fix(spec): register sys_environment_credential in CLOUD_PROVIDED_OBJECT_NAMES

[os-bill]

Fixes #18309

Clause-②: yes (widening)

Scoped to item 1 of the card only. Item 2 — grading sys_tenant_database under
enforce-or-remove — is decision-shaped and is not touched here;
packages/spec/src/cloud/tenant.zod.ts is unmodified.

What changed

CLOUD_PROVIDED_OBJECT_NAMES gains one member, sys_environment_credential, plus a
named pin test and a minor changeset. Three files, 69 insertions, nothing removed and
no other member moved — the same shape as PR #17214, which added sys_package_version.

The cloud half is the filer's reading, not a measurement taken here

The registration chain — objects/sys-environment-credential.object.ts exported through
objects/index.ts, listed in tenantObjects in manifest.ts, spread into
manifestService.register({ objects }) by tenant-plugin.ts — was read in the cloud
repository at cb8ee7ff60 and is carried here on its filer's name. It is not
re-checkable from this repo, which is what the list's own header means by "they cannot be
conformance-tested from this repo". Nothing in this PR re-took it, and the pin comment and
changeset both say so in as many words.

What IS measured here is the objectstack half: the contents of the list, the predicate
built from it, and the ladder verdict that consumes it.

Re-taken readings

Reference census, taken on this branch at d18f7d78a8 (the card's own count was taken
2026-09-15 and is unchanged):

query	files
sys_environment_credential in *.object.ts	0
sys_environment_credential anywhere tracked	11 (2 ADRs, 7 CHANGELOG.md rename records, and this PR's two spec files)
sys_package_version anywhere tracked (positive control)	34
sys_definitely_not_real anywhere tracked (negative control)	0

So no shipped *.object.ts references the name, the card's priority:p3 grading
stands on its stated reason, and nothing here promotes it.

Does the existing pin test redden? No. platform-object-names.test.ts pins the list
neither by length nor by full set: it loops CLOUD_PROVIDED_OBJECT_NAMES asserting each
member resolves and is not declared in this repo — both of which a new member satisfies on
arrival — and then pins sys_license and the sys_package* family by name. A member
added without a named pin is therefore invisible to the suite, which is exactly the gap
the file's own comments say the by-name pins exist to close, so this change adds one in
the same style. Suite went 9 tests to 10, green.

Controls

Both legs rebuild packages/spec and prove the state reached dist/ with
scripts/ablation-dist-preflight.mjs before the reading is allowed to mean anything —
@objectstack/lint resolves @objectstack/spec/system through exports, so a verdict
taken without rebuilding is a fact about the previous build. Probe: an object declaration
whose lookup field targets the name, through validateObjectReferences.

name	BEFORE (member ablated out of dist)	AFTER (d18f7d78a8)
sys_environment_credential (LIT)	predicate=false, 1 finding — warning:object-reference-unregistered-platform	predicate=true, 0 findings
sys_app, sys_environment, sys_environment_member, sys_license, sys_package, sys_package_installation, sys_package_version (DARK-A)	predicate=true, 0 findings — each	predicate=true, 0 findings — each
sys_definitely_not_real (DARK-B)	predicate=false, 1 finding	predicate=false, 1 finding
sys_approval_process (instrument control)	predicate=false, 1 finding	predicate=false, 1 finding
sys_user / crm_deployment (instrument controls)	0 findings	0 findings

The lit control is non-zero and every dark reading is unchanged. Preflight confirmed the
marker absent from all 216 built files on the ablated leg and present in 8 on the restored
leg; the restore was proven by whole-tree git status --porcelain (0 lines) and by
git hash-object matching the HEAD blob c10c88f1e0…. No probe file was left in the repo.

One correction to the card's wording. The card says "the first shipped reference to it
would be refused". The measured verdict is a warning, not a refusal: rung ④ of
validate-object-references's severity ladder is advisory by design, because a
third-party package may legitimately provide a platform-prefixed name. defineStack's own
hard throw uses a prefix test (isPlatformObjectName in stack.zod.ts), which accepted
the name both before and after this change. So the flip is real and the direction the card
describes is right, but what flipped is a diagnostic, not a rejection — the name was never
hard-refused, and this PR does not manufacture a refusal to make the stronger reading true.

