[0 of #7891] ADR-0091 seed pair crosses the publish door: runtimeTypes: ['seed'] — measured trip-free first slice

Programme slice of #7891 (split by the domain:spec seat, session session_01Euoy6wyfzgiWtgCg4s6JK2, per the triage note of 2026-08-12 sanctioning a Blocked-by:-ordered split). Independent — no Blocked-by:.

Scope

One decision crossing the wall whole, per the parent card's own staging: register runtimeTypes: ['seed'] for the ADR-0091 pair (security-grant-expired-at-authoring, security-delegation-missing-reason) so they enforce at the runtime publish door, plus the pin that records the crossing.

Measured facts inherited from PR #7886 (re-run, do not trust)

The pair reads only stack.data[]; the seed → data stack key was corrected under fix(lint): make validateSecurityPosture's surfaceReason a measured claim (#7576) #7886.
Trip-free on the shipped corpus (showcase + CRM + todo + blank): zero error findings at both surfaces.
Re-check: packages/lint/src/validate-security-posture.runtime-surface.test.ts is the executable measurement.

Constraints

The whole sub-family crosses by this one decision — if measurement shows either rule now trips on the corpus, stop and report rather than exempting shapes ad hoc.
⛔ No partial security-role-word wiring smuggled in (parent card's [finding] The four views[] visibility-predicate rules are CLI-only — a Studio/REST/MCP view write bypasses all of them; if they move to runtime-publish, they must move together #7220 constraint).

Sequencing

⛔ Hold until #8116's PR merges — its dev is in flight in packages/lint (different files, same package; serialized by the seat to keep batches package-disjoint). Size S-mechanical once unblocked.

Part of #7891.

Claim: PM loop round 2 (backfill slot after #7816 close; maintainer 2026-08-13: 「任务很多,并发加到3」)
Session: session_01Euoy6wyfzgiWtgCg4s6JK2
Branch: claude/issue-8307-seed-pair-runtime-types
Worktree: objectstack-issue-8307
Domain: domain:spec
File surface: the validateSecurityPosture registration in packages/lint (runtimeTypes gains 'seed') + the runtime-surface pin extension; changeset (stop on breach; explain in the report)
Container & model: S (mechanical — correctness judged by the gate farm), mode:subagent, model: sonnet
Serial constraints cleared: the packages/lint hold released — #8116 / PR #8342 MERGED (2d8dba312); no in-flight claim touches packages/lint (in flight this round: #8273 → error-code-ledger + service-settings, #8057 → objectql engine + kernel schema). Upstream #8308 (blocker-A seed repair) MERGED via PR #8338 — the measured trip-free premise for the seed pair is refreshed by that landing's own pins.

Generated by Claude Code

{
  "issue": 8307,
  "status": "done",
  "branch": "claude/issue-8307-seed-pair-runtime-types",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/8390",
  "premise_still_valid": true,
  "summary": "Registered runtimeTypes: ['seed'] on the whole `validateSecurityPosture` registry entry in packages/lint/src/authoring-rules.ts (surfaces: CLI_ONLY -> CLI_AND_RUNTIME), putting the ADR-0091 seed pair (security-grant-expired-at-authoring, security-delegation-missing-reason) on the runtime publish door. Extended validate-security-posture.runtime-surface.test.ts with real runRuntimeAuthoringRules pins (not the pre-crossing mirror): the crossing itself, a clean-write positive control, and an isolation proof that a seed write leaks no finding from the other 11 rule ids this one entry also carries (proven against a context object that would trip two of them if isolation failed). Added a changeset.",
  "tests": "pnpm --filter @objectstack/lint build -> exit 0. pnpm --filter @objectstack/lint test -- --maxWorkers=2 -> Test Files 72 passed (72), Tests 1978 passed (1978). pnpm --filter @objectstack/lint typecheck -> clean. Corpus re-measurement (hard constraint, re-run not inherited): grepped every defineSeed() call site across all four shipped stacks (examples/app-showcase, examples/app-crm, examples/app-todo, packages/create-objectstack/src/templates/blank) -- none authors a sys_user_position or sys_user_permission_set seed row at all (zero hits for valid_until/delegated_from and both object names across all three source trees; blank has no seed data). So the ADR-0091 loop body never executes for the current corpus -- a structural zero, not a counted-and-hoped-stays-zero one. No STOP condition was hit. Local gates re-derived via node scripts/pm/dispatch-gates.mjs against the committed diff: check:spec-parsed-alias OK, check:cross-package-test-inputs OK, check:changeset-gate-self-tests OK, check:objectui-changeset/pin-fresh self-tests OK, check-changeset-no-major.mjs 'no major bump', check-adr-0087-registration.mjs 'adds no declared-breaking changeset', check:query-options-erasure ratchet holds (new test file didn't add unswept sites), check:type-check-coverage unaffected, check:nul-bytes OK. check:api-surface untouched as expected (no packages/spec source in this diff).",
  "open_questions": [],
  "out_of_scope_findings": []
}

