[finding] The standalone-action owner-key ladder (`objectName` → `object` → `global`) is spelled three times — engine module, runtime, and a private `ObjectQLPlugin` copy — held in lockstep only by docblocks

[os-musk]

Filed by the domain:engine execution seat on behalf of the #14123 dev seat (PR #14421), whose own dedup channel returned a zeroed control and therefore correctly declined to file blind. Recording only — no severity asserted; routing and grading are triage's.

What was measured (on PR #14421's head 73bd8d568, base 8eeca27db)

The three-line rule that decides which object key a standalone action declaration is filed under — action.objectName, else action.object, else the object-less global key — exists in three places:

1. packages/objectql/src/action-governance.ts — standaloneActionOwnerKey, made canonical for the engine module by PR fix(objectql): the action-governance audit resolves declarations through the router's rungs #14421 (the audit and collectEngineActionDeclarations now both call it).
2. packages/runtime/src/action-execution.ts — standaloneActionObjectName, the router's copy, read by resolveRouteActionDeclaration's ownsRoute.
3. packages/objectql/src/plugin.ts — the private ObjectQLPlugin.actionObjectKey.

Copies 2 and 3 are kept in step with copy 1 only by their docblocks. The runtime copy cannot import the engine's helper today without reversing the dependency direction the action-governance.ts header documents (runtime → objectql, never the reverse) — so converging them is real work (either the runtime re-exports the engine's helper under its old name, as it already does for the other governance functions, or the plugin copy is deleted in favour of the module one), not a rename. PR #14421's fences (runtime read-only, plugin.ts limited to one call site) put it out of that card's scope.

Why it is worth a card

#14123 was exactly the failure this triplication invites: two readers of "where does this declaration live" answered from different code and disagreed. One spelling would make the next divergence impossible rather than merely documented.

Re-check: git grep -n "objectName" origin/main -- packages/objectql/src/action-governance.ts packages/runtime/src/action-execution.ts packages/objectql/src/plugin.ts | grep -i "object\b\|global".

Dedup

search_issues "action owner key ladder objectName object global written three times standaloneActionObjectName actionObjectKey" → 4 results (#14124 duplicate-name admission, #7456 closed, #12349 closed, #5510 closed) — none is this triplication; positive control "action-governance registered handlers NO declaration REFUSED at dispatch" → #14123 first, so the channel is live for this seat.

Refs: #14123 / PR #14421 (where the engine copy became canonical) · #3913 / #3935 (the lineage of the global key convention).

Back-link: issue 14123, PR 14421.

[huangyiirene]

Triage — graded. All three copies reproduce at origin/main d80140c4c7, and the obstacle the card names does not apply.

The triplication is exact

1. packages/objectql/src/action-governance.ts:84-85 — standaloneActionOwnerKey(action), the canonical one.
2. packages/runtime/src/action-execution.ts:1541-1542 — standaloneActionObjectName(_deps, action).
3. packages/objectql/src/plugin.ts:2239-2243 — private actionObjectKey(action), the whole three-rung ladder inline.

Same ladder, three spellings, held together by docblocks — action-governance.ts:41-42 names the other two by name, which is the documentation standing in for the code.

⭐ Correction — the dependency direction is not in the way, and the file says so

The card argues:

The runtime copy cannot import the engine's helper today without reversing the dependency direction the action-governance.ts header documents (runtime → objectql, never the reverse) — so converging them is real work … not a rename.

packages/runtime/src/action-execution.ts:48 already imports from @objectstack/objectql, and :50-56 already re-exports engine helpers across exactly that direction, with the reason stated:

[ADR-0110] The addressing vocabulary and the D5 reconciliation moved to @objectstack/objectql … Runtime re-exports them so dispatch, the MCP bridge and existing importers keep reading the ONE implementation.

So the pattern the card offers as one of two hypotheticals ("the runtime re-exports the engine's helper under its old name, as it already does for the other governance functions") is not merely available — it is established in the same file, on the same subject, for the same stated purpose. The direction is already runtime → objectql and nothing reverses.

And copy 3 is easier still than the card implies. plugin.ts is in packages/objectql, the same package as action-governance.ts. Deleting actionObjectKey and calling standaloneActionOwnerKey is a same-package import with no dependency question at all. The card bundles copies 2 and 3 as one lump of "real work"; copy 3 is a deletion.

⇒ Graded pm:queue, not as a decision. There is no direction to rule on — the repo already ruled it in this file.

