…arriers, one grammar (objectstack-ai#19637) Fixes objectstack-ai#18697 Clause-②: yes (narrowing) Phase 2 of the version-grammar canon. Phase 1 — the accept-set-neutral collapse of eight regex literals onto three exported constants — **already landed** as objectstack-ai#19478 (`2cac3636`, 2026-09-21T03:37Z), so this PR carries the one-line grammar move and nothing else. That is a re-derivation on this tree, not the dispatch's assumption: the card and its measurement report were both taken before objectstack-ai#19478 existed. The ruling is decision batch objectstack-ai#194 item 2, letter A, maintainer 「同意」 2026-09-20T10:02Z (comment 5749112309). The measurement report it names as the specification is comment 5736025846. ## What this changes One concept — "the version of a package or plugin" — was judged by four grammars across ten carriers in two repositories, and the strictest refused `2.0.0-beta.1`, the exact string a sibling declaration documents as an example of itself. `@objectstack/spec/kernel` now exports ONE grammar, `SEMVER_2_0_0_VERSION_PATTERN` (semver.org's own published expression, in its form without named capture groups), and every carrier references it. Per-carrier accept-set delta, both directions: | carrier | starts accepting | starts refusing | |:--|:--|:--| | `ManifestSchema.version` + `MetadataPluginManifestSchema`, `PluginRegistryEntrySchema`, `PluginMetadataSchema`, and the `PATCH /api/v1/packages/:id` door | `2.0.0-beta.1`, `17.0.0-rc.5`, `1.0.0-alpha.1`, `1.0.0-Beta.1`, `1.0.0+Build.5`, `1.0.0+20230101`, `1.0.0-rc.1+exp.sha.5114f85` | `01.1.1` | | `PluginSchema.version` + the boot path in `@objectstack/core` | — | `01.1.1`, `1.01.1`, `1.1.01`, `1.0.0-0123`, `1.0.0-alpha..1`, `1.0.0-alpha..`, `1.0.0-.`, `1.0.0+.` | | `PackageVersionSchema.version` | `1.0.0-Beta.1`, `1.0.0+Build.5` | the same eight | | `PackageManifestSchema.version` (was a bare `z.string()`) | — | `latest`, `v1.0.0`, `1.0`, the empty string, a trailing space, `2.0.0-beta.1extra!`, and the same eight | ## The objectstack-ai#16365 fence, and the proof it holds The boot path is governed by a widen-never-narrow ruling: nothing that loads today may stop loading. This narrows it on eight strings and **nothing else**, and both halves of that bound are pinned rather than claimed: - `plugin-loader.test.ts` gains a case asserting all sixteen valid prerelease and build forms the wider grammar admitted — `1.0.0-alpha.1`, `1.0.0-rc.1+build.1`, `1.0.0+0.build.1-rc.10000aaa-kk-0.1`, `0.0.0-fixture` and the rest — still load. Its comment says a failure there is not a pin to update. - `plugin.test.ts` keeps the same list on the schema side and flips the eight-form block from ACCEPTED to REFUSED. - `version-grammar.test.ts` pins both lists against the constant itself. What the eight have in common is that no precedence order exists for any of them: `dependency-resolver.ts` can place none of them in an order, so a plugin versioned that way could be published and never compared against its own successor. None of them is a valid prerelease, which is what the fence is about. ## Carrier count, re-derived on this tree ⛔ Not taken from the card's table (which the measurement report already found incomplete at 4) nor from the report's own count on `0f1cd83cb`. Query, run on this branch: ``` git grep -n "SEMVER_2_0_0_VERSION_PATTERN" -- 'packages/*/src/**' 'packages/*/*/src/**' \ | grep -v '\.test\.ts' | grep -v 'version-grammar.ts' ``` **9 in-repo carriers**, all referencing one declaration: five in `packages/spec/src/kernel` (`ManifestSchema`, `MetadataPluginManifestSchema`, `PluginRegistryEntrySchema`, `PluginMetadataSchema`, `PluginSchema`), two in `packages/spec/src/marketplace/package-version.zod.ts` (`PackageManifestSchema`, `PackageVersionSchema`), the boot path in `@objectstack/core`, and the `PATCH` door in `@objectstack/runtime`. `CreatePackageVersionRequestSchema.version` is `PackageVersionSchema.shape.version` — a reference, not a tenth declaration. The tenth carrier is objectui's, below. Lit control for the census, same tree — residual three-numeric-segment regex literals in non-test sources: ``` git grep -n -E '\\d\+\\\.