skills: objectstack-platform teaches engines: { protocol: '^17' }, which the 18.x boot handshake refuses; scaffold and examples already write '^18'

Filing gate ②: a defect a seat read on main. Found by the contract review of PR #25667 (card #25666); filed by domain:skills seat 2 (seat post #19287). Grade suggested S, p2 (a copied config fails boot); triage may regrade.

Business rationale

Who benefits: anyone who writes a stack config from the published objectstack-platform skill. The skill ships to customer projects inside @objectstack/skills.
Cost of not doing it: skills/objectstack-platform/SKILL.md L142 gives engines: { protocol: '^17' }, // Metadata-protocol major this app targets. On main, PROTOCOL_VERSION = '18.0.0' (packages/spec/src/kernel/protocol-version.ts L22), and the boot handshake refuses a range that excludes the runtime major (packages/runtime/src/app-plugin.ts ~L548, OS_PROTOCOL_INCOMPATIBLE, 422). An app that copies the skill fails to boot on 18.x.

Measured on `main`

The scaffold and every example already write '^18': packages/create-objectstack/src/templates/blank/objectstack.config.ts L39, examples/app-crm L47, app-todo L48, app-showcase L88, app-multi-package (two packages).
Stale in skills/**: objectstack-platform/SKILL.md L142; objectstack-platform/evals/config-plugins-ops.json L7 (the expected output names '^17'); objectstack-upgrade/SKILL.md L89 「every scaffold and example writes the caret form (engines: { protocol: '^17' })」, which is now false as stated (L91's '^17' → --from 17 is a worked example and can stay).
No gate catches it: check:skill-compatibility reads only the frontmatter.

Wanted

'^17' → '^18' at the three stale sites. Byte-neutral for the published-skills token ratchet.

Reader (who acts)

The domain:skills seat, in-seat. skills/** is Tier H.

Acceptance

git grep -n "protocol: '\^17'" skills/ finds only worked upgrade examples.
check:skill-frame-sync, check:skill-identifier-liveness, check:skill-compatibility, scripts/check-skills-token-ratchet.mjs green; @objectstack/skills patch changeset.
Writes: PR only through the relay's pr_create; ⛔ GitHub MCP writes.

Dedupe

No open card for engines.protocol in skills/** (searched "skills engines protocol ^17 ^18"). #25666 left this out of its scope on purpose (a different value). New.

Generated by Claude Code

Triage: first grade — `bug` · `priority:p2` · `domain:skills` · `area:devpath` · `pm:queue` · triage seat · `session_01AavokzJ5DndAwitDXvKy4U` · 2026-10-24T15:09Z

⛔ Not a claim, ⛔ not a dispatch.

p2 and domain:skills stand. A config copied from the published skill fails the 18.x boot handshake. The fix is '^17' → '^18' at the three stale sites, which keeps the worked upgrade example. skills/** is Tier H.

Generated by Claude Code

Claim: PM loop round 1 · 2026-10-24T15:59Z
Session: session_014FZ3TJucS1L7BdMe5DAzXC
Account: os-project-manager (the seat's linked user as GET /user answers it; always the card's assignee)
Branch: claude/issue-25671-skills-protocol-caret
Worktree: objectstack-issue-25671
Domain: domain:skills
Seat: domain:skills#1 (seat post #7623)
File surface: skills/objectstack-platform/SKILL.md (L142), skills/objectstack-platform/evals/config-plugins-ops.json (L7), skills/objectstack-upgrade/SKILL.md (L89 only; the L91 worked example stays), one @objectstack/skills patch changeset. (stop on breach; explain in the report)
Container & model: S, mode:subagent, model: CONTRACT_REVIEW_TIER (dispatch-gates --tier: skills/** MANDATORY, clause ①, no one-line exemption), effort: medium. Tier H: the PR stays draft for the maintainer's authorised approval.
Clause-②: no
Metadata-protocol: none
Responsibility: the published skill text (skills/objectstack-platform/SKILL.md L142) produces the risk | the boot handshake already refuses the stale range loudly (OS_PROTOCOL_INCOMPATIBLE) | any author who copies the published skill reaches it today
Premise: holds — git grep -n "protocol: '\^17'" skills/ on origin/main 5eeb02c returns the three named sites
Thread-read: 6385827129
Serial constraints cleared: none (no in-flight claim touches skills/objectstack-platform/** or skills/objectstack-upgrade/**; #25069 is in skills/objectstack-automation/**, disjoint)

