Static gates (build, unit tests, spec-liveness, CodeQL) verify each layer in
isolation, usually against mocks, and cannot catch a break that only appears
when the real engine + strategies + services + HTTP context run together. The
#2018 tz-bucketing regression is the canonical case: green on every static gate
(900+ unit tests included) because each of its three broken seams was
individually correct and individually mocked.

This adds `@objectstack/dogfood` (private), a harness that boots real example
apps in-process against in-memory SQLite — wired with the same service plugins
`objectstack dev` loads — and exercises them through the real HTTP surface via
Hono request-injection (no ports, no sockets, CI-stable). Tests act as a browser
client: sign in, hit /api/v1/..., assert on real responses.

- src/harness.ts — bootDogfoodStack(config) → { kernel, api, raw, signIn, apiAs, stop }
- test/analytics-timezone.dogfood.test.ts — golden regression for #1982/#2018:
  org timezone (set via the real settings route) must shift a boundary-crossing
  instant's date bucket (UTC 2024-03-01 → America/Los_Angeles 2024-02-29) with
  the correct count. Verified to FAIL when any #2018 seam is reverted.
- CI: new "Dogfood Regression Gate" job (also runs under turbo run test).

Boot-to-assert ~2s. Private package — no changeset.

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

…2024)

* docs(adr): ADR-0054 prove-it-runs gate for the authorable surface

Extends ADR-0049 (enforce-or-remove) with a third leg. The liveness ledger
(#1919) classifies every authorable property live/experimental/dead, but "live"
means only a static file:line consumer pointer — proof that something reads the
property, not that authoring it produces correct runtime behavior. #2018 (tz
bucketing: live at every layer, broken in integration) and the field-type
fidelity gaps (#2022: rating/slider/toggle read back wrong-typed) fell through
that gap — call it "unproven liveness".

For a platform whose authors are AI emitting metadata across a combinatorial
space the examples never cover, unproven liveness ships silently into
third-party apps. ADR-0054 upgrades a `live` classification to optionally carry a
`proof` — a @objectstack/dogfood test that authors the property against the real
in-process stack and asserts the runtime outcome. Required as a ratchet (not a
retrofit) for a high-risk authorable class on change, and for any property
implicated in a shipped regression (the fix carries its proof). Generative
testing is explicitly deferred (Phase 3, evidence-gated).

Proposed — for architect review.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* docs(adr): accept ADR-0054 (prove-it-runs gate)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

…0054)

Unlocks the analytics binding that was previously blocked because its authorable
surface wasn't governed.

- Govern the `dataset` metadata type: new liveness/dataset.json classifies all 19
  authorable props with file:line evidence from the analytics service consumer
  audit (26 live, 1 dead — measures.certified has no runtime consumer). `dataset`
  added to GOVERNED in check-liveness.mts.
- Bind the analytics class: dataset.dimensions.dateGranularity carries the
  tz-bucketing proof (#1982/#2018) — the property whose org-timezone day-bucket
  behavior the proof asserts. proof-registry.mts flips analytics to bound.
- Four high-risk classes now CI-enforced: field types, RLS, flow nodes, analytics.
- README governed-types + high-risk tables updated; changeset description updated.

Verified: liveness gate green (dataset 27 classified); 17 registry tests; the
analytics proof runs green; full dogfood suite 59/59.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XVdnfUAx85amkerym26vdx

…h-risk classes (ADR-0054 #1 + Phase 2) (#2045)

* feat(spec): add prove-it-runs proof field + ratchet to liveness gate (ADR-0054 #1)

ADR-0054 follow-up (1): the liveness ledger's `live` meant only a static
consumer pointer — necessary but not sufficient, since a property can be live at
every layer yet broken end-to-end. This adds the third leg: high-risk authorable
properties must carry a `proof` (a dogfood test reference) that asserts the
runtime outcome.

- proof-registry.mts: the authoritative high-risk-class list (field types,
  analytics, RLS, flow nodes, form widgets) + which classes the ratchet enforces
  this phase. Field types and RLS are bound (matrix exists AND surface governed);
  analytics/flow/form are listed-but-blocked with honest reasons (their surface
  isn't governed yet / no proof yet — Phase 2).
- check-liveness.mts: a bound `live` entry must carry a valid `proof` of its own
  class. Validation is STATIC (file exists + declares the `@proof: <id>` tag) so
  the gate stays seconds-cheap; running the proof remains the dogfood gate's job.
  Reverse check flags unregistered `@proof:` tags.
- Ledger: field.type → field-zoo proof; permission.rowLevelSecurity.using →
  #1994 RLS proof. Dogfood proofs self-declare their `@proof:` tag.
- Gate now also triggers on packages/dogfood/** so deleting/renaming a proof
  re-runs the check and the dangling reference is caught.
- 15 unit + wiring tests; README documents the contract and ratchet.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XVdnfUAx85amkerym26vdx

* chore: add changeset for the liveness prove-it-runs gate change

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XVdnfUAx85amkerym26vdx

* feat(verify,spec): bind flow-node high-risk class with a runtime proof (ADR-0054 Phase 2)

Phase 2 extends the prove-it-runs ratchet to the flow-node class.

- verify: bootStack gains an opt-in `automation` flag that registers
  @objectstack/service-automation, so authored flows are pulled from the registry
  and POST /automation/:name/trigger runs their nodes. Without it, flow execution
  was unreachable through the harness (the dispatcher's automation routes resolved
  no service). Mirrors the existing `multiTenant`/`security` opt-ins; default off.
- dogfood: a self-contained flow fixture (one object + one autolaunched flow whose
  update_record node stamps a record) + the flow-node proof. It authors the flow,
  triggers it over HTTP, and asserts both directions — the targeted record is
  stamped (node executed) AND a bystander is untouched (the input variable wired
  into the node filter, not a blanket update). Runs green end-to-end.
- spec: flow-node class is now `bound` in proof-registry.mts; flow.nodes.type
  carries the proof; the liveness gate enforces it. Three classes now bound:
  field types, RLS, flow nodes.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XVdnfUAx85amkerym26vdx

* feat(spec): govern dataset + bind the analytics high-risk class (ADR-0054)

Unlocks the analytics binding that was previously blocked because its authorable
surface wasn't governed.

- Govern the `dataset` metadata type: new liveness/dataset.json classifies all 19
  authorable props with file:line evidence from the analytics service consumer
  audit (26 live, 1 dead — measures.certified has no runtime consumer). `dataset`
  added to GOVERNED in check-liveness.mts.
- Bind the analytics class: dataset.dimensions.dateGranularity carries the
  tz-bucketing proof (#1982/#2018) — the property whose org-timezone day-bucket
  behavior the proof asserts. proof-registry.mts flips analytics to bound.
- Four high-risk classes now CI-enforced: field types, RLS, flow nodes, analytics.
- README governed-types + high-risk tables updated; changeset description updated.

Verified: liveness gate green (dataset 27 classified); 17 registry tests; the
analytics proof runs green; full dogfood suite 59/59.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XVdnfUAx85amkerym26vdx

---------

Co-authored-by: Claude <noreply@anthropic.com>

feat(console): "Edit with AI" — open the build agent pre-scoped to an app's package (#2018)

objectui@2021b5f4a89c1940b2b3aa751ce4e33fe971974a