docs(skills): objectstack-api stops teaching an app to mount routes on http.server (#23787)

[objectstack-fleet]

Fixes #23787
Clause-②: no

What changed

Ruling C′ item 2 on #23128 (record 6142279866, the maintainer's 「同意」) retired the imperative http.server mount as an app-author surface: an app declares apis:, computes in a flow, and registers code as a stack function or a connector; the http.server service itself stays the platform plugins' own door. This PR is the skill half of that item plus the ADR-0088 row the filer added. The spec half is PR #23785 (#23216); none of its files are touched here, and the skill wording follows its retire texts where they say the same thing.

• skills/objectstack-api/SKILL.md
  • Table "Choosing between apis: and a code handler": the http.server mount (plugin code) row is replaced by A flow that runs your code — point a type: 'flow' endpoint at a flow whose script node names a stack function (defineStack({ functions })), or whose connector_action node calls a declared connector (outbound). The apis: row is unchanged.
  • The paragraph under the table now names the inbound type: 'api' flow hook (a pointer to objectstack-automation → Inbound webhook (api) triggers, which already teaches hookId / secret), states that an app never mounts on http.server (same reasons as PR docs(spec): the routes / App.apis retire text stops sending app authors to an imperative http.server route (ruling C′ item 2) #23785's retire texts: no caller identity, auth gate, rate limit, namespace carve-out or OpenAPI entry), and names the three cases with no app surface today instead of inventing a door.
  • Section "Code routes: mounting on http.server" (26 lines including its leading separator) is deleted, with the deprecated-alias, kernel:listening and Hono-sealing notes.
• skills/objectstack-api/evals/endpoints-auth-routes.json, eval id 3. The Stripe prompt is kept (it is the realistic lure for the retired door) and the eval now expects the skill's statement of the gap plus what holds for code: expected_output rewritten; must_contain = x-objectstack-signature, functions; must_not_contain = http.server, kernel:ready, getService. Chosen over re-targeting at a served case because the eval's job is to catch an authoring AI reaching for the retired door on exactly this prompt; evals 1 and 2 already cover the served apis: cases.
• docs/adr/0088-metadata-kind-admission-and-retirement.md: one **Amended** entry on the Status line (2026-10-16, skills(objectstack-api): the "Choosing between apis: and a code handler" table and the "Code routes" section still teach app authors to mount on http.server, which ruling C′ (#23128) retired as an app-author surface #23787, citing showcase: the "Recalculate Estimate" / "Recalculate Selection" api actions answer 500 — recalc-endpoint.ts calls ctx.ql.update with no execution context, which the security layer refuses as a principal-less write #23128 ruling C′ item 2, record 6142279866), and the router row points at it. The router KIND's retirement is unchanged; the amendment narrows only the delivered form "imperative http.server mounts" to the platform plugins. No other ADR edit.
• .changeset/23787-api-skill-retired-route-door.md: @objectstack/skills patch with Clause-②: no. Measured: skills/** ships through packages/skills (files[] = dist, README.md, CHANGELOG.md; scripts/sync-catalog.mjs copies skills/** into dist/skills/), so the text edit publishes. docs/adr/** ships in no package's files[] (every tracked package.json scanned at b485122: zero adr/docs entries), so the ADR edit owes nothing.

Measurements behind the new text (base b485122)

