QA run · scan-functionality 14-item scope · 7 pass / 7 fail (14/14 adjudicated) · 79ebb37 · 2026-08-21

[baozhoutao]

Run record for the checklist-test execution of the 14 items authored by the 2026-08-20 scoped scan-functionality (扫描功能) sweep (PR #10147). Text-only durable record; product defects are extracted as their own cards (listed at the end). Fixtures learned + checklist-accuracy corrections flow back to the items as revisions, not filed here.

Environment fingerprint

• framework: 79ebb37 (branch claude/new-session-0pv25p; runtime identical to main a659896, delta docs-only)
• objectui pin: .objectui-sha 82a94170… — console not built; every item ran api/cli surface (2FA browser lanes are blocked(dependency) by design, no app mounts sys_two_factor)
• app: examples/app-showcase, SqlDriver(better-sqlite3), --seed-admin (admin@objectos.ai); 2FA items armed with OS_AUTH_TWO_FACTOR=true before boot
• isolation: one idle port + one file DB per item (4301–4314), scratch under /tmp/qa-*/; no repo-tree writes
• CLI entry: packages/cli/bin/run.js (see env-fact correction below)
• runner: parallel checklist-test runner agents (opus), Tier-1 pins executed first per RUNNER rule 6
• dates: 2026-08-21 UTC

Scope — selector: the 14 new items (id-list), + 3 revisions touched

Each verdict is valid only for the revision it ran against (all rev 1 unless noted).

Per-item verdicts

item	rev	derived	clauses	note
identity-auth.two-factor-enrollment-reveal	1	pass	6/6	otpauth payload parses, backup codes present, resultDialog paths resolve
identity-auth.two-factor-verify-to-activate	1	pass	5/5	inert-until-verified holds; verified defaultValue probe NOT realized (better-auth writes it explicitly)
identity-auth.two-factor-backup-codes	1	fail	5/6	crypto/behavioral core sound + encrypted at rest; clause 5 (no-resultDialog lockout) confirmed
identity-auth.two-factor-disable-lifecycle	1	pass	6/6	wrong-password disable refused server-side; teardown complete; stale creds dead
cli.doctor-health-report	1	fail	7/8	health report works; clause 7 expected-fail (✓ over unexamined tree) reproduced
cli.doctor-deprecation-scan	1	fail	5/6	scanner correct; clause 6 expected-fail (dead codemod hint) reproduced
cli.migrate-duplicates-inventory	1	fail	6/7	scan correct; clause 7 (no_sql_seam loud-refusal is dead code) failed
cli.datasource-introspect-codegen	1	fail	0/6 (1 blocked)	all three os datasource subcommands non-functional (response-envelope mismatch)
cli.hook-body-extraction-gates	1	fail	4/7	security net intact; clauses 0/3/6 failed (details below)
cli.lint-severity-exit-contract	1	pass	7/7	VERIFY-FIRST item fully accurate; both its own sketch corrections confirmed
integration-system.external-schema-introspection	1	fail	4/5	clause 2 (introspected primary key dropped from object-draft) failed
integration-system.external-schema-drift-gate	1	pass	6/6	fail/warn/ignore arms all proven; checkOnBoot declared-but-unenforced confirmed
attachments-storage.field-accept-maxsize-server-enforced	1	pass	7/7	enforcement pre-write; documented boundaries scored correctly; D13 wire-500 recorded
platform-core.interrupted-migration-boot-report	1	pass	5/5	boot proceeds, journal byte-identical, unresumable prescription printed

Tier-1 pins run and green as clause evidence: remote-tables-twin.equivalence 9/9, admin-routes 30/30, external-validation-plugin 13/13, list-diagnosed-consumer-sweep 9/9, file-reference-lifecycle 50/50, migration-recovery-plugin 11/11, four doctor-* pins 80 total, duplicates.* 35.

Reproduction rules per fail (auth/authz carve-out applied where noted)

cli.datasource-introspect-codegen — response-envelope mismatch (clauses 0,1,2,4,5). All three os datasource subcommands read the pre-#3843 flat shape (body.tables/body.draft/body.results, body.error as a string) while the server emits the wrapped envelope ({success:true,data:{…}} / {success:false,error:{code,message}}). Repro: boot showcase, mint admin token, os datasource list-tables showcase_external --url <U> --token <T> → No remote tables found. exit 0, oracle GET …/external/tables = {success:true,data:{tables:[{customers,7},{orders,7}]}}; introspect … --table customers → Error: Failed to generate draft exit 2; unknown-ds → TypeError: first argument must be a string or instance of Error (passing the error object to this.error). validate silently returns No federated objects to validate. exit 0 even against induced drift the oracle flags missing_column region severity:error — a silent CI-breaking pass. Fix: unwrap body.data.* and body.error?.message in list-tables.ts/introspect.ts/validate.ts. Secondary: the generated draft fails os build as-is (object name lacks ${namespace}_ prefix; no sharingModel).

integration-system.external-schema-introspection — object-draft drops the primary key (clause 2). POST /api/v1/datasources/showcase_external/object-draft {"table":"customers"} → 200 but definition.fields.id is {"type":"text"}, no primaryKey:true, though the remote table declares primary key (id). Mechanism: SqlDriver.introspectSchema sets col.isPrimary (sql-driver.ts:9698) while ExternalDatasourceService.generateObjectDraft reads col.primaryKey — a contract-spelling collision (objectql/util.ts isPrimary? vs spec/contracts primaryKey). Silent on every SQL driver; confirmed in shipped dist; reproduced on both fixture tables. The existing pin misses it because its fake schema hand-writes primaryKey:true. Impact: a reviewed federated object commits with no PK.

