[objectstack-fleet]

Fixes #26136

What changed

ObjectOS is one product in three editions — Community (this repository's runtime and Console, open source), Cloud (cloud.objectos.ai) and Enterprise — and ObjectStack is the name of the protocol, SDK, CLI and framework (maintainer ruling 2026-10-26 13:18Z, model 2). The hosted product is "ObjectOS Cloud" wherever a user reads it; this PR flips the places that still said "ObjectStack Cloud" and gives the Community Console its "Powered by ObjectStack" mark.

• packages/cli (string literals and help text only): os cloud login / logout / whoami, os package publish and os plugin publish descriptions, the --url / --server / --token / --visibility flag descriptions, the printed headers ("ObjectOS Cloud Login" / "Logout" / "Identity"), the "Not logged in to ObjectOS Cloud" prescriptions in whoami, package publish and cloud-config, the shared "Authentication required" message in api-client.ts, and the os serve welcome page's link text to the cloud console. Internal identifiers are untouched: ~/.objectstack/cloud.json, OS_CLOUD_API_KEY, OS_CLOUD_URL, OS_TOKEN, the os cloud … command ids.
• packages/cli/README.md (3 rows) and content/docs/deployment/cli.mdx (6 lines).
• README.md: the one phrase the slimmed README from PR 26148 still carried (that PR merged at 14:13Z, so this branch merged origin/main and fixed it, per the dispatch order's serial constraint).
• ui/packages/i18n: the four cloud-connection / cloud-install strings in all ten locales (cloudConnection.bound.title, the two dialogDescPickers and signInFirst) name "ObjectOS Cloud", the product name kept untranslated inside each locale's own sentence; zh's title read "已连接到 ObjectStack 云" and now reads "已连接到 ObjectOS Cloud". New key auth.shell.poweredBy in all ten locales (the ja value keeps the English wordmark line, listed beside publicForm.poweredBy in the untranslated-identity allowlist with the same reason).
• ui/packages/app-shell: new isDefaultProductName() on the runtime-config module and the barrel: true while branding.productName equals the default 'ObjectOS', false once a runtime has pushed its own.
• ui/apps/console: AuthLayout (the shell of every unauthenticated page: login, register, forgot/reset password, verify email, setup, consent, device, invitation) renders a small "Powered by ObjectStack" link to https://objectstack.ai under the form when isDefaultProductName() is true. The wordmark, logo.svg, manifest.json, the default productName: 'ObjectOS' and admin@objectos.ai are unchanged.
• scripts/sdui-manifest.sources/i18n.json: re-recorded by node scripts/gen-sdui-manifest-node.mjs (the gate hashes ui/packages/i18n sources; the manifest artefact itself is byte-identical).
• Changeset .changeset/26136-objectos-cloud-naming.md: patch on @objectstack/cli, @object-ui/i18n, @object-ui/app-shell, @object-ui/console.

Why the sign-in page, and why "productName equals the default"

The sign-in layout already reads the server-driven product name, so it is the one surface where "is this deployment branded?" is already answered; every auth page shares it, and it is the first screen a Community user sees. The About / footer surface was not given a second copy: one place, one rule.

How branding reaches the layout: initRuntimeConfig() fetches /api/v1/runtime/config at boot and merges body.branding into the app-shell singleton; getProductName() reads it. The payload carries no explicit edition key, so the only reliable signal of "server-pushed branding" is that productName differs from the default. That is what isDefaultProductName() reads, and the PR says so here as the order asked. Measured at source: objectstack-ai/cloud pushes CLOUD_PRODUCT_NAME = 'ObjectOS Cloud' (packages/app-cloud/src/product-name.ts), and a cloud-connected runtime pushes its workspace name (packages/cloud-connection/src/runtime-config-plugin.ts, productName ← branding.workspace_name), so both read as branded and get no second line. A logo or colour pushed without a name change does not count as a rebrand here (said in the predicate's doc comment).

