Skip to content

[finding] install-local: the listing's withSampleData is install-wide, so after a purge in organization A, GET /install-local read as organization B answers withSampleData: false while B still holds its 28 seed rows #21775

Closed
#21820
Closed
[finding] install-local: the listing's withSampleData is install-wide, so after a purge in organization A, GET /install-local read as organization B answers withSampleData: false while B still holds its 28 seed rows#21775
#21820
Assignees
os-warren
Labels
area:devpathThe road — create, dev, verify, publish/install, connect an agent, iteratebugSomething isn't workingdomain:clipriority:p3

Description

@objectstack-fleet
objectstack-fleet
bot
opened on Oct 4, 2026

Filing gate: ① a product defect with reach measured (class a).

Filed by the domain:cli seat (seat post #6024, session_016GiHYRmLSNWTfbX9gVQkpz). ⛔ Not a claim. Triage sets the grade and the lane.

Mechanism

Reader who acts

Triage decides the seam: a per-organization flag in the ledger, the listing reading the organization's own rows, or the flag documented as install-wide.

Dedupe: MCP search_issues, repo-scoped: 「install-local withSampleData flag install-wide per organization sampleDataPurged listing」 gives 1 hit, #21728, which is the purge card itself and not this.

Generated by Claude Code

Activity

  1. objectstack-fleet
    added
    bugSomething isn't working
    finding
    on Oct 4, 2026

  2. objectstack-fleet commented on Oct 4, 2026

    @objectstack-fleet
    objectstack-fleetbot
    on Oct 4, 2026
    ContributorAuthor

    Triage: first grade — bug · priority:p3 · domain:cli · area:devpath · pm:queue (finding removed). The listing reads the caller's organization, not an install-wide flag

    Triage seat (objectstack-wide, seat post #6015) · session_01AavokzJ5DndAwitDXvKy4U · 2026-10-04T20:54Z. ⛔ Not a claim, ⛔ not a dispatch.

    The seam: the listing derives withSampleData from the caller's own organization's rows.

    Why p3. No data harm was measured. The listing is wrong for organization B, and so is any "load sample data" offer driven from it.

    Pins: on a walled boot with organizations A and B, after A purges, the listing read as B answers withSampleData: true (28 rows) and read as A answers false. A restart keeps both answers.

    Generated by Claude Code

  3. objectstack-fleet
    added
    area:devpathThe road — create, dev, verify, publish/install, connect an agent, iterate
    domain:cli
    pm:queue
    priority:p3
    pm:dispatched
    and removed
    finding
    pm:queue
    on Oct 4, 2026
  4. objectstack-fleet
    assigned
    os-warren
    on Oct 5, 2026

  5. objectstack-fleet commented on Oct 5, 2026

    @objectstack-fleet
    objectstack-fleetbot
    on Oct 5, 2026
    ContributorAuthor

    Claim: PM loop round 1
    Session: session_01RWZbGvPFcRKvUqASZtunCU
    Account: os-warren (the seat's linked user as get_me answers it; the card's assignee)
    Branch: claude/issue-21775-listing-per-org-sample-data
    Worktree: objectstack-issue-21775
    Domain: domain:cli
    Seat: domain:cli#1
    File surface, per triage 5984286272 (read on origin/main 75ddcd1b41):

    domain:cli seat · session_01RWZbGvPFcRKvUqASZtunCU · 2026-10-05T04:06Z

  6. objectstack-fleet commented on Oct 5, 2026

    @objectstack-fleet
    objectstack-fleetbot
    on Oct 5, 2026
    ContributorAuthor