• apis: types: packages/spec/src/api/endpoint.zod.ts:174 — only object_operation and flow execute; script / proxy are refused at publish (endpoint-publish-gate.ts:370-371). The describe text already sends script logic to "a flow whose script node runs your registered function" and outbound calls to "a flow using a declared connector".
• Stack function from a flow: the script node's config.function resolves through engine.resolveFunction() to defineStack({ functions }) (packages/services/service-automation/src/builtin/screen-nodes.ts:31-33, 409-419; engine.ts:4266-4275; packages/spec/src/stack.zod.ts:992-1047). A type: 'flow' endpoint runs that flow (packages/runtime/src/endpoint-executor.ts:253-262, 484-585).
• Connectors: all five at this base (connector-imap, -mcp, -openapi, -rest, -slack) are outbound only — they registerConnector / registerConnectorProvider with the automation service so a flow's connector_action node can dispatch to them; imap is a read-only session that registers no connector_action handler. Zero hits for http.server, IHttpServer or .post( under packages/connectors/*/src.
• Inbound hook (PM reading b4, confirmed): packages/triggers/trigger-api/src/api-trigger.ts arms POST /api/v1/automation/hooks/:flowName/:hookId for a type: 'api' flow; the start node's config.secret is required (engine.ts:10807-10825); it verifies only ObjectStack's x-objectstack-signature in the timestamped form through core's verifyHttpSignature (api-trigger.ts:142-170, 346-348), requires a JSON object body (400 otherwise) and answers 202 queued. It is app-authorable (a flow is app metadata; skills/objectstack-automation/SKILL.md:340-354 teaches it), so the skill names it — for a sender that signs with ObjectStack's own scheme.
• Streaming: endpoint-executor.ts answers { status, body: { success: true, data } } for both executing types (:291, :567-585); there is no streaming path.
• Real-app precedent: examples/app-showcase mounts no route handler of its own; its recalc is a declared flow endpoint (src/coverage.ts:133, objectstack.config.ts:259).

Three cases with no app surface today — open questions for the maintainer

The seat puts these on the card; they are stated in the skill as gaps, not routed to the retired door.

1. A third-party callback verified by its own signature over the raw body (the eval's Stripe case): trigger-api answers 401 INVALID_SIGNATURE to any post without a valid x-objectstack-signature (api-trigger.ts:321-348), and a flow — whether started by the hook or by a type: 'flow' endpoint — receives the parsed JSON body as its trigger record, never the raw bytes or the request headers (api-trigger.ts:357-366; endpoint-executor.ts:567 passes ctx.body to buildAutomationContext). A stack function therefore cannot verify Stripe-Signature.
2. A streaming response: declared endpoints answer one JSON envelope (endpoint-executor.ts:291, 585).
3. A protocol the platform does not speak: no declared surface exists by definition, and http.server is an HTTP door in any case.

skills/** readings

File	Lines before → after	Tokens before → after (ceiling)
skills/objectstack-api/SKILL.md	434 → 415 (−19)	4754 → 4642 (6314; headroom 1560 → 1672)
skills/objectstack-api/evals/endpoints-auth-routes.json	55 → 55 (0)	1042 → 1039 (1042; headroom 0 → 3)
Whole package (sum of every skills/*/SKILL.md)	4408 → 4389 (−19)	bundle total (whole shipped tree) 155016 → 154901

node scripts/check-skills-token-ratchet.mjs verdict lines:

• before, at b485122: ✓ check-skills-token-ratchet: skills/objectstack-api/SKILL.md is 4754 tokens (ceiling 6314; headroom 1560). · ✓ check-skills-token-ratchet: skills/objectstack-api/evals/endpoints-auth-routes.json is 1042 tokens (ceiling 1042; headroom 0).
• after, at b4ea190: ✓ check-skills-token-ratchet: skills/objectstack-api/SKILL.md is 4642 tokens (ceiling 6314; headroom 1672). · ✓ check-skills-token-ratchet: skills/objectstack-api/evals/endpoints-auth-routes.json is 1039 tokens (ceiling 1042; headroom 3).

No CEILINGS row moves. The eval's growth is paid inside the file by content, not re-wrapping (its line count is unchanged; the byte count fell 4165 → 4156).

Verification (local, head b4ea190)

Derived after the final commit with node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack (no paths): 49 commands — the PM's 37 at 46ca793 plus 12 changeset-family gates the new .changeset/*.md pulls in. Every command was run with its exit code captured before any pipe and reconciled: dispatch-gates --ran → "49 derived famil(ies) accounted for — 45 run, 4 NOT-MEASURED (4 DERIVED from a recorded exit 3)", exit 0, 0 UNRUN.