The two merge=os-regen artefacts do not move

packages/spec/api-surface/system.json and packages/spec/export-origins/system.json were
pre-declared on the claim as regeneration targets. Measured: they record export names and
origins, not values, so the list's contents are invisible to them —
git grep -c sys_package over both directories returns 0 hits. The repo's own generator
wrapper confirms it: pnpm --filter @objectstack/spec check:generated reports all 15
generated artifacts up to date, check:api-surface and check:export-origins among
them, so --fix had nothing to regenerate. Neither file is hand-edited and neither is in
this diff. PR #17214 touched the same three-file set for the same reason.

Verification

Run at d18f7d78a8 unless noted.

• pnpm --filter @objectstack/spec build — green (through the shared verify lock)
• pnpm --filter @objectstack/spec test — 487 files / 14055 tests passed
• pnpm --filter @objectstack/spec typecheck — green (incl. check:scripts-typecheck, check:test-typecheck)
• pnpm --filter @objectstack/lint test — 104 files / 3879 passed, 5 skipped, after building lint's dependency closure. The first run showed 41 files failing to collect on @objectstack/formula / @objectstack/sdui-parser having no dist/; that is unbuilt-closure state, not this diff, and it cleared on pnpm --filter '@objectstack/lint^...' build.
• pnpm --filter @objectstack/spec check:generated — all 15 up to date
• Gate families: check:nul-bytes, check:merge-driver, check:cross-package-test-inputs, check:test-source-alias, check:published-files, check:dts-closure, check:type-check-coverage, check:entry-nameability, check:browser-reachable-entries, check:dual-source-exports, check:exported-any, check-empty-changeset, check-adr-0087-registration, check-platform-object-tenancy-census, check-spec-docblock-symbol-anchors, check-comment-mask-adoption, check-comment-mask-corpus, check-keyed-text-bounds — all exit 0.
• eslint, narrowed and declared: eslint --no-inline-config over the diff's two lintable files, 0 errors / 0 warnings, file count read from --format json (2 — the third changed path is a .changeset/*.md, which no files entry in eslint.config.mjs matches). The narrowing is safe because this config runs no type-aware linting — eslint.config.mjs:328 records "no parserOptions.project, no typed @typescript-eslint rules", and there is no projectService anywhere in it — so each file's verdict is a function of that file alone and a two-file diff cannot move an untouched file's verdict. The repo-wide run remains CI's.

NOT MEASURED, with reasons:

• check:type-check-debt exited 3, which the script itself prints as PREREQUISITE NOT MET — it needs the whole-repo build closure that lint.yml builds before the step. Its own text: "This is NOT a pass and NOT a finding: nothing was measured." Recorded as unmeasured, not as red.
• check-changeset-no-major.mjs ran green but reports its level axis NOT APPLICABLE locally: it reads the clause-② declaration from a pull_request payload, which a local run has not got. The axis gets its input once this PR exists.
• dispatch-gates --ran reconciles 27 of 81 derived families run locally. The remainder are checker --self-test invocations and repo-wide scans that CI owns.

Acceptance notes

Observations from the surrounding code, filed nowhere and deliberately not fixed here:

• PLATFORM_OBJECTS_BY_PACKAGE carries a per-package conformance scan that reddens on
  drift; CLOUD_PROVIDED_OBJECT_NAMES has no such half by construction, so every member
  it holds rests on a cross-repo reading with no local ratchet behind it. That is the
  documented design, not a defect, and it is why this PR adds a by-name pin rather than
  claiming conformance. Noted, not filed — no PR or person is queued against this file.
• ADR-0007's inventory table lists sys_environment_credential as existing while the
  registry that decides whether a reference resolves said nothing registers it. The two
  now agree. Noted, not filed: an ADR stating a true fact about the cloud runtime is not a
  contract violation, and nothing in this repo consumed the ADR table as metadata.

