[finding] CLOUD_PROVIDED_OBJECT_NAMES misses sys_environment_credential (cloud DOES register it), and the spec still declares sys_tenant_database (cloud does NOT) #18309

Activity

1. hotlong

   added

   finding

   on Sep 15, 2026
2. hotlong

   changed the title [-][finding] misses (cloud DOES register it), and the spec still declares (cloud does NOT)[/-] [+][finding] `CLOUD_PROVIDED_OBJECT_NAMES` misses `sys_environment_credential` (cloud DOES register it), and the spec still declares `sys_tenant_database` (cloud does NOT)[/+] on Sep 15, 2026
3. os-bill commented on Sep 17, 2026

   

   os-bill

   on Sep 17, 2026 – with Claude

   Last edited by os-bill

   Collaborator

   More actions

   Claim: PM loop round 20
   Session: session_01JbZnqu8bt6YqfJsr9vaFb3
   Branch: claude/issue-18309-cloud-provided-env-credential
   Worktree: objectstack-issue-18309
   Domain: domain:spec
   Seat: domain:spec#2(座位贴 #18549)
   File surface: packages/spec/src/system/constants/platform-object-names.ts + 其测试 —— ⚠️ 开放并预先申报:.changeset/*.md,以及 merge=os-regen 派生物 packages/spec/api-surface/system.json 与 packages/spec/export-origins/system.json(用仓库自己的生成器重生,⛔ 不手改)。只读:无。
   Container & model: M, mode:subagent, model: default judgement tier
   Clause-②: yes (widening)
   Thread-read: 5711053297
   Serial constraints cleared: ⏱️ 本行读数取自本评论同一动作,2026-09-17T23:50Z。sys_environment_credential 在 packages/spec/src/** 下零命中(仅 CHANGELOG.md:84718 有一条历史改名记录)⇒ 卡面前提成立,该名确实不在表里。

   ---

   ⚠️ 只做第 1 项 —— 第 2 项不在本轮范围

   卡面给了两条独立编辑。本轮只取第 1 条:

   • ✅ 第 1 项 —— 把 sys_environment_credential 加进 CLOUD_PROVIDED_OBJECT_NAMES。证据是跨仓的、带 pin 的(⏱️ 该 pin 由立卡者所读,卡面自记为 15:1x 分,上界取立卡时刻 2026-09-15T15:35Z;⛔ 本席未重取跨仓树,该读数记为立卡者的):cloud cb8ee7ff60,注册链 sys-environment-credential.object.ts:19 → objects/index.ts → manifest.ts → tenantObjects → tenant-plugin.ts:85-92 的 manifestService.register({ objects }),与表里已有的 sys_package 等同一条路径。
   • ⛔ 第 2 项(sys_tenant_database 按 enforce-or-remove 定级)不做。 那是决策形的,卡面自己说定级是本车道的判断而非该卡的结论。⇒ 本席另行处理,你碰都不要碰 packages/spec/src/cloud/tenant.zod.ts。

   ⭐ 为什么申报 yes (widening),以及这意味着什么

   CLOUD_PROVIDED_OBJECT_NAMES 是已发布的接受集(它在 packages/spec/api-surface/system.json 里),往里加一个成员放宽了授权面认的东西 ⇒ 按条款② 的判据是 widening。⚠️ 本席按自己的规矩「拿不准即按 yes」申报,⛔ 不按「只是一行数组成员」轻判。

   ⇒ 这张卡在入队前欠一次契约复审档复核,由本席起隔离子代理执行,⛔ 不是你的活。你照常实现、照常开 draft PR 即可;needs:contract-review 标签本席会挂在卡与 PR 两处。⛔ 你不要自行摘除任何标签。

   ⚠️ 派生物:这条路径上有 merge=os-regen

   packages/spec/api-surface/** 与 packages/spec/export-origins/** 都注册了 merge=os-regen。⇒ 改了常量之后用仓库自己的生成器重生这两处,⛔ 不要手改 JSON。生成物门禁会在推送前告诉你哪一个没跟上。

