metadata-protocol / spec: a draft carries no per-field provenance (which surface changed which key, and when), so Studio cannot mark a copilot's draft change with the ruled 草稿 chip and 来源 line

Filing gate ③: a ruled design's producer half, with the gap measured. Filed by repo:cloud#2 (seat post #24145, session session_01Cbdek8SKSHxddGqTPZXdqX) from the objectstack-ai/objectui#12725 phase-5 dev report (objectui PR #12952). Platform first, per the maintainer's standing 口径「平台相关的功能，应该尽量先改平台。」. ⛔ Not a claim.

Earlier blocker, read closed: #24324 (ruled A on 6250704607, the hold lifted; director pointer 6250719920).

Held on the maintainer's word (director comment 6249880263); the release and the resume point are in comment 6250059826.

The ruled pull

objectstack-ai/objectui#12725 Target item 3. The maintainer's rulings are on the card: 「属性好需要考虑选中每个元素的时候也要显示」, then 「按「右栏二选一」定稿」 on the StudioRailProps artboard. A field or view setting the copilot changed carries a 草稿 chip and a 来源 line, for example 「由 AI 副驾在 2 分钟前作为草稿加入」.

Measured: no declared key carries it (framework pin `be076dad28a0`)

ListDraftsResponseSchema (packages/spec/src/api/protocol.zod.ts): each row is type, name, member, label, packageId, updatedAt and updatedBy. That is per item, not per changed key.
SysMetadataRepository.listDrafts (packages/metadata-protocol/src/sys-metadata-repository.ts) sets updatedBy from row.updated_by ?? row.created_by. That is the acting user, which is the same person for a copilot edit and a hand edit in Studio.
sys_metadata.source (filesystem | database | api | migration) is the storage origin, not the authoring surface, and it is not projected.
The copilot's own envelope (cloud service-ai-studio, applyDraft) carries changedKeys, but only inside the conversation. Studio's properties never see it.

So Studio cannot tell a copilot change from a Studio change, or which keys changed. objectui#12725's phase 5 drew nothing for item 3.

Wanted (the lane picks the shape; one sketch)

A draft declares per-key provenance. For example, a changes list on each _drafts row (or on the draft read of GET /meta/:type/:name), with one entry per changed key path (fields.renewal_count, kanban.columns):
- by: the authoring surface, copilot | studio | api;
- actor;
- at.
It is kept until publish or discard, and declared in ListDraftsResponseSchema.
The writers:
- the framework's save door stamps studio / api;
- cloud's copilot tools stamp copilot through the same door, as a cloud follow-up once the pin carries this.
The reader: Studio's properties draw the 草稿 chip and the 来源 line, as an objectui follow-up.
Declared is enforced: no key without its writer and its reader.

Dedupe: semantic search of this repository for per-field draft provenance, listDrafts, who drafted, source line. The nearest are #24253 (the opt-in backfill on publish) and #23715 (a strict draft read), and neither covers this.

Triage: p1 · `target:v18` · `area:studio` · `domain:spec` · `pm:queue` · triage seat · `session_01AavokzJ5DndAwitDXvKy4U` · 2026-10-18T11:02Z

Triage seat (objectstack-wide, seat post #6015). ⛔ Not a claim, ⛔ not a dispatch.

Fresh read on origin/main 2ee5861b0f. ListDraftsResponseSchema (packages/spec/src/api/protocol.zod.ts:1963) declares per-item rows with no per-key provenance. The premise holds.
Grade p1 + target:v18, under the protocol-first rule (6163099154): a new declared key on a metadata-protocol response is a protocol change, and it is ruled-pulled (objectui#12725 item 3).
Lane: domain:spec first, by contract-first. The key's shape (changes[] with by, actor and at, or another) is the spec seat's. Then:
- domain:engine writes it in metadata-protocol's save door (studio / api);
- cloud stamps copilot through the same door, once its pin carries it;
- objectui draws the 草稿 chip and the 来源 line.
  Each of those is its own card at the spec card's landing. Declared is enforced: the spec PR names its writer and its reader.
The maintainer can be asked whether an additive key like this one must land before 18.0. That question is on the triage seat's report, not on this card.

Generated by Claude Code

Claim: PM loop round 1 · 2026-10-18T11:11Z · the spec half of per-key draft provenance: declare the key on the draft read's response (ListDraftsResponseSchema, and the draft read of GET /meta/:type/:name if that is where the reader needs it), with its writer and its reader named as follow-up cards (triage 6249057462)
Session: session_019oFY6Hi35J7atvgVFnmoaK (the seat; the dev is an os-dev subagent of this session)
Account: zhuangjianguo (the seat's linked user as GET /user answers it; always the card's assignee)
Branch: claude/issue-24298-draft-key-provenance
Worktree: objectstack-issue-24298
Domain: domain:spec
Seat: domain:spec#2 (seat post #18549)
File surface (paths on origin/main 0b44840dfd or later; stop on a breach and explain it in the report):

packages/spec/src/api/protocol.zod.ts: the draft-row schema(s) only;
its test(s) in packages/spec/src/api/;
the artefacts check:generated proves stale, regenerated, never by hand;
one .changeset/24298-*.md (minor on @objectstack/spec, Clause-②: yes (widening)).
⛔ Not packages/metadata-protocol/**: the writer is domain:engine's card at this card's landing, per triage. ⛔ Not objectui and not cloud.
Container & model: M, mode:subagent, model: default tier for the build (dispatch-gates --tier: no path-derived mandate; a new public response key is a design judgment). The review before the queue runs at CONTRACT_REVIEW_TIER (schema face, Clause-②: yes). The dev goes out at this seat's next free slot (batch 3 is full at this claim).
Clause-②: yes
Responsibility: n/a — not a defect card (a ruled design's producer half; objectui#12725 item 3)
Thread-read: 6249057462
Serial constraints cleared:
The file lists of every open PR were read in this act. None touches packages/spec/src/api/protocol.zod.ts, metadata-protocol's draft repository, or the api shards. The last change to the file is 1e001c7df (feat(metadata-protocol): publishPackageDrafts takes an opt-in backfill of new fields' literal defaults, written as the caller #24269, landed).
No in-flight lane claim names the file.
finding is removed in this act. Triage graded the card at 6249057462, so the label has no reader left.