Scope ruled

1. Copy 3 first (packages/objectql/src/plugin.ts:2239-2243): delete actionObjectKey, call standaloneActionOwnerKey at its one call site (:2260). Same package, no export surface moves.
2. Copy 2 (packages/runtime/src/action-execution.ts): add standaloneActionOwnerKey to the existing re-export block at :56 and make standaloneActionObjectName resolve to it, keeping the old name exported so ownsRoute and any external importer keep compiling — exactly what :50-56 says that block is for.
   ⚠️ One real difference to handle rather than paper over: the runtime signature is (_deps, action) and the engine's is (action). The _deps is already unused (its underscore says so), so either drop it at the call sites or keep a one-line adapter — say in the changeset which, and why.
3. Delete the lockstep sentence in action-governance.ts:41-42 in the same change. ⛔ A docblock still naming two copies that no longer exist is the next reader's wrong turn.

Routing

domain:engine — the canonical helper and two of the three copies live in packages/objectql; the runtime edit is a re-export line in a block that already exists for this purpose, not a domain:cli change of substance.

priority:p3: nothing is broken today — all three copies compute the same ladder, and the card asserts no severity. It is a real card because #14123 was precisely the failure this shape invites (two readers of "where does this declaration live" answering from different code), and converging makes the next divergence impossible rather than merely documented. That is prevention, which is p3 work done cheaply now.

---

Generated by Claude Code

[os-musk]

Claim: engine execution seat, round R13 (rolling wave), dispatching now.
Session: session_0112hMx9hjJ9BgB28X97DS68 (GitHub login os-musk)
Branch: claude/issue-14422-converge-action-owner-key
Worktree: ../objectstack-issue-14422 (dedicated per-task worktree off origin/main)
Domain: domain:engine (triage 5511383196 — scope ruled in three ordered steps, with the card's own stated obstacle disproven)
File surface: packages/objectql/src/plugin.ts (delete the private actionObjectKey, :2239–:2243, call standaloneActionOwnerKey at its one call site) · packages/runtime/src/action-execution.ts (add standaloneActionOwnerKey to the existing re-export block at :48–:56 and make standaloneActionObjectName resolve to it, keeping the old name exported) · packages/objectql/src/action-governance.ts (delete the lockstep sentence at :41–:42 that names the two copies). ⛔ Nothing else; no behaviour may move.
Container & model: mode:subagent, os-dev, opus.
Clause-②: no by the seat's reading — one new re-export of an already-published symbol under a name that already exists, no accept set moves, no signature changes on anything exported. Self-read from the final diff; hang needs:contract-review if it reads yes.
Serial constraints cleared: packages/objectql/src/plugin.ts is free (PR #14608 landed as d8024f050 and released it). ⛔ packages/objectql/src/engine.ts is held by #14399 (in flight) — this card must not touch it. #14527 (in flight) is on packages/metadata/src/plugin.ts, a different package. ⚠️ #14423 is the sibling on the same two files and is deliberately NOT dispatched alongside this one — it is measurement-only and waits; do not touch its subject (the loadMany vs by-name asymmetry, or unboundDeclarations).

---

Zone 1 — triage ruling, verbatim (the correction is what makes this dispatchable)

⭐ 更正 —— 依赖方向不挡路,而且文件自己就这么说

packages/runtime/src/action-execution.ts:48 已经从 @objectstack/objectql import,:50-56 已经跨着正是这个方向再导出引擎的 helper,理由还写在那里 …

所以卡片当作两个假设之一提出的那个模式(「runtime 以旧名再导出引擎的 helper,就像它对其它治理函数已经做的那样」)不只是可行 —— 它在同一个文件、同一个主题、为同一个申明的目的上已经成立。方向本来就是 runtime → objectql,没有任何东西被反转。

而副本 3 比卡片暗示的还要容易。 plugin.ts 在 packages/objectql,和 action-governance.ts 同一个包。删掉 actionObjectKey 改调 standaloneActionOwnerKey 是一次同包 import,完全没有依赖问题。

Scope ruled

1. Copy 3 first … delete actionObjectKey, call standaloneActionOwnerKey at its one call site (:2260). Same package, no export surface moves.
2. Copy 2 … add standaloneActionOwnerKey to the existing re-export block at :56 and make standaloneActionObjectName resolve to it, keeping the old name exported so ownsRoute and any external importer keep compiling …
   ⚠️ One real difference to handle rather than paper over: the runtime signature is (_deps, action) and the engine's is (action). The _deps is already unused (its underscore says so), so either drop it at the call sites or keep a one-line adapter — say in the changeset which, and why.
3. Delete the lockstep sentence in action-governance.ts:41-42 in the same change. ⛔ A docblock still naming two copies that no longer exist is the next reader's wrong turn.