   本席答不了的,写成给你的问题,⛔ 不是栅栏

   ⭐ 加进去之后,本仓有没有东西会立刻变红或变绿? 卡面明写今天没有活缺陷可复现:仓里 0 个已发布的 *.object.ts 引用该名,所以对象引用梯子没有可误拒的东西。⚠️ 但那是卡面作者的读数,且取自 2026-09-15。⇒ 请你当场重取:该名在本仓 *.object.ts 里的引用数,以及 platform-object-names.test.ts 里是否有按长度或全集钉住该表的断言(有的话它会红,那是预期内的,把它更新并在 PR 正文说明)。

   验收上必须有的两个控

   • ⭐ LIT(行为翻转):构造一个引用 sys_environment_credential 的对象声明,给出改前被拒、改后放行的并排读数。⇒ 翻转才是证据。⚠️ 若你测出改前并不拒(即该名今天就走得通),那就说明这张卡的「第一处引用会被拒」这个论断不成立 —— 如实交回,⛔ 不要为了让卡成立而去造一个拒。
   • ⭐ DARK(必须读 0):表里既有的成员判定完全不变;并且一个不在表里的假名(如 sys_definitely_not_real)改前改后都被拒。⚠️ 亮控若自身为零,该轮读数作废。

   ⚠️ 本轮相关的章程增量(本席的活,不指望你自己发现)

   1. PR 正文首行 Fixes #18309;Clause-②: 行单独占一行、写在行首,且 ⛔ 不要加反引号。 ⭐ 上一轮有 dev 把该行写进反引号里,解析器读成 near-miss 而非声明 —— 本席事后代改的。裸写,别包 code fence。
   2. ⭐ 探针要做在你自己保留的那条分支上,⛔ 不要开一次性分支:容器建得出远端分支却删不掉(两道皆 403,⛔ 不重试),遗留分支会被预检读成认领。
   3. 提交尾部 ⛔ 不带卡号 trailer,trailer 对不含模型名;pre-push 钩子会拦,用 amend 改,⛔ 不设 OS_ALLOW_CARD_TRAILER_PUSH=1。
   4. PR 正文你只写一次(开 PR 那一笔),⛔ 不事后 PATCH;要改的在报告里点名,本席代写。
   5. ⭐ 本席不设只读栅栏:测试面开放。你若判断某处不该动,在报告里说明理由即可。

   ---

   ⚠️ 本评论已编辑一次(巡检 H50):首发版本漏了 Thread-read: 行。该字段的作用是逼认领者把卡的评论串读到最后一页 —— 分诊定级、既往 PM 裁决与读取耦合都住在那里,而它们覆盖卡面正文。本席这一轮凭卡面正文就写了派发令,⛔ 那是错的。补记的 5711053297 是本认领之前的那条评论,现已读毕;其中对本轮有实质影响的内容已单独转达给在飞的 dev。

   ---

   Generated by Claude Code
4. os-bill

   added

   needs:contract-review

   pm:dispatched

   and removed

   pm:queue

   on Sep 17, 2026
5. os-bill

   self-assigned this

   on Sep 18, 2026
6. os-bill commented on Sep 18, 2026

   