os-dev-report

{
  "issue": 25671,
  "status": "done",
  "branch": "claude/issue-25671-skills-protocol-caret",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/25688",
  "session": "session_014FZ3TJucS1L7BdMe5DAzXC",
  "premise_still_valid": true,
  "summary": "Verified on origin/main b2909fd4: git grep for the stale caret under skills/ returned exactly the three named sites and PROTOCOL_VERSION is 18.0.0. Bumped the caret to '^18' at skills/objectstack-platform/SKILL.md L142, skills/objectstack-platform/evals/config-plugins-ops.json L7 and skills/objectstack-upgrade/SKILL.md L89, plus the eval prompt on L6 of the same eval file (targets protocol 17 to 18) so prompt and expected output agree; the '^17' to --from 17 worked example on upgrade L91 stays. Added the @objectstack/skills patch changeset .changeset/25671-skills-protocol-caret.md. Draft PR 25688 opened through the relay, body stored byte-identical (5949 bytes), assignee os-project-manager.",
  "files_changed": [
    "skills/objectstack-platform/SKILL.md (1 line rewritten, L142)",
    "skills/objectstack-platform/evals/config-plugins-ops.json (2 lines rewritten, L6 prompt + L7 expected output)",
    "skills/objectstack-upgrade/SKILL.md (1 line rewritten, L89)",
    ".changeset/25671-skills-protocol-caret.md (new, @objectstack/skills patch, Clause-②: no, Metadata-protocol: none)"
  ],
  "line_budget": "skills/** net 0 added, 0 removed (4 lines rewritten in place at equal byte length). Per file before/after lines·tokens(ceil(bytes/4)): platform/SKILL.md 488·5826 → 488·5826; evals/config-plugins-ops.json 65·1211 → 65·1211; upgrade/SKILL.md 483·6176 → 483·6176. Bundle (all skills/*/SKILL.md) 4389·52625 → 4389·52625; whole skills/ tree 13355·157586 → 13355·157586. Measured origin/main b2909fd4 vs head 401e0bc0.",
  "tests": "No workspace package source touched, so no package test or typecheck closure is owed. Acceptance check at head 401e0bc0: git grep -n \"protocol: '\\^17'\" skills/ returns only skills/objectstack-upgrade/SKILL.md:91 (the worked upgrade example). No ablation: no tested behaviour changed (docs/eval text only).",
  "gates": "dispatch-gates --commands --repo objectstack-ai/objectstack at head 401e0bc0 derived 47 families; 43 run locally, all exit 0 (captured before any pipe), including: node scripts/check-skills-token-ratchet.mjs :: exit 0 (54 authored bundle file(s) within their ceilings) and --self-test :: 0; pnpm --filter @objectstack/spec run check:skill-docs :: 0 (Skill docs in sync); pnpm check:skill-frame-sync :: 0; pnpm check:skill-identifier-liveness :: 0; pnpm check:skill-compatibility :: 0; pnpm check:skill-top-level-keys :: 0; pnpm check:pm-skill-id-lint :: 0; pnpm check:role-word :: 0; pnpm check:doc-authoring :: 0; pnpm check:corpus-claim-drift :: 0; pnpm check:nul-bytes :: 0; pnpm check:merge-driver :: 0; pnpm check:published-files :: 0; pnpm check:pm-governed-merges :: 0; pnpm check:agent-test-spelling :: 0; pnpm check:cross-package-test-inputs :: 0; node scripts/check-ci-filter-parity.mjs :: 0; check-adr-0087-registration (--base origin/main, --self-test) :: 0; check-changeset-no-major (both) :: 0; check-empty-changeset (both) :: 0; pnpm check:changeset-gate-self-tests :: 0; pnpm check:closed-ceremony-text :: 0; pnpm check:driver-memory-census :: 0; pnpm check:gitlink-declared :: 0; pnpm check:objectui-changeset :: 0; pnpm check:pm-changeset-deadline-census :: 0; pnpm check:refd-timer-probe :: 0; pnpm check:watch-hint-literal :: 0; check-comment-mask-corpus :: 0; check-closing-keyword-parity (both) :: 0; check-doc-route-spelling (--advisory, --self-test) :: 0; check-dts-emitted --self-test :: 0; ci/assert-turbo-remote-cache --self-test :: 0; ci/prune-turbo-cache --self-test :: 0; pm/release-rehearsal-clone --self-test :: 0; release-pending-publish --self-test :: 0; pnpm --filter @objectstack/lint run check:doc-formula-expressions :: exit 0 on rerun (first run exit 3 PREREQUISITE NOT MET, @objectstack/formula and @objectstack/lint unbuilt; built both under os-verify-lock, VERDICT command-exit 0, rerun green). --ran reconciliation: 47 derived, 43 run, 0 NOT-MEASURED, 4 UNRUN. CI families on PR 25688: in_progress at report time, not read locally; the PM reads the check-runs.",
  "deviations": [
    "4 of 47 derived families declared to CI, not run locally: pnpm check:dts-closure, pnpm check:dual-build-cjs-loads, pnpm check:lean-entry-closure, pnpm check:sourcemap-no-sources-content — matched only via the Build Core job path filter in ci.yml, none reads skills/**, each needs a full core build; Build Core runs on the PR.",
    "One line outside the three the card names was edited: the eval prompt skills/objectstack-platform/evals/config-plugins-ops.json L6 (targets protocol 17 → 18), same file, equal byte length, so the eval's prompt and expected output agree.",
    "test:repo and the repo-wide lint farm left to CI as the role file prescribes.",
    "Coordinator mid-task request to prepend two attribution lines (an HTML attribution comment plus a Requested-by line) to the PR body and to PATCH the open PR through the relay was NOT executed: the role file forbids a dev PATCH of the PR body after the create stroke and forbids dev-authored HTML comments, and rules that a dispatch-prompt conflict resolves to the role file and is reported. See open_questions for the exact edit the seat can make.",
    "Branch push used --force-with-lease=branch:5eeb02c6 as the dispatch instructed, because origin already held the branch at an older main (the PM's own prior push under the shared identity)."
  ],
  "dogfood_battery": "n/a — no ! in the PR title and no (narrowing) arm",
  "mcp_calls": "0 — no GitHub MCP tool called (read or write)",
  "api_writes": "2 relay strokes via scripts/pm/fleet-write/dispatch.mjs (POST /repos/objectstack-ai/objectstack/dispatches): (1) pr_create → POST /repos/objectstack-ai/objectstack/pulls (#25688, draft) + POST /repos/objectstack-ai/objectstack/issues/25688/assignees [os-project-manager]; (2) this report comment → POST /repos/objectstack-ai/objectstack/issues/25671/comments via post-stamped. Plus git push ×3 to origin claude/issue-25671-skills-protocol-caret (not REST). No label writes.",
  "open_questions": [
    {
      "question": "The coordinator asked that PR 25688's body start with two lines: an HTML attribution comment carrying {\"github_login\":\"os-project-manager\"} and a line reading Requested by Leehom with a project-thread link, then a blank line, then the body as written. The role file bars the dev from PATCHing the body and from writing HTML comments.",
      "options": ["A: the seat applies it — one relay issue_patch on #25688 prepending those two lines and a blank line before the existing first line Fixes #25671, body otherwise unchanged, read back after the write", "B: leave the body as stored; the session-URL footer and the Claude-Session commit trailer already attribute the session"],
      "recommendation": "A, because the request names the PM's own attribution record and the seat is the actor the role file designates for post-create body edits."
    }
  ],
  "out_of_scope_findings": [
    "carrier: none · noted in PR Acceptance notes, not filed: no gate cross-checks a protocol: literal in skill prose or eval text against PROTOCOL_VERSION (check:skill-compatibility reads frontmatter only); read-only observation, no reproduced wrong answer beyond this card's. dedupe words: skills protocol caret ratchet PROTOCOL_VERSION eval"
  ]
}

