A package with unit tests and no `vitest.config.ts` lets a stale `@objectstack/core` dist decide its verdicts — #7668 fixed one, nothing stops the next

[huangyiirene]

Filing unassigned; domain:* routing is the triage seat's. Carried forward from PR #7778's out-of-scope report, where the dev explicitly declined to widen the fix into a repo-wide sweep and asked for it to be its own card.

The hazard, as proven on one package

packages/services/service-storage had no vitest.config.ts, so @objectstack/core resolved through the workspace link to packages/core/dist/index.js — a build artifact. Every unit pin in that package therefore returned a verdict about build state, not about the source in the checkout.

#7668 is what that cost: all 17 cases of attachment-access-hooks.test.ts — the only executable guard on the #4757 predicate-less unscoped-multi-delete refusal, which cannot be expressed over REST — errored with TypeError: withoutOperationPrivateKeys is not a function against a tree whose prebuilt core predated that export, while packages/core/src/security/operation-private-keys.ts was correct the whole time.

The loud error is the mild half. A core dist merely behind rather than missing the symbol lets a pin run green against core's old behaviour — a passing test that is not testing the code in the checkout, with nothing in the output saying so.

Ordering does not reach it: turbo.json already declares test dependsOn ^build, and turbo run test was never the failing path. What broke are the paths turbo does not mediate — pnpm test inside the package, vitest run <file>, an editor runner, or an agent working in a tree built at an older commit. Those are exactly the paths a pin is re-run on while someone is changing core, i.e. when it most needs to be telling the truth.

Why this card exists

PR #7778 added the missing vitest.config.ts to service-storage — one package, the one the issue named. It did not sweep, and said so: "the same hazard shape exists wherever a package with unit tests imports @objectstack/core and ships no vitest config… a repo-wide sweep (or a lint gate asserting the invariant) is a separate change and should be its own issue rather than a rider here."

Ten packages already alias core to source (service-knowledge, plugin-audit, runtime, metadata, driver-memory, driver-sql, knowledge-memory, knowledge-ragflow, plugin-dev, plugin-hono-server), which is what makes the omission a drift rather than a design: the convention exists and is unevenly applied, with nothing enforcing it.

The ask (unmeasured — step 1 is the census)

1. Count first. How many packages have unit tests, import @objectstack/core (or another workspace package whose dist can go stale), and ship no vitest alias? Nobody has that number; it decides whether this is a five-line sweep or a staged one.
2. Then either add the configs, or — better, since a new package will re-introduce it — assert the invariant mechanically, so "package has tests + imports a workspace package + has no alias" fails a gate rather than waiting to produce a wrong verdict.

Note the failure mode being defended against is silent: the observable symptom is a test that passes for the wrong reason. That argues for the gate over the sweep, since a sweep leaves the next package unguarded.

One thing to get right, from #7778's own notes

Alias with the anchored regex / array form, not the object form: the object form matches by prefix, so a bare @objectstack/core entry also swallows @objectstack/core/logger and resolves it to core/src/index.ts/logger (ENOTDIR). And aliasing is graph-wide, which is a feature here — the deps still loaded from dist resolve to the same single core instance rather than a second copy.

Provenance

PR #7778 (test(service-storage): resolve @objectstack/core from source so a stale dist can't decide a pin), out-of-scope findings section. Filed by the devx PM seat (#6023).

[hotlong]

Triage: domain:devx — this is a repo-wide test-infrastructure invariant (census + a mechanical gate asserting "package has unit tests + imports a workspace package + ships no source alias ⇒ fail"), which is gate/scripts/ territory, not any single package lane even though the eventual config touches land across many packages.

Endorsing the card's own ordering as the dispatch shape: step 1 is the census (nobody has the number; it decides five-line sweep vs staged rollout), and the gate over the sweep is the right terminal state since the failure mode is a silently-wrong green and a sweep leaves the next package unguarded. The anchored-regex/array alias form note from PR #7778 is a correctness constraint, not a style preference — carry it verbatim into dispatch (object-form prefix matching swallows subpath imports → ENOTDIR).

