finding(cli): plugins / devPlugins are package-owned collections, but os serve and os migrate read them off the flattened top level only — and the mechanical fix is wrong

Related #14122 · same shape as #15210 (the by-shape sweep) and #14512 (the emitter half). Found while implementing #15006; deliberately not folded into it, because the answer is a decision rather than a read fix.

The sites

`file:line`	Reads
`packages/cli/src/commands/serve.ts:2622`	`let plugins = config.plugins \|\| [];`
`packages/cli/src/commands/serve.ts` (a few lines below)	`if (flags.dev && config.devPlugins) plugins = [...plugins, ...config.devPlugins];`
`packages/cli/src/utils/schema-migration-plugins.ts:1082`	`const hostPlugins = Array.isArray(config?.plugins) ? config.plugins : [];`

plugins and devPlugins are both package-owned collections by the derivation every reader in this program uses — COMPOSE_KEY_DISPOSITIONS gives them 'concat', so they are members of AssembledPackageBodySchema, so ObjectStackDefinitionSchema ∩ AssembledPackageBodySchema contains them. (Both appear in the 37-key list #15210 prints.) An option-B-shaped stack therefore carries them under packages[i].manifest.plugins and not at the top level, and all three reads above see nothing.

Why the one-line fix that every other site in the program takes is WRONG here

Everywhere else in the reader program the repair is "resolve packages[] when the top level is absent". Applying that here would hand kernel.use() whatever sits in packages[i].manifest.plugins — and on the artifact path that is inert JSON, not a live plugin instance. A JSON artifact cannot carry a constructed plugin. So the mechanical repair converts a silent skip into a boot that registers garbage.

That points at a question upstream of the CLI, which is why this is filed rather than fixed:

Should plugins / devPlugins be in the assembled-package-body key set at all? They are the only members of it whose values are live objects rather than serializable metadata. If they should not be, this is a packages/spec disposition change (COMPOSE_KEY_DISPOSITIONS), not a CLI change, and every reader in the program inherits the answer.
If they stay, what does a package's plugins mean inside an artifact — a dropped key, or a declaration the loader is supposed to resolve to a real module?

Not measured, and why

The #15004 acceptance zoo declares no plugins, so no probe row covers this today and the loss above is derived from the key set rather than observed. Adding plugins to that fixture is fixture surgery three parallel cards are reading, so it was left alone. A row belongs here once question 1 is answered — before that, a row would pin a shape that may be about to change.

Reached in practice by any multi-package host that composes plugins per package: composeStacks concatenates them to the top level today, which is exactly the copy option B removes.

docs(cli): name the filed issue for the one option-B site this card l…

升级为发射半的阻塞项，转 `needs-user-decision` —— 这不是旁支，`plugins` / `devPlugins` 是 `concat`

PM 席（epic #14122，session session_01UHvF5hyiZjnCyExFnfQB8m）。本卡由 #15006 席在实施 3/4 时发现并故意不修，那个判断是对的。但我核实处置表之后，本卡的位置要改：它不是可选的清理，而是 #14512 发射半不能绕过的前置。

实测

packages/spec/src/stack.zod.ts：

930:  plugins: 'concat',
933:  devPlugins: 'concat',

两者都是 concat，即 package-owned 集合，都在那套派生的 37 键集里。所以发射半（多包产物停止输出扁平集合）一落地：

serve.ts:2622 与 schema-migration-plugins.ts:1082 只从顶层读 plugins / devPlugins
顶层被删掉 → 读到 undefined → 插件不再注册，进程照常启动

这与本程序其余站点是同一种静默失败，只是它没有可用的修法——这正是 #15006 席拒绝机械修复的理由，而且理由成立：产物路径上 packages[i].manifest.plugins 是惰性 JSON，而调用点 kernel.use() 期待的是活的插件实例。照搬其他站点的修法，会把「静默跳过」换成「启动时注册垃圾」——修复比缺陷更糟。

所以要先裁一个 `packages/spec` 的问题

一个装活对象 / 待解析引用的集合，到底该不该留在 package-owned 键集里？

	选项	代价
A	把 `plugins`（也许还有 `devPlugins`）从 `concat` 改为信封键：顶层保留，不进 `packages[]`	这不是新增特例，是改正一次分类错误——`plugins: z.array(z.unknown())` 装的是运行时装配指令而非可序列化元数据，产物里的 `packages[i].plugins` 本来就没人能用。发射半从此不碰它们，读取方一行不用改。⚠️ 但它是已发布契约的 accept-set 变更（clause-② yes），且 `AssembledPackageBodySchema` 今天确实带着这两个键
B	读取方从 `packages[]` 读，并在装载时把 JSON 描述解析成活插件	新增一条「元数据描述 → 活对象」的解析路径，是本程序一直在避免的那类新机制；且要回答「产物里的插件引用如何解析、解析失败怎么办」
C	发射半特例跳过这两个键	裁决已经拒绝过这个形状：「a partly flattened artifact is a new permanent shape to document, migrate and explain」（#14512 comment 5528589044，⛔ Not D）

⚠️ plugins 与 devPlugins 可能要分开裁。 两者的类型不同：plugins 是 z.array(z.unknown())（可能是活对象），devPlugins 是 z.array(z.union([ManifestSchema, z.string()]))（可序列化，manifest 或字符串）。所以 A 对 plugins 成立的理由，对 devPlugins 不一定成立——后者也许真的可以走 B。

本席推荐

plugins 走 A，devPlugins 单独量过再定。 ①长远合理性领起：把一个装活对象的键留在「可组合的 package-owned 集合」里，是分类本身错了，A 是收敛而非新增特例；③防 AI 犯错：B 的失败面是「解析失败时注册了什么」，比今天的静默跳过更难诊断；④不扩散：A 改一个处置常量，B 新增一条解析路径。C 被裁决排除。

⛔ 不是本席的裁决——COMPOSE_KEY_DISPOSITIONS 是已发布产物格式的一部分，clause-② yes。这里只提交测量与推荐。

状态

needs-user-decision。⚠️ #14512 发射半在此裁定前不能落地——否则多包产物一发出去就静默丢插件。读取半其余五张（#15005 / #15006 / #15007 / #15229 / #15232）不受影响，artifact 全程 additive。

Generated by Claude Code

Maintainer ruling — A, both keys (2026-09-04, decision batch #32, card 1): `plugins` and `devPlugins` become artifact envelope keys — top level only, never inside `packages[]`; the emitter half never touches them

Director seat (objectstack #12708, summon 14, session_01LsEjuNMPitCHwEfYftZ1um, GitHub os-warren). Provenance: maintainer, live chat with the director seat, replying to batch #32 (one card, presented ~07:2xZ with the recommendation 1 A, both keys together; fallback "A for plugins, devPlugins measured first"). Verbatim: 「同意」.

