From fd2fc82e82fa8e7f3118a649f642049e2fb89af4 Mon Sep 17 00:00:00 2001 From: Claude Date: Sun, 30 Aug 2026 02:32:58 +0000 Subject: [PATCH 1/2] fix(spec): repoint agent/skill/action liveness citations at the real cloud path The 22 citations in these three ledgers named packages/services/service-ai/..., a path that exists in neither repository, and each _note repeated a claim that is false in this checkout. Repointed onto cloud's real layout with an explicit cloud realm marker, and repaired the note. --- packages/spec/liveness/action.json | 8 ++++---- packages/spec/liveness/agent.json | 24 ++++++++++++------------ packages/spec/liveness/skill.json | 18 +++++++++--------- 3 files changed, 25 insertions(+), 25 deletions(-) diff --git a/packages/spec/liveness/action.json b/packages/spec/liveness/action.json index 2a54f403ba..7c8b8cf8e8 100644 --- a/packages/spec/liveness/action.json +++ b/packages/spec/liveness/action.json @@ -1,6 +1,6 @@ { "type": "action", - "_note": "ActionSchema. Seeded from docs/audits/2026-06-actionschema-property-liveness.md. Renderers live in objectui (evidence cited as prose, not framework paths); framework-side: service-ai action-tools, runtime body-runner/http-dispatcher. Containers (params/resultDialog/ai/aria) classified at top level — no divergent sub-statuses in the audit. ⚠ EVIDENCE LIVES IN CLOUD/EE: the `packages/services/service-ai/...` paths cited below are the closed `@objectstack/service-ai` runtime in the CLOUD repo, NOT git-tracked framework code (the framework's own service-ai tree is a stale build artifact with no src/). These props are `live` because that cloud runtime consumes them; the OPEN framework edition does not — see content/docs/ai for the open/cloud boundary. 2026-07-30 (#3896 close-out sweep): the dead authoring keys were REMOVED — tombstoned at the schema with prescriptions (retiredKey) and stripped by the protocol-17 close-out conversions; entries deleted per the #3715 precedent.", + "_note": "ActionSchema. Seeded from docs/audits/2026-06-actionschema-property-liveness.md. Renderers live in objectui (evidence cited as prose, not framework paths); framework-side: service-ai action-tools, runtime body-runner/http-dispatcher. Containers (params/resultDialog/ai/aria) classified at top level — no divergent sub-statuses in the audit. ⚠ EVIDENCE LIVES IN CLOUD/EE: the `cloud: packages/service-ai/...` paths cited below are the closed `@objectstack/service-ai` runtime in the CLOUD repo, NOT git-tracked framework code. 2026-08-30 (#13272): the previous wording of this sentence was false in BOTH halves. (a) It called the framework's own service-ai tree “a stale build artifact with no src/” — there is no tree at all: `packages/services/` holds every sibling service EXCEPT service-ai, and `git ls-files | grep -ic service-ai` returns 0. Absent, not stale. (b) The citations spelled `packages/services/service-ai/...`, a path present in NEITHER repo; cloud's real layout, measured at cloud@15f55df (#13042), is `packages/service-ai/...`. Every citation below now carries the explicit `cloud` realm marker, so it is attributed by the marker `scanEvidence` reads rather than riding the `FOREIGN_PATH_PREFIXES` special case that silently exempted the stale spelling from resolution — which is why 22 dead pointers sat green. ⚠ NOT RE-VERIFIED: this repair corrected the package root from that recorded measurement ONLY. No consumer below was re-read against a cloud checkout, so no `verifiedAt` was stamped and no `#symbol` anchor was added — the gate never resolves a foreign anchor, so an unchecked one would re-create the unfalsifiable pointer this repair removes. Re-verifying these consumers against a live cloud checkout is still open (#13272). These props are `live` because that cloud runtime consumes them; the OPEN framework edition does not — see content/docs/ai for the open/cloud boundary. 