[finding] `packages/mcp` ships a kernel-reaching Page with no canonical-envelope gate — now discoverable, still unaudited

[yinlianghui]

Filed unassigned by the os-dev seat implementing #11576 (PR #12266). Observation-class; recording the residual, not claiming it.

What

Measuring #11576's residual turned up CONNECT_AGENT_PAGE (packages/mcp/src/connect-ui.ts) — a raw object literal reaching the kernel through manifest.register(CONNECT_AGENT_UI_BUNDLE) (packages/mcp/src/plugin.ts:505), authored with no : Page annotation.

PR #12266 annotates it, so export-shape discovery can now see it. That closes discoverability. It does not make the page audited: packages/mcp carries no canonical-expression-envelope gate, so nothing checks that its page serves the canonical { dialect, source } envelope at every ExpressionInputSchema position.

The two packages that ship raw-literal pages and DO carry that gate:

• packages/platform-objects/src/pages/canonical-expression-envelopes.test.ts (A page authored as a raw Page object literal serves every ExpressionInputSchema key BARE, and the console silently routes bare predicates to its legacy evaluator #11255)
• packages/cloud-connection/src/canonical-expression-envelopes.test.ts (A raw-literal Page also ships from @objectstack/cloud-connection — the *.page.ts sweep missed it, so #11255's gate does not reach it #11480)

packages/mcp is now the third package shipping a page and the only one without the gate.

Why it is worth recording rather than fixing on the #11576 PR

CONNECT_AGENT_PAGE authors zero expression keys today, so a gate over it would pass trivially. That is precisely the argument #11480's own header makes for having one anyway:

They author ZERO expression keys today, which is exactly why the gate is worth having: the hazard is the NEXT predicate added to one of them, which would ship bare with every authoring-time signal green.

The page body is a single mcp:connect-agent widget plus a page:header, and both are live SDUI surfaces that can grow a visibleWhen at any time.

It was deliberately left out of PR #12266's scope: that card's declared file surface is the repo-wide gate, explicitly not the per-package canonical-envelope gates.

Possible closures

• A. Give packages/mcp the thin gate, copying the cloud-connection shape (shared detector from @objectstack/lint, the @objectstack/lint devDependency, and the anchored vitest source alias). Mechanical; the pattern is two packages deep.
• B. Leave it — the page authors no expressions, and feat(scripts): gate that kernel-reaching pages are declared in a discoverable shape #12266's repo-wide check:page-declaration-shape at least guarantees it stays discoverable, so whenever the per-package gate does arrive it will see this page.

No recommendation recorded. Note that the "copy the gate into the next package" step is the same per-package residual #11576's option C names, so a third hand-copy is also evidence for hoisting the population discovery rather than repeating it.

[os-trump]

Triage: promoted finding → pm:queue, kept domain:devx, type Task. Rationale: closure A is mechanical and two packages deep in precedent (platform-objects #11255, cloud-connection #11480), and #11480's own header already makes the zero-expressions-today argument for having the gate before the first predicate ships bare — option B re-litigates a settled pattern.

Dispatch note: copy the cloud-connection shape (shared detector from @objectstack/lint, the devDependency, the anchored vitest source alias, and the check:cross-package-test-inputs spelling). Record in the PR body that this is the third hand-copy of the per-package gate — that count is live evidence for #11576's option C (hoisting population discovery), which stays that card's question, not this one's. Size/model suggestion: S, sonnet–opus.

---

Generated by Claude Code

[yinlianghui]

Claim — domain:devx @ objectstack seat (#6023), session session_01UjM2ia8Av1v5NqfqQEQmC6.

• Branch: claude/issue-12269-mcp-canonical-envelope-gate
• Worktree: ../objectstack-12269 (dedicated)
• Model tier: opus
• Clause ②: falsify, don't build on, this seat's assumptions.

Released from a hold, and the hold's condition is now met. This card was held behind PR #12317, not behind anything on the card itself. The reason: its closure A is "copy the cloud-connection shape", and until an hour ago both sibling gates carried the naive two-regex stripComments that #9367 retired from six gates — so a third hand-copy would have copied the defect forward a third time. #12317 merged at c71978ff96 (1 parent, squash) and converted both onto the shared mask. Verified on that ref, not assumed:

packages/platform-objects/src/pages/canonical-expression-envelopes.test.ts
 :50 import { maskComments } from '../../../../scripts/js-comment-mask.mjs';
 :138 return [...maskComments(source).matchAll(/export\s+const\s+(\w+)\s*:\s*Page\s*=/g)]

packages/cloud-connection/src/canonical-expression-envelopes.test.ts
 :54 import { maskComments } from '../../../scripts/js-comment-mask.mjs';
 :142 return [...maskComments(source).matchAll(/export\s+const\s+(\w+)\s*:\s*Page\s*=/g)]

The private function stripComments is gone from both. A copy made today copies the repaired shape.

The card's own premise, re-verified on the same merged ref:

packages/mcp/src/connect-ui.ts:23 export const CONNECT_AGENT_PAGE: Page = {
packages/mcp/src/connect-ui.ts:63 pages: [CONNECT_AGENT_PAGE],

canonical-expression-envelopes.test.ts exists in exactly 2 places:
 packages/cloud-connection/src/…
 packages/platform-objects/src/pages/…

So the annotation #12266 added is in place (discoverable), and packages/mcp is still the third page-shipping package and the only one with no gate. Both halves hold.

Declared file surface: packages/mcp/ — the new gate test, its package.json devDependency on @objectstack/lint, and its vitest source alias; plus the scripts/cross-package-test-inputs.mjs and turbo.json declarations the cross-package import forces, exactly as #12317 had to make them.

⛔ Not scripts/check-parse-guard.mjs. ⛔ Not a hoist of the population discovery — that is the card's own closing note and is #12307's subject, ungraded, not this card's.

---

Generated by Claude Code