Make the demo seed opt-in, default off, and add pnpm demo

[os-warren]

Fixes#73

Implements the five-item scope adjudicated on the card.

Duly is meant to be a general product, and a general product does not install 459 rows of a fictional manufacturer's org chart into every fresh deployment. Someone evaluating Duly for their own company wants an empty app to put their own duties into; someone evaluating the idea wants the demo. Those are two intentions, and now they are two commands. The login bug on a clean git clone && pnpm dev falls out of that for free — with no sys_user rows in the default seed the database is zero-user at kernel:ready, so plugin-auth mints the dev admin exactly as documented.

What changed

Scope item	Where
1. Gate dulySeeds on an explicit opt-in, default off, genuinely empty	src/data/index.ts — the demo array is exported as demoSeeds, and dulySeeds is demoSeedRequested() ? demoSeeds : []. The gate wraps the whole array rather than filtering rows, so "off" is empty, not "empty of users".
2. pnpm demo, working on a clean checkout in one command	scripts/demo.mjs + package.json. Boots once quietly with the flag off, verifies the handover with a real sign-in, stops, then boots with the flag on in the foreground.
3. README documents both as first-class choices	README.md — a two-row table under Quick start, no mention of the platform interaction.
4. A test that fails if the default seed is non-empty	test/demo-seed-opt-in.test.ts (12 cases). test/seed.test.ts now opts in explicitly.
5. A comment at the gate naming objectstack#14157	src/data/index.ts, including what collapses when it lands: pnpm demo becomes a single boot, and the gate stays.

Two things worth a reviewer's attention

Both dev and demo now boot with --compile. The seed is baked into dist/objectstack.json at compile time, and os dev's --compile defaults to false — it auto-compiles only when the artifact is missing. Without this, pnpm demo's second boot would serve the artifact its own priming boot just built (the one with no seed) and print success over an empty app; and a pnpm dev after a pnpm demo would serve the demo artifact, so the default would not be a default. Measured: default build → 0 datasets / 0 rows in the artifact; DULY_DEMO_SEED=1 build → 10 datasets / 459 rows.

The handover is verified, not assumed.scripts/demo.mjs polls POST /api/v1/auth/sign-in/email against the priming server until it returns 200, rather than watching for a log line or sleeping. A seeded database with no login is worse than the bug it replaces because it looks like it worked, so the failure path is loud, names the remedy, and never reaches the second boot.

Verification

Every run below deleted .objectstack/data (and dist/) immediately before booting, since a directory that already holds a minted admin makes both paths look fine whatever the code says — the exact mistake that hid this for a round. Servers ran on ports 3173-3175; port 3000 belongs to another agent.

Acceptance — pnpm dev on an empty database

### deleting the data directory immediately before this run
exists after delete? NO
### ready after 11s
🔑 Dev admin: admin@objectos.ai / admin123 ← printed; no `Seeds:` line at all
sign-in HTTP 200
sys_user -> 1 rows duly_task -> 0 rows duly_duty -> 0 rows
duly_catalog_item -> 0 rows duly_log_entry -> 0 rows

Acceptance — pnpm demo on an empty database, one command

### deleting the data directory immediately before this run
exists after delete? NO
### demo server ready 24s after `pnpm demo` started (elapsed 26s)
1/2 preparing an admin account (quiet, a few seconds)…
1/2 done — admin account ready.
2/2 starting Duly with the demo organisation loaded…
🔑 Dev admin: admin@objectos.ai / admin123
Seeds: ai.objectstack.duly 459 rows
sign-in HTTP 200
sys_business_unit 6 · sys_user 13 · duly_catalog_item 20 · duly_duty 31
duly_assignment 2 · duly_task 186 · duly_log_entry 15 → 273 distinct rows

273 read back against 459 declared is the expected shape, not a shortfall: the two mode: 'update' backdate passes re-walk the same 186 task rows (273 + 186 = 459), which is what test/seed.test.ts has always asserted.

Reverse verification — the new guard actually goes red. Gate mutated on disk to export const dulySeeds: Seed[] = demoSeeds; (drift back into the default path), confirmed on disk by grep before running (gated=0 drift=1), restored by an EXIT trap. No rebuild is involved: both suites read the TypeScript sources, and seed.test.ts already points artifactPath at a file that cannot exist so no dist/ artifact is ever loaded. Result — 9 failed | 33 passed, all nine in demo-seed-opt-in.test.ts; seed.test.ts stayed green, which is the correct direction (the demo still lands, it is only the default that broke). Tree verified clean afterwards (0 modified).

Reverse verification — the loud failure path.scripts/demo.mjs mutated to a 20s priming budget and a --no-seed-admin priming boot, so no admin can ever be minted:

### pnpm demo EXIT=1
1/2 preparing an admin account (quiet, a few seconds)…
❌ pnpm demo failed — no account could sign in after 20s, so the demo was NOT loaded.
... Start over: rm -rf .objectstack/data && pnpm demo
Nothing was seeded by this run — the database is exactly as it was.
### did the demo ever boot? Seeds: lines in log = 0

Worth recording: the first attempt at this mutated only the environment (OS_SEED_ADMIN=0) and the handover succeeded — os dev sets OS_SEED_ADMIN itself in its serve child from its own --seed-admin flag, so a parent-side value never reaches plugin-auth. That is an ineffective mutation that reads as a pass; the mutation had to move onto the spawn arguments.

Gates, all four on the pushed commit b2df2ae, after the reverse verifications had been restored (tree: 0 modified):

validate exit=0 | ✓ Validation passed (475ms)
typecheck exit=0 | > tsc --noEmit
test exit=0 | Test Files 21 passed (21) Tests 552 passed (552)
build exit=0 | ✓ Build complete (580ms)

The one validate warning is the expected hierarchy-security capability-provider notice AGENTS.md says not to silence.

Deliberately not included

No changeset. This repo has no changeset mechanism — no .changeset/ in the tree or anywhere in git log --all, no @changesets/* dependency, no script, no mention in AGENTS.md. Adding one would mint a mechanism nothing reads.

Generated by Claude Code

---

Generated by Claude Code

[os-warren]

Reviewed — and I ran the acceptance myself, from empty data directories. Merging.

This card hid for a whole round because a reused .objectstack/data makes both paths look fine, so I did not take the report's word for it.

pnpm dev, after rm -rf .objectstack/data dist, data dir exists? NO:

🔑 Dev admin: admin@objectos.ai / admin123
(no "Seeds:" line at all)
POST /api/v1/auth/sign-in/email → 200

pnpm demo, same wipe, data dir exists? NO, one command:

1/2 preparing an admin account (quiet, a few seconds)…
1/2 done — admin account ready.
2/2 starting Duly with the demo organisation loaded…
🔑 Dev admin: admin@objectos.ai / admin123
Seeds: ai.objectstack.duly 459 rows
POST /api/v1/auth/sign-in/email → 200 · duly_task, duly_duty, sys_user all populated

A clean git clone && pnpm dev now works. That was the whole point.

Gates on the head merged with current main (this branch was cut before #80, #81, #83, #85 and #87 landed): validate 0, typecheck 0, test 0 — Test Files 23 passed, Tests 599 passed — build 0, no conflicts.

The finding beyond the scope is the one that would have sunk this

os dev --compile defaults to false and auto-compiles only when dist/objectstack.json is missing, while the seed is baked in at compile time. Without --compile on both scripts, pnpm demo's second boot would serve the seedless artifact its own priming boot had just built — printing every success message over an empty app — and a pnpm dev after a pnpm demo would serve the demo artifact, so the default would not be a default. Catching that is the difference between this working and this appearing to work.

Two more things worth recording:

• The gate wraps the whole array (dulySeeds = demoSeedRequested() ? demoSeeds : []) rather than filtering rows, so "off" is genuinely empty rather than empty-of-users. That was the distinction scope item 1 turned on, and it is easy to get wrong in a way nothing would catch.
• The handover is verified by a real sign-in returning 200, not by a log line or a sleep. The failure path exits 1, names the remedy, prints the priming log tail, and never reaches the second boot — so a broken priming step cannot produce a seeded database with no login, which is the exact state this card exists to prevent.

And the ablation note about the first mutation attempt is the most useful paragraph in the report: mutating OS_SEED_ADMIN=0 in the environment did not break the handover, because os dev sets that variable itself in its serve child from its own --seed-admin flag, so a parent-side value never reaches plugin-auth. An ineffective mutation that reads as a passing test — recognising it and moving the mutation onto the spawn arguments is exactly right.

test/seed.test.ts opting in explicitly rather than substituting the demo array by hand is also correct: it keeps the config's own wiring under test instead of testing a hand-assembled copy of it.

Noted on the report-marker sanitization — GitHub ate the HTML comment. Not worth another attempt; the second comment is legible.