2026-07-30 (#3896 close-out sweep): the dead authoring keys were REMOVED — tombstoned at the schema with prescriptions (retiredKey) and stripped by the protocol-17 close-out conversions; entries deleted per the #3715 precedent.", "props": { "name": { "status": "live", @@ -18,7 +18,7 @@ }, "objectName": { "status": "live", - "evidence": "packages/services/service-ai/src/tools/action-tools.ts:535", + "evidence": "cloud: packages/service-ai/src/tools/action-tools.ts:535", "note": "action dispatch + AI bridge." }, "icon": { @@ -60,7 +60,7 @@ }, "params": { "status": "live", - "evidence": "packages/services/service-ai/src/tools/action-tools.ts", + "evidence": "cloud: packages/service-ai/src/tools/action-tools.ts", "note": "field/objectOverride/defaultFromRow/options/placeholder/helpText/defaultValue/required all consumed." }, "variant": { @@ -120,7 +120,7 @@ }, "ai": { "status": "live", - "evidence": "packages/services/service-ai/src/tools/action-tools.ts", + "evidence": "cloud: packages/service-ai/src/tools/action-tools.ts", "note": "full AI bridge (exposed/description/category/paramHints/outputSchema/requiresConfirmation)." }, "recordIdParam": { diff --git a/packages/spec/liveness/agent.json b/packages/spec/liveness/agent.json index c08a0c7a12..0753f616b8 100644 --- a/packages/spec/liveness/agent.json +++ b/packages/spec/liveness/agent.json @@ -1,14 +1,14 @@ { "type": "agent", - "_note": "AgentSchema. Seeded from docs/audits/2026-06-agentschema-property-liveness.md. agent-runtime.ts is the runtime consumer; AgentPreview is display-only. ⚠ EVIDENCE LIVES IN CLOUD/EE: the `packages/services/service-ai/...` paths cited below are the closed `@objectstack/service-ai` runtime in the CLOUD repo, NOT git-tracked framework code (the framework's own service-ai tree is a stale build artifact with no src/). These props are `live` because that cloud runtime consumes them; the OPEN framework edition does not — see content/docs/ai for the open/cloud boundary. 2026-07-30 (#3896 close-out sweep): the dead authoring keys were REMOVED — tombstoned at the schema with prescriptions (retiredKey) and stripped by the protocol-17 close-out conversions; entries deleted per the #3715 precedent. agent.knowledge (and AIKnowledgeSchema) removed; the topics→sources rename was absorbed into the removal pre-release.", + "_note": "AgentSchema. Seeded from docs/audits/2026-06-agentschema-property-liveness.md. agent-runtime.ts is the runtime consumer; AgentPreview is display-only. ⚠ EVIDENCE LIVES IN CLOUD/EE: the `cloud: packages/service-ai/...` paths cited below are the closed `@objectstack/service-ai` runtime in the CLOUD repo, NOT git-tracked framework code. 2026-08-30 (#13272): the previous wording of this sentence was false in BOTH halves. (a) It called the framework's own service-ai tree “a stale build artifact with no src/” — there is no tree at all: `packages/services/` holds every sibling service EXCEPT service-ai, and `git ls-files | grep -ic service-ai` returns 0. Absent, not stale. (b) The citations spelled `packages/services/service-ai/...`, a path present in NEITHER repo; cloud's real layout, measured at cloud@15f55df (#13042), is `packages/service-ai/...`. Every citation below now carries the explicit `cloud` realm marker, so it is attributed by the marker `scanEvidence` reads rather than riding the `FOREIGN_PATH_PREFIXES` special case that silently exempted the stale spelling from resolution — which is why 22 dead pointers sat green. ⚠ NOT RE-VERIFIED: this repair corrected the package root from that recorded measurement ONLY. No consumer below was re-read against a cloud checkout, so no `verifiedAt` was stamped and no `#symbol` anchor was added — the gate never resolves a foreign anchor, so an unchecked one would re-create the unfalsifiable pointer this repair removes. Re-verifying these consumers against a live cloud checkout is still open (#13272). These props are `live` because that cloud runtime consumes them; the OPEN framework edition does not — see content/docs/ai for the open/cloud boundary. 2026-07-30 (#3896 close-out sweep): the dead authoring keys were REMOVED — tombstoned at the schema with prescriptions (retiredKey) and stripped by the protocol-17 close-out conversions; entries deleted per the #3715 precedent. agent.knowledge (and AIKnowledgeSchema) removed; the topics→sources rename was absorbed into the removal pre-release.", "props": { "name": { "status": "live", - "evidence": "packages/services/service-ai/src/agent-runtime.ts" + "evidence": "cloud: packages/service-ai/src/agent-runtime.ts" }, "surface": { "status": "live", - "evidence": "packages/services/service-ai/src/agent-runtime.ts (resolveActiveSkills)", + "evidence": "cloud: packages/service-ai/src/agent-runtime.ts (resolveActiveSkills)", "note": "ADR-0063 §1 — the product surface this agent binds ('ask'|'build'). resolveActiveSkills enforces that only surface-compatible skills (matching, or 'both') attach; tool scoping is derived from that bundle." }, "label": { @@ -21,47 +21,47 @@ }, "role": { "status": "live", - "evidence": "packages/services/service-ai/src/agent-runtime.ts", + "evidence": "cloud: packages/service-ai/src/agent-runtime.ts", "note": "persona → system prompt." }, "instructions": { "status": "live", - "evidence": "packages/services/service-ai/src/agent-runtime.ts", + "evidence": "cloud: packages/service-ai/src/agent-runtime.ts", "note": "system prompt." }, "model": { "status": "live", - "evidence": "packages/services/service-ai/src/agent-runtime.ts:264", + "evidence": "cloud: packages/service-ai/src/agent-runtime.ts:264", "note": "PARTIAL — model/temperature/maxTokens applied; model.provider + topP DEAD." }, "skills": { "status": "live", - "evidence": "packages/services/service-ai/src/agent-runtime.ts", + "evidence": "cloud: packages/service-ai/src/agent-runtime.ts", "note": "Agent→Skill→Tool." }, "tools": { "status": "live", - "evidence": "packages/services/service-ai/src/agent-runtime.ts", + "evidence": "cloud: packages/service-ai/src/agent-runtime.ts", "note": "legacy direct-tool fallback." }, "active": { "status": "live", - "evidence": "packages/services/service-ai/src/agent-runtime.ts", + "evidence": "cloud: packages/service-ai/src/agent-runtime.ts", "note": "gates listing + 403 on chat." }, "planning": { "status": "live", - "evidence": "packages/services/service-ai/src/agent-runtime.ts", + "evidence": "cloud: packages/service-ai/src/agent-runtime.ts", "note": "Only planning.maxIterations remains; the dead strategy/allowReplan knobs were removed in 16.0 (#2377)." }, "access": { "status": "live", - "evidence": "packages/services/service-ai/src/routes/agent-access.ts:50", + "evidence": "cloud: packages/service-ai/src/routes/agent-access.ts:50", "note": "evaluateAgentAccess() — allow-list by userId/role; enforced at the chat route (agent-routes.ts:151). #1884 (landed after the 2026-06 audit, which still listed it dead)." }, "permissions": { "status": "live", - "evidence": "packages/services/service-ai/src/routes/agent-access.ts:50", + "evidence": "cloud: packages/service-ai/src/routes/agent-access.ts:50", "note": "evaluateAgentAccess() — caller must hold ALL required permissions/roles; enforced at the chat route. #1884." }, "lifecycle": { diff --git a/packages/spec/liveness/skill.json b/packages/spec/liveness/skill.json index 54198294ea..2ee57609a8 100644 --- a/packages/spec/liveness/skill.json +++ b/packages/spec/liveness/skill.json @@ -1,52 +1,52 @@ { "type": "skill", - "_note": "SkillSchema. Seeded from docs/audits/2026-06-skillschema-property-liveness.md. skill-registry.ts + agent-runtime.ts are the runtime consumers. ⚠ EVIDENCE LIVES IN CLOUD/EE: the `packages/services/service-ai/...` paths cited below are the closed `@objectstack/service-ai` runtime in the CLOUD repo, NOT git-tracked framework code (the framework's own service-ai tree is a stale build artifact with no src/). 2026-08-06 (#3905): that used to be the WHOLE story — the open framework consumed nothing here. It now consumes the INSTRUCTIONS half: `packages/mcp/src/skill-prompts.ts` projects every active skill carrying `instructions` onto the MCP `prompts` primitive (name/label/description/instructions/active are read there, in-repo and testable). The TOOL-BINDING half (`tools`, `surface`, `triggerConditions`) stays cloud-runtime-only and now says so in the schema's own JSDoc. See content/docs/ai for the open/cloud boundary. 2026-07-30 (#3896 close-out sweep): the dead authoring keys were REMOVED — tombstoned at the schema with prescriptions (retiredKey) and stripped by the protocol-17 close-out conversions; entries deleted per the #3715 precedent.", + "_note": "SkillSchema. Seeded from docs/audits/2026-06-skillschema-property-liveness.md. skill-registry.ts + agent-runtime.ts are the runtime consumers. ⚠ EVIDENCE LIVES IN CLOUD/EE: the `cloud: packages/service-ai/...` paths cited below are the closed `@objectstack/service-ai` runtime in the CLOUD repo, NOT git-tracked framework code. 2026-08-30 (#13272): the previous wording of this sentence was false in BOTH halves. (a) It called the framework's own service-ai tree “a stale build artifact with no src/” — there is no tree at all: `packages/services/` holds every sibling service EXCEPT service-ai, and `git ls-files | grep -ic service-ai` returns 0. Absent, not stale. (b) The citations spelled `packages/services/service-ai/...`, a path present in NEITHER repo; cloud's real layout, measured at cloud@15f55df (#13042), is `packages/service-ai/...`. Every citation below now carries the explicit `cloud` realm marker, so it is attributed by the marker `scanEvidence` reads rather than riding the `FOREIGN_PATH_PREFIXES` special case that silently exempted the stale spelling from resolution — which is why 22 dead pointers sat green. ⚠ NOT RE-VERIFIED: this repair corrected the package root from that recorded measurement ONLY. No consumer below was re-read against a cloud checkout, so no `verifiedAt` was stamped and no `#symbol` anchor was added — the gate never resolves a foreign anchor, so an unchecked one would re-create the unfalsifiable pointer this repair removes. Re-verifying these consumers against a live cloud checkout is still open (#13272). 2026-08-06 (#3905): that used to be the WHOLE story — the open framework consumed nothing here. It now consumes the INSTRUCTIONS half: `packages/mcp/src/skill-prompts.ts` projects every active skill carrying `instructions` onto the MCP `prompts` primitive (name/label/description/instructions/active are read there, in-repo and testable). The TOOL-BINDING half (`tools`, `surface`, `triggerConditions`) stays cloud-runtime-only and now says so in the schema's own JSDoc. See content/docs/ai for the open/cloud boundary. 2026-07-30 (#3896 close-out sweep): the dead authoring keys were REMOVED — tombstoned at the schema with prescriptions (retiredKey) and stripped by the protocol-17 close-out conversions; entries deleted per the #3715 precedent.", "props": { "name": { "status": "live", - "evidence": "packages/services/service-ai/src/skill-registry.ts; packages/mcp/src/skill-prompts.ts (projectSkillPrompt)", + "evidence": "cloud: packages/service-ai/src/skill-registry.ts; packages/mcp/src/skill-prompts.ts (projectSkillPrompt)", "note": "also the MCP prompt name in the open framework (#3905).", "verifiedAt": "2026-08-06" }, "surface": { "status": "live", - "evidence": "packages/services/service-ai/src/agent-runtime.ts (resolveActiveSkills)", + "evidence": "cloud: packages/service-ai/src/agent-runtime.ts (resolveActiveSkills)", "note": "ADR-0063 §3 / ADR-0064 — skill↔agent affinity. resolveActiveSkills hard-fails when a bound skill's surface ('ask'|'build'|'both') is incompatible with the agent's surface; the union of surface-compatible skills' tools IS the agent's tool set (no global fall-through). CLOUD-RUNTIME-ONLY (#3905) — the open framework has no agent to bind to.", "verifiedAt": "2026-08-06" }, "label": { "status": "live", - "evidence": "packages/services/service-ai/src/skill-registry.ts:247; packages/mcp/src/skill-prompts.ts (projectSkillPrompt)", + "evidence": "cloud: packages/service-ai/src/skill-registry.ts:247; packages/mcp/src/skill-prompts.ts (projectSkillPrompt)", "note": "injected into the agent system prompt (cloud); the MCP prompt `title` in the open framework (#3905).", "verifiedAt": "2026-08-06" }, "description": { "status": "live", - "evidence": "packages/services/service-ai/src/skill-registry.ts:247; packages/mcp/src/skill-prompts.ts (projectSkillPrompt)", + "evidence": "cloud: packages/service-ai/src/skill-registry.ts:247; packages/mcp/src/skill-prompts.ts (projectSkillPrompt)", "note": "injected into prompt (cloud); the MCP prompt `description` in the open framework (#3905).", "verifiedAt": "2026-08-06" }, "instructions": { "status": "live", - "evidence": "packages/services/service-ai/src/skill-registry.ts:247; packages/mcp/src/skill-prompts.ts (skillPromptResult)", + "evidence": "cloud: packages/service-ai/src/skill-registry.ts:247; packages/mcp/src/skill-prompts.ts (skillPromptResult)", "note": "injected into prompt (cloud); served as the MCP `prompts/get` message body in the open framework (#3905) — a skill without it is not projected at all.", "verifiedAt": "2026-08-06" }, "tools": { "status": "live", - "evidence": "packages/services/service-ai/src/skill-registry.ts:206", + "evidence": "cloud: packages/service-ai/src/skill-registry.ts:206", "note": "tool-contribution path incl. action_* wildcard. CLOUD-RUNTIME-ONLY (#3905): MCP exposes one flat tool list to a client-side model, so there is nothing to bind server-side; still validated at authoring time in both distributions.", "verifiedAt": "2026-08-06" }, "triggerConditions": { "status": "live", - "evidence": "packages/services/service-ai/src/skill-registry.ts:153", + "evidence": "cloud: packages/service-ai/src/skill-registry.ts:153", "note": "THE activation gate — AND of {field,operator,value}. CLOUD-RUNTIME-ONLY (#3905): MCP has no server-side activation step; a client lists every projected prompt and chooses.", "verifiedAt": "2026-08-06" }, "active": { "status": "live", - "evidence": "packages/services/service-ai/src/skill-registry.ts:93; packages/mcp/src/skill-prompts.ts (projectSkillPrompt)", + "evidence": "cloud: packages/service-ai/src/skill-registry.ts:93; packages/mcp/src/skill-prompts.ts (projectSkillPrompt)", "note": "inactive skills dropped — by the cloud registry, and not projected as an MCP prompt either (#3905).", "verifiedAt": "2026-08-06" }, From 7e1580b9cfbca4ac3c939ac1403859bcae76d906 Mon Sep 17 00:00:00 2001 From: Claude Date: Sun, 30 Aug 2026 02:42:47 +0000 Subject: [PATCH 2/2] chore(spec): add changeset for the liveness cloud-path repair --- .../liveness-cloud-path-agent-skill-action.md | 39 +++++++++++++++++++ 1 file changed, 39 insertions(+) create mode 100644 .changeset/liveness-cloud-path-agent-skill-action.md diff --git a/.changeset/liveness-cloud-path-agent-skill-action.md b/.changeset/liveness-cloud-path-agent-skill-action.md new file mode 100644 index 0000000000..55809e979d --- /dev/null +++ b/.changeset/liveness-cloud-path-agent-skill-action.md @@ -0,0 +1,39 @@ +--- +"@objectstack/spec": patch +--- + +fix(spec): repoint the `agent`, `skill` and `action` liveness citations at the real cloud path (#13272) + +The `liveness/` ledgers ship inside this package's npm tarball (they are named +in `files`), so this is a published-data change even though no runtime +behaviour moves and no schema key changes. No `status` verdict is altered. + +Twenty-two `evidence` citations across `liveness/agent.json` (11), +`liveness/skill.json` (8) and `liveness/action.json` (3) named +`packages/services/service-ai/...` — a path that exists in **neither** +repository. The framework has no service-ai tree at all (`packages/services/` +ships every sibling service except it), and cloud's real layout, measured at +cloud@`15f55df`, is `packages/service-ai/...`. Each `_note` additionally +repeated the claim that the framework's own tree "is a stale build artifact +with no `src/`", which is false in the opposite direction from the one it +suggests: absent, not stale. + +Why twenty-two dead pointers sat green, and why the repair is not a plain +re-spelling: `FOREIGN_PATH_PREFIXES` in `scripts/liveness/evidence.mts` lists +the *stale* spelling, so those citations were silently treated as foreign and +never resolved — they did not survive scrutiny, they were exempt from it. The +real cloud path is repo-rooted in shape and is not in that list, so a naive +repoint resolves as LOCAL and fails CI. Measured on this branch by ablation: +stripping the realm markers moves the gate from `467 repo-local ... 467 +resolved` to `489 ... 467 resolved, 22 MISSING` and exit 1. Every repointed +citation therefore carries the explicit `cloud` realm marker, which is the +attribution `scanEvidence` reads directly rather than a special case for one +prefix. The constant is deliberately left alone: adding the real path to it +would let an unmarked citation pass silently, trading one unfalsifiable +spelling for another. + +Scope boundary recorded in each `_note`: this corrects the package root from +the measurement above only. The cited consumers were **not** re-read against a +cloud checkout, so no `verifiedAt` is stamped and no `#symbol` anchor is added +— the gate never resolves a foreign anchor, so an unverified one would +re-create the very unfalsifiable pointer this repair removes.