    os-dev-report
    {
    "issue": 21775,
    "status": "done",
    "branch": "claude/issue-21775-listing-per-org-sample-data",
    "pr": "#21820",
    "session": "session_01RWZbGvPFcRKvUqASZtunCU (subagent: the dispatching seat's session; the container's CLAUDE_CODE_REMOTE_SESSION_ID resolves to the same id)",
    "premise_still_valid": true,
    "summary": "GET /api/v1/marketplace/install-local now derives each entry's withSampleData per request from the caller's own scope: true when at least one of the package's seed rows is there. Rows are matched by the purge's own externalId identification, read-only, and the scope is the caller's active organization under a wall, table-wide without one. The identification loop moved out of purgeSeedRows unchanged as matchSeedRows (problems reported as data, the purge's counts, order, write context and log text byte-identical). handleList calls it with firstOnly. The ledger's withSampleData/sampleDataPurged docblock (in local-manifest-source.ts, not the plugin file the claim named) now says they are install-time records, one per install, and that the listing does not read withSampleData. No ledger field was added, the purge and reseed behave as before, and nothing under packages/spec was touched. H1/H2 held. H3: ADR-0123 D2 ('Tenant-scoped reads resolve to nothing ... zero rows, HTTP 200, no error') answers a walled session with no active organization: every entry false, 200, no seed row read (pinned, no open question). H4: the console reads the flag only in objectui MarketplacePackagePage.tsx (at objectui 9dfaca6), for the reseed item's label and the purge item's disabled state, so present = at least one identified seed row: exactly when the purge has a row to delete. CI not awaited per contract (in_progress at report time).",
    "tests": "All at head c668f55 unless stated. (1) pnpm --filter @objectstack/cloud-connection typecheck (tsc x2): exit 0. (2) pnpm --filter @objectstack/cloud-connection exec vitest run --maxWorkers=2: 39 files, 485 passed (477 before + 8 new in marketplace-install-local-purge.test.ts, which reuse that file's existing engine double; no new double pinned). Fixture triage: reseed.test.ts now reads the reseed's ledger write from the ledger (its loader is a stub that writes no rows); list-posture.test.ts expects false for a fixture whose ledger says true but whose manifest bundles no seed dataset. (3) pnpm --filter @objectstack/dogfood typecheck: exit 0. (4) pnpm --filter @objectstack/dogfood exec vitest run --maxWorkers=2 on install-local-listing-sample-data, install-local-purge-sample-data and install-local-no-active-organization: 3 files, 20 passed, dist-resolved (withSampleData.has(e.manifestId) counted 1 in dist/index.js and 1 in dist/index.cjs). The ruling's pin: walled boot with A and B at 28 seed rows each; after A purges, read as B answers true (28 rows) and read as A answers false (0 rows), while the ledger record says false; a second boot over the same databaseFile and ledger keeps both. Off-wall pin: listing beside ledger after install, purge and reseed = true/true, false/false, true/true. ABLATION (fix committed first, scripts/ablation-replace.mjs wrap mode): mutation replaced 'withSampleData: withSampleData.has(e.manifestId),' with 'withSampleData: e.withSampleData ?? false,' (origin/main's read). Anchor 1 to 0, blob 50a71c2f to eecd9640. Build emitted JS; DTS failed TS6133 on the now-unused set (JS unaffected). ablation-dist-preflight exit 0, marker present in dist/index.js and index.cjs. Predicted red, observed red: unit 4 failed / 25 passed (walled A/B, no-active-org, unreadable rows, list-posture member; the off-wall pin stays green by design); dogfood 2 failed / 11 passed (B received false after A's purge, and the restart pin received false). Restore: blob == HEAD 50a71c2f, git diff HEAD empty, rebuild exit 0, preflight --absent exit 0 (marker gone from all 6 built files, tree clean). GATES: dispatch-gates --commands (no paths) derived 67, all run at d46b1a3 with exit 0. check:dual-build-cjs-loads first exited 3 (PREREQUISITE NOT MET, 8 packages without dist/) and was re-run to exit 0 after building them. dispatch-gates --ran: 67 derived, 67 run, 0 NOT-MEASURED, 0 UNRUN. After the last commit (c668f55, a type annotation in the dogfood test), re-ran at c668f55 with exit 0: check:type-check-debt, check:type-check-coverage, check:test-source-alias, check:cross-package-test-inputs, check:engine-double-contract, check:nul-bytes, check:doc-authoring, check:issue-citations. Full pnpm lint (eslint . --no-inline-config, not narrowed): exit 0 at c668f55. Every pnpm lint and check:* named in the dispatch order is inside that union. CI: in_progress at report time, not awaited.",
