[objectstack-fleet]

Requested by Elon · project thread

Fixes #25666

Clause-②: no
Metadata-protocol: none

维护者速读(草稿)

• 改了什么:已发布技能 objectstack-platform 的 bootstrap 示例里,五个 @objectstack/* 依赖还写着 ^17.0.0。改成和脚手架一样的精确版本 18.1.0。原计划加的一句说明被已发布技能的 token 上限挡住(只降不升),已删去,精确版本本身已表达同一意思。
• 为什么改:PR fix(create-objectstack, cli): scaffolded projects pin every @objectstack/* dependency to the exact scaffolder version #25539 起脚手架写精确版本,v18 文档也要求锁精确版本;照技能抄的人会装到 17.x,还是 caret 范围。
• 风险与代价(含回滚):纯文档,附一条 @objectstack/skills patch changeset;一次 revert 可回。
• 你要做的(一个动作):skills/** 属 Tier H,复核通过、CI 全绿后请您合并。

What changed

• skills/objectstack-platform/references/bootstrap.md 〈Complete Working Example〉 package.json: @objectstack/spec, runtime, driver-memory, plugin-hono-server, cli go from ^17.0.0 to 18.1.0; typescript keeps ^5.3.0. No prose added: a first commit added one sentence (the scaffolder writes its own version, exactly), and the published skills token ratchet (scripts/check-skills-token-ratchet.mjs, [finding] the published skills bundle has no length budget — a maintainer ruling now establishes the principle, but nothing enforces it #10473) refused it, 1391 tokens against a shrink-only ceiling of 1351; the second commit drops it (1350 / 1351) rather than ask for a ceiling ruling.
• .changeset/25666-skills-bootstrap-exact-pins.md: @objectstack/skills patch.

Grounds: packages/create-objectstack/src/pkg-utils.ts syncObjectStackDeps (deps[dep] = version, PR #25539); content/docs/protocol/backward-compatibility.mdx L206 and content/docs/deployment/self-hosting.mdx L64 (pin exact); packages/create-objectstack/package.json 18.1.0.

Gates

On this head: node scripts/check-skills-token-ratchet.mjs ✓ (bootstrap.md 1350 / 1351), pnpm check:skill-frame-sync ✓, pnpm check:skill-frame-freshness ✓, pnpm check:skill-identifier-liveness ✓, pnpm check:skill-compatibility ✓, scripts/check-empty-changeset.mjs ✓, scripts/check-commit-card-trailers.mjs --range origin/main..HEAD ✓. git grep -n '"\^1[0-9]\.' skills/ finds nothing (it found these five lines before).

Acceptance notes

• Not in scope: engines: { protocol: '^17' } in objectstack-platform/SKILL.md L142 is the protocol handshake range, a different value. The template baseline and its release-time stamping are PR fix(create-objectstack): template baseline pins @objectstack/* exactly; specVersion stays a range #25665 (domain:devx).
• The literal 18.1.0 will age with each release like any versioned example.
• Governed surface skills/** (Tier H): lands by the maintainer's hand. Opened through the fleet-write relay pr_create; every later write goes through the relay too.

🤖 Generated with Claude Code

https://claude.ai/code/session_01REMuzhz6MWRjg8uohedMnM

[objectstack-fleet]

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: eb587e5af14a893fe9d7011e342799aeab9ecceb
Local-runs: none
Scope: skills/objectstack-platform/references/bootstrap.md + packages/create-objectstack/src/pkg-utils.ts, packages/create-objectstack/src/index.ts (L175–L187 call site), packages/cli/src/commands/create.ts (objectstackDependencySpec), packages/cli/src/commands/init.ts (L29–L33), the five package manifests (packages/spec, packages/runtime, packages/drivers/driver-memory, packages/plugins/plugin-hono-server, packages/cli), .changeset/config.json (fixed group), content/docs/protocol/backward-compatibility.mdx L206, content/docs/deployment/self-hosting.mdx L64, scripts/check-skills-token-ratchet.mjs (the bootstrap.md ceiling row and the hand-audit formula), skills/objectstack-platform/SKILL.md L142–L147

Card #25666 body and its claim comment (6385224980); PR #25667 body and file list; net diff origin/main...origin/claude/project-thread-r6oa8t (2 files, +14/−5, two commits: c65aab44 then eb587e5a, which drops the sentence the first added); the head's check-runs read at 2026-10-24T14:20Z, 2026-10-24T14:21Z and 2026-10-24T14:22Z, and the superseded head c65aab44's at 2026-10-24T14:18Z–2026-10-24T14:20Z; the merge-base 2c523d0100's check-runs for the same jobs. Code and docs read on origin/main at 2c523d0100e9368ba8af3b08c652f23e943de46a (the PR's base). Not an input: the dispatch order or the seat's own conclusions; the gate results on the PR body are not used, only the head's check-runs.