Options put to the maintainer — the epic PM seat's A / B / C from 5537074924, premises re-read on origin/main a23603e: stack.zod.ts:930 / :933 both concat, hence in AssembledPackageBodySchema by the derivation at :999; plugins: z.array(z.unknown()) (:718, live objects), devPlugins: z.array(ManifestSchema | string) (:781); serve.ts:2622 and schema-migration-plugins.ts:1082 read the top level only; the artifact boot of os serve goes through the default host and never reaches :2622, so the population that meets this is a host config composing packages in memory with composeStacks(…, { manifest: 'preserve' }) once the #14512 emitter half stops flattening. A envelope keys (Clause-② yes: the published artifact format's accept set narrows — packages[i].manifest.plugins goes from accepted to refused); B readers resolve JSON descriptions into live plugins (a new resolution path); C emitter special-cases the two keys (refused in batch #23, not re-presented).

Ruled: A for both keys. As presented: ① this corrects a classification error rather than adding a special case — the only members of the collection set whose values are runtime assembly instructions were being treated as serialisable metadata, which is the whole reason "the fix is worse than the defect" here; after A, "an artifact carries metadata, a host assembles plugins" is one sentence every reader inherits. ② composeStacks really does concatenate per-package plugins to the top level for multi-package hosts, and this card is the hard precondition of the #14512 emitter half. ③ under A a plugin placed inside a package body is a loud schema refusal; under B a failed resolution registers something nobody can see; today it is a silent skip. ④ A changes one disposition row and one shape exclusion; B adds a resolver to maintain forever. devPlugins rides along: it is a load instruction too, and no artifact-path reader resolves it (os dev reads the live config only) — the dev measures that in the PR rather than a second ruling round.

Scope for the domain:spec seat (S/M, Clause-② yes — PR and card carry needs:contract-review when the PR opens; director-seat review at tier):

packages/spec/src/stack.zod.ts: keep plugins / devPlugins at concat for in-memory composition (live stacks still concatenate their plugins to the top level) but exclude both from the assembled package body — an explicit envelope exclusion beside the existing packages skip in assembledPackageBodyShape(), with the collections-shape docblock's envelope list updated to name them and say why (runtime assembly instructions, not metadata).
Pins: assembled-package-body.test.ts asserts the two keys are absent from the body key set and that a package body carrying plugins is refused (strict object); the AssembledPackageBodyKey derivation and the #15210 37-key list move to 35 — restate the count where it is printed.
Measure in the PR: readers of devPlugins on any artifact path (expect none; if one exists, stop and report — that is the fallback the maintainer was offered).
Changeset minor with a BREAKING banner per the launch-window convention, stating the migration: an existing multi-package artifact that carries packages[i].manifest.plugins (if os build ever wrote one — not directly measured, the confidence gap named to the maintainer) is refused on load after this change and must be rebuilt.
Not this card's: serve.ts / schema-migration-plugins.ts (they stay top-level readers, now correct by construction); the #15004 probe row for plugins belongs to the emitter half; A multi-package artifact serializes its metadata twice — the flattened top level and every packages[i] body carry the same definitions #14512's Blocked-by: #15219 clears when this card's PR merges.

State: needs-user-decision → pm:queue (read-modify-write; priority:p2 · domain:spec untouched; no assignee). Ledger: objectstack #12708, batch #32 entry.

Generated by Claude Code

Claim: PM loop round R2 — taken on the maintainer's summons (live chat with this seat, 2026-09-04 ~07:30Z, verbatim 「15219 插队」), ahead of the p2-by-age queue — domain:spec seat (seat post #6017). Executing the maintainer ruling A for both keys (director relay 5537162356, 2026-09-04, verbatim 「同意」): plugins / devPlugins become artifact envelope keys — excluded from the assembled package body, never inside packages[]; both stay concat for in-memory composition.
Session: session_01H2oQebDDxYKfWZusyd8GXk (GitHub os-justin)
Branch: claude/issue-15219-plugins-envelope-keys
Worktree: objectstack-issue-15219
Domain: domain:spec
File surface (all verified present on origin/main 97bcd99e, 07:36Z): packages/spec/src/stack.zod.ts (:718 plugins and :781 devPlugins declarations unchanged; :930 / :933 disposition rows stay concat; :961-976 body docblock's envelope list names the two keys and why; :977-980 AssembledPackageBodyKey — the Exclude widens from 'packages' to the three envelope keys; :999-1006 assembledPackageBodyShape() — an explicit exclusion beside the packages skip), packages/spec/src/assembled-package-body.test.ts (:64-72 ARTIFACT_ENVELOPE_KEYS gains plugins + devPlugins; a refusal pin for an assembled body carrying plugins, asserted on the unrecognized_keys issue as :190-201 already does; the derived count restated wherever it is printed), packages/spec/src/compose-stacks-manifest-preserve.test.ts (read-and-report: :273 names the packages disposition; touch only if a pin there enumerates the body keys), one new ADR-0087 entry under packages/spec/src/migrations/entries/** + regenerated packages/spec/src/migrations/registry.ts, one .changeset/*.md (@objectstack/spec minor, BREAKING banner), generated followers exactly as the gates demand (packages/spec/authorable-surface/*.json, content/docs/references/**, spec-changes.json if projected). ⛔ Not touched: packages/cli/src/commands/serve.ts:2622-2628, packages/cli/src/utils/schema-migration-plugins.ts:1082 (top-level readers, correct by construction after A), the #15004 zoo fixture (packages/cli/test/fixtures/option-b-collection-zoo.ts derives the body key set from the schema and adapts by itself), packages/core/src/artifact-packages.ts (the load gate that now refuses loudly — no edit needed).
Container & model: S/M, mode:subagent, model: claude-fable-5-1 — --tier from a detached worktree at 97bcd99e (07:36Z): no path-derived mandate, Clause ② SUSPECT surface; judged from the card content, the card changes contract accept/reject behaviour (a body carrying packages[i].manifest.plugins goes from accepted to refused) ⇒ fable-mandatory.
Clause-②: yes — the published artifact format's accept set narrows. The dev hangs needs:contract-review on the PR and on this card at PR open (dual carrier, read-modify-write + read-back); this seat reviews at tier and clears both on PASS in the same stroke as landing.
Serial constraints cleared at 07:36Z: 0 of 20 open PRs touch stack.zod.ts or assembled-package-body.test.ts (branch-name read; the epic's #15228 change set read in full — packages/cli/** only; the epic's reader-half cards #15005 / #15006 / #15007 / #15229 / #15232 are CLI/services; claude/issue-15006-*, -15007-*, -14970-* heads diffed against origin/main on the two files: empty). In-flight #14414 (PR #15227, queued) regenerates packages/spec/src/migrations/registry.ts — a merge=os-regen generated file; regenerate after merging main before the PR opens. #14462 family / #14556 / #14559: no overlap. H17 index (anchor #9857, swept 01:55Z): no on-hold trigger file on this surface. Downstream: #14512 (Blocked-by: #15219) is the epic seat's to unblock when this card's PR merges — this seat posts the unlock note there at landing.

Generated by Claude Code

Dispatch (R2, maintainer summons, 2026-09-04T07:41Z) — domain:spec seat, session_01H2oQebDDxYKfWZusyd8GXk (os-justin), seat post #6017. mode:subagent, model: claude-fable-5-1, size S/M, Clause ② yes. Landing: draft PR → seat contract review at tier → ready + auto-merge through the queue (by the seat, never the dev). The dev leaves its own Claim: comment below before its first edit.

Rulings (not re-decidable). Maintainer ruling A for both keys (director relay 5537162356, 2026-09-04, verbatim 「同意」 to the epic seat's A / B / C in 5537074924): plugins and devPlugins are artifact envelope keys — top level only, never inside packages[]; the emitter half never touches them. Operative scope, quoted from 5537162356: (1) "keep plugins / devPlugins at concat for in-memory composition (live stacks still concatenate their plugins to the top level) but exclude both from the assembled package body — an explicit envelope exclusion beside the existing packages skip in assembledPackageBodyShape(), with the collections-shape docblock's envelope list updated to name them and say why (runtime assembly instructions, not metadata)"; (2) "Pins: assembled-package-body.test.ts asserts the two keys are absent from the body key set and that a package body carrying plugins is refused (strict object); the AssembledPackageBodyKey derivation and the #15210 37-key list move to 35 — restate the count where it is printed"; (3) "Measure in the PR: readers of devPlugins on any artifact path (expect none; if one exists, stop and report — that is the fallback the maintainer was offered)"; (4) "Changeset minor with a BREAKING banner per the launch-window convention, stating the migration: an existing multi-package artifact that carries packages[i].manifest.plugins (if os build ever wrote one — not directly measured, the confidence gap named to the maintainer) is refused on load after this change and must be rebuilt"; (5) "Not this card's: serve.ts / schema-migration-plugins.ts (they stay top-level readers, now correct by construction); the #15004 probe row for plugins belongs to the emitter half; #14512's Blocked-by: #15219 clears when this card's PR merges." Options B (readers resolve JSON descriptions into live plugins) and C (emitter special-case) are refused — ⛔ no resolver, no emitter carve-out, no CLI edit. Seat's reading for (2): the "37-key list" is printed in issue #15210's body, not in code — at 97bcd99e no 37 appears in stack.zod.ts, assembled-package-body.test.ts or compose-stacks-manifest-preserve.test.ts; if a code or doc site prints the count, restate it there, otherwise measure the new count (expected 35) and print it in the PR body with the command that produced it. Seat's reading for (3): at 97bcd99e, git grep -n devPlugins origin/main -- packages ':!packages/spec' hits serve.ts:792 / :2625-2627 (the live config under --dev), format.ts:492 / :530 / :1040-1131 (a stats counter reading the top level), the CLI README and a stats test — none resolves devPlugins from packages[] or from an artifact; re-run it and quote the result; a reader that does ⇒ STOP, status: needs_decision.

Decision frame (pasted verbatim from .claude/skills/pm-dispatch/SKILL.md ## 升级与决策 at tree 97bcd99e, file last commit b17cdea0, md5 208a26aeb24cdf047e058484f4d6de3f over the block as pasted, declaring sentence through the binding sentence; use it for any needs_decision return):

每个方案必须沿四条固定评估轴分析,这是决策分析的核心原则,不是可选项:

实际业务需求 — 它服务的是真实存在的业务场景,
还是投机性能力面?判据要求实测(谁在写这个键、谁在读、
示例应用与真实部署的用法),「读起来像有用」不作数。这条轴会改变结论,不是陪衬。
项目长远合理性 — 哪个方案符合北极星方向与可持续架构(no workarounds、
contract-first),临时补丁式选项要明说长期代价。
防 AI 写代码犯错,尤其是防 AI 写元数据 app 犯错 — 哪个方案让 AI 在结构上更难写错:
契约收紧(严格 schema、publish 时响亮拒绝)优于消费端宽容(?? 回退、静默容错)——
宽容恰是 AI 批量犯错被掩盖的温床;声明即强制,绝不让 AI 声明一个运行时不兑现的能力。
创业阶段不扩散需求 — 创业阶段聚焦原则(维护者 2026-08-04 指示:
「我们是一个创业项目,应该先专注于核心能力」):能力扩张默认从紧,
无拉动的声明面按 implementation-first 处置,已发布零消费的能力不因沉没成本获得豁免。
过渡也从紧 —— 创业阶段不渐进(维护者 2026-08-27 裁,逐字:「项目在创业阶段,
用户也很少,短期不考虑渐进。」):废弃别名/拼写与能力退役默认立即退休,
不设分阶段窗口、不留双拼写宽限;staged 选项仅凭具名外部用户证据才可呈报为推荐。

推荐意见必须基于这四条轴给出理由;四轴冲突时如实呈现权衡,
交维护者拍板。

PM mechanism assumptions (verify). (a) The body's refusal door is ManifestSchema's strict close carried through .extend() — assembled-package-body.test.ts:190-201 pins the unrecognized_keys issue; confirm that removing a key from assembledPackageBodyShape() is what makes AssembledPackageBodySchema refuse it, and pin both keys the same way (issue code + path, never "it threw"). (b) AssembledPackageBodyKey (:977-980) and assembledPackageBodyShape() (:999-1006) must exclude the same three keys — the Pick return type turns a mismatch into a compile error; prove it once in reverse (drop the runtime exclusion only → typecheck or the pin goes red → restore, blob-hash proof). (c) A BREAKING changeset must carry an adr-0087: disposition the gate accepts (node scripts/check-adr-0087-registration.mjs --base origin/main): two keys leave a published schema, so read packages/spec/src/migrations/entries/README.md and choose between per-key retired-keys entries and one semantic D3 entry by what the README and the gate prescribe — then gen:migration-registry and check:migration-registry. PR #15227 (in the merge queue, position 2 of the chain at 07:39Z) also regenerates registry.ts (merge=os-regen); merge origin/main and regenerate before the PR opens. (d) Generated followers: the stack schema's docs and authorable surface may move under packages/spec/authorable-surface/*.json and content/docs/references/** — check:generated --fix then a clean second run decides; spec-changes.json and the upgrade guide project step entries only at the major (as #15227 found). (e) Consumers derive, not transcribe: packages/cli/test/fixtures/option-b-collection-zoo.ts:63 reads AssembledPackageBodySchema's keys; packages/core/src/artifact-packages.ts:217 parses every artifact entry with ArtifactPackageSchema — after this change that seam is where a body carrying plugins is refused loudly. No edit to either; build the closure (pnpm --filter '@objectstack/core...' build, and '@objectstack/cli...' if the cli tests need dist) and run packages/core's artifact-packages tests and packages/cli/test/option-b-reader-acceptance.pin.test.ts plus the zoo's importers; quote counts and direction. (f) compose-stacks-key-loss.test.ts / compose-stacks-manifest-preserve.test.ts: plugins concatenation in composeStacks stays; if a pin there enumerates the body key set it moves with (2) and nothing else. (g) Liveness / strictness ledgers: the two keys stay on the stack schema and no new z.object appears — the gates' own lines decide.

Surface, gates, report. File surface = the claim comment 5537297101 (stop on breach). 预期落点是 packages/spec/src/stack.zod.ts;若实测表明真正的生产者在别包,报备后按生产者侧修(落点与理由写进报告和 PR 正文),⛔ 不在消费者侧打补丁。Derive gates after the last commit from the real change set (node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands, no path args, from a tree at origin/main); at minimum: pnpm --filter @objectstack/spec exec vitest run src/assembled-package-body.test.ts src/compose-stacks-key-loss.test.ts src/compose-stacks-manifest-preserve.test.ts, pnpm --filter @objectstack/spec typecheck, pnpm --filter '@objectstack/spec...' build, check:generated --fix + a clean second run, check:migration-registry, node scripts/check-adr-0087-registration.mjs --base origin/main, node scripts/check-changeset-no-major.mjs --base origin/main, check:api-surface, check:authorable-surface, check:docs, check:spec-changes, check:liveness, check:strictness-ledger, pnpm check:doc-authoring, pnpm check:nul-bytes, node scripts/check-system-context-census.mjs, pnpm lint, plus the consumer readings in (e). Reverse verification: at HEAD, put the two keys back into the body (drop the exclusion) → the new pins go red and the derived count returns to 37 → restore, prove by git hash-object == the HEAD blob. Clause ②: hang needs:contract-review on the PR and on this card at PR open (read current set → union → write → read back; declare the MCP whole-set write as a channel switch). PR: draft, first line Fixes #15219, body quotes the ruling's operative sentences, premise re-verified at the worktree base with refs, the devPlugins reader measurement, consumer readings with direction and closure built, a measurements table pinned to the head sha. Report: os-dev-report first as a comment here, then as the return; machine-checkable fields only.

Generated by Claude Code

Claim: os-dev for this card, dispatched by the domain:spec seat (claim 5537297101, dispatch 5537332589). Executing maintainer ruling A for both keys (5537162356) — plugins / devPlugins become artifact envelope keys: excluded from the assembled package body, never inside packages[], both stay concat for in-memory composition.
Session: session_01H2oQebDDxYKfWZusyd8GXk
Branch: claude/issue-15219-plugins-envelope-keys (pushed empty as the write-route probe, exit 0)
Worktree: objectstack-issue-15219, cut from origin/main 460134af (main moved past the seat's 97bcd99e reading; premise re-verified at 460134af: stack.zod.ts:718 plugins: z.array(z.unknown()), :781 devPlugins, :930 / :933 both concat, :961-976 body docblock, :977-980 AssembledPackageBodyKey, :999-1006 assembledPackageBodyShape() with the packages skip; assembled-package-body.test.ts:64-72 ARTIFACT_ENVELOPE_KEYS, :125 set-difference pin, :190-201 unrecognized_keys pin — all hold).
File surface (as claimed by the seat): packages/spec/src/stack.zod.ts, packages/spec/src/assembled-package-body.test.ts, packages/spec/src/compose-stacks-manifest-preserve.test.ts (read-and-report), one new packages/spec/src/migrations/entries/semantic/18.*.ts + regenerated registry.ts, one .changeset/*.md (@objectstack/spec minor, BREAKING banner, adr-0087: marker), generated followers as the gates demand.
Surface note, measured before the first edit: packages/cli/test/option-b-reader-acceptance.pin.test.ts:188 transcribes the seven envelope keys literally, so it goes red once the envelope has nine. Four in-flight branches already edit that file (claude/issue-15005-*, -15006-*, -15007-*, -15229-*; none of their hunks overlap lines 176-200), so the bounded in-place fix exemption does not apply (the file is held) — I am NOT editing it; the report carries the decision for the seat.
Clause ②: yes — needs:contract-review goes on the PR and on this card at PR open. Assignee untouched. Not touched: serve.ts, schema-migration-plugins.ts, the #15004 zoo fixture, artifact-packages.ts.

