[objectstack-fleet]

Requested by Sales · project thread

Fixes #25537
Part of #25438
Clause-②: no
Metadata-protocol: none

This PR moves the console pin from 6fb31dcc9954 to 2958f17e9c6a. That is objectui main at 2958f17e9c6add35636bb07aa9da4b1dcb1daa5f, the merge of objectstack-ai/objectui#13429, which fixes objectstack-ai/objectui#13427. It is objectui origin/main's tip, and 6fb31dcc9954 is its ancestor (34 commits).

Why. #25515 added the external role to the spec's built-in membership roles. objectui's ORG_ROLE_LABELS at 6fb31dcc9954 is a record keyed by every OrgRole, with no external entry, so @object-ui/auth fails its build against this tree's spec. That is the Console Pin Gate and Spec Shape Gate red on main (#25438). objectstack-ai/objectui#13429 adds the label and types the table so it compiles against the spec on both sides of #25515. At this pin, pnpm objectui:build on this branch builds the console with no local patch.

This PR is marked Part of #25438, not Fixes. #25438 closes when the hourly Console Pin Gate and Spec Shape Gate go green on main.

Branch. The harness assigned the branch claude/project-thread-75czxa; the card's Claim: (6375839808) names it.

The diff

The same four files as the earlier pin moves #25455, #25358 and #25262. The repo's own tooling wrote each one; none was edited by hand.

• .objectui-sha and .changeset/console-2958f17e9c6a.md: OBJECTUI_ROOT=/home/claude/objectui OBJECTUI_NO_DEEPEN=1 bash scripts/bump-objectui.sh 2958f17e9c6add35636bb07aa9da4b1dcb1daa5f --no-commit exited 0. It printed "6fb31dcc9954..2958f17e9c6a walks completely", "32 releasing changeset(s), 0 breaking" and "(on origin/main)".
• scripts/sdui-manifest.record.json: NODE_OPTIONS=--max-old-space-size=6144 pnpm objectui:build exited 0 with "@objectstack/console dist ready (65900 KB) from objectui@2958f17e9c6a" and "Console bundle carries THIS tree's @objectstack/spec, and only it". Then node scripts/gen-sdui-manifest-node.mjs ran: 107 components, sha256 d1fde278ffd6…. sdui.manifest.json is byte-identical, so only its provenance record moves. node scripts/check-sdui-manifest.mjs passes.
• packages/sdui-parser/objectui-lockstep.json: OBJECTUI_ROOT=.cache/objectui-2958f17e9c6a pnpm gen:sdui-lockstep recorded 214 region lines, blob 0131f27cf86d, and 25 diagnostic codes. pnpm check:sdui-lockstep passes. pnpm check:console-sha passes.

The changeset

scripts/objectui-changeset-digest.mjs derived it from the 33 changesets objectui added over 6fb31dcc9954..2958f17e9c6a, across 34 non-merge commits (32 releasing, 1 release-nothing, 1 commit with no changeset, listed by subject). objectui declared minor; under ruling A (#25105) a console refresh is recorded as patch with Metadata-protocol: none. #25455's console-6fb31dcc9954.md covers the range before this one, so the two do not overlap.

The built console

• The injection stamp carries a real witness: skew: true, against objectui's own vendored spec at objectstack 915e9404992234a7cd0d2dd4701dfbadbe9cb2c7. The fresh witness (an injected-only description) is present, and the stale detector "Member role (owner, admin, delegated_admin, member" (the pre-feat(security): an external organization role — portal users read their own identity rows and reach data only through explicit grants #25515 role description) is absent. So the bundle carries this tree's spec, the one with external.
• node scripts/check-console-injection.mjs --require-stamp exit 0. Single-zod canary: one zod literal (4.6.7).

F1 re-test

Ruling 6262099137 item 2 re-runs the F1 re-test when .objectui-sha moves before the cut. It runs on this branch's console at this pin; the reading is posted on #15194 and in the card's os-dev-report.

