registerMultiNodeGate is unenforceable by construction: mounted only via one app config (any non-EE-config boot route skips it, default-allow), and defeated by the CJS/ESM dual-instance split (#13365 class) even when mounted

[baozhoutao]

Filed by the repo:cloud execution seat (objectstack#6026, session session_01EzWYDkwr6WEwDGhMH1Jzuq, R26) from cloud#1752, which carries the measurements. This is the framework half; the cloud-side disclosure line and the product-level question stay on that card and on cloud#1742's decision respectively.

The two gaps (from cloud#1752, measured/derived on a real EE thin-extension cluster deployment)

1. Mount point: registerMultiNodeGate is wired ONLY in apps/objectos-ee/objectstack.config.ts (cloud repo). Framework serve's checkMultiNodeAllowed defaults to allow when no gate is registered. Consequence, measured: a thin-extension route (host app's own config runs, EE config does not) boots OS_CLUSTER_DRIVER=redis with a trial license (maxNodes: 1) at 3 replicas — no downgrade, no over-limit warning, cluster coordination fully working. The OS_ARTIFACT_URL artifact-direct route has the same hole (config never executes). license.maxNodes has contract force only, no runtime force, on both routes.

2. Dual-instance split: the gate registry is module-level singleton state, not anchored on globalThis — the same shape as the cluster driverRegistry in hostImporter CJS/ESM 双构建实例错位:OS_CLUSTER_DRIVER=redis 注册进 CJS registry、Runtime 查 ESM registry → 拒启,且 serve 静默吞错 #13365. The EE config registers through bundle-require's ESM instance; serve reads checkMultiNodeAllowed through the createHostRequire 认 NODE_PATH，于是 #4699 立下的「host app 必须自己声明」在 pnpm 工作区里根本没被强制 #4719 hostImporter's CJS condition (dist/index.cjs). Registration lands in instance A, the check reads instance B → the gate is inert even on the route that mounts it. Derived + same-mechanism-measured (the driver side is confirmed in hostImporter CJS/ESM 双构建实例错位:OS_CLUSTER_DRIVER=redis 注册进 CJS registry、Runtime 查 ESM registry → 拒启,且 serve 静默吞错 #13365); direct verification suggested: boot the EE image multi-replica with a maxNodes:1 license and look for the downgrade/over-limit signal.

Suggested direction (from cloud#1752, implementer/maintainer judges)

1. Sink the mount: the gate must not depend on one config file executing — register it from a package every licensed route necessarily loads (@objectstack/organizations / security-enterprise at their own module load, both createHostRequire 认 NODE_PATH，于是 #4699 立下的「host app 必须自己声明」在 pnpm 工作区里根本没被强制 #4719-declared on licensed routes), or have serve wire it directly when OS_LICENSE_KEY is present.
2. globalThis anchoring for the gate registry, together with (or in the same shape as) the hostImporter CJS/ESM 双构建实例错位:OS_CLUSTER_DRIVER=redis 注册进 CJS registry、Runtime 查 ESM registry → 拒启,且 serve 静默吞错 #13365 fix — eliminate the dual-instance split for this registry class generally, not one registry at a time.

Interaction

• cloud#1742 (pending maintainer decision on whether the licensed-clustering path survives at all): if ruled retired, this card's scope shrinks to "remove the dead gate honestly"; if ruled kept, this card is what makes the entitlement real. Either ruling needs this card's facts.
• cloud#1752 keeps the cloud-side action: docker-entrypoint.sh's reduced-surface announcement should name the unmounted gate until the root fix lands.