---

Generated by Claude Code

[os-warren]

Fixes#73

Implements the five-item scope adjudicated on the card.

Duly is meant to be a general product, and a general product does not install 459 rows of a fictional manufacturer's org chart into every fresh deployment. Someone evaluating Duly for their own company wants an empty app to put their own duties into; someone evaluating the idea wants the demo. Those are two intentions, and now they are two commands. The login bug on a clean git clone && pnpm dev falls out of that for free — with no sys_user rows in the default seed the database is zero-user at kernel:ready, so plugin-auth mints the dev admin exactly as documented.

What changed

Scope item	Where
1. Gate dulySeeds on an explicit opt-in, default off, genuinely empty	src/data/index.ts — the demo array is exported as demoSeeds, and dulySeeds is demoSeedRequested() ? demoSeeds : []. The gate wraps the whole array rather than filtering rows, so "off" is empty, not "empty of users".
2. pnpm demo, working on a clean checkout in one command	scripts/demo.mjs + package.json. Boots once quietly with the flag off, verifies the handover with a real sign-in, stops, then boots with the flag on in the foreground.
3. README documents both as first-class choices	README.md — a two-row table under Quick start, no mention of the platform interaction.
4. A test that fails if the default seed is non-empty	test/demo-seed-opt-in.test.ts (12 cases). test/seed.test.ts now opts in explicitly.
5. A comment at the gate naming objectstack#14157	src/data/index.ts, including what collapses when it lands: pnpm demo becomes a single boot, and the gate stays.

Two things worth a reviewer's attention

Both dev and demo now boot with --compile. The seed is baked into dist/objectstack.json at compile time, and os dev's --compile defaults to false — it auto-compiles only when the artifact is missing. Without this, pnpm demo's second boot would serve the artifact its own priming boot just built (the one with no seed) and print success over an empty app; and a pnpm dev after a pnpm demo would serve the demo artifact, so the default would not be a default. Measured: default build → 0 datasets / 0 rows in the artifact; DULY_DEMO_SEED=1 build → 10 datasets / 459 rows.

The handover is verified, not assumed.scripts/demo.mjs polls POST /api/v1/auth/sign-in/email against the priming server until it returns 200, rather than watching for a log line or sleeping. A seeded database with no login is worse than the bug it replaces because it looks like it worked, so the failure path is loud, names the remedy, and never reaches the second boot.

Verification

Every run below deleted .objectstack/data (and dist/) immediately before booting, since a directory that already holds a minted admin makes both paths look fine whatever the code says — the exact mistake that hid this for a round. Servers ran on ports 3173-3175; port 3000 belongs to another agent.

Acceptance — pnpm dev on an empty database

### deleting the data directory immediately before this run
exists after delete? NO
### ready after 11s
🔑 Dev admin: admin@objectos.ai / admin123 ← printed; no `Seeds:` line at all
sign-in HTTP 200
sys_user -> 1 rows duly_task -> 0 rows duly_duty -> 0 rows
duly_catalog_item -> 0 rows duly_log_entry -> 0 rows

Acceptance — pnpm demo on an empty database, one command

### deleting the data directory immediately before this run
exists after delete? NO
### demo server ready 24s after `pnpm demo` started (elapsed 26s)
1/2 preparing an admin account (quiet, a few seconds)…
1/2 done — admin account ready.
2/2 starting Duly with the demo organisation loaded…
🔑 Dev admin: admin@objectos.ai / admin123
Seeds: ai.objectstack.duly 459 rows
sign-in HTTP 200
sys_business_unit 6 · sys_user 13 · duly_catalog_item 20 · duly_duty 31
duly_assignment 2 · duly_task 186 · duly_log_entry 15 → 273 distinct rows

273 read back against 459 declared is the expected shape, not a shortfall: the two mode: 'update' backdate passes re-walk the same 186 task rows (273 + 186 = 459), which is what test/seed.test.ts has always asserted.

Reverse verification — the new guard actually goes red. Gate mutated on disk to export const dulySeeds: Seed[] = demoSeeds; (drift back into the default path), confirmed on disk by grep before running (gated=0 drift=1), restored by an EXIT trap. No rebuild is involved: both suites read the TypeScript sources, and seed.test.ts already points artifactPath at a file that cannot exist so no dist/ artifact is ever loaded. Result — 9 failed | 33 passed, all nine in demo-seed-opt-in.test.ts; seed.test.ts stayed green, which is the correct direction (the demo still lands, it is only the default that broke). Tree verified clean afterwards (0 modified).

Reverse verification — the loud failure path.scripts/demo.mjs mutated to a 20s priming budget and a --no-seed-admin priming boot, so no admin can ever be minted:

### pnpm demo EXIT=1
1/2 preparing an admin account (quiet, a few seconds)…
❌ pnpm demo failed — no account could sign in after 20s, so the demo was NOT loaded.
... Start over: rm -rf .objectstack/data && pnpm demo
Nothing was seeded by this run — the database is exactly as it was.
### did the demo ever boot? Seeds: lines in log = 0

Worth recording: the first attempt at this mutated only the environment (OS_SEED_ADMIN=0) and the handover succeeded — os dev sets OS_SEED_ADMIN itself in its serve child from its own --seed-admin flag, so a parent-side value never reaches plugin-auth. That is an ineffective mutation that reads as a pass; the mutation had to move onto the spawn arguments.

Gates, all four on the pushed commit b2df2ae, after the reverse verifications had been restored (tree: 0 modified):

validate exit=0 | ✓ Validation passed (475ms)
typecheck exit=0 | > tsc --noEmit
test exit=0 | Test Files 21 passed (21) Tests 552 passed (552)
build exit=0 | ✓ Build complete (580ms)

The one validate warning is the expected hierarchy-security capability-provider notice AGENTS.md says not to silence.

Deliberately not included

No changeset. This repo has no changeset mechanism — no .changeset/ in the tree or anywhere in git log --all, no @changesets/* dependency, no script, no mention in AGENTS.md. Adding one would mint a mechanism nothing reads.

Generated by Claude Code

---

Generated by Claude Code

[os-warren]

Reviewed — and I ran the acceptance myself, from empty data directories. Merging.

This card hid for a whole round because a reused .objectstack/data makes both paths look fine, so I did not take the report's word for it.

pnpm dev, after rm -rf .objectstack/data dist, data dir exists? NO:

🔑 Dev admin: admin@objectos.ai / admin123
(no "Seeds:" line at all)
POST /api/v1/auth/sign-in/email → 200

pnpm demo, same wipe, data dir exists? NO, one command:

1/2 preparing an admin account (quiet, a few seconds)…
1/2 done — admin account ready.
2/2 starting Duly with the demo organisation loaded…
🔑 Dev admin: admin@objectos.ai / admin123
Seeds: ai.objectstack.duly 459 rows
POST /api/v1/auth/sign-in/email → 200 · duly_task, duly_duty, sys_user all populated

A clean git clone && pnpm dev now works. That was the whole point.

Gates on the head merged with current main (this branch was cut before #80, #81, #83, #85 and #87 landed): validate 0, typecheck 0, test 0 — Test Files 23 passed, Tests 599 passed — build 0, no conflicts.

The finding beyond the scope is the one that would have sunk this

os dev --compile defaults to false and auto-compiles only when dist/objectstack.json is missing, while the seed is baked in at compile time. Without --compile on both scripts, pnpm demo's second boot would serve the seedless artifact its own priming boot had just built — printing every success message over an empty app — and a pnpm dev after a pnpm demo would serve the demo artifact, so the default would not be a default. Catching that is the difference between this working and this appearing to work.

Two more things worth recording:

• The gate wraps the whole array (dulySeeds = demoSeedRequested() ? demoSeeds : []) rather than filtering rows, so "off" is genuinely empty rather than empty-of-users. That was the distinction scope item 1 turned on, and it is easy to get wrong in a way nothing would catch.
• The handover is verified by a real sign-in returning 200, not by a log line or a sleep. The failure path exits 1, names the remedy, prints the priming log tail, and never reaches the second boot — so a broken priming step cannot produce a seeded database with no login, which is the exact state this card exists to prevent.

And the ablation note about the first mutation attempt is the most useful paragraph in the report: mutating OS_SEED_ADMIN=0 in the environment did not break the handover, because os dev sets that variable itself in its serve child from its own --seed-admin flag, so a parent-side value never reaches plugin-auth. An ineffective mutation that reads as a passing test — recognising it and moving the mutation onto the spawn arguments is exactly right.

test/seed.test.ts opting in explicitly rather than substituting the demo array by hand is also correct: it keeps the config's own wiring under test instead of testing a hand-assembled copy of it.

Noted on the report-marker sanitization — GitHub ate the HTML comment. Not worth another attempt; the second comment is legible.

