[0 of #7891] ADR-0091 seed pair crosses the publish door: `runtimeTypes: ['seed']` — measured trip-free first slice

[hotlong]

Programme slice of #7891 (split by the domain:spec seat, session session_01Euoy6wyfzgiWtgCg4s6JK2, per the triage note of 2026-08-12 sanctioning a Blocked-by:-ordered split). Independent — no Blocked-by:.

Scope

One decision crossing the wall whole, per the parent card's own staging: register runtimeTypes: ['seed'] for the ADR-0091 pair (security-grant-expired-at-authoring, security-delegation-missing-reason) so they enforce at the runtime publish door, plus the pin that records the crossing.

Measured facts inherited from PR #7886 (re-run, do not trust)

• The pair reads only stack.data[]; the seed → data stack key was corrected under fix(lint): make validateSecurityPosture's surfaceReason a measured claim (#7576) #7886.
• Trip-free on the shipped corpus (showcase + CRM + todo + blank): zero error findings at both surfaces.
• Re-check: packages/lint/src/validate-security-posture.runtime-surface.test.ts is the executable measurement.

Constraints

• The whole sub-family crosses by this one decision — if measurement shows either rule now trips on the corpus, stop and report rather than exempting shapes ad hoc.
• ⛔ No partial security-role-word wiring smuggled in (parent card's [finding] The four views[] visibility-predicate rules are CLI-only — a Studio/REST/MCP view write bypasses all of them; if they move to runtime-publish, they must move together #7220 constraint).

Sequencing

⛔ Hold until #8116's PR merges — its dev is in flight in packages/lint (different files, same package; serialized by the seat to keep batches package-disjoint). Size S-mechanical once unblocked.

Part of #7891.

[hotlong]

Claim: PM loop round 2 (backfill slot after #7816 close; maintainer 2026-08-13: 「任务很多,并发加到3」)
Session: session_01Euoy6wyfzgiWtgCg4s6JK2
Branch: claude/issue-8307-seed-pair-runtime-types
Worktree: objectstack-issue-8307
Domain: domain:spec
File surface: the validateSecurityPosture registration in packages/lint (runtimeTypes gains 'seed') + the runtime-surface pin extension; changeset (stop on breach; explain in the report)
Container & model: S (mechanical — correctness judged by the gate farm), mode:subagent, model: sonnet
Serial constraints cleared: the packages/lint hold released — #8116 / PR #8342 MERGED (2d8dba312); no in-flight claim touches packages/lint (in flight this round: #8273 → error-code-ledger + service-settings, #8057 → objectql engine + kernel schema). Upstream #8308 (blocker-A seed repair) MERGED via PR #8338 — the measured trip-free premise for the seed pair is refreshed by that landing's own pins.

---

Generated by Claude Code

[hotlong]

<!-- os-dev-report -->

{
 "issue": 8307,
 "status": "done",
 "branch": "claude/issue-8307-seed-pair-runtime-types",
 "pr": "https://github.com/objectstack-ai/objectstack/pull/8390",
 "premise_still_valid": true,
 "summary": "Registered runtimeTypes: ['seed'] on the whole `validateSecurityPosture` registry entry in packages/lint/src/authoring-rules.ts (surfaces: CLI_ONLY -> CLI_AND_RUNTIME), putting the ADR-0091 seed pair (security-grant-expired-at-authoring, security-delegation-missing-reason) on the runtime publish door. Extended validate-security-posture.runtime-surface.test.ts with real runRuntimeAuthoringRules pins (not the pre-crossing mirror): the crossing itself, a clean-write positive control, and an isolation proof that a seed write leaks no finding from the other 11 rule ids this one entry also carries (proven against a context object that would trip two of them if isolation failed). Added a changeset.",
 "tests": "pnpm --filter @objectstack/lint build -> exit 0. pnpm --filter @objectstack/lint test -- --maxWorkers=2 -> Test Files 72 passed (72), Tests 1978 passed (1978). pnpm --filter @objectstack/lint typecheck -> clean. Corpus re-measurement (hard constraint, re-run not inherited): grepped every defineSeed() call site across all four shipped stacks (examples/app-showcase, examples/app-crm, examples/app-todo, packages/create-objectstack/src/templates/blank) -- none authors a sys_user_position or sys_user_permission_set seed row at all (zero hits for valid_until/delegated_from and both object names across all three source trees; blank has no seed data). So the ADR-0091 loop body never executes for the current corpus -- a structural zero, not a counted-and-hoped-stays-zero one. No STOP condition was hit. Local gates re-derived via node scripts/pm/dispatch-gates.mjs against the committed diff: check:spec-parsed-alias OK, check:cross-package-test-inputs OK, check:changeset-gate-self-tests OK, check:objectui-changeset/pin-fresh self-tests OK, check-changeset-no-major.mjs 'no major bump', check-adr-0087-registration.mjs 'adds no declared-breaking changeset', check:query-options-erasure ratchet holds (new test file didn't add unswept sites), check:type-check-coverage unaffected, check:nul-bytes OK. check:api-surface untouched as expected (no packages/spec source in this diff).",
 "open_questions": [],
 "out_of_scope_findings": []
}

---

Generated by Claude Code