connector-openapi normalizer: a trim mode that keeps only the operations --include-pattern matches, so a large vendor document packages as the operations an app calls, with the sha256 of those bytes #28309

Activity

1. objectstack-fleet

   added

   enhancementNew feature or requestNew feature or request

   priority:p2Medium: important, M3Medium: important, M3

   pm:epic

   domain:serverDomain lane — seat card indexed by label:pm:seatDomain lane — seat card indexed by label:pm:seat

   on Oct 31, 2026
2. objectstack-fleet

   added a parent issue on Oct 31, 2026

   • connector apps, E4 batch 1 (static key): GitHub over its remote MCP server and Stripe read over its OpenAPI document, as open-edition metadata packages validated by this repository's CI #28276
3. objectstack-fleet

   added

   pm:dispatched

   on Oct 31, 2026
4. objectstack-fleet

   assigned

   sunhaolin

   on Oct 31, 2026
5. objectstack-fleet commented on Oct 31, 2026

   

   objectstack-fleetBot

   on Oct 31, 2026

   ContributorAuthor

   More actions

   epic:#27293#1 · sunhaolin · session_017xRBcVBKAFk1ntXSjvPt7U

   Claim: PM loop round 3 (in-flight derivative of #28276, held by its claim 6538171907; dispatched without triage per the derivative rule)
   Session: session_017xRBcVBKAFk1ntXSjvPt7U
   Account: sunhaolin (the seat's linked user as GET /user answers it; the card's assignee)
   Branch: claude/issue-28309-normalizer-trim
   Worktree: objectstack-issue-28309
   Domain: domain:server
   Seat: epic:#27293#1
   File surface: packages/connectors/connector-openapi/scripts/normalize-openapi.mts and its test and fixtures; content/docs/automation/connectors.mdx (the script's paragraph); content/docs/deployment/marketplace-handbook.mdx (the one stale "forthcoming" sentence) (stop on breach; explain in the report)
   Container & model: S, mode:subagent, model: opus (TIER_DEFAULT — no path-derived mandate), effort: medium
   Clause-②: no
   Metadata-protocol: none
   Responsibility: n/a — not a defect card
   Thread-read: none
   Premise: holds (read at origin/main 57f8ca2f 2026-10-31T04:17Z: --include-pattern computes include and writes the whole document; the #28276 dev's measurement is on that card)
   Serial constraints cleared: open draft PR #28308 (a runtime card, another seat) edits content/docs/deployment/marketplace-handbook.mdx in its enable/disable step and a new "Disabling a module" section — not the README-section sentence this card changes (:117); ordinary concurrency, the later lander merges origin/main. PR #28306 (#28276) adds packages/apps/connector-github/** only. No other of the 60 most recent open PRs touches this surface.
6. objectstack-fleet commented on Oct 31, 2026

   