Clause-②: no
Metadata-protocol: none

How verified (worktree at the final head, see the report comment for the sha)

• node packages/cli/bin/run-dev cloud login --help and … package publish --help print "ObjectOS Cloud" (flag descriptions and command description), no "ObjectStack Cloud".
• pnpm --filter @objectstack/cli exec vitest run --project unit --maxWorkers=2 under the verify lock on the merged tree: 333 of 334 files passed, 4876 of 4877 tests; the one red, src/utils/boot-preparation-parity.test.ts, was a 5 s timeout while a gate sweep shared the box, and the file passes alone under the lock (37 of 37; it reads serve.ts source, which this PR touches in one string). The two published-subpath-*.pin suites need packages/cli/dist, built first. the new test/cloud-product-name.test.ts pins the five commands' descriptions and flag descriptions on "ObjectOS Cloud" and asserts no "ObjectStack Cloud" in any of their help strings. The integration tier and the nightly cloud-login-json-ndjson.e2e tier (whose not.toContain('ObjectOS Cloud Login') pin flipped with the header) are CI's.
• ui: pnpm exec vitest run apps/console/src/pages/auth/__tests__/AuthLayout.powered-by.test.tsx apps/console/src/pages/auth/__tests__/LoginPage.layout-12600.test.tsx packages/app-shell/src/runtime-config.test.ts packages/app-shell/src/__tests__/product-neutral-renderer.ratchet.test.ts packages/i18n/ → 91 files / 1448 tests passed. The new AuthLayout.powered-by test boots branding through a stubbed GET /api/v1/runtime/config into the real singleton: default → mark with href https://objectstack.ai; productName: 'ObjectOS' plus a colour → mark; 'ObjectOS Cloud' → no mark; 'Acme Studio' plus a logo → no mark.
• pnpm --dir ui --filter @object-ui/app-shell run type-check, … @object-ui/console run type-check, … @object-ui/i18n run type-check, pnpm --filter @objectstack/cli typecheck: all exit 0. pnpm --dir ui run check:i18n-keys (every defaultValue equals its en value) and check:i18n-drift (4 changed en values, 36 pack values followed, 1 key added) exit 0.
• Derived gate subset (node scripts/pm/dispatch-gates.mjs --commands) run on the final tree; the full list, each exit code and the --ran reconciliation are in the report comment. check:sdui-manifest, check:i18n, check:i18n-coverage, check:i18n-walk-parity, check:dual-build-cjs-loads and spec check:skill-examples pass after a full build. node scripts/check-plugin-teardown-shape.mjs --self-test is NOT MEASURED here: it pins a fixture to a commit this shallow checkout cannot reach; CI runs it on a full checkout.

Acceptance notes

• git grep -n "ObjectStack Cloud" -- ':!**/CHANGELOG.md' went from 123 lines (at the branch base, a335f1d) to 59 on this branch's final head. Inside the card's surface the only residue is developer-facing code comments in packages/cli/src and its test files (file headers such as "authenticate against the ObjectStack Cloud", "ObjectStack Cloud's control plane" in the migration helpers' comments) — left as they are because the dispatch order limited packages/cli/src/** to string literals and help text; a user never reads them, and the new unit test names the stale phrase on purpose. Flipping those comments is a mechanical follow-up if the seat wants the grep at zero inside packages/cli.
• The same phrase survives outside the card's surface, user-facing in places: content/docs/deployment/cloud-connection.mdx (title and description), content/docs/deployment/index.mdx, content/docs/deployment/publish-and-preview.mdx, content/docs/protocol/objectql/schema.mdx, content/docs/protocol/kernel/metadata-service.mdx, content/docs/ui/setup-app.mdx, content/docs/kernel/services-checklist.mdx, ROADMAP.md, four package READMEs (adapters/hono, drivers/driver-memory, services/service-package, services/service-cluster-redis), and one runtime string served in HTTP 501 bodies and pinned by tests and the platform checklist: packages/spec/src/system/core-services.zod.ts "Provided by @objectstack/service-ai in ObjectStack Cloud/Enterprise". Listed in the report for the seat; not edited here. content/docs/releases/** and CHANGELOGs are history and stay.
• ui/AGENTS.md and ui/docs/adr/0060-product-neutral-renderer.md say "ObjectStack Cloud" as a product example; both are governed surfaces and are not touched.
• ui/scripts/check-changeset-presence.mjs still reads ui/.changeset and reports this change as undeclared, while this repository's changeset for ui packages lives in the root .changeset/ (every ui PR merged today does the same); no workflow in this repository runs that script. An observation, not a card: zero pull.
• The commit trailer pair is the model-free pair .claude/agents/os-dev.md requires and the pre-push hook enforces; the dispatch order's trailer text, which names a model, was not used.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/cli, touching 12 documentable anchor(s). ⚠️ 1 changed file(s) yielded no anchor (packages/cli/README.md), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files.

11 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/api/declarative-endpoints.mdx (via os package publish (command, read off packages/cli/src/commands/package/publish.ts))
• content/docs/concepts/metadata-lifecycle.mdx (via os package publish (command, read off packages/cli/src/commands/package/publish.ts))
• content/docs/deployment/cli.mdx (via os cloud login (command, read off packages/cli/src/commands/cloud/login.ts), os package publish (command, read off packages/cli/src/commands/package/publish.ts))
• content/docs/deployment/index.mdx (via os cloud login (command, read off packages/cli/src/commands/cloud/login.ts), os package publish (command, read off packages/cli/src/commands/package/publish.ts))
• content/docs/deployment/publish-and-preview.mdx (via os package publish (command, read off packages/cli/src/commands/package/publish.ts))
• content/docs/protocol/kernel/index.mdx (via os package publish (command, read off packages/cli/src/commands/package/publish.ts))
• content/docs/protocol/kernel/lifecycle.mdx (via os package publish (command, read off packages/cli/src/commands/package/publish.ts), os plugin publish (command, read off packages/cli/src/commands/plugin/publish.ts))
• content/docs/protocol/kernel/metadata-service.mdx (via os package publish (command, read off packages/cli/src/commands/package/publish.ts))
• content/docs/protocol/kernel/plugin-spec.mdx (via os plugin publish (command, read off packages/cli/src/commands/plugin/publish.ts))
• content/docs/protocol/objectql/index.mdx (via os package publish (command, read off packages/cli/src/commands/package/publish.ts))
• content/docs/protocol/objectql/schema.mdx (via os package publish (command, read off packages/cli/src/commands/package/publish.ts))

⛔ 4 release-owned page(s) also name something this change touched. These are read-only:

• content/docs/releases/v17/17-5.mdx (via os package publish (command, read off packages/cli/src/commands/package/publish.ts))
• content/docs/releases/v17/17-6.mdx (via os package publish (command, read off packages/cli/src/commands/package/publish.ts), os plugin publish (command, read off packages/cli/src/commands/plugin/publish.ts))
• content/docs/releases/v17/17-7.mdx (via os cloud login (command, read off packages/cli/src/commands/cloud/login.ts))
• content/docs/releases/v9.mdx (via os package publish (command, read off packages/cli/src/commands/package/publish.ts))

content/docs/releases/ is RELEASE-OWNED (AGENTS.md "Documentation Guardrails"): release
notes are written centrally at release time, and a code PR that edits them is the exact PR
that guardrail exists to stop. They are still audited — read-only. If one of them is actually
wrong, file an issue or open a dedicated docs-only PR; do not edit it here.

What this run could not see

• 1 changed file(s) yielded no anchor (packages/cli/README.md) — pages documenting those are invisible to this run
• 1 anchor(s) matched too much of the corpus to be a work list: os serve (command, 40 pages)
• 2 name(s) were too generic to anchor anything (single lowercase words)
• the SDK route bridge reached 54 of 206 client-bound route-ledger rows — the other 152 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 152: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 55 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 97 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 31 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 69aa630b9fd6ef20f76cbac9ed4d9b9efa69c804 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from df6ced6160bc7a69011d261e3ec411957c1b73ff — the merge of head f442ea21ce5d409e49c8d9814a392bb9bfa907a7 into base 69aa630b9fd6ef20f76cbac9ed4d9b9efa69c804, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin df6ced6160bc7a69011d261e3ec411957c1b73ff && git checkout df6ced6160bc7a69011d261e3ec411957c1b73ff
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 69aa630b9fd6ef20f76cbac9ed4d9b9efa69c804 f442ea21ce5d409e49c8d9814a392bb9bfa907a7 && git checkout -B drift-repro 69aa630b9fd6ef20f76cbac9ed4d9b9efa69c804 && git merge --no-ff f442ea21ce5d409e49c8d9814a392bb9bfa907a7

node scripts/docs-audit/affected-docs.mjs --json 69aa630b9fd6ef20f76cbac9ed4d9b9efa69c804