\\d\+\\\.\\d\+' -- 'packages/*/src/**' 'packages/*/*/src/**' | grep -v '\.test\.ts' ``` Four hits, and all four are the concepts the measurement report bounded out by name: `engines.platform` (a version RANGE, `manifest.zod.ts`), the npm dependency-prefix test and the docker image tag pin in `packages/create-objectstack`, and one comment in `plugin.zod.ts` quoting the pre-objectstack-ai#16365 regex as history. **Zero residual carriers.** ## Out of this repository's reach - **cloud's publish route** follows through its pin on `@objectstack/spec`, as the ruling directs. Its accept set moves when it takes this version: it chose `PackageVersionSchema.version` deliberately because that set was a strict subset of the loader's, and after this change the two are equal — the subset relation is gone because the disagreement it protected against is gone. `objectstack-ai/cloud` is not mounted in this session, so this is stated, not measured. - **objectui** is the tenth carrier: `PackageFormDialog.tsx` hand-copies the strict regex and gates the form with it, `package-schema.ts` builds the form's JSON Schema from `ManifestSchema`, and `PackageFormDialog.helpTextI18n.test.tsx` pins this repo's `.describe()` text verbatim — which this PR changes, so that test goes red until the objectui card lands. The ruling assigns that card to the spec seat at this PR's ACCEPT. ⛔ Not attempted here. - The pinned objectui checkout **cannot** import the three constants this PR retires, and that is measured rather than assumed: `.objectui-sha` was last moved at 2026-09-21T00:18:44Z (`fbc12be3`), three hours and nineteen minutes **before** objectstack-ai#19478 landed the constants at 03:37:40Z, so no source at that pin could reference a symbol that did not yet exist. The Console Pin Gate builds objectui against this tree's spec via `OBJECTSTACK_SPEC_DIST`, which is why the question needed an answer rather than an assumption. ## ADR-0087 Four D3 semantic entries under protocol 18, one per surface that moves, each carrying its FROM → TO and the reason no mechanical D2 conversion ships with it — a version is how a release is addressed, so rewriting one re-points whatever already resolved the old string, and each degenerate form has more than one defensible repair: `manifest-version-semver-2-0-0` · `plugin-version-semver-2-0-0` · `package-version-row-semver-2-0-0` · `package-manifest-version-grammar-enforced` The ruling asked for entries on the G2 and G4 narrowings; the other two surfaces narrow as well (G1 on `01.1.1`, G3 on the degenerate forms), and the ledger is the only notification channel a narrowing has, so all four are registered rather than the named two. Their projections `spec-changes.json` and `docs/protocol-upgrade-guide.md` are byte-unchanged, and that is correct rather than a missed regeneration: no protocol-18 semantic entry reaches either file. Measured with a lit control in both directions — `manifest-id-reverse-domain-required`, `metadata-item-name-grammar-enforced` and `automation-runs-cursor-retired` are each present in `registry.ts` and absent from both projections, while the protocol-17 entry `actor-user-roles-to-positions` appears 14 times and 7 times in them. ## Three retired exports `MAJOR_MINOR_PATCH_VERSION_PATTERN`, `SEMVER_SHAPED_VERSION_PATTERN` and `SEMVER_SHAPED_LOWERCASE_VERSION_PATTERN` are removed, replaced by the one canon. They were introduced by objectstack-ai#19478 one day ago and each named an accept set that no longer exists — keeping them as aliases would leave two names actively lying (`MAJOR_MINOR_PATCH` accepting prereleases, `LOWERCASE` accepting uppercase), which is the class-(b) defect this card exists to close. The changeset carries the import migration. ## Verification Suites, on this branch: - `packages/spec` — **14906 passed / 2 failed** before regeneration; both failures were the export-surface artifacts (`export-origins.test.ts`, `state-machine.test.ts`) naming the three retired constants, and both pass after `check:generated --fix`. - Consumer packages, as the spec lane charter requires — `@objectstack/core` **1337 passed (51 files)**, `@objectstack/metadata` **792 passed (53 files)**, `@objectstack/objectql` **5050 passed (303 files)**, `@objectstack/rest` **3254 passed, 1 skipped (194 files)**, `@objectstack/runtime` **3796 passed, 3 failed** — and that sweep is what found the one consumer fixture asserting the other way, which a sweep inside `packages/spec` alone could not have seen. The runtime failure was `packages-install-manifest-version.test.ts`, and it failed by design. Its §0 exists to go red first when this canon moves, and it says so in the file: 「If the version-grammar canon moves, THIS is the assertion that goes red… only this fixture needs re-choosing.」 It pinned `2.0.0-beta.1` as refused by the declaration; the declaration now accepts it. The successor fixture is `01.1.1` — still version-shaped, still refused on the grammar alone, so every claim that file makes about the DOOR is unchanged. Generated artifacts: `check:generated` reported exactly 3 of 15 stale (`api-surface/`, `export-origins/`, `content/docs/references/**`) and `--fix` regenerated those 3 from a dist it built. The api-surface delta is exactly 3 names out and 1 in. `packages/spec/json-schema/**` is gitignored and its tracked roster records names only, so no JSON Schema artifact moves; `dropped-refinements.baseline.json` is untouched, as expected — this change is a `.regex()`, not a `.refine()`. ## Acceptance notes - `packages/spec/src/contracts/plugin-validator.test.ts` declares its own `validateVersion: (version) => /^\d+\.\d+\.\d+$/.test(version)` as a test double implementing an interface. It is a stub, not a carrier of the concept, and is deliberately left alone. ## 维护者速读(草稿) **改了什么** —— 「一个包的版本号」这个概念,以前在本仓有 9 个载体、4 套互不相同的判定规则;同一个 `2.0.0-beta.1`,构建时被拒、发布时被收、Studio 表单拒两次、安装门根本不检查。现在全仓只有一条语法,就是 SemVer 2.0.0 这个公开标准本身,9 个载体全部引用同一份声明。 **为什么改** —— 这不是整洁性问题,是对外承诺与实际执行不一致:`.describe()`、生成的参考文档、Studio 帮助文案、两份 ADR 都写着「语义化版本」,而被强制的规则拒绝语义化版本里的预发布号。本仓自己发 483/7611 个预发布 tag,描述包的那个键却表达不出预发布。裁决选 A,就是让被强制的语法等于早就公开宣称的那句话。 **风险与代价(含回滚)** —— 绝大多数作者只会「多了能写的东西」:预发布号与构建号第一次被接受。真正收窄的只有 8 个字符串,都是 SemVer 明令禁止、且任何解析器都排不出先后的退化写法(如 `01.1.1`、`1.0.0-alpha..1`);本仓作者语料里这些写法的生产者实测为 **0**。启动路径上有一条「只准放宽、不准收紧」的旧裁决,本次收窄严格限定在那 8 个之内,「今天能加载的合法预发布一个都不会被拒」这条性质是用测试钉死的,不是文字承诺。回滚成本低:改动集中在一个导出常量与它的引用,回退该常量即整体复原;但已按新语法发布的预发布版本会重新落到旧的「构建拒、发布收」矛盾里。跨仓两处不在本仓触及范围:cloud 的发布路由随 pin 走,objectui 的表单副本与帮助文案另开卡(本 PR 会让 objectui 那条固定文案的测试变红,直到那张卡落地)。 **席位意见** —— **你要做的** —— 确认一件事:本次是否接受在启动路径上收窄那 8 个退化写法。裁决已经同意(批次 objectstack-ai#194 第 2 项,letter A),此处只需确认实现照做了、且边界没有溢出;实现给出的边界证据是 `plugin-loader.test.ts` 与 `plugin.test.ts` 里成对的「仍然接受」与「开始拒绝」两张清单。其余无需决策。 --- _Generated by [Claude Code](https://claude.ai/code/session_014aHq2gi6yvckJhDVbCUuYJ)_ --------- Co-authored-by: Claude <noreply@anthropic.com>

🔗 Broken links detected in documentation #194

Description

Activity

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions