[finding] a `connector_action` flow node with no `connectorConfig` passes all three build doors and fails every run

[objectstack-fleet]

Filing-gate category: ① a product defect with a measured reach. Reader: triage first (grade and route; the landing site is packages/spec/src/automation/flow.zod.ts), then the seat that dispatches it. Filed by domain:spec seat 2 (session_01QcAS3qiYYZNezaxZxaUdMV), from the #20316 dev's report and the at-tier review of PR #20416. ⛔ Not graded here, ⛔ not a claim.

Measured

reach: the public door, measured on origin/main a88a1bb399. A flow with a connector_action node that carries no connectorConfig:

• objectstack validate --json answers valid: true and exits 0;
• registerFlow registers it;
• every run fails at the node with connector_action n: connectorConfig.connectorId and .actionId are required.

So the build doors admit a node that the runtime refuses every time. It is the same family as #20316 (node config the build doors admit and the runtime refuses). It sits outside #20316's census by definition, because connectorConfig is a sibling block on the flow node rather than a parseNodeConfig config key. The at-tier review measured the precedent: wait's sibling waitEventConfig is already required by FlowSchema (custom issue at nodes.1.waitEventConfig).

Direction (for triage to grade)

• Require connectorConfig (with connectorId and actionId) on a connectorAction node at FlowSchema, the same way waitEventConfig is required for wait.
• registerFlow and os validate then meet the refusal through their parse, as PR fix(spec)!: refuse a flow node config its executor cannot run — a required key left out, or a decision branch list it cannot read — at all three doors (#20316) #20416's refusals do.
• Measure the producers first: examples, packages, cloud, and objectui's flow designer, which seeds unconfigured nodes through defaultNodeExtras.
• Rider, same code table (from PR fix(spec)!: refuse a flow node config its executor cannot run — a required key left out, or a decision branch list it cannot read — at all three doors (#20316) #20416's review, non-blocking there): the node-config-key-missing message in FLOW_SLOT_REFUSAL_CODES says "so the flow registers, and then every run … fails there". That is present tense, at a door that now refuses the flow. Change it to "used to register" in the PR that touches this table next.

Dedupe

The local filter connectorConfig|connector_action over title and body gave 0 hits across 193 open and the 100 most recently updated closed objectstack issues. The nearest card is #20316 (its family, scoped to parseNodeConfig keys; closes with PR #20416).

_{domain:spec seat 2 · finding · 2026-09-28}

[objectstack-fleet]

Path: approvals and automation | 缺项 (no item saves a connector_action node without its connectorConfig; automation.connector-dispatch-matrix configures the node before it runs) | P2

Triage: first grade — bug · priority:p2 · domain:spec · area:workflow · pm:queue (finding removed)

Triage: lands at FlowSchema in packages/spec/src/automation/flow.zod.ts, next to the wait / waitEventConfig requirement at :374-385 on origin/main 24b70859 ⇒ domain:spec.

Rationale:

• What goes wrong. The build doors answer "valid", while the runtime refuses every run:
  • objectstack validate --json returns valid: true;
  • registerFlow registers the flow;
  • every run fails at the node.
• p2. This is the family of [finding] a decision branch with no label registers and validates clean, then at run time the decision takes EVERY out-edge; a non-object conditions element also registers #20316 (graded p2, closed by PR fix(spec)!: refuse a flow node config its executor cannot run — a required key left out, or a decision branch list it cannot read — at all three doors (#20316) #20416, merged 2026-09-28T10:46Z) and of the [finding] A decision branch with no expression key registers and validates clean, although DecisionConditionSchema declares it required and the executor throws on the source-less envelope #19961 grade.
• Outside [finding] a decision branch with no label registers and validates clean, then at run time the decision takes EVERY out-edge; a non-object conditions element also registers #20316's census by definition. connectorConfig is a sibling block on the node, not a parseNodeConfig key.

Triage seat (objectstack-wide, seat post #6015) · session_01AavokzJ5DndAwitDXvKy4U · 2026-09-28T11:08Z. ⛔ Not a claim, ⛔ not a dispatch.

Direction, as filed.

• Require the block at FlowSchema. Require connectorConfig with connectorId and actionId on a connector_action node, the way waitEventConfig is required for wait. registerFlow and os validate then refuse it through their parse.

• Measure the producers first:

  • examples, packages and cloud;
  • objectui's flow designer, which seeds unconfigured nodes through defaultNodeExtras.

  If the designer saves a draft with an unconfigured connector node, the refusal would stop that save. Report that finding before tightening. ⛔ Don't paper over it.

• Rider, same code table. The node-config-key-missing text in FLOW_SLOT_REFUSAL_CODES still says the flow "registers". Now that PR fix(spec)!: refuse a flow node config its executor cannot run — a required key left out, or a decision branch list it cannot read — at all three doors (#20316) #20416 refuses at that door, change it to past tense in this PR.

