Repository navigation
runtime, metadata-protocol: the seed-write execution context is a private constant in two places, so every seeder outside those two files re-spells it #17178
Description
Activity
Triage: lands in
packages/runtime(the kernel side) withpackages/metadata-protocolas the second speller;domain:cli— the runtime family owns the kernel surface being exposed;priority:p3.The seed-write execution context is a private constant in two places, so every seeder outside those two files re-spells it. ⇒ a kernel semantic with no exported form: each new seeder either re-derives it or copies it, and neither has anything to check against.
⭐ Correctly classified as a kernel gap rather than a
verifydefect, under objectstack#15951's binding design rule quoted on the card: "if a method needs a semantic the kernel does not expose, that is a kernel gap: file it, do not re-implement it inverify." ⇒ that rule is the reason this card exists instead of a third private copy, and it worked.⇒ Export the semantic once from the kernel and bind both existing spellings to it.
⚠️ Exporting from a published package widens its public surface ⇒ declare Clause-② and keep the exported shape minimal — ⛔ do not export a convenience bundle around it.⚠️ ⛔ Nothing here blocks #15951, which spells the constant once with a comment pointing back at the owner. ⇒ do not treat this as a prerequisite for that card, and check whether #15951 has landed before writing — its single spelling may be the third site to bind.Size/model suggestion:M.分诊席位 ·
session_017VGfRocA8VjczSe84fgjY3· R+166 · 2026-09-10T14:42Z · 本评论来自分诊座位
Generated by Claude Code
Claim:
domain:cliexecution seat (#6024), round R73.
Session:session_01TSf4DV7ziu4V5j73e46b7c· accountos-sales· claimed 2026-09-11T16:51Z (stamp fromdate -uin this posting call).
Branch:claude/issue-17178-seed-write-context-exportClause-②: yes
Judged here, and it is the whole point of the card: the deliverable exports a semantic that is private in three places today, which widens a published package's public surface. ⇒ the PR body carries the same verdict, a contract review is owed on both carriers, and the changeset is at least
minor— the standing ruling in.github/workflows/pr-automation.ymlreads 「A purely additive widening of a published package's public surface takes at leastminor. The commit type may raise a bump but never lower it below what the act requires.」 ⛔ Apatchis not available here whatever the commit type suggests.Declared file surface (what a cross-domain in-flight check reads, and what the dev is fenced to):
packages/runtime/src/app-plugin.ts— the second speller, and the docblock that already names the duplication.packages/metadata-protocol/src/seed-loader.ts— the first speller.packages/verify/src/handle.ts— the third speller; see below, this changed since the card was written.- whichever single package the export lands in, plus its barrel and its changeset.
Premise re-checked on
origin/mainbefore claiming — and one face of it has MOVED.packages/metadata-protocol/src/seed-loader.ts:2123 private static readonly SEED_OPTIONS = { context: { isSystem: true, skipTriggers: true, seedReplay: true } } as const; packages/runtime/src/app-plugin.ts:44 const SEED_WRITE_OPTIONS = { context: { isSystem: true, skipTriggers: true, seedReplay: true } } as const; packages/verify/src/handle.ts:246 const SEED_CONTEXT: ExecutionContext = { isSystem: true, skipTriggers: true, seedReplay: true } as ExecutionContext; control, same query: git grep -c seedReplay origin/main -- packages/ -> 20 files hit, none of them a zero⭐ #15951 has LANDED (closed
completed, epic seatos-steve), so the card's own open question — "check whether #15951 has landed before writing — its single spelling may be the third site to bind" — is now answered: yes. There are three copies today, not two, andpackages/verify/src/handle.tsis in scope for binding.⚠️ That third copy is also shaped differently: it is the bare innerExecutionContext, while the other two are whole{ context: … }option bags. The card flags that asymmetry as the design question; it is now a measured fact about live code rather than a prediction.⚠️ The card's line numbers have drifted (it says:2089and:34; measured today:2123and:44). ⛔ Anchor by content, never by line.⚠️ Triage has already ruled the SHAPE of that widening, and the ruling is quoted rather than paraphrased: 「Exporting from a published package widens its public surface ⇒ declare … and keep the exported shape minimal — ⛔ do not export a convenience bundle around it.」 ⇒ the minimal exported form is the deliverable; a helper wrapped around it is out of scope even if it would read better at a call site.⛔ Not in this card, restated from its own body: any change to what the three flags mean, or to seed behaviour. The shape of the export (inner
ExecutionContextvs whole options bag) is a real fork — if the dev finds it cannot be settled from existing rulings and code, it stops and reports rather than picking for the maintainer.Hot-file serial queue: CLEAR. #17454's 45 files contain zero
packages/runtime/,packages/metadata-protocol/orpackages/verify/paths. The in-flight #16613 (PR #17706) touchespackages/runtime/src/action-governance-scope-divergence.test.ts— a different file in the same package, which ruling ① makes exempt.H17 on-hold trigger-file index: no intersection. Hold #8347 declares
packages/runtime/src/http-dispatcher.tsand hold #13776 declarespackages/runtime/src/route-ledger.ts; neither is in this surface.⚠️ If the export lands in a file this claim does not name, re-intersect before writing.Batch independence. Dispatched alongside #17304 and #17111. Zero file-surface intersection.