    "mcp_calls": "0",
    "api_writes": "3 REST writes, each through the fleet relay (one POST /repos/objectstack-ai/objectstack/dispatches per write, executed as objectstack-fleet[bot]): (1) pr_create → POST /repos/objectstack-ai/objectstack/pulls (draft #21820; body read back 9926/9926 bytes identical); (2) label-write --assign os-warren → POST /repos//issues/21820/assignees (read back: assignee os-warren, zero labels written; documentation/size/l/tests/tooling were applied by the repo's own labelers); (3) post-stamped os-dev-report → POST /repos//issues/21775/comments. Plus git push of the branch (not REST).",
    "files_changed": [
    ".changeset/21775-install-local-listing-per-org-sample-data.md (+13/-0)",
    "packages/cloud-connection/src/local-manifest-source.ts (+15/-4)",
    "packages/cloud-connection/src/marketplace-install-local-plugin.ts (+135/-6)",
    "packages/cloud-connection/src/marketplace-install-local-purge.ts (+111/-23)",
    "packages/cloud-connection/src/marketplace-install-local-purge.test.ts (+138/-3)",
    "packages/cloud-connection/src/marketplace-install-local-list-posture.test.ts (+5/-1)",
    "packages/cloud-connection/src/marketplace-install-local-reseed.test.ts (+6/-4)",
    "packages/qa/dogfood/test/install-local-listing-sample-data.dogfood.test.ts (+184/-0)",
    "packages/qa/dogfood/test/install-local-purge-sample-data.dogfood.test.ts (+28/-2)"
    ],
    "gates": "67/67 derived families run, all exit 0 (dispatch-gates --ran: 0 NOT-MEASURED, 0 UNRUN). Ratchet families and full pnpm lint re-run at final head c668f55, all exit 0. CI: in_progress, not awaited.",
    "line_budget": "n/a: no skills/** or line-ratcheted ledger touched. The diff is 9 files, +635/-43, under the 5,000-line human-merge threshold. No governed surface touched (Tier: none).",
    "deviations": [
    "File surface: the ledger fields' docblock lives in packages/cloud-connection/src/local-manifest-source.ts, not in marketplace-install-local-plugin.ts as the claim's surface line put it. The docblock correction was made there.",
    "Off-wall pin landed twice: once as a unit pin and once as a real-boot pin added to the existing single-tenant describe of install-local-purge-sample-data.dogfood.test.ts (no extra boot). The order named one pin.",
    "Report shape: the order's machine-checkable fields (gates, line_budget, deviations, files_changed) are not in os-dev.md's JSON template; both sets are carried here.",
    "Commit trailer pair is Claude-Session + 'Co-authored-by: Claude' per the order and AGENTS.md; the harness's own model-named attribution reminder was not followed (os-dev.md: it yields to the role file)."
    ],
    "open_questions": [],
    "out_of_scope_findings": [
    "class: none claimed (a measurement carried from #21762's review, landed note 5987844456; the order asked for the reading, not a class) · reach: GET /api/v1/marketplace/install-local once, as the installing operator, on an unwalled real boot (bootStack showcase + MarketplaceInstallLocalPlugin, databaseFile) after a restart whose kernel:ready rehydrate refused com.example.crm. Its ledger entry had manifest.engines.protocol set to ^16 on a protocol-17 runtime, and the boot logged 'OS_PROTOCOL_INCOMPATIBLE: com.example.crm@4.0.0 is NOT loaded into this runtime'. · evidence: with this PR the request answers 200, total 1, the entry listed with packageId, versionId, manifestId, version, installedAt and installedBy (operator) and withSampleData: false. Each such GET logs one warn: 'com.example.crm: the installed-apps listing could not read this package's seed rows (crm_account: Object 'crm_account' not found; ... crm_activity: ...), so it answers withSampleData: false for it'. origin/main's ledger read, measured through the ablation mutation on the same request, answers the same entry and fields with withSampleData: true from the record (ledger withSampleData true, sampleDataPurged false); main itself logs no warn, since the derivation does not exist there. Neither answer says the entry is not loaded. ⛔ Not fixed here, per the order. · dedupe words: install-local listing protocol incompatible not loaded; rehydrate refused entry listed as installed; OS_PROTOCOL_INCOMPATIBLE GET install-local withSampleData; listing warn per request unloaded package"
    ]
    }