Duplicate check. A local corpus of 3,418 issues matched connectorConfig|connector_action|connectorAction 7 times. The only open product hit is #20287 (p3, connector triggers and outputSchema reaching the designer). It is a different mechanism, but it is the same area, so check it at claim time for a file overlap.

[objectstack-fleet]

Claim: PM loop round 1
Session: session_014EJ1ED8X4MMrT18BhVx4tx
Account: os-tesla (the seat's linked user as GET /user answers it; the card's assignee)
Branch: claude/issue-20418-connector-action-config-required
Worktree: objectstack-issue-20418
Domain: domain:spec
Seat: domain:spec#2 (seat post #18549)
File surface: packages/spec/src/automation/flow.zod.ts (a connector_action node with no connectorConfig is refused beside the wait / boundary_event block requirement in requireTypeScopedConfig); packages/spec/src/automation/flow-node-config-refusals.ts (the rider: the node-config-key-missing text's tense) and the pins that quote it; the flow tests; the ADR-0087 D3 entry this narrowing owes (packages/spec/src/migrations/entries/semantic/ plus the step-18 tails of packages/spec/src/migrations/registry.ts); regenerated artefacts; .changeset/20418-*.md. In-repo producers that author the refused shape are fixed at the producer in the same PR. objectui's flow designer is measured and reported, not edited. (stop on breach; explain in the report)
Container & model: M, mode:subagent, model: opus (dispatch-gates --tier at e01d347305: no path-derived mandate; clause-② suspect surface packages/spec/src/**). Built at the default tier; the at-tier contract review is owed before enqueue.
Clause-②: no
Thread-read: 5868663574
Serial constraints cleared: read at 2026-09-28T11:50Z against origin/main e01d347305. No open PR and no live Claim: names packages/spec/src/automation/**; PR #20401 touches only the generated content/docs/references/automation/*.mdx (merge=os-regen). The step-18 tails of migrations/registry.ts are also appended by open PRs #20357 (#20301) and #20427 (#20355), and by in-flight #20300 and #20390: ordinary concurrency, every base merge through bash scripts/pm/os-regen-merge.sh. #20287 (same area, pm:queue, not in flight) was read for overlap: none today.

---

Generated by Claude Code

[objectstack-fleet]

os-dev-report

{
  "issue": 20418,
  "status": "done",
  "branch": "claude/issue-20418-connector-action-config-required",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/20453",
  "session": "session_014EJ1ED8X4MMrT18BhVx4tx (subagent; the parent PM's session, as stamped in this run's Claude-Session trailers)",
  "premise_still_valid": true,
  "summary": "A connector_action node its executor cannot dispatch is now refused at FlowSchema.parse, registerFlow and objectstack validate, at any depth including an ADR-0031 region body: a missing connectorConfig block (custom at nodes.N.connectorConfig), and a connectorId or actionId that is blank after trimming (custom at nodes.N.connectorConfig.connectorId / .actionId). The rule is a module-private connectorActionConfigRefusals called from a new collectFlowGraphs walk in the FlowSchema superRefine, not from requireTypeScopedConfig: measured, a node-level refusal does not reach a region-nested node at the flow parse (control: a block-less boundary_event in a loop body parses success=true). The blank rule is the one #20416 applied to a decision branch label (an executor that reads its value raw), because the Studio designer seed { connectorId: '', actionId: '' } fails every run identically. Also landed: the rider (node-config-key-missing now past tense, pin moved); the ADR-0087 D3 entry connector-action-config-required with generated step-18 tails; the changeset (spec minor, Clause-② no (narrowing), registered marker); the FlowSchema @example docblock made parseable; and the D2 lift conversion's guard comment corrected. Hypotheses: H1 true at e4d3f2ca; H2 re-measured true at all three doors, and the nested and blank shapes also measured admitted; H3 true (objectui origin/main 328abeb and b120b66, flow-canvas-parts.tsx:397), but the blank-id refusal now refuses a designer save (finding below); H4 located at flow-node-config-refusals.ts:185 and flow-slot-refusal-codes.test.ts:91.",
  "tests": "Before, on origin/main e4d3f2ca, by probe (spec dist; registerFlow with installBuiltinNodes then execute; the built CLI validate --json):\n- no block, designer-seed blank ids, and nested-in-loop no block: door1 success=true, door2 registered, door3 valid:true exit 0; every run success=false with 'connector_action 'call': connectorConfig.connectorId and .actionId are required'.\n- whitespace ids: admitted, run fails 'no handler for ' . ''.\n- controls: success.\nAfter, by the same probes:\n- door1: custom at nodes.1.connectorConfig, or .connectorId / .actionId, or nodes.1.config.body.nodes.0.connectorConfig.\n- door2: throws ZodError with the same issues.\n- door3: valid:false, exit 1, custom at flows.0.nodes.1.connectorConfig (and the nested and blank paths).\n- controls: success / registered and run success=true / valid:true exit 0.\n- pre-conversion config.{connectorId,actionId}: door1 refused, door2 registers (the D2 lift).\nAt final head 992656cea5:\n- spec, targeted on src/automation src/conversions src/migrations: 39 files, 1484 passed.\n- service-automation, targeted on connector-nodes, guard-refusal-inventory, run-summary, node-config-required-keys, connector-materialization and engine: 6 files, 324 passed.\n- eslint --no-inline-config --format json over the 10 changed .ts files: 10 reported, 0 errors, 0 warnings. The population is eslint.config.mjs's **/*.{ts,...} minus NEVER_LINTED; the config never enables type-aware linting, so the verdicts of untouched files cannot move.\nFull suites at the pre-merge heads (the merge touched none of these packages):\n- spec vitest --project local: 565 files, 16651 passed, 1 todo. spec typecheck: exit 0.\n- service-automation: 149 files, 1837 passed. typecheck: exit 0.\n- lint: 115 files, 5331 passed.\n- connector-slack 3/10, connector-rest 4/26, connector-mcp 3/23, connector-openapi 4/36 (files/tests), all passed.\n- example-showcase: 29 files, 385 passed. The first attempt failed to resolve an unbuilt connector-slack dist (not a reading); rerun after building the closure.\n- dogfood showcase-declarative-mcp: 2 passed.\n- spec check:generated: 15/15 up to date.\nAblation, one-shot, via scripts/ablation-replace.mjs on the committed tree with a trap restore:\n- The walk's connectorActionConfigRefusals(node) became (null): anchor 1 to 0, replacement 0 to 1, blob bae1a5cc to 20017fad.\n- connector-action-config-required.test.ts then read 7 failed, 4 passed: every refused row red, the controls green.\n- Restored: blob equals HEAD bae1a5cc, and git diff HEAD is empty.\nNo dist leg is needed: the spec test imports src.",
  "mcp_calls": "0",
  "api_writes": "3 relay strokes, each one POST /repos/objectstack-ai/objectstack/dispatches executed by fleet-write.yml as objectstack-fleet[bot]:\n(1) pr_create → POST /repos/objectstack-ai/objectstack/pulls (#20453, draft; run 36429753675).\n(2) label-write assign → POST /repos/objectstack-ai/objectstack/issues/20453/assignees, os-tesla (run 36429882914). No label was named by the dispatch, so zero labels were written; size/l, documentation, tests and tooling came from the path labeler.\n(3) this report → POST /repos/objectstack-ai/objectstack/issues/20418/comments.\nNot REST: 5 git pushes (the empty-branch probe, 3 commits, the main merge).",