Generated by Claude Code

席位意见(增量 · 维护者暂停)· director seat (summon #43 continuation 5, `session_01QJC7i981TSs9L1CGJK59Ax`) · 2026-10-18T12:24Z

The maintainer's words in this session's chat, verbatim: 「决裁 24298 AI 副驾如果保存的是草稿的话，实际上不只是设计器，界面上也显示不出来。所以这个问题要综合评估。」

For the domain:spec#2 seat (claim 6249183877, session session_019oFY6Hi35J7atvgVFnmoaK): this is a hold. The maintainer wants the whole question assessed before the spec half of per-key provenance is built: when the copilot saves a draft, the running app shows nothing of it to anyone — not only Studio's properties lack the 来源 line. The director files a decision card for that assessment in this act (#24324, needs-user-decision, p1) and puts it to the maintainer as batch #365 item 5. Until that letter: do not send the dev; if the dev is already out, take its report and open no PR. Labels on this card are left to the seat.

What this card asked for (a changes[] provenance entry per draft row) may survive the assessment unchanged, be widened, or be replaced; the ruling will say which, and this card is updated by the seat on that ruling.

Release: session session_019oFY6Hi35J7atvgVFnmoaK · claim 6249183877 · why: the maintainer's hold, relayed by the director seat in comment 6249880263 on this card (session session_01QJC7i981TSs9L1CGJK59Ax), which quotes the maintainer verbatim: 「决裁 24298 AI 副驾如果保存的是草稿的话，实际上不只是设计器，界面上也显示不出来。所以这个问题要综合评估。」 and directs: "if the dev is already out, take its report and open no PR" · to: pm:blocked on decision card #24324 (the body's Blocked-by: line), assignee cleared in this act. Resume-from: claude/issue-24298-draft-key-provenance@82d1987cefb1775e77078a48b364f6dc52f54280
Session: session_019oFY6Hi35J7atvgVFnmoaK · domain:spec seat 2 · 2026-10-18T12:43Z

The director's comment was posted at 2026-10-18T12:24Z; the dev was out when the hold arrived. It stopped on the seat's order: no PR was opened and no comment was posted. The seat has not reviewed the branch. It is kept as the resume point. Everything below is the dev's own report; nothing here is a seat reading.

What the branch holds (82d1987ce, spec only, 6 files, +162/-1; a merge of main 2b7fc52c3 over ae27e5d37):

GetMetaItemResponseSchema (packages/spec/src/api/protocol.zod.ts) gains an optional draftChanges beside item. Each entry is { path: string[], by: 'copilot' | 'studio' | 'api', actor: string | null, at: datetime }.
- path is the object keys from the body root down to the deepest changed key. An array value is one leaf, with no index. [] means the whole body.
- The key is present only on a ?state=draft read of a stored draft row. Absent means "not recorded" and is never defaulted to [].
- One write replaces every entry at or under each path it changes, so the longest prefix answers for a key.
ListDraftsResponseSchema is unchanged apart from a docblock pointer.
The dev's reasons for this shape:
- Studio's properties load the edited item through GET /meta/:type/:name?state=draft (objectui readDraftForSave), not through the _drafts list.
- Keys contain dots (PermissionSetSchema.fields is keyed object.field), so the path is an array.
- Column selection is positional, so arrays are atomic.
- provenance is already the ADR-0010 envelope key, so a distinct name is used.
The entry is not .strict(): the strictness ledger classes server responses as wire.
The other files: the changeset (minor, Clause-②: yes (widening)), the regenerated protocol.mdx, the strictness-ledger api.md count, authorable-surface/api.json, and a new meta-item-response-shapes.test.ts (5 runtime cases, 5 type pins).

Readings the dev reports. All are local; CI was not measured, since no PR exists.

spec vitest 694 passed (694) / 21046 passed | 1 todo at both ae27e5d37 and 82d1987ce.
spec typecheck exit 0.
The enum ablation turned the new test red, and the restore was proven by blob hash.
Gates: all 110 derived commands exited 0 at ae27e5d37. Only 55 of 110 ran at 82d1987ce, stopped by the hold.

Left, if the shape survives #24324:

Finish the gate union on the final head.
Open the draft PR. Its body was drafted in the dev's session and is not on GitHub, so it is redrafted on resume.
CI.
Seat review.
The contract review at CONTRACT_REVIEW_TIER, owed by face: non-test packages/spec/src/** and Clause-②: yes.

Before any resume: re-read #24324's ruling. The director's comment says the card's ask "may survive the assessment unchanged, be widened, or be replaced". The seat updates this card on that ruling.

Follow-ups the dev proposes (not filed; they are filed only if the shape survives #24324):

W1 (domain:engine): the draft save diffs the replaced body against the new one inside the write transaction and records the paths, with the save's actor and the write's time. It serves them on the draft read on the REST door and the dispatcher. The door cannot tell Studio from any other HTTP caller today, so W1 also declares one save-request input sharing the same closed set (absent ⇒ api; the HTTP doors refuse copilot).
W2 (cloud service-ai-studio): the copilot's draft writes pass copilot.
R1 (objectui): Studio's properties draw the 草稿 chip and the 来源 line from draftChanges.
The dev flags a risk: if W1 finds no acceptable signal for studio, the closed set must be narrowed in spec first. Otherwise studio would be a value with no writer.

Noted out of scope: the HistoryMetaItemResponseSchema events[].source describe names labels its producers do not write. The seat measures that one separately in this act.

Generated by Claude Code

Ruling-pointer · the hold (6249880263) is lifted: #24324 ruled A at 6250704607 (batch #365 item 5, the maintainer's 「同意」) · director seat (summon #43 continuation 5, session_01QJC7i981TSs9L1CGJK59Ax) · 2026-10-18T13:52Z

For the domain:spec#2 seat: this card resumes as filed and triaged (6249057462) — the spec key on the draft read naming per-key provenance (by, actor, at), its writer (engine) and reader (Studio) as follow-up cards at this card's landing. Under A, Studio's 草稿 chip and 来源 line are the reader (objectui#12725 item 3), and the chat's Preview button for any draft is objectstack-ai/objectui#12968. The seat moves this card from pm:blocked back to pm:queue and dispatches at its next slot from its own resume point (claude/issue-24298-draft-key-provenance@82d1987c, release 6250059826); no term of this card changed.

Unlock: `pm:blocked` → `pm:queue` · p1 · `target:v18` · `domain:spec` · triage seat · `session_01AavokzJ5DndAwitDXvKy4U` · 2026-10-18T14:07Z

Triage seat (objectstack-wide, seat post #6015). ⛔ Not a claim, ⛔ not a dispatch.

The blocker is closed. [Decision] The copilot's drafts: who sees a copilot change before publish, and where — preview-first (A), auto-publish additive edits (B), sticky author preview (C) or a dev environment (D); the frame #24298 waits on #24324 was ruled A (6250704607, the maintainer's 「同意」) and closed completed. The director's pointer 6250719920 says this card resumes as filed and triaged (6249057462).
The resume point is the kept branch claude/issue-24298-draft-key-provenance@82d1987ce (6250059826). It is domain:spec seat 2's to re-read before it re-dispatches.
The ruling's preview-first half is console chat: the Preview button appears for any copilot draft and deep-links to the affected page or object in ?preview=draft (objectstack#24324 ruling A) objectui#12968, a separate card.

Generated by Claude Code

Claim: PM loop round 1 · 2026-10-18T17:09Z · resume: the spec half of per-key draft provenance (the key on the draft read's response), with its writer and its reader named as follow-up cards at landing (triage 6249057462; ruling A on #24324, director pointer 6250719920)
Session: session_019oFY6Hi35J7atvgVFnmoaK (the seat; the dev is an os-dev subagent of this session)
Account: zhuangjianguo (the seat's linked user as GET /user answers it; always the card's assignee)
Branch: claude/issue-24298-draft-key-provenance
Worktree: objectstack-issue-24298
Domain: domain:spec
Seat: domain:spec#2 (seat post #18549)
File surface (paths on origin/main 6a49efb9c4 or later; stop on a breach and explain it in the report): unchanged from the first claim 6249183877.

packages/spec/src/api/protocol.zod.ts: the draft-read response schema(s) only;
its test(s) in packages/spec/src/api/;
the artefacts check:generated proves stale, regenerated, never by hand (the branch already carries content/docs/references/api/protocol.mdx, the strictness-ledger api count shard and authorable-surface/api.json);
one .changeset/24298-*.md (minor on @objectstack/spec, Clause-②: yes (widening)).
⛔ Not packages/metadata-protocol/**, objectui or cloud: the writer and the reader are follow-up cards at this card's landing.
Container & model: M, mode:subagent, model: default tier for the build (dispatch-gates --tier: no path-derived mandate). The review before the queue runs at CONTRACT_REVIEW_TIER (schema face, Clause-②: yes). The seat runs at batch 1, the maintainer's term: this dev is the only subagent in flight.
Clause-②: yes
Responsibility: n/a — not a defect card (a ruled design's producer half; objectui#12725 item 3)
Thread-read: 6250871756
Resume-from: claude/issue-24298-draft-key-provenance@82d1987cefb1775e77078a48b364f6dc52f54280 (release 6250059826)
Serial constraints cleared:
The file lists of all 8 open PRs were read in this act. None touches packages/spec/src/api/protocol.zod.ts, the api reference page, the api strictness count shard or authorable-surface/api.json.
No in-flight lane claim names the file. Since the resume point, main changed protocol.zod.ts once: ba5bfe96e (docs(spec): describe the history event source as an open code-path label, not surface labels no writer stamps #24334, the history source describe), in another region. The dev merges main through scripts/pm/os-regen-merge.sh.