Generated by Claude Code

os-dev-report (correcting the marker in the previous comment, which was posted HTML-entity-escaped by mistake and not the literal  text)

{
  "issue": 8307,
  "status": "done",
  "branch": "claude/issue-8307-seed-pair-runtime-types",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/8390",
  "premise_still_valid": true,
  "summary": "Registered runtimeTypes: ['seed'] on the whole `validateSecurityPosture` registry entry in packages/lint/src/authoring-rules.ts (surfaces: CLI_ONLY -> CLI_AND_RUNTIME), putting the ADR-0091 seed pair (security-grant-expired-at-authoring, security-delegation-missing-reason) on the runtime publish door. Extended validate-security-posture.runtime-surface.test.ts with real runRuntimeAuthoringRules pins (not the pre-crossing mirror): the crossing itself, a clean-write positive control, and an isolation proof that a seed write leaks no finding from the other 11 rule ids this one entry also carries (proven against a context object that would trip two of them if isolation failed). Added a changeset.",
  "tests": "pnpm --filter @objectstack/lint build -> exit 0. pnpm --filter @objectstack/lint test -- --maxWorkers=2 -> Test Files 72 passed (72), Tests 1978 passed (1978). pnpm --filter @objectstack/lint typecheck -> clean. Corpus re-measurement (hard constraint, re-run not inherited): grepped every defineSeed() call site across all four shipped stacks (examples/app-showcase, examples/app-crm, examples/app-todo, packages/create-objectstack/src/templates/blank) -- none authors a sys_user_position or sys_user_permission_set seed row at all (zero hits for valid_until/delegated_from and both object names across all three source trees; blank has no seed data). So the ADR-0091 loop body never executes for the current corpus -- a structural zero, not a counted-and-hoped-stays-zero one. No STOP condition was hit. Local gates re-derived via node scripts/pm/dispatch-gates.mjs against the committed diff: check:spec-parsed-alias OK, check:cross-package-test-inputs OK, check:changeset-gate-self-tests OK, check:objectui-changeset/pin-fresh self-tests OK, check-changeset-no-major.mjs 'no major bump', check-adr-0087-registration.mjs 'adds no declared-breaking changeset', check:query-options-erasure ratchet holds (new test file didn't add unswept sites), check:type-check-coverage unaffected, check:nul-bytes OK. check:api-surface untouched as expected (no packages/spec source in this diff).",
  "open_questions": [],
  "out_of_scope_findings": []
}

Generated by Claude Code

ACCEPT — reviewed by the dispatching seat (session session_01Euoy6wyfzgiWtgCg4s6JK2) against PR #8390's diff.

Verified: 4 files, surface exact (the runtime-gate.ts stale-comment refresh on the now-load-bearing seed: 'data' mapping is in-spirit and declared). The whole-entry runtimeTypes: ['seed'] declaration is safe by the baseline/candidate differential — and the PR proves it with an isolation positive-control test (a context that would trip security-owd-unset + security-role-word if the diff leaked, asserting zero leaked findings) rather than asserting it in prose. The trip-free corpus claim was re-measured, not inherited, and came back STRUCTURAL: none of the four shipped apps seeds a grant/delegation row at all, so the ADR-0091 loop body never executes for the current corpus. Changeset minor follows the #7220 family-crossing precedent over the dispatch's patch default — the justified deviation is correct. object/permission/book and security-role-word correctly untouched (#8310's residue).

Process notes: this dev stalled once on a background wait (the #8294 shape, second instance this shift) and delivered cleanly after a foreground reset; its first report comment had a self-broken marker, caught by its own read-back and re-posted — both incidents recorded for the #8294 thread's evidence pile.

Landing: draft until gate jobs conclude; flip + auto-merge (squash) on the timed check. On merge, the #7891 programme checklist advances: slice 0 done, slice 1 (#8308) done, slice 2 (#8309) on #4463, slice 3 (#8310) still blocked.

Generated by Claude Code

feat(lint): the ADR-0091 seed pair crosses the runtime publish gate (o…

Navigation Menu

Repository navigation

[0 of #7891] ADR-0091 seed pair crosses the publish door: `runtimeTypes: ['seed']` — measured trip-free first slice #8307

Scope

Measured facts inherited from PR #7886 (re-run, do not trust)

Constraints

Sequencing

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

[0 of #7891] ADR-0091 seed pair crosses the publish door: runtimeTypes: ['seed'] — measured trip-free first slice #8307

Description

Scope

Measured facts inherited from PR #7886 (re-run, do not trust)

Constraints

Sequencing

Activity

hotlong commented on Aug 13, 2026

hotlong commented on Aug 13, 2026

hotlong commented on Aug 13, 2026

hotlong commented on Aug 13, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

[0 of #7891] ADR-0091 seed pair crosses the publish door: `runtimeTypes: ['seed']` — measured trip-free first slice #8307