• 45 × exit 0, among them check-skills-token-ratchet (+ --self-test), check:skill-docs, check:adr-anchors, check-adr-links (+ --self-test), check-adr-symbol-anchors, check:skill-identifier-liveness, check:skill-frame-sync, check:skill-compatibility, check:role-word, check:doc-authoring, check:pm-skill-id-lint, check:nul-bytes, check:published-files, check-empty-changeset, check-changeset-no-major, check-adr-0087-registration, and check:doc-formula-expressions (first exit 3 for an unbuilt @objectstack/lint; rebuilt with pnpm exec turbo run build --filter=@objectstack/formula --filter=@objectstack/lint --concurrency=2 under os-verify-lock.sh, VERDICT command-exit 0, 88 s held; rerun exit 0).
• 4 NOT MEASURED locally (exit 3, PREREQUISITE NOT MET): check:dts-closure, check:dual-build-cjs-loads, check:lean-entry-closure, check:sourcemap-no-sources-content. They read the whole repository's dist/; a fresh worktree has none, and this diff touches no package, so the whole-repo build is not owed here. They enter the derivation only through ci.yml's Build Core job filter on skills/**, and CI measures them after its full build.
• No package source changed, so no package test suite or typecheck is owed; no tested behaviour changed, so no ablation.

Acceptance notes

• Observation, not filed (class none; carrier: none): skills/objectstack-platform/rules/plugin-lifecycle.md:134 reads ctx.getService('http-server'), the deprecated alias; the api-skill text deleted here recorded that the alias is absent on the provider path that registers no alias. Platform-plugin teaching outside this card's file list.
• The remaining kernel:ready / kernel:listening mentions in skills/ (objectstack-platform, objectstack-i18n) teach plugin lifecycle to platform-plugin authors, the primitive the ruling leaves untouched. Out of scope.
• The spec's describe texts still spell the executing-type statement as "17.x" (endpoint.zod.ts:174-175, openapi-endpoints.ts:218); the skill keeps that spelling at its L154 for consistency with the spec. Not this card.

维护者速读(草稿)

改了什么:objectstack-api 技能不再教应用作者把路由挂到 http.server 上。决策表的「需要代码」一行改为:声明 type: 'flow' 端点,代码以 stack function(defineStack({ functions }))由 flow 的 script 节点运行,或以 connector 由 connector_action 节点调用;新增一句指向 type: 'api' 入站 webhook;整节「Code routes」删除。eval 3 改为期待这套说法。ADR-0088 状态行加一条 Amended,router 行指向它。附 @objectstack/skills patch changeset。

为什么改:#23128 裁决 C′ 第 2 条(记录 6142279866)已把 http.server 的命令式挂载从应用作者面退役;发布的技能文本和它的 eval 仍在教这扇门,写元数据的 AI 会照表执行。spec 半边在 PR #23785,本 PR 是技能半边加 ADR 行。

风险与代价(含回滚):只改文本,运行时零变化;技能行数与 token 都下降(SKILL.md 434→415 行、4754→4642 tokens;eval 1042→1039 tokens,天花板不动)。风险在于三类场景(第三方自带签名的回调、流式响应、平台不说的协议)今天确实没有应用可声明的落点,技能如实写明「没有」而不发明门;若维护者另有裁定,只需改那一句。回滚 = revert 本 PR 一个 commit。

席位意见:(留空)

你要做的:审批 Tier H(skills/** + docs/adr/**);并回答一个问题 —— 上述三类无落点场景(尤其 Stripe 这类自带签名、需原始请求体的回调)是否要给应用一个声明式入口,还是维持「平台插件自建门」的现状。

---

Generated by Claude Code

[objectstack-fleet]

维护者速读

改了什么

• skills/objectstack-api/SKILL.md:
  • 「apis: 与代码处理器怎么选」表的第二行原来是「http.server 挂载(插件代码)」,现改为「A flow that runs your code」:声明一个 type: 'flow' 端点,代码以 stack function(defineStack({ functions }))由 flow 的 script 节点运行,或由 connector_action 节点调用已声明的 connector(出站)。
  • 表下一段:指向 type: 'api' 入站 webhook(只认 ObjectStack 自己的 x-objectstack-signature);写明「应用从不挂载到 http.server」;并点名今天没有应用落点的三类场景。
  • 整节「Code routes: mounting on http.server」删除。
• eval 3 保留 Stripe 提问,改为期待上面这套说法,并把 http.server / kernel:ready / getService 列入不得出现。
• ADR-0088 状态行加一条 Amended,router 行指向它;router KIND 的退役结论不变。
• 附 @objectstack/skills patch changeset。