cli.migrate-duplicates-inventory — no_sql_seam loud-refusal is dead for the memory driver (clause 7). os migrate duplicates --database-url memory://qa → exit 0 with a clean empty report instead of {error:"no_sql_seam"} exit 1. InMemoryDriver.execute() is a no-op returning null (not absent, not throwing), so resolveSeedTenancyExec returns a non-null exec and the if (!exec) guard at duplicates.ts:697 never fires — the "indistinguishable from never looked" false all-clear #8928 exists to prevent. Reproduced across 3 URL variants.

cli.hook-body-extraction-gates (clauses 0,3,6). Clause 6 (encoded expected-fail, confirmed): a default os build silently warn-and-bundles forbidden patterns, contradicting extract-hook-body.ts:14-18's "no silent fallback" (docs hook-bodies.mdx:256 agree with the code, both against the header). Clause 3 (new product/docs gap): the // @capabilities override is unreachable through os build — esbuild strips // comments during TS-config load, so it never survives to String(fn); the pin masks it by feeding raw JS literals. Clause 0 (assertion defect): require() is rewritten to __require by esbuild, so the require() FORBIDDEN pattern is dead — the refusal fires via the free-identifier gate instead (still exit 1). Security net intact throughout: no forbidden body ever shipped as body.source.

cli.doctor-deprecation-scan — dead remediation prescription (clause 6, expected-fail confirmed). os doctor --scan-deprecations prints Run `objectstack codemod v2-to-v3` to auto-fix. (doctor.ts:2149); os codemod v2-to-v3 → exit 2 "command not found". The real path is os migrate meta; docs backward-compatibility.mdx:134 already admit the command is "not yet available". The five feature clauses (file:line attribution, --verbose replacements, warns-not-gates, decoys skipped, absent-src honesty) all pass.

cli.doctor-health-report — ✓ over an unexamined tree (clause 7, expected-fail confirmed). In a stock create-objectstack scaffold with no <cwd>/packages/spec/src, os doctor prints ✓ Test coverage and ✓ Deprecations about a tree it never walked (findMissingTests/findDeprecatedUsages early-return [] at doctor.ts:1141-1143/1159-1161, then the else prints the ✓). Violates doctor's own withhold-the-✓ discipline (:2063-2065). Adjacent same-class noise: ⚠ @objectstack/spec Not built. All seven real health checks pass.

identity-auth.two-factor-backup-codes — regenerate lockout (clause 5). sys_user.generate_backup_codes (the only navigable regenerate surface) has no resultDialog; it toasts "New backup codes generated — save them somewhere safe" while never showing them and the old set dies instantly (sys_two_factor.regenerate_backup_codes has the reveal dialog but is mounted in no app). The QR-bearing enrollment surface has the same shape. Codes are genuinely one-shot (no re-reveal endpoint), which is what makes the toast-only surface a lockout rather than an inconvenience. Crypto core sound: single-use, wholesale invalidation on regeneration, password+session gated, encrypted at rest (no plaintext in sys_two_factor.backup_codes).

Auth/authz findings — detail withheld pending maintainer (RUNNER rule 2 carve-out)

Existence recorded; reproductions withheld from GitHub entirely, held in the runner session for maintainer review:

• identity-auth.two-factor-verify-to-activate / -enrollment-reveal · re-enrollment secret-rotation posture · detail withheld pending maintainer
• identity-auth.two-factor-enrollment-reveal · verify-totp token not accepted on the bearer seam (fail-closed lockout) · detail withheld pending maintainer
• integration-system.external-schema-introspection · federation-spelling entitlement posture under open self-signup · detail withheld pending maintainer
• attachments-storage.field-accept-maxsize-server-enforced · whether a non-admin file owner can null sys_file mime/size to neutralize the re-check (hypothesis; admin-only proven) · detail withheld pending maintainer

Fixture gaps / environment facts learned

• CLI entry: packages/cli/dist/index.js is a re-export barrel that exits 0 with no output for any argv — a convincing fake "boots clean." Real entry is packages/cli/bin/run.js; the root node_modules/.bin/objectstack does not exist in this checkout. (Independently hit by 8 runners.)
• os dev has no --no-ui flag (it is --ui opt-in, no allowNo; --no-ui exits 2). RUNNER's absence-inference row describes serve, not dev.
• qa-media-constraints area recipe replayed literally (both steps 2xx) — proven live at 79ebb37; the pre-未知键静默剥离仍是全仓默认:把 #3405 的 strict 收紧从一个 schema 推广到整个可授权面(ADR-0078 完整性闸门) #4001 silent-strip hypothesis in its knownGaps is disproven.
• external ?schema= narrowing is unobservable on the sqlite fixture (unqualified table names) — a postgres fixture is needed to score it live.

Extraction candidates (product defects → standalone cards at close-out)

Net-new: datasource CLI envelope mismatch; object-draft PK-drop; migrate duplicates no_sql_seam dead code; hook @capabilities override dead through os build. Confirmed-live and already tracked in PR #10147 FOLLOW-UPS §7c: doctor ✓-over-unexamined-tree (D12), backup-codes regenerate lockout (D10), dead codemod prescription, FileConstraintError sanitized-500 (D13). Checklist-accuracy corrections (columnCount 5→7, clause-3 md5→logical-dump oracle, clause-5/require over-specs, lint suggestion fixture, checkOnBoot declared≠enforced) close out through the sweep's revisions, not extracted.