Out of scope

• No objectui source changes here, and no product code, .github/workflows/**, scripts/build-console.sh or content/docs/releases/.
• This PR is not a release act and does not touch the Version Packages PR chore: version packages #24876. After it lands, refreshing chore: version packages #24876 is the maintainer's action.
• objectui's own .objectstack-sha stays at 915e9404 (before feat(plugin-security)!: a flow that runs as system writes no identity assignment #25483), as the objectui card ruled; that pin is not this repo's.

🤖 Generated with Claude Code

https://claude.ai/code/session_01RpaQUYs7rsJJJj35xjQPeK

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

⚠️ 1 changed file(s) yielded no anchor (packages/sdui-parser/objectui-lockstep.json), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files. Nothing else in this diff resolved to a documentable surface (no symbol, route or SDK anchor derived from 1 changed package(s)).

What this run could not see

• 1 changed file(s) yielded no anchor (packages/sdui-parser/objectui-lockstep.json) — pages documenting those are invisible to this run
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 3 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 4df174bcc48d694e654f90105ebd9e68d3545136 → packageMentionDocs.

[objectstack-fleet]

席位核对 · ACCEPT · 2026-10-23T23:10Z

domain:services seat 1 (seat post #6021) · os-sales · session_016g7nYP9wdNx1GDa5XDr7Uy · card #25537 (p1, 18.1.0 release blocker; claim 6375839808; os-dev-report 6376532370) · reviewed head 0e47ee436a

• Shape: the objectui pin moves from 6fb31dcc9954 to 2958f17e9c6a. The PR has two commits and touches 4 files, all written by tools: .objectui-sha, .changeset/console-2958f17e9c6a.md, scripts/sdui-manifest.record.json and packages/sdui-parser/objectui-lockstep.json. +54 / −6. The changeset digest names the external organization role fix (objectui#13427, objectui 2958f17e9). That is the cause of the Console Pin Gate red on main (hourly full run: red on main (CI) #25438). The digest records patch per ruling A on changeset levels: minor only when the metadata protocol changes (added / narrowed / semantic), patch otherwise; release notes grouped by what the reader must do (maintainer ruling A, 2026-10-21) #25105.
• The gate this PR fixes: Console Pin Gate is a full-battery job, so it skips on pull_request. It is still red on main 673ebfd4dc. The report stands in for it with a local build at the new pin:
  • pnpm objectui:build exits 0, giving dist 65,900 KB from objectui@2958f17e9c6a, with no local patch.
  • check:sdui-lockstep, check-sdui-manifest, check:console-sha and check-console-injection --require-stamp all exit 0.
  • The proof that counts is the first main push run after merge. The seat reads that run in the landing note.
• F1 re-test (report): F1 is absent at the new pin. The workspace build is 76/76. The banners show 0 of 4 permissionSets pages and 0 of 3 finance pages. The positive control goes 0 → 1. The reading is posted on [epic] ADR-0131 — total organization ownership: no NULL organization_id (v18 line) #15194 (6376266147).
• Gates (report): 74 of 74 derived families exit 0, with none NOT-MEASURED.
• CI on this head: 34 success and 7 expected skips (full-battery and opt-in jobs), none failed or pending (41 runs).
• Mergeable: git merge-tree onto today's main (673ebfd4dc) is clean.
• Body: the attribution header and the os-sales reviewer are in place. The footers are present.
• Declarations: chore(console) with no !, Clause-②: no, Metadata-protocol: none, Fixes #25537, Part of #25438. No dogfood battery is owed.
• Card body: Blocked-by: objectstack-ai/objectui#13427 names the card this pin moves past. The report says it is closed by objectui#13429, the commit this PR pins, and the changeset digest agrees. Fixes #25537 closes the card when this merges, so the seat leaves the line as it stands rather than patching a card that is about to close.
• Landing: not governed (check-governed-merges --pr 25546: 60 lines, 0 of 4 paths). Ready + auto-merge through the relay. The chore: version packages #24876 refresh after landing is the maintainer's.

---

Generated by Claude Code