为什么改

• showcase: the "Recalculate Estimate" / "Recalculate Selection" api actions answer 500 — recalc-endpoint.ts calls ctx.ql.update with no execution context, which the security layer refuses as a principal-less write #23128 裁决 C′ 第 2 条(记录 6142279866,你的「同意」)已把命令式 http.server 挂载从应用作者面退役。
• 发布出去的技能和它的 eval 还在教这扇门,写元数据的 AI 会照表执行。spec 那一半在 PR docs(spec): the routes / App.apis retire text stops sending app authors to an imperative http.server route (ruling C′ item 2) #23785,本 PR 是技能一半加 ADR 一行。

风险与代价(含回滚)

• 纯文本,运行时零变化。SKILL.md 434 → 415 行、4754 → 4642 tokens;eval 1042 → 1039 tokens;上限一行不动。
• 三类场景今天确实没有应用可声明的入口:第三方自带签名、需要原始请求体的回调(Stripe 一类),流式响应,平台不支持的协议。技能如实写「没有」,不发明门。你若另有裁定,只需改这一句。
• 回滚:revert 本 PR。

席位意见

• 建议批准。席位逐句对过 main:
  • script 节点经 engine.resolveFunction 调用 defineStack({ functions }) 注册的函数(screen-nodes.ts L369 起);
  • connector_action 是已声明的节点类型,五个 connector 都只出站;
  • trigger-api 只验 x-objectstack-signature,入队后回 202(api-trigger.ts L373);
  • 「code-mounted route gets no caller identity, auth gate, rate limit, namespace carve-out or OpenAPI entry」与 PR docs(spec): the routes / App.apis retire text stops sending app authors to an imperative http.server route (ruling C′ item 2) #23785 的退役文字逐字一致。
• 隔离的达档契约复核由席位本轮发起,PASS 在案前不落地。你的批准可以先给。

你要做的

• 对 PR docs(skills): objectstack-api stops teaching an app to mount routes on http.server (#23787) #23807 给一个 APPROVED review。
• 另有一个不阻塞落地的问题:上述三类无落点场景要不要给应用开声明式入口。详见卡 skills(objectstack-api): the "Choosing between apis: and a code handler" table and the "Code routes" section still teach app authors to mount on http.server, which ruling C′ (#23128) retired as an app-author surface #23787 上席位的提问。

席位核对

Seat domain:skills#2 · session_01VqGhCg9wdsBXPz54uAEWg7 (os-elon-musk) · read 2026-10-16T04:02Z · head b4ea190791de50d7a5f2647813f91b1d418508b8 · verdict: ACCEPT (Tier H — stays draft for an authorized approval)

Implemented-by: claude/issue-23787-api-skill-retired-route-door
Reviewed-by: session_01VqGhCg9wdsBXPz54uAEWg7

