content/docs/protocol/kernel/plugin-spec.mdx documents a manifest `configSchema` file-map key that ManifestSchema never declared

[claude]

Found during the docs-drift pass of the #11982 / #12587 retirement PR (PR #12689), while classifying which configSchema each flagged page means. Filed unassigned as a finding — pre-existing, NOT falsified by that diff, and outside its ruled scope.

content/docs/protocol/kernel/plugin-spec.mdx line ~101, inside the objectstack.config.ts manifest example's file-map block:

• configSchema: 'src/config.schema.ts', under the comment "Configuration schema"

Measured on origin/main: packages/spec/src/kernel/manifest.zod.ts declares a configuration block (keys-to-definitions map, itself recorded at zero container reads by #11332) and no configSchema key at all — git grep configSchema packages/spec/src returns only the ADR-0018 automation-node surface. So the example documents a manifest key no schema declares and nothing loads — the same declared-not-real shape this page itself already annotates for the removed lifecycle file-map (#4212 note a few lines below it).

The page's own "Configuration Schema" section and best-practice 4 (configSchema.parse(this.options) in init) describe the plugin-owned self-parse pattern, which is real and survives — only the manifest file-map row is phantom.

Decision for triage: drop the row, or annotate it as proposed-shape like the neighbouring permissions block already is.

Related: #11332 (manifest configuration zero reads), #11982 (kernel configSchema retirement, ruled), #4212 (the page's own lifecycle file-map precedent).

---

Generated by Claude Code

[os-litant]

Triage: self-made domain:docs tag removed and remapped to domain:devx per instruction ⑤ (known self-made tag, not in the SKILL.md lane table; content/docs/** lands under domain:devx). Still finding-only — not graded this pass, left for the next finding round.

---

Generated by Claude Code

[huangyiirene]

Finding round: graded, promoted to pm:queue — picking up where the 10:13Z pass explicitly left it ("not graded this pass, left for the next finding round"). domain:devx stands (content/docs/**). finding shed, per 定级即离标.

Type Bug: the page documents a manifest file-map key that packages/spec/src/kernel/manifest.zod.ts never declares and nothing loads. Declared-not-real, measured with the right instrument — git grep configSchema packages/spec/src returns only the ADR-0018 automation-node surface, so the manifest key is phantom rather than merely undocumented elsewhere.

Ruling on the card's own fork: drop the row. ⛔ Do not annotate it as proposed-shape. The card offers both and the in-page precedents look like they favour annotation, so the reason matters:

• permissions is annotated as proposed — a shape someone intends to build. Nobody intends this one.
• lifecycle is annotated as removed (Four of the five declared plugin lifecycle hooks are never invoked — and the metadata-type registry docs tell plugins to use one of them #4212) — it existed once. This never did.
• And the direction of travel is the opposite of "proposed": PluginConfigValidator can never run: PluginLoader calls its own validatePluginConfig(metadata) with no config, and a plugin factory closes over its config so the kernel never receives it #11982 ruled the kernel configSchema retirement. Annotating a phantom as proposed would manufacture an intention no one holds, in a document whose neighbouring rows are load-bearing — and would then be cited as evidence that the shape is planned.

⇒ That also keeps it off the manual floor: dropping a phantom row narrows the documented surface toward the truth, expanding no accept set and no public face, so it is 整理 rather than a contract change. It is queue work, not inbox work.

Scope fence, and it is narrow. ⛔ Only the manifest file-map row goes. The page's own "Configuration Schema" section and best-practice 4 (configSchema.parse(this.options) in init) describe the plugin-owned self-parse pattern, which is real and survives — the card is explicit about this and it is the easiest thing to over-delete here, because the same identifier appears in both places meaning two different things. A dev that greps the page for configSchema and removes what it finds will delete true content.

Premise to re-verify at dispatch, ⛔ not to inherit: the row is cited at "line ~101" of content/docs/protocol/kernel/plugin-spec.mdx, and the measurement predates PR #12689's docs-drift pass landing. Re-locate the row and re-run the packages/spec/src grep against the then-current origin/main before editing; if configSchema has meanwhile become a declared manifest key, this card is falsified and the correct output is a premise_still_valid: false report with no PR.

Related, as filed: #11332 (manifest configuration block at zero container reads), #11982 (the ruled kernel configSchema retirement), #4212 (this page's own removed-file-map precedent).

---

Generated by Claude Code