[objectstack-fleet]

Requested by Yibo Wang · project thread
Fixes #29668

维护者速读

• 改了什么：build-schemas-check-mode.deleted-baseline.test.ts 的 [finding] the authorable-key deletion gate's reachability BFS reports integration/DataSyncConfig unreachable from the metadata-type roots — it is two hops from the connector root, so #4650 proof 2 waives a tombstone for a key a stack manifest really authors #17356 用例在原有的根自身 def(integration/DeclarativeConnectorEntry)旁，新增一个挂在未注册根 connector 之下的 def:integration/ConnectorInstanceBearerAuth(connector.auth → 实例鉴权联合 → bearer 分支)，并加夹具诚实守卫。仅测试,+97/−1。
• 为什么改:feat(spec)!: an authored connector URL holds no credential part; its retryConfig and actions refuse an undeclared key #29573 把该用例的样本移到根自身 def 后，实测它已不能判别 [finding] the authorable-key deletion gate's reachability BFS reports integration/DataSyncConfig unreachable from the metadata-type roots — it is two hops from the connector root, so #4650 proof 2 waives a tombstone for a key a stack manifest really authors #17356 缺陷：根集合收窄回已注册类型时，它经共享的 _lock 等记账键实例被读成 derived-clone,删除照样被拒；新样本此时读 null,会被 proof 2 豁免，正是该缺陷的形态。
• 风险与回滚：不改任何生成器或 schema,不动任何接受集合；回滚即 revert 本 PR。
• 先看：测试文件中 DELETED_BENEATH_UNREGISTERED_KIND_DEF 的文档注释，再看 beforeAll 里 A connector save of retryConfig: {} keeps a withheld key; decide whether an empty container clears it #29668 守卫和 [finding] the authorable-key deletion gate's reachability BFS reports integration/DataSyncConfig unreachable from the metadata-type roots — it is two hops from the connector root, so #4650 proof 2 waives a tombstone for a key a stack manifest really authors #17356 用例中新增的四条断言。
• 两分钟验证:pnpm --filter @objectstack/spec exec vitest run --project repo scripts/build-schemas-check-mode.deleted-baseline.test.ts -t 17356,预期通过；把 computeSurfaceReachability() 的 BFS 改为不下探未注册根，预期本用例在新断言处变红，下方两次消融均已实测。
• 需要你做的：无，席位落地。

Clause-②: no
Metadata-protocol: none

What changes

• Depth specimen. The [finding] the authorable-key deletion gate's reachability BFS reports integration/DataSyncConfig unreachable from the metadata-type roots — it is two hops from the connector root, so #4650 proof 2 waives a tombstone for a key a stack manifest really authors #17356 case seeds a third deleted base line, integration/ConnectorInstanceBearerAuth:zzBeneathAnUnregisteredRoot29668, and asserts that check (c) refuses it: in the eager regime it reads def reachable from the metadata-type roots; … was LIVE, in the lazy regime def … was LIVE (never tombstoned), and in neither does it read def not reachable from the … (the proof-2 waiver). The existing specimen and its assertions are unchanged. It runs in the same spawned run as the existing specimen, so no new spawn and no test-budget change.
• Fixture guard. beforeAll holds the def beneath connector and beneath no other root. It reads the def the way the gate does, on both routes: its own instance in a BFS closure (zodChildSchemas), and a shape entry (same name, same instance) held by a visited object node (zodShapeOf). It also checks the def is still emitted with authorable keys. Imports added for the guard only: getMetadataTypeSchema, ConnectorInstanceBearerAuthSchema, zodChildSchemas and zodShapeOf.
• Docblock. The constant's docblock says why the root's own def no longer discriminates, gives the measurement, and lists the nine sibling arms that qualify the same way.

Why

#29573 moved the #17356 specimen from integration/RetryConfig to the connector root's own def. The card asks for a specimen beneath that root again. Measuring which one qualifies on main turned up more than the card said: the root's own def no longer catches the defect at all.

Every metadata document carries the shared bookkeeping keys (_lock, _lockReason, …) as the same schema instances. So with the roots narrowed back to listMetadataTypeSchemaTypes() (the #17356 defect), integration/DeclarativeConnectorEntry resolves as derived-clone through any registered root's _lock, and check (c) still refuses its deletion. Only the wording changes. The existing pin goes red on that wording, but the waiver it was written against no longer happens to it.

Measurement (on main at 0e4b0fa)

A one-off probe, deleted before commit, ran the gate's own walk (zodChildSchemas closure plus the shape-entry bridge) over every Integration/Shared/… namespace export, in both schema regimes. Defs that read root-graph from connector and not from the other 32 roots:

def	without connector	on the surface
integration/ConnectorInstance{NoAuth,BearerAuth,APIKeyAuth,BasicAuth,OAuth2AuthorizationCodeAuth,OAuth2ClientCredentialsAuth,AppCredentialAuth,SignedAlipayV3Auth,SignedAliyunAcs3Auth,SignedTencentCloudTc3Auth}	null	yes (10)
integration/ConnectorInstance{Auth,OAuth2Auth,SignedAuth} (unions)	null	no keys
integration/DeclarativeConnectorEntry (the root's own def)	derived-clone	yes

With the registered set alone (30 roots, the pre-#17356 roots): DeclarativeConnectorEntry gives derived-clone, ConnectorInstanceBearerAuth gives null, in both regimes. bearer was picked as the plainest arm.

Ablations (the new assertion, red; then restored)

Each ablation edited packages/spec/scripts/build-schemas.ts, ran vitest run --project repo … -t 17356 under os-verify-lock, and was restored with git checkout. The committed tree has no generator change.

1. Stop the walk at the unregistered roots. The root stays visited, but the BFS does not push its children. Exit 1, red at the new eager assertion (:617). The gate printed:

   • integration/ConnectorInstanceBearerAuth:zzBeneathAnUnregisteredRoot29668 — def not reachable from the 33 metadata-type roots (waived)
   • integration/DeclarativeConnectorEntry:zzOnlyRootIsAnUnregisteredKind17356 — def reachable from the metadata-type roots; … was LIVE (never tombstoned). (the existing assertions held)

   Only the new specimen measures the descent.

2. Narrow the roots back to the registered set (the [finding] the authorable-key deletion gate's reachability BFS reports integration/DataSyncConfig unreachable from the metadata-type roots — it is two hops from the connector root, so #4650 proof 2 waives a tombstone for a key a stack manifest really authors #17356 defect: drop the listUnregisteredKindSchemaTypes() line from reachabilityRootTypes()). Exit 1, red at the existing wording assertion (:606). The gate printed:

   • ConnectorInstanceBearerAuth:… — def not reachable from the 30 metadata-type roots (waived)
   • DeclarativeConnectorEntry:… — def authorable through a derived clone of a root-reachable schema; … was LIVE (still refused)

   This confirms the docblock's claim with the real gate.

Item 1 (ruled, already on main)

Item 1 was ruled by the maintainer on PR #29573 (comment 6593804783, 「显式 {} 就清掉,带前提」), and #29573 built it and is merged. The HTTP-door pin is on main: packages/qa/dogfood/test/connector-meta-door-url-and-nested-keys.dogfood.test.ts, test "retryConfig: {} replaces the stored one whole: the next read of the stored row no longer has the undeclared key", in the CARRY-FORWARD describe. It is a PUT /meta/connector/:name of the served form with retryConfig: {} over a seeded row holding retryConfig.secret. It asserts a withheld-key-dropped advisory at connectors[0].retryConfig.secret, the stored row's retryConfig equal to {}, and a control that a withheld position outside retryConfig is still carried forward. The served-object variant is in connector-meta-door-undeclared-keys-withheld.dogfood.test.ts. This PR adds no dogfood pin.

Verification

All under scripts/pm/os-verify-lock.sh on head d1cdcbe1, shared box:

• pnpm --filter @objectstack/spec build: exit 0 (93 s).
• pnpm --filter @objectstack/spec test: exit 0, 23961 passed, 1 todo.
• pnpm --filter @objectstack/spec test:repo: exit 0, 89 files, 1522 tests (the deleted-baseline file runs here: 15/15, 186 s alone).
• pnpm --filter @objectstack/spec check:test-typecheck and check:scripts-typecheck: exit 0.
• node scripts/pm/dispatch-gates.mjs --commands: 58 families, each run and recorded. --ran exits 0 with 56 run, 2 NOT MEASURED, 0 unrun. NOT MEASURED: check:dual-build-cjs-loads and check:lean-entry-closure, both exit 3 because they need every package's dist and only spec was built. CI's Build Core runs them, and a test file under packages/spec/scripts/ moves no dist. check-plugin-teardown-shape --self-test first exited 3 on the shallow clone; after git fetch origin 621a4876 it exited 0.
• node scripts/check-commit-card-trailers.mjs --range origin/main..HEAD: exit 0.

Acceptance notes

• Changeset: none, label skip-changeset. AGENTS.md (Post-Task Checklist 3) reserves the label for "a diff that publishes nothing from any released package". packages/spec/package.json files does not include scripts/, so this test file publishes nothing.
• Clause-②: no and Metadata-protocol: none: no accept set and no authorable surface moves (the diff is one test file).

🤖 Generated with Claude Code

https://claude.ai/code/session_01WGufzeePBUouzbRj7MtDva

[github-actions]

📓 Docs Drift Check

Nothing in this diff resolved to a documentable surface (no symbol, route or SDK anchor derived from 0 changed package(s)), so this run has no opinion about the docs.

What this run could not see

• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 0 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 0afb1b2b060c66b07d6593af9ae690c0ac97e52e → packageMentionDocs.

[objectstack-fleet]

domain:spec#2 · os-support-ai · session_01WGufzhJG3tKnksHVa1krBz

席位核对 — ACCEPT · domain:spec#2 · head 9b62a75a14b9de332b27148c78dea0258854e335

• Shape: test only, one file: packages/spec/scripts/build-schemas-check-mode.deleted-baseline.test.ts gains the A connector save of retryConfig: {} keeps a withheld key; decide whether an empty container clears it #29668 depth specimen integration/ConnectorInstanceBearerAuth (connector.auth → the bearer arm), its fixture-honesty guard (reached from connector, and by neither instance nor shape entry from any other root), and the eager and lazy assertions that check (c) does not waive its deletion. +102 −4, skip-changeset.
• Read in the diff: the specimen discriminates where the existing one no longer does: with the roots narrowed back to the registered set, integration/DeclarativeConnectorEntry still reads derived-clone through the shared bookkeeping instances, so only the new key flips to the proof-2 waiver. The executor's two ablations show it red (os-dev-report 6597194329); the corrected case comment (9b62a75a) now says so.
• Item 1: already met on main by feat(spec)!: an authored connector URL holds no credential part; its retryConfig and actions refuse an undeclared key #29573 (the retryConfig: {} replaces-whole test in connector-meta-door-url-and-nested-keys.dogfood.test.ts); no pin added.
• Contract review: none owed: the one path is a test file, reviewFace decides no contract face; this ACCEPT at TIER_DEFAULT is the review.
• Declarations: Clause-②: no, Metadata-protocol: none, no changeset.
• Gates: every check-run on the head complete, 54 success, 10 skipped, 0 failure.
• Landing: not governed. Ready + auto-merge now.