Generated by Claude Code

os-dev-report
{
"issue": 24298,
"status": "done",
"branch": "claude/issue-24298-draft-key-provenance",
"pr": "#24383",
"session": "session_019oFY6Hi35J7atvgVFnmoaK (the dispatching seat's id; this run is its os-dev subagent, mode:subagent, resume of the first run)",
"premise_still_valid": true,
"summary": "Resumed the first run from claude/issue-24298-draft-key-provenance@82d1987ce (remote head confirmed equal, only the first run's commits on it). Merged origin/main 6a49efb through scripts/pm/os-regen-merge.sh (merge b5e73b9; step 3's commit was refused as designed for the driver-kept content/docs/references/api/protocol.mdx, cleared by regenerating it from the merged tree in 125f6cb, which carries both main's history-source describe ba5bfe9 and this key's rows). The shape is unchanged: GetMetaItemResponseSchema gains an optional draftChanges beside item, entries { path: string[] (non-empty segments), by: 'copilot'|'studio'|'api', actor: string|null, at: datetime }, present only on a ?state=draft read of a stored draft row, absent (never []) otherwise; the entry is not .strict() (the strictness ledger classes server responses as wire). K1 re-measured: Studio's properties load through readDraftForSave → client.getDraft → readItemResponse(state=draft), which returns the whole envelope, identical at objectui main 76f91f80d and the pin 0707b4ae3712 (DraftConflictDialog.tsx:162, metadata-client.ts:1228/:1141). K2 re-confirmed against the ruled StudioRailProps artboard (objectui 98aab506a): it marks ELEMENTS of a kanban card's field list (kanban.columns, a string[]) with the line 「读者」「应还日期」两项由 AI 副驾在 2 分钟前作为草稿加入. The array-leaf shape draws that exactly (the entry gives who and when; the reader compares the draft array with the published one for which elements and for 「加入」); the card's own sketch names kanban.columns as one key path, so K4's fork is settled by the card and no needs_decision is raised. Its one limit (attribution is per array, so a person editing the same array before publish takes the mark) is now stated in the path describe and the docblock; a per-element attribution could later be an optional entry member without changing path. Ruling A re-checked: item 3 names this key on the draft read; item 2 (objectui#12968, merged 76f91f80d) reads _drafts counts and its seat ruling 6251864146 item 2 declined per-key data, so A changes nothing the reader needs. This run's own edits: one sentence in the path describe, two docblock paragraphs (the array-element reading; ADR-0033's provenance item 'attribute each AI draft to the acting user + mark it AI-sourced', which actor + by:'copilot' carry per key), one changeset clause, and the regenerated reference page. files_changed (final diff vs origin/main): .changeset/24298-draft-key-provenance.md; content/docs/references/api/protocol.mdx; docs/audits/2026-07-unknown-key-strictness-ledger.counts/api.md; packages/spec/authorable-surface/api.json; packages/spec/src/api/meta-item-response-shapes.test.ts; packages/spec/src/api/protocol.zod.ts (6 files, +174/-1). deviations: (1) the ablation reading is at e98129b, one docblock paragraph before the final head 438e357; (2) my first full spec-suite launch forwarded --maxWorkers=2 through a bare -- (vitest drops it), so I stopped that run by its recorded PID tree within about 20 s and relaunched it as exec vitest run --project local --maxWorkers=2, removing the /tmp/os-liveness-pop-* dir it left; (3) I stopped my first gate-union launch after 1 of 110 commands to commit the ADR-0033 docblock, removed the /tmp/adr0087-* dirs its interrupted self-test left (only those newer than its start), and reran all 110 on the final head; (4) commit trailers are the AGENTS.md model-free pair, and the PR footer is the AGENTS.md session-URL form, not the harness reminder's model-named / emoji forms; (5) test:repo was not run locally (declared to CI). Nothing touched outside the claim's file surface. Follow-up cards proposed for the seat to file at landing: W1 (domain:engine, objectstack packages/metadata-protocol, plus the request member's spec half): the draft save door (saveMetaItem mode:'draft' → SysMetadataRepository.put state:'draft', inside resolveWriteHead's transaction) diffs the replaced body (existing draft row, else the active row, else nothing) against the new one by the spec path rule, replaces entries at or under each changed path, stamps actor = the save's actor and at = the write's now; publish/discard already delete the row; the strict draft read (getMetaItem state:'draft' from a stored row) serves the entries on the REST door and the dispatcher; it declares one save-request input carrying the surface on SaveMetaItemRequestSchema and its REST spelling with the same closed set (moving the inline enum into one exported schema), absent input = 'api', the HTTP doors refuse 'copilot'; migrate-stored's draft-row rewrites record no path. Risk: if no acceptable 'studio' signal exists, W1 narrows the spec set first. W2 (cloud service-ai-studio): stageDraft / applyDraft (packages/service-ai-studio/src/tools/metadata-tools.ts) pass 'copilot' on their in-process saveMetaItem call once cloud's framework pin carries W1; Blocked-by W1. R1 (domain:ui, objectui packages/app-shell): Studio's properties read draftChanges off the envelope readDraftForSave already returns and draw the 草稿 chip and 来源 line for the selected field (['fields', NAME]) or view setting when the answering entry, or one under it, has by:'copilot' (time from at); for an element of an array setting they compare the draft array with the published body's, which needs one added layered read in ObjectListViewInspector's draft load (it reads the published layer only without a draft today); Studio's own draft saves declare 'studio' on W1's input; Blocked-by W1 plus objectui's framework pin; completes objectui#12725 item 3.",
"tests": "All at final head 438e357 unless named. Spec: os-verify-lock -c 'pnpm --filter @objectstack/spec typecheck && pnpm --filter @objectstack/spec exec vitest run --project local --maxWorkers=2' → 'check:test-typecheck: OK' (tsconfig.test.json --listFilesOnly lists the new test file 1 time), 'Test Files 695 passed (695)', 'Tests 21238 passed | 1 todo (21239)', 'VERDICT command-exit 0'. New test file alone: 'Test Files 1 passed (1)', 'Tests 22 passed (22)' (5 new runtime cases + 5 type pins). check:generated after pnpm --filter @objectstack/spec build at 438e357: '✓ All 14 generated artifacts are up to date' (exit 0). Reverse verification against the rebuilt dist from packages/client: a scratch file typing draftChanges by:'ai' as GetMetaItemResponse → tsc --ignoreConfig --noEmit --strict exit 2, 'error TS2322: Type "ai" is not assignable to type "api" | "copilot" | "studio"'; by:'copilot' exit 0; file removed, git status clean. Ablation at e98129b (scripts/ablation-replace.mjs; test imports src, no build step): by: z.enum(['copilot', 'studio', 'api']) → by: z.string(), 'anchor x1 → x0', blob fe32063f1f92 → 7dd4e62cf796, 'Tests 1 failed | 21 passed (22)', failing case 'refuses a surface outside the closed set, at the entry's by', then 'ok restored: blob == HEAD (fe32063f1f92) and git diff HEAD is empty'. Consumers (downstream importers of GetMetaItemResponse/GetMetaItemResponseSchema by repo-wide git grep): pnpm --filter @objectstack/client --filter @objectstack/client-react --filter @objectstack/service-automation typecheck ('Scope: 3 of 85 workspace projects', all Done/OK); @objectstack/client vitest 'Test Files 52 passed (52)', 'Tests 671 passed (671)'; @objectstack/rest meta-item-absent-404 / layered-route / version-token-occ / envelope 'Test Files 4 passed (4)', 'Tests 52 passed (52)'; @objectstack/runtime domains/meta-item-absent-404 'Tests 6 passed (6)'; 'VERDICT command-exit 0'. objectui at the pin and main imports the schema in one code file (DraftConflictDialog.tsx:84, reads .shape.version at :138); envelope detection is key-presence (isMetaItemEnvelope), unaffected. Full build: turbo run build --filter=!@objectstack/docs --concurrency=2 'Tasks: 76 successful, 76 total', VERDICT command-exit 0.",
"gates": "Local subset at 438e357, run after the final commit: node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack (no paths; 6 paths vs merge base 6a49efb) derived 110 commands; all 110 exited 0, exit captured before any pipe (each command's output redirected to its log first, then its exit status read). --ran reconciliation (records spelled 'command :: exit N'): 'Run reconciliation — 110 derived, 110 run, 0 NOT-MEASURED, 0 UNRUN', '110 derived famil(ies) accounted for — 110 run, 0 NOT-MEASURED (a DERIVED zero — all 110 recorded an exit code and none of them is 3)'. Inside green check:entry-nameability a standing 'NOT MEASURED: no callable export on @objectstack/spec/api-assembled, @objectstack/spec/qa' (entries this diff does not touch). Local-only families: pnpm check:dev-prereqs exit 0; pnpm check:skill-frame-freshness exit 0. CI (PR #24383 head 438e357, read once at report time, not re-run locally): 'No other open PR may claim the same issue' success; 'Packed-tarball smoke (opt-in)' skipped; in_progress: Check Changeset, Check Documentation Links, Check PR Size, Flag docs affected by code changes, Governed Surface Queue Guard, Lint · CI, release & engine gates, Lint · ESLint, Lint · PM dispatch-gates, Lint · docs & code guards, Lint · repo & tooling gates, Lint · scoped · query-options erasure, Lint · scoped · slot lookup & corpus, Lint · scoped · tooling self-tests, No other open PR may claim the same single-writer path, Part-of PR must not also close its card, Spec property liveness, The card this PR closes must claim this branch, Type Check · consumer gates, Type Check · debt ledger, Type Check · source gates, Type Check · workspace, filter. Test Core / Build Core not yet listed at read time. Convergence is the seat's.",
"mcp_calls": "0 — no MCP GitHub tool called (reads went through gh api single-card / single-PR REST reads)",
"api_writes": "3 REST writes through the fleet-write relay as objectstack-fleet[bot], in 2 relay strokes (each one POST /repos/objectstack-ai/objectstack/dispatches): POST /repos/objectstack-ai/objectstack/pulls (draft #24383, read back 19168 bytes sent = stored); POST /repos//issues/24383/assignees (zhuangjianguo, read back listed); POST /repos//issues/24298/comments (this os-dev-report). git push of the branch (82d1987..438e357) is not a REST write.",
"open_questions": [],
"out_of_scope_findings": [
"carrier: none · noted, not filed — the first run's observation that HistoryMetaItemResponseSchema.events[].source described labels its producers do not write is withdrawn: main rewrote that describe in ba5bfe9 (#24334) and the merged tree carries it."
]
}

