[finding] check:liveness warns on 11 unregistered dogfood proof tags — proof-registry.mts lags the dogfood test tree

[os-elon]

Observation recorded while running pnpm --filter @objectstack/spec check:liveness on the #10576 worktree (2026-08-21, branch claude/issue-10576-aggregate-per-filter, base dd8172ee2). The gate PASSES — this is its warning channel, not a failure — but it currently prints:

⚠ 11 unregistered dogfood proof tag(s) — add to proof-registry.mts

The eleven @proof: tags, each present in a packages/qa/dogfood/test/*.dogfood.test.ts file and absent from proof-registry.mts:

• admin-credential-lifecycle
• admin-route-nonadmin-refusal
• attachments-parent-rls-count-parity
• attachments-parent-rls-scan-cap
• attachments-public-read-acl
• attachments-unscoped-delete-gate
• no-active-organization-write-refusal
• org-scoped-sharing-rule-listing
• sharing-rule-org-less-caller
• showcase-crud-persona-matrix
• showcase-fls-read-mask-strip

Why it is worth a card rather than silence: the proof registry is what lets liveness-ledger entries BIND a high-risk verdict to an executable dogfood proof (check:liveness verifies "all bound high-risk proofs resolve"). A proof tag that exists on disk but not in the registry is a proof no ledger entry can cite — the drift accumulates one warning line at a time and nothing ever goes red. Registering them is mechanical (add entries to proof-registry.mts); deciding whether any of the eleven should also be bound to a ledger entry is the judgment half.

Pre-existing on main (none of the eleven tags is touched by #10576's diff); found during, not caused by, that card's verification.

[huangyiirene]

Triage (finding round): promoted → pm:queue, domain:spec (fix lands in proof-registry.mts / check:liveness, spec tooling), type Task. Scope split per the card: registering the eleven tags is mechanical and dispatchable; deciding which of them should be bound to a liveness-ledger entry is the judgment half — the dev should register all eleven, propose bindings with one-line rationale each, and leave adoption to the spec seat's review rather than binding unilaterally.

---

Generated by Claude Code

[os-elon]

Claim: PM loop round 2 (slot reuse after #10618 collection)
Session: session_01B4h3medzvhB9rpfoja9jcw
Branch: claude/issue-10773-proof-registry-tags
Worktree: objectstack-issue-10773
Domain: domain:spec (spec toolchain — check:liveness proof registry)
File surface: proof-registry.mts (+ its own test/self-check if the registry carries one); packages/qa/dogfood/test/*.dogfood.test.ts READ-ONLY; ⛔ no liveness-ledger binding edits — bindings are PROPOSED in the PR body per the triage ruling (13:11Z), adoption is the spec seat's review
Container & model: S, mode:subagent, model: opus — mechanical registration + proposal writing, no gate-semantics design; Clause-②: no (tooling registry, no contract acceptance change)
Serial constraints: disjoint from in-flight #9249 (ui/component.zod.ts + ADR-0087 registry — fenced), #10655 (docs host), landing #10930 (lint scripts). H17 index (13:55Z sweep): no trigger-file hit on this surface.

---

Generated by Claude Code

[os-elon]

os-dev-report

{
 "issue": 10773,
 "status": "done",
 "branch": "claude/issue-10773-proof-registry-tags",
 "pr": "https://github.com/objectstack-ai/objectstack/pull/10934",
 "premise_still_valid": true,
 "summary": "Premise re-verified on today's main (3d7deb7000): the same eleven unregistered @proof: tags, no delta from the card's dd8172ee2 snapshot — none registered since, none new. Registered all eleven in packages/spec/scripts/liveness/proof-registry.mts, each with its grep-verified proofRef and a summary of the break it guards. Per the triage ruling (13:11Z) every entry is bound:false with an honest blockedReason and NO liveness-ledger entry was touched; the binding judgment is delivered as a per-tag proposal table in the PR body. Three have a fitting ledger entry (permission.fields.readable for showcase-fls-read-mask-strip — the strongest, the file authors readable:false and asserts key-absence both ways; permission.objects.allowCreate/allowRead/allowEdit/allowDelete for showcase-crud-persona-matrix, with a scope question; permission.systemPermissions for sharing-rule-org-less-caller, blocked on re-verifying that entry's note, which scopes it narrower than the proof measures). The other eight have no authorable surface and each names the surface it actually guards. The registry does NOT structurally couple registration to binding — bound:false + blockedReason is the file's existing shape, and the proof-registry.test.ts BOUND_PROOF_PATHS pin is unchanged, which is itself the check that nothing was bound silently.",
 "tests": "Gate union derived at final commit 23e27af370 with `node scripts/pm/dispatch-gates.mjs` (no hand-fed paths; it took the change set from the merge base itself — 1 path, committed). Exits captured to files before any pipe. POSITIVE CONTROL: before `⚠ 11 unregistered dogfood proof tag(s) — add to proof-registry.mts:` / after zero ⚠ lines; a diff of the two full gate outputs shows exactly one change — the 13-line warning block deleted, bound-class list and 364/364 evidence-path resolution identical. check:liveness exits 0 in BOTH states (warning channel, not a failure), so the readout is the warning line, never the exit code. REVERSE LEG: removed the fls-read-strip entry from the committed registry, mutation confirmed on disk BEFORE measuring (anchor `id: 'fls-read-strip'` grep-count 1 → 0, `git diff --stat` showing the 24 deleted lines — an editor's exit code is not evidence), gate then printed `⚠ 1 unregistered dogfood proof tag(s)`; restore ran from an `EXIT INT TERM` trap and is byte-identical (`git status --porcelain` empty) with the gate green again. No rebuild leg applies and none is claimed: check:liveness runs `tsx scripts/liveness/check-liveness.mts`, importing the registry from source — there is no dist/ between edit and measurement. GATES (12 matched families, all exit 0): @objectstack/spec check:liveness (its ✓ summary line, zero ⚠), check:empty-state, check:strictness-ledger, check:variant-docs, check:merge-driver, check:slot-lookup, check:test-source-alias, check:type-source-resolution, check-ci-filter-parity.mjs, check-plugin-teardown-shape.mjs, docs-audit/check-affected-docs.mjs, check-dev-prereqs.mjs --self-test (`✓ every verdict reachable … (16 cases)`), plus check-nul-bytes.mjs and a direct control-byte scan of the changed file. AFFECTED PACKAGE via scripts/pm/os-verify-lock.sh: `pnpm --filter @objectstack/spec test` → `Test Files 415 passed (415)` / `Tests 11062 passed (11062)`, lock `VERDICT command-exit 0 · held the lock 435s`; `pnpm --filter @objectstack/spec typecheck` → 0 across all three legs (tsc --noEmit, check:scripts-typecheck which is what compiles this .mts, check:test-typecheck), lock `VERDICT command-exit 0 · held 67s`. Zero-match trap checked: the banner `@objectstack/spec@17.1.0 test` is echoed in both logs. No dependency-closure build needed — packages/spec declares no workspace deps (pg-connection-string, zod only). DECLARED NARROWING, one item: check:dev-prereqs's SCAN half reds on a fresh worktree ('67 of 67 workspace packages declare an entry point under dist/ that is not on disk') — an unbuilt-worktree precondition independent of a diff that adds no package, and NOT the form CI runs: lint.yml invokes `node scripts/check-dev-prereqs.mjs --self-test` under the step name 'Self-test the dev-prereqs gate (self-test half only, never the scan)', whose own comment states it 'vouches for the gate's verdict paths, never for this workspace'. That CI form is green. Repo-wide `pnpm lint` was not run locally — CI's run. CHANGESET: none, re-derived not assumed — packages/spec's published `files` set is dist, json-schema, liveness, prompts, llms.txt, README.md, src/**/*.zod.ts, CHANGELOG.md, api-surface, spec-changes.json; the one changed file is under scripts/, not in that set (the `liveness` entry is the ledger JSON dir packages/spec/liveness/, untouched). skip-changeset label applied as a read-then-union write and READ BACK: labels are now [size/m, tooling, skip-changeset] — the bot's `tooling` survived and so did mine.",
 "open_questions": [
 {
 "question": "Should showcase-crud-persona-matrix bind all four permission.objects.allow* entries, or a subset? (Proposal only — not implemented, per the triage ruling.)",
 "options": [
 "A: bind all four (allowCreate/allowRead/allowEdit/allowDelete) — the cells map one-to-one, both directions per cell, and the exact allow/deny split is asserted so the sweep cannot shrink quietly; multi-entry binding has precedent in semantic-roles, which binds three",
 "B: bind a chosen subset and leave the rest citing no proof",
 "C: leave unbound as a breadth guard, the way permission-model-zoo is handled"
 ],
 "recommendation": "A, because unlike permission-model-zoo (a breadth guard over a whole ADR with no single owner) each of the four cells has exactly one owning property and the file exercises each in both directions. The seat should confirm it is comfortable with one proof anchoring four entries."
 },
 {
 "question": "permission.systemPermissions' ledger note reads 'PARTIAL — app-entry/nav visibility only, not a general capability gate' (evidence: hono-plugin.ts:1222), but sharing-rule-org-less-caller measures manage_sharing acting as a real data-layer boundary at the sharing service (ADR-0111 D6). Is the note stale?",
 "options": [
 "A: re-verify and correct the note, then bind sharing-rule-org-less-caller to the entry",
 "B: leave the note and leave the proof unbound",
 "C: correct the note in a separate card and decide the binding afterwards"
 ],
 "recommendation": "A or C — the substantive point is that the note and the proof describe different consumers, so binding as-is would cite an entry describing something narrower than what is proven. I did not touch either the note or the binding: both are ledger edits and therefore the spec seat's review."
 }
 ],
 "out_of_scope_findings": []
}

---

Generated by Claude Code