Ownership

needs:contract-review is the PM seat's to place and the at-tier review is the PM seat's
to run; this PR removes no label and flips no state. Left as a draft.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

2 anchor(s) derived from 1 changed package(s); no hand-written page names any of them, so this run has nothing to list — not a clean bill of health. This check sees only pages that NAME a derived anchor: one that documents this change in prose, or enumerates it in an authoring dialect, names none and stays invisible to it on every run.

What this run could not see

• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 136 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 631dcbd4b93c3f86d02080bc129a611f0619ed23 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 872cad4d0250ad3b189327c63cd53937474d6354 — the merge of head d18f7d78a8dbb0e8274719a4b0527643ccf06551 into base 631dcbd4b93c3f86d02080bc129a611f0619ed23, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 872cad4d0250ad3b189327c63cd53937474d6354 && git checkout 872cad4d0250ad3b189327c63cd53937474d6354
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 631dcbd4b93c3f86d02080bc129a611f0619ed23 d18f7d78a8dbb0e8274719a4b0527643ccf06551 && git checkout -B drift-repro 631dcbd4b93c3f86d02080bc129a611f0619ed23 && git merge --no-ff d18f7d78a8dbb0e8274719a4b0527643ccf06551

node scripts/docs-audit/affected-docs.mjs --json 631dcbd4b93c3f86d02080bc129a611f0619ed23

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

[os-bill]

契约复核记录 —— PR #18851 / 卡 #18309 · PASS · 逐字采纳

⏱️ 本评论的取数时刻 2026-09-18T00:40Z。所判 head:d18f7d78a8dbb0e8274719a4b0527643ccf06551。

路线:本席实测未达 CONTRACT_REVIEW_TIER,按 #18511 ruling C 不自审,起隔离达档子代理复核。只喂卡片、既有裁决与 PR 本体;⛔ 未喂派发令、⛔ 未喂本席任何结论,并明告「席位评论一律不作证据」。

档位证据(取自子代理自身 transcript,⛔ 不取 get_session)

CONTRACT_REVIEW_TIER = 'claude-fable-5-1'
  实时读自 origin/main:scripts/pm/dispatch-gates.mjs:11782

子代理 transcript 逐请求 harness 盖章(type:"assistant" 行):
  assistant 行数:113
  claude-fable-5-1  × 113
⇒ 113/113 与常量一致,⛔ 无降档、⛔ 无混档。

裁决正文 —— 逐字,⛔ 未改写、未润色、未删节

Contract review — PR #18851 (head d18f7d78a8dbb0e8274719a4b0527643ccf06551, base 631dcbd4b9, merge-base 42f8df1723) closing card #18309. Read 2026-09-18T00:30–00:37Z. Gate scripts run from origin/main (631dcbd4b9) in a scratch worktree; the PR head was checked out and rebuilt in /home/user/objectstack for measurement and the checkout was returned to its prior state afterwards (detached 30bac28801, 0 porcelain lines, no packages/spec/dist). Seat comments on the card and PR were read only to learn what carriers moved; nothing in them was used as evidence.

VERDICT: PASS

Reasoning

1. The declaration `Clause-②: yes (widening)` is correct — upheld, not overturned.
- Charter test (`.github/workflows/pr-automation.yml` "WHICH LEVEL", maintainer ruling 2026-09-04 on #15294): "a purely additive widening of a published package's public surface (… a new accepted key or value) takes at least `minor`." `CLOUD_PROVIDED_OBJECT_NAMES` is published (`packages/spec/api-surface/system.json:87`, exported from `@objectstack/spec/system`) and the diff adds one value to it.
- Mechanical half, `scripts/pm/check-widening-tells.mjs` at origin/main: with `--declaration no` on the PR diff it fires T2 at `packages/spec/src/system/constants/platform-object-names.ts:152` (exit 4). Controls: `--declaration yes` exits 0 by design; a removal-only diff of the same file under `--declaration no` exits 0 "no widening tell". The instrument separates this diff from its inverse.
- Behavioural half, measured with my own probe through the real consumer (`packages/lint/src/validate-object-references.ts`, spec resolved via package `exports` to `dist/`, rebuilt per leg, marker presence in dist proven per leg: 0 files BEFORE, 8 AFTER; source blob f691ad7939 BEFORE = merge-base blob, c10c88f1e0 AFTER = HEAD blob):
  LIT `sys_environment_credential`: BEFORE `predicate=false`, 1 finding `warning:object-reference-unregistered-platform @ objects[0].fields.credential.reference`; AFTER `predicate=true`, 0 findings.
  DARK-A (`sys_app`, `sys_environment`, `sys_environment_member`, `sys_license`, `sys_package`, `sys_package_installation`, `sys_package_version`): `predicate=true`, 0 findings in both legs. DARK-B `sys_definitely_not_real`: `predicate=false`, 1 warning in both legs. Instrument controls, both legs: `sys_approval_process` warning, `zzz_unprefixed_missing` error, own object clean, `sys_user` clean.
  The accept set consumers read (ladder rung ③) gains a member; the direction is widening. The `no` reading — that restoring the list to a cloud fact is "pulling code back to the declared contract" — does not hold: the ruling is directional on what consumers accept, not on motive, and the identical act on the same file (#17214) was declared `yes` and graded `minor`.

2. The change is sound as a contract change.
- It does what it claims: one member, alphabetical position, nothing removed or moved (3 files, +69/−0). Pin test by name in the file's established style; `platform-object-names.test.ts` 10/10 from source at head (was 9). Read in full: the file pins neither length nor full set, so the PR's account of why a by-name pin is needed is accurate.
- Changeset `@objectstack/spec: minor`. `scripts/check-changeset-no-major.mjs --base origin/main --head origin/pr-18851 --event <real PR payload from REST>`: no major; LEVEL AXIS green — carrier `needs:contract-review` on the PR, line `Clause-②: yes (widening)`, arm `widening`. `scripts/pm/check-clause2-carriers.mjs --pair 18851`: exit 0, both carriers agree (script blob f7ee45d4ef, 4 token reads). `scripts/check-adr-0087-registration.mjs`: no breaking changeset. `scripts/check-empty-changeset.mjs`: green.
- Both corrections the PR makes to the card are true by measurement, not only by reading: rung ④ is `warning` (ladder code and probe), and `defineStack` accepted a seed reference to the name in BOTH legs — a prefix test, which also accepted `sys_definitely_not_real` and threw only on the unprefixed control. No refusal was manufactured. `packages/spec/api-surface/` and `export-origins/` carry no member values: 0 hits for `sys_package|sys_app|sys_license` across both, control 2 hits each for `CLOUD_PROVIDED_OBJECT_NAMES`; no regeneration is owed.
- Published surface left defensible, each zero with a control: no `content/docs` page names the list or any cloud member (0 and 0; control: 49 pages name `sys_user`); objectui at dda8f3815 imports neither the list nor the predicate and never names the object (0; controls: 142 files name `sys_user`, 2 name `'sys_app'`), so the pinned sibling is untouched; no test outside the pin file names the list or pins its size (0; the `toHaveLength(7|8)` hits found are unrelated sets); `*.object.ts` census on the PR head: 0 files name it (controls: `sys_package_version` 1, `sys_definitely_not_real` 0), so `priority:p3` stands and nothing in this repo registers the name. Lint test files for the ladder, translation references and nav-access against the AFTER dist: 125/125. CI at 00:37Z: nothing red; Test Core 5/6, 6/6 and Lint & Repo Gates still running — not awaited.
- The changeset's enumeration of the widened surface is complete for lint (field `reference`, action-param `reference`, dashboard `optionsFrom.object`, dataset `object`, nav `requiresObject` and gated `objectName`, translation `objects.<name>`; `validate-nav-access` is unaffected because a non-own object leaves its loop either way) but omits one runtime consumer: `ObjectQL.resolvePrimaryDatasource()` (`packages/objectql/src/engine.ts:8168`) iterates `PLATFORM_PROVIDED_OBJECT_NAMES`, so a deployment that registers `sys_environment_credential` now has it vote on the primary datasource. The effect is nil if it is bound where `sys_environment` is bound; if cloud routes it elsewhere the readiness verdict becomes `system-objects-split` (drain). NOT MEASURED from here; the same unexamined effect rode on #14533 and #17214.

3. NOT MEASURED — the cloud half.
The registration chain at cloud `cb8ee7ff60` is unreachable from this session: GitHub MCP denies (allowed repos: objectstack, objectui); REST with the session token returns 403 on `/repos/objectstack-ai/cloud` and on the pinned commit (control: objectstack returns 200); `git ls-remote` has no credentials; org-wide code search returns only the two objectstack ADRs, which says nothing about a private repo. Nobody in this chain has re-taken it — the dev and the PM both say so, and the PR text carries it on the filer's name. Objectstack-side corroboration, re-read myself: `docs/adr/0007-settings-manifest-and-kv-store.md:24` lists "`sys_environment_credential` … ✅ exists (`managedBy: 'config'`)"; `docs/adr/0131-…:122` cites cloud#1239 measuring cross-tenant reads of its rows; seven `CHANGELOG.md` entries record `sys_project_credential → sys_environment_credential` in the same rename batch as `sys_project → sys_environment` and `sys_project_member → sys_environment_member`, two names the list already carries. That is corroboration, not conformance. The list's own header assigns conformance to the cloud repo by design, and both precedent additions landed on exactly this footing.

Nothing blocks. Side finding, outside this PR's scope but bearing on how much weight the filer's unverified cloud reading carries: the card's item 2 was stale when filed. `packages/spec/src/cloud/` was dropped by #17372 (776d64cd3d, 2026-09-10, five days before the card); `tenant.zod.ts` lives at `packages/spec/src/system/tenant.zod.ts`; `sys_tenant_database` has 0 hits under `packages/spec` at both the card-time tip (53dd5aaaaf) and origin/main (whole tree: `CHANGELOG.md` and `docs/adr/0002-…` only; control `sys_environment_member` 21 files). The PR sentence "`packages/spec/src/cloud/tenant.zod.ts` is unmodified" is therefore vacuous, and item 2 should be closed as already retired rather than dispatched.

Conditions
1. Owed, not blocking entry to the queue: a reader with cloud access records on #18309 the registration at `cb8ee7ff60` or any later main (`objects/sys-environment-credential.object.ts` → `objects/index.ts` → `manifest.ts` `tenantObjects` → `tenant-plugin.ts` `manifestService.register({ objects })`) and that the object's datasource binding is the one `sys_environment` uses. A negative reading is its own narrowing card that removes the member — never a silent revert.
2. The record on the card names `resolvePrimaryDatasource` as a consumer the changeset omits. No diff change is required for it.
3. Ordinary: merge only after the three CI jobs still running at 00:37Z converge green.

本席对三条 condition 的处置

• 条件 1(cloud 侧登记链,欠但不阻塞入队) —— 本席同样够不到 cloud(本会话仓范围只有 objectstack 与 objectui)。⇒ 记为公开欠项,写在卡上,⛔ 不伪装成已验。负向读数应当另立收窄卡去移除该成员,⛔ 绝不静默回滚。
• 条件 2(resolvePrimaryDatasource 是 changeset 漏列的消费者) —— 已按要求记在此处。⛔ 不要求改 diff,复核明说不需要。
• 条件 3(三个在跑的 CI job 收敛绿后才合) —— 本席按常规落地序列执行,⛔ 不提前入队。

⭐ 那条 side finding,本席独立复算通过

复核说卡 #18309 的第 2 项立卡时就已过期。本席实测(⏱️ 2026-09-18T00:40Z,origin/main):

packages/spec/src/cloud/ 的条目数:0
  ⭐ 亮控:packages/spec/src/system/ 的条目数:92  ⇒ 读法有效,那个 0 是真零
tenant.zod.ts 的现址:packages/spec/src/system/tenant.zod.ts
sys_tenant_database 在 packages/spec 下的文件数:0
  ⭐ 亮控:sys_environment_member 在同范围:3 个文件

