fix(verify): skip read-only federated (external) objects in CRUD verification

`objectstack verify` probe-inserts into every object; a read-only external object
(ADR-0015) correctly rejects the insert via the write gate, which verify reported
as a create-failed runtime failure (breaking the Dogfood Regression Gate once the
showcase gained federated objects). deriveCrudCases now marks external objects
that aren't fully write-opted-in (datasource.external.allowWrites && object.external.writable)
as `blocked`/skipped. Adds derive.test.ts covering the skip + the write-opted-in
and managed pass-through cases.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: os-zhuang

.changeset/verify-skip-external-readonly.md

@@ -0,0 +1,13 @@
+---
+"@objectstack/verify": patch
+---
+
+fix(verify): skip read-only federated (external) objects in CRUD verification.
+
+`objectstack verify` probe-inserts a record into every object. A federated object
+on an external datasource is read-only unless BOTH the datasource and the object
+opt into writes (ADR-0015 write gate), so that insert is correctly rejected —
+which `verify` was reporting as a `create-failed` runtime failure. `deriveCrudCases`
+now marks such objects `blocked` (skipped), matching the write gate's double
+opt-in rule, so the dogfood gate stays honest while supporting external datasource
+example apps.

packages/verify/src/derive.test.ts

@@ -0,0 +1,45 @@
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+
+import { describe, it, expect } from 'vitest';
+import { deriveCrudCases } from './derive';
+
+describe('deriveCrudCases — federated (external) objects (ADR-0015)', () => {
+  it('blocks a read-only external object so verify never probe-inserts it', () => {
+    const config = {
+      datasources: [{ name: 'wh', schemaMode: 'external', external: { allowWrites: false } }],
+      objects: [
+        { name: 'wh_order', datasource: 'wh', external: { remoteName: 'orders' }, fields: { amount: { type: 'number' } } },
+      ],
+    };
+    const c = deriveCrudCases(config).find((x) => x.object === 'wh_order');
+    expect(c?.blocked).toMatch(/external read-only/);
+  });
+
+  it('blocks when the object opts in but the datasource does not', () => {
+    const config = {
+      datasources: [{ name: 'wh', schemaMode: 'external', external: { allowWrites: false } }],
+      objects: [
+        { name: 'wh_order', datasource: 'wh', external: { remoteName: 'orders', writable: true }, fields: { amount: { type: 'number' } } },
+      ],
+    };
+    const c = deriveCrudCases(config).find((x) => x.object === 'wh_order');
+    expect(c?.blocked).toMatch(/external read-only/);
+  });
+
+  it('does NOT block a fully write-opted-in external object (datasource + object)', () => {
+    const config = {
+      datasources: [{ name: 'wh', schemaMode: 'external', external: { allowWrites: true } }],
+      objects: [
+        { name: 'wh_order', datasource: 'wh', external: { remoteName: 'orders', writable: true }, fields: { amount: { type: 'number' } } },
+      ],
+    };
+    const c = deriveCrudCases(config).find((x) => x.object === 'wh_order');
+    expect(c?.blocked).toBeFalsy();
+  });
+
+  it('leaves managed objects unaffected', () => {
+    const config = { objects: [{ name: 'task', fields: { title: { type: 'text' } } }] };
+    const c = deriveCrudCases(config).find((x) => x.object === 'task');
+    expect(c?.blocked).toBeFalsy();
+  });
+});

packages/verify/src/derive.ts

@@ -129,6 +129,8 @@ export function deriveCrudCases(config: any): CrudCase[] {
   const objects: any[] = config?.objects ?? [];
   const byName = new Map<string, any>();
   for (const o of objects) if (o?.name) byName.set(o.name, o);
+  const dsByName = new Map<string, any>();
+  for (const ds of (config?.datasources ?? [])) if (ds?.name) dsByName.set(ds.name, ds);
 
   const drafts = new Map<string, Draft>();
 
@@ -140,6 +142,20 @@ export function deriveCrudCases(config: any): CrudCase[] {
       name: obj.name, body: {}, asserts: [], skippedFields: [], relationalRefs: [], requiredTargets: [],
     };
 
+    // Federated (external) objects are read-only unless BOTH the datasource and
+    // the object opt into writes (ADR-0015 write gate). The CRUD probe insert is
+    // correctly rejected by the gate for them, so mark the case blocked (skipped)
+    // rather than letting a guaranteed-rejected insert surface as a failure.
+    if (obj.external) {
+      const ds = obj.datasource ? dsByName.get(obj.datasource) : undefined;
+      const writable = ds?.external?.allowWrites === true && obj.external?.writable === true;
+      if (!writable) {
+        d.blocked = `external read-only object (federated datasource "${obj.datasource ?? 'default'}"; no inserts)`;
+        drafts.set(obj.name, d);
+        continue;
+      }
+    }
+
     for (const [name, f] of Object.entries(fields)) {
       const type = String((f as any)?.type ?? '').toLowerCase();
       const isRequired = !!(f as any)?.required;