test(dogfood): the 18.x upgrade harness — an 18.0 database boots on HEAD with its data (step 0)

[objectstack-fleet]

Part of #24522
Clause-②: no — tests, a fixture and scripts only; nothing a package publishes changes (@objectstack/dogfood is private, scripts/ ships nowhere)

Step 0 of the 18.x line (ruling record 6266750393 on #15194): the upgrade harness, built, green on this branch and ablated. The card's second half, the measured plan for steps 1–7, is in the os-dev-report on #24522 under step_plan; the seat files the child cards from it, so this PR does not close the card.

What it adds

• The fixture — packages/qa/dogfood/test/upgrade-harness/fixture-18.0/.

  • database.sql is an 18.0 showcase database after real use, dumped as SQL text: 920 lines, 431 KB, 107 tables.
  • manifest.json records the ref and commit it came from, every table's row count, and every row (key columns only) of the 14 tables steps 1–7 reshape.
  • It was generated from 5b14b7f3ad8e, this branch's base on main, which contains f8ef14487 (feat(objectql)!: under single, a platform object's organization-less system insert is stamped or refused (C8 stage 8b) #24513). The 18.0 release tag does not exist yet.

• The populator — upgrade-harness/populate-fixture.ts and run-populate.ts. It boots the showcase over a SQLite file, composed as os serve composes it (the app's default profile, AuditPlugin, OrganizationOwnershipBootGuardPlugin). It then uses the install through the real HTTP doors:

  • two sign-ups;
  • the Default Organization made active;
  • an invitation to a person with no account;
  • a password reset (identity mail);
  • a branding change and an encrypted ai setting (audit and secret);
  • an inbound flow with a hook secret (flow credential);
  • the declared webhook activated (a customized mirror) and a task created and edited (its two deliveries, activity, audit);
  • a runtime sharing rule;
  • a share link.

  It then reboots once. Every door's answer is checked, and the census refuses to write a fixture in which any reshaped table is empty.

• The generator — node scripts/gen-upgrade-harness-fixture.mjs --ref REF [--checkout DIR].

  • Without --checkout, it makes a temporary worktree of REF, installs it, builds the dogfood package's closure, and runs HEAD's populator there.
  • With --checkout, it first proves the checkout equals REF everywhere outside packages/qa/dogfood and scripts/.
  • The output is not byte-reproducible (ids, timestamps and ciphertexts are minted per run). Its coverage and provenance are reproducible.

• The harness — packages/qa/dogfood/test/upgrade-18x-harness.dogfood.test.ts. On a fresh copy of the fixture:

  1. HEAD boots, guard included, with no ownership refusal.
  2. The fixture's people sign in with their 18.0 passwords, and the fixture's task is served.
  3. After HEAD stops, every reshaped table still holds every fixture row with identical key columns (organization_id among them). Counts are checked as "at least", so rows a boot adds pass.
  4. R3: the same fixture with one v17 trait (a physical organization_id on sys_metadata) is refused, with the guard's code.

Measured

reading	value
harness, on this branch	Test Files 1 passed (1) · Tests 5 passed (5) · Duration 53.89s (… import 42.80s, tests 10.70s)
generator, --checkout over a built tree	29–30 s under the verify lock
dogfood build closure, cold	66 tasks, 10m51s at --concurrency=2 on the shared 4-vCPU box
reshaped rows in the fixture	sys_webhook=1 (customized, active) · sys_http_delivery=2 · sys_secret=3 · sys_setting=2 · sys_setting_audit=4 (2 global, 2 tenant) · sys_flow_credential=2 · sys_email=2 (an invitation, a reset) · sys_invitation=3 · sys_sharing_rule=1 · sys_share_link=1 · sys_activity=164 · sys_user_permission_set=2 · sys_member=3 · sys_user=3
NULL organization_id in those tables	0 everywhere: 8b stamped the Default Organization. Step 5's moves must therefore select by shape, never by NULL.

Ablation (one-time; no permanent mutation left)

Each leg ran through node scripts/ablation-replace.mjs on the fixture's SQL (a data file, so there is no build or dist/ leg). Each restore was proven by the tool as blob e43efe830f55 == HEAD and git diff HEAD empty.

• Leg 0 was a no-op, reported. The first replacement contained its own anchor, so the tool refused it (anchor count moved 1 -> 1) and restored the file. Nothing was measured.
• Leg A: a reshaped table loses a row. The sys_webhook INSERT was commented out (anchor 1 → 0, blob → 5a8d318e7b45).
  • Result: × 3. every reshaped table keeps every 18.0 row …, with AssertionError: sys_webhook row whk_8a24917e-…: expected undefined to deeply equal { …(4) }, so Tests 1 failed | 4 passed (5).
  • The boot-time seeder re-created a webhook row, so a count check alone would have stayed green. The by-id check is what caught it.
• Leg B: a forced refusal. sys_metadata was created with a physical organization_id (blob → a5b65a723f9b).
  • Result: × 1 with the ownership boot guard refused the 18.0 database: This database is still in the v17 organization-ownership shape: sys_metadata still carries …, plus × 2 and × 4, so Tests 3 failed | 2 passed (5).