---

Generated by Claude Code

[os-warren]

Fixes#73

Implements the five-item scope adjudicated on the card.

Duly is meant to be a general product, and a general product does not install 459 rows of a fictional manufacturer's org chart into every fresh deployment. Someone evaluating Duly for their own company wants an empty app to put their own duties into; someone evaluating the idea wants the demo. Those are two intentions, and now they are two commands. The login bug on a clean git clone && pnpm dev falls out of that for free — with no sys_user rows in the default seed the database is zero-user at kernel:ready, so plugin-auth mints the dev admin exactly as documented.

What changed

Scope item	Where
1. Gate dulySeeds on an explicit opt-in, default off, genuinely empty	src/data/index.ts — the demo array is exported as demoSeeds, and dulySeeds is demoSeedRequested() ? demoSeeds : []. The gate wraps the whole array rather than filtering rows, so "off" is empty, not "empty of users".
2. pnpm demo, working on a clean checkout in one command	scripts/demo.mjs + package.json. Boots once quietly with the flag off, verifies the handover with a real sign-in, stops, then boots with the flag on in the foreground.
3. README documents both as first-class choices	README.md — a two-row table under Quick start, no mention of the platform interaction.
4. A test that fails if the default seed is non-empty	test/demo-seed-opt-in.test.ts (12 cases). test/seed.test.ts now opts in explicitly.
5. A comment at the gate naming objectstack#14157	src/data/index.ts, including what collapses when it lands: pnpm demo becomes a single boot, and the gate stays.

Two things worth a reviewer's attention

Both dev and demo now boot with --compile. The seed is baked into dist/objectstack.json at compile time, and os dev's --compile defaults to false — it auto-compiles only when the artifact is missing. Without this, pnpm demo's second boot would serve the artifact its own priming boot just built (the one with no seed) and print success over an empty app; and a pnpm dev after a pnpm demo would serve the demo artifact, so the default would not be a default. Measured: default build → 0 datasets / 0 rows in the artifact; DULY_DEMO_SEED=1 build → 10 datasets / 459 rows.

The handover is verified, not assumed.scripts/demo.mjs polls POST /api/v1/auth/sign-in/email against the priming server until it returns 200, rather than watching for a log line or sleeping. A seeded database with no login is worse than the bug it replaces because it looks like it worked, so the failure path is loud, names the remedy, and never reaches the second boot.

Verification

Every run below deleted .objectstack/data (and dist/) immediately before booting, since a directory that already holds a minted admin makes both paths look fine whatever the code says — the exact mistake that hid this for a round. Servers ran on ports 3173-3175; port 3000 belongs to another agent.

Acceptance — pnpm dev on an empty database

### deleting the data directory immediately before this run
exists after delete? NO
### ready after 11s
🔑 Dev admin: admin@objectos.ai / admin123 ← printed; no `Seeds:` line at all
sign-in HTTP 200
sys_user -> 1 rows duly_task -> 0 rows duly_duty -> 0 rows
duly_catalog_item -> 0 rows duly_log_entry -> 0 rows

Acceptance — pnpm demo on an empty database, one command

### deleting the data directory immediately before this run
exists after delete? NO
### demo server ready 24s after `pnpm demo` started (elapsed 26s)
1/2 preparing an admin account (quiet, a few seconds)…
1/2 done — admin account ready.
2/2 starting Duly with the demo organisation loaded…
🔑 Dev admin: admin@objectos.ai / admin123
Seeds: ai.objectstack.duly 459 rows
sign-in HTTP 200
sys_business_unit 6 · sys_user 13 · duly_catalog_item 20 · duly_duty 31
duly_assignment 2 · duly_task 186 · duly_log_entry 15 → 273 distinct rows

273 read back against 459 declared is the expected shape, not a shortfall: the two mode: 'update' backdate passes re-walk the same 186 task rows (273 + 186 = 459), which is what test/seed.test.ts has always asserted.

Reverse verification — the new guard actually goes red. Gate mutated on disk to export const dulySeeds: Seed[] = demoSeeds; (drift back into the default path), confirmed on disk by grep before running (gated=0 drift=1), restored by an EXIT trap. No rebuild is involved: both suites read the TypeScript sources, and seed.test.ts already points artifactPath at a file that cannot exist so no dist/ artifact is ever loaded. Result — 9 failed | 33 passed, all nine in demo-seed-opt-in.test.ts; seed.test.ts stayed green, which is the correct direction (the demo still lands, it is only the default that broke). Tree verified clean afterwards (0 modified).

Reverse verification — the loud failure path.scripts/demo.mjs mutated to a 20s priming budget and a --no-seed-admin priming boot, so no admin can ever be minted:

### pnpm demo EXIT=1
1/2 preparing an admin account (quiet, a few seconds)…
❌ pnpm demo failed — no account could sign in after 20s, so the demo was NOT loaded.
... Start over: rm -rf .objectstack/data && pnpm demo
Nothing was seeded by this run — the database is exactly as it was.
### did the demo ever boot? Seeds: lines in log = 0

Worth recording: the first attempt at this mutated only the environment (OS_SEED_ADMIN=0) and the handover succeeded — os dev sets OS_SEED_ADMIN itself in its serve child from its own --seed-admin flag, so a parent-side value never reaches plugin-auth. That is an ineffective mutation that reads as a pass; the mutation had to move onto the spawn arguments.

Gates, all four on the pushed commit b2df2ae, after the reverse verifications had been restored (tree: 0 modified):

validate exit=0 | ✓ Validation passed (475ms)
typecheck exit=0 | > tsc --noEmit
test exit=0 | Test Files 21 passed (21) Tests 552 passed (552)
build exit=0 | ✓ Build complete (580ms)

The one validate warning is the expected hierarchy-security capability-provider notice AGENTS.md says not to silence.

Deliberately not included

No changeset. This repo has no changeset mechanism — no .changeset/ in the tree or anywhere in git log --all, no @changesets/* dependency, no script, no mention in AGENTS.md. Adding one would mint a mechanism nothing reads.

Generated by Claude Code

---

Generated by Claude Code

[os-warren]

Reviewed — and I ran the acceptance myself, from empty data directories. Merging.

This card hid for a whole round because a reused .objectstack/data makes both paths look fine, so I did not take the report's word for it.

pnpm dev, after rm -rf .objectstack/data dist, data dir exists? NO:

🔑 Dev admin: admin@objectos.ai / admin123
(no "Seeds:" line at all)
POST /api/v1/auth/sign-in/email → 200

pnpm demo, same wipe, data dir exists? NO, one command:

1/2 preparing an admin account (quiet, a few seconds)…
1/2 done — admin account ready.
2/2 starting Duly with the demo organisation loaded…
🔑 Dev admin: admin@objectos.ai / admin123
Seeds: ai.objectstack.duly 459 rows
POST /api/v1/auth/sign-in/email → 200 · duly_task, duly_duty, sys_user all populated

A clean git clone && pnpm dev now works. That was the whole point.

Gates on the head merged with current main (this branch was cut before #80, #81, #83, #85 and #87 landed): validate 0, typecheck 0, test 0 — Test Files 23 passed, Tests 599 passed — build 0, no conflicts.

The finding beyond the scope is the one that would have sunk this

os dev --compile defaults to false and auto-compiles only when dist/objectstack.json is missing, while the seed is baked in at compile time. Without --compile on both scripts, pnpm demo's second boot would serve the seedless artifact its own priming boot had just built — printing every success message over an empty app — and a pnpm dev after a pnpm demo would serve the demo artifact, so the default would not be a default. Catching that is the difference between this working and this appearing to work.

Two more things worth recording:

• The gate wraps the whole array (dulySeeds = demoSeedRequested() ? demoSeeds : []) rather than filtering rows, so "off" is genuinely empty rather than empty-of-users. That was the distinction scope item 1 turned on, and it is easy to get wrong in a way nothing would catch.
• The handover is verified by a real sign-in returning 200, not by a log line or a sleep. The failure path exits 1, names the remedy, prints the priming log tail, and never reaches the second boot — so a broken priming step cannot produce a seeded database with no login, which is the exact state this card exists to prevent.

And the ablation note about the first mutation attempt is the most useful paragraph in the report: mutating OS_SEED_ADMIN=0 in the environment did not break the handover, because os dev sets that variable itself in its serve child from its own --seed-admin flag, so a parent-side value never reaches plugin-auth. An ineffective mutation that reads as a passing test — recognising it and moving the mutation onto the spawn arguments is exactly right.

test/seed.test.ts opting in explicitly rather than substituting the demo array by hand is also correct: it keeps the config's own wiring under test instead of testing a hand-assembled copy of it.

Noted on the report-marker sanitization — GitHub ate the HTML comment. Not worth another attempt; the second comment is legible.