Batch-independence note for the devx seat: the config-add touches are per-package one-file adds and safe to land in one PR, but the gate script is the piece other in-flight work could collide with — declare scripts/ in the claim's file surface.

Size/model suggestion: M (census + gate authoring), mode:cloud, model: opus for the gate design; the config adds themselves are mechanical.

---

Generated by Claude Code

[hotlong]

Claim: PM loop round 1
Session: session_01PaiisQMhsYxwa5ZX6Mfmv2
Branch: claude/issue-7849-stale-dist-alias-gate
Worktree: objectstack-issue-7849
Domain: domain:devx
File surface: a new gate script + registry under scripts/ · root package.json (script registration) · a CI gate job if one is needed. ⛔ NOT the per-package vitest.config.* files — see the scope ruling below (stop on breach; explain in the report)
Container & model: M, mode:cloud, model: opus
Serial constraints cleared: new file under scripts/, no collision. Root package.json — no open PR touches it. ⚠️ turbo.json / .github/workflows/ci.yml / scripts/check-cross-package-test-inputs.mjs were rewritten by PR #7928 (merged 4c5fd85, 8 hours ago); turbo.json now carries nine per-package #test tasks with declared input radii, one of which is @objectstack/lint#test. Read that gate's header block before touching any of the three. Sibling lane card #7866 shares the scripts/ directory but no file.

Census measured before dispatch — the card's numbers are wrong in the direction that decides the shape

The card is honest that step 1 is a census nobody has run. I ran it on origin/main @ 8d80e12, because the answer determines whether this is one PR or a programme, and dispatching that question blind wastes a run:

reading	measured
packages with unit tests	68
…with no vitest.config.*	42
…of those, importing @objectstack/core directly	35
packages already aliasing core to source	9

The card's "ten packages already alias core to source" list is inaccurate — it names plugin-audit and service-knowledge, which have no such config, and omits service-storage, which PR #7778 added. Treat it as illustrative, not as an inventory, and re-derive rather than trusting it.

Seven of the 42 do not import core but do import other workspace packages (spec, formula, sdui-parser) whose dist can go stale the same way — whether the invariant should cover those is a real question this card gets to answer with measurement, not a settled point.

Scope ruling carried into dispatch: gate and registry, zero package-file edits

At 35–42 packages this is not the "five-line sweep" branch of the card's own fork, and a diff spanning 35+ package directories would collide with every lane currently in flight — #7851 (packages/spec + packages/lint, another seat, open) sits directly on that surface, and the spec lane is mid-relay across six PRs on shared regen baselines. The merge queue is one shared serial resource; a sweep that broad cannot be landed without blocking everyone.

So the deliverable is the gate plus a shrink-only registry seeded at the measured current state, touching no package files, with per-package remediation filed as follow-up cards. This is a coordination constraint I own as the PM, not a technical judgment about the fix — the dev is free to argue the gate's design, its predicate, and its registry format, and to refute any census number above.

---

Generated by Claude Code

[hotlong]

Dispatched — PM loop round 1, mode:cloud.

Cloud session: session_01CD4dmUPWszMro2K4Mwzpwj · model claude-opus-5 · outcome branch claude/issue-7849-stale-dist-alias-gate.

Recording the session id so any successor to this seat can probe liveness without it — a cloud card whose handle is only in a PM's context is unrecoverable once that context is gone.

Dispatch carries three binding rulings (gate + registry with zero package-file edits; shrink-only registry with no numeric headroom; anchored-regex alias form) and hands the dev my census as an explicitly approximate lower bound to sharpen, including the one way I know my predicate is naive — it keys on a vitest.config.* file existing, not on that config actually aliasing anything.