Generated by Claude Code

os-dev-report

{
  "issue": 15219,
  "status": "done",
  "branch": "claude/issue-15219-plugins-envelope-keys",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/15289",
  "head_sha": "d5ff0b3e6e7e9a2903c2a7a5e181bbb23ac79745",
  "worktree_base": "460134af85f7ab2cf68abc62f1bbb9783b8899dd",
  "premise_still_valid": true,
  "premise_evidence": "At 460134af (and d5ff0b3e6): stack.zod.ts:718 plugins z.array(z.unknown()); :781 devPlugins; :930/:933 both concat; :977-980 Exclude over 'packages' only; :999-1006 the packages-only skip; test :64-72 seven-key ARTIFACT_ENVELOPE_KEYS, :125 set-difference pin, :190-201 unrecognized_keys pin. Base behaviour measured via the reverse run: a wrapper carrying manifest.plugins parsed green, the body accepted devPlugins, package-owned keys 37, envelope 7.",
  "summary": "Ruling A for both keys executed in packages/spec: one constant ASSEMBLED_PACKAGE_BODY_ENVELOPE_KEYS = ['packages','plugins','devPlugins'] (as const satisfies readonly StackDefinitionKey[]) now feeds both the AssembledPackageBodyKey type and the assembledPackageBodyShape() loop, so a body carrying plugins or devPlugins is refused at the manifest's strict close (unrecognized_keys naming the key; path manifest through ArtifactPackageSchema) while both keys stay concat and at the top level (composeStacks still concatenates them; manifest:'preserve' no longer folds them into bodies, by derivation). Docblocks name the three envelope keys and why. Five new pins plus the envelope list in assembled-package-body.test.ts; ADR-0087 D3 semantic entry 18.assembled-package-body-plugins-envelope + regenerated registry.ts (151 semantic after merging main's #15227); BREAKING minor changeset with FROM-to-TO migration and the registered marker. No generated follower moved (check:generated --fix regenerated nothing). No CLI/core edit. One expected red outside the claimed surface: packages/cli/test/option-b-reader-acceptance.pin.test.ts:188 transcribes the seven envelope keys literally and now receives nine; the file is held by four in-flight branches, so it was not touched (open question 1).",
  "tests": "At head d5ff0b3e6, all under scripts/pm/os-verify-lock.sh (slot issue-15219): spec vitest src/assembled-package-body.test.ts src/compose-stacks-key-loss.test.ts src/compose-stacks-manifest-preserve.test.ts -> 'Test Files 3 passed (3) / Tests 53 passed (53)'; pnpm --filter @objectstack/spec typecheck -> exit 0, 'check:test-typecheck: OK ... 54 file(s) / 261 error(s) / 145 pinned signature(s)' (ledger unchanged), 0 'error TS'; spec build -> 'check-dts-emitted 34/34', .build-input-hash 2fa354834bab37c2. Consumers (downstream of spec; closures built via turbo '@objectstack/metadata...' + '@objectstack/objectql...' 15 tasks and '@objectstack/cli...' 56 tasks, minus spec, OS_SKIP_DTS=1 which turbo.json lists in globalEnv): metadata src/plugin-artifact-packages-attribution.test.ts 7/7; objectql src/artifact-load-path.test.ts 14/14; cli test/option-b-reader-acceptance.pin.test.ts 1 failed / 5 passed — the :188 literal envelope list ('expected [ api, devPlugins, i18n, ...(6) ] to deeply equal [ api, i18n, manifest, ...(4) ]'). Reverse verification on the committed tree: runtime exclusion only replaced by the old packages-only skip (marker count 1 / removed-line count 0 on disk; mutated blob b0cb9bcb differs from HEAD blob f600508f; test resolves ./stack.zod from src so no dist on the path, no rebuild needed for either leg) -> 6 red (the #14242 set-difference pin + all five #15219 pins), count back to 37 / envelope 7, both refusals flipped to accepted; restore by git checkout HEAD on the absolute path under an EXIT/INT/TERM trap, restored blob f600508fcd481af2d4b53e055eb063a12a7794d8 == HEAD blob, git diff HEAD empty, status clean, marker 0. Direction observed: red, not reversed. Key count printed in the PR (no code/doc site prints it): package-owned = 35, envelope = 9, via a tsx script over src intersecting the two schemas' shape keys.",
  "gates": [
    {"name": "pnpm --filter @objectstack/spec build (with .d.ts)", "exit": 0, "verdict_line": "check-dts-emitted: @objectstack/spec - 34/34 declared declaration file(s) present. / packages/spec/dist/.build-input-hash written as 2fa354834bab37c2"},
    {"name": "spec vitest (3 files)", "exit": 0, "verdict_line": "Test Files 3 passed (3) · Tests 53 passed (53)"},
    {"name": "pnpm --filter @objectstack/spec typecheck", "exit": 0, "verdict_line": "check:test-typecheck: OK — @objectstack/spec's test layer compiles under packages/spec/tsconfig.test.json; 54 file(s) / 261 error(s) / 145 pinned signature(s)"},
    {"name": "check:generated --fix", "exit": 0, "verdict_line": "All 15 generated artifacts are up to date."},
    {"name": "check:generated (clean second run)", "exit": 0, "verdict_line": "All 15 generated artifacts are up to date."},
    {"name": "check:migration-registry", "exit": 0, "verdict_line": "src/migrations/registry.ts is current (151 semantic, 86 retired-key, 94 retired-def)"},
    {"name": "node scripts/check-adr-0087-registration.mjs --base origin/main", "exit": 0, "verdict_line": "check-adr-0087-registration: 1 declared-breaking changeset(s), each carrying an ADR-0087 disposition. — registered assembled-package-body-plugins-envelope (new here)"},
    {"name": "node scripts/check-changeset-no-major.mjs --base origin/main", "exit": 0, "verdict_line": "This diff introduces no `major` bump."},
    {"name": "check:api-surface", "exit": 0, "verdict_line": "@objectstack/spec public API surface + factory signatures unchanged"},
    {"name": "check:authorable-surface", "exit": 0, "verdict_line": "Successfully generated 1603 schemas."},
    {"name": "check:docs", "exit": 0, "verdict_line": "230 generated files in sync with packages/spec"},
    {"name": "check:spec-changes", "exit": 0, "verdict_line": "spec-changes.json is up to date."},
    {"name": "check:upgrade-guide", "exit": 0, "verdict_line": "protocol-upgrade-guide.md is up to date."},
    {"name": "check:liveness", "exit": 0, "verdict_line": "packages/spec/liveness/state-counts.md is current — the same 35 row(s), no count column left in the README."},
    {"name": "check:strictness-ledger", "exit": 0, "verdict_line": "docs/audits/2026-07-unknown-key-strictness-ledger.counts.md is current — 440 site(s) measured, 1 authorable strip site(s) left."},
    {"name": "pnpm check:doc-authoring", "exit": 0, "verdict_line": "doc authoring guard: sibling-package prose ids hold the baseline — 831 pinned site(s) across 231 file(s), no growth, no burn-down unrecorded."},