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 69aa630b9fd6ef20f76cbac9ed4d9b9efa69c804 → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[objectstack-fleet]

CI note · Test UI (13/16) and Test UI (8/16) are red on the base, not on this PR · 2026-10-26T16:11Z

Both shards fail on one assertion each, at head 9e0a8d92:

• ui/packages/app-shell/src/services/MetadataService.retiredObjectEnabled.test.ts:161 — AssertionError: expected 48 to be 47
• ui/packages/app-shell/src/services/MetadataService.specKeyObjectPayload.test.ts:175 — AssertionError: expected 48 to be 47

Both pin Object.keys(ObjectSchema.shape).length to 47. main's own merge-queue run 40353572789 (head f143cd88, the current main) fails Test UI (6/16) on the same specKeyObjectPayload assertion, so the red is the base's: commit 5e113b39 (PR #26005) added a top-level sharing: strictObject({...}) key to ObjectSchema in packages/spec/src/data/object.zod.ts and did not move the two pins. This PR touches neither test file nor the spec; the shard numbers differ from main's only because the PR adds test files and the shard assignment shifts.

Not fixed here: the pins are outside this PR's surface (card #26136 is naming strings and the auth-page mark), and a fix belongs with the key that moved them. Searched for an open fix PR on "expected 48 to be 47" / specKeyObjectPayload: none. The patch is two lines plus the comments that name the count: bump both toBe(47) to 48 and name sharing as the new key in each pin's comment. Filed as a tooling card in the landing stroke so the queue is green again for everyone.

---

Generated by Claude Code

[objectstack-fleet]

席位核对 · ACCEPT · 2026-10-26T16:17Z · session_01FMuBZmssbfQkVrKRtxNvng (maintainer-directed seat, card #26136)

