chore(spec): spec liveness gate — classify-or-fail for authorable properties#1919
Merged
Conversation
…perties
For a metadata-driven platform the spec IS the product surface; a parsed-but-
unenforced property is a silent no-op, and for security props a silent no-op is
false compliance (e.g. forceMfa accepted and ignored). The metadata-liveness
audits found large dead swaths. This makes the classification explicit and
regression-proof.
- packages/spec/scripts/liveness/check-liveness.mjs — reads the generated
json-schema/<category>/*.json, resolves each authorable property's liveness
(ledger entry > spec .describe() marker > UNCLASSIFIED), and exits non-zero on
any unclassified property in a GOVERNED category (the ratchet: no new
undeclared surface). --dump inventories a category; --json for machines.
- packages/spec/liveness/security.json — security ledger seeded from
docs/audits/2026-06-security-identity-property-liveness.md (file:line evidence)
plus greps for schemas the audit didn't cover. 93 props: 66 dead, 26 live,
1 experimental. The dead set (Policy tree, allow{Transfer,Restore,Purge},
isProfile, contextVariables, SharingRule, Territory, RLSConfig) is the
enforce-or-remove worklist.
- .github/workflows/spec-liveness-check.yml — runs the gate on PRs touching
packages/spec/** (gen:schema then check).
- check:liveness npm script + packages/spec/liveness/README.md (how to roll out
the next category, highest-risk-first).
Governed today: security only. Other categories are added one at a time as their
ledgers are seeded from the existing audits.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Contributor
📓 Docs Drift CheckThis PR changes 1 package(s): 89 hand-written doc(s) reference the affected code and may need an implementation-accuracy re-verification:
|
github-actions
Bot
added
documentation
This was referenced Jun 15, 2026
Merged
os-zhuang
added a commit
that referenced
this pull request
Jun 18, 2026
…2024) * docs(adr): ADR-0054 prove-it-runs gate for the authorable surface Extends ADR-0049 (enforce-or-remove) with a third leg. The liveness ledger (#1919) classifies every authorable property live/experimental/dead, but "live" means only a static file:line consumer pointer — proof that something reads the property, not that authoring it produces correct runtime behavior. #2018 (tz bucketing: live at every layer, broken in integration) and the field-type fidelity gaps (#2022: rating/slider/toggle read back wrong-typed) fell through that gap — call it "unproven liveness". For a platform whose authors are AI emitting metadata across a combinatorial space the examples never cover, unproven liveness ships silently into third-party apps. ADR-0054 upgrades a `live` classification to optionally carry a `proof` — a @objectstack/dogfood test that authors the property against the real in-process stack and asserts the runtime outcome. Required as a ratchet (not a retrofit) for a high-risk authorable class on change, and for any property implicated in a shipped regression (the fix carries its proof). Generative testing is explicitly deferred (Phase 3, evidence-gated). Proposed — for architect review. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * docs(adr): accept ADR-0054 (prove-it-runs gate) Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
os-zhuang
added a commit
that referenced
this pull request
Jun 23, 2026
fix(grid): rows-per-page selector honors pagination.pageSizeOptions; drop duplicate ListView <select> (#1919) objectui@92c32428ff6ff1e488e0c233777db654233afede
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
First step of the long-term "close the spec↔runtime gap" direction. For a metadata-driven platform the spec is the product surface — a parsed-but-unenforced property is a silent no-op, and for a security property a silent no-op is false compliance (e.g.
forceMfa: trueaccepted and ignored). The metadata-liveness audits found large DEAD swaths; this makes the classification explicit and regression-proof.What it does
Every authorable property in a governed category must declare a runtime-liveness status with evidence in
packages/spec/liveness/<category>.json, or CI fails — the ratchet: no new undeclared surface.livefile:line)experimental/planned[EXPERIMENTAL — not enforced]spec markers)deadinternalResolution: ledger entry → spec
.describe()marker → UNCLASSIFIED.Seeded:
security(the P0 category)93 authorable properties — 66 dead, 26 live, 1 experimental. ~71% of the authorable security surface is parsed-but-unenforced. Seeded from
docs/audits/2026-06-security-identity-property-liveness.md(file:line evidence) + greps for what the audit didn't cover. Thedeadset is the concrete worklist for the security enforce-or-remove ADR — most urgently the ungated destructiveObjectPermission.allow{Transfer,Restore,Purge}and the entirely-deadPolicytree (password/session/forceMfa/network/audit).Pieces
packages/spec/scripts/liveness/check-liveness.mjs— the gate (--dump,--json).packages/spec/liveness/security.json— the seeded ledger..github/workflows/spec-liveness-check.yml— runs on PRs touchingpackages/spec/**.pnpm --filter @objectstack/spec check:liveness+packages/spec/liveness/README.md.Verified
security(0 unclassified, exit 0).ObjectPermissionflag → unclassified → exit 1.json-schema/is generated (gitignored); CI regenerates viagen:schemabefore checking.Rollout
Governed today: security only. Other categories (
data,automation,ui, …) are added one at a time, highest-risk-first, each seeded from its existing audit — see the README. Same "drift → CI gate" pattern as the docs-accuracy system (#1906).🤖 Generated with Claude Code