---

Generated by Claude Code

[os-warren]

Fixes#73

Implements the five-item scope adjudicated on the card.

Duly is meant to be a general product, and a general product does not install 459 rows of a fictional manufacturer's org chart into every fresh deployment. Someone evaluating Duly for their own company wants an empty app to put their own duties into; someone evaluating the idea wants the demo. Those are two intentions, and now they are two commands. The login bug on a clean git clone && pnpm dev falls out of that for free — with no sys_user rows in the default seed the database is zero-user at kernel:ready, so plugin-auth mints the dev admin exactly as documented.

What changed

Scope item	Where
1. Gate dulySeeds on an explicit opt-in, default off, genuinely empty	src/data/index.ts — the demo array is exported as demoSeeds, and dulySeeds is demoSeedRequested() ? demoSeeds : []. The gate wraps the whole array rather than filtering rows, so "off" is empty, not "empty of users".
2. pnpm demo, working on a clean checkout in one command	scripts/demo.mjs + package.json. Boots once quietly with the flag off, verifies the handover with a real sign-in, stops, then boots with the flag on in the foreground.
3. README documents both as first-class choices	README.md — a two-row table under Quick start, no mention of the platform interaction.
4. A test that fails if the default seed is non-empty	test/demo-seed-opt-in.test.ts (12 cases). test/seed.test.ts now opts in explicitly.
5. A comment at the gate naming objectstack#14157	src/data/index.ts, including what collapses when it lands: pnpm demo becomes a single boot, and the gate stays.

Two things worth a reviewer's attention

Both dev and demo now boot with --compile. The seed is baked into dist/objectstack.json at compile time, and os dev's --compile defaults to false — it auto-compiles only when the artifact is missing. Without this, pnpm demo's second boot would serve the artifact its own priming boot just built (the one with no seed) and print success over an empty app; and a pnpm dev after a pnpm demo would serve the demo artifact, so the default would not be a default. Measured: default build → 0 datasets / 0 rows in the artifact; DULY_DEMO_SEED=1 build → 10 datasets / 459 rows.

The handover is verified, not assumed.scripts/demo.mjs polls POST /api/v1/auth/sign-in/email against the priming server until it returns 200, rather than watching for a log line or sleeping. A seeded database with no login is worse than the bug it replaces because it looks like it worked, so the failure path is loud, names the remedy, and never reaches the second boot.

Verification

Every run below deleted .objectstack/data (and dist/) immediately before booting, since a directory that already holds a minted admin makes both paths look fine whatever the code says — the exact mistake that hid this for a round. Servers ran on ports 3173-3175; port 3000 belongs to another agent.

Acceptance — pnpm dev on an empty database

### deleting the data directory immediately before this run
exists after delete? NO
### ready after 11s
🔑 Dev admin: admin@objectos.ai / admin123 ← printed; no `Seeds:` line at all
sign-in HTTP 200
sys_user -> 1 rows duly_task -> 0 rows duly_duty -> 0 rows
duly_catalog_item -> 0 rows duly_log_entry -> 0 rows

Acceptance — pnpm demo on an empty database, one command

### deleting the data directory immediately before this run
exists after delete? NO
### demo server ready 24s after `pnpm demo` started (elapsed 26s)
1/2 preparing an admin account (quiet, a few seconds)…
1/2 done — admin account ready.
2/2 starting Duly with the demo organisation loaded…
🔑 Dev admin: admin@objectos.ai / admin123
Seeds: ai.objectstack.duly 459 rows
sign-in HTTP 200
sys_business_unit 6 · sys_user 13 · duly_catalog_item 20 · duly_duty 31
duly_assignment 2 · duly_task 186 · duly_log_entry 15 → 273 distinct rows

273 read back against 459 declared is the expected shape, not a shortfall: the two mode: 'update' backdate passes re-walk the same 186 task rows (273 + 186 = 459), which is what test/seed.test.ts has always asserted.

Reverse verification — the new guard actually goes red. Gate mutated on disk to export const dulySeeds: Seed[] = demoSeeds; (drift back into the default path), confirmed on disk by grep before running (gated=0 drift=1), restored by an EXIT trap. No rebuild is involved: both suites read the TypeScript sources, and seed.test.ts already points artifactPath at a file that cannot exist so no dist/ artifact is ever loaded. Result — 9 failed | 33 passed, all nine in demo-seed-opt-in.test.ts; seed.test.ts stayed green, which is the correct direction (the demo still lands, it is only the default that broke). Tree verified clean afterwards (0 modified).

Reverse verification — the loud failure path.scripts/demo.mjs mutated to a 20s priming budget and a --no-seed-admin priming boot, so no admin can ever be minted:

### pnpm demo EXIT=1
1/2 preparing an admin account (quiet, a few seconds)…
❌ pnpm demo failed — no account could sign in after 20s, so the demo was NOT loaded.
... Start over: rm -rf .objectstack/data && pnpm demo
Nothing was seeded by this run — the database is exactly as it was.
### did the demo ever boot? Seeds: lines in log = 0

Worth recording: the first attempt at this mutated only the environment (OS_SEED_ADMIN=0) and the handover succeeded — os dev sets OS_SEED_ADMIN itself in its serve child from its own --seed-admin flag, so a parent-side value never reaches plugin-auth. That is an ineffective mutation that reads as a pass; the mutation had to move onto the spawn arguments.

Gates, all four on the pushed commit b2df2ae, after the reverse verifications had been restored (tree: 0 modified):

validate exit=0 | ✓ Validation passed (475ms)
typecheck exit=0 | > tsc --noEmit
test exit=0 | Test Files 21 passed (21) Tests 552 passed (552)
build exit=0 | ✓ Build complete (580ms)

The one validate warning is the expected hierarchy-security capability-provider notice AGENTS.md says not to silence.

Deliberately not included

No changeset. This repo has no changeset mechanism — no .changeset/ in the tree or anywhere in git log --all, no @changesets/* dependency, no script, no mention in AGENTS.md. Adding one would mint a mechanism nothing reads.

Generated by Claude Code

---

Generated by Claude Code

[os-warren]

Reviewed — and I ran the acceptance myself, from empty data directories. Merging.

This card hid for a whole round because a reused .objectstack/data makes both paths look fine, so I did not take the report's word for it.

pnpm dev, after rm -rf .objectstack/data dist, data dir exists? NO:

🔑 Dev admin: admin@objectos.ai / admin123
(no "Seeds:" line at all)
POST /api/v1/auth/sign-in/email → 200

pnpm demo, same wipe, data dir exists? NO, one command:

1/2 preparing an admin account (quiet, a few seconds)…
1/2 done — admin account ready.
2/2 starting Duly with the demo organisation loaded…
🔑 Dev admin: admin@objectos.ai / admin123
Seeds: ai.objectstack.duly 459 rows
POST /api/v1/auth/sign-in/email → 200 · duly_task, duly_duty, sys_user all populated

A clean git clone && pnpm dev now works. That was the whole point.

Gates on the head merged with current main (this branch was cut before #80, #81, #83, #85 and #87 landed): validate 0, typecheck 0, test 0 — Test Files 23 passed, Tests 599 passed — build 0, no conflicts.

The finding beyond the scope is the one that would have sunk this

os dev --compile defaults to false and auto-compiles only when dist/objectstack.json is missing, while the seed is baked in at compile time. Without --compile on both scripts, pnpm demo's second boot would serve the seedless artifact its own priming boot had just built — printing every success message over an empty app — and a pnpm dev after a pnpm demo would serve the demo artifact, so the default would not be a default. Catching that is the difference between this working and this appearing to work.

Two more things worth recording:

• The gate wraps the whole array (dulySeeds = demoSeedRequested() ? demoSeeds : []) rather than filtering rows, so "off" is genuinely empty rather than empty-of-users. That was the distinction scope item 1 turned on, and it is easy to get wrong in a way nothing would catch.
• The handover is verified by a real sign-in returning 200, not by a log line or a sleep. The failure path exits 1, names the remedy, prints the priming log tail, and never reaches the second boot — so a broken priming step cannot produce a seeded database with no login, which is the exact state this card exists to prevent.

And the ablation note about the first mutation attempt is the most useful paragraph in the report: mutating OS_SEED_ADMIN=0 in the environment did not break the handover, because os dev sets that variable itself in its serve child from its own --seed-admin flag, so a parent-side value never reaches plugin-auth. An ineffective mutation that reads as a passing test — recognising it and moving the mutation onto the spawn arguments is exactly right.

test/seed.test.ts opting in explicitly rather than substituting the demo array by hand is also correct: it keeps the config's own wiring under test instead of testing a hand-assembled copy of it.

Noted on the report-marker sanitization — GitHub ate the HTML comment. Not worth another attempt; the second comment is legible.

