feat(spec)!: 删除 ./system 的 declared-only tenant-provisioning 家族 —— C16 双源清账,基线 12 → 10 (#4739) - #4752
Merged
Merged
Conversation
…6 双源清账,TenantPlan 唯一真源在 ./cloud (#4739) `TenantPlan(Schema)` 曾由 `./cloud` 与 `./system` 各自导出一个声明:cloud 侧 5 值(free/starter/pro/enterprise/custom)嵌 `EnvironmentSchema.plan` / `TenantContextSchema.plan` / `ProvisionTenantRequestSchema.plan`,cloud 仓 service-tenant 实际消费;system 侧 3 值子集只嵌 `TenantProvisioningRequest/ Result`,而该 provisioning 协议(连同 contracts 的 `IProvisioningService` / `ITenantRouter`)objectstack / cloud / objectui 三仓 import 语句级实测零实现 零调用 —— declared-only,已被 cloud 的 `Provision*` 家族整体取代。按维护者 裁决(#4739,路线 B)删 system 侧全家族,cloud 侧一字未动。 - 删 system/provisioning.zod.ts(+测试):TenantPlan / TenantRegion / TenantProvisioningStatus / ProvisioningStep / TenantProvisioningRequest / TenantProvisioningResult 六 def 全家 - 删 contracts/provisioning-service.ts、contracts/tenant-router.ts(+测试): 两文件除三个 declared-only 接口外无他物,整文件退役;两 index 留 #4739 指路注释(#4212/#4451 同款) - dual-source-exports.baseline.json:删 TenantPlan / TenantPlanSchema 两行 (12 → 10,rebase 携带 C6 #4745 落地后的起点) - authorable-surface.json:21 行随三个整 def 出账(#4650 门禁判定三组 「def no longer emitted」自证路径,输出见 PR) - json-schema.manifest.json:删六 def 键(#2978 蓄意移除通道) - api-surface.json:恰好 15 行删除(./system 12 + ./contracts 3),零新增 - docs:system/provisioning.mdx 与幽灵页 cloud/provisioning.mdx 随生成器 消失,cloud/TenantPlan 文档回到真家 cloud/tenant.mdx(#4696 病灶随重名 根因消除);docs-import-surface.baseline.json 经生成器收缩一行 - 回归 pin(cloud/tenant.test.ts):compiler-API 断言全入口(package.json exports 枚举)任何叫 TenantPlan(Schema) 的导出唯一解析到 cloud 声明、 ./system 不再命名之、三个契约接口全包消失,防空转守卫;S1(重加声明)/ S2(禁止的 re-export 路线)sabotage 均红 - changeset:@objectstack/spec major(移除 15 个已发布导出名,TS2305), 零元数据迁移;strictness-ledger 实跑零变化(该文件不在台账辖区) Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0176qgxgCXTJCUv4YFLtusP9
|
The latest updates on your projects. Learn more about Vercel for GitHub. 1 Skipped Deployment
|
github-actions
Bot
added
documentation
Contributor
📓 Docs Drift CheckThis PR changes 1 package(s): 107 hand-written doc(s) reference the affected code and may need an implementation-accuracy re-verification:
|
os-zhuang
marked this pull request as ready for review
August 3, 2026 02:18
os-zhuang
enabled auto-merge
August 3, 2026 02:19
This was referenced Aug 3, 2026
os-zhuang
pushed a commit
that referenced
this pull request
Aug 3, 2026
…ant.test.ts, a 5s timeout in a test #4752 landed after this branch (zero spec files in this diff) Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015Br2xsJsczFsTR9bvbh2Ny
This was referenced Aug 3, 2026
akarma-synetal
pushed a commit
to akarma-synetal/framework
that referenced
this pull request
Aug 3, 2026
…tack-ai#4669) (objectstack-ai#4755) * fix(security): project only spec-declared keys into permission-set metadata, and make a failed backfill loud (objectstack-ai#4669) `sys_permission_set` carries an `active` STORAGE COLUMN — the on/off switch the Setup list views filter on and the two lifecycle actions toggle. ADR-0094 D4's boot backfill turned a whole row into a metadata body, so `active` went with it; objectstack-ai#4001 then sealed `PermissionSetSchema` `.strict()`, and every backfill began failing with `[invalid_metadata] … Unrecognized