1. 形态 — draft PR against main, head 9e0a8d92 (4 commits: the change, the sdui i18n record, the merge of origin/main carrying PR docs(readme): slim the root README to a reader's page — contributor detail to CONTRIBUTING.md, stale lines out, ui/ named MIT #26148's README, the record regenerated on the merged tree — the os-regen-merge shape, no rebase), 31 files +327/−71; body first line Fixes #26136; Clause-②: no / Metadata-protocol: none at line start in body and changeset; changeset patch on @objectstack/cli, @object-ui/i18n, @object-ui/app-shell, @object-ui/console; labels by the labeler only (documentation, size/m, tests, tooling); assignee os-zhuang.
2. 前提实测 — re-read by the seat on d1ea236 and by the dev on a335f1d / d3041a4: the CLI's cloud / publish descriptions, flags, headers and not-logged-in prescriptions, api-client.ts's auth message, the os serve welcome link, cli.mdx, the CLI README, the four cloud-connection / install strings in ten locales (zh "已连接到 ObjectStack 云") and README.md's one phrase at the slimmed line 257 — all held and all flipped. Diff read by the seat: login.ts / api-client.ts string-only; en.ts / zh.ts four strings + auth.shell.poweredBy; runtime-config.ts isDefaultProductName() = getProductName() === defaults.branding.productName with its doc comment stating the signal and its limits; AuthLayout.tsx renders the mark under the form only on that predicate, rel="noopener noreferrer", data-testid="auth-powered-by"; internal identifiers, wordmark, logo.svg, manifest.json, admin@objectos.ai, CHANGELOGs untouched. Measured basis for the predicate stated in the body: cloud pushes CLOUD_PRODUCT_NAME = 'ObjectOS Cloud', a cloud-connected runtime pushes its workspace name.
3. 门禁 check-runs (head 9e0a8d92): see the landing comment on the card for the final readings; at ACCEPT time Lint & Repo Gates, TypeScript Type Check, Build Core, Test Core 8 shards, Lint UI, Type Check UI, Test UI 14 of 16 shards, Build & E2E UI, Check Changeset, Governed Surface Queue Guard — all success; Temporal / Dogfood lanes skipped by path filter. Test UI (13/16) and Test UI (8/16) failure on the base's own red: the two ObjectSchema key-count pins at 47 (MetadataService.retiredObjectEnabled.test.ts:161, MetadataService.specKeyObjectPayload.test.ts:175) since feat(spec,plugin-security,lint): sharing.controlledByParent.ownerMayEdit — a detail row's owner updates it with read on the master #26005 added sharing; main's queue run 40353572789 fails the same assertion; this PR touches neither file. Carried by card app-shell: MetadataService.retiredObjectEnabled corpus guard expects 47 ObjectSchema keys, main now has 48 after #26005 added sharing, so Test UI is red for every ui PR #26218 (p1, domain:ui, dispatched to os-steve at 15:58Z), not by a card from this seat — the CI note above said a tooling card would be filed in this stroke; app-shell: MetadataService.retiredObjectEnabled corpus guard expects 47 ObjectSchema keys, main now has 48 after #26005 added sharing, so Test UI is red for every ui PR #26218 already is that card. Dev's local union: dispatch-gates.mjs --commands → 112 families, 111 run exit 0 (--ran reconciliation), 1 NOT MEASURED (check-plugin-teardown-shape --self-test, pinned to a commit the shallow checkout cannot reach; CI runs it on a full checkout); cli unit tier 333/334 files on the shared box, the one timeout re-measured alone under the lock 37/37; new cloud-product-name.test.ts 4 cases; ui targeted run 91 files / 1448 tests; type-checks exit 0; check:i18n-keys, check:i18n-drift exit 0; full turbo run build VERDICT 0 at both pre- and post-merge heads.
4. 接受的偏差 — (a) general-purpose subagent under os-dev.md; (b) commit trailers model-free as the pre-push hook requires, os-dev.md over the harness line; (c) session-URL footer on the PR body; (d) labels key omitted on pr_create; (e) README.md edited because docs(readme): slim the root README to a reader's page — contributor detail to CONTRIBUTING.md, stale lines out, ui/ named MIT #26148 had merged (serial constraint satisfied by merging main, conflict only in the generated sdui record, regenerated); (f) check-plugin-teardown-shape --self-test NOT MEASURED locally; (g) integration and nightly e2e tiers left to CI.
5. 范围外去向 — open question 1 (explicit branding.edition key) ruled A: keep the default-name reading; no new contract key without a second consumer. Open question 2 (the 20 developer-facing "ObjectStack Cloud" comment lines in packages/cli) ruled A, as a sibling card, not a patch round: a comments-only push would re-run the full CI for no user-visible change; the lines go into the residue card brand(residue): "ObjectStack Cloud" survives outside #26136's surface — eight docs pages, ROADMAP, four package READMEs, the AI 501 remedy string and two settings-manifest messages (with their test and checklist pins), plus developer comments #26228 (filed in this stroke, domain:devx · pm:queue) together with the user-facing residue outside this surface (content/docs/deployment/cloud-connection.mdx, index.mdx, publish-and-preview.mdx, protocol/objectql/schema.mdx, protocol/kernel/metadata-service.mdx, ui/setup-app.mdx, kernel/services-checklist.mdx, ROADMAP.md, four package READMEs, and the HTTP 501 string in packages/spec/src/system/core-services.zod.ts with its test and checklist pins). ui/AGENTS.md and ADR-0060 are governed (Tier H) — maintainer's hand, noted on the card. ui/scripts/check-changeset-presence.mjs reading ui/.changeset: observation, zero pull, not filed.
6. 落地条款 — check-governed-merges.mjs --pr 26215: 0 of 31 paths governed, 398 lines ≤ 3000 → ordinary queue landing, independent of the www / docs landings. Parked in draft under the dependent-PR convention (landing-operations §C): a queue build of this diff runs the ui lane and would be ejected on the base's red, so the PR is not flipped in this stroke. Expected-red list, exact: Test UI (13/16) → ui/packages/app-shell/src/services/MetadataService.retiredObjectEnabled.test.ts:161 AssertionError: expected 48 to be 47; Test UI (8/16) → ui/packages/app-shell/src/services/MetadataService.specKeyObjectPayload.test.ts:175 AssertionError: expected 48 to be 47 (shard numbers may shift; the two file:line signatures are the list). Any other red is this PR's. Release condition: the PR that Fixes #26218 merges into main. Then, in one stroke: relay pr_update_branch (expected_head_sha = the head at that moment) → the two signatures clear → pr_ready + automerge_enable → queue. mergeable_state re-read before the flip.

---

Generated by Claude Code