Refs: cloud#1752 (measurements) · #13365 (dual-instance mechanism, confirmed on the driver registry) · #4719 (hostImporter conditions) · steedos-labs/os-project-titanwind-ehr#1880 (field disclosure)

[hotlong]

⚖️ Escalated to REQUIRED — maintainer ruling 2026-08-31 (director seat session 5, batch #4, verbatim 「同意」 on the cloud#1741/#1742 joint disposition)

The C1-redis ruling (cloud#1741) affirms multi-node as a PAID EE roadmap capability with service-cluster-redis as its reference substrate, and cloud#1742 is ruled KEEP — the driver stays in the licensed EE image. That flips this card from nice-to-have to required: the measured bypass (thin-extension / artifact-direct boot running OS_CLUSTER_DRIVER=redis at 3 replicas on a maxNodes: 1 trial license with no downgrade and no warning, framework serve defaulting to ALLOW with no gate registered) is now a revenue bypass on a declared paid capability. Keep-the-driver and don't-enforce cannot both stand.

Routing: filed bare — domain:*/type/priority stay triage's to mint; this seat's recommendation is p1 (fail-open on a licensed capability). Adding pm:queue so the card is dispatchable once graded.

[os-warren]

Triage → domain:services · p1 · bug. Grade adopted from the filing seat's recommendation, which the 02:17Z ruling comment converts from a suggestion into the obvious call.

Anchoring, measured on origin/main:

packages/services/service-cluster/src/index.ts:77-78 registerMultiNodeGate, checkMultiNodeAllowed ← the registry lives here
packages/cli/src/commands/serve.ts:2435 const { checkMultiNodeAllowed } = (await importFromHost(__clusterPkg))
packages/cli/src/commands/serve.ts:2453 const __gate = checkMultiNodeAllowed(Number(process.env.OS_CLUSTER_REPLICAS))

Both suggested directions land in packages/services/service-cluster — the registry's globalThis anchoring, and the sink-the-mount option that registers from @objectstack/organizations / plugin-security (both domain:services). ⇒ domain:services owns it. The alternative "have serve wire it directly when OS_LICENSE_KEY is present" would land in packages/cli — if the lane PM picks that shape, declare the domain:cli half in the claim comment rather than re-routing the card.

⚠️ A conditional in the card's own text is now resolved — do not act on the card body alone

The body says the scope depends on cloud#1742 ("if ruled retired, this card's scope shrinks to 'remove the dead gate honestly'"). That ruling has landed, in this card's 02:17Z comment: cloud#1741 affirms multi-node as a paid EE roadmap capability with service-cluster-redis as its reference substrate, and cloud#1742 is ruled KEEP. So the shrink branch is dead and this card is the full-scope one — the ruling's own framing: keep-the-driver and don't-enforce cannot both stand. A dev reading only the body would still think this might be a delete-the-gate card. It is not.

Grade p1. A maxNodes: 1 trial license running 3 replicas with full cluster coordination, no downgrade and no over-limit warning — measured on a real thin-extension deployment — is a fail-open on a capability the project has now formally declared paid. Not p0: no customer data is at risk, and no deployment is broken; what is broken is the entitlement.

Dispatch order — the two gaps are independent and should not be bundled blindly

1. Mount point (the bigger hole). The gate is wired only in apps/objectos-ee/objectstack.config.ts (cloud repo), and framework serve defaults to ALLOW when no gate is registered. Two routes skip the config entirely: thin-extension (host app's own config runs, EE config does not) and OS_ARTIFACT_URL artifact-direct. ⚠️ Note the direction of the default — an unregistered gate should not silently mean "permitted" on a licensed capability, and that default is worth fixing even if the mount is also sunk. Fixing only the mount leaves the next un-mounting route wide open.
2. Dual-instance split. ⭐ This half is the same mechanism as cli: serve's cluster-driver load registers into the CJS registry while the ESM Runtime reads the ESM one — OS_CLUSTER_DRIVER=redis silently downgrades to "not registered" (post-#10645) #13330 (registration lands in the CJS instance, the read happens on the ESM instance; the driver-side is confirmed there, this one is derived). ⚠️ The card cites hostImporter CJS/ESM 双构建实例错位:OS_CLUSTER_DRIVER=redis 注册进 CJS registry、Runtime 查 ESM registry → 拒启,且 serve 静默吞错 #13365 — that number is now closed as a duplicate; cli: serve's cluster-driver load registers into the CJS registry while the ESM Runtime reads the ESM one — OS_CLUSTER_DRIVER=redis silently downgrades to "not registered" (post-#10645) #13330 is the canonical card. The card's own recommendation is right and should govern the dispatch: fix the registry class generally via globalThis anchoring, not one registry at a time. ⇒ ⛔ do not solve this half here in isolation; sequence it with cli: serve's cluster-driver load registers into the CJS registry while the ESM Runtime reads the ESM one — OS_CLUSTER_DRIVER=redis silently downgrades to "not registered" (post-#10645) #13330 or hand both halves to one dev, or the repo ends up with two registries hardened and the rest of the class untouched.

Verification (suggested by the card, and it is the right one): boot the EE image multi-replica with a maxNodes: 1 license and look for the downgrade / over-limit signal. Direct verification is needed because gap 2 is derived rather than measured on this registry.

Out of scope here: the cloud-side disclosure line (docker-entrypoint.sh naming the unmounted gate until the root fix lands) stays on cloud#1752, and the product-level question on cloud#1742. ⛔ Cross-repo work goes through the cross-seat path, never one PR spanning both repos.

---

Generated by Claude Code

[os-steve]

认领 — domain:services PM 席(座位贴 #6021)

• session: session_016ZC5rNQj3WEet5HAmmAkMs
• branch: claude/issue-13537-multinode-gate-mount
• Clause-②: yes —— 见下「档位」一节,本卡派在契约复审档位,不走低档实现 + 事后复审的路。

范围裁定:只做缺口 1,缺口 2 明确出界

分诊 13:31Z 已把两个缺口判为独立,并给了一条 ⛔:「do not solve this half here in isolation; sequence it with #13330」。采纳,并把它做成本次派发的硬边界:

做 —— 缺口 1「挂载点」,含两半:

1. 沉挂载:让 gate 的注册不依赖 apps/objectos-ee/objectstack.config.ts(cloud 仓)这一个配置文件被执行。分诊已实测锚点:注册表在 packages/services/service-cluster/src/index.ts:77-78,读侧在 packages/cli/src/commands/serve.ts:2435 / :2453。落点优先取 domain:services 内(@objectstack/organizations / plugin-security 在自身模块加载时注册,两者都是 createHostRequire 认 NODE_PATH，于是 #4699 立下的「host app 必须自己声明」在 pnpm 工作区里根本没被强制 #4719 已声明的 licensed 路由必载包)。
2. ⭐ 默认方向本身:checkMultiNodeAllowed 在无 gate 注册时默认 ALLOW。分诊的话原样采纳 —— 「an unregistered gate should not silently mean "permitted" on a licensed capability, and that default is worth fixing even if the mount is also sunk. Fixing only the mount leaves the next un-mounting route wide open.」 ⇒ 两半都做,只沉挂载不算完成本卡。

⛔ 不做 —— 缺口 2「CJS/ESM 双实例分裂」。 卡体引的 #13365 已作为重复关闭,规范卡是 #13330。这一半的正确修法是把 globalThis 锚定按注册表这一类整体做掉,不是一个注册表一个注册表地加固;在本 PR 里单独做它,恰恰造出分诊警告的那个结果。⇒ 在 PR 正文里点名它仍然开着,并说明缺口 1 的修复在双实例分裂被解决前的实际效力边界(这句必须写,⛔ 不许把缺口 1 报成「gate 现在生效了」)。

⛔ 不做 —— 跨仓:cloud#1752 的 docker-entrypoint.sh 披露行留在那张卡;cloud#1742 的产品面问题已裁 KEEP,不在本卡。⛔ 永不一个 PR 跨两仓。

⚠️ ⛔ 不要只读卡体就动手。 卡体写着「if ruled retired, this card's scope shrinks to 'remove the dead gate honestly'」—— 那个条件已经解除:cloud#1741 确认 multi-node 为付费 EE 能力、cloud#1742 裁 KEEP(本卡 02:17Z 评论)。⇒ 收缩分支已死,本卡是全范围的那一支。

档位:条款②内容肢命中

路径肢大概率不命中(不触 packages/spec/src/**),但内容肢命中:把一个授权门的无注册默认值从 ALLOW 改掉,就是主文件所说的「不触契约文件而改变接受/拒绝行为」。⇒ 按维护者对本席的裁定,这类卡从一开始就派在契约复审档位,而不是低档实现完再补一趟复审。

⚠️ 若实现最终选了分诊提到的「serve 直接在 OS_LICENSE_KEY 存在时接线」这一形,落点会落进 packages/cli:在 PR 正文里声明这半个 domain:cli 面,⛔ 不要因此改卡的车道标。

验收要求(除仓内常规外)

• ⚠️ 缺口 2 是推导而非实测。所以本卡的绿不得声称「gate 现在在集群上真的生效了」—— 能声称的上限是「未注册时不再默认放行,且注册不再依赖单个配置文件被执行」。⛔ 超出这条的措辞按假申报处理。
• 否定面要有:已授权(maxNodes 足够)的部署不得被新默认值挡住;OS_CLUSTER_REPLICAS 未设/为 1 的单副本路径不得变化。这两条各自一测,⛔ 不许只测拒绝面。
• ablation 照仓内形状:先声明方向,on-disk blob 哈希 + marker 计数证实变异,restore 以状态证明。

---

Generated by Claude Code

[os-steve]

⚠️ 派发的 dev 被会话额度中断,不是缺陷 —— 在制品已保全并推送

domain:services PM 席(session session_016ZC5rNQj3WEet5HAmmAkMs)。本卡的 dev agent 于 2026-09-01 01:2x UTC 被 HTTP 429「session limit」 终止(额度 04:30 UTC 重置),⛔ 不是实现失败、⛔ 不是缺陷、⛔ 不是它的判断出了问题 —— 它当时正在起草 PR 正文。

在制品已由 PM 保全:该 agent 的 worktree 里有一个未推送的提交,容器是临时的,再不推就随回收一起没了。已推到认领分支:

branch: claude/issue-13537-multinode-gate-mount
commit: ee607b488 fix(service-cluster,cli): multi-node gate fails closed when
 unregistered; mount it on every boot route
files : 7

⛔ 接手的人先读这三条,再动手

1. ⛔ 不要从零重做。 分支上已有一版实现,含缺口 1 的两半(沉挂载 + 无注册默认值)。先读它,再决定改还是接着做。
2. ⚠️ 它没有被复核、没有被验证。 该 agent 在被打断前没有报告过测试、ablation 或门族读数,也没有开 PR。⇒ 分支 = 起点,⛔ 不是完成品;任何「它已经绿了」的假设都是无据的。
3. 认领仍然有效,同一 session 持有;额度重置后可续做。⛔ 在此之前请勿另起认领。

范围与档位不变

派发令(评论 5486478267)全文仍然生效,包括:⛔ 缺口 2(CJS/ESM 双实例分裂)出界、⛔ 不跨仓、以及那条不得声称的话 —— 能声称的上限只是「未注册不再默认放行,且注册不再依赖单个配置文件被执行」。

本卡仍派在契约复审档位(条款②内容肢:改授权门的无注册默认值)。⇒ 分支上那版实现落成 PR 后仍须走契约复审才能入队。

---

Generated by Claude Code

[os-steve]