key(s) on this permission set: 'active'`. The failure was caught into one `warn` and no counter moved, so a 100%-failing projection path stayed green for a release. `active` is row state, not a declaration — its entire consumer surface (column, highlightFields, list-view filters, the actions' `bodyExtra`) is the record's runtime switch, never a capability boundary an author declared. So the fix is on the PROJECTION side; `packages/spec` is untouched. - `permissionSetBodyFromRow()` / `mergeRowPatchIntoBody()` now pass through a whitelist DERIVED from `PermissionSetSchema.shape` — not a transcribed string list, which would silently drop the next key the spec grows (this defect, one layer over). Storage columns never enter a body, and a body STORED before objectstack-ai#4001 (data at rest can still carry `active`) is filtered at the same choke point, so its data-door edits stop 422-ing. - The activate/deactivate actions keep working: a patch that touches only row state is not a definition write and passes through to the driver, so the column write keeps its ordinary engine semantics and no bogus "customization" overlay is minted on a packaged set. The projector no longer reads `active` from a body either — a stale body can no longer re-activate a set an admin just switched off. - A real backfill failure is now loud per AGENTS.md "Degradation log levels" (objectstack-ai#4632): `error` level with the consequence and the fix, said once at the first failure, plus a new `ProjectionReconcileOutcome.backfillFailed` counter so the degradation lands in the RESULT and not only in a log line. Tests: the mock protocol now validates with the REAL `PermissionSetSchema`, exactly as `saveMetaItem` does — re-introducing the defect fails 6 of them with the issue's verbatim error. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015Br2xsJsczFsTR9bvbh2Ny * ci: retrigger — Test Core (1/2) failed on packages/spec/src/cloud/tenant.test.ts, a 5s timeout in a test objectstack-ai#4752 landed after this branch (zero spec files in this diff) Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015Br2xsJsczFsTR9bvbh2Ny --------- Co-authored-by: Claude <noreply@anthropic.com>
akarma-synetal
pushed a commit
to akarma-synetal/framework
that referenced
this pull request
Aug 3, 2026
…`ConnectorConflictResolution`,ui 侧保名 (objectstack-ai#4738) (objectstack-ai#4760) `DataSyncConfig(Schema)` 曾由 `./automation` 与 `./integration` 各导出一个声明, `ConflictResolution(Schema)` 三个入口三个声明(objectstack-ai#4411 陷阱)。按维护者裁决 (objectstack-ai#4535 前锋判定 + 2026-08-03 批复,L1 否决位默认通过)三动作一单: - **automation 侧整体死删**:`automation/sync.zod.ts` + `sync.test.ts`(L1 「Simple Sync」层,17 个导出名)。三仓(objectstack / cloud / objectui) import 语句级零消费者、无父 schema 嵌入,8 个 def 全部不再发出 —— 39 个 authorable key 删行由 objectstack-ai#4650 门禁按路径 3(整 def 消失)自证, 归 manifest ratchet(objectstack-ai#2978 蓄意移除,8 键逐个列于 PR)+ check:api-surface 管辖。 - **integration 侧 D9(a) 改名**:`ConflictResolution(Schema)` → `ConnectorConflictResolution(Schema)`,走 `RENAMED_DEFS` 承接(0-key carry, 枚举值逐字不变);`DataSyncConfig` integration 侧保名不动 (`ConnectorSchema.syncConfig` 活解析路径)。 - **ui 侧保留正名一字不动**:objectui `useOffline.ts` + `types/index.ts:1054` re-export + parity ratchet 钉住;`api/ConflictResolutionStrategy` 第四亲戚 未动。 - dual-source-exports.baseline.json:删 4 行(认领时点账面 12 → 8;C16 objectstack-ai#4752 先行合入 −2,rebase 到 5647006 后实跑 10 → 6) - 回归 pin(sync-retirement.test.ts):compiler-API 符号身份 + exports-map 全入口枚举 + 唯一属主断言 + 防空转守卫;S1(重加导出)/ S2(禁止的裸名 re-export 收敛)/ S3(动 ui 侧名字)三组 sabotage 均红后还原 - SYNC_ARCHITECTURE.md:三层 → 两层 + 显式 L1 退役记录;PROTOCOL_MAP / quick-reference / etl.zod / connector.zod / shared/mapping.zod 头注连带更新 - expression-conformance.ledger.ts:删 stale cover(automation/sync.zod.ts:condition) - 严格性台账:automation 86 → 74 sites(check:strictness-ledger 实跑) - changeset:@objectstack/spec major(TS2305),零元数据迁移(integration 值域 逐字节不变;automation 侧无解析站点即无作者,conversion 不可达) Claude-Session: https://claude.ai/code/session_0176qgxgCXTJCUv4YFLtusP9 Co-authored-by: Claude <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #4739
关联:#4535(主账本 C16)、#4650(删行自证门禁,本单走其「整 def 消失」路径 ×3)、#2978(manifest 蓄意移除通道)、#4642(pin 形态)、#4446 / #4506(gate 本体)、#4696(幽灵页,本单顺带消掉两页病灶)。
按维护者裁决(2026-08-03 批复前锋判定)走路线 B:删除
./system侧的整个 tenant-provisioning 家族,./cloud侧保名、一字未动。system 侧不是一个孤立枚举,而是一套从未实现的 provisioning 协议:system/provisioning.zod.ts六 def(TenantPlan/TenantRegion/TenantProvisioningStatus/ProvisioningStep/TenantProvisioningRequest/Result)加contracts的IProvisioningService/ITenantRouter—— 三仓零实现零调用,已被 cloud 入口的Provision*家族整体取代。1. 重验前提(未采信前锋结论,全部实测)
三仓 import 语句级扫描(objectstack @ 本分支基线 / cloud @
5df2c69(= origin/main)/ objectui @785b8a5(= origin/main,恰为当前 console pin 版本);cloud-v1 容器内无检出,与前锋同为三仓结论):packages/ apps/ examples/ scripts/全域、除家族自身 6 文件(def + contracts + 各自测试)外零命中;hand-written docs / skills / ADR 全域零命中。system/tenant.zod.ts(system/Tenant行级租户记录)自带内联枚举,不 import 被删文件 —— 删除是外科式的。TenantProvisioningService/TenantProvisioningConfig是service-tenant/src/tenant-provisioning.ts的重名本地类,不 import spec 的被删家族;全仓大量@objectstack/spec/contractsimport 均为其他契约(LLMAdapter / IMetadataService / Logger / IDataDriver …),三个import type * as Contracts命名空间站点实际只用Contracts.IDataDriver。cloud 消费链完好且走 cloud 入口:tenant-provisioning.ts:4importProvisionTenantRequest、tenant-context.ts/environment-provisioning.ts/registry-reader.ts均 import 自@objectstack/spec/cloud。cloud/tenant.zod.ts:35自声明 5 值TenantPlanSchema,cloud/environment.zod.ts:4只 import 自./tenant.zod—— 不经./system,预期零改动成立(diff 中src/cloud/*.zod.ts零变更)。与裁决零冲突,未触发升级条件。
2. 契约文件处置论证(整文件退役,非局部删除)
contracts/provisioning-service.ts除IProvisioningService(含migrateTenantPlan)外无他物;contracts/tenant-router.ts除ITenantRouter+ResolvedTenantContext外无他物;两文件的全部 type import 都指向被删的system/provisioning.zod.js。家族死则文件空 —— 局部删除会留下两个零导出的空壳,故整文件退役,contracts/index.ts/system/index.ts各留 #4739 指路注释(#4212./types、#4451workflow-service 同款先例)。导出类型不走 tombstone:判据是可达性(处置手册 §1/§4),六 def 全部不从元数据根可达(见 §3 门禁判定)。3. #4650 门禁对被删行的判定(rebase 后实跑输出)
authorable-surface.json被删 21 行分三组走「整 def 消失」自证路径:两个裁决点均满足:
json-schema.manifest.json删六 def 键(#2978 蓄意移除通道,gen:schema 的❌ 6 previously published schema(s) disappeared错误信息指定的同 PR 手删;三个枚举 def 零 authorable key,只在 manifest 出账);check:api-surface全绿,且api-surface.json对 main 的 delta 恰好 15 行删除、零新增(./system12 +./contracts3,./cloud未动)。4. 基线 12 → 10(实跑)
dual-source-exports.baseline.json删TenantPlan/TenantPlanSchema两行(rebase 携带 C6 #4745 落地后起点为 12),其余 10 行一字未动:5. 回归 pin + sabotage(C6 #4745 形态,#4642 纪律)
新增
