fix(cli): stamp the manifest identity block in the os create example scaffold

[os-trump]

Fixes#14705

What was wrong, re-verified on origin/main

os create example [name] wrote an objectstack.config.ts whose manifest:
block was name, version, description — nothing else
(packages/cli/src/commands/create.ts:130, confirmed at merge base 8f9ef6f7c8).
ManifestSchema requires id and type; namespace — the mandatory prefix of
every object name, and therefore each object's table name and REST path — was
absent too. defineStack refuses that, so the project a documented command had
just created failed on its first run, before the author wrote a line.

The ablation leg below reproduces the reported measurement verbatim, through the
real schema:

defineStack validation failed (2 issues):
x manifest.id: Required property 'id' is missing.
x manifest.type: Invalid value ''. Did you mean one of: 'ui', 'app'?

Every factual claim in the card holds. init.ts's three templates all stamp
id / namespace / type / engines.protocol; create's example template
is the one scaffold that had drifted. One clarification, not a correction:
create's plugin template emits no objectstack.config.ts at all — it
scaffolds a Plugin object in src/index.ts — so example is the only
create template ManifestSchema governs.

What changed

packages/cli/src/commands/create.ts (+19/-3) — the example template now
stamps what os init stamps: id: 'com.example.NAMESPACE', namespace,
type: 'app' and engines: { protocol: '^PROTOCOL_MAJOR' }, alongside the
version / name / description it already carried. The namespace comes from
init's own exported sanitizeNamespace, and the protocol range from the same
PROTOCOL_MAJOR constant init stamps, so the two scaffolders cannot answer
differently for the same input. The shipped comment explaining the protocol
range is copied from init's template, which is already pinned self-contained
(no monorepo-only reference, and its docs link resolves).

packages/cli/test/scaffold-manifest-schema.test.ts (new, 223 lines) — the
pin the card asks for. It sweeps both scaffolders: every init and create
template that emits an objectstack.config.ts is rendered through its own
emitter (configContent + writeTemplateSrcFiles for init; the .ts entries
of the files map for create), written to a throwaway directory under the
package's git-ignored tmp/, loaded back through bundle-require — the same
loader scaffold-validate.ts uses — and its manifest parsed through the real
ManifestSchema. Nothing is hand-copied: the population is derived from the two
template maps, so a template added later is swept the day it is added.

The standalone ManifestSchema parse is not redundant with the defineStack
call above it. ObjectStackDefinitionSchema.manifest is .optional(), so a
template that drops the block entirely, or one that calls
defineStack(config, { strict: false }), loads green at that door and ships a
project with no id, namespace or type. The header states both.

.changeset/create-scaffold-manifest-identity.md — patch for
@objectstack/cli.

File face

.changeset/create-scaffold-manifest-identity.md +37
packages/cli/src/commands/create.ts +19 -3
packages/cli/test/scaffold-manifest-schema.test.ts +223

Three files. packages/spec is untouched — the honest fix needed no schema
change; the scaffold was simply not declaring what the schema has always
required.

Measurements — all at 1a30e47e09, this PR's head

Reverse verification (three legs, one script, trap ... EXIT INT TERM).
Committed first, so the restore leg's reference (HEAD) already carried the fix.

leg	tree	result
1	fixed	Test Files 5 passed (5) · Tests 43 passed (43)
2	create.ts reverted to origin/main	Tests 1 failed | 5 passed (6) — the single failure is create:example, with the diagnostic quoted above
3	restored	blob hash back to 779e4fecfd, git diff HEAD empty

Mutation proved on disk, not by exit code: HEAD_BLOB=779e4fecfd... vs
MUT_BLOB=f706bb2199... (differ, non-empty), and the mutated file's
sanitizeNamespace / PROTOCOL_MAJOR occurrence counts both dropped to 0.
Restore proved the same way — the hash returned to HEAD_BLOB and the diff is
empty. The ablation direction is a plain red, and only in the scaffold the card
names: the three init scaffolds stayed green through both legs, so the pin is
specific rather than a blanket refusal.