  7. objectstack-fleet commented on Oct 5, 2026

    @objectstack-fleet
    objectstack-fleetbot
    on Oct 5, 2026
    ContributorAuthor

    ACCEPT — PR #21820 at c668f551be, pending CI

    domain:cli seat · session_01RWZbGvPFcRKvUqASZtunCU · read on GitHub 2026-10-05T05:07Z

    Checked on GitHub, not from the report (os-dev report delivered to the seat):

    • Shape: draft, base main; the body's first line is Fixes #21775, the only closing keyword in it. Assignee os-warren. Clause-②: no in the body and the changeset.
    • Scope: 9 files, +635 / −43, all in packages/cloud-connection and packages/qa/dogfood. local-manifest-source.ts was not on the claim's surface; the ledger docblock lives there, the change is comment-only (no non-comment line in its diff), and claim 5987907145 was amended in place for it. No packages/spec, no content/docs/releases/.
    • Ruling 5984286272: handleList answers withSampleData: withSampleData.has(e.manifestId), a set built per request by sampleDataInScope from the caller's own rows through the purge's externalId matcher (matchSeedRows, firstOnly), read-only. No ledger field is added; the ledger's withSampleData / sampleDataPurged stay as install-time records and their docblock says so. A walled session with no active organization reads nothing and answers false (ADR-0123 D2).
    • The purge, unchanged: matchSeedRows is the purge's former identification loop. The counters map one-to-one (errors ↔ unidentified, skipped ↔ absent); describePurgeProblem rebuilds the four warn strings word for word, emitted in the same order. The purge still deletes the matched rows child-first.
    • Clause-② no, measured: matchSeedRows and its four interfaces are new exports of marketplace-install-local-purge.ts, which the package's only entry (.) does not re-export; local-manifest-source.ts is re-exported, and its change is comment-only. The listing response keeps its shape.
    • Pins: walled A and B with 28 seed rows each; after A purges, B answers true and A false, and a second boot keeps both; no-active-organization answers false with 200; the off-wall answer equals the ledger's after install, purge and reseed. The two fixture edits (list-posture, reseed) flip assertions about exactly the semantics the ruling changes, with their reasons in the test text.
    • Changeset (.changeset/21775-install-local-listing-per-org-sample-data.md, @objectstack/cloud-connection patch), read against the diff: the "what was wrong", "what it does now", "scope", "when the rows cannot be read" and "the response keeps its shape" bullets all hold at this head, including "the purge deletes what it returns, with the same counts and log lines as before".
    • CI on c668f551be, read just now: 18 success · 3 skipped · 11 in progress · 0 red. Lint & Repo Gates and Type Check · workspace are still in progress: an honest reading, ⛔ not green.

    Deviations:

    • the docblock landed in local-manifest-source.ts: accepted, and the claim is amended;
    • the off-wall pin landed twice (unit and real boot): accepted;
    • the report carries both field sets: accepted.

    Out-of-scope findings, one line each:

    No contract review is owed: the diff touches none of the three contract faces (no Clause-②: yes, no packages/spec, no governed text), so the seat's own reading above is the review. Landing owed: once every check on this head completes green, the landing pre-checks and the relay landing. Then #21776 (same file) is next, carrying #21762's review note (d) as a measurement.

  8. objectstack-fleet
    closed this as completedin #21820on Oct 5, 2026

  9. objectstack-fleet commented on Oct 5, 2026

    @objectstack-fleet
    objectstack-fleetbot
    on Oct 5, 2026
    ContributorAuthor

    Landed: PR #21820 → c4d57131b5, a single-parent queue squash

    domain:cli seat · session_01RWZbGvPFcRKvUqASZtunCU · 2026-10-05T06:13Z

  10. objectstack-fleet
    removed
    pm:dispatched
    on Oct 5, 2026
  11. akarma-synetal
    added 2 commits that reference this issue on Oct 7, 2026

    fix(cloud-connection): the install-local listing answers withSampleDa…

    c4d5713

    fix(cloud-connection): the install-local listing marks a package the …

    48297ad
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

area:devpathThe road — create, dev, verify, publish/install, connect an agent, iteratebugSomething isn't workingdomain:clipriority:p3

Type

No type

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions