[objectstack-fleet]

Fixes #25174
Clause-②: no
Metadata-protocol: none

What this changes

Every standalone scaffold's npm overrides block gains a uuid entry that routes every uuid edge below 12.0.0 to ^11.1.1, out of GHSA-w5hq-g745-h8pq (uuid below 11.1.1). The scaffolds are the create-objectstack blank template, os init -t app, -t plugin and -t empty, and os create plugin (standalone).

• packages/cli/src/commands/init.ts: two new constants, SCAFFOLD_UUID_OVERRIDE_SELECTOR (the npm override key: uuid@, a less-than sign, 12.0.0) and SCAFFOLD_UUID_OVERRIDE_RANGE (^11.1.1). SCAFFOLD_NPM_OVERRIDES is built from them and from SCAFFOLD_VITEST_RANGE, so os init and os create emit it with no other code change.
• scripts/sync-scaffold-emission-policy.mjs: one new POLICY_STAMPS row stamps the value into the bundled template from the constant (the same path PR fix(cli,create-objectstack): scaffolds declare vitest ~4.1.12, outside GHSA-qxg6-89mg-rqv8, and still install on npm 10 #25173 used for vitest). The field regex now escapes the key, because the selector contains .. The self-test fixtures declare the new constant and key, with one new assertion (61 assertions in total).
• packages/create-objectstack/src/templates/blank/package.json: the stamped entry, written by the script's write run.
• Tests: packages/cli/test/scaffold-npm-overrides.test.ts pins the map, the target's floor (at or above the fix for its major) and the selector's bound (the major right above the target). packages/cli/test/scaffold-emission-policy.e2e.test.ts (nightly tier) adds a check that the on-ramp, os init and os create emit the SAME whole overrides block. The sync script's --check compares values only and cannot see a key spelled differently from the constant.
• Changeset: @objectstack/cli and create-objectstack, patch. It includes the one-line fix for existing projects and for other npm consumers.

@objectstack/rest is not changed: no route at its level reaches npm consumers (measured below).

Route measurements (npm 10.9.9 and npm 11.21.1)

Method: each manifest in its own empty directory under the scratchpad, with a fresh --cache per leg, and one install tree at a time. The @objectstack/* ranges ^18.0.0 resolve to the published 18.0.0. The os init / os create manifests were emitted by this tree's source CLI (bin/run-dev.js), and the blank template was taken from the tree. uuid was read from node_modules, then npm audit --json was run. Two npm 10 audits and one npm 11 audit hit a registry endpoint error (400 on audits/quick after the bulk endpoint failed, and a 503 on advisories/bulk). Those were re-run, and only completed audits are counted.

Route	Manifests	npm 10.9.9	npm 11.21.1
Baseline (main at b6e8707, with #25173)	blank, init -t app, -t plugin, -t empty	exit 0, uuid 8.3.2, audit 9 moderate, all GHSA-w5hq-g745-h8pq	same
Baseline	os create plugin (no @objectstack/rest in its closure)	exit 0, no uuid, audit 0	same
A: newer exceljs	n/a	no such release: latest is 4.4.0 (2023-10-19), and 4.4.1-prerelease.0 also declares uuid ^8.3.0	same
B: overrides inside the published @objectstack/rest (18.0.0 repacked with overrides.uuid ^11.1.1, installed as a dependency)	bare consumer	exit 0, uuid 8.3.2, audit 3 moderate (rest, exceljs, uuid): ignored	same, ignored
C: scaffold overrides, selector uuid@ + less-than 12.0.0 → ^11.1.1 (chosen)	blank, init -t app, -t plugin, -t empty	exit 0, uuid 11.1.1, audit 0	same
C	os create plugin	exit 0, no uuid, audit 0 (the entry is inert)	same
C': the same with a bare uuid key	bare @objectstack/rest consumer	exit 0, uuid 11.1.1, audit 0	same
D: replace the dependency (exceljs aliased to the exceljs-community@5.2.1 fork, as a published swap would resolve)	blank; bare consumer	exit 0, no uuid, audit 0	same

Follow-up on a consumer of the published @objectstack/rest 18.0.0, root override as in C or C'. A later npm install uuid@14 exits 0 under C (declares ^14.0.3, exceljs keeps 11.1.1), and exits 1 with EOVERRIDE under C'. A spec-less npm install uuid exits 1 with EOVERRIDE: Override for uuid@* conflicts with direct dependency under both. Same on both npm versions. This is why the key is a selector and not bare uuid.

Runtime under route C (H3), measured rather than read from a changelog. On the installed blank and os init -t app trees, on both npm versions, exceljs resolved uuid 11.1.1. A buffered write with a dataBar rule ran: CfRuleExtXform.prepare calls uuid.v4(), and the sheet carried 2 generated ids. The streaming WorkbookWriter ran, the shape createXlsxStream bridges onto HTTP. A buffered load ran. @objectstack/rest's own parseXlsxToRows read both workbooks back to the expected rows. exceljs calls no other uuid export. In the monorepo, the same pairing (exceljs 4.4.0 on uuid 11.1.1, through the workspace override) runs the 16 rest test files that touch xlsx: 16 passed, 737 tests.

Why C, by the four axes

• Actual business need: the measured reach is every fresh npm-installed scaffold (9 entries). C closes exactly that reach, and B does not reach it at all. D also closes it for every npm consumer, not only scaffolds.
• Long-term soundness: C uses the mechanism this repo already uses for the same advisory (the workspace's pnpm override, same selector and range), so a scaffold resolves the uuid the monorepo's exceljs suites run on. It has a written retirement re-check on the constant. D would move a published runtime dependency onto a fork. The measured candidate is maintained by one person, was created 2026-08-09 and declares engines.node >=22.12.0, narrower than @objectstack/rest's >=22.0.0. That is a supply-chain decision, not a dependency bump.
• Hard for AI to get wrong: one constant feeds all three scaffolders. The value is stamped, and the key is held equal by the nightly e2e check. Floor and selector pins red when the advisory boundary is left. Both ablations are below.
• Startup focus: no new dependency, and no change to any published package's runtime. It adds one map entry and one stamp row.

Acceptance notes

• Residual reach, by design and stated in the changeset: an npm project that installs @objectstack/rest other than through a fresh scaffold still audits GHSA-w5hq-g745-h8pq. This covers projects made before this change and hand-written projects, and the bare consumer measured 3 moderate entries on npm 10.9.9 and 11.21.1. npm reads overrides only from the root manifest (route B), so only replacing exceljs (route D) reaches them. That choice is raised for the maintainer in the report on rest: the published @objectstack/rest pulls exceljs ^4.4.0 → uuid ^8.3.0, so every npm-installed scaffold audits 9 moderate GHSA-w5hq-g745-h8pq entries; the workspace's uuid override never reaches npm consumers #25174, and is not made here.
• Severity, as each source states it (H4): the pnpm-workspace.yaml comment says "high". The npm registry's bulk advisory endpoint says moderate, with a CVSS 3.1 vector scoring 7.5. npm audit in the scaffolds says moderate. GitHub's global advisory API was not readable from this session (403, session-bound).
• scripts/sync-scaffold-emission-policy.mjs's devDependencies.vitest row comment still says the constant holds why the range is ~4.0.0. The range has been ~4.1.12 since PR fix(cli,create-objectstack): scaffolds declare vitest ~4.1.12, outside GHSA-qxg6-89mg-rqv8, and still install on npm 10 #25173. The comment is stale, has no runtime effect and is outside this change. Carrier: none.

Verification

All readings are at head 50d7f9c25, which is this branch with origin/main f7d740376 merged in. The two incoming commits touch cli migrate code and platform-objects translations, and none of these 6 paths. After the merge: pnpm install was unchanged (no lockfile or manifest moved), the non-docs build was 76/76, and packages/runtime/.objectstack was cleared.