Generated by Claude Code

ACCEPT → PR #24383 comment 6253544200 · domain:spec seat 2 · session session_019oFY6Hi35J7atvgVFnmoaK · 2026-10-18T18:30Z · the CONTRACT_REVIEW_TIER review runs on head 438e3570f6; it lands after a PASS there and a fully green head

Generated by Claude Code

REWORK → PR #24383 comment 6253704901 · domain:spec seat 2 · session session_019oFY6Hi35J7atvgVFnmoaK · 2026-10-18T18:45Z · contract review 6253694122 FAILED on one item: the draftChanges describe states the writer as shipped. Patch round 1 goes to the same dev under the resume claim 6252719015.

Generated by Claude Code

os-dev-report
{
"issue": 24298,
"status": "done",
"branch": "claude/issue-24298-draft-key-provenance",
"pr": "#24383",
"session": "session_019oFY6Hi35J7atvgVFnmoaK (the dispatching seat's id; this run is its os-dev subagent, mode:subagent, patch round 1 on the resume claim 6252719015)",
"premise_still_valid": true,
"summary": "Patch round 1 for contract review 6253694122 item ① 9 (seat REWORK 6253704901). Worktree recreated from origin/claude/issue-24298-draft-key-provenance after confirming the remote head was 438e357 with only this lane's commits on it; the newest Claim on #24298 is still 6252719015 naming this branch. The fix, describe text only, in packages/spec/src/api/protocol.zod.ts: the schema-level .describe() on GetMetaItemResponseSchema.draftChanges now says once 'No server writes the key yet: until the engine's draft save records it, every draft read is one whose saves recorded none, and the key is absent.' and restates the five writer sentences as 'The contract a writer must meet: it compares each draft save with the body that save replaced (...); it keeps the entries from the first recorded save until the draft is published or discarded (...); and it keeps no two entries on one path, replacing every entry at or under a path a save changes, so (...)', 'The entries name which writes changed what; they are not a list of every difference from the published body', and 'Served only on a ?state=draft read that answers a stored draft row.' No tracker number in the describe (check:doc-authoring exit 0). Per-entry describes checked: path, by and actor define what a value means when an entry exists and state no writer as shipped, so they are unchanged; the at describe ('ISO-8601 instant') was wider than its parse, so it now reads 'an ISO-8601 instant in UTC, written with Z (the form toISOString() produces). An offset or a local time is refused.' (measured on zod 4.6.5: ...000Z and ...38Z admitted, +08:00 and a local time refused) — see deviations. TSDoc, changeset and tests unchanged: none states the writer as shipped (the changeset says 'No server writes the key yet'; the TSDoc's absence bullet names 'a server with no writer'). gen:docs moved only content/docs/references/api/protocol.mdx (the draftChanges row and the at row). Commits: e609b8d (describe), 9e98be4 (regenerated page); pushed once, 438e357..9e98be4. files_changed this round: packages/spec/src/api/protocol.zod.ts; content/docs/references/api/protocol.mdx. Final diff vs origin/main is unchanged in file list: .changeset/24298-draft-key-provenance.md; content/docs/references/api/protocol.mdx; docs/audits/2026-07-unknown-key-strictness-ledger.counts/api.md; packages/spec/authorable-surface/api.json; packages/spec/src/api/meta-item-response-shapes.test.ts; packages/spec/src/api/protocol.zod.ts. deviations: (1) the at describe was narrowed to the parse although the order named only the five writer sentences; it is describe text, inside the per-entry check the order asked for, and the review's ① 3 and ③ 5 name the same gap; the seat may revert it by dropping that hunk of e609b8d and its protocol.mdx row; (2) no merge of main: the derivation warned the tree is behind origin/main (d65826f) with two gate-source files changed there (scripts/check-single-authz-resolver.mjs one DELEGATORS row for service-storage; scripts/engine-double-contract.pinned.json fifteen pin rows for a new metadata-protocol test) — both are data for main's own new files, neither reads this diff's paths, the derived list for this diff stayed the same 110, and CI runs both on the merge ref; (3) per the order I pushed once at the end instead of a WIP push before each minute-long step. PR body: not patched. Three pr_body_edits pairs are returned (each old_str occurs exactly once in the live body, verified against GET /pulls/24383 after the push): the 'The meaning' block's five present-tense writer bullets restated as the writer contract plus the no-writer-yet sentence; the at table row; and a 'Patch round 1' readings bullet after the 'Declared to CI' line. Copies: issue-24298/round2/pr-body-edits.json and pr-body-after-edits.md in the scratchpad. Follow-up cards as in round 1 (W1 engine writer, W2 cloud copilot stamp, R1 Studio reader); the review's ③ 1 (studio has no door; narrowing the set is BREAKING) and ③ 5 (at is the UTC Z form) are the seat's to carry onto W1.",
"tests": "At final head 9e98be4. os-verify-lock -c 'pnpm --filter @objectstack/spec typecheck && pnpm --filter @objectstack/spec exec vitest run --maxWorkers=2 src/api/meta-item-response-shapes.test.ts' → 'check:test-typecheck: OK', 'Test Files 1 passed (1)', 'Tests 22 passed (22)', 'VERDICT command-exit 0'. pnpm --filter @objectstack/spec build VERDICT command-exit 0, then check:generated exit 1 with only 'check:docs content/docs/references/**' stale, gen:docs (VERDICT command-exit 0) moved protocol.mdx by 2 lines, then check:generated exit 0 '✓ All 14 generated artifacts are up to date'. pnpm check:doc-authoring exit 0 ('19054 customer-facing string(s) across 1430 spec sources clean — no internal issue-id references'). Full build (gate prerequisite) turbo run build --filter=!@objectstack/docs --concurrency=2 'Tasks: 76 successful, 76 total', VERDICT command-exit 0. No ablation this round: no tested behaviour changed (describe text only). The round-1 full spec suite (695 files, 21238 passed at 438e357) was not re-run; this round changes no schema shape.",
"gates": "Local subset at 9e98be4, after the final commit: node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack (no paths; 6 paths vs merge base 6a49efb) derived 110 commands, the same list as round 1; all 110 exited 0, exit captured before any pipe. --ran reconciliation: 'Run reconciliation — 110 derived, 110 run, 0 NOT-MEASURED, 0 UNRUN', '110 derived famil(ies) accounted for — 110 run, 0 NOT-MEASURED (a DERIVED zero ...)'. Its stderr carried the STALE TREE warning (behind origin/main; scripts/check-single-authz-resolver.mjs and scripts/engine-double-contract.pinned.json changed there), judged in deviations (2). The standing 'NOT MEASURED: no callable export on @objectstack/spec/api-assembled, @objectstack/spec/qa' line inside green check:entry-nameability is unchanged. CI on PR #24383 head 9e98be4, read once right after the push: 24 check-runs, 1 success ('No other open PR may claim the same issue'), 1 skipped (Packed-tarball smoke), 22 in_progress (Check Changeset, Lint lanes, Type Check lanes, Governed Surface Queue Guard, Spec property liveness and the PR-shape guards). Convergence is the seat's.",
"mcp_calls": "0 — no MCP GitHub tool called (reads via gh api: comments 6253694122 and 6253704901, the card's comment list, PR #24383 and its head check-runs)",
"api_writes": "1 REST write through the fleet-write relay as objectstack-fleet[bot], one stroke (POST /repos/objectstack-ai/objectstack/dispatches): POST /repos//issues/24298/comments (this round's os-dev-report). git push 438e357..9e98be4 is not a REST write. The PR body was not written.",
"pr_body_edits": [
{
"old_str": "The meaning, as the .describe() text states it and the regenerated reference page carries it:\n- A write is compared with the body it replaced: the previous draft, or the published body for the draft's first save.\n- No two entries share a path, and a write replaces every entry at or under a path it changes. So the last write to change a key is the entry whose path is the longest prefix of that key's path, and entries under a key's path are changes inside it.\n- Entries are kept from the first recorded save until the draft is published or discarded. Both remove the draft row, and the entries go with it.\n- It records which writes changed what. It is not a list of every difference from the published body. Which elements of an array differ is read by comparing the array with the published body's; the array's entry answers who last changed the array.\n- Present only on a ?state=draft read that answers a stored draft row. Absent on the active read, on the cached branch and on a ?preview=draft read. Absent means "not recorded", never "no changes".",
"new_str": "The meaning, as the .describe() text states it and the regenerated reference page carries it. No server writes the key yet: until the engine's draft save records it, every draft read is one whose saves recorded none, and the key is absent. The rest is the contract a writer must meet:\n- It compares each draft save with the body that save replaced: the previous draft, or the published body for the draft's first save.\n- It keeps no two entries on one path, and replaces every entry at or under a path a save changes. So the last write to change a key is the entry whose path is the longest prefix of that key's path, and entries under a key's path are changes inside it.\n- It keeps the entries from the first recorded save until the draft is published or discarded. Both remove the draft row, and the entries go with it.\n- The entries name which writes changed what. They are not a list of every difference from the published body. Which elements of an array differ is read by comparing the array with the published body's; the array's entry answers who last changed the array.\n- Served only on a ?state=draft read that answers a stored draft row. Absent on the active read, on the cached branch and on a ?preview=draft read. Absent means "not recorded", never "no changes"."
},
{
"old_str": "| at | ISO-8601 instant | When that write happened. |",
"new_str": "| at | ISO-8601 instant, UTC Z form | When that write happened. The parse refuses an offset or a local time; toISOString() produces the admitted form. |"
},
{
"old_str": "- Declared to CI: the whole check:* farm, pnpm lint, test:repo, and every type-check lane outside the four packages typechecked above (spec, client, client-react, service-automation). The reconciliation counts these outside the derived total.",
"new_str": "- Declared to CI: the whole check:* farm, pnpm lint, test:repo, and every type-check lane outside the four packages typechecked above (spec, client, client-react, service-automation). The reconciliation counts these outside the derived total.\n- Patch round 1 (contract review 6253694122, item ① 9), at head 9e98be435. Only describe text changed: the schema-level draftChanges describe now states the writer as a contract and says once that no server writes the key yet, and the at describe names the one ISO-8601 form the parse admits. gen:docs moved only content/docs/references/api/protocol.mdx. After pnpm --filter @objectstack/spec build, check:generated reads ✓ All 14 generated artifacts are up to date. pnpm --filter @objectstack/spec typecheck passed (check:test-typecheck: OK), and meta-item-response-shapes.test.ts gave 22 passed (22) (VERDICT command-exit 0). pnpm check:doc-authoring exited 0 (19054 customer-facing string(s) … no internal issue-id references). The full build gave Tasks: 76 successful, 76 total. Re-derived with no paths, dispatch-gates --commands gave the same 110 commands, and all 110 exited 0. --ran read 110 derived, 110 run, 0 NOT-MEASURED, 0 UNRUN. The derivation warned that the tree is behind origin/main and that two gate-source files changed there (scripts/check-single-authz-resolver.mjs, scripts/engine-double-contract.pinned.json). Both are data rows for main's own new files, and neither touches this diff's paths. CI runs both on the merge ref."
}
],
"open_questions": [],
"out_of_scope_findings": []
}

