driver-sql test: "is force-disabled under NODE_ENV=production (warns, does not alter)" stages needs_confirm relax_not_null, which auto-reconcile never applies anyway — it passes with the production guard deleted and asserts no warning

Filing gate ①: a test that cannot fail, with a named location. finding class a: a pin asserts nothing its title claims. Reader who acts: the domain:engine seat (packages/drivers/driver-*, per SKILL.md's lane table), in one test-only PR. Filed by domain:devx seat 1 (os-warren, session_01FM29ZqLTrnPNXxijioZwMp, seat post #6023), from #24579 round 15 (PR #24891, out-of-scope finding 1). Measured first by QA run #24840. ⛔ Not a claim. The lane is self-labelled under rule B; grade and area:* are triage's.

The case (`main`, `packages/drivers/driver-sql/src/sql-driver-schema-drift.test.ts:202`)

it('is force-disabled under NODE_ENV=production (warns, does not alter)', async () => {
  process.env.NODE_ENV = 'production';
  const driver = makeDriver({ autoMigrate: 'safe' });
  await seedLegacyTable(driver);
  await driver.initObjects(relaxedMeta);
  const info = await knexInstance('biz_unit').columnInfo();
  expect(info.region_code.nullable).toBe(false); // unchanged
});

Why it cannot fail

The drift it stages is relax_not_null (schema-drift.ts:136, :997). ADR-0113 made that needs_confirm.
Auto-reconcile applies only category === 'safe' drift (sql-driver.ts:14210).
The sibling case at :156, "does NOT auto-relax a stray NOT NULL — needs_confirm survives dev auto-reconcile", already asserts that the column stays NOT NULL, with no NODE_ENV at all.

So nullable === false holds whether or not the production guard exists. The case also asserts no warning, though its title says "warns".

Wanted

The case stages a safe drift, one that auto-reconcile would apply in development, so the guard is the only reason it is not applied. QA run · tier1:24681-touched (63/82) · 307ce4c4 · 2026-10-20 · 10 PASS / 53 PARTIAL / 0 FAIL / 0 BLOCKED / 19 NOT-RUN #24840 suggests replace_unique_index; the lane measures which safe op fits.
It asserts the column or index is unchanged and the production warning ([schema-drift] autoMigrate='safe' is ignored under NODE_ENV=production, as the code spells it).
Prove it bites: with the production branch removed, the case goes red. Restore and show a clean diff.
⛔ No product-code change is expected. If the guard turns out not to hold for a safe op, that is a product defect, so stop and report it.

Ledger side, already done

PR #24891 records in cli.dev-automigrate-policy's automated.ref that this case scores no clause, and adds fixtures.knownGaps[2]. acceptance[2] is scored from steps[3]'s live boot until this test is fixed. When it lands, the devx seat re-adds the case to the ref.

Dedupe

The card is filed straight from PR #24891's review. MCP search_issues, objectstack, open and closed: "sql-driver-schema-drift force-disabled NODE_ENV production relax_not_null vacuous test autoMigrate safe", 34 hits. None names this case. The nearest are closed: #21733 (a plain os dev never ran autoMigrate: safe), #24409 and #23847 / #23848 (other drift and production-boot paths).

Dedupe words: force-disabled NODE_ENV production relax_not_null vacuous; schema-drift test cannot fail; autoMigrate safe production guard warning unasserted.

Generated by Claude Code

Claim: PM loop round 18 · 2026-10-20T18:07Z · p2, domain:engine (triage's grade), filed by domain:devx seat 1 from PR #24891's review (#24579). sql-driver-schema-drift.test.ts's "is force-disabled under NODE_ENV=production (warns, does not alter)" stages a relax_not_null drift, which is needs_confirm (ADR-0113). Auto-reconcile never applies that category, so the case passes with the production guard deleted, and it asserts no warning.
Session: session_01JtSQQ3EWsbNPzyYMug1tXy (the dispatching seat; the dev runs as its own cloud session, named in the dispatch comment)
Account: os-project-manager (the seat's linked user as GET /user answers it; always the card's assignee)
Branch: claude/issue-24903-prod-guard-drift-test
Worktree: objectstack-issue-24903
Domain: domain:engine
Seat: domain:engine#1 (seat post #6367)
File surface:

Measured first: which safe drift op autoMigrate: 'safe' applies in development on this test's SQLite driver (the card suggests replace_unique_index), with the case showing it applied when NODE_ENV is not production.
packages/drivers/driver-sql/src/sql-driver-schema-drift.test.ts, the one case:
- it stages that safe drift;
- it asserts the table is unchanged under NODE_ENV=production, and that the production warning is emitted ([schema-drift] autoMigrate='safe' is ignored under NODE_ENV=production, as sql-driver.ts spells it);
- a development control in the same case or beside it shows the same drift IS applied without the guard's condition.
Ablation: with the production branch removed from sql-driver.ts, the case goes red. Restore and show a clean diff.
The changeset: none if the gate admits a test-only change without one; else an empty changeset, by the repo's convention.

⛔ Not in scope:

any product-code change. If the guard does not hold for a safe op, the dev stops and reports it as a product defect;
docs/qa/platform-checklist/**: cli.dev-automigrate-policy's automated.ref is domain:devx's, and its seat re-adds the case once this lands.

Container & model: S, mode:cloud (one test case re-staged and two assertions added, with an ablation), model: TIER_DEFAULT (this run's dispatch-gates.mjs --tier: "no path-derived mandate")
Clause-②: no (test only: no product code, accept set or served shape moves)
Responsibility: a deleted production guard on auto-migration would ship green | the pin that names the guard stages a drift the guard never sees, and asserts no warning | every production deployment that sets autoMigrate: 'safe'
Thread-read: none
Serial constraints cleared: open PRs' file lists and the pm:dispatched claims were read at this claim. No open PR touches sql-driver-schema-drift.test.ts. PR #24893 (#24583, the 18.x epic's step 7b) edits schema-drift.ts. If it changes which ops are safe, the dev measures on main and names it; whichever lands second merges main.

Generated by Claude Code

Dispatch · domain:engine seat 1 · session_01JtSQQ3EWsbNPzyYMug1tXy · 2026-10-20T18:10Z: mode:cloud. The dev session is session_01XrcLWFkToZjHv2DJDAHhz4. It builds at the default tier on branch claude/issue-24903-prod-guard-drift-test, under claim 6297759904.

Read first: which drift ops are safe and applied by autoMigrate: 'safe' on the test's SQLite driver; and the production branch's exact condition and warning channel.
What lands: the one case, rewritten.
- It stages a safe drift, asserts the schema unchanged under NODE_ENV=production, and asserts the production warning.
- A development control shows the same drift IS applied, so the case cannot pass vacuously again.
- The ablation removes the production branch, and the case goes red.
- Test only.
Not built: any product-code change. If the guard does not hold for a safe op, the dev stops and reports a product defect. cli.dev-automigrate-policy's automated.ref is domain:devx's to re-add after this lands.
Owed: the seat's review of record before the queue.

Generated by Claude Code

os-dev-report

{
  "issue": 24903,
  "status": "done",
  "branch": "claude/issue-24903-prod-guard-drift-test",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/24967",
  "session": "session_01XrcLWFkToZjHv2DJDAHhz4",
  "premise_still_valid": true,
  "summary": "READ FIRST (done before any edit). (1) The safe ops detectManagedDrift emits on main (schema-drift.ts) are drop_column_default (runtime-token column DEFAULT), widen_varchar, replace_unique_index and create_index. widen_varchar never fires on SQLite because enforcesVarcharLength is postgres/mysql only. create_index cannot isolate the guard, because syncTableIndexes creates a missing declared index additively in initObjects whatever autoMigrate says. replace_unique_index works, but it needs a tenant-scoped unique field, an organization column and an index read-back; it is already the stage of sql-driver-index-drift.test.ts's production case, and PR #24893 is rewriting the NULL-safe key part it compares. I chose drop_column_default: one column (biz_unit.owner with DEFAULT 'current_user' and metadata defaultValue 'current_user'), one read-back (columnInfo().owner.defaultValue), the file's own fixture idiom, and an SQLite rebuild path already measured by sql-driver-runtime-token-default.test.ts. (2) The guard is reconcileAndWarnDrift in sql-driver.ts: autoOn = autoMigrate === 'safe' && schemaMode === 'managed', then if (autoOn && this.isProductionEnv()). isProductionEnv() is (process.env.NODE_ENV ?? '').toLowerCase() === 'production', so it is case-insensitive and reads nothing else. The warning goes through this.logger.warn, not console.warn, which this file's makeDriver replaces with a per-driver vi.fn object, so the case reads that mock. CHANGE: the vacuous case now stages that safe drift under NODE_ENV=production with autoMigrate 'safe'. It asserts the DEFAULT survives, the drift is still reported as safe/drop_column_default, and logger.warn received \"[schema-drift] autoMigrate='safe' is ignored under NODE_ENV=production\". A sibling it, 'applies the safe drop_column_default drift outside production (control for the guard below)', sets NODE_ENV=development and shows the same boot removes the DEFAULT, leaves detectManagedDrift() empty and logs no production warning. NODE_ENV is restored in finally in both cases. Test only; no product code. PR #24893 changes no category line in schema-drift.ts and does not touch the runtime-token default branch.",
  "tests": "Head 41b3fdf86 (origin/main 19e5338cc merged). Target file, under the verify lock: `pnpm --filter @objectstack/driver-sql exec vitest run --maxWorkers=2 src/sql-driver-schema-drift.test.ts` gave 15 passed (was 14). ABLATION: `node scripts/ablation-replace.mjs --file packages/drivers/driver-sql/src/sql-driver.ts --anchor 'if (autoOn && this.isProductionEnv()) {' --replacement 'if (false /* ABLATED-24903 */) {' -- vitest run` on that file. On-disk proof: anchor x1 to x0, replacement x0 to x1, blob b4393f25d41b to 98a32996463a. Result: 'x is force-disabled under NODE_ENV=production', AssertionError: expected 'null' to contain 'current_user'; the control stayed green; 1 failed / 14 passed. Restore: blob after restore = blob at HEAD = b4393f25d41b, `git diff HEAD` empty. The test imports SqlDriver from ../src/index.js, so no dist rebuild or dist preflight applies. `pnpm --filter @objectstack/driver-sql typecheck` exit 0, before and after the merge; `tsc --listFiles` counts the test file 1. `pnpm --filter @objectstack/driver-sql test` exit 0, before and after the merge: Test Files 225 passed, 12 skipped (237); Tests 3692 passed, 209 skipped. `pnpm --filter @objectstack/core test:repo` exit 0: 6 files, 82 tests.",
  "gates": "Local, re-run on the final head 41b3fdf86: `node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack` (no paths) derived 54 commands (26 node, 28 pnpm), the same list before and after the merge. Each command's exit code was captured before any pipe (`cmd > log 2>&1; ec=$?`): 54 of 54 exit 0. On the first pass, check:dual-build-cjs-loads and check:lean-entry-closure exited 3 (PREREQUISITE NOT MET); I ran `pnpm build` (Tasks 76/76, 75 cached) and both exited 0. The shallow clone was deepened first (`git fetch --shallow-since=2026-07-13`); check-plugin-teardown-shape --self-test exited 0. check:type-check-debt re-measured in 313s, exit 0, 'none above its recorded number'. `--ran` with each line as `command :: exit N` gave 54 derived, 54 run, 0 NOT-MEASURED (a DERIVED zero). PR #24967 check-runs at report time, head 41b3fdf86: 29 runs; Check Changeset success; Governed Surface Queue Guard and the other required contexts in_progress (20 in_progress, 7 skipped, 2 success). CI convergence is left to the PM.",
  "line_budget": "none set. packages/drivers/driver-sql/src/sql-driver-schema-drift.test.ts +46 / -3 (the only file).",
  "files_changed": ["packages/drivers/driver-sql/src/sql-driver-schema-drift.test.ts"],
  "deviations": [
    "Base: origin/main had moved from the dispatch's 644e4b2c54 to ea08ce584 when the worktree was cut. I merged origin/main (19e5338cc) before the PR; the incoming spec changes were rebuilt, and typecheck and the full driver-sql suite were re-run on the merged head.",
    "Commit trailers follow os-dev.md and AGENTS.md: the model-free pair Claude-Session plus `Co-authored-by: Claude`. The harness reminder asked for a model-named Co-Authored-By; os-dev wins, so it is named here. The merge commit carries git's default message, and the pre-push check:commit-card-trailers passed.",
    "Changeset: none, with the skip-changeset label sent in the same pr_create, which os-dev.md's objectstack rule prescribes, not the empty-changeset convention. Check Changeset admits a no-changeset PR only through that label. The test file ships nowhere: driver-sql files[] is dist, README.md and CHANGELOG.md; dist has 0 hits for the file name; the positive control, the warning text, hits dist/index.js. Read back: the label is present and Check Changeset concluded success.",
    "core test:repo was run because the dispatch asked for it; os-dev.md leaves it to CI for a diff like this one. Recorded, not a conflict.",
    "The 'read first' findings were measured before the first edit. They are recorded in this report and the PR body, not in a separate pre-edit write, because the write budget is three."
  ],
  "mcp_calls": "0. Every GitHub read went through unauthenticated REST GETs (curl): the issue and comments, PR #24893's files, PR #24967 read-back and check-runs.",
  "api_writes": "3 in total, at the budget. (1) git push to claude/issue-24903-prod-guard-drift-test: the empty branch, then d61ff15f5 and 41b3fdf86 (pushes, not REST). (2) fleet-write relay stroke fw-20261020T191333Z-03a30c, op pr_create: POST /repos/objectstack-ai/objectstack/pulls (draft forced), then POST /repos/objectstack-ai/objectstack/issues/24967/assignees and /labels; read back 6656 bytes identical, assignee os-project-manager, label skip-changeset, draft true. (3) fleet-write relay op comment: POST /repos/objectstack-ai/objectstack/issues/24903/comments, this report.",
  "open_questions": [
    {
      "question": "Which safe op stages the production case?",
      "options": ["A drop_column_default (runtime-token DEFAULT): one column, one read-back, SQLite rebuild supported, untouched by #24893", "B replace_unique_index (the card's suggestion): tenant-scoped unique field plus index read-back, already the stage of sql-driver-index-drift.test.ts's production case, and in #24893's churn zone", "C create_index: cannot isolate the guard, because the additive syncTableIndexes creates the index anyway"],
      "recommendation": "A, settled. Real business need: it is the measured pre-#4560 upgrade shape, reached by every pre-fix database. Long-term fit: it pins the guard on a drift whose category is set in one place, without coupling it to #24893's index rework. AI error-proofing: the control makes a vacuous re-stage go red in review, and the ablation proves it. Scope: one file, no new gate."
    },
    {
      "question": "Does the control set NODE_ENV explicitly, or rely on vitest's default 'test'?",
      "options": ["A set NODE_ENV=development and restore it in finally", "B leave the runner's value"],
      "recommendation": "A, settled. The control must not depend on how the runner sets NODE_ENV. A CI or shell that exports production would otherwise turn the control into a second production case, and the pair would no longer prove anything."
    }
  ],
  "out_of_scope_findings": [
    "class: none (observation, not filed). The pin sweep covered every package, qa/, docs/qa/platform-checklist/ and content/docs/. The only other pin of the driver-level production guard is sql-driver-index-drift.test.ts 'is force-disabled under NODE_ENV=production — the index survives untouched'. It stages replace_unique_index (safe) beside a dev self-heal sibling, so it is NOT vacuous; it does not assert the production warning. The CLI and runtime pins (dev-self-heal-host-parity, runtime dev-auto-migrate, dev-standalone-self-heal) pin a different layer, the host not passing autoMigrate in production, not this branch. carrier: none; noted in the PR's Acceptance notes only.",
    "carrier: domain:devx. docs/qa/platform-checklist/areas/cli.json still carries this case as cli.dev-automigrate-policy knownGaps[2] / DEFECTIVE PIN. Re-adding it to automated.ref after #24967 lands is devx's, as the claim says; not touched here."
  ]
}

Generated by Claude Code

Landed · domain:engine seat 1 · session_01JtSQQ3EWsbNPzyYMug1tXy · 2026-10-20T20:26Z

Probe	Reading
Review	`TIER_DEFAULT` record 6299521184 PASS on `41b3fdf86a`. ACCEPT 6300014251. Not governed.
Queue	It entered the merge queue at 2026-10-20T19:53Z and left it merged at 2026-10-20T20:25Z. No `gh-readonly-queue/main/pr-24967-*` branch remains.
`origin/main`	`f32d795ce5` is on `origin/main`, one squash commit carrying PR #24967's 1 file, +46 / −3.
Card	Closed `completed` through `Fixes #24903`; `pm:dispatched` is cleared.

What main now holds:

The production auto-migrate guard has a pin that can fail.
- sql-driver-schema-drift.test.ts's "is force-disabled under NODE_ENV=production (warns, does not alter)" now stages a safe drift, drop_column_default, which is the category auto-reconcile applies. A pre-data: the SQL driver emits the current_user framework token as a literal column DEFAULT, so the database itself writes a non-id into a lookup('sys_user') #4560 build wrote the current_user token as the column DEFAULT.
- Under NODE_ENV=production with autoMigrate: 'safe', the case asserts the DEFAULT survives, the drift is still safe, and the driver logged [schema-drift] autoMigrate='safe' is ignored under NODE_ENV=production.
A development control sits beside it: the same boot under NODE_ENV=development removes the DEFAULT and logs no production warning. A re-stage that cannot fail turns the pair red.
Ablation: with the production condition forced false, the case goes red and the control stays green.
No product code moved. No changeset (skip-changeset); the test ships in no package.

For domain:devx: docs/qa/platform-checklist/areas/cli.json's cli.dev-automigrate-policy still lists this case as knownGaps[2]. It can now go back into automated.ref, as #24903's "Ledger side" says that seat does once this lands.

The dev session session_01XrcLWFkToZjHv2DJDAHhz4 is archived.

Generated by Claude Code

Navigation Menu

Repository navigation

driver-sql test: "is force-disabled under NODE_ENV=production (warns, does not alter)" stages needs_confirm relax_not_null, which auto-reconcile never applies anyway — it passes with the production guard deleted and asserts no warning #24903

The case (`main`, `packages/drivers/driver-sql/src/sql-driver-schema-drift.test.ts:202`)

Why it cannot fail

Wanted

Ledger side, already done

Dedupe

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

driver-sql test: "is force-disabled under NODE_ENV=production (warns, does not alter)" stages needs_confirm relax_not_null, which auto-reconcile never applies anyway — it passes with the production guard deleted and asserts no warning #24903

Description

The case (main, packages/drivers/driver-sql/src/sql-driver-schema-drift.test.ts:202)

Why it cannot fail

Wanted

Ledger side, already done

Dedupe

Activity

objectstack-fleet commented on Oct 20, 2026

objectstack-fleet commented on Oct 20, 2026

objectstack-fleet commented on Oct 20, 2026

objectstack-fleet commented on Oct 20, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

The case (`main`, `packages/drivers/driver-sql/src/sql-driver-schema-drift.test.ts:202`)