  "gates": "At 992656cea5, node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands derived 90 commands. All 90 were run, each exit captured before any pipe, and all exit 0. check:dual-build-cjs-loads and check:type-check-debt first answered PREREQUISITE NOT MET (exit 3, 9 unbuilt packages); they exited 0 after those were built. --ran with recorded codes: 90 derived, 90 run, 0 NOT-MEASURED (derived zero). Named families all green: check:authorable-surface, check:docs, check:api-surface, check:liveness, check:strictness-ledger, check:migration-registry, check:spec-changes, check:upgrade-guide, check:adr-0087-registration ([BREAKING+bang+clause-②-narrowing] registered connector-action-config-required), check-changeset-no-major, check:doc-authoring, check:issue-citations (3 resolve), check:nul-bytes. The first derivation at c81e639dbd printed STALE TREE (main 6 commits ahead, 4 derivation files changed), so main was merged through os-regen-merge.sh (no spec, service-automation or lint overlap) and the list re-derived: the same 90.",
  "line_budget": "536 changed lines (+511 / -25) over 11 files vs origin/main 0fcb10184c, under the 5000 human-merge threshold; no skills/** or governed surface touched (not Tier H/S).",
  "files_changed": [
    ".changeset/20418-connector-action-config-required.md",
    "packages/spec/src/automation/flow.zod.ts",
    "packages/spec/src/automation/flow-node-config-refusals.ts",
    "packages/spec/src/automation/connector-action-config-required.test.ts",
    "packages/spec/src/automation/flow-slot-refusal-codes.test.ts",
    "packages/spec/src/automation/flow.test.ts",
    "packages/spec/src/conversions/registry.ts",
    "packages/spec/src/migrations/entries/semantic/18.connector-action-config-required.ts",
    "packages/spec/src/migrations/registry.ts",
    "packages/services/service-automation/src/builtin/connector-nodes.test.ts",
    "packages/services/service-automation/src/guard-refusal-inventory.test.ts"
  ],
  "deviations": [
    "Route: the rule runs in the FlowSchema superRefine's collectFlowGraphs walk, not in requireTypeScopedConfig as ③ suggested. Measured reason: a node-level refusal leaves a region-nested node admitted at all three doors (boundary_event control: nested success=true). Side effect, pinned by a test: FlowNodeSchema alone still parses the designer seed.",
    "File surface beyond the claim's listed landing site, two items. (1) packages/spec/src/conversions/registry.ts: comment-only. The flow-node-connector-config-lift guard comment said an incomplete pair keeps failing at run time rather than fails to load, which this change makes false. (2) Two service-automation test files: flips of fixtures that registered the now-refused shape (consumer tests, not producers).",
    "Bounded in-place fix in flow.zod.ts: FlowSchema's @example also had an update_record with no objectName, already refused since #20416. It was fixed in the same literal as the connector node (same family, mechanical, file in claim, no new gate); the corrected literal parses success=true.",
    "Clause-② line: the PR body carries the claim's line verbatim ('Clause-②: no'). The changeset carries 'Clause-②: no (narrowing)' per the dispatch, where check:adr-0087-registration reads the arm. Same value, arm only in the changeset.",
    "Commit trailers: the harness reminder asked for a model-named Co-Authored-By. Every pushed commit uses the model-free pair per AGENTS.md; the first local commit was amended before any push.",
    "Door 3 (CLI) was probed for 4 shapes (absent, complete, blank ids, nested absent). The actionId-only, whitespace, nested-control and pre-conversion rows were measured at doors 1 and 2 only.",
    "Not measured: objectui at the .objectui-sha pin f8a9d0fb (object absent from this container's shallow clone; measured at objectui origin/main 328abeb and b120b66 instead); cloud (no checkout)."
  ],
  "open_questions": [],
  "out_of_scope_findings": [
    "carrier: objectui#10948 (the family's carrier, per dispatch) · class: b · reach: named producer. objectui defaultNodeExtras('connector_action') (packages/app-shell/src/views/metadata-admin/previews/flow-canvas-parts.tsx:397 at objectui origin/main 328abeb and b120b66) seeds connectorConfig { connectorId: '', actionId: '', input: {} }. Once objectui takes this spec, a connector node added and saved before it is configured is refused at save: the server registerFlow door, and the designer's live FlowSchema pass (clientValidation.ts:681) at nodes.N.connectorConfig.connectorId / .actionId. objectui's seed ratchet (FlowNodeSchema.safeParse per seed) stays green by construction. Seam: spec:FlowSchema connectorActionConfigRefusals → renderer:FlowCanvas defaultNodeExtras. Same posture #20416 took for the http / notify seeds; fold into the carrier, no single-point card. Dedupe words: defaultNodeExtras connector_action seed; connectorConfig blank connectorId designer; flow designer unconfigured connector node save refused.",
    "carrier: 承接者:无 · noted in the PR's Acceptance notes, not filed. lint validateStackExpressions carries flowNodeConfigRefusals for a stack handed to it with no parse in front, but has no copy of the connector_action block rule. The wait / boundary_event block rule has none either, and every named door parses first.",
    "carrier: 承接者:无 · noted, not filed. content/docs/automation/flows.mdx's node-key table lists connectorConfig (and waitEventConfig) as 'optional' with no note that its node type requires it. Docs polish outside this card's surface.",
    "carrier: 承接者:无 · noted, not filed. packages/lint/src/lint-flow-patterns.test.ts:2077 uses connector_action with config: { connectorId: 'c', action: 'a' }, which is off-spec (no block, 'action' rather than actionId). It is a lint-pattern fixture that never meets FlowSchema; the lint suite is green."
  ]
}

[objectstack-fleet]

REWORK round 1 — PR #20453 at head 992656cea5 · domain:spec seat 2 (session_014EJ1ED8X4MMrT18BhVx4tx) · 2026-09-28T13:43Z

The seat reviewed the dev report 5871041819 against GitHub and the diff, not against the report's prose. Everything below stands, except one must-fix item.

Must fix (sent to the same dev, same claim and branch):

1. content/docs/automation/flows.mdx:142 documents connectorConfig as optional "for a connector_action node". This PR makes it required on that node type: absence and blank ids are both refused. A published text the change falsifies is fixed in the same PR, not noted. The dev's out_of_scope_findings[2] had it as "noted, not filed".
2. The same table's waitEventConfig row (~:146) has the same defect class: a node-type-required block documented as optional (FlowSchema refuses a block-less wait). It is corrected in the same round as a bounded in-place fix: same class, mechanical, no other claim on the file, same gate family.

Checked and standing:

• PR shape: draft, base main, first line Fixes #20418 (the card is not in the decision box), the body's Clause-②: no line at line start, assignee os-tesla. The closing-keyword scan finds only #20418.
• Route deviation, accepted: the rule lives in the FlowSchema superRefine walk (collectFlowGraphs), not in requireTypeScopedConfig. The dev measured that a node-level refusal leaves a region-nested node admitted (control: a block-less boundary_event in a loop body parses success: true). The seat read the diff: the refusal texts carry prescriptions and no tracker number, and the blank rule reuses NON_BLANK_STRING, the rule fix(spec)!: refuse a flow node config its executor cannot run — a required key left out, or a decision branch list it cannot read — at all three doors (#20316) #20416 applies to decision labels.
• File surface amended (declared by the dev, adopted here): packages/spec/src/conversions/registry.ts (comment only: the lift conversion's guard sentence this change falsifies); packages/services/service-automation/src/builtin/connector-nodes.test.ts and src/guard-refusal-inventory.test.ts (consumer fixtures that registered the refused shape, flipped); and the FlowSchema @example in-place fix (an update_record with no objectName, refused since fix(spec)!: refuse a flow node config its executor cannot run — a required key left out, or a decision branch list it cannot read — at all three doors (#20316) #20416). With round 1, content/docs/automation/flows.mdx joins.
• Evidence: before and after at all three doors (absent, blank, nested), one ablation with a byte-proven restore, and full suites for spec, service-automation, lint, four connectors, example-showcase and dogfood. dispatch-gates: 90 derived, 90 run, all exit 0. CI at 992656cea5 was in progress at this stamp; the seat reads it on the round-1 head.
• Contract review (owed before enqueue): the at-tier reviewer could not run. The CONTRACT_REVIEW_TIER model answered HTTP 429 (usage limit). ⛔ No lower-tier review is substituted for it. The PR stays draft, and the at-tier review is retried on the round-1 head.

Finding dispositions (one line each):

• [0] objectui designer seed connectorConfig: { connectorId: '', actionId: '' } refused at save after the bump → folds into objectui#10948 (the family's carrier: seeded nodes that become save errors), noted there at ACCEPT.
• [1] lint validateStackExpressions has no copy of the block rule (every named door parses first) → PR Acceptance notes.
• [2] flows.mdx optional rows → fixed in this PR (round 1 above), not noted.
• [3] the lint-flow-patterns.test.ts:2077 off-spec fixture that never meets FlowSchema → dropped: a test-only fixture outside the three filing classes, and the lint suite is green.

---

Generated by Claude Code

[objectstack-fleet]

os-dev-report

{
  "issue": 20418,
  "status": "done",
  "branch": "claude/issue-20418-connector-action-config-required",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/20453",
  "session": "session_014EJ1ED8X4MMrT18BhVx4tx (subagent; the parent PM's session, as stamped in this run's Claude-Session trailers)",
  "premise_still_valid": true,
  "summary": "Round 1 (REWORK item: a published doc this PR made false). content/docs/automation/flows.mdx node-key table: connectorConfig now reads \"✅ on `connector_action`\" and states that FlowSchema refuses the node without the block, and with a blank (empty or whitespace-only) connectorId or actionId, at any depth. As the bounded in-place fix, waitEventConfig reads \"✅ on `wait`\" (FlowSchema refuses a block-less wait; eventType has no default; timer needs a non-blank timerDuration). boundaryConfig reads \"✅ on `boundary_event`\", the same class in the same table; this row goes one past the two rows the rework named, and is declared here for the seat's PR-body line. In the edited wait row, \"`timerDuration` accepts a bare number as milliseconds\" was itself false (a number is invalid_type; a quoted numeric string is read as ms) and is corrected. Everything from round 0 stands: A connector_action node its executor cannot dispatch is now refused at FlowSchema.parse, registerFlow and objectstack validate, at any depth including an ADR-0031 region body: a missing connectorConfig block (custom at nodes.N.connectorConfig), and a connectorId or actionId that is blank after trimming (custom at nodes.N.connectorConfig.connectorId / .actionId). The rule is a module-private connectorActionConfigRefusals called from a new collectFlowGraphs walk in the FlowSchema superRefine, not from requireTypeScopedConfig: measured, a node-level refusal does not reach a region-nested node at the flow parse (control: a block-less boundary_event in a loop body parses success=true). The blank rule is the one #20416 applied to a decision branch label (an executor that reads its value raw), because the Studio designer seed { connectorId: '', actionId: '' } fails every run identically. Also landed: the rider (node-config-key-missing now past tense, pin moved); the ADR-0087 D3 entry connector-action-config-required with generated step-18 tails; the changeset (spec minor, Clause-② no (narrowing), registered marker); the FlowSchema @example docblock made parseable; and the D2 lift conversion's guard comment corrected. Hypotheses: H1 true at e4d3f2ca; H2 re-measured true at all three doors, and the nested and blank shapes also measured admitted; H3 true (objectui origin/main 328abeb and b120b66, flow-canvas-parts.tsx:397), but the blank-id refusal now refuses a designer save (finding below); H4 located at flow-node-config-refusals.ts:185 and flow-slot-refusal-codes.test.ts:91.",
  "tests": "Round 1 at head c23d0a3211 (the only change since 992656cea5 is content/docs/automation/flows.mdx).\nEvidence for the three rows, FlowSchema.safeParse on spec src (tsx):\n- connector_action with no block → custom at nodes.1.connectorConfig; with blank ids → custom at .connectorId and .actionId; complete → success.\n- wait with no block → custom at nodes.1.waitEventConfig; timer with no timerDuration → custom at nodes.1.waitEventConfig.timerDuration; timerDuration 60000 (a number) → invalid_type; '60000' and 'PT1H' → success.\n- boundary_event with no block → custom at nodes.1.boundaryConfig; complete → success.\nMDX: the page compiles with @mdx-js/mdx 3.1.1 + remark-gfm 4.0.1 and renders the three \"✅ on \" cells; the new rows hold no bare braces or angle brackets outside code spans.\nMergeability: a driver-free probe (a bare --shared clone with no os-regen driver) ran merge-tree --write-tree origin/main 7fa3e3e07c against c23d0a3211 and exited 0 with tree fbd3b978. That tree's packages/spec/src/migrations/registry.ts passes build-migration-registry --check (309 semantic, holding both this entry and main's list-view-tabs-retired), so no merge was made. A first attempt at that check ran on the wrong tree (commit-tree could not see the probe clone's objects, so the worktree fell back to my own head); that reading was discarded, and the check was redone on an archive of the real merge tree. Round 0 test readings stand: Before, on origin/main e4d3f2ca, by probe (spec dist; registerFlow with installBuiltinNodes then execute; the built CLI validate --json):\n- no block, designer-seed blank ids, and nested-in-loop no block: door1 success=true, door2 registered, door3 valid:true exit 0; every run success=false with 'connector_action 'call': connectorConfig.connectorId and .actionId are required'.\n- whitespace ids: admitted, run fails 'no handler for ' . ''.\n- controls: success.\nAfter, by the same probes:\n- door1: custom at nodes.1.connectorConfig, or .connectorId / .actionId, or nodes.1.config.body.nodes.0.connectorConfig.\n- door2: throws ZodError with the same issues.\n- door3: valid:false, exit 1, custom at flows.0.nodes.1.connectorConfig (and the nested and blank paths).\n- controls: success / registered and run success=true / valid:true exit 0.\n- pre-conversion config.{connectorId,actionId}: door1 refused, door2 registers (the D2 lift).\nAt final head 992656cea5:\n- spec, targeted on src/automation src/conversions src/migrations: 39 files, 1484 passed.\n- service-automation, targeted on connector-nodes, guard-refusal-inventory, run-summary, node-config-required-keys, connector-materialization and engine: 6 files, 324 passed.\n- eslint --no-inline-config --format json over the 10 changed .ts files: 10 reported, 0 errors, 0 warnings. The population is eslint.config.mjs's **/*.{ts,...} minus NEVER_LINTED; the config never enables type-aware linting, so the verdicts of untouched files cannot move.\nFull suites at the pre-merge heads (the merge touched none of these packages):\n- spec vitest --project local: 565 files, 16651 passed, 1 todo. spec typecheck: exit 0.\n- service-automation: 149 files, 1837 passed. typecheck: exit 0.\n- lint: 115 files, 5331 passed.\n- connector-slack 3/10, connector-rest 4/26, connector-mcp 3/23, connector-openapi 4/36 (files/tests), all passed.\n- example-showcase: 29 files, 385 passed. The first attempt failed to resolve an unbuilt connector-slack dist (not a reading); rerun after building the closure.\n- dogfood showcase-declarative-mcp: 2 passed.\n- spec check:generated: 15/15 up to date.\nAblation, one-shot, via scripts/ablation-replace.mjs on the committed tree with a trap restore:\n- The walk's connectorActionConfigRefusals(node) became (null): anchor 1 to 0, replacement 0 to 1, blob bae1a5cc to 20017fad.\n- connector-action-config-required.test.ts then read 7 failed, 4 passed: every refused row red, the controls green.\n- Restored: blob equals HEAD bae1a5cc, and git diff HEAD is empty.\nNo dist leg is needed: the spec test imports src.",
  "mcp_calls": "0",
  "api_writes": "Round 1: 1 relay stroke, the new os-dev-report comment, POST /repos/objectstack-ai/objectstack/issues/20418/comments via POST /repos/objectstack-ai/objectstack/dispatches (fleet-write.yml as objectstack-fleet[bot]). 1 git push (c23d0a3211). The PR body is untouched. Round 0: 3 relay strokes, each one POST /repos/objectstack-ai/objectstack/dispatches executed by fleet-write.yml as objectstack-fleet[bot]:\n(1) pr_create → POST /repos/objectstack-ai/objectstack/pulls (#20453, draft; run 36429753675).\n(2) label-write assign → POST /repos/objectstack-ai/objectstack/issues/20453/assignees, os-tesla (run 36429882914). No label was named by the dispatch, so zero labels were written; size/l, documentation, tests and tooling came from the path labeler.\n(3) this report → POST /repos/objectstack-ai/objectstack/issues/20418/comments.\nNot REST: 5 git pushes (the empty-branch probe, 3 commits, the main merge).",
  "gates": "Round 1 at c23d0a3211: dispatch-gates --repo objectstack-ai/objectstack --commands derived 112 commands, the round-0 90 plus 22 for the docs path. All 112 were run, each exit captured before any pipe, and all exit 0; --ran with recorded codes reports 112 derived, 112 run, 0 NOT-MEASURED (derived zero). The named gates: node scripts/docs-audit/check-affected-docs.mjs exit 0; pnpm check:doc-authoring exit 0 (16566 strings clean, sibling prose ids at baseline); check-issue-citations exit 0 (3 resolve); pnpm check:nul-bytes exit 0 (9960 files). The 22 docs-path additions, all exit 0: check-doc-frontmatter, check-doc-route-spelling --advisory, check-docs-section-name, check-section-landing-index (each with --self-test), lint check:doc-security-posture, spec check:skill-examples, check:corpus-claim-drift, check:doc-anchors, check:docs-audit-scope, check:docs-redirects, check:docs-single-h1, check:docs-spec-enumerations, check:docs-transcript-drift, check:published-readme-links, check:react-page-adapter-contract, check:role-word, check:skill-identifier-liveness, check:vendor-version-stamps. Builds were replayed from the turbo cache before the run (72 tasks, 71 cached), so the dist-reading gates read a current dist. Outside the derived total and left to CI: the docs-site build and check-links.yml (lychee); the edit adds no link. Round 0: At 992656cea5, node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands derived 90 commands. All 90 were run, each exit captured before any pipe, and all exit 0. check:dual-build-cjs-loads and check:type-check-debt first answered PREREQUISITE NOT MET (exit 3, 9 unbuilt packages); they exited 0 after those were built. --ran with recorded codes: 90 derived, 90 run, 0 NOT-MEASURED (derived zero). Named families all green: check:authorable-surface, check:docs, check:api-surface, check:liveness, check:strictness-ledger, check:migration-registry, check:spec-changes, check:upgrade-guide, check:adr-0087-registration ([BREAKING+bang+clause-②-narrowing] registered connector-action-config-required), check-changeset-no-major, check:doc-authoring, check:issue-citations (3 resolve), check:nul-bytes. The first derivation at c81e639dbd printed STALE TREE (main 6 commits ahead, 4 derivation files changed), so main was merged through os-regen-merge.sh (no spec, service-automation or lint overlap) and the list re-derived: the same 90.",
  "line_budget": "542 changed lines (+514 / -28) over 12 files vs origin/main merge base 0fcb10184c; round 1 adds 3 / removes 3 in one file. Under the 5000 threshold; no governed surface.",
  "files_changed": [
    ".changeset/20418-connector-action-config-required.md",
    "packages/spec/src/automation/flow.zod.ts",
    "packages/spec/src/automation/flow-node-config-refusals.ts",
    "packages/spec/src/automation/connector-action-config-required.test.ts",
    "packages/spec/src/automation/flow-slot-refusal-codes.test.ts",
    "packages/spec/src/automation/flow.test.ts",
    "packages/spec/src/conversions/registry.ts",
    "packages/spec/src/migrations/entries/semantic/18.connector-action-config-required.ts",
    "packages/spec/src/migrations/registry.ts",
    "packages/services/service-automation/src/builtin/connector-nodes.test.ts",
    "packages/services/service-automation/src/guard-refusal-inventory.test.ts",
    "content/docs/automation/flows.mdx"
  ],
  "deviations": [
    "Round 1: the boundaryConfig row is corrected too, one row past the two the rework named. It is the same defect class (a node-type-required block documented as optional) in the same table, and FlowSchema refuses a block-less boundary_event (custom at nodes.1.boundaryConfig). Left alone, it would have been the table's one remaining \"optional\" among the three sibling blocks. Please name it in the seat's PR-body line with the other two.",
    "Round 1: in the waitEventConfig row, \"`timerDuration` accepts a bare number as milliseconds\" was false, and it sat in the row being rewritten. It now says timerDuration is a string and a quoted bare number is read as ms. Measured: timerDuration 60000 is invalid_type; '60000' parses.",