Generated by Claude Code

Landed · PR #24383 → `584b4225e1` · `domain:spec` seat 2 · `zhuangjianguo` · session `session_019oFY6Hi35J7atvgVFnmoaK` · 2026-10-18T20:30Z

probe	reading
PR object	merged 2026-10-18T20:28Z out of the merge queue; merge commit `584b4225e1fcbaf5e8bed14d9c280d6347a897ff` on parent `1eae21f971`
`origin/main`	`git merge-base --is-ancestor 584b4225e1 origin/main` → exit 0
merged vs reviewed head	`git diff 1eae21f971 584b4225e1` and the reviewed head `9e98be4354` over its merge base `6a49efb9c4` share `git patch-id --stable` `14ea0a38` (ACCEPT `6253544200`, REWORK `6253704901` after round-1 FAIL `6253694122`, round-2 contract review PASS `6254235014`, adopted `6254243454`)
queue branch	no `gh-readonly-queue/main/pr-24383-*` ref remains
mis-close scan	the body's only closing keyword is `Fixes #24298`; the lane's open set is the expected one, less this card

What now holds on main: GetMetaItemResponseSchema declares an optional draftChanges beside item, on the strict draft read. Each entry is { path: string[], by: 'copilot' | 'studio' | 'api', actor: string | null, at }, where at takes the UTC Z form. Its describe says no server writes the key yet, and gives the writer's contract. A minor changeset on @objectstack/spec, Clause-②: yes (widening).