Suite run (under the shared verify lock):
pnpm --filter @objectstack/cli exec vitest run --project unit --maxWorkers=2 test/scaffold-manifest-schema.test.ts test/create.test.ts test/init-scaffold-authoring-rules.test.ts test/init-template-comments-self-contained.test.ts test/commands.test.ts

Typecheck.pnpm --filter @objectstack/cli typecheck exit 0 (script echoed
tsc --noEmit, so not a zero-match pass). --listFiles says what that covers
and what it does not: src/commands/create.ts is in the program (1 hit); the
new test file is not (0 hits) — this package's tsconfig.json is
include: ["src"], which is why it carries a TEST_DEBT entry. So that green
says nothing about the new test, and the ratchet is measured separately below.

ESLint.pnpm lint — the whole repo, eslint . --no-inline-config — exit
0. No narrowing claimed and none needed.

Gate families.node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack
derives 37 for this diff (35 by path + 6 by change kind, 4 shared). Harvested
with --commands, re-run whole at this head: 34 green, 3 NOT MEASURED —
recorded as such, not as passes and not as reds:

• node scripts/check-test-completeness.mjs — exit 3, PREREQUISITE NOT MET:
  it grades a saved turbo run test log and there is none locally. CI passes
  the path on every invocation.
• node scripts/pm/check-half-states.mjs — exit 3, PREREQUISITE NOT MET: it
  needs repo-scoped REST egress this container does not have.
• pnpm check:type-check-debt (--re-measure) — killed by the 10-minute
  foreground ceiling mid-sweep; it re-runs tsc across 10 ledger packages.
  Substituted with a targeted measurement of the same quantity: a probe
  config extending this package's own tsconfig.json with
  include: ["src", "test"] reports 144 errors — exactly the frozen
  TEST_DEBT['@objectstack/cli'].errors of 144 — and zero of them are in
  scaffold-manifest-schema.test.ts. The new test file therefore cannot push
  the ratchet up. The probe config was deleted; it is not in the diff.

pnpm check:i18n, check:i18n-coverage and check:dual-build-cjs-loads each
refused on an unbuilt closure at first and were re-run green once the workspace
build caught up; the green readings above are the ones taken at this head.

What I deliberately did NOT do

• os create is untouched as a command. Not removed, not deprecated, not
  redirected at os init, and it does not call init internally. Whether two
  scaffolders should coexist is a CLI-surface decision and is not this PR's.
  Fixing the template forecloses nothing there.
• packages/spec is untouched. No schema change was needed or made.
• create's plugin template is untouched. It emits no package manifest,
  so ManifestSchema has nothing to say about it, and pretending otherwise
  would have put a surface in the sweep that the schema does not govern.
• The scaffold's package.json / tsconfig.json are not emitted by the pin.
  They are monorepo-relative (workspace:*, extends: '../../tsconfig.json')
  and resolve to nothing from a throwaway directory, and neither can change what
  the manifest declares. The test header records this and why.

Draft, per dispatch. Not flipped ready, no auto-merge armed.

🤖 Generated with Claude Code

https://claude.ai/code/session_016yfqQh2dBgPAymYd7xipza

Generated by Claude Code

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/cli, touching 1 documentable anchor(s).

4 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/deployment/cli.mdx(via os create (command, read off packages/cli/src/commands/create.ts))
• content/docs/plugins/index.mdx(via os create (command, read off packages/cli/src/commands/create.ts))
• content/docs/protocol/kernel/index.mdx(via os create (command, read off packages/cli/src/commands/create.ts))
• content/docs/protocol/kernel/plugin-spec.mdx(via os create (command, read off packages/cli/src/commands/create.ts))

What this run could not see

• 1 anchor(s) matched too much of the corpus to be a work list: objectstack.config.ts (literal, 32 pages)
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 22 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 5a5336b399db2ef18dd4700f97d579a328197dda → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 1b77c4b5450e40755f2b69dc665a2a026eaa9604 — the merge of head 1a30e47e0915a10a4beaa9459402843c46690165 into base 5a5336b399db2ef18dd4700f97d579a328197dda, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 1b77c4b5450e40755f2b69dc665a2a026eaa9604 && git checkout 1b77c4b5450e40755f2b69dc665a2a026eaa9604
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 5a5336b399db2ef18dd4700f97d579a328197dda 1a30e47e0915a10a4beaa9459402843c46690165 && git checkout -B drift-repro 5a5336b399db2ef18dd4700f97d579a328197dda && git merge --no-ff 1a30e47e0915a10a4beaa9459402843c46690165
node scripts/docs-audit/affected-docs.mjs --json 5a5336b399db2ef18dd4700f97d579a328197dda