packages/spec/src/cloud/tenant.test.ts(幸存声明侧此前无测试文件):compiler-API pin:入口从
package.jsonexports map 枚举(防新入口逃逸)+ 防空转守卫;断言./system表面非平凡且不再命名家族 12 名、./contracts不再命名 3 接口(幸存邻居TenantSchema/TenantIsolationLevel/ISchemaDiffService站着)、./cloud的TenantPlan(Schema)声明落在src/cloud/tenant.zod.ts、全入口范围内任何叫TenantPlan(Schema)的导出唯一解析到该声明且./system不得为持有者、三个契约接口全包消失。运行时命名空间断言:cloud 有 / system 无;5 值词表逐值 parse(
starter/custom是被删 3 值子集拒绝的值 —— 幸存者是 cloud 声明的运行时证据),闭枚举拒'solo'。sabotage 实证(均已回滚):
S1 在
./system重加一个独立 3 值声明 → 2 条 pin 红:S2 走禁止路线
export { TenantPlanSchema } from '../cloud/tenant.zod'(符号同一性是单声明,dual-source gate 视角骗得过)→ 同样 2 条红 —— 拦的是「名字离开./system」这条裁决本身,不只是名字存在性。干净态:
tenant.test.ts3/3 通过。6. changeset 定级(逐条自证)
@objectstack/specmajor:15 个已发布导出名的移除,外部消费方 TS2305(与 C14 / C6 同形);实测三仓零命中,预期实际受影响数为 0。同时零元数据迁移:六 def 均不从元数据根可达(§3 门禁三组「def no longer emitted」自证即其判定输出),没有任何元数据文档曾被它们解析,无 tombstone、无 ADR-0087 conversion / migration(check:spec-changes/check:upgrade-guide两 gate 零变化、全绿)。changeset 正文另载词表变宽警告:从./system迁到./cloud的消费方,TenantPlan联合从 3 值变 5 值,穷举 switch 要补starter/custom—— 这正是双源曾隐藏的漂移。全文见.changeset/tenant-plan-dual-source-c16.md。7. 全量验证(rebase 后实跑)
check:generated(8 门)check:dual-source-exportscheck:livenesscheck:strictness-ledgersystem/provisioning.zod.ts不在台账辖区,§5 纪律:以实跑为准,不反射式改)check:empty-statecheck:variant-docscheck:exported-anycheck:skill-examplespnpm testtypecheckpnpm typecheckdocs 顺带:幽灵页
cloud/provisioning.mdx(#4696 实证,cloud 词表配错页)与system/provisioning.mdx随生成器消失,cloudTenantPlan文档回到真家cloud/tenant.mdx;docs-import-surface.baseline.json经--update-import-baseline收缩一行(system/TenantProvisioningStatusEnum — no type export例外随 def 出账)。8. cloud 仓跟进单
objectstack-ai/cloud#1027:
auto-default-environment-plugin.ts:94手抄 5 值 plan 联合 → 改 import spec 单一真源(跨仓潜伏双源;本 PR 不动 cloud 仓代码)。9. 并行协议合规(#4535 2026-08-03 新纪律)
./system(provisioning)+contracts+./cloud测试新增 + spec 生成物,与在飞 RestServerConfig.openApi31(OpenApi31Extensions / Callback / OpenApiWebhookEvent)declared ≠ enforced:没有任何运行时读取它 —— ADR-0049 enforce-or-remove 候选 #4579(api/rest-server 区)、已落地 fix(spec): #3207 收尾 — 补上 enable.trash/mru 退役缺失的 ADR-0087 迁移面,墓碑改指 #3146 #4734(conversions/object 区)、feat(spec)!: 移除./automation的孤儿EventSchema—— C6 双源清账,基线 13 → 12 (#4658) #4745(automation/kernel Event 区)零交集(diff 21 文件,api/、automation/、data/、ai/ 下零文件)。155507e4f(含 fix(spec): #3207 收尾 — 补上 enable.trash/mru 退役缺失的 ADR-0087 迁移面,墓碑改指 #3146 #4734);实施期间 main 推进 5 格(含 feat(spec)!: 移除./automation的孤儿EventSchema—— C6 双源清账,基线 13 → 12 (#4658) #4745 与fix(metadata)!fix(metadata)!:sys_metadata_history.recorded_by存 NULL 而非哨兵字符串'system'(#4556) #4742)—— 已 rebase → 重跑生成器 → 重验:生成物经 os-regen merge driver 从合并树重算(pre-commit 钩子确认all deferred artifacts are current),§3 / §4 / §7 输出均为 rebase 后结果;基线起点按 feat(spec)!: 移除./automation的孤儿EventSchema—— C6 双源清账,基线 13 → 12 (#4658) #4745 落地后的 12 计。入队前若 main 再推进,将再走一轮同流程。flock /tmp/os-heavy-verify.lock串行,vitest--maxWorkers=2、turbo--concurrency=2。.changeset/pre.json开工实测mode: pre/tag: rc(窗口开启)。content/docs/releases/;KNOWN_STILL_DUAL_SOURCE保持[];RENAMED_DEFS未动(本单是删除不是改名);authorable-surface.json删行走 authorable-surface 的 tombstone 门禁可被手编基线绕过 —— 删掉基线行就删掉了证据(#4638 / #4643 已两次这样过绿) #4650 自证而非绕过。🤖 Generated with Claude Code
https://claude.ai/code/session_0176qgxgCXTJCUv4YFLtusP9
Generated by Claude Code