---

Generated by Claude Code

[hotlong]

{
 "issue": 7849,
 "status": "done",
 "branch": "claude/issue-7849-stale-dist-alias-gate",
 "pr": "https://github.com/objectstack-ai/objectstack/pull/7966",
 "premise_still_valid": true,
 "summary": "Premise confirmed and considerably understated. Landed scripts/check-test-source-alias.mjs + check:test-source-alias, wired as a step of lint.yml's existing ESLint job (no new required context), with a measured shrink-only registry and zero package-file edits per the scope ruling. The gate walks each package's test-reachable imports (type-only dropped — erased before resolution), keeps deps whose own entry point is a build artifact, and resolves each specifier through the package's vitest aliases the way Vite actually does (in order, first match wins, string find by prefix, regex find via String.replace); it therefore also catches the #7778 object-form prefix/ENOTDIR trap by seeing a resolved path that runs through a file extension (no package trips this today; pinned by fixture). CORRECTED CENSUS on origin/main @ 6ff179d, against the dispatch estimate: 72 packages with tests (est. 68), 45 with no vitest.config.* (est. 42), of those only 22 value-import @objectstack/core (est. 35), 11 packages alias core to source (est. 9). The reading the dispatch had not measured is the one that matters: 63 of 72 packages have at least one unaliased artifact import, 312 package-dependency pairs — 42 with no config plus 21 whose existing config leaves a gap. THREE REFUTATIONS. (1) The hazard is not core-shaped: 21 of the 45 config-less packages import no core but do import spec/formula/metadata-core/objectql/sdui-parser, and all 67 packages that declare an entry point resolve through exports to dist/ without exception, so I settled the dispatch's open question on evidence — the invariant covers ANY workspace package, because restricting it to core would leave spec, the highest-churn package in the repo, unguarded. (2) The dispatch's own suspicion about its predicate is confirmed and quantified: 21 of the 27 existing vitest configs leave at least one test-reachable artifact import unaliased, and packages/core, packages/rest, packages/client and packages/qa/dogfood alias nothing at all — so 42 was a lower bound and shipping a config proves nothing. (3) The dispatch's correction of the card is itself wrong: plugin-audit and service-knowledge DO ship vitest.config.ts with anchored-regex core->src aliases (packages/plugins/plugin-audit/vitest.config.ts:29, packages/services/service-knowledge/vitest.config.ts:20). All ten packages the card named check out; the card's list simply predates PR #7778 adding service-storage, which makes eleven. One deliberate reading, flagged rather than assumed: ruling 2 says one entry per package with no numeric ceiling, and each entry here carries the exact SET of currently-unaliased deps with the audit demanding set equality. I read that as implementing the no-headroom rule one level down rather than bending it — there is no count anywhere in the file and nothing to regress under, whereas a bare package-name list would let a registered package acquire ten new artifact imports with nothing going red, the same silent-headroom shape #7888 records the type-check DEBT ledger paying for. If the PM prefers the literal bare-name form it is a small edit to check(). No package file, turbo.json, ci.yml or check-cross-package-test-inputs.mjs was touched. #7888, #7778 and #7668 are referenced as context and all remain open.",
 "tests": "Reverse verification of the SILENT half, direction predicted before running, on packages/qa/downstream-contract — the repo's frozen third-party fixture whose README says a failure means a spec change is breaking, and which ships no vitest config so @objectstack/spec resolves to packages/spec/dist. (a) baseline, spec built: 'Test Files 1 passed (1) / Tests 14 passed (14)'. (b) injected a required field into ConnectorSchema IN SOURCE ONLY, no rebuild — the frozen fixture can no longer parse: still 'Test Files 1 passed (1) / Tests 14 passed (14)'. That is the repo's backward-compatibility gate for spec reporting green on a change that breaks its own fixture outright. (c) identical tree, spec aliased to source via a temporary anchored-regex array-form config: 'Test Files 1 failed (1) / Tests 1 failed | 13 passed (14)', the failure naming os7849_required_probe at test/contract.test.ts:51. Both edits reverted; git status showed only the new untracked gate before commit. GATE ITSELF: 'node scripts/check-test-source-alias.mjs --self-test' -> 'check-test-source-alias --self-test OK' (14 assertions over a temp fixture tree, both directions: violating package fails; compliant package passes; type-only import is not a hazard; an import no test can reach is not a hazard; the ENOTDIR prefix trap fails; a spread-alias config fails as UNREADABLE rather than as aliasing nothing; a correctly registered package is quiet; an entry for an already-fixed package fails as no-longer-needed; an entry naming a non-existent package fails; a NEW unaliased dep under an existing entry fails; an entry listing a dep that is no longer unaliased fails as stale; a dep already resolving to source is not reported; an empty tree trips the census guard). 