① Derived judgments

Each changed line, judged against the code and docs that must make it true on main:

1. bootstrap.md L148–L151, L154: five @objectstack/* entries ^17.0.0 → 18.1.0 — TRUE on every count. (a) The packages exist under those names: packages/spec @objectstack/spec, packages/runtime @objectstack/runtime, packages/drivers/driver-memory @objectstack/driver-memory, packages/plugins/plugin-hono-server @objectstack/plugin-hono-server, packages/cli @objectstack/cli. (b) All five manifests read "version": "18.1.0" on main, and the npm registry's latest dist-tag is 18.1.0 for each (plus create-objectstack and @objectstack/skills). (c) The exact form is what the scaffolder writes: packages/create-objectstack/src/pkg-utils.ts syncObjectStackDeps sets deps[dep] = version for every @objectstack/ key in dependencies and devDependencies, header 「EXACT … — no ^, no ~, prereleases kept verbatim」 (PR fix(create-objectstack, cli): scaffolded projects pin every @objectstack/* dependency to the exact scaffolder version #25539, merged 2026-10-23), called from src/index.ts L187 with readCliVersion(); os init / os create standalone do the same through getCliVersion() (init.ts L29–L33, create.ts objectstackDependencySpec 「the CLI's own version, EXACT (no ^/~)」). (d) One version for all of them is the lockstep: .changeset/config.json puts all five, create-objectstack and @objectstack/skills in the single fixed group. (e) The docs prescribe the form: content/docs/protocol/backward-compatibility.mdx L206 「Pin exact versions instead of caret ranges … and after 18.0.0 each PATCH as well」; content/docs/deployment/self-hosting.mdx L64 「Pin the exact version in production, matching the CLI version in your package.json」. The old ^17.0.0 was a major behind and the range the docs refuse. typescript: ^5.3.0 untouched, as the card asked; it is also the floor os init writes (init.ts L224, L255).

2. The sentence c65aab44 added after the block (「npx create-objectstack writes every @objectstack/* dependency as its own version, exactly (no caret) — keep all @objectstack/* packages on that one version」) was TRUE by 1(c)–(d) and spelt the command as the file's own 〈Scaffolding Command〉 does (L81, L84 npx create-objectstack), but it is no longer in the diff: eb587e5a removes it. The head's prose is byte-for-byte main's; only the five version strings differ.

3. Token-ratchet resolution — VERIFIED. scripts/check-skills-token-ratchet.mjs CEILINGS L679 pins skills/objectstack-platform/references/bootstrap.md at 1351, shrink-only, and the file sits at zero headroom on main: 5403 bytes, ceil(5403/4) = 1351 (the script's own stated hand audit, header 「INDEPENDENTLY REPRODUCIBLE」: ceil of the file's wc -c byte count over 4; nothing was run). c65aab44 grew the file by the sentence and the gate step 「Published skills token ratchet ([finding] the published skills bundle has no length budget — a maintainer ruling now establishes the principle, but nothing enforces it #10473) + its self-test」 in Type Check · source gates went red (annotation at 2026-10-24T14:18Z; the merge-base's Type Check · source gates run is green, so the red was this PR's, not a base signature). eb587e5a is 5398 bytes, ceil(5398/4) = 1350 ≤ 1351: each ^17.0.0 → 18.1.0 is one byte shorter, five bytes in all, so the head is one unit under its ceiling. Dropping the sentence instead of asking for a raise is the right remedy: the ratchet header 「New text is paid for by DELETING text in the SAME FILE … Going the other way lands only in a PR whose body quotes a maintainer ruling」, and the ceiling file is maintainer-only. No ceiling row changed.

4. Sweep of skills/** on the head: git grep -n '"\^1[0-9]\.' skills/ is empty (the card's acceptance line); no @objectstack/… entry with a caret range anywhere in skills/**; no other 17.0.0 package-version example. The only ^17 left is engines: { protocol: '^17' } (objectstack-platform/SKILL.md L142, its eval config-plugins-ops.json L7, and objectstack-upgrade/SKILL.md L89/L91) — the metadata-protocol handshake range, a different value from the package version, as the card says; its own staleness is ③.2.

5. Card acceptance read against the head: the caret grep is empty (above); check:skill-frame-sync and check:skill-compatibility run in Type Check · source gates, check:skill-identifier-liveness in Lint · docs & code guards, check:skill-frame-freshness beside frame-sync — their conclusions are those jobs' check-runs (CI state below). Commit trailers model-free (Co-Authored-By: Claude, Claude-Session:); PR author objectstack-fleet[bot], so no login note is owed.

CI on this head (last read 2026-10-24T14:22Z, 45 check-runs): success — Governed Surface Queue Guard, filter, The card this PR closes must claim this branch, No other open PR may claim the same issue, No other open PR may claim the same single-writer path, Part-of PR must not also close its card, Auto Label, Check PR Size, Check Changeset (both runs), Check Documentation Links, Dogfood Regression Gate, Test Core (3/6), Type Check · debt ledger, Type Check · workspace, Lint · scoped · tooling self-tests, Lint · PM dispatch-gates, Lint · scoped · slot lookup & corpus, Lint · scoped · query-options erasure. In progress — Type Check · source gates (hosts the token ratchet, frame-sync and skill-compatibility), Type Check · consumer gates, Lint · docs & code guards, Lint · repo & tooling gates, Lint · CI, release & engine gates, Lint · ESLint, Build Core, Test Core (1/6, 2/6, 4/6, 5/6, 6/6). Skipped (path-filtered or opt-in) — Dogfood Verify CLI, Build Docs, Console Pin Gate, Temporal Conformance, Dogfood Regression Gate shards, 18.x upgrade harness, Packed-tarball smoke, and the duplicate Auto Label / Check PR Size rows. One cancelled row: a first Governed Surface Queue Guard run, superseded by the in-progress one on the same head. No red on this head at any read; the only red in the PR's history is c65aab44's token ratchet, resolved as in ①.3. This verdict is on the diff; landing waits for every in-progress and queued run to conclude green, Type Check · source gates first among them.