1. Shape.
   • Draft PR against main. Body line 1 is Fixes #23787; line 2 is Clause-②: no, copied from claim 6207374288. No other closing keyword.
   • Files: skills/objectstack-api/SKILL.md, skills/objectstack-api/evals/endpoints-auth-routes.json, docs/adr/0088-metadata-kind-admission-and-retirement.md, .changeset/23787-api-skill-retired-route-door.md. These are exactly the claimed surface plus the changeset. Merge base b485122a7.
   • Disjoint from PR docs(spec): the routes / App.apis retire text stops sending app authors to an imperative http.server route (ruling C′ item 2) #23785's 17 files.
2. The new text against main, read by the seat.
   • 「script node names a stack function」: screen-nodes.ts L369–419. The script executor parses config.function and calls engine.resolveFunction; its refusal names defineStack({ functions }).
   • 「connector_action node calls a declared connector (outbound)」: connector_action is a declared node type in packages/spec/src/automation. The dev measured all five packages/connectors/* as outbound; none mounts a route.
   • 「a type: 'api' flow … verifies ObjectStack's own x-objectstack-signature, enqueues, and answers 202」: api-trigger.ts L142–170 (verification) and L373 (status: 202). The pointer target exists: skills/objectstack-automation/SKILL.md L340, 「Inbound webhook (api) triggers」.
   • 「An app never mounts on http.server — … no caller identity, auth gate, rate limit, namespace carve-out or OpenAPI entry」: verbatim from PR docs(spec): the routes / App.apis retire text stops sending app authors to an imperative http.server route (ruling C′ item 2) #23785's retire text, which passed its own contract review.
   • 「a declared endpoint answers one JSON envelope」: the dev cites endpoint-executor.ts L291 and L567–585. This is left to the at-tier reader.
   • The deleted section's only other dependents: none. http.server / Code routes occur in skills/ only in these two files at the base.
3. Eval 3. The Stripe prompt is kept, so it now pins the retired door's lure. must_contain holds two tokens the new text teaches; must_not_contain holds the three the old pattern needed. Valid JSON; 1039/1042 tokens, paid by content (byte count 4165 → 4156, line count unchanged, no re-wrap).
4. ADR-0088. One **Amended** entry on the Status line, in the repo's precedent shape (ADR-0005's line), and the router row points at it. The KIND's retirement is untouched. This follows AGENTS.md rule 13's amended-status-line route.
5. Changeset. @objectstack/skills patch, Clause-②: no. skills/** ships through dist (sync-catalog.mjs). docs/adr/** is in no package's files[] (the dev scanned every tracked package.json). The prose matches the diff.
6. Gates.
   • The dev's local union at b4ea19079: 49 derived (37 + 12 changeset families). 45 ran at exit 0; 4 are NOT MEASURED (check:dts-closure, check:dual-build-cjs-loads, check:lean-entry-closure, check:sourcemap-no-sources-content, whole-repo dist/ sweeps that CI's Build Core carries). --ran reconciled.
   • CI at this read: Build Core, Lint & Repo Gates, TypeScript Type Check, every Lint · and Type Check · lane, Check Changeset, and Test Core 2–6/6 are success; path-filtered jobs are skipped; Test Core (1/6) is still running. None failed.
7. Open questions → maintainer. The three cases with no app surface today are put to the maintainer on skills(objectstack-api): the "Choosing between apis: and a code handler" table and the "Code routes" section still teach app authors to mount on http.server, which ruling C′ (#23128) retired as an app-author surface #23787 in this act. They do not block landing: the skill states the gap, which stays true until a ruling builds a door.
8. Out of scope (noted, not filed; no reach:):
   • skills/objectstack-platform/rules/plugin-lifecycle.md L134 teaches the deprecated alias ctx.getService('http-server').
   • The executing-type statement still says 「17.x」 in endpoint.zod.ts L174–175 and in the skill's L154.
9. Landing (Tier H).
   • In this act: needs-user-decision and needs:contract-review are added, review is requested from os-zhuang and hotlong, and the isolated CONTRACT_REVIEW_TIER reviewer is launched on this head.
   • Landing needs an authorized APPROVED review and the at-tier PASS. Then come the pre-landing checks and pr_ready + automerge_enable.

---

Generated by Claude Code

[objectstack-fleet]

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: b4ea190791de50d7a5f2647813f91b1d418508b8
Local-runs: none
Scope: skills/objectstack-api/SKILL.md,skills/objectstack-api/evals/endpoints-auth-routes.json,docs/adr/0088-metadata-kind-admission-and-retirement.md,.changeset/23787-api-skill-retired-route-door.md + packages/triggers/trigger-api/src/api-trigger.ts, packages/triggers/trigger-api/src/plugin.ts, packages/runtime/src/endpoint-executor.ts, packages/runtime/src/domains/automation.ts, packages/runtime/src/dispatcher-plugin.ts, packages/plugins/plugin-hono-server/src/adapter.ts, packages/services/service-automation/src/builtin/screen-nodes.ts, packages/services/service-automation/src/builtin/connector-nodes.ts, packages/services/service-automation/src/engine.ts, packages/spec/src/api/endpoint.zod.ts, packages/spec/src/api/endpoint-publish-gate.ts, packages/spec/src/stack.zod.ts, packages/rest/src/openapi-endpoints.ts, skills/objectstack-automation/SKILL.md, packages/skills/package.json, packages/skills/scripts/sync-catalog.mjs, .changeset/config.json, scripts/pm/check-governed-merges.mjs, scripts/check-skills-token-ratchet.mjs — every cited file read at b485122a7, the PR's merge base on main; PR #23785's manifest.zod.ts retire text read at refs/pull/23785/head for the one sentence the skill says it mirrors.