---

Generated by Claude Code

[os-warren]

Fixes#73

Implements the five-item scope adjudicated on the card.

Duly is meant to be a general product, and a general product does not install 459 rows of a fictional manufacturer's org chart into every fresh deployment. Someone evaluating Duly for their own company wants an empty app to put their own duties into; someone evaluating the idea wants the demo. Those are two intentions, and now they are two commands. The login bug on a clean git clone && pnpm dev falls out of that for free — with no sys_user rows in the default seed the database is zero-user at kernel:ready, so plugin-auth mints the dev admin exactly as documented.

What changed

Scope item	Where
1. Gate dulySeeds on an explicit opt-in, default off, genuinely empty	src/data/index.ts — the demo array is exported as demoSeeds, and dulySeeds is demoSeedRequested() ? demoSeeds : []. The gate wraps the whole array rather than filtering rows, so "off" is empty, not "empty of users".
2. pnpm demo, working on a clean checkout in one command	scripts/demo.mjs + package.json. Boots once quietly with the flag off, verifies the handover with a real sign-in, stops, then boots with the flag on in the foreground.
3. README documents both as first-class choices	README.md — a two-row table under Quick start, no mention of the platform interaction.
4. A test that fails if the default seed is non-empty	test/demo-seed-opt-in.test.ts (12 cases). test/seed.test.ts now opts in explicitly.
5. A comment at the gate naming objectstack#14157	src/data/index.ts, including what collapses when it lands: pnpm demo becomes a single boot, and the gate stays.

Two things worth a reviewer's attention

Both dev and demo now boot with --compile. The seed is baked into dist/objectstack.json at compile time, and os dev's --compile defaults to false — it auto-compiles only when the artifact is missing. Without this, pnpm demo's second boot would serve the artifact its own priming boot just built (the one with no seed) and print success over an empty app; and a pnpm dev after a pnpm demo would serve the demo artifact, so the default would not be a default. Measured: default build → 0 datasets / 0 rows in the artifact; DULY_DEMO_SEED=1 build → 10 datasets / 459 rows.

The handover is verified, not assumed.scripts/demo.mjs polls POST /api/v1/auth/sign-in/email against the priming server until it returns 200, rather than watching for a log line or sleeping. A seeded database with no login is worse than the bug it replaces because it looks like it worked, so the failure path is loud, names the remedy, and never reaches the second boot.

Verification

Every run below deleted .objectstack/data (and dist/) immediately before booting, since a directory that already holds a minted admin makes both paths look fine whatever the code says — the exact mistake that hid this for a round. Servers ran on ports 3173-3175; port 3000 belongs to another agent.

Acceptance — pnpm dev on an empty database

### deleting the data directory immediately before this run
exists after delete? NO
### ready after 11s
🔑 Dev admin: admin@objectos.ai / admin123 ← printed; no `Seeds:` line at all
sign-in HTTP 200
sys_user -> 1 rows duly_task -> 0 rows duly_duty -> 0 rows
duly_catalog_item -> 0 rows duly_log_entry -> 0 rows

Acceptance — pnpm demo on an empty database, one command

### deleting the data directory immediately before this run
exists after delete? NO
### demo server ready 24s after `pnpm demo` started (elapsed 26s)
1/2 preparing an admin account (quiet, a few seconds)…
1/2 done — admin account ready.
2/2 starting Duly with the demo organisation loaded…
🔑 Dev admin: admin@objectos.ai / admin123
Seeds: ai.objectstack.duly 459 rows
sign-in HTTP 200
sys_business_unit 6 · sys_user 13 · duly_catalog_item 20 · duly_duty 31
duly_assignment 2 · duly_task 186 · duly_log_entry 15 → 273 distinct rows

273 read back against 459 declared is the expected shape, not a shortfall: the two mode: 'update' backdate passes re-walk the same 186 task rows (273 + 186 = 459), which is what test/seed.test.ts has always asserted.

Reverse verification — the new guard actually goes red. Gate mutated on disk to export const dulySeeds: Seed[] = demoSeeds; (drift back into the default path), confirmed on disk by grep before running (gated=0 drift=1), restored by an EXIT trap. No rebuild is involved: both suites read the TypeScript sources, and seed.test.ts already points artifactPath at a file that cannot exist so no dist/ artifact is ever loaded. Result — 9 failed | 33 passed, all nine in demo-seed-opt-in.test.ts; seed.test.ts stayed green, which is the correct direction (the demo still lands, it is only the default that broke). Tree verified clean afterwards (0 modified).

Reverse verification — the loud failure path.scripts/demo.mjs mutated to a 20s priming budget and a --no-seed-admin priming boot, so no admin can ever be minted:

### pnpm demo EXIT=1
1/2 preparing an admin account (quiet, a few seconds)…
❌ pnpm demo failed — no account could sign in after 20s, so the demo was NOT loaded.
... Start over: rm -rf .objectstack/data && pnpm demo
Nothing was seeded by this run — the database is exactly as it was.
### did the demo ever boot? Seeds: lines in log = 0

Worth recording: the first attempt at this mutated only the environment (OS_SEED_ADMIN=0) and the handover succeeded — os dev sets OS_SEED_ADMIN itself in its serve child from its own --seed-admin flag, so a parent-side value never reaches plugin-auth. That is an ineffective mutation that reads as a pass; the mutation had to move onto the spawn arguments.

Gates, all four on the pushed commit b2df2ae, after the reverse verifications had been restored (tree: 0 modified):

validate exit=0 | ✓ Validation passed (475ms)
typecheck exit=0 | > tsc --noEmit
test exit=0 | Test Files 21 passed (21) Tests 552 passed (552)
build exit=0 | ✓ Build complete (580ms)

The one validate warning is the expected hierarchy-security capability-provider notice AGENTS.md says not to silence.

Deliberately not included

No changeset. This repo has no changeset mechanism — no .changeset/ in the tree or anywhere in git log --all, no @changesets/* dependency, no script, no mention in AGENTS.md. Adding one would mint a mechanism nothing reads.

Generated by Claude Code

---

Generated by Claude Code

[os-warren]

Reviewed — and I ran the acceptance myself, from empty data directories. Merging.

This card hid for a whole round because a reused .objectstack/data makes both paths look fine, so I did not take the report's word for it.

pnpm dev, after rm -rf .objectstack/data dist, data dir exists? NO:

🔑 Dev admin: admin@objectos.ai / admin123
(no "Seeds:" line at all)
POST /api/v1/auth/sign-in/email → 200

pnpm demo, same wipe, data dir exists? NO, one command:

1/2 preparing an admin account (quiet, a few seconds)…
1/2 done — admin account ready.
2/2 starting Duly with the demo organisation loaded…
🔑 Dev admin: admin@objectos.ai / admin123
Seeds: ai.objectstack.duly 459 rows
POST /api/v1/auth/sign-in/email → 200 · duly_task, duly_duty, sys_user all populated

A clean git clone && pnpm dev now works. That was the whole point.

Gates on the head merged with current main (this branch was cut before #80, #81, #83, #85 and #87 landed): validate 0, typecheck 0, test 0 — Test Files 23 passed, Tests 599 passed — build 0, no conflicts.

The finding beyond the scope is the one that would have sunk this

os dev --compile defaults to false and auto-compiles only when dist/objectstack.json is missing, while the seed is baked in at compile time. Without --compile on both scripts, pnpm demo's second boot would serve the seedless artifact its own priming boot had just built — printing every success message over an empty app — and a pnpm dev after a pnpm demo would serve the demo artifact, so the default would not be a default. Catching that is the difference between this working and this appearing to work.

Two more things worth recording:

• The gate wraps the whole array (dulySeeds = demoSeedRequested() ? demoSeeds : []) rather than filtering rows, so "off" is genuinely empty rather than empty-of-users. That was the distinction scope item 1 turned on, and it is easy to get wrong in a way nothing would catch.
• The handover is verified by a real sign-in returning 200, not by a log line or a sleep. The failure path exits 1, names the remedy, prints the priming log tail, and never reaches the second boot — so a broken priming step cannot produce a seeded database with no login, which is the exact state this card exists to prevent.

And the ablation note about the first mutation attempt is the most useful paragraph in the report: mutating OS_SEED_ADMIN=0 in the environment did not break the handover, because os dev sets that variable itself in its serve child from its own --seed-admin flag, so a parent-side value never reaches plugin-auth. An ineffective mutation that reads as a passing test — recognising it and moving the mutation onto the spawn arguments is exactly right.

test/seed.test.ts opting in explicitly rather than substituting the demo array by hand is also correct: it keeps the config's own wiring under test instead of testing a hand-assembled copy of it.

Noted on the report-marker sanitization — GitHub ate the HTML comment. Not worth another attempt; the second comment is legible.

---

Generated by Claude Code

[os-warren]

Fixes#73

Implements the five-item scope adjudicated on the card.

Duly is meant to be a general product, and a general product does not install 459 rows of a fictional manufacturer's org chart into every fresh deployment. Someone evaluating Duly for their own company wants an empty app to put their own duties into; someone evaluating the idea wants the demo. Those are two intentions, and now they are two commands. The login bug on a clean git clone && pnpm dev falls out of that for free — with no sys_user rows in the default seed the database is zero-user at kernel:ready, so plugin-auth mints the dev admin exactly as documented.

What changed

Scope item	Where
1. Gate dulySeeds on an explicit opt-in, default off, genuinely empty	src/data/index.ts — the demo array is exported as demoSeeds, and dulySeeds is demoSeedRequested() ? demoSeeds : []. The gate wraps the whole array rather than filtering rows, so "off" is empty, not "empty of users".
2. pnpm demo, working on a clean checkout in one command	scripts/demo.mjs + package.json. Boots once quietly with the flag off, verifies the handover with a real sign-in, stops, then boots with the flag on in the foreground.
3. README documents both as first-class choices	README.md — a two-row table under Quick start, no mention of the platform interaction.
4. A test that fails if the default seed is non-empty	test/demo-seed-opt-in.test.ts (12 cases). test/seed.test.ts now opts in explicitly.
5. A comment at the gate naming objectstack#14157	src/data/index.ts, including what collapses when it lands: pnpm demo becomes a single boot, and the gate stays.

Two things worth a reviewer's attention

Both dev and demo now boot with --compile. The seed is baked into dist/objectstack.json at compile time, and os dev's --compile defaults to false — it auto-compiles only when the artifact is missing. Without this, pnpm demo's second boot would serve the artifact its own priming boot just built (the one with no seed) and print success over an empty app; and a pnpm dev after a pnpm demo would serve the demo artifact, so the default would not be a default. Measured: default build → 0 datasets / 0 rows in the artifact; DULY_DEMO_SEED=1 build → 10 datasets / 459 rows.

The handover is verified, not assumed.scripts/demo.mjs polls POST /api/v1/auth/sign-in/email against the priming server until it returns 200, rather than watching for a log line or sleeping. A seeded database with no login is worse than the bug it replaces because it looks like it worked, so the failure path is loud, names the remedy, and never reaches the second boot.

Verification

Every run below deleted .objectstack/data (and dist/) immediately before booting, since a directory that already holds a minted admin makes both paths look fine whatever the code says — the exact mistake that hid this for a round. Servers ran on ports 3173-3175; port 3000 belongs to another agent.

Acceptance — pnpm dev on an empty database

### deleting the data directory immediately before this run
exists after delete? NO
### ready after 11s
🔑 Dev admin: admin@objectos.ai / admin123 ← printed; no `Seeds:` line at all
sign-in HTTP 200
sys_user -> 1 rows duly_task -> 0 rows duly_duty -> 0 rows
duly_catalog_item -> 0 rows duly_log_entry -> 0 rows

Acceptance — pnpm demo on an empty database, one command

### deleting the data directory immediately before this run
exists after delete? NO
### demo server ready 24s after `pnpm demo` started (elapsed 26s)
1/2 preparing an admin account (quiet, a few seconds)…
1/2 done — admin account ready.
2/2 starting Duly with the demo organisation loaded…
🔑 Dev admin: admin@objectos.ai / admin123
Seeds: ai.objectstack.duly 459 rows
sign-in HTTP 200
sys_business_unit 6 · sys_user 13 · duly_catalog_item 20 · duly_duty 31
duly_assignment 2 · duly_task 186 · duly_log_entry 15 → 273 distinct rows

273 read back against 459 declared is the expected shape, not a shortfall: the two mode: 'update' backdate passes re-walk the same 186 task rows (273 + 186 = 459), which is what test/seed.test.ts has always asserted.

Reverse verification — the new guard actually goes red. Gate mutated on disk to export const dulySeeds: Seed[] = demoSeeds; (drift back into the default path), confirmed on disk by grep before running (gated=0 drift=1), restored by an EXIT trap. No rebuild is involved: both suites read the TypeScript sources, and seed.test.ts already points artifactPath at a file that cannot exist so no dist/ artifact is ever loaded. Result — 9 failed | 33 passed, all nine in demo-seed-opt-in.test.ts; seed.test.ts stayed green, which is the correct direction (the demo still lands, it is only the default that broke). Tree verified clean afterwards (0 modified).

Reverse verification — the loud failure path.scripts/demo.mjs mutated to a 20s priming budget and a --no-seed-admin priming boot, so no admin can ever be minted:

### pnpm demo EXIT=1
1/2 preparing an admin account (quiet, a few seconds)…
❌ pnpm demo failed — no account could sign in after 20s, so the demo was NOT loaded.
... Start over: rm -rf .objectstack/data && pnpm demo
Nothing was seeded by this run — the database is exactly as it was.
### did the demo ever boot? Seeds: lines in log = 0

Worth recording: the first attempt at this mutated only the environment (OS_SEED_ADMIN=0) and the handover succeeded — os dev sets OS_SEED_ADMIN itself in its serve child from its own --seed-admin flag, so a parent-side value never reaches plugin-auth. That is an ineffective mutation that reads as a pass; the mutation had to move onto the spawn arguments.

Gates, all four on the pushed commit b2df2ae, after the reverse verifications had been restored (tree: 0 modified):

validate exit=0 | ✓ Validation passed (475ms)
typecheck exit=0 | > tsc --noEmit
test exit=0 | Test Files 21 passed (21) Tests 552 passed (552)
build exit=0 | ✓ Build complete (580ms)

The one validate warning is the expected hierarchy-security capability-provider notice AGENTS.md says not to silence.

Deliberately not included

No changeset. This repo has no changeset mechanism — no .changeset/ in the tree or anywhere in git log --all, no @changesets/* dependency, no script, no mention in AGENTS.md. Adding one would mint a mechanism nothing reads.

Generated by Claude Code

---

Generated by Claude Code

[os-warren]

Reviewed — and I ran the acceptance myself, from empty data directories. Merging.

This card hid for a whole round because a reused .objectstack/data makes both paths look fine, so I did not take the report's word for it.

pnpm dev, after rm -rf .objectstack/data dist, data dir exists? NO:

🔑 Dev admin: admin@objectos.ai / admin123
(no "Seeds:" line at all)
POST /api/v1/auth/sign-in/email → 200

pnpm demo, same wipe, data dir exists? NO, one command:

1/2 preparing an admin account (quiet, a few seconds)…
1/2 done — admin account ready.
2/2 starting Duly with the demo organisation loaded…
🔑 Dev admin: admin@objectos.ai / admin123
Seeds: ai.objectstack.duly 459 rows
POST /api/v1/auth/sign-in/email → 200 · duly_task, duly_duty, sys_user all populated

A clean git clone && pnpm dev now works. That was the whole point.

Gates on the head merged with current main (this branch was cut before #80, #81, #83, #85 and #87 landed): validate 0, typecheck 0, test 0 — Test Files 23 passed, Tests 599 passed — build 0, no conflicts.

The finding beyond the scope is the one that would have sunk this

os dev --compile defaults to false and auto-compiles only when dist/objectstack.json is missing, while the seed is baked in at compile time. Without --compile on both scripts, pnpm demo's second boot would serve the seedless artifact its own priming boot had just built — printing every success message over an empty app — and a pnpm dev after a pnpm demo would serve the demo artifact, so the default would not be a default. Catching that is the difference between this working and this appearing to work.

Two more things worth recording:

• The gate wraps the whole array (dulySeeds = demoSeedRequested() ? demoSeeds : []) rather than filtering rows, so "off" is genuinely empty rather than empty-of-users. That was the distinction scope item 1 turned on, and it is easy to get wrong in a way nothing would catch.
• The handover is verified by a real sign-in returning 200, not by a log line or a sleep. The failure path exits 1, names the remedy, prints the priming log tail, and never reaches the second boot — so a broken priming step cannot produce a seeded database with no login, which is the exact state this card exists to prevent.

And the ablation note about the first mutation attempt is the most useful paragraph in the report: mutating OS_SEED_ADMIN=0 in the environment did not break the handover, because os dev sets that variable itself in its serve child from its own --seed-admin flag, so a parent-side value never reaches plugin-auth. An ineffective mutation that reads as a passing test — recognising it and moving the mutation onto the spawn arguments is exactly right.

test/seed.test.ts opting in explicitly rather than substituting the demo array by hand is also correct: it keeps the config's own wiring under test instead of testing a hand-assembled copy of it.

Noted on the report-marker sanitization — GitHub ate the HTML comment. Not worth another attempt; the second comment is legible.