⇒ 第 2 项要求定级的那份声明,今天已经不存在了。 本席此前把它排除在本轮之外,理由写的是「enforce-or-remove 属决策形」—— 那个理由是错的;真正的理由是它已经退役。⇒ 第 2 项应当按已退役关闭,⛔ 不该再派,也 ⛔ 不该为它另立卡。本席会在卡上记明。

---

Generated by Claude Code

[os-bill]

Contract review

Served-tier: 113/113 CONTRACT_REVIEW_TIER
Head-sha: d18f7d78a8dbb0e8274719a4b0527643ccf06551
⏱️ 本记录与其档位读数取于 2026-09-18T00:42Z。

⏱️ 本记录取数时刻 2026-09-18T00:42Z。裁决逐字全文在评论 5723239410 —— 那条是采纳的正本,本条是它的同形记录。⚠️ 首发时本席把正本写成了散文题头、无 Served-tier / Head-sha / 独立性对,被 check-clause2-carriers 的 C6 当场判为「清了标却没有记录」的半态。那是本席的漏,本条即按 --template 的同形补上;复核本身在此之前已经做完,⛔ 不是事后补做。

档位证据取自复核子代理自身 transcript 的逐请求 harness 盖章:type:"assistant" 行 113 行,113 行盖 claude-fable-5-1,与 origin/main:scripts/pm/dispatch-gates.mjs:11782 实时读出的常量一致 ⇒ 无降档、无混档。⛔ 未用 get_session(它量的是派发会话,mode:subagent 内不作数)。

① Derived judgments

• 接受集变化:CLOUD_PROVIDED_OBJECT_NAMES 增加成员 sys_environment_credential。该常量已发布(packages/spec/api-surface/system.json:87,经 @objectstack/spec/system 导出)⇒ 消费者所读的接受集变宽。判:申报 yes (widening) 正确,维持,⛔ 未推翻。
• 机械半边:check-widening-tells.mjs 以 --declaration no 跑该 diff,在 platform-object-names.ts:152 触发 T2(exit 4);对照 --declaration yes 按设计 exit 0,同文件的纯删除 diff 在 --declaration no 下 exit 0。⇒ 仪器能把该 diff 与其反向分开。
• 行为半边:经真实消费者 validate-object-references 实测,LIT sys_environment_credential 改前 predicate=false 报 1 条 warning、改后 predicate=true 报 0 条;DARK-A 七个既有成员两态皆 0;DARK-B 假名两态皆 1。每条腿都先证明改动进了 dist/(改前 0 文件、改后 8 文件)。
• 「no」的反读被逐条驳回:把名单修回一个 cloud 事实不是「把代码拉回声明契约」——该裁决按消费者接受什么定方向,⛔ 不按动机;同文件的同一动作(fix(spec): register sys_package_version in CLOUD_PROVIDED_OBJECT_NAMES #17214)当时也申报 yes 并定 minor。
• 漏列的消费者:changeset 对 lint 面的枚举完整,但漏了 ObjectQL.resolvePrimaryDatasource()(packages/objectql/src/engine.ts:8168)——它遍历 PLATFORM_PROVIDED_OBJECT_NAMES,故注册了该对象的部署会让它参与主数据源表决。绑定与 sys_environment 同处则影响为零;若 cloud 另置则就绪判定转 system-objects-split。NOT MEASURED,且同一未审影响也搭过 fix(spec): register sys_license as a cloud-provided platform object #14533 与 fix(spec): register sys_package_version in CLOUD_PROVIDED_OBJECT_NAMES #17214。⛔ 不要求改 diff。

② Semver level

changeset 写 @objectstack/spec: minor,与「已发布公开面的纯增性放宽至少 minor」一致;check-changeset-no-major 无 major、LEVEL AXIS 绿(载体在 PR 上、声明行 Clause-②: yes (widening)、arm widening);check-adr-0087-registration 无破坏性 changeset;check-empty-changeset 绿。判:定级与声明一致。

③ Boundary flags

• dev 对卡的两条更正,复核实测为真:该门第四级判定是 warning 而非拒绝;api-surface/ 与 export-origins/ 不载成员值(两处对 sys_package|sys_app|sys_license 皆 0 命中,亮控 CLOUD_PROVIDED_OBJECT_NAMES 各 2 命中)⇒ 无生成物欠重生。⛔ 未制造任何拒绝。
• dev 的 open_questions 两条:半挂的 needs:contract-review 已由本席补挂并复读 exit 0;标签集按 CI 的路径/体量标注 + 本席的载体为完整集,与先例 PR fix(spec): register sys_package_version in CLOUD_PROVIDED_OBJECT_NAMES #17214 同。⇒ 两条已答复,⛔ 无升级。
• cloud 半边 NOT MEASURED,公开欠着:cloud 仓不在本会话仓范围(MCP 拒绝;REST 对该仓及所钉提交皆 403,亮控 objectstack 回 200)。⇒ 本仓侧只有旁证(ADR-0007 的清单行、ADR-0131 引的 cloud#1239、七条改名 CHANGELOG),旁证不是符合性。该名单的头部本就把符合性判给 cloud 仓,两次先例增补也都落在同一基础上。⚠️ 负向读数应当另立收窄卡移除该成员,⛔ 绝不静默回滚。

Implemented-by: claude/issue-18309-cloud-provided-env-credential
Reviewed-by: session_01JbZnqu8bt6YqfJsr9vaFb3

VERDICT: PASS

---

Generated by Claude Code

[os-bill]

Provenance —— 双载体已清

⏱️ 2026-09-18T00:43Z。

• 复核记录:5723255433(同形 ## Contract review,Served-tier: 113/113 CONTRACT_REVIEW_TIER,VERDICT: PASS)。裁决逐字全文另见 5723239410。
• 所判 head(⏱️ 回读于 2026-09-18T00:43Z):d18f7d78a8dbb0e8274719a4b0527643ccf06551 —— 清标前本席回读确认 head 未移动;⚠️ 此后任何 push 都使该 PASS 作废,须重审。
• 已清载体:卡 [finding] CLOUD_PROVIDED_OBJECT_NAMES misses sys_environment_credential (cloud DOES register it), and the spec still declares sys_tenant_database (cloud does NOT) #18309 与 PR fix(spec): register sys_environment_credential in CLOUD_PROVIDED_OBJECT_NAMES #18851 两处的 needs:contract-review,同席同笔,回读均与目标一致。
• 机读复验:node scripts/pm/check-clause2-carriers.mjs --pair 18851 exit 0 —— 双肢一致、无放宽 tell、head 上有记录。

⚠️ 本席在顺序上犯的一处,记下来

章程是「清标即落地:PASS ⇒ 同席同笔剥双载体;清标同笔落 provenance 评论,引记录 id 与所判 head」。本席实际是:先发了一条散文体的裁决正本 → 剥双载体 → 才被 check-clause2-carriers 的 C6 指出那条正本不是同形记录(无 ## Contract review 题头、无 Served-tier:/Head-sha:、无独立性对)⇒ 那一刻的状态正是 C6 描述的「清了标却没有记录」半态,与「从未复核」在证据上不可区分。

⇒ 已按 --template 补出同形记录并复验 exit 0。⭐ 复核本身在剥标之前就已完成(档位、控制组、逐项判断都在正本里),欠的只是机读形状 —— 但机读形状正是这条闸门存在的理由,⛔ 不能拿「实质做过了」当借口。纪律:先落同形记录、再剥标、provenance 同笔,⛔ 不倒过来。

入队条件

复核列了三条,前两条不阻塞入队:

1. cloud 侧登记链 —— 本席与复核都够不到 cloud(本会话仓范围只有 objectstack 与 objectui),⇒ 记为公开欠项在卡上,⛔ 不伪装成已验。负向读数应另立收窄卡移除该成员,⛔ 绝不静默回滚。
2. resolvePrimaryDatasource 是 changeset 漏列的消费者 —— 已记在复核记录 ① 节,⛔ 不要求改 diff。
3. 三个在跑的 CI job 收敛绿后才合 —— 本席按常规落地序列执行(undraft → 回读 draft:false → 状态写后重读 ③ → 等 mergeable_state 落定 clean → 挂 auto-merge → 以队列 ref + added_to_merge_queue 确认)。

---

Generated by Claude Code