fix(objectql): artifact lock envelope survives overlay hydration and reset (ADR-0010 §3.3)#1775
Merged
Merged
Conversation
…reset (ADR-0010 §3.3) On a control-plane kernel, GET /meta/:type hydrates sys_metadata overlay rows into the SchemaRegistry under the PLAIN key — shadowing the packaged artifact registered under `<packageId>:<name>`. Every envelope reader (lookupArtifactItem / getEffectiveLock / isArtifactBacked) resolved the shadow instead of the artifact, so a `_lock: full` app read back as unlocked after PUT+GET, and DELETE (reset) only removed the DB row — the polluted shadow survived until restart. Fix, three layers: - SchemaRegistry.getArtifactItem(): shadow-immune artifact lookup (composite keys first, requires a real `_packageId`, excludes the 'sys_metadata' rehydration sentinel). All protocol envelope readers and getMetaItemLayered's code layer now use it. - Hydration (getMetaItems / loadMetaFromDb) grafts the artifact's `_lock`/`_packageId`/`_provenance` onto the overlay body before registering, so registry-direct readers keep the envelope: overlay content wins, artifact protection wins. - SchemaRegistry.removeRuntimeShadow() + restoreArtifactRegistryView(): reset drops the plain-key shadow so the artifact view is restored without a restart; a no-op DELETE self-heals pre-existing pollution. Draft discards keep the shadow (the active overlay may still exist). Regression suite: protocol-registry-shadow.test.ts pins the PUT→GET→DELETE envelope round-trip, reset healing, and shadow-immune 403 item_locked enforcement on scoped kernels. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
github-actions
Bot
added
documentation
baozhoutao
added a commit
that referenced
this pull request
Jun 17, 2026
* chore: bump objectui to e6fd254e8797 feat(metadata-admin): book metadata display UI (ADR-0046 §6) (#1775) objectui@e6fd254e879708ca6395777a5d5517c60a555e19 * chore(console): changeset for objectui refresh to e6fd254
os-zhuang
added a commit
that referenced
this pull request
Jun 17, 2026
feat(metadata-admin): book metadata display UI (ADR-0046 §6) (#1775) objectui@e6fd254e879708ca6395777a5d5517c60a555e19
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
在无
environmentId的本地栈（control-plane kernel）复现的元数据状态污染：_lock: full的 artifact-backed app 执行PUT /api/v1/meta/app/setup（锁门禁在 control-plane 被设计性跳过，写入成功）；GET /api/v1/meta/app会把 overlay body 以无 packageId 的registerItem水合进 SchemaRegistry 的 plain key，shadow 掉 composite key（<packageId>:<name>）下的 artifact；lookupArtifactItem/getEffectiveLock/isArtifactBacked都经registry.getItem（plain key 优先命中）拿到被剥光 envelope 的 overlay body → GET 返回_lock: undefined，违反 ADR-0010 §3.3（overlay 不得放松 packaged lock）；DELETE（reset）只删 DB 行，恢复块查metadataService.get落空 → 污染的 shadow 残留到服务重启。Fix（三层）
SchemaRegistry.getArtifactItem()— 穿透 shadow 的 artifact 专用查找：优先扫 composite key、要求真实_packageId（排除'sys_metadata'哨兵）。protocol 的全部 envelope 读取点（lookupArtifactItem/getEffectiveLock/isArtifactBacked/getMetaItemLayeredcode 层）改用，锁解析从此对 shadow 免疫。getMetaItems/loadMetaFromDb注册 shadow 前先mergeArtifactProtection把 artifact 的_lock/_packageId/_provenance嫁接到 overlay body：内容字段 overlay win，保护信封 artifact win。SchemaRegistry.removeRuntimeShadow()+restoreArtifactRegistryView()— reset 删除 plain-key shadow，artifact 视图立即恢复（无需重启）；no-op 二次 DELETE 可自愈历史污染；draft 丢弃不清 shadow（active overlay 可能仍在）。Verification
protocol-registry-shadow.test.ts（8 用例）：PUT→GET→DELETE 全链路 envelope 保持、reset 自愈、scoped kernel 在 registry 已被污染时403 item_locked仍生效、两个新 registry 方法的单元行为。tsc --noEmit干净。_lock: full/_packageId/_provenance全程保持；单条 GET 信封editable/deletable: false正确。🤖 Generated with Claude Code