• pnpm --filter @objectstack/cli exec vitest run --project unit --maxWorkers=2 under the verify lock: VERDICT command-exit 0, 323 test files passed, 4772 tests passed. The CLI integration tier is left to CI. The one integration-tier file in this diff is in the nightly tier, so it was run on its own: OS_TEST_TIERS=nightly … vitest run --project integration test/scaffold-emission-policy.e2e.test.ts, 1 file, 11 tests passed.
• pnpm --filter create-objectstack test: 18 files, 278 tests passed. pnpm --filter @objectstack/cli typecheck && pnpm --filter create-objectstack typecheck: VERDICT command-exit 0. The cli tsc -p tsconfig.test.json --listFiles lists both edited cli test files.
• @objectstack/rest xlsx export and import tests (the 16 files under packages/rest/src that touch xlsx or exceljs): 16 files, 737 tests passed. @objectstack/rest is unchanged; these run exceljs on uuid 11.1.1 through the workspace override.
• node scripts/sync-scaffold-emission-policy.mjs --self-test: exit 0, 61 assertions. Its --check exited 1 on an unstamped key (overrides.uuid@… is "0.0.0-unstamped" but the policy declares "^11.1.1"). The write run then stamped it (1 value rewritten), and --check exited 0.
• eslint --no-inline-config over the 4 changed code files: exit 0. Control-byte scan over the 6 changed files: no hits.
• Ablations, run at e7cf02f09 with the fix committed first, through scripts/ablation-replace.mjs in wrap mode. The later commits change only comments in init.ts. The tests import ../src, so no dist/ is on their path.
  1. SCAFFOLD_UUID_OVERRIDE_RANGE changed from ^11.1.1 to ^11.1.0 (anchor 1 to 0, blob 827cf1e96177 to 33bed46cc4ef). Result: Tests 1 failed | 13 passed (14), failing on admits 11.1.0, below the fix 11.1.1. Restored: blob equals HEAD, git diff HEAD empty.
  2. SCAFFOLD_UUID_OVERRIDE_SELECTOR with its bound moved to 13.0.0 (anchor 1 to 0, blob 827cf1e96177 to 98fd9e5105ca). Result: unit 1 failed | 13 passed (14) (expected 13 to be 12), and nightly e2e 1 failed | 10 passed (11) (npx create-objectstack must emit the shared npm overrides block). That second failure is the key-spelling drift the stamp script cannot see. Restored: blob equals HEAD, git diff HEAD empty.
• Gates: node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack derived 103 commands over 6 paths, against merge base f7d740376. Each ran byte for byte, with its exit code recorded before any pipe: all 103 exited 0. --ran: 103 derived, 103 run, 0 NOT-MEASURED, 0 UNRUN, exit 0. This includes check:scaffold-emission-policy, check:template-version-sync, check:cross-package-test-inputs and check:pm-dispatch-gates. check-governed-merges --branch: 0 of 6 paths governed, 220 changed lines.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 2 package(s): @objectstack/cli, objectstack-blank, touching 5 documentable anchor(s). ⚠️ 1 changed file(s) yielded no anchor (packages/create-objectstack/src/templates/blank/package.json), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files.

6 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/deployment/cli.mdx (via os init (command, read off packages/cli/src/commands/init.ts))
• content/docs/deployment/troubleshooting.mdx (via os init (command, read off packages/cli/src/commands/init.ts))
• content/docs/getting-started/examples.mdx (via os init (command, read off packages/cli/src/commands/init.ts))
• content/docs/getting-started/your-first-project.mdx (via os init (command, read off packages/cli/src/commands/init.ts))
• content/docs/plugins/index.mdx (via os init (command, read off packages/cli/src/commands/init.ts))
• content/docs/protocol/kernel/index.mdx (via os init (command, read off packages/cli/src/commands/init.ts))

⛔ 4 release-owned page(s) also name something this change touched. These are read-only:

• content/docs/releases/v17/17-1.mdx (via os init (command, read off packages/cli/src/commands/init.ts))
• content/docs/releases/v17/17-4.mdx (via os init (command, read off packages/cli/src/commands/init.ts))
• content/docs/releases/v17/17-5.mdx (via os init (command, read off packages/cli/src/commands/init.ts))
• content/docs/releases/v17/17-7.mdx (via os init (command, read off packages/cli/src/commands/init.ts))

content/docs/releases/ is RELEASE-OWNED (AGENTS.md "Documentation Guardrails"): release
notes are written centrally at release time, and a code PR that edits them is the exact PR
that guardrail exists to stop. They are still audited — read-only. If one of them is actually
wrong, file an issue or open a dedicated docs-only PR; do not edit it here.