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 5a5336b399db2ef18dd4700f97d579a328197dda → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[os-trump]

Fixes#14705

What was wrong, re-verified on origin/main

os create example [name] wrote an objectstack.config.ts whose manifest:
block was name, version, description — nothing else
(packages/cli/src/commands/create.ts:130, confirmed at merge base 8f9ef6f7c8).
ManifestSchema requires id and type; namespace — the mandatory prefix of
every object name, and therefore each object's table name and REST path — was
absent too. defineStack refuses that, so the project a documented command had
just created failed on its first run, before the author wrote a line.

The ablation leg below reproduces the reported measurement verbatim, through the
real schema:

defineStack validation failed (2 issues):
x manifest.id: Required property 'id' is missing.
x manifest.type: Invalid value ''. Did you mean one of: 'ui', 'app'?

Every factual claim in the card holds. init.ts's three templates all stamp
id / namespace / type / engines.protocol; create's example template
is the one scaffold that had drifted. One clarification, not a correction:
create's plugin template emits no objectstack.config.ts at all — it
scaffolds a Plugin object in src/index.ts — so example is the only
create template ManifestSchema governs.

What changed

packages/cli/src/commands/create.ts (+19/-3) — the example template now
stamps what os init stamps: id: 'com.example.NAMESPACE', namespace,
type: 'app' and engines: { protocol: '^PROTOCOL_MAJOR' }, alongside the
version / name / description it already carried. The namespace comes from
init's own exported sanitizeNamespace, and the protocol range from the same
PROTOCOL_MAJOR constant init stamps, so the two scaffolders cannot answer
differently for the same input. The shipped comment explaining the protocol
range is copied from init's template, which is already pinned self-contained
(no monorepo-only reference, and its docs link resolves).

packages/cli/test/scaffold-manifest-schema.test.ts (new, 223 lines) — the
pin the card asks for. It sweeps both scaffolders: every init and create
template that emits an objectstack.config.ts is rendered through its own
emitter (configContent + writeTemplateSrcFiles for init; the .ts entries
of the files map for create), written to a throwaway directory under the
package's git-ignored tmp/, loaded back through bundle-require — the same
loader scaffold-validate.ts uses — and its manifest parsed through the real
ManifestSchema. Nothing is hand-copied: the population is derived from the two
template maps, so a template added later is swept the day it is added.

The standalone ManifestSchema parse is not redundant with the defineStack
call above it. ObjectStackDefinitionSchema.manifest is .optional(), so a
template that drops the block entirely, or one that calls
defineStack(config, { strict: false }), loads green at that door and ships a
project with no id, namespace or type. The header states both.

.changeset/create-scaffold-manifest-identity.md — patch for
@objectstack/cli.

File face

.changeset/create-scaffold-manifest-identity.md +37
packages/cli/src/commands/create.ts +19 -3
packages/cli/test/scaffold-manifest-schema.test.ts +223

Three files. packages/spec is untouched — the honest fix needed no schema
change; the scaffold was simply not declaring what the schema has always
required.

Measurements — all at 1a30e47e09, this PR's head

Reverse verification (three legs, one script, trap ... EXIT INT TERM).
Committed first, so the restore leg's reference (HEAD) already carried the fix.

leg	tree	result
1	fixed	Test Files 5 passed (5) · Tests 43 passed (43)
2	create.ts reverted to origin/main	Tests 1 failed | 5 passed (6) — the single failure is create:example, with the diagnostic quoted above
3	restored	blob hash back to 779e4fecfd, git diff HEAD empty

Mutation proved on disk, not by exit code: HEAD_BLOB=779e4fecfd... vs
MUT_BLOB=f706bb2199... (differ, non-empty), and the mutated file's
sanitizeNamespace / PROTOCOL_MAJOR occurrence counts both dropped to 0.
Restore proved the same way — the hash returned to HEAD_BLOB and the diff is
empty. The ablation direction is a plain red, and only in the scaffold the card
names: the three init scaffolds stayed green through both legs, so the pin is
specific rather than a blanket refusal.