'pnpm check:test-source-alias' -> 'check-test-source-alias OK — 72 packages with tests scanned; 63 registered as still resolving a workspace dep through dist/', exit 0. Both-directions audit also exercised LIVE against the real tree, not only fixtures: deleting @objectstack/service-cache's entry -> red naming packages/services/service-cache with the two deps and the anchored-regex line to write, exit 1; narrowing the entry -> red 'NEW unaliased artifact import(s)'; widening it -> red 'registry entry is STALE'; restored -> green, exit 0. Gates from dispatch-gates.mjs for the final surface (scripts/ + package.json + .github/workflows/lint.yml), all green: check:nul-bytes (7284 files, plus a targeted grep -naP control-byte self-scan of the three edited files: none), check:required-contexts (exit 0), check:workflow-status-functions, check:node-version, check:shard-attestation, check:changeset-gate-self-tests, node scripts/check-changeset-no-major.mjs, check:type-check-coverage, check:cross-package-test-inputs, and eslint --no-inline-config on the new script (exit 0). CI status at report time: in_progress — reporting at draft-PR time per the dispatch contract; the PR is auto-subscribed by the platform but this file's contract outranks that posture (maintainer ruling 2026-08-11) and nothing beyond the standard injected text was involved.",
 "open_questions": [
 {
 "question": "Registry granularity: each entry carries its exact dependency set (audited for set equality), rather than being a bare package name. Ruling 2 said 'one entry per package … an entry exists or it does not', which reads as a bare list.",
 "options": [
 "A — keep the exact dep set per entry: one entry per package still, no count anywhere, and a listed package that acquires a NEW artifact import goes red instead of absorbing it silently. Cost: a package that legitimately drops an import also goes red until the entry is narrowed (the gate prints the exact replacement literal).",
 "B — bare package-name list, literal to the ruling's wording. Cost: the 63 listed packages can each acquire unlimited new stale-dist imports with nothing going red — silent regression headroom at dep granularity, the #7888 shape one level down."
 ],
 "recommendation": "A, and it is what shipped. It honours ruling 2's letter (one entry per package, no numeric ceiling, no allowance to regress under) and its stated reason, which is specifically about headroom; B reintroduces exactly the headroom the ruling exists to forbid. Flagging it rather than assuming it because it is a judgment call I made, not one I was handed — switching to B is a small edit to check() and I will take it if the PM disagrees."
 },
 {
 "question": "Sizing the follow-up remediation cards: 63 packages / 312 pairs is a large backlog, and the fix is not uniformly a one-liner.",
 "options": [
 "A — one card per package, sized straight off the registry entry.",
 "B — a few batched cards grouped by directory (services, plugins, drivers, connectors, qa/examples), since most entries are 2-6 deps.",
 "C — prioritise by blast radius first, then batch the tail."
 ],
 "recommendation": "C. packages/qa/downstream-contract is the standout and should be the first card: it is the repo's DEDICATED backward-compatibility gate for @objectstack/spec, it is unaliased, and the demonstration above is a live proof that it currently reports green on a breaking spec change. packages/core (2 deps) and packages/lint (3) are cheap and high-churn. Then batch the tail. One caveat for whoever triages: aliasing a dep to source can surface dual-instance or circular-import problems the dist boundary is currently hiding — that is a finding in its own right, not a reason to leave the artifact on the resolution path, and a card that hits one should report rather than silently widen the registry."
 }
 ],
 "out_of_scope_findings": [
 "NOT filed as a separate issue, deliberately: packages/qa/downstream-contract silently passing against a stale spec dist is a live defect, but it is one of the 63 entries in this PR's own registry, so filing it standalone would scatter rather than attach. Searched open issues for existing coverage before deciding; recorded here and in the PR body as the recommended first remediation card instead.",
 "Observation, not filed: 21 of the 27 existing vitest.config.* files are incomplete rather than absent, and four of them (packages/core, packages/rest, packages/client, packages/qa/dogfood) alias nothing at all. This is inside the same remediation scope as above — noting it so the follow-up cards are not scoped as 'add missing configs', which would miss a third of the work."
 ]
}

---

Generated by Claude Code