    {"name": "pnpm check:nul-bytes", "exit": 0, "verdict_line": "check-nul-bytes: OK (scanned 8286 text file(s) -- 8286 tracked; no raw ASCII control bytes)."},
    {"name": "node scripts/check-system-context-census.mjs", "exit": 0, "verdict_line": "check-system-context-census: OK — 106 elevation read sites in 20 packages across 45 files, all anchored; 140 anchors resolve, 27 declared non-read."},
    {"name": "pnpm lint (repo-wide, full run, not narrowed)", "exit": 0, "verdict_line": "eslint . --no-inline-config exited 0 (84 s wall, shared box)"},
    {"name": "derived set: node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands (5 paths vs merge base 4dd5041bd)", "exit": 0, "verdict_line": "63 commands derived; 61 exit 0 (root batch 44/46, spec batch 17/17); the 2 non-zero are the NOT MEASURED rows below"},
    {"name": "pnpm check:dual-build-cjs-loads", "exit": 3, "verdict_line": "NOT MEASURED — PREREQUISITE NOT MET: this gate reads built output, and some package has no dist/ (85 listed). Run pnpm build first. This is NOT a pass: nothing was measured."},
    {"name": "pnpm check:type-check-debt", "exit": 3, "verdict_line": "NOT MEASURED — check-type-check-coverage: PREREQUISITE NOT MET — 32 workspace dependenc(ies) of the ledgered packages have no built type entry point on disk"},
    {"name": "check:entry-nameability", "exit": 0, "verdict_line": "entry-nameability: 434 call probes across 17 public entries, 0 new unnameable structural mentions — plus its standing note 'NOT MEASURED: no callable export on @objectstack/spec/qa' (pre-existing)"},
    {"name": "consumer: @objectstack/metadata src/plugin-artifact-packages-attribution.test.ts", "exit": 0, "verdict_line": "Test Files 1 passed (1) · Tests 7 passed (7)"},
    {"name": "consumer: @objectstack/objectql src/artifact-load-path.test.ts", "exit": 0, "verdict_line": "Test Files 1 passed (1) · Tests 14 passed (14)"},
    {"name": "consumer: @objectstack/cli test/option-b-reader-acceptance.pin.test.ts", "exit": 1, "verdict_line": "Test Files 1 failed (1) · Tests 1 failed | 5 passed (6) — :188 'the two shapes differ in exactly the package-owned collections' (literal seven-key envelope list; expected red, file outside the claim surface, held by four in-flight branches)"}
  ],
  "ruling_3_devplugins_readers": "git grep -n devPlugins HEAD -- packages ':!packages/spec' at d5ff0b3e6: 23 hits in 4 files (cli README:196; serve.ts:792,2625-2627 live config under --dev; format.ts:492,530,1040-1131 stats counter over the top level; print-metadata-stats-zero-row.test.ts). Broader pattern for packages[...].devPlugins / manifest.devPlugins / artifact ... devPlugins: 4 hits, all this PR's own migration-entry prose in packages/spec; 0 outside spec. No artifact-path reader; the fallback is not triggered.",
  "mechanism_assumptions": {"a": "held", "b": "half — the Pick return type cannot see a runtime-only mismatch (the shape is cast); the pin went red, typecheck not re-measured under mutation; closed structurally by the shared constant", "c": "held — semantic D3 entry, registered accepted", "d": "held — nothing regenerated", "e": "half — zoo derives; cli pin :188 transcribes and reds", "f": "held", "g": "held"},
  "clause_2_labels": {"card_15219": "read [priority:p2, pm:dispatched, domain:spec] -> union write -> read back [priority:p2, pm:dispatched, domain:spec, needs:contract-review] (4 == 4, nothing stripped)", "pr_15289": "read [size/m] -> union write -> read back [size/m, needs:contract-review] (2 == 2, nothing stripped)"},
  "channel_switches": ["REST repo-scoped read probed 403 at session start ('GitHub access is not enabled for this session') and gh is absent, so GitHub reads/writes went through MCP; the issue body and the first three comments were read from the public issue page's embedded JSON payload (zero quota); label writes were MCP whole-set writes (read -> union -> write -> compare read-back) on both carriers"],
  "deviations_from_the_claim_surface": [],
  "mcp_calls": "14 — 1 get_comments (dispatch comment, page 2 of the web payload), 1 claim comment, 1 targeted search_issues (dedup), 2 get_labels on the card, 1 get_labels on the PR (refused: PR numbers not resolvable there), 1 create_pull_request, 2 pull_request_read (read-backs), 2 issue_write (label unions), 1 update_pull_request (count correction), 1 report comment, 1 report read-back",
  "open_questions": [
    {
      "question": "Who moves packages/cli/test/option-b-reader-acceptance.pin.test.ts:188 (the literal seven-key ARTIFACT_ENVELOPE_KEYS list, now nine) and the zoo header/const prose 'seven' at option-b-collection-zoo.ts:26,67? Test Core is red on this PR until it moves. Measured: four in-flight branches edit the pin file (claude/issue-15005-*, -15006-*, -15007-*, -15229-*; hunks at lines 83-141, 207-224, 272-284 — none overlaps 176-200); #15229 also edits the zoo.",
      "options": [
        "A — extend this card's claim by that one pin file (+ the zoo prose) and push the two-name addition on this PR; the text merge against all four branches is clean by hunk position.",
        "B — hold this PR until #15229 (verify option-b readers, already editing both files) lands and carries the nine-key list; this spec landing then waits on a reader-half card.",
        "C — land with the pin red: not available, Test Core is required."
      ],
      "recommendation": "A. Real need: the literal list is the pin's reviewable half and must say nine — ruling (2) itself says restate the count where it is printed. Long-term: the envelope set changed by ruling; a reader-half card should not carry a spec-side restatement. AI-error prevention: a literal that disagrees with the derived set is precisely the drift the pin exists to catch; leaving it red teaches nothing and blocks the queue. Startup focus: a two-line push-fix on the PR that caused it, versus sequencing a spec landing behind another card's schedule."
    }
  ],
  "out_of_scope_findings": [
    "already filed as #14721: the AssembledPackageBodySchema docblock paragraph 'NOT strictObject: ManifestSchema is an open object' (stack.zod.ts) is stale since #14192 closed the manifest — it now sits a few lines under this PR's pins asserting exactly that refusal; not re-filed, left for its card.",
    "not filed (a consequence of this card, not a pre-existing defect): option-b-collection-zoo.ts:26 and :67 say 'seven' envelope keys; nine after this PR — belongs with whichever card moves the :188 pin (open question 1)."
  ]
}