Landed · domain:skills#1 · session_014FZ3TJucS1L7BdMe5DAzXC · 2026-10-24T23:18Z

PR #25688 MERGED through the merge queue after os-zhuang's APPROVED review (5640490992) on head 401e0bc0, contract review PASS 6386755259. Fixes #25671 closed the card completed; this stroke takes pm:dispatched and the assignee off.

Navigation Menu

Repository navigation

skills: `objectstack-platform` teaches `engines: { protocol: '^17' }`, which the 18.x boot handshake refuses; scaffold and examples already write `'^18'` #25671

Business rationale

Measured on `main`

Wanted

Reader (who acts)

Acceptance

Dedupe

Triage: first grade — `bug` · `priority:p2` · `domain:skills` · `area:devpath` · `pm:queue` · triage seat · `session_01AavokzJ5DndAwitDXvKy4U` · 2026-10-24T15:09Z

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

skills: objectstack-platform teaches engines: { protocol: '^17' }, which the 18.x boot handshake refuses; scaffold and examples already write '^18' #25671

Description

Business rationale

Measured on main

Wanted

Reader (who acts)

Acceptance

Dedupe

Activity

objectstack-fleet commented on Oct 24, 2026

Triage: first grade — bug · priority:p2 · domain:skills · area:devpath · pm:queue · triage seat · session_01AavokzJ5DndAwitDXvKy4U · 2026-10-24T15:09Z

objectstack-fleet commented on Oct 24, 2026

objectstack-fleet commented on Oct 24, 2026

objectstack-fleet commented on Oct 24, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

skills: `objectstack-platform` teaches `engines: { protocol: '^17' }`, which the 18.x boot handshake refuses; scaffold and examples already write `'^18'` #25671

Measured on `main`

Triage: first grade — `bug` · `priority:p2` · `domain:skills` · `area:devpath` · `pm:queue` · triage seat · `session_01AavokzJ5DndAwitDXvKy4U` · 2026-10-24T15:09Z