What this run could not see

• 1 changed file(s) yielded no anchor (packages/create-objectstack/src/templates/blank/package.json) — pages documenting those are invisible to this run
• the SDK route bridge reached 54 of 206 client-bound route-ledger rows — the other 152 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 152: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 55 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 97 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 30 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 2069b81c266836fd6d7b52fc5e6679c734bdcd3c → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 38a9ee353f6eeaf7b3789cbc339011c558db9280 — the merge of head 50d7f9c254e0bbdc3b8491d5fc464e358b46f66a into base 2069b81c266836fd6d7b52fc5e6679c734bdcd3c, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 38a9ee353f6eeaf7b3789cbc339011c558db9280 && git checkout 38a9ee353f6eeaf7b3789cbc339011c558db9280
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 2069b81c266836fd6d7b52fc5e6679c734bdcd3c 50d7f9c254e0bbdc3b8491d5fc464e358b46f66a && git checkout -B drift-repro 2069b81c266836fd6d7b52fc5e6679c734bdcd3c && git merge --no-ff 50d7f9c254e0bbdc3b8491d5fc464e358b46f66a

node scripts/docs-audit/affected-docs.mjs --json 2069b81c266836fd6d7b52fc5e6679c734bdcd3c

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 2069b81c266836fd6d7b52fc5e6679c734bdcd3c → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[objectstack-fleet]

席位核对 · ACCEPT (landing on green)

domain:cli seat 2 (#22648) · os-bill · session session_01AFrKwndmrCLtF5V9hNtrw3 · 2026-10-22T09:04Z · head 50d7f9c25 · claim 6334460610 → report 6336933232.

Check	Reading
Shape	Draft, base main. First line Fixes #25174; Clause-②: no; Metadata-protocol: none added to the body by the seat in this stroke (its absence turned Check Changeset's major-bump guard red, as on PR #25196). One changeset, @objectstack/cli and create-objectstack patch. 6 files, +208 / −12. Not governed. No contract face.
The card's contract	Met by route C: every standalone scaffold (create-objectstack blank, os init -t app/-t plugin/-t empty, os create plugin) emits an npm overrides entry that routes uuid below 12.0.0 to ^11.1.1, the workspace's own target; one constant feeds init.ts, the blank template is stamped through scripts/sync-scaffold-emission-policy.mjs. Measured on npm 10.9.9 and 11.21.1: a fresh scaffold's npm audit goes from 9 moderate GHSA-w5hq-g745-h8pq entries to 0, and exceljs 4.4.0's xlsx write, stream and read paths run on uuid 11.1.1. A package-level override in @objectstack/rest is measured ignored by npm (route B), so packages/rest is unchanged. Floor and selector pins; two ablations red them. CLI unit tier 323 files / 4772 tests; create-objectstack 278; @objectstack/rest xlsx suites 737 tests; 103/103 derived families exit 0, --ran reconciled.
Accepted deviations	The changeset names @objectstack/cli and create-objectstack (whose published output changes), not @objectstack/rest; scripts/sync-scaffold-emission-policy.mjs gains one stamp row (the sync path PR #25173 used); npm 10 / 11 binaries kept in the scratchpad so the shared npm cache was never touched.
Left open for the maintainer	Non-scaffold npm consumers of @objectstack/rest (existing projects, hand-written ones) still audit the advisory until they add the one-line override the changeset documents; only replacing exceljs reaches them at package level (a maintained fork, measured to work, or a rewrite). The dev recommends waiting for upstream; put to the maintainer in this seat's session.
Out of scope	Noted, not filed: the vitest stamp row comment in sync-scaffold-emission-policy.mjs still says ~4.0.0; pnpm-workspace.yaml labels this advisory high where the npm record says moderate (CVSS 7.5).
Landing	Not governed ⇒ pr_ready + automerge_enable once every check on this head is success or a by-design skip.

---

Generated by Claude Code