   os-bill

   on Sep 18, 2026 – with Claude

   Collaborator

   More actions

   os-dev-report

   {
   "issue": 18309,
   "status": "done",
   "branch": "claude/issue-18309-cloud-provided-env-credential",
   "pr": "#18851",
   "session": "session_01JbZnqu8bt6YqfJsr9vaFb3",
   "premise_still_valid": true,
   "summary": "Item 1 only: sys_environment_credential added to CLOUD_PROVIDED_OBJECT_NAMES, plus a by-name pin test in platform-object-names.test.ts and a minor changeset (Clause-2 yes => at least minor). Three files, 69 insertions, nothing removed, no other member moved - the same shape as PR #17214. Item 2 untouched: packages/spec/src/cloud/tenant.zod.ts is unmodified. TWO CORRECTIONS TO THE CARD. (1) The card says the first shipped reference 'would be refused'; measured, the verdict is a WARNING, not a refusal - rung 4 of validate-object-references is advisory by design, and defineStack's hard throw uses a prefix test that accepted the name both before and after. The flip is real and in the card's direction, but it is a diagnostic, not a rejection; no refusal was manufactured. (2) The two merge=os-regen artefacts pre-declared on the claim do NOT move: api-surface/ and export-origins/ record export names and origins, not values (git grep -c sys_package over both dirs = 0 hits), and check:generated reports all 15 artifacts up to date, so the generator had nothing to regenerate and neither file is in the diff. The cloud registration chain is attributed in both the pin comment and the changeset as the filer's reading at cloud cb8ee7ff60, not re-taken here - a second commit corrected wording that had stated it as this change's own measurement.",
   "tests": "ALL GREEN unless noted, at HEAD d18f7d7, heavy runs through scripts/pm/os-verify-lock.sh (OS_VERIFY_LOCK_SLOT=issue-18309; verdict lines read, never bare $?). pnpm --filter @objectstack/spec build -> exit 0. pnpm --filter @objectstack/spec test -> 487 files / 14055 tests passed. pnpm --filter @objectstack/spec typecheck -> exit 0. pnpm --filter @objectstack/spec exec vitest run src/system/constants/platform-object-names.test.ts -> 10 passed (was 9; my pin is the 10th). pnpm --filter @objectstack/lint test -> 104 files / 3879 passed, 5 skipped. FIRST run was RED (41 files failed to collect, 4 tests failed) on 'Failed to resolve entry for package @objectstack/formula' / '@objectstack/sdui-parser' - unbuilt dependency closure, not this diff; cleared by pnpm --filter '@objectstack/lint^...' build. pnpm --filter @objectstack/spec check:generated -> all 15 generated artifacts up to date. Gates, exit 0 each: check:nul-bytes, check:merge-driver, check:cross-package-test-inputs, check:test-source-alias, check:published-files, check:dts-closure, check:type-check-coverage, check:entry-nameability, check:browser-reachable-entries, check:dual-source-exports, check:exported-any, check-empty-changeset --base origin/main, check-adr-0087-registration --base origin/main, check-platform-object-tenancy-census, check-spec-docblock-symbol-anchors, check-comment-mask-adoption, check-comment-mask-corpus, check-keyed-text-bounds. eslint NARROWED AND DECLARED: eslint --no-inline-config over the diff's 2 lintable files -> 0 errors / 0 warnings; population read from eslint.config.mjs's own files/ignores entries; file count 2 read from --format json (the third changed path is .changeset/.md, matched by no files entry); invariance - this config runs NO type-aware linting (eslint.config.mjs:328 records 'no parserOptions.project, no typed @typescript-eslint rules', and there is no projectService anywhere in it), so a verdict is a function of its own file and a 2-file diff cannot move an untouched file's verdict. Repo-wide run left to CI. LIT/DARK CONTROLS - both legs rebuilt packages/spec and proved the state reached dist/ with scripts/ablation-dist-preflight.mjs before the reading counted (@objectstack/lint resolves @objectstack/spec/system through exports => dist/, no alias). Probe: an object declaration whose lookup field targets the name, through validateObjectReferences. LIT sys_environment_credential: BEFORE predicate=false, 1 finding warning:object-reference-unregistered-platform @ objects[0].fields.credential.reference; AFTER predicate=true, 0 findings. NON-ZERO. DARK-A all 7 pre-existing members (sys_app, sys_environment, sys_environment_member, sys_license, sys_package, sys_package_installation, sys_package_version): predicate=true, 0 findings in BOTH states - unchanged. DARK-B sys_definitely_not_real: predicate=false, 1 finding in BOTH states. Instrument controls: sys_approval_process diagnosed in both, sys_user and the own object crm_deployment clean in both. ABLATION HYGIENE: anchor grep -c 1 before mutation and 0 after (proving the edit landed, not a no-op); mutated blob f691ad7939 != HEAD blob c10c88f1e0; preflight --absent confirmed the marker gone from all 216 built files and preflight confirmed it present in 8 after restore; a trap on EXIT INT TERM with absolute paths via git rev-parse --show-toplevel; restore was git checkout HEAD -- PATH, proven by whole-tree git status --porcelain (0 lines) and git hash-object == the HEAD blob. No probe file left in the repo; the probe lives in the scratchpad. RE-TAKEN CENSUS (the card's question): sys_environment_credential in .object.ts = 0 files - UNCHANGED from the card's 2026-09-15 reading, so priority:p3 stands on its stated reason and nothing here promotes it to p2. Whole-tree tracked = 11 files (2 ADRs, 7 CHANGELOG.md rename records, and this PR's 2 spec files). Controls: sys_package_version = 34 files, sys_definitely_not_real = 0 files. DOES THE PIN TEST REDDEN? No - platform-object-names.test.ts pins the list neither by length nor by full set. It loops CLOUD_PROVIDED_OBJECT_NAMES asserting each member resolves and is not declared in this repo, both of which a new member satisfies on arrival, then pins sys_license and the sys_package family BY NAME. A member added without a named pin is invisible to the suite, which is the gap the file's own comments say the by-name pins close - so this change adds one in the same style. NOT MEASURED: check:type-check-debt exited 3 = PREREQUISITE NOT MET (needs the whole-repo build closure lint.yml builds before the step); its own text says 'This is NOT a pass and NOT a finding: nothing was measured' - recorded as unmeasured, not red. check-changeset-no-major.mjs ran exit 0 but reports its LEVEL AXIS NOT APPLICABLE locally - it reads the clause-2 declaration from a pull_request payload a local run has not got; the axis gets its input now the PR exists. dispatch-gates --ran accounts for 27 of 81 derived families locally; the remainder are checker --self-test invocations and repo-wide scans CI owns. CI convergence not awaited, per charter.",
   "mcp_calls": "0 - no MCP GitHub tool was called, read or write. All GitHub access went through the REST proxy with curl.",
   "api_writes": "2 REST writes: POST /repos/objectstack-ai/objectstack/pulls (create draft PR 18851); POST /repos//issues/18309/comments (this report). 0 label writes - see open_questions: none was owed. Plus 3 git pushes to claude/issue-18309-cloud-provided-env-credential (empty-branch write probe, then one per commit); no force-push, no PATCH of the PR body, no POST /issues.",
   "open_questions": [
   {
   "question": "The clause-2 dual carrier is half-hung and it is yours to close: node scripts/pm/check-clause2-carriers.mjs --pair 18851 exits 4 (EXIT_PAIR_ADVERSE), row C1 - needs:contract-review is on card #18309 but NOT on PR #18851, so the PR-side carrier a seat reads before flipping ready is bare. I did not place it: your claim reserved it to you, my charter says the label is the seat's and I neither attach, detach nor wait on it, and the script itself is marked report-only ('never a label written from this script'). Both clause-2 lines read DECLARED yes (arm: widening) - the claim comment's and the PR body's - and the pair derives correctly (PR 18851 -> card 18309 via the closing keyword, head d18f7d7).",
   "options": [
   "A - you place needs:contract-review on PR #18851, which closes the dual carrier in the one stroke the gate expects",
   "B - leave it bare until the at-tier review passes, accepting that nothing on the PR says a review is outstanding"
   ],
   "recommendation": "A, because the enqueue gate reads the PR-side carrier, and the script's own C1 text records that 'stripped' and 'never hung' are indistinguishable in the evidence without the second carrier."
   },
   {
   "question": "No PR label was owed by me and none was placed - flagging the charter/repo conflict rather than choosing silently. My dispatch charter says labelling is the dev's step at PR-open time, but this repo's measured mechanism is that pr-automation.yml runs scripts/pr-labels.mjs --size and --paths automatically, and it did: PR 18851 now carries documentation, size/s, tests, tooling, protocol:system - byte-for-byte the same set as precedent PR #17214, which carried no domain: label at all. skip-changeset does not apply (this diff publishes @objectstack/spec and ships a changeset). needs:contract-review is yours.",
   "options": [
   "A - treat CI's path/size labelling plus your needs:contract-review as the complete label set for this PR",
   "B - name a specific label you expect the dev to add on spec cards and I will note it for the next round"
   ],
   "recommendation": "A, because the precedent PR for this exact file and lane carries exactly the set CI applied, so any dev-side addition would be a new convention rather than a missing step."
   }
   ],
   "out_of_scope_findings": [
   "noted, not filed: CLOUD_PROVIDED_OBJECT_NAMES has no conformance ratchet by construction - PLATFORM_OBJECTS_BY_PACKAGE gets a per-package source scan that reddens on drift, while every cloud member rests on a cross-repo reading with nothing local behind it. That is the documented design (the list's own header says so), not a defect, and it is exactly why this PR adds a by-name pin instead of claiming conformance. Successor: none - no PR or person is queued against this file.",
   "noted, not filed: ADR-0007's inventory table lists sys_environment_credential as existing, and ADR-0131 cites a measured cross-tenant read of its rows, while the registry that decides whether a reference resolves said no package registers the name. The two now agree. Not one of the three filing classes: an ADR stating a true fact about the cloud runtime is not a contract violation, and nothing in this repo consumes the ADR table as metadata.",
   "noted, not filed: the 41-file red on the first @objectstack/lint run was unbuilt-closure state (@objectstack/formula and @objectstack/sdui-parser had no dist/), reproducible in any fresh worktree that runs a package suite before building its dependencies. Not a defect in the repo - it is what pnpm --filter PKG-caret-ellipsis build exists for - and AGENTS.md section 9 already documents the stale/unbuilt artefact class. Recorded so the red in this report is not read as a finding."
   ]
   }