   objectstack-fleetBot

   on Oct 31, 2026

   ContributorAuthor

   More actions

   epic:#27293#1 · sunhaolin · session_017xRBcVBKAFk1ntXSjvPt7U
   os-dev-report

   {
     "issue": 28309,
     "status": "done",
     "branch": "claude/issue-28309-normalizer-trim",
     "pr": "https://github.com/objectstack-ai/objectstack/pull/28331",
     "session": "session_017xRBcVBKAFk1ntXSjvPt7U",
     "premise_still_valid": true,
     "summary": "packages/connectors/connector-openapi/scripts/normalize-openapi.mts gains --trim (NormalizeOptions.trim). It needs at least one --include-pattern and is refused with exit 1 without one. It keeps only the path operations a pattern matches, drops path items left empty and webhooks, and does this before dereferencing, so only kept operations are walked and nothing reachable only from a dropped one is written. include is computed exactly as before (the same patterns, the imported operationActionKey); the printed sha256 is of the written, trimmed bytes; the summary adds trimmedFrom; securitySchemes stay as in the untrimmed path. I chose a separate flag over an implied trim (the PM's mechanism question). An implied trim would change the bytes and hash of the one documented command with no change to the command line. Untrimmed plus include stays the right output for an app that wants to widen include by config later. Today's only documented caller (the connectors.mdx example) now passes --trim. Premise held at 57f8ca2f: include was computed and the whole document written. Measured on stripe/openapi spec3.json at 51610f5f (source sha256 7cff4cc4…, 8,317,513 bytes) with a 6-operation pattern ^(GetCustomers|PostCustomers|GetCustomersCustomer|GetCharges|PostPaymentIntents|GetPaymentIntentsIntent)$ at max-depth 2. Untrimmed control: 63,317,655 bytes, 612 operations, sha256 0ea3c37a0854ad2646a156404b1ef86cca57403855e3803cd4630601eb6fc7b2, byte-identical to the #28276 dev's reading. --trim: 1,934,435 bytes, 6 operations (trimmedFrom 612), sha256 08d6e40bccec707a0bfc355b1cbf936df29018c22e7be658d616683e501b13d4, equal to sha256sum of the file, refsLeft 0. It loads through createOpenApiProviderFactory with exactly the 6 actions and 0 $ref in the text and in the def. It is about 1.9 MB rather than the card's ~1.1 MB because the dev's six are unnamed and this six differs. Docs: the connectors.mdx script paragraph, and the stale marketplace-handbook.mdx README-section sentence, which now reads as landed and links to the provider: 'openapi' section.",
     "tests": "head 08bf2826 (after merging origin/main): bash scripts/pm/os-verify-lock.sh -c 'pnpm --filter @objectstack/connector-openapi test && pnpm --filter @objectstack/connector-openapi typecheck' -> 'Test Files 6 passed (6)', 'Tests 82 passed (82)', 'check:test-typecheck: OK', 'VERDICT command-exit 0'. pnpm --filter @objectstack/connector-openapi exec vitest run --maxWorkers=2 scripts/normalize-openapi.test.ts -> 'Tests 20 passed (20)' (13 existing + 7 new: trimmed output = exactly the matched operations with the untrimmed include list, loads through createOpenApiProviderFactory with no $ref; nothing reachable only from dropped operations, zero cuts; Swagger 2.0 trimmed after conversion; $ref path item resolved before selection, webhooks dropped; refusals for --trim with no pattern and no match; no-trim control unchanged; CLI --trim bytes/sha256 equal the written file, trimmedFrom 4, --trim alone exits 1 writing nothing). Ablation at e6e78338 with the fix committed: node scripts/ablation-replace.mjs; anchor 'if (matches(patterns, { key: operationActionKey(...' hits 1 -> 0, blob a2190cd6ea17 -> 70610c5bb588, replaced by a condition keeping every operation -> 'Tests 5 failed | 15 passed (20)' (the 4 trim-selection cases and the CLI --trim case red; refusals and control green). Restored: blob == HEAD a2190cd6ea17 and git diff HEAD empty. No dist leg: the test imports the script from source. Stripe real-document measurement: see summary (one-off, not committed).",
     "gates": "dispatch-gates --commands --repo objectstack-ai/objectstack (no paths; change set from merge base): 78 commands from 4 changed paths, 312 changed lines. Run 1 at e6e78338: 76 exit 0; pnpm --filter @objectstack/spec run check:skill-examples and pnpm check:dual-build-cjs-loads each exit 3 PREREQUISITE NOT MET (client-react / sibling dists unbuilt). After building the '@objectstack/client-react...' closure under the lock (VERDICT command-exit 0), both re-ran exit 0 ('277 prose examples type-check'; '113 published require entry point(s) across 70 package(s) load'). Run 2 on the final head 08bf2826, same 78-command list (diff identical): all 78 exit 0. Exit codes were captured before any pipe (cmd > log 2>&1; ec=$?). --ran with a 'CMD :: exit N' record -> 'dispatch-gates --ran: 78 derived famil(ies) accounted for — 78 run, 0 NOT-MEASURED (a DERIVED zero — all 78 recorded an exit code and none of them is 3)'. CI on PR #28331 head 08bf2826 at report time: 9 check-runs completed (Check Changeset=success, the others skipped: opt-in harnesses, Auto Label, Check PR Size, Schedule gate), 19 in_progress, not awaited. Not run locally, by rule: test:repo, pnpm lint and the other repo-wide scans (CI).",
     "dogfood_battery": "n/a — no ! in the PR title and no (narrowing) arm (Clause-②: no)",
     "mcp_calls": "0 — no GitHub MCP calls, no MCP writes",
     "api_writes": "2 relay strokes, each POST /repos/objectstack-ai/objectstack/dispatches: (1) pr_create, executed by the relay as POST /repos/objectstack-ai/objectstack/pulls (draft) + POST /repos/objectstack-ai/objectstack/issues/28331/labels [skip-changeset]; read-back identical, 8148 bytes sent and stored, assignees none; labels [skip-changeset] confirmed by a GET read. (2) this os-dev-report comment via post-stamped.mjs, POST /repos/objectstack-ai/objectstack/issues/28309/comments. git pushes (not REST): 4 — the empty branch probe, two commits, the origin/main merge.",
     "files_changed": "4 files, +283/-29 vs origin/main, all inside the claimed surface: packages/connectors/connector-openapi/scripts/normalize-openapi.mts, packages/connectors/connector-openapi/scripts/normalize-openapi.test.ts, content/docs/automation/connectors.mdx (the script's paragraph), content/docs/deployment/marketplace-handbook.mdx (the one README-section sentence only; PR #28308's sections untouched). No fixture changed; src/** untouched.",
     "line_budget": "312 changed lines (dispatch-gates count), under the 3000 human-merge threshold. No skills/** file touched.",
     "deviations": [
       "Commit trailers are AGENTS.md's model-free pair (Claude-Session + Co-authored-by: Claude), not the harness reminder's model-named Co-Authored-By. AGENTS.md wins, and the pre-push hook refuses a model identifier in that pair.",
       "PR body footer: only AGENTS.md's session-URL form; the harness reminder's extra robot-emoji line plus bare session URL was left out so the body does not carry two footers.",
       "check:skill-examples and check:dual-build-cjs-loads read exit 3 on the first gate run; I built the missing closure and re-ran, and the final-head run is all exit 0. The --ran record cites the final run."
     ],
     "open_questions": [],
     "out_of_scope_findings": [
       "carrier: none · skills/objectstack-automation/references/integration-recipes.md recipe 1 says 'Trim the vendor's OpenAPI 3.x document to the operations the app calls' but does not name --trim. The recipe is now deliverable as written; naming the flag there would be a skills/** edit (Tier H, line ratchet), outside this card's surface. Noted in this report only, not filed.",
       "carrier: #28276 · the Stripe app package (Blocked-by: #28309) can now commit the --trim output and its printed sha256; the measured six-operation reading above is a starting point, not the app's chosen operation set."
     ]
   }
7. objectstack-fleet

   closed this as completedin #28331on Oct 31, 2026
8. objectstack-fleet commented on Oct 31, 2026

   

   objectstack-fleetBot

   on Oct 31, 2026

   ContributorAuthor

   More actions

   epic:#27293#1 · sunhaolin · session_017xRBcVBKAFk1ntXSjvPt7U

   MERGED → PR #28331 through the merge queue (merge commit 64c56685f) · 2026-10-31T05:54Z. Closed completed by its Fixes #28309; pm:dispatched removed in this act, pm:epic kept. This unblocks #28276 (its Blocked-by: #28309), which the epic PM re-claims for the Stripe app.
9. objectstack-fleet

   removed

   pm:dispatched

   on Oct 31, 2026