Repository navigation
upgrade-impact comparison after v18: report the non-access classes to the administrator, and retire the zero-consumer package-upgrade.zod.ts #24447
Description
Filing gate ③: a task the maintainer directed. Decision #24443 was ruled A (6259332195; the maintainer said 「其他同意」), and items 2–4 put this half after v18.
- Reader who acts: the epic seat, or whichever lane holds this card after v18.
- Dedupe: none was found; this card carries [Decision] A vendor package upgrade checks nothing: a rename silently re-enables what the customer switched off, and orphans, collisions and broken references go unreported, for every metadata type #24443's after-v18 half.
Blocked-by: #24446
What the ruling binds (items 2–4 of 6259332195)
- The other classes are reported. That means the O overlays (views, dashboards, reports, translations, email templates), the C behavioural types (flows and actions; validations and scheduled jobs, which have no switch today), the E extensions (objects and apps) and settings. They use the same comparison upgrade-impact comparison, access class (v18): a vendor upgrade that would orphan, re-enable or collide with a customer's access choice is refused until an administrator confirms, and raised at boot #24446 builds. Each finding goes to the administrator, not only to the server log; none is refused.
- Retire
packages/spec/src/kernel/package-upgrade.zod.ts(plan, diff, conflict, snapshot, rollback; zero runtime consumers), with its ADR-0087 conversion. - No rename spelling is added to the spec (item 5).
Measured silent cases (origin/main e22defb13c; seat measurement behind #24443)
| class | silent case | evidence |
|---|---|---|
| Flow, action | A rename re-enables a disabled item, with a double fire beside a clone. A removal orphans the ledger row. One action row disables every same-named action on every object. | service-automation/src/engine.ts:5244; objectql/src/action-activation.ts:49 |
| O overlays | A removal leaves an orphan that keeps serving. View diagnostics check only userFilters, filterableFields and kanban. | metadata-protocol/src/metadata-diagnostics.ts:207-250 |
| E extensions | A same-named vendor field is silently overridden by the extension's. A vendor object named like a customer object drops the customer's row at cold boot. | objectql/src/registry.ts:262; metadata-protocol/src/protocol.ts:31206 |
| Settings | A renamed key orphans the stored value, and the default applies. | platform-objects/src/system/sys-setting.object.ts:242 |
Activity
objectstack-fleet commentedon Oct 23, 2026
Unlocked · triage seat ·
session_01AavokzJ5DndAwitDXvKy4U· 2026-10-23T07:55ZBlocked-by: #24446: closedcompleted. Its ADR notes landed with PR docs(adr): ADR-0126 wall 3 holds for the access class; ADR-0131 D5 records the single-posture re-slug rule (#24446) #25384, merged at 2026-10-23T07:08Z.6259332195, items 2–4): 18.0.0 is published, and 18.x is the current line with no v19 planned. So the after-v18 half is now in scope.pm:blocked→pm:queue. The grade is unchanged at p2,domain:services.packages/spec/src/kernel/package-upgrade.zod.tsis a metadata-protocol change. Under the maintainer's standing order it is handled directly in 18.x, with no retirement stage, and its PR declares it (Metadata-protocol:line, ADR-0087 conversion). The reporting half (non-access classes reach the administrator) is runtime work, and the split into PRs is the seat's.Generated by Claude Code
objectstack-fleet commentedon Oct 23, 2026
Claim: card thread ·
domain:servicesseat 1 (seat post #6021, project run by the Sales account) · p2 · the services half (the non-access upgrade report); the spec half (retiringpackages/spec/src/kernel/package-upgrade.zod.tswith its ADR-0087 conversion) is left to the spec lane, asked for in a separate comment on this card · 2026-10-23T15:01ZSession:
session_01XHebWJmL3ZgbVpjM6JERNAAccount:
os-sales(the seat's linked user; the card's assignee)Branch:
claude/project-thread-mfvys8(the harness-pinned branch for this session; it names no issue, so the Duplicate Fix Guard's branch-name hint will not match — this claim is the identity record). #25413 (claimed by this session, comment 6367880115) lands first on it; this card's PR opens on the same branch after that PR merges, because this report hands its findings to the delivery helper #25413 adds.Worktree:
objectstack-issue-24447Domain:
domain:servicesSeat:
domain:services#1(seat post #6021)File surface (read on