② Semver level

@objectstack/skills patch — right. skills/** is the source of @objectstack/skills (packages/skills/scripts/sync-catalog.mjs copies skills/** into dist/skills; pr-automation.yml L861 「a 'skills/**' change releases '@objectstack/skills' and never takes the label」), so a changeset is owed and the package named is the one that ships the file. Five version strings in a documentation example widen no accepted set and no public face: Clause-②: no on the PR body and the changeset holds; Metadata-protocol: none holds (no schema, no manifest field, no conversion). The reworded changeset body matches the head (no claim of an added sentence; 「the exact form create-objectstack writes, with all of them on one version」 is ①.1(c)–(d)).

③ Boundary flags

1. Card 〈Wanted〉 half not delivered, declared: the card asked for the five pins AND 「one prose line says the scaffolder writes its own version exactly and every @objectstack/* package stays on the same one」. The head delivers the pins only; the sentence is unfunded under the shrink-only ceiling (①.3) and the PR body says so in both its 维护者速读 and 〈What changed〉. The card's machine 〈Acceptance〉 (empty caret grep, four gates) is met. If the lane still wants the sentence, it is paid for by deleting text elsewhere in bootstrap.md (one unit of headroom today) — a skills-lane choice, not this review's; 「Fixes skills: objectstack-platform/references/bootstrap.md still teaches ^17.0.0 for every @objectstack/* dependency, while the scaffolders now write the exact version (the governed half of #25510) #25666」 closes the card with the body's statement as the record of the half left out.

2. engines: { protocol: '^17' } — out of this PR's scope by the card, correctly described as a different value, but itself STALE and worth a card: packages/spec/src/kernel/protocol-version.ts has PROTOCOL_VERSION = '18.0.0' (PROTOCOL_MAJOR 18), and the handshake refuses a range that excludes the runtime major (packages/metadata-core/src/protocol-handshake.ts; packages/runtime/src/app-plugin.ts L548 「fails boot fast with the structured OS_PROTOCOL_INCOMPATIBLE diagnostic」), so an app that copies '^17' from objectstack-platform/SKILL.md L142 is refused at boot by an 18.x runtime. The scaffolders already write '^18' (packages/create-objectstack/src/templates/blank/objectstack.config.ts L39; packages/cli/src/commands/init.ts L869 '^${PROTOCOL_MAJOR}'; all five examples/** carry '^18'), while SKILL.md L147 says create-objectstack stamps the value shown. Also stale on the same value: objectstack-platform/evals/config-plugins-ops.json L7 and objectstack-upgrade/SKILL.md L89 (「scaffold and example writes the caret form (engines: { protocol: '^17' })」). No gate catches it: check:skill-compatibility reconciles only the frontmatter compatibility: and metadata.version lines, and sync-protocol-version.mjs stamps the constant, not skills/**. No open domain:skills card carries it (the open set was read; only skills: objectstack-platform/references/bootstrap.md still teaches ^17.0.0 for every @objectstack/* dependency, while the scaffolders now write the exact version (the governed half of #25510) #25666 mentions ^17). '^17' → '^18' is byte-neutral, so the ratchet does not block it. Flag only: a domain:skills filing-gate ② card, not a blocker here.

3. packages/create-objectstack/src/index.ts L175–L178 comment (「so ^ plus the scaffolder's own version always resolves」 — the caret form) is stale against syncObjectStackDeps (domain:devx, not this PR). Carrier exists: PR fix(create-objectstack): template baseline pins @objectstack/* exactly; specVersion stays a range #25665 (open, Fixes #25510) rewrites it to 「own exact version」, caret gone, in its index.ts hunk. Nothing owed from this PR.

4. The literal 18.1.0 ages with each release and nothing restamps it: the ratchet's one exclusion is the frontmatter metadata.version stamp line, and check:skill-compatibility --fix rewrites only the frontmatter pins, so a prose/code-block version string is hand-kept. Already stated on the PR body; recorded so the next release's reader knows no gate will red on it. The card's own alternative (a range) is what the docs refuse, so the exact literal is still the right choice.

5. c65aab44 (superseded): its red was this PR's and is resolved by eb587e5a; the base's Type Check · source gates run at 2c523d0100 is green, so nothing on main is bleeding.

Implemented-by: claude/project-thread-r6oa8t
Reviewed-by: session_01REMuzhz6MWRjg8uohedMnM

VERDICT: PASS

---

Generated by Claude Code