Reviewed 2026-10-16T04:15Z. Inputs: card #23787 body and all seven comments (6206661348, 6207123004, 6207374288, 6207401165, 6207466146, 6207749987, 6207817517); PR #23807 body, file list and git diff b485122a7 b4ea19079; ruling record 6142279866 on #23128 in full; the head's 47 check-runs. Not an input: the dispatch order's conclusions or the seat's ACCEPT (6207794824), both read only to know what they claim.

① Derived judgments

1. Table row "A flow that runs your code" — RIGHT. A type: 'flow' endpoint resolves to executeFlow and calls automation.execute(plan.flow, …) (endpoint-executor.ts planEndpointTarget, the flow branch; executeFlow L505–616). A flow script node reads config.function, calls engine.resolveFunction, and its refusal text names defineStack({ functions }) as the registry (screen-nodes.ts L369–419; engine.ts L4266–4275 setFunctionResolver, backed by bundle.functions; stack.zod.ts L993–1047 functions). connector_action dispatches to engine.resolveConnectorAction(connectorId, actionId), populated by the five connector plugins through registerConnector / registerConnectorProvider; git grep for http.server, IHttpServer, .post( under packages/connectors/*/src returns nothing, so "(outbound)" is the measured fact. apis: type: 'script' and 'proxy' are refused at publish with the same prescription the row now gives — a flow whose script node runs your registered function, an outbound call from a declared connector (endpoint-publish-gate.ts L367–379; endpoint.zod.ts L174–175). The row teaches the publish gate's own answer.
2. Inbound webhook sentence — RIGHT. api-trigger.ts: the only signature judged is x-objectstack-signature, through core's verifyHttpSignature, timestamped form only (verifyInboundSignature, L142–170); every unverified post answers 401 INVALID_SIGNATURE; a JSON object body is required (L356–363); the post is enqueued and answered 202 (L373); the consumer hands the parsed payload to the flow as record (L283–284). The pointer target exists verbatim: skills/objectstack-automation/SKILL.md:340 "Inbound webhook (api) triggers". "A sender you control" is the right qualifier: only a sender signing ObjectStack's scheme passes.
3. "An app never mounts on http.server — the platform plugins' own door-building primitive" — RIGHT, and it is ruling C′ item 2's second sentence restated; trigger-api itself is the primitive in use (plugin.ts L180–192 mounts the hooks path on the raw app). The reasons: caller identity and auth gate are per-seam decisions (core/security/auth-gate.ts, anonymous-deny.ts, REST enforceAuth, the dispatcher) and no global auth middleware exists; the namespace carve-out is a publish gate on apis: paths only; OpenAPI enumerates ApiEndpointSchema items alone (openapi-endpoints.ts L336–340). One clause is imprecise, non-blocking: "rate limit". A code-mounted route lacks the endpoint rateLimit budget, but server.security.rateLimit, when armed, is installed as GLOBAL middleware on http.server (dispatcher-plugin.ts L920 server.use(rateLimitMiddleware); adapter.ts installMiddlewareSeam, app.use('*')), so such a route IS metered on a stack that arms it. The clause is word-identical to PR docs(spec): the routes / App.apis retire text stops sending app authors to an imperative http.server route (ruling C′ item 2) #23785's manifest.zod.ts retire text (L892–894 at its head), argues against a retired door, and over-advertises nothing (Prime Directive chore: version packages #10 runs the other way); the precise spelling is "endpoint rate-limit budget". Narrow both texts together in one follow-up so they stay identical — not a reason to hold this PR alone.
4. The three gap cases — RIGHT, each measured. Case 1: the hook checks only x-objectstack-signature (L142–170, L346–348) and a flow receives the parsed JSON body as its record (L283–284, L356); a type: 'flow' endpoint passes ctx.body through buildAutomationContext(body, protocolContext) (endpoint-executor.ts L567; domains/automation.ts L115–137 reads body keys only — no headers, no raw bytes), so no stack function can verify a third party's signature. Case 2: the executor answers successAnswer { success, data, meta } for both executing types (L290–292, L616) and has no streaming path (grep -i stream: 0 hits). Case 3: true by definition. "Say so rather than invent one" is the card's 「Reader who acts」 binding and Prime Directive chore: version packages #10.
5. Deleted "Code routes" section — RIGHT. No other referrer in the tree (grep "Code routes" at b485122a7: SKILL.md:201 only; references/_index.md names no HTTP-server schema). The alias, kernel:listening and Hono-sealing notes are platform-plugin knowledge, carried where it is used (trigger-api/src/plugin.ts L172–181); nothing an app author needs survived only here.
6. Ruling fidelity — RIGHT, neither widened nor narrowed. Record 6142279866 item 2: "an app declares apis:, computes in a flow, and registers code as a stack function or a connector. The http.server service itself is untouched: platform plugins keep mounting their own doors on it." The table, the paragraph, the changeset and the ADR entry restate exactly that. No new door is declared (the api hook named is an existing app-authorable flow type the automation skill already teaches); the connector is kept beside the stack function; the apis: row is unchanged.
7. Eval 3 — RIGHT, two observations. expected_output restates the new text; must_contain pins the two tokens it teaches (x-objectstack-signature, functions); must_not_contain pins the three the retired pattern needed (http.server, kernel:ready, getService). Valid JSON; 55 lines unchanged; 1039/1042 tokens, no CEILINGS move (CI ratchet green). (a) http.server in must_not_contain while the expected answer names the door to refuse it is the catalog's existing shape — 14 sibling evals on main carry a must_not_contain token that their own expected_output names (platform eval 1 tableName, data eval 2 many_to_many, …); not this PR's to change alone. (b) functions is a weak token (a common word); it pins the right thing but loosely.
8. ADR-0088 — RIGHT, AGENTS.md rule 13 held. One **Amended** entry on the Status line in the repo's precedent shape (ADR-0005 L8, ADR-0029 L3, ADR-0056 L4: · **Amended** (date, #card — what changed)), citing ruling C′ item 2 and record 6142279866; the router row points at it; both earlier ⚠️ Correction notes stay verbatim as dated history; the KIND's retirement is untouched. grep http.server docs/adr finds no other ADR naming the mount as an app surface (0076 and 0097 speak of platform code), so no second ADR edit is owed.
9. Whole package, reader's seat. SKILL.md 434 → 415 lines, 4754 → 4642 tokens; the eval 1042 → 1039. The new eleven-line paragraph carries one decision rule, one pointer, one prohibition with its reasons and three named gaps — every sentence routes an authoring act. Pre-existing, out of scope (dev noted): L154 says script / proxy "do not execute in 17.x" beside compatibility: 18.x, mirroring the spec's own describe texts.
10. Public surface. No code, schema or export moves; skills/** publishes through @objectstack/skills dist (sync-catalog.mjs copies the tree byte for byte), so the only publish effect is text in the next catalog release. Tier H paths: skills/** and docs/adr/** (GOVERNED_SURFACES, both tier: H).

② Semver level

@objectstack/skills patch — right. A text-only change to a published package in the changeset fixed group, not in ignore (.changeset/config.json); skip-changeset would be wrong. docs/adr/** is in no package's files[] (grep over every tracked package.json for docs: 0 hits), so the ADR edit owes nothing. Clause-②: no on PR body line 2 and in the changeset body, no arm — right: nothing an author writes changes (no key, no export, no behaviour; the retired door was never a declared surface). The changeset prose matches the diff (table row, paragraph, section deleted, eval 3) and follows the .changeset/23768-datasources-default-host-reserved.md shape.

③ Boundary flags

• Dev open_questions 1–3 (card 6207749987) — escalated to the maintainer by the seat on the card (6207817517); each measurement re-read against main and confirmed in ①.4. Recommendation A for each follows from the code: declaring a door the runtime does not serve is what Prime Directive chore: version packages #10 forbids, and a streaming answer would be the second execution dialect ADR-0121 rules out. The skill text is true under any answer, so none blocks landing.
• Dev deviations — base moved 46ca793ed → b485122a7 with the PM readings re-measured identical: accepted. Derived gate set 49 not 37: the twelve are changeset-family gates the new .changeset/*.md pulls in, run locally and by CI (Check Changeset ×3 success). Four dist/ sweeps NOT MEASURED locally: CI Build Core success at the head measures them.
• Release-timing condition (card 6207466146) — PR docs(spec): the routes / App.apis retire text stops sending app authors to an imperative http.server route (ruling C′ item 2) #23785's entry-18 acceptanceCriteria says no former teaching site sends an app author to the mount; fully true only once this PR lands. If the two miss one release, domain:spec seat 1 owes the narrowing. Carried on the card; not this PR's.
• Rate-limit clause (①.3) — follow-up on both texts together; non-blocking.
• Eval convention (①.7a) — observation; catalog-wide, not this PR's.
• Out of scope, no reach (dev noted): skills/objectstack-platform/rules/plugin-lifecycle.md:134 teaches the deprecated http-server alias; the 17.x spelling in endpoint.zod.ts and the skill's L154.
• Check-runs on b4ea19079, read 2026-10-16T04:13Z: 47 runs, all completed, 0 failures. The five required contexts: Lint & Repo Gates success, TypeScript Type Check success, Test Core success (every shard and the aggregate), Build Core success, Governed Surface Queue Guard success. Check Changeset success; path-filtered jobs (Console Pin Gate, Temporal Conformance, Dogfood CLI, Build Docs, tarball smoke) skipped by filter.
• Landing (Tier H). This record is the at-tier half. The PR is draft with needs-user-decision and needs:contract-review; it lands only on an authorized APPROVED review by a GOVERNED_APPROVERS account, then the owning seat through the queue. No AI seat readies, arms or approves it.

Implemented-by: claude/issue-23787-api-skill-retired-route-door
Reviewed-by: session_01VqGhCg9wdsBXPz54uAEWg7

VERDICT: PASS

---

Generated by Claude Code

[objectstack-fleet]

Review labels cleared · director seat (summon #43, session_01QJC7i981TSs9L1CGJK59Ax) · 2026-10-16T08:35Z

• Approval in place: os-zhuang (in GOVERNED_APPROVERS) submitted an APPROVED review at 2026-10-16T04:04Z on head b4ea190791de, the head this PR still carries. The needs-user-decision label on a PR marks it as awaiting the maintainer's review and leaves when the approval is given; it is removed in this act.
• At-tier record in place: ## Contract review 6207942851 reads Served-tier: CONTRACT_REVIEW_TIER, Head-sha: b4ea190791de…, PASS. The needs:contract-review marker leaves with a same-head PASS; it was not removed with the record, so it is removed in this act.
• Landing stays the domain:skills seat 2's (session_01VqGhCg9wdsBXPz54uAEWg7, seat post [PM seat] domain:skills · seat 2 — ⏳ vacant #19287): the pre-landing checks, then pr_ready and automerge_enable through the relay. This seat submits no review and clicks nothing. CI on this head: every required context success.
• The three no-surface cases (a third-party-signed callback, a streaming response, a protocol the platform does not speak) stay the maintainer's open question on skills(objectstack-api): the "Choosing between apis: and a code handler" table and the "Code routes" section still teach app authors to mount on http.server, which ruling C′ (#23128) retired as an app-author surface #23787; they do not block this landing, as the seat's ACCEPT 6207794824 and the record both say.

---

Generated by Claude Code