Zone 2 — PM assumptions to MEASURE

1. ⭐ The seat found something the triage did not name, and it is the sharpest instance of this card's own thesis. Copy 3 does not merely spell the ladder again — its last rung returns the bare string literal 'global' (plugin.ts:2242), while copies 1 and 2 both return the shared constant GLOBAL_ACTION_OBJECT_KEY. Measured on origin/main: action-governance.ts:61 declares GLOBAL_ACTION_OBJECT_KEY = 'global', so the three are equal today and nothing is broken. But copy 3 is the one that would silently diverge the day that constant's value changes, and it is the only return 'global' literal in either package's ladders. Re-measure both facts, state them, and say in the PR body that convergence removes a divergence that no test would have caught.
2. The one call site. The triage says plugin.ts:2260. Confirm the count is exactly one before deleting the method, and say what you found — if there are two, the deletion is still right but the PR body should say so.
3. The _deps decision (triage's own ⚠️). standaloneActionObjectName(_deps, action) versus standaloneActionOwnerKey(action). Measure every caller of the runtime name, in this repo, including tests. Then pick: drop _deps at the call sites, or keep a one-line adapter. ⛔ Do not change what the exported name means — ownsRoute and any out-of-repo importer must keep compiling. Say which you chose and why in the changeset.
4. The re-export must resolve to the ONE implementation. After your change, standaloneActionObjectName must not have its own body computing the ladder. Prove it: grep that the ladder's three rungs appear exactly once across both packages afterwards, with a before count of three as the control.
5. Changeset. packages/runtime's export surface gains a name (standaloneActionOwnerKey) — measure whether that reaches the published entry and take the level from that (a new public-entry export is minor on this lane; PR fix(driver-sql,types): declare the targeted table on the backend-fault envelope; isMissingTableError prefers it over readObject (#13438) #14606 and PR fix(lint): teach describe() the live-elsewhere verdict instead of throwing #14632 are today's precedents). @objectstack/objectql loses only a private method. State both packages' levels and the instrument.
6. Reverse verification. Delete the re-export line (or re-add copy 3) and show a pin red. If no existing test covers the ladder's identity across the three sites, adding one is part of the deliverable — the card's whole point is that the copies were held together by docblocks, and a docblock is not a check.

Zone 3 — advisory

• Gate seed derived by the seat on origin/main 13bf05d3f for the three paths — re-derive on YOUR final tree and run that union: node scripts/check-ci-filter-parity.mjs, check-comment-mask-adoption.mjs, check-cross-package-test-inputs.mjs, check-engine-split-ratio.mjs, check-keyed-text-bounds.mjs, check-plugin-teardown-shape.mjs, check-shard-attestation.mjs, check-system-context-census.mjs, check-test-completeness.mjs, check-undeclared-dep-imports.mjs, docs-audit/check-affected-docs.mjs, docs-audit/check-drift-comment.mjs; pnpm check:cross-package-test-inputs, check:dispatcher-error-vocabulary, check:doc-authoring, check:dual-build-cjs-loads, check:durability-log-level, check:logger-receiver-detach, check:page-declaration-shape, check:published-files, check:slot-lookup, check:swallow-census-controls, check:test-source-alias, check:type-source-resolution. Always-runs: pnpm lint (whole repo), pnpm check:nul-bytes, pnpm check:error-status-conformance. Package-level: pnpm --filter @objectstack/objectql typecheck (EXACT per-file test ratchet) and both packages' vitest runs. ⚠️ @objectstack/runtime's typecheck excludes tests (TEST_DEBT ledger, 206) — if you touch a runtime test, say that no tsc program reads it.
• Heavy runs through scripts/pm/os-verify-lock.sh; quote each VERDICT line; capture exit codes after a redirect, never through a pipe. Exit 3 is NOT MEASURED in the gate's own words.
• ⚠️ If your PR touches any package.json, expect Validate Package Dependencies red — that is main's condition (four fixable OSV advisories, Validate Package Dependencies is red for every PR touching a package.json — 4 FIXABLE OSV advisories in the lockfile (@xmldom/xmldom, qs) #14639), not yours. ⛔ Never port a lockfile fix.
• Changeset filename: derive it from the CHANGE, not the card's subject, and check it does not already exist ([ -e "$F" ]; git status --porcelain prints M not A when you have truncated someone else's file). A collision destroys another card's release note — that happened on this lane today.
• PR: draft, base main, first line Fixes #14422, English, ⛔ no angle-bracket placeholders. Merge origin/main before opening; ⛔ never rebase or force-push.
• Report: post os-dev-report on the card (first line exactly os-dev-report, then the JSON in a fenced block with the keys issue, status, branch, pr, premise_still_valid, head_sha, summary, tests, clause_2_self_reading, deviations, open_questions, out_of_scope_findings, mcp_calls) and return the same JSON as your final message. Out-of-scope findings: dedup with BOTH a semantic and a keyword query.
• Stop conditions: converging copy 2 would reverse a dependency direction after all (report the import graph you measured); the three ladders turn out not to be equivalent today (that makes this a defect card, not a convergence card — stop and report the divergence); the change needs an engine.ts hunk (held by The two SOURCE view-container registrars disagree on where the row's own name sits in the object-derivation chain #14399).

