Repository navigation
packages: the publish-drafts door accepts a non-string message and publishes with the default note instead of refusing it 400 #28452
Description
domain:spec#4 · marchtian · session_017ihL2fi9zfJhUTubyJYb6V
Filing gate: ② a finding a dev report carried out of scope (#28406 item 4's dev, draft PR #28447, out-of-scope finding 1, os-dev-report 6546543076). ⛔ Not a claim. No grade: triage sets it.
Reader: domain:server, packages/runtime/src/domains/packages.ts (the POST /packages/:id/publish-drafts door, ≈L1890–1915); next PR after #28414 lands, since #28414 is editing the same file now.
Dedupe (open AND closed): "publish-drafts message validation" → 9 hits, none about the request body's message (closest: #7023 capability floor, #24253 backfill, both closed).
reach: public HTTP entry, measured by #28447's conformance suite: POST /api/v1/packages/:id/publish-drafts with {"message": 42} answers 200 and publishes with the default "publish app package …" note.
What is wrong. #28447 declares the door's body as PublishPackageDraftsRequestSchema (message?: string, backfill?: { object, field }[], unknown keys stripped). The door does not parse its body with it: it forwards message only when it is a string and silently drops anything else, so a caller that sends a number, an object or an array gets a 200 and a history row with the default note, never learning its note was ignored. backfill is already judged by the protocol (400 VALIDATION_ERROR), so only message diverges.
Wanted. The door parses its body with PublishPackageDraftsRequestSchema and refuses a body the schema refuses with 400 VALIDATION_ERROR naming message. Unknown keys stay stripped (the SDK still sends its deprecated opts.actor). Flip the known-divergence pin in packages/runtime/src/domains/packages-publish-drafts-request-conformance.test.ts (added by #28447) and the matching sentence of the route-ledger row note.
Not here. The body actor reads on the six sibling package doors and the app re-save (#28414).
Links back: #28406, PR #28447, #28414, ADR-0146 D1.
Blocked-by: #28447
Activity
objectstack-fleet commentedon Oct 31, 2026
triage#1 · os-zhuang · session_01AavokzJ5DndAwitDXvKy4U
Path: 错的必须被响亮拒绝并给处方 | none | P③
Triage: p3 ·
domain:server·area:devpath·pm:blockedon #28447 · 2026-10-31T17:55Z⛔ Not a claim.
POST /packages/:id/publish-draftswith a non-stringmessageanswers 200 and publishes with the default note, instead of refusing. Only the history note is lost, so the grade is p3.PublishPackageDraftsRequestSchema, refuse 400VALIDATION_ERRORnamingmessage, keep unknown keys stripped, and flip feat(spec): declare the publish-drafts request body, so the change note is part of the published API contract #28447's known-divergence pin. Serial after runtime: the package doors record whateveractorthe request body names — publish, save, discard, revert, rollback, reassign and duplicate write a caller-chosen name into metadata history #28414, which edits the same file.Blocked-by: #28447is added to the body.pm:blocked.Generated by Claude Code
objectstack-fleet commentedon Oct 31, 2026
triage#1 · os-zhuang · session_01AavokzJ5DndAwitDXvKy4U
Path: none
Triage: unblocked · p3 · 2026-10-31T18:53Z
⛔ Not a claim.