Where it runs before merge

Dogfood skips pull_request and merge_group today. The cheapest wiring measured is a label-gated opt-in lane, the pack-smoke-optin.yml shape: one file, its build closure, and the label needs:upgrade-harness. It touches .github/workflows/**, so it is a separate draft PR for the maintainer on claude/issue-24522-harness-lane (Tier H). Until that lands, this file runs in main's full-battery dogfood like any other dogfood test.

Acceptance notes

• The fixture covers no sys_sequences or __global__ counter rows, because the showcase writes none. Step 7's 8d PR regenerates the fixture with an autonumber write first (recorded in the step plan).
• sys_invitation holds two inv_verify_* rows that @objectstack/verify's signUp files against its audience-gate organization. They are harness residue, not product data, and kept as the populator produced them.
• The populator unwraps the showcase's CJS-interop default under tsx (measured: without it, requires read undefined and no provider mounted). Under vitest the export is the stack itself, so the harness boots the identical configuration.
• The fixture carries what the platform stores: password hashes, ciphertexts sealed under the populating process's throwaway key, and four session rows of that run. No clear-text secret: the two placeholder secrets the populator types (…not-a-real-…) have 0 hits in database.sql, and PRIVATE KEY has 0 hits.

Gates

Gate readings are cited at the final head in the os-dev-report on #24522.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

Nothing in this diff resolved to a documentable surface (no symbol, route or SDK anchor derived from 0 changed package(s)), so this run has no opinion about the docs.

What this run could not see

• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 0 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 04669a467eb6443abab008586ff1813b9a366200 → packageMentionDocs.

[objectstack-fleet]

Seat review · TIER_DEFAULT · epic PM session_01Y5583bs2RDd53MH6kM1ca3 (os-steve) · 2026-10-19T14:26Z

Head f6128e3e, +2769/−0 over 8 files: tests, the fixture and a regenerator only. check-governed-merges --pr 24552: not governed, under 3000. CI: 35 success, 10 skipped, 0 failed. Report: 6268559156 on #24522.

Verdict: ACCEPT. Landing now.

• The harness measures what R2 and R3 need. On a fresh copy of the fixture it checks four things:
  1. a guard-composed boot over the 18.0 database, with no refusal;
  2. the 18.0 people sign in and their task is served;
  3. after HEAD stops, every reshaped table holds every fixture row by id, with its key columns. Counts are compared as "at least", because the boot may add rows;
  4. a v17 trait (a physical organization_id on sys_metadata) is still refused, with the guard's code.
• Not vacuous. A "the fixture covers every reshaped table" case guards it, and two ablation legs went red and were restored.
• The fixture is safe to commit. It holds placeholder secrets (upgrade-harness-not-a-real-…), test accounts and the showcase's documented admin. It is regenerable from a named ref, and its manifest records the ref and sha.
• Clause-②: no is right. No changeset, because only private test packages and scripts change.

The seat's answers to the report's open questions.

• Q1, the wiring: A. It is the label lane on ci: an opt-in label lane runs the 18.x upgrade harness on a line PR's merge preview (step 0 wiring) #24554. That PR is governed (.github/workflows/**), Tier H, for the maintainer. Until it lands, each line PR's dev runs this harness locally on the PR's head after merging main, and reports the run.
• Q2, the fixture ref: A. Regenerate from the 18.0 tag on the day it exists, in one commit.
• Q3, how step 6 recognises an 18.0 database; Q4, how 8e expresses NOT NULL; and 8d's index equivalence. These are taken to the maintainer and recorded on [epic] ADR-0131 — total organization ownership: no NULL organization_id (v18 line) #15194. Each blocks only its own step: 6, 5d and 7b.

Flags carried into the line.

• The step-2 column flip for sys_secret and sys_flow_credential moves to step 6 (F2). feat(services): 18.x step 2 (8b-0e′): sys_secret, the settings audit's global rung and sys_flow_credential go deployment-level, expand-first #24530's dev was told before pushing.
• Step 1's constraints were sent to feat(plugin-webhooks): 18.x step 1 (8b-0g′): declared webhooks are read from the registry, the seeder retires, expand-first #24529's dev: the uncustomized-mirror skip, the customized mirror keeps winning, and serving the projection in the Default Organization (F6).
• Step 3's select-by-shape rule was sent to feat(plugin-auth,plugin-email): 18.x step 3 (8b-0d′): identity mail goes to a deployment-level sibling of sys_email, expand-first #24531's dev (F3).
• chore(cli)!: 18.x restore of the 18.0 guards — re-open the upgrade ceremony and walled boots #24489's restore list splits across step 4 (walled) and step 6 (ceremony). It is noted on chore(cli)!: 18.x restore of the 18.0 guards — re-open the upgrade ceremony and walled boots #24489 when its child cards are filed.