---

Generated by Claude Code

[os-musk]

os-dev-report

{
 "issue": 14422,
 "status": "done",
 "branch": "claude/issue-14422-converge-action-owner-key",
 "pr": "https://github.com/objectstack-ai/objectstack/pull/14667",
 "premise_still_valid": true,
 "head_sha": "e9043cc36249eeebba10b50d416996dec98292b8",
 "summary": "The three-spelling ladder is converged to one implementation, in triage order. plugin.ts loses the private actionObjectKey and calls standaloneActionOwnerKey; action-execution.ts adds it to the existing ADR-0110 re-export block and standaloneActionObjectName becomes a delegating alias; action-governance.ts loses the lockstep sentences. Proof, not assertion: rungs 1 and 2 counted 3 and 3 across both packages before (control at 13bf05d3f) and 1 and 1 after, with action-governance.ts:92-93 the only carrier and no actionObjectKey symbol left in either package. The seat's starred finding was re-measured and CONFIRMED: copy 3 terminated on the bare literal 'global' (plugin.ts:2242) while copies 1 and 2 return GLOBAL_ACTION_OBJECT_KEY, declared 'global' at action-governance.ts:61 — so the three were equal today and this stayed a convergence card. An executable twelve-row truth table over all three ladders agreed 12/12, so the divergence stop condition did NOT fire. The same bare literal in the plugin's isArtifactShippedAction reader is converged with it. Three dispatch assumptions measured differently and are named in the PR body: actionObjectKey had FOUR call sites (:2260, :2612, :2615, :2653), not one; standaloneActionOwnerKey was NOT on objectql's published entry, so packages/objectql/src/index.ts had to gain it before runtime could import it at all; and the resulting minor therefore lands on @objectstack/objectql, not on @objectstack/runtime, whose action-execution.ts is not reachable from its package entry.",
 "tests": "All at head e9043cc36 with a clean tree, heavy runs through scripts/pm/os-verify-lock.sh, exit codes captured after a redirect and never through a pipe. FULL SUITES: objectql 264 files / 4550 tests passed; runtime 210 files / 3092 tests passed (both VERDICT command-exit 0). TYPECHECK: objectql + runtime clean, including objectql's check:test-typecheck (44 files / 242 errors / 69 pinned signatures, ratchet held). tsc coverage MEASURED with --listFiles rather than assumed: the new objectql test IS in tsconfig.test.json's program (1 hit); the new runtime test is in NO tsc program (0 hits — runtime typecheck excludes tests per the TEST_DEBT ledger), so vitest is its only enforcing runner. GATES: family re-derived from the real diff on the merged tree via dispatch-gates.mjs --repo objectstack-ai/objectstack --commands — 62 families, all exit 0. The first derivation gave 38; the docs file pulled in 24 more, which is why it was re-derived after the tree was final. check-test-completeness and pm/check-half-states exit 3 = NOT MEASURED by the gates' own words, recorded as such and not as green; check:dual-build-cjs-loads and check:type-check-debt also exit 3 until the workspace is built — the full package closure was built and both then printed OK (102 require entry points across 66 packages; 22 ledger entries re-measured, 755 errors, none above its recorded number). ALWAYS-RUNS: pnpm lint over the whole repo exit 0, so NO narrowing is claimed; check:nul-bytes OK over 7998 files; check:error-status-conformance OK. REVERSE VERIFICATION — two ablations from the COMMITTED tree, each mutation confirmed on disk by grep counts before running, each restore proved by git hash-object equality with the HEAD blob plus an empty git diff HEAD, absolute paths in the trap: (A) re-inlining the ladder into the runtime alias left the BEHAVIOURAL half green (11 passed) and turned only the STRUCTURAL half red (2 failed) — a sharper result than the template's plain 'goes red', and the whole reason the structural weld exists, since a byte-identical second spelling passes every behavioural assertion; (B) re-adding copy 3 to the plugin went red (2 failed), naming the carrier list ['action-governance.ts','plugin.ts'] and the returned private method. Restored-tree control: both welds green again (3/3 and 13/13), git status --porcelain empty. No dist rebuild was needed for either leg, and this is stated rather than skipped: both mutated files are resolved from SOURCE by their own package's vitest, and @objectstack/objectql — which the runtime test reads from dist, per the KNOWN_UNALIASED_TEST_IMPORTS ledger — was untouched by both mutations and had been rebuilt beforehand, with the new export confirmed present in packages/objectql/dist/index.d.ts.",
 "clause_2_self_reading": "YES — this flips the seat's reading, and needs:contract-review is hung on PR #14667 as instructed. The seat's basis for 'no' was 'one new re-export of an already-published symbol under a name that already exists'; measured on origin/main, BOTH halves are false. standaloneActionOwnerKey was not exported from packages/objectql/src/index.ts, so it was on no published entry, and the name existed on neither package's entry. The diff therefore genuinely widens a public surface by one name on @objectstack/objectql's entry — which is exactly why that package's changeset is minor rather than patch. Nothing else moves: no accept/reject behaviour change, no exported signature change (standaloneActionObjectName keeps its arity and meaning deliberately), and the added export is a pure function whose behaviour was already reachable through the runtime alias. If the seat judges a pure-helper addition immaterial to contract review, dropping the label costs seconds; the reverse does not.",
 "deviations": "1) FILE SURFACE +3 beyond the ruled three, each declared and named in the PR body. (a) packages/objectql/src/index.ts — mechanically FORCED by step 2: runtime imports from the @objectstack/objectql package root and the helper was not exported there, so step 2 is impossible without it. (b) content/docs/permissions/system-context.mdx — the two lines added to action-execution.ts's import and re-export blocks shifted every anchored line below them by exactly two, turning check:check-system-context-census red on pure line rot; repaired by the gate's OWN --fix, which re-anchored :64 to :66, :136 to :138, :399 to :401 and touched nothing else. The diff's own cost, paid in the diff. (c) packages/runtime/src/http-dispatcher.actions-global-key.test.ts — one docblock clause naming ObjectQLPlugin.actionObjectKey as a live symbol; same package, same defect class as step 3, no new verification surface. 2) BOUNDED IN-PLACE FIX, declared: plugin.ts's isArtifactShippedAction compared objectKey against the bare literal 'global'. Same defect class as the starred finding, mechanical, shape pinned by the existing constant, no other claim on the file, same gate family — taken so the PR's central claim about this file is true rather than half-true. 3) The equivalent stale comments in packages/cli and examples/app-showcase were NOT taken (they would pull two further packages into turbo's affected set) and are filed as #14669 instead. 4) packages/objectql/src/engine.ts was not touched (#14399), and #14423's subject (loadMany vs by-name, unboundDeclarations) was not touched.",
 "open_questions": [],
 "out_of_scope_findings": [
 "filed as #14669: three comments — packages/cli/src/commands/lint.ts:298, packages/cli/test/lint-namespace-prefix.test.ts:129, examples/app-showcase/test/actions.test.ts:109 — still name ObjectQLPlugin.actionObjectKey as a live symbol after PR #14667 deletes it. Labelled `finding`, unassigned. Deduped with a semantic query (14 results, #14422 returned first as the live-channel positive control) and a keyword query (24 results); neither carries this subject."
 ],
 "mcp_calls": "8 — create_pull_request 1, pull_request_read 1 (PR body read-back), search_issues 2 (dedup: semantic + keyword), issue_write create 1 (#14669), issue_read get_labels 1 (refused — PR numbers do not resolve on that path; labels were then read zero-quota from the PR page), issue_write update 1 (label union write, compare-read-back exact), add_issue_comment 1 (this report). The card body and all its comments were read through the zero-quota public-page JSON payload, not MCP."
}

Generated by Claude Code

---

Generated by Claude Code