---

Generated by Claude Code

[os-warren]

Fixes#73

Implements the five-item scope adjudicated on the card.

Duly is meant to be a general product, and a general product does not install 459 rows of a fictional manufacturer's org chart into every fresh deployment. Someone evaluating Duly for their own company wants an empty app to put their own duties into; someone evaluating the idea wants the demo. Those are two intentions, and now they are two commands. The login bug on a clean git clone && pnpm dev falls out of that for free — with no sys_user rows in the default seed the database is zero-user at kernel:ready, so plugin-auth mints the dev admin exactly as documented.

What changed

Scope item	Where
1. Gate dulySeeds on an explicit opt-in, default off, genuinely empty	src/data/index.ts — the demo array is exported as demoSeeds, and dulySeeds is demoSeedRequested() ? demoSeeds : []. The gate wraps the whole array rather than filtering rows, so "off" is empty, not "empty of users".
2. pnpm demo, working on a clean checkout in one command	scripts/demo.mjs + package.json. Boots once quietly with the flag off, verifies the handover with a real sign-in, stops, then boots with the flag on in the foreground.
3. README documents both as first-class choices	README.md — a two-row table under Quick start, no mention of the platform interaction.
4. A test that fails if the default seed is non-empty	test/demo-seed-opt-in.test.ts (12 cases). test/seed.test.ts now opts in explicitly.
5. A comment at the gate naming objectstack#14157	src/data/index.ts, including what collapses when it lands: pnpm demo becomes a single boot, and the gate stays.

Two things worth a reviewer's attention

Both dev and demo now boot with --compile. The seed is baked into dist/objectstack.json at compile time, and os dev's --compile defaults to false — it auto-compiles only when the artifact is missing. Without this, pnpm demo's second boot would serve the artifact its own priming boot just built (the one with no seed) and print success over an empty app; and a pnpm dev after a pnpm demo would serve the demo artifact, so the default would not be a default. Measured: default build → 0 datasets / 0 rows in the artifact; DULY_DEMO_SEED=1 build → 10 datasets / 459 rows.

The handover is verified, not assumed.scripts/demo.mjs polls POST /api/v1/auth/sign-in/email against the priming server until it returns 200, rather than watching for a log line or sleeping. A seeded database with no login is worse than the bug it replaces because it looks like it worked, so the failure path is loud, names the remedy, and never reaches the second boot.

Verification

Every run below deleted .objectstack/data (and dist/) immediately before booting, since a directory that already holds a minted admin makes both paths look fine whatever the code says — the exact mistake that hid this for a round. Servers ran on ports 3173-3175; port 3000 belongs to another agent.

Acceptance — pnpm dev on an empty database

### deleting the data directory immediately before this run
exists after delete? NO
### ready after 11s
🔑 Dev admin: admin@objectos.ai / admin123 ← printed; no `Seeds:` line at all
sign-in HTTP 200
sys_user -> 1 rows duly_task -> 0 rows duly_duty -> 0 rows
duly_catalog_item -> 0 rows duly_log_entry -> 0 rows

Acceptance — pnpm demo on an empty database, one command

### deleting the data directory immediately before this run
exists after delete? NO
### demo server ready 24s after `pnpm demo` started (elapsed 26s)
1/2 preparing an admin account (quiet, a few seconds)…
1/2 done — admin account ready.
2/2 starting Duly with the demo organisation loaded…
🔑 Dev admin: admin@objectos.ai / admin123
Seeds: ai.objectstack.duly 459 rows
sign-in HTTP 200
sys_business_unit 6 · sys_user 13 · duly_catalog_item 20 · duly_duty 31
duly_assignment 2 · duly_task 186 · duly_log_entry 15 → 273 distinct rows

273 read back against 459 declared is the expected shape, not a shortfall: the two mode: 'update' backdate passes re-walk the same 186 task rows (273 + 186 = 459), which is what test/seed.test.ts has always asserted.

Reverse verification — the new guard actually goes red. Gate mutated on disk to export const dulySeeds: Seed[] = demoSeeds; (drift back into the default path), confirmed on disk by grep before running (gated=0 drift=1), restored by an EXIT trap. No rebuild is involved: both suites read the TypeScript sources, and seed.test.ts already points artifactPath at a file that cannot exist so no dist/ artifact is ever loaded. Result — 9 failed | 33 passed, all nine in demo-seed-opt-in.test.ts; seed.test.ts stayed green, which is the correct direction (the demo still lands, it is only the default that broke). Tree verified clean afterwards (0 modified).

Reverse verification — the loud failure path.scripts/demo.mjs mutated to a 20s priming budget and a --no-seed-admin priming boot, so no admin can ever be minted:

### pnpm demo EXIT=1
1/2 preparing an admin account (quiet, a few seconds)…
❌ pnpm demo failed — no account could sign in after 20s, so the demo was NOT loaded.
... Start over: rm -rf .objectstack/data && pnpm demo
Nothing was seeded by this run — the database is exactly as it was.
### did the demo ever boot? Seeds: lines in log = 0

Worth recording: the first attempt at this mutated only the environment (OS_SEED_ADMIN=0) and the handover succeeded — os dev sets OS_SEED_ADMIN itself in its serve child from its own --seed-admin flag, so a parent-side value never reaches plugin-auth. That is an ineffective mutation that reads as a pass; the mutation had to move onto the spawn arguments.

Gates, all four on the pushed commit b2df2ae, after the reverse verifications had been restored (tree: 0 modified):

validate exit=0 | ✓ Validation passed (475ms)
typecheck exit=0 | > tsc --noEmit
test exit=0 | Test Files 21 passed (21) Tests 552 passed (552)
build exit=0 | ✓ Build complete (580ms)

The one validate warning is the expected hierarchy-security capability-provider notice AGENTS.md says not to silence.

Deliberately not included

No changeset. This repo has no changeset mechanism — no .changeset/ in the tree or anywhere in git log --all, no @changesets/* dependency, no script, no mention in AGENTS.md. Adding one would mint a mechanism nothing reads.

Generated by Claude Code

---

Generated by Claude Code

[os-warren]

Reviewed — and I ran the acceptance myself, from empty data directories. Merging.

This card hid for a whole round because a reused .objectstack/data makes both paths look fine, so I did not take the report's word for it.

pnpm dev, after rm -rf .objectstack/data dist, data dir exists? NO:

🔑 Dev admin: admin@objectos.ai / admin123
(no "Seeds:" line at all)
POST /api/v1/auth/sign-in/email → 200

pnpm demo, same wipe, data dir exists? NO, one command:

1/2 preparing an admin account (quiet, a few seconds)…
1/2 done — admin account ready.
2/2 starting Duly with the demo organisation loaded…
🔑 Dev admin: admin@objectos.ai / admin123
Seeds: ai.objectstack.duly 459 rows
POST /api/v1/auth/sign-in/email → 200 · duly_task, duly_duty, sys_user all populated

A clean git clone && pnpm dev now works. That was the whole point.

Gates on the head merged with current main (this branch was cut before #80, #81, #83, #85 and #87 landed): validate 0, typecheck 0, test 0 — Test Files 23 passed, Tests 599 passed — build 0, no conflicts.

The finding beyond the scope is the one that would have sunk this

os dev --compile defaults to false and auto-compiles only when dist/objectstack.json is missing, while the seed is baked in at compile time. Without --compile on both scripts, pnpm demo's second boot would serve the seedless artifact its own priming boot had just built — printing every success message over an empty app — and a pnpm dev after a pnpm demo would serve the demo artifact, so the default would not be a default. Catching that is the difference between this working and this appearing to work.

Two more things worth recording:

• The gate wraps the whole array (dulySeeds = demoSeedRequested() ? demoSeeds : []) rather than filtering rows, so "off" is genuinely empty rather than empty-of-users. That was the distinction scope item 1 turned on, and it is easy to get wrong in a way nothing would catch.
• The handover is verified by a real sign-in returning 200, not by a log line or a sleep. The failure path exits 1, names the remedy, prints the priming log tail, and never reaches the second boot — so a broken priming step cannot produce a seeded database with no login, which is the exact state this card exists to prevent.

And the ablation note about the first mutation attempt is the most useful paragraph in the report: mutating OS_SEED_ADMIN=0 in the environment did not break the handover, because os dev sets that variable itself in its serve child from its own --seed-admin flag, so a parent-side value never reaches plugin-auth. An ineffective mutation that reads as a passing test — recognising it and moving the mutation onto the spawn arguments is exactly right.

test/seed.test.ts opting in explicitly rather than substituting the demo array by hand is also correct: it keeps the config's own wiring under test instead of testing a hand-assembled copy of it.

Noted on the report-marker sanitization — GitHub ate the HTML comment. Not worth another attempt; the second comment is legible.