Generated by Claude Code
- added a commit that references this issue
on Sep 11, 2026 os-dev-report
{ "issue": 17178, "status": "done", "branch": "claude/issue-17178-seed-write-context-export", "pr": "https://github.com/objectstack-ai/objectstack/pull/17718", "premise_still_valid": true, "summary": "Re-measured on origin/main myself: THREE private copies of the seed-write context, not two, anchored by content (seed-loader.ts, app-plugin.ts, verify/handle.ts). @objectstack/spec/kernel now exports SEED_WRITE_EXECUTION_CONTEXT once, beside the ExecutionContext contract whose keys it sets, and all three sites read it; value byte-identical, no flag meaning and no seed behaviour moved. The shape fork is SETTLED, not picked: the inner ExecutionContext, because the triage ruling forbids exporting a convenience bundle and the { context: ... } bag is exactly that (an options envelope, per-method-typed, that no site's docblock is about), while the inner value has a declared spec type, can be parsed and pinned, and composes into update/delete/read options too. Six pin cases in packages/spec/src/kernel/execution-context.test.ts hold the value (full safeParse green, exactly three keys, one named case per flag) and the surface (reachable on exactly one entry point, exactly one holder, anti-vacuity guards first). assignee was already set by the dispatch (os-sales) and I never wrote it. needs:contract-review hung on BOTH carriers in one stroke, as the dual-carrier ruling requires.", "tests": "86 gate families derived by scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack, reconciled with --ran carrying an exit code per family: 86 accounted, 84 run exit 0, 2 NOT MEASURED (exit 3 = PREREQUISITE NOT MET: check:dual-build-cjs-loads and check:type-check-debt both refuse without the FULL workspace build, which CI does first), 0 UNRUN. Every exit code captured before any pipe (cmd > log 2>&1; EXIT=$?). All builds/tests/typechecks through scripts/pm/os-verify-lock.sh with OS_VERIFY_LOCK_SLOT=issue-17178, each printing VERDICT command-exit 0: pnpm --filter @objectstack/spec build (waited 291s, held 193s); pnpm --workspace-concurrency=2 --filter '@objectstack/verify^...' build (waited 359s, held 461s); then one hold for the batch (held 1626s) - typecheck exit 0 for spec, metadata-protocol, runtime, verify; pnpm test exit 0 for spec (473 files / 13441 tests), metadata-protocol (176 files / 2529 passed, 12 skipped), runtime (259 files / 3613 tests), verify (14 files / 103 tests). check:api-surface read the widening as '0 breaking (removed/narrowed), 1 added'; api-surface/kernel.json and export-origins/kernel.json each moved exactly one line; spec check:generated green on all 15 artifacts. eslint FULL population, not a narrowing: eslint . --no-inline-config --format json = 6635 files, 0 errors, 0 warnings, exit 0, count read from eslint's own JSON. ABLATION, both legs, on-disk proof and restore proof: (1) pin can fail - deleted 'skipTriggers: true' from the canonical, anchor occurrence count 1 -> 0 with git diff --stat showing the single deletion, vitest exit 1 with exactly two named cases red and 25 green (no vacuity, no blast radius), restored via git checkout HEAD -- path (never the bare form), git hash-object == HEAD blob edc468ad and git diff HEAD empty; (2) consumers read the REBUILT declarations - stripped the symbol from the built packages/spec/dist/kernel/index.d.ts and .d.mts (mentions 1 -> 0 each), pnpm --filter @objectstack/verify exec tsc --noEmit exit 1 naming it: src/handle.ts(50,10) error TS2305 Module @objectstack/spec/kernel has no exported member SEED_WRITE_EXECUTION_CONTEXT, then restored byte-exact (sha256 73a3133f... / 8f9cd586... match) and the same typecheck exits 0. Ablation script carried trap restore EXIT INT TERM with absolute paths from git rev-parse --show-toplevel; tree is clean, no residue in the diff. scripts/pm/check-clause2-carriers.mjs --pair 17718 = exit 0 (first run exit 4, C1: the card carried no needs:contract-review; hung it on the card as the second carrier and re-ran).", "mcp_calls": "0 - every GitHub read and write went through repo-scoped REST (probed first: GET /repos/objectstack-ai/objectstack = 200). Card body and both comments read via REST; branch push, PR create, and both label writes via REST additive endpoints with a read-back on each.", "open_questions": [], "out_of_scope_findings": [ "noted, not filed: SYSTEM_CTX = { isSystem: true, positions: [], permissions: [] } is a private constant in three files (plugins/plugin-approvals/src/approval-node.ts, plugins/plugin-approvals/src/approval-service.ts, plugins/plugin-sharing/src/sharing-rule-service.ts), with two more shapes nearby (verify's SYSTEM_CONTEXT, service-knowledge's adminCtx). Same duplication class one level out, but all measured IDENTICAL today - no divergence, no declared contract violated, not metadata - so it fails all three filing tests. Successor who would carry it: a follow-up on single-sourcing the plain system context; packages/core/src/security/assemble-execution-context.ts is the module that already owns the 'one assembly of an ExecutionContext' principle and names this exact defect family (#6071 / #6206 / #6551).", "noted, not filed: the shared singleton is not Object.freeze'd. Freezing would be a real anti-aliasing improvement and this package has precedent for it, but it is a behaviour change on the seed write path if any layer ever mutates a context in place, and the card forbids changes to seed behaviour. The type is 'as const satisfies ExecutionContext', so consumers are compile-blocked from mutating. Recorded as a deliberate boundary.", "not filed, needs your call: the repo-wide FOURTH-COPY gate - the only piece of the card's 'a pin holding the sites equal' that this PR does not deliver. The three copies are gone by construction, so nothing needs holding equal between them; what remains uncovered is a future fourth site re-spelling the triple. Its natural home is a repo-root check:* script plus its lint.yml step (or one no-restricted-syntax rule in eslint.config.mjs), all OUTSIDE this card's declared file surface and a NEW validation surface, so the in-place-fix exemption does not reach it. I did not file a card for it either: it is the other half of THIS card's ask rather than an independent defect, so it is yours to re-fence or to charter." ] }
Generated by Claude Code
pm:retriage— the delivered fix lands inpackages/spec, so this card is no longer this lane's to landRaised by the
domain:cliexecution PM seat (#6024), sessionsession_01TSf4DV7ziu4V5j73e46b7c, 2026-09-11T18:11Z.pm:dispatchedand the assignee stay as they are: the work is delivered and good. What transfers is the review and the landing. ⛔ This seat has not flipped PR #17718 ready, has not armed auto-merge, and will not.⚠️ Bookkeeping correction, first, because it is this seat's own half-state: thepm:retriagelabel went on at 18:12Z and this comment failed to post in the same stroke — a local formatting fault swallowed the request body. A label with no comment is exactly the half-state this protocol forbids, so the pair is completed here rather than left to a sweep. The label's read-back is otherwise clean:pm:dispatched,domain:cli,needs:contract-reviewandpriority:p3all survive, and the assignee is unmoved.What is asked of triage, in one line
Re-route this card to
domain:spec— or rule that the export must move topackages/runtimeinstead. ⛔ This seat did not touchdomain:*: that label is triage's sole production, and 误标 ⇒pm:retriage+ dissent in the same stroke is the protocol this comment follows.The measurement that forces it
PR #17718 changes 8 files; 4 of them are in
packages/spec:packages/spec/src/kernel/execution-context.zod.ts +39 -0 <- the export itself packages/spec/src/kernel/execution-context.test.ts +56 -1 packages/spec/api-surface/kernel.json +1 -0 packages/spec/export-origins/kernel.json +1 -0 packages/metadata-protocol/src/seed-loader.ts +13 -24 packages/runtime/src/app-plugin.ts +14 -9 packages/verify/src/handle.ts +6 -6 .changeset/17178-seed-write-execution-context-export.md +51 -0The standing rule is not ambiguous, and it appears in six places on
origin/main— including this lane's own charter:SKILL.md:231 凡触 `packages/spec` 一律转 `domain:spec` 座位,不论谁需要它。 references/core-rules.md:62 (the same line) SKILL.md:287 `packages/spec` 恒归 spec 座位。 references/lanes/cli.md:12 `packages/spec` 恒归 spec 座位。 references/lanes/spec.md:12 `packages/spec` 恒归本席,不论谁需要它。 references/dispatch-runbook.md:158 `packages/spec` 恒归 spec 座位,本条不豁免:唯一所有者规则更硬。⇒ the clause-② review is the same answer. The dual
needs:contract-reviewcarrier is correctly hung on both this card and the PR — the dev did that in one stroke — and apackages/specwidening's contract review belongs to the spec seat's tier, ⛔ not to this seat's default judgment tier. ⛔ This seat will not clear either limb of that gate.⛔ This is this seat's omission, not the dev's error, and it is stated plainly
The dispatch order fenced the dev to "whichever single package the export lands in, plus its barrel and its changeset" and did not carry the
packages/specred line as a stop-and-report trigger — even though that line sits in this lane's own charter, which this seat is supposed to read fromorigin/mainat the start of every round. The dev did exactly what it was told, and it settled the shape fork the way the order expressly permitted: "If you can settle it from existing rulings and code — settle it and show the reasoning."⭐ Its reasoning is derived rather than picked, which is why re-routing is the right disposition and a re-do is not. Triage's own ruling was 「keep the exported shape minimal — ⛔ do not export a convenience bundle around it」, and the dev read the options envelope as being precisely that convenience bundle — the envelope, not the posture — then corroborated it three ways: no call site needs an adapter either way; all three docblocks explain the flags and not one explains the envelope; and the inner value has a declared spec type with a Zod schema behind it, while the envelope has no single type because the options parameter differs per engine method.
⚠️ So the export's landing inpackages/specis not a slip to be undone by default. It may well be the right home: the constant sets the keys of theExecutionContextcontract declared in that very file. Deciding that is the spec seat's and the maintainer's call, ⛔ not this seat's — which is the whole reason this is a retriage comment and not a landing record.What the next reader inherits, so nothing is re-derived
- CI on
5a307947: converging, zero non-green at the last read. - The dev's verification: 86 derived gate families — 84 exit 0, 2 exit 3 (
check:dual-build-cjs-loads,check:type-check-debt, both needing a full workspace build ⇒ NOT MEASURED, neither pass nor failure), 0 unrun. Four packages' full tests and typechecks green.check:api-surfaceread0 breaking (removed/narrowed), 1 added. Repo-wideeslint . --no-inline-configover 6635 files: 0 errors, 0 warnings. - Reverse verification with both legs proven on disk and restored byte-exact (blob-hash and sha256 matches recorded in the PR body).
- Changeset:
minoron@objectstack/spec,patchon the three consumers — andminoris not a choice, per the standing ruling in.github/workflows/pr-automation.yml. - Three decisions the PR carries for the maintainer, drafted by the dev in its
维护者速读: the export shape, whether a repo-level fourth-copy gate is wanted, and the contract review itself.
⚠️ One risk for whoever re-routes: the spec seat's post #6017 is flagged H38 STALE on the 13:46:43Z patrol anchor, so the receiving lane may be unattended. ⇒ this card must not be assumed read merely because it was re-routed.⛔ Nothing further is owed from the dispatched dev: it reported with
open_questions: [], and its two out-of-scope observations are recorded on the PR.
Generated by Claude Code
- CI on
Release of record — this card leaves the
domain:cliseat, cause: route changeReleased by the
domain:cliexecution PM seat (#6024), sessionsession_01TSf4DV7ziu4V5j73e46b7c, 2026-09-13T06:32Z. Cause is one of the four the release protocol admits — 改路由 — and the authority is triage's ruling5650082872(2026-09-13T01:57:12Z), which re-routeddomain:cli→domain:specand closed with the friction it deliberately did not resolve:⚠️ 一处摩擦,明写出来而不是留给下一个人撞:assignee 是 cli 车道的行动者,而卡现在归 spec 车道。交接机制由两席自行商定,⛔ 分诊不重指派、⛔ 不越过认领协议。This comment is this seat's half of that handoff. ⛔ It is not a claim, not a dispatch, and not a contract review.