origin/mainb2c07529; stop on a breach and explain it in the report):packages/plugins/plugin-security/src/upgrade-impact-report.ts(new): the non-access boot comparison, beside the access one upgrade-impact comparison, access class (v18): a vendor upgrade that would orphan, re-enable or collide with a customer's access choice is refused until an administrator confirms, and raised at boot #24446 built, reading the registry and the stored rows only. C:sys_metadata_activationflow/action/webhook rows whose package no longer ships the name, an action row whose name more than one object ships, a stored flow or webhook row a packaged one of the same name now shadows or withholds. O: activesys_metadataoverlay rows of view, dashboard, report, translation and email_template bound to a package that no longer ships the item. E: an extension field that collides with the owning object's field, an environment-authored object row a packaged object now owns. Settings: a stored value whose namespace and key no registered manifest declares. Findings go to the administrator through the feat(plugin-security): under a walled posture, deliver the access upgrade report in-app into the organization OS_PLATFORM_OWNER_ORGANIZATION names, instead of the operator log line only #25413 helper under their own topic and dedupKey; nothing is refused.packages/plugins/plugin-security/src/security-plugin.ts: one call in thekernel:bootstrappedhook, besidereportAccessUpgrade. Serial with the [maintainer] refactor(plugin-security): splitsrc/security-plugin.ts(10,746 lines, +2,803 in 30 days) along itsSecurityPluginseams, one move-only slice per PR #25223 split series (draft refactor(plugin-security): move the read filters, field readers and object admissions out of security-plugin.ts (#25223 cut 9) #25456 edits this file): rebased onto whatever cut is onmainwhen this PR opens.packages/plugins/plugin-security.patchchangeset for@objectstack/plugin-security.packages/spec, not the engine lane (objectql,metadata-*,platform-objects,core; read through their public surface only), notservice-automation,plugin-webhooksorservice-settingssources.Container & model:
L, card thread (in-session executor),model: default tier(dispatch-gates --tier: no path-derived mandate),effort: xhighClause-②: yes (widening)
Metadata-protocol: none
Basis for the Clause-② line: a new report at boot; no write, refusal or behaviour change on any path (item 2 of 6259332195: none is refused).
Responsibility:
n/a — not a defect cardThread-read: 6360244800
Serial constraints cleared: feat(plugin-security): under a walled posture, deliver the access upgrade report in-app into the organization OS_PLATFORM_OWNER_ORGANIZATION names, instead of the operator log line only #25413 (same session) lands first on the same branch; refactor(plugin-security): move the read filters, field readers and object admissions out of security-plugin.ts (#25223 cut 9) #25456 ([maintainer] refactor(plugin-security): split
src/security-plugin.ts(10,746 lines, +2,803 in 30 days) along itsSecurityPluginseams, one move-only slice per PR #25223 cut 9, draft) editssecurity-plugin.ts, so this PR rebases onto it if it lands first; no open PR or in-flight claim declaresupgrade-impact-report.ts.Resume-from: none
Generated by Claude Code
objectstack-fleet commentedon Oct 23, 2026
Spec half: left to the spec lane ·
domain:servicesseat 1 (#6021) · 2026-10-23T15:04ZThe claim above (6367925751) takes the services half of this card: the non-access upgrade report. The other half is item 3 of 6259332195: retiring
packages/spec/src/kernel/package-upgrade.zod.tswith its ADR-0087 conversion. That is apackages/specchange, and the services lane holds no spec files, so it is asked of the spec lane in one pointer on seat post #18549.No ordering between the halves. The services report reads none of these schemas. Neither half is
Blocked-bythe other.Measured on
origin/mainb2c07529, for whoever takes the spec half:packages/spec: none.git grep -n "package-upgrade\|UpgradePlanSchema\|planUpgrade\|UpgradePackageResponse\|UpgradeSnapshot" -- ':!packages/spec'hits only docs and one ADR sentence.kernel/index.ts:59contracts/package-service.ts:29(IPackageService.planUpgrade()andupgrade()) and its testapi/package-api.zod.ts:7,598(UpgradePlanSchemaas an optionalplanfield)kernel/package-upgrade.test.tsmigrations/entries/semantic/18.kernel-package-lifecycle-durations-unit-in-key.tstype-alias-convention.pin.test.ts:165,1022export-origins/kernel.json(about 30 names)scripts/build-docs.ts:658content/docs/references/kernel/package-upgrade.mdx, with its rows inreferences/index.mdx:224,references/kernel/index.mdx:29andmeta.json:21content/docs/upgrading.mdx:603, which points at that pagedocs/adr/0126-packaged-metadata-customization-model.md:321names the file.How this card closes. If the spec half has its own card by the time the services PR lands, that PR says
Fixes #24447and names the spec card. If it does not, the PR saysRefs #24447and this card stays open for the spec half.Generated by Claude Code
objectstack-fleet commentedon Oct 23, 2026
os-dev-report
{ "issue": 24447, "status": "done", "branch": "claude/project-thread-mfvys8", "pr": "https://github.com/objectstack-ai/objectstack/pull/25512", "session": "session_01XHebWJmL3ZgbVpjM6JERNA", "premise_still_valid": true, "summary": "The services half (items 2 and 4 of 6259332195). It adds a new plugin-security/src/upgrade-impact-report.ts, and one call in the kernel:bootstrapped hook after the access report. At every boot it reads the customer's stored state against the registry and reports 10 classes. C: flow, action and webhook ledger rows whose name no package ships; a switched-off row whose package now ships names no switch covers (a suspected re-enablement); a switched-off action that more than one object declares; a stored flow a packaged flow shadows; a sys_webhook row that withholds a declared webhook. O: an active sys_metadata view, dashboard, report, translation or email_template bound to an installed code or marketplace package that no longer ships it. E: an extension field the base layer or another extension also declares; a stored object row bound to a package that does not own the object; a navigation contribution whose group its app no longer has. Settings: a stored key its registered namespace no longer declares (values never read). Validations and scheduled jobs have no switch, so they have no ledger row to compare (as the card body says). The findings go through #25489's upgrade-report-delivery.ts under the topic system.upgrade_impact, with a dedupKey over the sorted finding set. Under single they go to the Default Organization's administrators and the operators. Under a wall they go to the operator line, plus an in-app copy in the organization OS_PLATFORM_OWNER_ORGANIZATION names. Each category logs one error with its fix. An unreadable store stops the report for that boot with one warn. Nothing is written or refused. Not judged, on purpose: a package-less object row over a packaged object (ADR-0005's overlay); rows bound to authored, unknown or disabled packages; unregistered settings namespaces; contributions to a missing app. The spec half (retiring package-upgrade.zod.ts) is not in this PR, so the PR says Part of #24447 and the card stays open for it.", "tests": "plugin-security pnpm test: exit 0, 217 files, 4529 passed, 45 skipped. pnpm typecheck (tsc, scripts, test-typecheck): exit 0. eslint on the touched files: exit 0. upgrade-impact-report.test.ts has 39 cases, each class with a CONTROL. upgrade-impact-report.wiring.test.ts has 5 cases on a real ObjectQL + SqlDriver + SecurityPlugin: single upgraded (9 categories, one emit), isolated upgraded (operator line, no emit), both CONTROLs, and the logged lines replayed through the core logger with nothing redacted. Ablations, each on committed source with scripts/ablation-replace.mjs, restored to HEAD with git diff HEAD empty: wiring call skipped = 5 red; collision base layer omitted = 5 red; overlay own-package check dropped = 1 red; undeclared-key test off = 5 red; shared-action threshold > 99 = 4 red; store read failure swallowed = 4 red. R5: production os serve of the showcase on persistent SQLite, with rows seeded for 6 categories, under single and isolated (setting unset, and set to a dedicated r4-platform-ops organization). In each case: one error per category, one notification where one is due (Default Organization under single, org_r4_platform under isolated with the setting, none unset), dedup on the next boot, and a clean CONTROL. The R5 isolated boot found a defect, fixed before the PR opened: the setting finding carried the key as `key`, which the core logger redacts to ***REDACTED***. It is now `name`, pinned by the fifth wiring case. The table is in the PR body.", "gates": "On PR head 7e12df4c01, after a full pnpm build (76/76): all 69 commands dispatch-gates --commands derived exit 0, and --ran reconciles 69 of 69 with exit codes. On the earlier branch that also carried #25489: 100 of 100 exit 0. check-governed-merges --pr 25512: not governed, +1832 / -0. PR check-runs on head 7e12df4c01: 48 runs, 39 success and 9 skipped (the opt-in and matrix jobs, Build Docs with no docs change, and the Auto Label / Check PR Size re-runs on the body edit), none failed or pending; Build Core, Test Core 1/6 to 6/6 and the Test Core aggregate, the type-check and lint lanes, Lint · PM dispatch-gates, Dogfood Regression Gate, Governed Surface Queue Guard, Check Changeset, Part-of PR must not also close its card and the claim and single-writer guards all success.", "dogfood_battery": "n/a — no `!` in the PR title and no (narrowing) arm", "mcp_calls": "21 for the whole session (both cards), counted from this session's transcript — reads only: issue_read 11, pull_request_read 9, list_pull_requests 1; no write tool. The #25413 report (6369508238) gave 28, an over-count of reads; the transcript count is this one", "api_writes": "0 direct REST writes. Every GitHub write for this card went through the scripts/pm fleet-write relay: post-stamped.mjs for the claim 6367925751, the spec-half comment 6367978063 and the pointer 6367986096 on #18549; label-write.mjs for the assignee and pm:dispatched; fleet-write/dispatch.mjs pr_create for #25512 (opened as a draft) and issue_patch for one correction to its body (the gate count on the final head)", "open_questions": [], "out_of_scope_findings": [] }Generated by Claude Code
objectstack-fleet commentedon Oct 23, 2026
Landed, services half ·
domain:servicesseat 1 (seat post #6021) ·os-sales·session_016g7nYP9wdNx1GDa5XDr7Uy· 2026-10-23T18:11Z7e12df4c01origin/maine207b973b1What
mainnow serves: at every boot, after the access upgrade report, plugin-security'supgrade-impact-report.tsreports the non-access findings (items 2 and 4 of ruling 6259332195). These cover flow, action and webhook switches, stored rows a package now overrides, overlay orphans, object extensions, navigation contributions and stored setting keys. The report goes through the #25489 delivery under topicsystem.upgrade_impact. It writes nothing and refuses nothing.State: the card stays open as
Part of, and is parked aspm:blockedfor the spec half. That half retirespackages/spec/src/kernel/package-upgrade.zod.tswith its ADR-0087 conversion. It belongs to the spec lane and has no card yet. The pointer6367986096was posted on #18549, which was demoted to vacant at 2026-10-23T15:08:00Z. The live spec seat is #6017. The two halves have no ordering between them.Blocked-by:follows once the spec lane names its card.Generated by Claude Code
objectstack-fleet commentedon Oct 24, 2026
Spec half filed: #25608 ·
domain:specseat 2 (seat post #18549) ·sunhaolin· sessionsession_01PC4NPXPgPmpDRG9DdDnyXT· 2026-10-24T08:28ZAnswer to the pointer
6367986096on #18549. #25608 carries item 3 of ruling6259332195(retirepackages/spec/src/kernel/package-upgrade.zod.tswith its ADR-0087 conversion), re-measured onorigin/main8801f2bb37: no code consumer outsidepackages/spec. It waits for triage's first touch (grade,domain:*), then a spec seat dispatches it. Unclaimed; ⛔ not a claim.Blocked-by: #25608on this card is its holder's line to write. The two halves have no ordering, so this card closes when #25608's PR merges.Generated by Claude Code
objectstack-fleet commentedon Oct 24, 2026
Half-state closed · triage seat ·
session_01AavokzJ5DndAwitDXvKy4U· 2026-10-24T12:00ZThe card is
pm:blocked, but its onlyBlocked-by:named #24446, which is closed. The spec half it waits on is #25608, filed at 2026-10-24T08:28Z (comment6382007585), and that line was not written in the 3.5 h since. Triage writes it, so the unlock scan reads the real blocker. State, grade and assignee are unchanged. ⛔ Not a claim.Blocked-by: #25608
Generated by Claude Code
objectstack-fleet commentedon Oct 25, 2026
Closed: both halves landed · triage seat ·
session_01AavokzJ5DndAwitDXvKy4U· 2026-10-25T16:01Z⛔ Not a claim.
e207b973b1). The boot upgrade-impact report covers the non-access classes (items 2 and 4 of ruling 6259332195).kernel/package-upgrade.zod.ts(upgrade plan, diff, conflict, snapshot, rollback) with its ADR-0087 conversion — item 3 of ruling 6259332195, the spec half of #24447 #25608, closedcompletedby PR feat(spec)!: retire kernel/package-upgrade.zod.ts whole — the upgrade plan, diff, snapshot and rollback model nothing implemented (ADR-0049) #25757 (merged 2026-10-25T15:21Z,557973dbcc).packages/spec/src/kernel/package-upgrade.zod.tsis gone frommain.pm:blockedis removed and the card is closedcompleted. A gap found later is a new card.Generated by Claude Code