Generated by Claude Code

Patch round: claim extended per seat ruling (option A on the report's open question 1) — packages/cli/test/option-b-reader-acceptance.pin.test.ts (the literal envelope list at :188 gains devPlugins and plugins — nine keys, in the file's own sort order) + packages/cli/test/fixtures/option-b-collection-zoo.ts (the :26 header and :67 const prose "seven" → "nine"; nothing else). Done in a fresh worktree of the branch after merging origin/main in the os-regen order (merge commit b6ada92c1; gen:migration-registry then check:migration-registry: "✓ src/migrations/registry.ts is current (151 semantic, 86 retired-key, 94 retired-def)"; no conflict, no regeneration diff).

Head 749729185 (7497291853d1d01b26ad641b0588f672e2a68c0a), pushed; PR #15289 now carries it.

Measured at 749729185, build/test runs under scripts/pm/os-verify-lock.sh (slot issue-15219):

cli pin pnpm --filter @objectstack/cli exec vitest run --maxWorkers=2 test/option-b-reader-acceptance.pin.test.ts → exit 0, "Test Files 1 passed (1) · Tests 6 passed (6)" — 6/6.
spec trio pnpm --filter @objectstack/spec exec vitest run --maxWorkers=2 src/assembled-package-body.test.ts src/compose-stacks-key-loss.test.ts src/compose-stacks-manifest-preserve.test.ts → exit 0, "Test Files 3 passed (3) · Tests 53 passed (53)".
pnpm --filter @objectstack/spec build (with declarations) → exit 0, "check-dts-emitted: @objectstack/spec - 34/34 declared declaration file(s) present." — .build-input-hash 2fa354834bab37c2, identical to the previous head (main's merge touched only a spec script).
check:generated → exit 0, "✓ All 15 generated artifacts are up to date."
check:browser-reachable-entries / check:dual-source-exports / check:entry-nameability / check:exported-any → all exit 0 ("✅ … 44 bundle(s) scanned …" / "✅ no new dual-source exports: 5050 names across 17 entry points" / "✅ entry-nameability: 434 call probes across 17 public entries, 0 new unnameable structural mentions" / "✅ no exported type resolves to any: 2457 types + 1524 schemas").
node scripts/check-adr-0087-registration.mjs --base origin/main → exit 0, "✓ 1 declared-breaking changeset(s), each carrying an ADR-0087 disposition."; node scripts/check-changeset-no-major.mjs --base origin/main → exit 0, "✓ This diff introduces no major bump."; pnpm check:nul-bytes → exit 0, "check-nul-bytes: OK (scanned 8285 text file(s) … no raw ASCII control bytes)."; eslint on the two cli files → exit 0.

Tooling observation for the seat (no file changed for it): a turbo closure build with --filter='@objectstack/cli...' --filter='!@objectstack/spec' still executed @objectstack/spec:build as a ^build dependency (turbo 2.10.10, "cache miss, executing"), so under OS_SKIP_DTS=1 it replaced spec's dist with a declarations-less build; check:api-surface then reported "dist holds no .d.ts declarations" until spec was rebuilt with declarations — which is the order every reading above followed (rebuild after the closure, then the gates).

Generated by Claude Code

Contract review (Clause ②, in-seat at tier) — PASS · ACCEPT — domain:spec seat, 2026-09-04T11:31Z, on PR #15289 head 74972918 (the contract content of d5ff0b3e plus the seat-ruled patch: packages/cli/test/option-b-reader-acceptance.pin.test.ts:188 nine-key literal, option-b-collection-zoo.ts:26,67 prose, and a merge of main).
Implemented-by: claude/issue-15219-plugins-envelope-keys
Reviewed-by: session_01H2oQebDDxYKfWZusyd8GXk
Tier fuse: get_session 08:52Z and 11:28Z — session_context.model = last_served_model = claude-fable-5-1. No contract fork and no dev flag on a contract judgment (the one open question was a claim-surface question, ruled A by the seat at 08:52Z and recorded on the epic anchor: 5538085434), so no isolated second opinion was owed.

Derived judgments (against the diff on origin/main, not the report): ① accept set — AssembledPackageBodySchema loses plugins and devPlugins: a body carrying either is refused at the manifest's strict close (unrecognized_keys naming the key, path through ArtifactPackageSchema), exactly the ruling's A for both keys; the stack schema's two declarations are unchanged (stack.zod.ts:718, :781), both stay concat (:930, :933), composeStacks still concatenates them at the top level, and manifest: 'preserve' stops folding them into bodies by derivation — right. ② one constant ASSEMBLED_PACKAGE_BODY_ENVELOPE_KEYS = ['packages', 'plugins', 'devPlugins'] feeds both AssembledPackageBodyKey and assembledPackageBodyShape(), closing the type/runtime mismatch the dispatch's assumption (b) worried about — right, and better than two lists. ③ pins assert unrecognized_keys + the key + the path, never "it threw"; ARTIFACT_ENVELOPE_KEYS gains both keys with the reason; the reverse run (exclusion replaced by the old packages-only skip) turned six pins red and both refusals back to accepted, restore proven by blob hash — right. ④ ruling (3) measured on the tree: no artifact-path reader of devPlugins (serve.ts live config under --dev, format.ts stats counter, README, a stats test) — the fallback is not triggered. ⑤ ruling (2): no code or doc site prints the 37, the PR body prints the measured 35 package-owned / 9 envelope with its command — right. Semver: @objectstack/spec minor with a BREAKING banner under the launch-window convention, adr-0087: registered assembled-package-body-plugins-envelope — a D3 semantic entry (not retired-keys: both keys stay declared on the stack; not D2: no lossless target, a live instance has no JSON form and hoisting changes who loads it) — the gate accepted it; correct. No generated follower moved (check:generated --fix regenerated nothing) — consistent with no key added or removed on the stack schema.

Patch verified on 74972918: the pin's literal list reads nine keys, the zoo prose reads nine; CI on that head — 34 check runs all success (Test Core ×6 incl. the cli pin, Lint & Repo Gates, all four Type Check jobs, Governed Surface Queue Guard, Spec property liveness, Check Changeset) between 09:04Z and 09:22Z. The four epic branches that share the pin file edit disjoint hunks (notice 5538085434); #15229 landing first makes those two lines a no-op merge.

Clearing needs:contract-review on both carriers in this stroke (provenance: the 2026-08-31 ruling — in-seat review at tier, PASS ⇒ same seat strips both carriers; dual-carrier reading taken through MCP: card labels read back at 11:29Z = priority:p2 · pm:dispatched · domain:spec · needs:contract-review; PR labels documentation · size/m · tests · tooling · needs:contract-review). Landing pre-checks: ① this PASS; ② both carriers cleared (read back after the write); ③ all checks green on the current head. Not governed (packages/spec/**, packages/cli/test/**, .changeset/). Next stroke: ready + auto-merge (squash) with a provenance comment on the PR; on MERGED — strip pm:dispatched, probe stack.zod.ts on origin/main, unlock note on #14512 (Blocked-by: #15219).

Generated by Claude Code

Landed — domain:spec seat, session_01H2oQebDDxYKfWZusyd8GXk, 2026-09-04T12:04Z. PR #15289 MERGED 11:58:25Z through the merge queue as 8f404a51 (squash); Fixes closed this card. Probed on origin/main 8f404a51 (12:02Z): packages/spec/src/stack.zod.ts:1011 declares ASSEMBLED_PACKAGE_BODY_ENVELOPE_KEYS = ['packages', 'plugins', 'devPlugins'] feeding both the type and the runtime shape; packages/spec/src/migrations/entries/semantic/18.assembled-package-body-plugins-envelope.ts is present and registry.ts was regenerated with it; the cli pin at packages/cli/test/option-b-reader-acceptance.pin.test.ts carries the nine-key list. pm:dispatched stripped (read-modify-write: priority:p2 · domain:spec kept). Clause ② carriers were cleared at PASS (5539806437). Follow-on: #14512 (the emitter half, Blocked-by: #15219) is unlocked by this merge — note posted there for the epic seat; the #15004 probe row for plugins belongs to that half. PR #15299 (#14676) now resyncs registry.ts on top of this merge before it is enqueued.

Generated by Claude Code

Provenance correction (seat, 2026-09-04T12:10Z): the dispatch 5537332589 recorded md5 208a26aeb24cdf047e058484f4d6de3f for its pasted four-axis frame block. That hash was taken over a scratch copy that stopped at the last bullet; the block as pasted (declaring sentence through the binding sentence "推荐意见必须基于这四条轴给出理由;四轴冲突时如实呈现权衡,交维护者拍板。") is complete and verbatim, and its md5 is 22f2339f0acb64cdb50c7adc9db681c3 (SKILL.md ## 升级与决策, unchanged text at 97bcd99e and 8f404a51). The text was right; the recorded hash was not.

Generated by Claude Code

fix(cli): resolve `packages[]` at the four config-load boundaries and…

feat(spec)!: `plugins` / `devPlugins` are artifact envelope keys — ex…

test(spec): the first root-level test file group's titles state each …

Navigation Menu

Repository navigation

finding(cli): `plugins` / `devPlugins` are package-owned collections, but `os serve` and `os migrate` read them off the flattened top level only — and the mechanical fix is wrong #15219

The sites

Why the one-line fix that every other site in the program takes is WRONG here

Not measured, and why

升级为发射半的阻塞项，转 `needs-user-decision` —— 这不是旁支，`plugins` / `devPlugins` 是 `concat`

实测

所以要先裁一个 `packages/spec` 的问题

本席推荐

状态

Maintainer ruling — A, both keys (2026-09-04, decision batch #32, card 1): `plugins` and `devPlugins` become artifact envelope keys — top level only, never inside `packages[]`; the emitter half never touches them

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

finding(cli): plugins / devPlugins are package-owned collections, but os serve and os migrate read them off the flattened top level only — and the mechanical fix is wrong #15219

Description

The sites

Why the one-line fix that every other site in the program takes is WRONG here

Not measured, and why

Activity

hotlong commented on Sep 4, 2026

升级为发射半的阻塞项，转 needs-user-decision —— 这不是旁支，plugins / devPlugins 是 concat

实测

所以要先裁一个 packages/spec 的问题

本席推荐

状态

os-warren commented on Sep 4, 2026

Maintainer ruling — A, both keys (2026-09-04, decision batch #32, card 1): plugins and devPlugins become artifact envelope keys — top level only, never inside packages[]; the emitter half never touches them

os-justin commented on Sep 4, 2026

os-justin commented on Sep 4, 2026

os-justin commented on Sep 4, 2026

os-justin commented on Sep 4, 2026

os-justin commented on Sep 4, 2026

os-justin commented on Sep 4, 2026

os-justin commented on Sep 4, 2026

os-justin commented on Sep 4, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

finding(cli): `plugins` / `devPlugins` are package-owned collections, but `os serve` and `os migrate` read them off the flattened top level only — and the mechanical fix is wrong #15219

升级为发射半的阻塞项，转 `needs-user-decision` —— 这不是旁支，`plugins` / `devPlugins` 是 `concat`

所以要先裁一个 `packages/spec` 的问题

Maintainer ruling — A, both keys (2026-09-04, decision batch #32, card 1): `plugins` and `devPlugins` become artifact envelope keys — top level only, never inside `packages[]`; the emitter half never touches them