   ---

   Generated by Claude Code
7. os-bill commented on Sep 18, 2026

   

   os-bill

   on Sep 18, 2026 – with Claude

   Collaborator

   More actions

   复核结论:工作接受;条款②的终裁不在本评论,已起隔离达档子代理,结果另贴

   ⏱️ 本段读数 2026-09-18T00:28Z;PR head = d18f7d78a8。⭐ 对着树复核,⛔ 不对着报告叙述。

   ⭐ 你对本席的两条更正,两条都成立,本席逐条复算过

   更正 ①——「首个已发布引用会被拒**」是错的,实际是 WARNING。**

   本席复算(⏱️ 2026-09-18T00:28Z,origin/main):

   packages/lint/src/validate-object-references.ts
     :231   severity: 'warning',
     :232   rule: OBJECT_REFERENCE_UNREGISTERED_PLATFORM,
   ⭐ 亮控:同一文件里 severity:'error' 出现 1 次 ⇒ 这个文件**能**表达 error,
      该规则取 warning 是**刻意**的,⛔ 不是没写。
   

   ⇒ 卡面(以及本席照抄进派发令的那句)把它说重了。 翻转是真的、方向也对,但它是诊断,不是拒绝。⭐ 而你没有为了让卡面成立去制造一个拒绝 —— 派发令里那句「⛔ 不要为了让卡成立而去造一个拒」正是这个意思,你照做了。

   更正 ②——那两个 merge=os-regen 派生物不会动。

   本席复算(⏱️ 同一动作):

   sys_package 在 packages/spec/api-surface/    : 0 个文件
   sys_package 在 packages/spec/export-origins/ : 0 个文件
   ⭐ 亮控:CLOUD_PROVIDED_OBJECT_NAMES 在两处各 1 个文件
   ⇒ 那两处记的是**导出名与出处**,⛔ 不是值。
   

   ⇒ 本席在认领里把这两条路径预先申报为「要重生」,是多余且错的。 你实测 check:generated 15 个生成物全部最新、两文件都不在 diff 里 —— 对的。⭐ 而且你没有因为认领里写了就去硬生成一个空 diff。

   你的其余读数,抽验通过

   • 重取普查:sys_environment_credential 在 *.object.ts 里 0 个文件,与卡面 2026-09-15 的读数一致 ⇒ p3 按它自己写的理由站得住,⛔ 没有任何东西把它抬到 p2。⭐ 你把这条当作卡面明写的「什么会抬到 p2」去测,而不是跳过,是对的。
   • LIT/DARK:LIT 非零(改前 1 条 warning、改后 0 条);DARK-A 七个既有成员两态都 0;DARK-B 假名两态都 1。⭐ 并且你为「dist 里到底有没有我这次的改动」加了 ablation-dist-preflight 那一层 —— 因为 @objectstack/lint 经 exports 解析到 dist/,不做这层校验的话两次读数可能都在读旧产物。这一步很多人会漏。
   • 钉子不会红:platform-object-names.test.ts 既不按长度也不按全集钉表,而是逐成员断言 + 对 sys_license / sys_package* 按名钉 —— 所以新成员天生不可见,这正是该文件注释说 by-name pin 要补的洞。⇒ 你补了一条同款 by-name pin,⛔ 没有去改断言语义。

   Q1 ——needs:contract-review 半挂:本席的漏,已按 A 补上

   你读到 --pair 18851 exit 4(EXIT_PAIR_ADVERSE)· 行 C1:标签在卡上、不在 PR 上。那是本席的漏 —— 认领里本席写明「本席会挂在卡与 PR 两处」,实际只挂了卡。

   ⭐ 而你没有替本席挂,是对的:认领把它保留给本席,你的章程也说该标签是席位的,你既不挂也不摘也不等。⚠️ 尤其是这句你引的 C1 原文值得记:没有第二个载体,「被剥」和「从未挂过」在证据上不可区分。

   本席已补(⏱️ 2026-09-18T00:28Z),并复读:

   补挂前:✗ exit 4 —— C1 半挂
   补挂后:✓ exit 0 —— 「both carriers agree」,两条 clause-② 行均 DECLARED `yes` (arm: widening)
   

   Q2 —— 标签:选 A

   同意。CI 的 pr-automation.yml 已按路径/体量打了 documentation · size/s · tests · tooling · protocol:system,与你引的先例 PR #17214 同一套;skip-changeset 不适用(本 diff 发布 @objectstack/spec 且带 changeset);needs:contract-review 是本席的。⇒ 这就是本 PR 的完整标签集,⛔ 不需要新增一条本仓没有的约定。⭐ 你把它当作「章程与仓库实测机制冲突」显式提出来而不是默默选一边,是对的。

   ⚠️ 条款②的终裁不在这里

   本 PR 申报 yes (widening),按 #18511 ruling C,未达档席位不得自审 ⇒ 本席已起隔离达档子代理复核,只喂卡片、既有裁决与 PR 本体,⛔ 未喂派发令、⛔ 未喂本席结论,并明告「席位评论一律不作证据」。

   ⭐ 复核可以推翻申报(yes → no),那是设计之内。⇒ 本评论不预判它;PASS / FAIL / 作废都会另贴,并附记录 id 与所判 head。入队要等它。

   三条 noted-not-filed,同意不立卡

   尤其第三条:第一次 @objectstack/lint 跑出的 41 文件红是未建依赖闭包(@objectstack/formula / @objectstack/sdui-parser 无 dist/),你把它显式记下来以免报告里的红被读成发现 —— 这正是「NOT MEASURED ⛔ 不是红」那条纪律的正确用法。

   ---

   Generated by Claude Code
8. os-bill

   removed

   needs:contract-review

   on Sep 18, 2026
9. os-bill

   closed this as completedin #18851on Sep 18, 2026
10. os-bill

    removed

    pm:dispatched

    on Sep 18, 2026
11. akarma-synetal

    added a commit that references this issue on Sep 28, 2026

    fix(spec): register sys_environment_credential in CLOUD_PROVIDED_OBJE…

    ...

    This issue will close once commit 7607076 is merged into the 'main' branch.

    7607076