os-dev-report

{
 "issue": 13537,
 "status": "done",
 "branch": "claude/issue-13537-multinode-gate-mount",
 "pr": "https://github.com/objectstack-ai/objectstack/pull/14114",
 "premise_still_valid": true,
 "summary": "Gap 1 shipped, both halves, per the claim ruling. (b) checkMultiNodeAllowed now fails closed with no gate registered: a declared multi-node topology (requested greater than 1) is refused in the same verdict shape as a registered gate's outright denial, so serve downgrades to single-node loudly, never bricks; OS_CLUSTER_REPLICAS unset/1/meaningless keeps the historical allow byte-identical, and registered-gate verdicts are unchanged. (a) New mountMultiNodeGateFromHost in service-cluster owns the carrier list (security-enterprise, organizations; drift-tested against PLATFORM_PLUGIN_WIRED_RUNTIMES) and serve hands it its host-anchored importer before the consult, so registration no longer depends on the EE app config executing — the domain:cli half (one destructure + one guarded call in serve.ts) is declared in the PR body. Clause-2: yes, declared with the touched surface. Gap 2 is named still open in the PR body with the effectiveness boundary (13330 is the canonical card); claim ceiling respected verbatim. Mid-run the session was killed by a rate limit; recovered from disk with zero work loss (PM had pushed ee607b488), then origin/main was merged in (a97319179) so the gate derivation ran on a current tree. Changeset is minor for service-cluster (launch-window breaking convention) + patch for cli, with an ADR-0087 not-required (no-migration-prescription) disposition.",
 "tests": "At head 30c2d3d02, via the shared verify lock (VERDICT lines cited, exit codes captured before any pipe): service-cluster vitest 'Test Files 5 passed (5) / Tests 77 passed (77)'; service-cluster-redis (direct dist-coupled consumer) '1 passed / 28 passed'; cli targeted suites (advisory + advisory.pin + telemetry + cluster-host-resolution sweep + serve-app-anchored-optional-import e2e real boot) '5 passed / 71 passed'. Mandated negatives each have a dedicated test: entitled deployment (gate registered, admitted 5, requested 3) not blocked; single-replica (1) and undeclared/meaningless (NaN/0/-1) unchanged. Ablation: predicted RED before running (3 fail-closed assertions); mutation if-wanted-gt-1 to if-false applied at ee607b488 (service-cluster tree byte-identical to head, diff empty), proven on disk by anchored grep counts (target 1 to 0, marker 0 to 1) and blob hash 65ffad01 to de8c8fbb — never by editor exit codes; the mutated module reaches its tests via same-package relative src imports so no dist rebuild is on that path (stated, not skipped); observed 4 red (the 3 predicted plus the reset test whose added last line asserts the same branch — same class, direction as predicted), 23 controls green in both trees and declared controls; restore proven by state: git diff HEAD empty, blob back to the HEAD blob, counts back. Gates re-derived at a97319179 with dispatch-gates --repo objectstack-ai/objectstack, both sections read whole: all 33 path-derived families plus convention-triggered (type-check-debt --re-measure 'none above its recorded number', engine-double-contract, where-matcher, query-options-erasure, dispatcher-error-vocabulary, test-source-alias, adr-0087-registration — red once for the missing disposition, fixed, re-run green) and full-repo pnpm lint exit 0, check:nul-bytes OK. NOT MEASURED: check-test-completeness exit 3 = PREREQUISITE NOT MET (CI shard context) — CI owns it. Typecheck: cli tsc --noEmit exit 0 at head with serve.ts proven in the program via --listFiles; service-cluster has no typecheck script — manual tsc shows my four files in the program with zero errors and one pre-existing error in untouched memory.contract.test.ts, carried by the type-check-debt ledger.",
 "mcp_calls": "2 — create_pull_request and this comment; all card/comment/PR reads went through the zero-quota public-page payload channel and unauthenticated REST",
 "open_questions": [],
 "out_of_scope_findings": [
 "not filed (cross-repo; this session is repo-bound to objectstack): cloud-side follow-up needed — a carrier package (objectstack security-enterprise or organizations, cloud repo) must call registerMultiNodeGate at its own module load; today only apps/objectos-ee/objectstack.config.ts calls it, so the new mount helper loads carriers that register nothing until that lands (attempts report loaded-without-gate honestly). Handing to the PM for cross-seat filing; until it lands, licensed thin-extension/artifact-direct deployments fail CLOSED (loud single-node downgrade) instead of fail-open.",
 "not filed (already tracked by the repo's own mechanism): pre-existing tsc error in packages/services/service-cluster/src/memory/memory.contract.test.ts (subscribe handler returns number where void is expected) plus the package having no typecheck script — both are carried by the check:type-check-debt ledger, which re-measured green this run; a card would duplicate the ledger row."
 ]
}

Generated by Claude Code

---

Generated by Claude Code