    "Round 1: the pre-existing \"(#4158)\" in the waitEventConfig row is kept verbatim. The new prose carries no tracker number.",
    "Round 1: no merge of origin/main; the driver-free probe says the head is mergeable. Worktree recreated on the existing local branch (the git worktree add --track -b spelling was refused because the branch name already existed locally at the same sha 992656cea5), then removed again after the push.",
    "Route: the rule runs in the FlowSchema superRefine's collectFlowGraphs walk, not in requireTypeScopedConfig as ③ suggested. Measured reason: a node-level refusal leaves a region-nested node admitted at all three doors (boundary_event control: nested success=true). Side effect, pinned by a test: FlowNodeSchema alone still parses the designer seed.",
    "File surface beyond the claim's listed landing site, two items. (1) packages/spec/src/conversions/registry.ts: comment-only. The flow-node-connector-config-lift guard comment said an incomplete pair keeps failing at run time rather than fails to load, which this change makes false. (2) Two service-automation test files: flips of fixtures that registered the now-refused shape (consumer tests, not producers).",
    "Bounded in-place fix in flow.zod.ts: FlowSchema's @example also had an update_record with no objectName, already refused since #20416. It was fixed in the same literal as the connector node (same family, mechanical, file in claim, no new gate); the corrected literal parses success=true.",
    "Clause-② line: the PR body carries the claim's line verbatim ('Clause-②: no'). The changeset carries 'Clause-②: no (narrowing)' per the dispatch, where check:adr-0087-registration reads the arm. Same value, arm only in the changeset.",
    "Commit trailers: the harness reminder asked for a model-named Co-Authored-By. Every pushed commit uses the model-free pair per AGENTS.md; the first local commit was amended before any push.",
    "Door 3 (CLI) was probed for 4 shapes (absent, complete, blank ids, nested absent). The actionId-only, whitespace, nested-control and pre-conversion rows were measured at doors 1 and 2 only.",
    "Not measured: objectui at the .objectui-sha pin f8a9d0fb (object absent from this container's shallow clone; measured at objectui origin/main 328abeb and b120b66 instead); cloud (no checkout)."
  ],
  "open_questions": [],
  "out_of_scope_findings": [
    "carrier: objectui#10948 (the family's carrier, per dispatch) · class: b · reach: named producer. objectui defaultNodeExtras('connector_action') (packages/app-shell/src/views/metadata-admin/previews/flow-canvas-parts.tsx:397 at objectui origin/main 328abeb and b120b66) seeds connectorConfig { connectorId: '', actionId: '', input: {} }. Once objectui takes this spec, a connector node added and saved before it is configured is refused at save: the server registerFlow door, and the designer's live FlowSchema pass (clientValidation.ts:681) at nodes.N.connectorConfig.connectorId / .actionId. objectui's seed ratchet (FlowNodeSchema.safeParse per seed) stays green by construction. Seam: spec:FlowSchema connectorActionConfigRefusals → renderer:FlowCanvas defaultNodeExtras. Same posture #20416 took for the http / notify seeds; fold into the carrier, no single-point card. Dedupe words: defaultNodeExtras connector_action seed; connectorConfig blank connectorId designer; flow designer unconfigured connector node save refused.",
    "carrier: 承接者:无 · noted in the PR's Acceptance notes, not filed. lint validateStackExpressions carries flowNodeConfigRefusals for a stack handed to it with no parse in front, but has no copy of the connector_action block rule. The wait / boundary_event block rule has none either, and every named door parses first.",
    "carrier: 承接者:无 · noted, not filed. packages/lint/src/lint-flow-patterns.test.ts:2077 uses connector_action with config: { connectorId: 'c', action: 'a' }, which is off-spec (no block, 'action' rather than actionId). It is a lint-pattern fixture that never meets FlowSchema; the lint suite is green."
  ],
  "round_1": {
    "head": "c23d0a32119f795ef7c1344981d542bb0c5f66c2",
    "previous_head": "992656cea5ceaa72eddae7a73747d40e29702daa",
    "rows": [
      {
        "key": "connectorConfig",
        "before": "| `connectorConfig` | `object` | optional | `{ connectorId, actionId, input }` for a `connector_action` node |",
        "after": "| `connectorConfig` | `object` | ✅ on `connector_action` | `{ connectorId, actionId, input }` — the only input a `connector_action` node's executor reads. `FlowSchema` refuses a `connector_action` node without it, and one whose `connectorId` or `actionId` is blank (empty or whitespace only), at any depth including a region body. `connectorId` is the registered connector's `name`, `actionId` one of the action keys it declares; `input` is optional |"
      },
      {
        "key": "waitEventConfig",
        "before": "| `waitEventConfig` | `object` | optional | `wait`-node event descriptor (`eventType`, `timerDuration`, `signalName`). `timeoutMs` / `onTimeout` were removed in 17 (#4158) — `wait` has no timeout; `timerDuration` accepts a bare number as milliseconds |",
        "after": "| `waitEventConfig` | `object` | ✅ on `wait` | `wait`-node event descriptor (`eventType`, `timerDuration`, `signalName`). `FlowSchema` refuses a `wait` node without it; `eventType` has no default, and `eventType: 'timer'` requires a non-blank `timerDuration`. `timeoutMs` / `onTimeout` were removed in 17 (#4158) — `wait` has no timeout; `timerDuration` is a string, and a quoted bare number (`'60000'`) is read as milliseconds |"
      },
      {
        "key": "boundaryConfig",
        "before": "| `boundaryConfig` | `object` | optional | BPMN boundary-event descriptor (interop) |",
        "after": "| `boundaryConfig` | `object` | ✅ on `boundary_event` | BPMN boundary-event descriptor (interop). `FlowSchema` refuses a `boundary_event` node without it |"
      }
    ]
  }
}