---

Generated by Claude Code

[os-warren]

Fixes#73

Implements the five-item scope adjudicated on the card.

Duly is meant to be a general product, and a general product does not install 459 rows of a fictional manufacturer's org chart into every fresh deployment. Someone evaluating Duly for their own company wants an empty app to put their own duties into; someone evaluating the idea wants the demo. Those are two intentions, and now they are two commands. The login bug on a clean git clone && pnpm dev falls out of that for free — with no sys_user rows in the default seed the database is zero-user at kernel:ready, so plugin-auth mints the dev admin exactly as documented.

What changed

Scope item	Where
1. Gate dulySeeds on an explicit opt-in, default off, genuinely empty	src/data/index.ts — the demo array is exported as demoSeeds, and dulySeeds is demoSeedRequested() ? demoSeeds : []. The gate wraps the whole array rather than filtering rows, so "off" is empty, not "empty of users".
2. pnpm demo, working on a clean checkout in one command	scripts/demo.mjs + package.json. Boots once quietly with the flag off, verifies the handover with a real sign-in, stops, then boots with the flag on in the foreground.
3. README documents both as first-class choices	README.md — a two-row table under Quick start, no mention of the platform interaction.
4. A test that fails if the default seed is non-empty	test/demo-seed-opt-in.test.ts (12 cases). test/seed.test.ts now opts in explicitly.
5. A comment at the gate naming objectstack#14157	src/data/index.ts, including what collapses when it lands: pnpm demo becomes a single boot, and the gate stays.

Two things worth a reviewer's attention

Both dev and demo now boot with --compile. The seed is baked into dist/objectstack.json at compile time, and os dev's --compile defaults to false — it auto-compiles only when the artifact is missing. Without this, pnpm demo's second boot would serve the artifact its own priming boot just built (the one with no seed) and print success over an empty app; and a pnpm dev after a pnpm demo would serve the demo artifact, so the default would not be a default. Measured: default build → 0 datasets / 0 rows in the artifact; DULY_DEMO_SEED=1 build → 10 datasets / 459 rows.

The handover is verified, not assumed.scripts/demo.mjs polls POST /api/v1/auth/sign-in/email against the priming server until it returns 200, rather than watching for a log line or sleeping. A seeded database with no login is worse than the bug it replaces because it looks like it worked, so the failure path is loud, names the remedy, and never reaches the second boot.

Verification

Every run below deleted .objectstack/data (and dist/) immediately before booting, since a directory that already holds a minted admin makes both paths look fine whatever the code says — the exact mistake that hid this for a round. Servers ran on ports 3173-3175; port 3000 belongs to another agent.

Acceptance — pnpm dev on an empty database

### deleting the data directory immediately before this run
exists after delete? NO
### ready after 11s
🔑 Dev admin: admin@objectos.ai / admin123 ← printed; no `Seeds:` line at all
sign-in HTTP 200
sys_user -> 1 rows duly_task -> 0 rows duly_duty -> 0 rows
duly_catalog_item -> 0 rows duly_log_entry -> 0 rows

Acceptance — pnpm demo on an empty database, one command

### deleting the data directory immediately before this run
exists after delete? NO
### demo server ready 24s after `pnpm demo` started (elapsed 26s)
1/2 preparing an admin account (quiet, a few seconds)…
1/2 done — admin account ready.
2/2 starting Duly with the demo organisation loaded…
🔑 Dev admin: admin@objectos.ai / admin123
Seeds: ai.objectstack.duly 459 rows
sign-in HTTP 200
sys_business_unit 6 · sys_user 13 · duly_catalog_item 20 · duly_duty 31
duly_assignment 2 · duly_task 186 · duly_log_entry 15 → 273 distinct rows

273 read back against 459 declared is the expected shape, not a shortfall: the two mode: 'update' backdate passes re-walk the same 186 task rows (273 + 186 = 459), which is what test/seed.test.ts has always asserted.

Reverse verification — the new guard actually goes red. Gate mutated on disk to export const dulySeeds: Seed[] = demoSeeds; (drift back into the default path), confirmed on disk by grep before running (gated=0 drift=1), restored by an EXIT trap. No rebuild is involved: both suites read the TypeScript sources, and seed.test.ts already points artifactPath at a file that cannot exist so no dist/ artifact is ever loaded. Result — 9 failed | 33 passed, all nine in demo-seed-opt-in.test.ts; seed.test.ts stayed green, which is the correct direction (the demo still lands, it is only the default that broke). Tree verified clean afterwards (0 modified).

Reverse verification — the loud failure path.scripts/demo.mjs mutated to a 20s priming budget and a --no-seed-admin priming boot, so no admin can ever be minted:

### pnpm demo EXIT=1
1/2 preparing an admin account (quiet, a few seconds)…
❌ pnpm demo failed — no account could sign in after 20s, so the demo was NOT loaded.
... Start over: rm -rf .objectstack/data && pnpm demo
Nothing was seeded by this run — the database is exactly as it was.
### did the demo ever boot? Seeds: lines in log = 0

Worth recording: the first attempt at this mutated only the environment (OS_SEED_ADMIN=0) and the handover succeeded — os dev sets OS_SEED_ADMIN itself in its serve child from its own --seed-admin flag, so a parent-side value never reaches plugin-auth. That is an ineffective mutation that reads as a pass; the mutation had to move onto the spawn arguments.

Gates, all four on the pushed commit b2df2ae, after the reverse verifications had been restored (tree: 0 modified):

validate exit=0 | ✓ Validation passed (475ms)
typecheck exit=0 | > tsc --noEmit
test exit=0 | Test Files 21 passed (21) Tests 552 passed (552)
build exit=0 | ✓ Build complete (580ms)

The one validate warning is the expected hierarchy-security capability-provider notice AGENTS.md says not to silence.

Deliberately not included

No changeset. This repo has no changeset mechanism — no .changeset/ in the tree or anywhere in git log --all, no @changesets/* dependency, no script, no mention in AGENTS.md. Adding one would mint a mechanism nothing reads.

Generated by Claude Code

---

Generated by Claude Code

[os-warren]

Reviewed — and I ran the acceptance myself, from empty data directories. Merging.

This card hid for a whole round because a reused .objectstack/data makes both paths look fine, so I did not take the report's word for it.

pnpm dev, after rm -rf .objectstack/data dist, data dir exists? NO:

🔑 Dev admin: admin@objectos.ai / admin123
(no "Seeds:" line at all)
POST /api/v1/auth/sign-in/email → 200

pnpm demo, same wipe, data dir exists? NO, one command:

1/2 preparing an admin account (quiet, a few seconds)…
1/2 done — admin account ready.
2/2 starting Duly with the demo organisation loaded…
🔑 Dev admin: admin@objectos.ai / admin123
Seeds: ai.objectstack.duly 459 rows
POST /api/v1/auth/sign-in/email → 200 · duly_task, duly_duty, sys_user all populated

A clean git clone && pnpm dev now works. That was the whole point.

Gates on the head merged with current main (this branch was cut before #80, #81, #83, #85 and #87 landed): validate 0, typecheck 0, test 0 — Test Files 23 passed, Tests 599 passed — build 0, no conflicts.

The finding beyond the scope is the one that would have sunk this

os dev --compile defaults to false and auto-compiles only when dist/objectstack.json is missing, while the seed is baked in at compile time. Without --compile on both scripts, pnpm demo's second boot would serve the seedless artifact its own priming boot had just built — printing every success message over an empty app — and a pnpm dev after a pnpm demo would serve the demo artifact, so the default would not be a default. Catching that is the difference between this working and this appearing to work.

Two more things worth recording:

• The gate wraps the whole array (dulySeeds = demoSeedRequested() ? demoSeeds : []) rather than filtering rows, so "off" is genuinely empty rather than empty-of-users. That was the distinction scope item 1 turned on, and it is easy to get wrong in a way nothing would catch.
• The handover is verified by a real sign-in returning 200, not by a log line or a sleep. The failure path exits 1, names the remedy, prints the priming log tail, and never reaches the second boot — so a broken priming step cannot produce a seeded database with no login, which is the exact state this card exists to prevent.

And the ablation note about the first mutation attempt is the most useful paragraph in the report: mutating OS_SEED_ADMIN=0 in the environment did not break the handover, because os dev sets that variable itself in its serve child from its own --seed-admin flag, so a parent-side value never reaches plugin-auth. An ineffective mutation that reads as a passing test — recognising it and moving the mutation onto the spawn arguments is exactly right.

test/seed.test.ts opting in explicitly rather than substituting the demo array by hand is also correct: it keeps the config's own wiring under test instead of testing a hand-assembled copy of it.

Noted on the report-marker sanitization — GitHub ate the HTML comment. Not worth another attempt; the second comment is legible.

---

Generated by Claude Code