The write, and its read-back
One label write, then read back and diffed against
union(previous, {−pm:dispatched, +pm:queue}):before (06:31Z) after (06:32:43Z, read back) pm state pm:dispatchedpm:queueassignee os-sales(none) domain:spec·needs:contract-review·priority:p3present present, untouched issue type TaskTask⭐ Why the assignee was the load-bearing half, not the label. A receiving seat's candidate filter is open, unassigned;
pm:queue卡恒无 assignee. So while this seat's assignee stood on a card labelleddomain:spec, the card was structurally invisible to the only seat allowed to land it — a re-route with the assignee left on is a card that reaches nobody. That state stood from 01:57:12Z to 06:32:43Z, 4h 35m. ⛔ That latency is this seat's, not triage's and not the receiving seat's.needs:contract-reviewis deliberately left on, per the ruling: it is the only machine-readable evidence that the gate is uncleared rather than stripped.State of the delivered work — measured here, ⛔ not copied from the dev report
PR #17718, head
5a307947d9006fd4a87347e2833912898530f5ee, still a draft. ⛔ This seat never flipped it ready, never armed auto-merge, and will not — the surface it widens is not this lane's to approve.check runs on 5a307947, read 2026-09-13T06:30Z total 38 — success 32 · skipped 6 · failures 0 · in_progress 0 · queued 0 dual-carrier clause-② gate, read 2026-09-13T06:31Z node scripts/pm/check-clause2-carriers.mjs --pair 17718 → exit 0 "the clause-② declaration is readable in the fixed spelling and both carriers agree"⚠️ Both readings have a stated expiry, so ⛔ do not land on them. That head was pushed 2026-09-11T18:12Z and has not been rebased since; green on it is green against the base as it stood two days ago.mergeable_statereadunknownat 06:30Z (GitHub had not computed it). The receiving seat re-takes both on the head it actually intends to land. These numbers are here to say the work is delivered and CI-clean, ⛔ not the PR is ready to land.What the receiving seat inherits, in one list
- The contract review of record — owed, because
Clause-②: yesis declared on both carriers. ⛔ This seat cannot write it: apackages/specpublic-surface widening cannot be reviewed by the lane that does not own the surface. - The ready flip, the queue arm, the landing record, and the disposal of card runtime, metadata-protocol: the seed-write execution context is a private constant in two places, so every seeder outside those two files re-spells it #17178.
- Triage's standing ruling on shape, which the receiving seat inherits rather than re-litigates: ⛔ 不 re-do、⛔ 不改形状 — the dev's choice of
packages/spec/src/kernel/execution-context.zod.tswas derived (from triage's own "keep the exported shape minimal — ⛔ do not export a convenience bundle") rather than picked. The three open questions the PR raised are already routed to维护者速读on the PR body, for the spec seat and the maintainer.
Delivery mechanism — ⛔ this comment is not it
⛔ This seat is not relying on a knock on the spec seat post. The spec seat itself measured why that is unsafe: the seat-post read rule is 正文 + 晚于正文最后编辑的评论, so a single seat-post body refresh silently voids every unread knock (filed as #17905,
domain:skills). The delivery mechanism here is the label pair —pm:queue+domain:spec, assignee clear — which is exactly what that lane's own候选查询 reads every fire.domain:cliexecution PM seat · #6024 · sessionsession_01TSf4DV7ziu4V5j73e46b7c· R73 · release comment, ⛔ not a claim and ⛔ not a review
Generated by Claude Code
- The contract review of record — owed, because
⚠️ Maintainer direct dispatch — this card returns to thedomain:cliseat, by instruction, ⛔ not by protocoldomain:cliexecution PM seat (#6024), sessionsession_01TSf4DV7ziu4V5j73e46b7c— 2026-09-13T06:58Z. This reverses the release this seat posted 26 minutes ago (5651688778).The authorization, quoted verbatim, ⛔ untranslated
The maintainer, directing this session at 2026-09-13T06:5xZ:
17718 你直接跟进到合并。如果需要契约复审你可以派 fable
⇒ Two instructions: drive PR #17718 through to merge in this seat, and a contract review may be dispatched to a
fableagent. This is the standing maintainer direct-dispatch channel, which binds only for the card it names.What changed in one write, read back
before (06:57Z) after (06:58Z) pm state pm:queuepm:dispatchedassignee (none) os-salesdomain:specpresent present, ⛔ UNTOUCHED needs:contract-review·priority:p3· typeTaskpresent present ⭐
domain:specstays on this card and that is deliberate. A direct dispatch instructs this session; it does not re-assign the contract surface.packages/specstill belongs to the spec seat, the lane label still says so, and triage's ruling5650082872is not overturned — what the maintainer overrode is who drives this one PR to merge, ⛔ not who owns the package. ⛔ This seat did not touchdomain:*, which remains triage's sole production.State of the work, re-measured now — ⛔ not copied from the release comment
PR #17718, head 5a307947d9006fd4a87347e2833912898530f5ee, read 2026-09-13T06:57:42Z state open · draft TRUE · merged false mergeable TRUE · mergeable_state CLEAN ← no conflict against main, 2 days on 38 check runs: 32 success · 6 skipped · 0 failures dual-carrier clause-② gate: exit 0, both carriers agree auto_merge: NOT armed⚠️ The green was taken on a head pushed 2026-09-11T18:12Z.mergeable_state: cleansays there is no conflict; it does not say CI has run against today'smain. That is re-taken before the arm, ⛔ not assumed.The plan, so the next reader does not have to infer it
- Contract review of record — dispatched to a separate
fableagent, per the authorization. ⭐ This is a strict improvement over what this seat could otherwise offer: apackages/specpublic-surface widening reviewed by an agent that neither wrote the dispatch order nor holds this seat, so the review carriesIndependence: INDEPENDENT AGENTrather thanSELF-REVIEW. - On a PASS: re-take CI on the head that will actually land, flip ready, arm the merge queue.
- Landing record with two readings and a negative control that can fail, then dispose the card.
- ⛔ Unchanged by any of this: this seat does not approve the PR and does not merge it by hand.
domain:cliexecution PM seat · #6024 · sessionsession_01TSf4DV7ziu4V5j73e46b7c· R73 · maintainer direct dispatch, audit comment
Generated by Claude Code
- Contract review of record — dispatched to a separate
Contract review is of record, the gate is cleared on both carriers, and PR #17718 is ready + armed
domain:cliexecution PM seat (#6024), sessionsession_01TSf4DV7ziu4V5j73e46b7c— 2026-09-13T07:10Z. Acting under the maintainer direct dispatch recorded at5651809638.The review of record — ⭐ independent, which is the point of the authorization
5651852441on PR #17718, posted 07:08:08Z by thefableagent this seat dispatched. Verdict: PASS, no conditions.Independence: INDEPENDENT AGENT— ⛔ notSELF-REVIEW, which is the best this seat could have offered on its own and is why the maintainer's 「你可以派 fable」 mattered.Verified at source by this seat before acting on it (⛔ the webhook body is relayed content, not evidence): comment id
5651852441exists, carries the## Contract reviewheading, the head sha5a307947d9006fd4a87347e2833912898530f5eeas a code span, aReviewed-by:line, the independence disclosure, and exactly one footer.The review's load-bearing measurements, which it took itself rather than copying:
exact literal `isSystem: true, skipTriggers: true, seedReplay: true` origin/main (84e6b05b) and merge-base → 3 PR head 5a307947 → 0 LIVE CONTROL `skipTriggers: true` alone at head → 5 ⇒ the zero is a reading no fourth copy landed on main in the 123 commits since the merge-base behaviour: usage lines unchanged at all three sites; the only runtime delta is shared object identity, and no reachable path writes into an isSystem context (engine.insert only reads it; the security memo writes sit behind the total isSystem bypass at plugin-security/src/security-plugin.ts:1776) bookkeeping: exactly one correct line in each ledger, in kernel.json ONLY across all 17 shards of each changeset: `minor` is the floor pr-automation.yml:717-720 requires for a purely additive public-surface widening; the three patch consumers are exactly the three non-spec packages, all published, all with spec as a RUNTIME dependency fences: exactly the declared 8 files; content/docs/releases/** untouchedWhat this seat did, in order, each read back
act result clear needs:contract-reviewon PR #17718labels now documentation · size/m · tests · tooling— gate absent, everything else preservedclear needs:contract-reviewon card #17178labels now domain:spec · pm:dispatched · priority:p3— gate absent,domain:spec⛔ still untouchedflip ready ready_for_review07:09:35Z on the timelinearm the queue auto_merge_enabled07:09:40Z on the timeline⭐ The gate was cleared on BOTH carriers, in that order, before the flip — a label cleared on one carrier and left on the other is the half-state this protocol exists to forbid, and it is the shape that re-reds a gate an hour later.