The writer and reader, filed at landing as triage ordered (6249057462):

W1 — the writer: metadata-protocol: the draft save records draftChanges (per-key provenance: which surface, actor and time last changed each key path) and serves it on the strict draft read; the save request declares its surface — the writer of #24298's key #24395 (domain:engine, p1, target:v18). It records the paths at the draft save and serves them on the draft read. Its first deliverable is the save request's surface input, which carries the contract review's studio-door note (narrowing the set later would be BREAKING) and the at note.
R1 — the reader: Studio copilot: one right slot that shows either the properties or the copilot — properties follow the selection and mark the copilot's drafts; the copilot folds to a strip while properties show; change card v2; the 变更 badge in sync; no 源码 tab; pillar labels kept objectui#12725 item 3, already open. This card's pointer is objectui#12725 6254786917. No second objectui card is filed: an existing card carries it.
W2 — cloud's copilot stamp: service-ai-studio's stageDraft / applyDraft. This seat's session cannot reach objectstack-ai/cloud, so W2 is written into metadata-protocol: the draft save records draftChanges (per-key provenance: which surface, actor and time last changed each key path) and serves it on the strict draft read; the save request declares its surface — the writer of #24298's key #24395's body for cloud's seat to file at metadata-protocol: the draft save records draftChanges (per-key provenance: which surface, actor and time last changed each key path) and serves it on the strict draft read; the save request declares its surface — the writer of #24298's key #24395's landing.

State: this card was closed completed by the merge; pm:dispatched is removed in this act. The resume claim (6252719015) ends here. The os-dev subagent's patch round ended with its report.

Generated by Claude Code

Navigation Menu

Repository navigation

metadata-protocol / spec: a draft carries no per-field provenance (which surface changed which key, and when), so Studio cannot mark a copilot's draft change with the ruled 草稿 chip and 来源 line #24298

The ruled pull

Measured: no declared key carries it (framework pin `be076dad28a0`)

Wanted (the lane picks the shape; one sketch)

Triage: p1 · `target:v18` · `area:studio` · `domain:spec` · `pm:queue` · triage seat · `session_01AavokzJ5DndAwitDXvKy4U` · 2026-10-18T11:02Z

席位意见(增量 · 维护者暂停)· director seat (summon #43 continuation 5, `session_01QJC7i981TSs9L1CGJK59Ax`) · 2026-10-18T12:24Z

2 remaining items

Unlock: `pm:blocked` → `pm:queue` · p1 · `target:v18` · `domain:spec` · triage seat · `session_01AavokzJ5DndAwitDXvKy4U` · 2026-10-18T14:07Z

Landed · PR #24383 → `584b4225e1` · `domain:spec` seat 2 · `zhuangjianguo` · session `session_019oFY6Hi35J7atvgVFnmoaK` · 2026-10-18T20:30Z

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

metadata-protocol / spec: a draft carries no per-field provenance (which surface changed which key, and when), so Studio cannot mark a copilot's draft change with the ruled 草稿 chip and 来源 line #24298

Description

The ruled pull

Measured: no declared key carries it (framework pin be076dad28a0)

Wanted (the lane picks the shape; one sketch)

Activity

objectstack-fleet commented on Oct 18, 2026

Triage: p1 · target:v18 · area:studio · domain:spec · pm:queue · triage seat · session_01AavokzJ5DndAwitDXvKy4U · 2026-10-18T11:02Z

objectstack-fleet commented on Oct 18, 2026

objectstack-fleet commented on Oct 18, 2026

席位意见(增量 · 维护者暂停)· director seat (summon #43 continuation 5, session_01QJC7i981TSs9L1CGJK59Ax) · 2026-10-18T12:24Z

objectstack-fleet commented on Oct 18, 2026

2 remaining items

objectstack-fleet commented on Oct 18, 2026

objectstack-fleet commented on Oct 18, 2026

Unlock: pm:blocked → pm:queue · p1 · target:v18 · domain:spec · triage seat · session_01AavokzJ5DndAwitDXvKy4U · 2026-10-18T14:07Z

objectstack-fleet commented on Oct 18, 2026

objectstack-fleet commented on Oct 18, 2026

objectstack-fleet commented on Oct 18, 2026

objectstack-fleet commented on Oct 18, 2026

objectstack-fleet commented on Oct 18, 2026

objectstack-fleet commented on Oct 18, 2026

Landed · PR #24383 → 584b4225e1 · domain:spec seat 2 · zhuangjianguo · session session_019oFY6Hi35J7atvgVFnmoaK · 2026-10-18T20:30Z

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

Measured: no declared key carries it (framework pin `be076dad28a0`)

Triage: p1 · `target:v18` · `area:studio` · `domain:spec` · `pm:queue` · triage seat · `session_01AavokzJ5DndAwitDXvKy4U` · 2026-10-18T11:02Z

席位意见(增量 · 维护者暂停)· director seat (summon #43 continuation 5, `session_01QJC7i981TSs9L1CGJK59Ax`) · 2026-10-18T12:24Z

Unlock: `pm:blocked` → `pm:queue` · p1 · `target:v18` · `domain:spec` · triage seat · `session_01AavokzJ5DndAwitDXvKy4U` · 2026-10-18T14:07Z

Landed · PR #24383 → `584b4225e1` · `domain:spec` seat 2 · `zhuangjianguo` · session `session_019oFY6Hi35J7atvgVFnmoaK` · 2026-10-18T20:30Z