Blocked-by: #28447, and PR feat(spec): declare the publish-drafts request body, so the change note is part of the published API contract #28447 merged at 2026-10-31T18:17Z, soPublishPackageDraftsRequestSchemais onmainnow.pm:blockedis removed. It stays at p3 withoutpm:queue, and it stays serial after runtime: the package doors record whateveractorthe request body names — publish, save, discard, revert, rollback, reassign and duplicate write a caller-chosen name into metadata history #28414, which edits the same file.Generated by Claude Code
objectstack-fleet commentedon Nov 1, 2026
domain:server#2 · os-project-manager · session_0186vfjHHMsRXC9EUT9hTFMo
Claim: PM loop round 4 · card thread · 2026-11-01T03:52Z
Session:
session_0186vfjHHMsRXC9EUT9hTFMo(the seat); the card thread issession_01FEkQ5kzB44oaLQ7JxbMKk9Account:
os-project-manager(the seat's linked user; the card's assignee)Branch:
claude/project-thread-x4768u(the card thread's harness-pinned branch; it names no issue, so this claim is the identity record)Worktree: the card thread's own container checkout
Domain:
domain:serverSeat:
domain:server#2Ruling-ref: the maintainer, 2026-11-01T03:46Z: 「server 车道现在就是你负责，任务有一大堆啊，都可以派，包括 p3」, with 2026-10-26T10:29Z 「p1 p2 处理完了，就可以处理 p3」. Triage
6547072197/ unblock6547725928: parse the body withPublishPackageDraftsRequestSchema, refuse 400VALIDATION_ERRORnamingmessage, keep unknown keys stripped, flip #28447's known-divergence pin. ⛔ Noactorchange (#28414, closed).File surface:
packages/runtime/src/domains/packages.ts(thePOST /packages/:id/publish-draftsdoor),packages/runtime/src/domains/packages-publish-drafts-request-conformance.test.ts(the pin to flip), the route-ledger row note, tests, and a changeset.Container & model:
M,mode:thread,model: opus(--tiernames no path mandate: PM's call, default),effort: highClause-②: yes (expected: narrowing — a body answered 200 today is refused; a contract review at
CONTRACT_REVIEW_TIERis owed before the queue)Metadata-protocol: none (expected; the dev measures and declares)
Responsibility: the code is the runtime's package publish-drafts door · the platform path is the package history note that door stamps · reached by an API caller or SDK that sends a non-string
messageThread-read: none
Premise: holds (read 2026-11-01T03:52Z at
origin/main:PublishPackageDraftsRequestSchemais onmainsince PR #28447, and the door forwardsmessageonly when it is a string); the dev re-measures firstSerial constraints cleared: PR #28447 merged and #28414 closed; no open PR touches
packages.tsat this readResume-from: none — fresh from
origin/mainState: →
pm:dispatched, assigned toos-project-manager, recorded by this claim.Generated by Claude Code
objectstack-fleet commentedon Nov 1, 2026
domain:server#2 · os-project-manager · session_01FEkQ5kzB44oaLQ7JxbMKk9
os-dev-report
{
"issue": 28452,
"status": "done",
"branch": "claude/project-thread-x4768u",
"pr": "#28527",
"session": "session_01FEkQ5kzB44oaLQ7JxbMKk9",
"premise_still_valid": true,
"summary": "POST /packages/:id/publish-drafts now parses body.message with PublishPackageDraftsRequestSchema.shape.message and refuses a note it refuses (number, object, array, null) with deps.error(text, 400) = 400 VALIDATION_ERROR, text 'Invalid publish-drafts body — message: Invalid input: expected string, received number. Nothing was published: ...', placed after the 404/501 beside the protocol's backfill judgement; the forwarded note is the parsed value. backfill is NOT judged at the door (a whole-body parse would double-judge it with a second sentence and no issues[]), so its one refusal is unchanged; unknown keys (actor) still ignored; actor handling untouched. Flipped the known-divergence pin, the route-ledger row note, and the spec PublishPackageDraftsRequestSchema docblock ('forwarded only when it is a string' became false). Changeset: runtime patch + spec patch (docblock), superseding the pending 28406 changeset's 'Nothing changes on the wire' sentence. Departures: Clause-② declared 'no (narrowing)' not the expected 'yes (narrowing)' (clause2-line.mjs: yes(narrowing) = widens one surface and narrows another; nothing is widened); file surface adds packages/spec/src/api/protocol.zod.ts beyond the claim, please amend.",
"tests": "Head af581fe. Red first on the base door: both new cases red '{"message":42}: expected 200 to be 400', 11 green. Green: 13/13 (packages-publish-drafts-change-note.integration.test.ts real door+protocol+ObjectQL+on-disk SQLite: 42/{}/[] refused 400 VALIDATION_ERROR, no publish history row, no commit, then the same draft publishes with a string note; packages-publish-drafts-request-conformance.test.ts: 5 bodies refused, publishPackageDrafts and app re-save never called). Ablation via scripts/ablation-replace.mjs anchor 'if (!declaredMessage.success) {' -> 'if (false && !declaredMessage.success) {' (restores string-only forward): anchor 1->0, blob ba0e3795ad83->5906236be414, 2 refusal cases red, 11 controls green, restore blob == HEAD, git diff HEAD empty; tests import the door from src/ so no build between mutation and run. pnpm --filter @objectstack/runtime typecheck exit 0; pnpm --filter @objectstack/runtime test: Test Files 498 passed (498), Tests 8085 passed | 19 skipped (8104).",
"gates": "Local on af581fe: dispatch-gates --commands --repo objectstack-ai/objectstack = 84 families, exit codes captured before any pipe; --ran: '84 derived famil(ies) accounted for — 84 run, 0 NOT-MEASURED'. First reads exit 3 for check-plugin-teardown-shape --self-test (fixed by git fetch --depth=1 origin 621a487..., then exit 0) and check:dual-build-cjs-loads (after full pnpm build --concurrency=2, 116/116, exit 0). Hand: check-platform-checklist --changed-from origin/main exit 0; check-commit-card-trailers --range origin/main..HEAD exit 0; eslint --no-inline-config on the 5 touched source files exit 0 (no lint script in runtime/spec). CI check-runs: in_progress at report time, the seat reads them.",
"dogfood_battery": "af581fe0 · VERDICT batch-last-exit 0 (build 116/116 and dual-build exit 0 read separately from their logs) · Test Files 363 passed | 3 skipped (366) · Tests 2932 passed | 28 skipped (2960) · no failure",
"mcp_calls": "0",
"api_writes": "2 — 1 relay pr_create (POST /repos/objectstack-ai/objectstack/dispatches -> PR #28527, no labels, no assignees), 1 os-dev-report comment (POST /repos//issues/28452/comments via post-stamped); plus 1 git push (not REST)",
"open_questions": [],
"out_of_scope_findings": [
"none"
]
}
Generated by Claude Code
objectstack-fleet commentedon Nov 1, 2026
domain:server#2 · os-project-manager · session_0186vfjHHMsRXC9EUT9hTFMo
2026-11-01T04:54Z · claim
6553080672amended (file surface)The card thread found a schema docblock this fix makes false.
packages/spec/src/api/protocol.zod.ts, thePublishPackageDraftsRequestSchemadocblock, saysmessageis "forwarded only when it is a string". Once the door parses the body with the schema, that sentence no longer holds.patchline for@objectstack/specin the changeset. It is a comment-only edit in the same defect, and no governed path is involved.no (narrowing), because nothing is widened. The narrowing still owes the contract review atCONTRACT_REVIEW_TIERbefore the queue, and the seat runs it on PR fix(runtime)!: the publish-drafts door refuses a non-string change note 400 VALIDATION_ERROR naming message (#28452) #28527.Generated by Claude Code
objectstack-fleet commentedon Nov 1, 2026
domain:server#2 · os-project-manager · session_0186vfjHHMsRXC9EUT9hTFMo
Landing record · #28452 · PR #28527
domain:serverseat 2 ·session_0186vfjHHMsRXC9EUT9hTFMo· 2026-11-01T05:40Zgit ls-remote origin 'refs/heads/gh-readonly-queue/main/pr-28527-*'git merge-base --is-ancestor 12333bae origin/maingit grep -c shape.message.safeParse origin/main -- packages/runtime/src/domains/packages.ts12333bae.POST /packages/:id/publish-draftsrefuses a non-stringmessage(a number, object, array ornull) with 400VALIDATION_ERRORnamingmessage, before anything is published. feat(spec): declare the publish-drafts request body, so the change note is part of the published API contract #28447's known-divergence pin is flipped, and the route-ledger note and thePublishPackageDraftsRequestSchemadocblock now match.@objectstack/runtimeand@objectstack/specpatch.message, unknown keys (still stripped, so a body withactoranswers 200), and the singlebackfillrefusal.Release: claim
6553080672(amended6553627544;session_0186vfjHHMsRXC9EUT9hTFMo, branchclaude/project-thread-x4768u) · landed.pm:dispatchedremoved; assignee cleared; the card closed on merge.Generated by Claude Code