⚠️ The CI caveat the review raised, and how it is dischargedThe 38 green check runs on
5a307947(32 success · 6 skipped · 0 failures) completed 2026-09-11T18:08–18:29Z against base98c904a9—origin/mainis now84e6b05b, 123 commits past the branch's merge-base. That green is a no-conflict reading plus a two-day-old CI reading, ⛔ not a current one.⇒ It is discharged by the merge queue's own rebuilt generation, which is CI against today's
main. ⛔ This seat did not treat the 18:xxZ green as sufficient and did not merge by hand.mergeable_statereadblockedat 07:09:48Z — the same transient PR #17927 showed one minute before it enqueued at 06:53:09Z, ⛔ not a failure. If the rebuilt generation goes red, that is this seat's to root-cause; ⛔ "flake" is not a root cause.One follow-up the review found, filed rather than ridden
packages/metadata-protocol/src/seed-loader-state-machine-exempt.test.ts:21instructs a future debugger to "Revert theseedReplayflag inSEED_OPTIONS" — after this PR there is no flag inSEED_OPTIONSto revert, because the value now comes frompackages/spec. ⇒ This PR makes that instruction false. It is outside the declared 8-file face, the delivering dev is long gone, and adding a file now would cost a full CI generation for a comment. ⇒ Filed as its own card, ⛔ not ridden into this PR and ⛔ not left for someone to hit while debugging.Two further reader-traps the review recorded as non-blocking, repeated here so they are on the card and not only on the PR: the PR body's "compile-blocked from mutating through the readonly properties" is overstated —
handle.ts:246binds to a mutableExecutionContextand the other two sites passas any, so the real guard is that nothing writes into anisSystemcontext, ⛔ not the type; and the docblock's{@link skipTriggers}-style tags name schema properties rather than exported symbols, so nothing resolves them.domain:cliexecution PM seat · #6024 · sessionsession_01TSf4DV7ziu4V5j73e46b7c· R73 · maintainer direct dispatch
Generated by Claude Code
Landing record — PR #17718 merged, ledger 44
domain:cliexecution PM seat (#6024), sessionsession_01TSf4DV7ziu4V5j73e46b7c, R73, driving this card under the maintainer direct dispatch recorded at5651809638. Merged 2026-09-13T07:37:54Z; verified 07:38Z onorigin/mainafter a fresh fetch. ⛔ Nothing below is taken from the merge event.⚠️ Lane, stated plainly so no one reads this as a claim of ownership: this card isdomain:specand staysdomain:spec. This seat drove it by instruction; it does not ownpackages/spec, and triage's routing ruling5650082872is untouched.Landing sha:
bdb247d9ec0ed1b652cee6a418a2e8d87da060b7Reading 1 — shape and ancestry, with a control that fires
git rev-list --parents -n 1 bdb247d9 → 2 fields bdb247d9ec0ed1b652cee6a418a2e8d87da060b7 bd25e897dc3cf9cf50af9dd23a7d36948ade6bd9 git cat-file -t bdb247d9 → commit merge-base --is-ancestor bdb247d9 origin/main → exit 0 ANCESTOR NEGATIVE CONTROL — PR #17948's head b379018e (a real commit on an OPEN PR): git cat-file -t b379018e → commit --is-ancestor b379018e origin/main → exit 1 NOT an ancestor ✓ the instrument CAN answer "no"⭐ The squash reading reproduces, and that is now two for two. The parent is
bd25e897— the commit PR #17927 landed 16 minutes earlier — and the pre-merge head5a307947is NOT an ancestor ofmain, because the branch's own commits never entered its history. As on #17927,auto_mergehad reportedmerge_method: "merge". ⇒ ⛔merge_methoddescribes what was armed, not what the queue did. Read the parent count.⚠️ A second field that must not be misread, measured here: at 07:35Z this PR'sauto_mergereadfalsewhile the timeline still showedadded_to_merge_queue(07:10:31Z) and no removal. The queue consumes the arm. ⛔auto_merge: falseis not a failed arm, exactly asauto_merge: nullis not — the timeline is the authority.Reading 2 — content on the merged ref, with a fabricated control at zero
SEED_WRITE_EXECUTION_CONTEXT in packages/spec/src/kernel/execution-context.zod.ts → 2 the three former private copies, exact literal `isSystem: true, skipTriggers: true, seedReplay: true`, repo-wide (*.ts) → 0 files FABRICATED CONTROL SEED_WRITE_EXECUTION_CONTEXT_ZZ → 0 LIVE CONTROL `skipTriggers: true` repo-wide (*.ts) → 5 files api-surface/kernel.json carries its line → 1 export-origins/kernel.json carries its line → 1⇒ One exported spelling on
main, three private copies gone, both surface ledgers recording it, and the live control at 5 files proves the zero is a reading.The record of this card
- Contract review of record:
5651852441— PASS, no conditions,Independence: INDEPENDENT AGENT. ⭐ Written by a separatefableagent under the maintainer's authorization, which is why thispackages/specsurface widening did not land on a self-review. - The review's CI caveat — 38 green check runs taken 09-11 against a base two days old — was discharged exactly as it said it would be: the merge queue's own rebuilt generation
bdb247d9, built on today'smain, read 26 check runs, 25 success, 0 failures at 07:35:39Z withLint & Repo Gatesstill running, and merged green at 07:37:54Z. ⛔ The stale green was never treated as sufficient. - Routing history, for whoever reads this card cold: dispatched to
domain:clion 2026-09-10 → the delivered fix landed inpackages/spec→pm:retriageraised 09-11T18:11Z → triage re-routed todomain:spec09-13T01:57Z → released by this seat 06:32Z (5651688718… see5651688778) → maintainer direct dispatch reversed the release 06:5xZ → landed 07:37:54Z. The structural gap that made the released card invisible for 4 h 35 m is filed as [finding] A re-routed card keeps the old lane's assignee, so it is structurally invisible to the lane it was routed to — and the patrol has no rule that sees it #17932.
⚠️ Released by this landing: card #17938#17938 —
seed-loader-state-machine-exempt.test.ts:21tells a debugger to "Revert theseedReplayflag inSEED_OPTIONS", which this merge makes false (the lever moved topackages/spec). That card carried an explicit ordering constraint: ⛔ not dispatchable until this PR merged. It has merged. The constraint is now discharged and the card is verifiable againstorigin/mainbdb247d9.Disposal
The card auto-closed on the merge (
closed/completed, 07:37:55Z), and once againpm:dispatchedand the assignee survived it — the same residue as #12271 twenty minutes ago, and the subject of #14881. Both cleared in one write with read-back immediately after this comment;domain:specandpriority:p3stay, because ownership is not state.domain:cliexecution PM seat · #6024 · sessionsession_01TSf4DV7ziu4V5j73e46b7c· R73 · landing record · ledger 44 · driven under maintainer direct dispatch, card lanedomain:spec
Generated by Claude Code
- Contract review of record:
- added a commit that references this issue
on Sep 17, 2026 - added a commit that references this issue
on Oct 7, 2026
Filed from objectstack#15951 (hotcrm#1579 step 5a) under that card's binding design rule: "if a method needs a semantic the kernel does not expose, that is a kernel gap: file it, do not re-implement it in
verify." This is one of the two gaps that card hit. It is a kernel gap, not averifydefect — nothing here blocks #15951, which spells the constant once, in one place, with a comment pointing back at the owner.Measured (objectstack
origin/main5d12b16e, 2026-09-09)The write context a seed insert must use is three flags —
isSystem,skipTriggers,seedReplay— and the platform holds two private copies of it:packages/metadata-protocol/src/seed-loader.ts:2089—private static readonly SEED_OPTIONS = { context: { isSystem: true, skipTriggers: true, seedReplay: true } } as const;packages/runtime/src/app-plugin.ts:34—const SEED_WRITE_OPTIONS = { context: { isSystem: true, skipTriggers: true, seedReplay: true } } as const;— module-private, and its own docblock says it "mirrorsSeedLoaderService.SEED_OPTIONS", i.e. the duplication is already known and written down at the second site.That docblock also records why the value is load-bearing rather than cosmetic:
skipTriggersis what suppresses "on create" automation for seed rows,isSystemalone does not suppress dispatch, and the two basic-insert fallbacks inapp-plugin.tsonce seeded with automation live while the main path had it suppressed (#3760, a self-trigger loop that wedged first boot).Why it is a gap and not a style point
A constant whose divergence re-opens a boot-wedging defect has no exported spelling, so every writer that needs the seed posture must copy it. #15951 needed exactly that:
@objectstack/verify's newseed(object, rows)writes fixture rows the way the platform replays a stack's declareddata[], so it now carries a third copy (packages/verify/src/handle.ts,SEED_CONTEXT, spelled with a comment namingapp-plugin.tsas the owner). Three copies of a three-flag invariant, none of which any gate holds equal to the others.The copies are also not equal today in one respect worth noting:
SEED_OPTIONSandSEED_WRITE_OPTIONSare{ context: { ... } }wrappers, i.e. whole option bags, while a caller that already has an options bag needs only the innerExecutionContext.The ask
Export the seed-write execution context once, from wherever the platform decides owns it, and have both existing sites read it. Shape is the maintainer's call; the two candidates the code suggests are the inner
ExecutionContext(composes into any options bag) or the whole options bag (matches both current call sites verbatim). A pin holding the sites equal would be worth more than either.Not in this card: any change to what the three flags mean, or to seed behaviour.
Refs: objectstack#15951 (the card that hit it) - hotcrm#1579 (epic) - #3760 (the self-trigger loop
skipTriggersprevents).Generated by Claude Code