Suite run (under the shared verify lock):
pnpm --filter @objectstack/cli exec vitest run --project unit --maxWorkers=2 test/scaffold-manifest-schema.test.ts test/create.test.ts test/init-scaffold-authoring-rules.test.ts test/init-template-comments-self-contained.test.ts test/commands.test.ts

Typecheck.pnpm --filter @objectstack/cli typecheck exit 0 (script echoed
tsc --noEmit, so not a zero-match pass). --listFiles says what that covers
and what it does not: src/commands/create.ts is in the program (1 hit); the
new test file is not (0 hits) — this package's tsconfig.json is
include: ["src"], which is why it carries a TEST_DEBT entry. So that green
says nothing about the new test, and the ratchet is measured separately below.

ESLint.pnpm lint — the whole repo, eslint . --no-inline-config — exit
0. No narrowing claimed and none needed.

Gate families.node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack
derives 37 for this diff (35 by path + 6 by change kind, 4 shared). Harvested
with --commands, re-run whole at this head: 34 green, 3 NOT MEASURED —
recorded as such, not as passes and not as reds:

• node scripts/check-test-completeness.mjs — exit 3, PREREQUISITE NOT MET:
  it grades a saved turbo run test log and there is none locally. CI passes
  the path on every invocation.
• node scripts/pm/check-half-states.mjs — exit 3, PREREQUISITE NOT MET: it
  needs repo-scoped REST egress this container does not have.
• pnpm check:type-check-debt (--re-measure) — killed by the 10-minute
  foreground ceiling mid-sweep; it re-runs tsc across 10 ledger packages.
  Substituted with a targeted measurement of the same quantity: a probe
  config extending this package's own tsconfig.json with
  include: ["src", "test"] reports 144 errors — exactly the frozen
  TEST_DEBT['@objectstack/cli'].errors of 144 — and zero of them are in
  scaffold-manifest-schema.test.ts. The new test file therefore cannot push
  the ratchet up. The probe config was deleted; it is not in the diff.

pnpm check:i18n, check:i18n-coverage and check:dual-build-cjs-loads each
refused on an unbuilt closure at first and were re-run green once the workspace
build caught up; the green readings above are the ones taken at this head.

What I deliberately did NOT do

• os create is untouched as a command. Not removed, not deprecated, not
  redirected at os init, and it does not call init internally. Whether two
  scaffolders should coexist is a CLI-surface decision and is not this PR's.
  Fixing the template forecloses nothing there.
• packages/spec is untouched. No schema change was needed or made.
• create's plugin template is untouched. It emits no package manifest,
  so ManifestSchema has nothing to say about it, and pretending otherwise
  would have put a surface in the sweep that the schema does not govern.
• The scaffold's package.json / tsconfig.json are not emitted by the pin.
  They are monorepo-relative (workspace:*, extends: '../../tsconfig.json')
  and resolve to nothing from a throwaway directory, and neither can change what
  the manifest declares. The test header records this and why.

Draft, per dispatch. Not flipped ready, no auto-merge armed.

🤖 Generated with Claude Code

https://claude.ai/code/session_016yfqQh2dBgPAymYd7xipza

Generated by Claude Code

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/cli, touching 1 documentable anchor(s).

4 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/deployment/cli.mdx(via os create (command, read off packages/cli/src/commands/create.ts))
• content/docs/plugins/index.mdx(via os create (command, read off packages/cli/src/commands/create.ts))
• content/docs/protocol/kernel/index.mdx(via os create (command, read off packages/cli/src/commands/create.ts))
• content/docs/protocol/kernel/plugin-spec.mdx(via os create (command, read off packages/cli/src/commands/create.ts))

What this run could not see

• 1 anchor(s) matched too much of the corpus to be a work list: objectstack.config.ts (literal, 32 pages)
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 22 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 5a5336b399db2ef18dd4700f97d579a328197dda → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 1b77c4b5450e40755f2b69dc665a2a026eaa9604 — the merge of head 1a30e47e0915a10a4beaa9459402843c46690165 into base 5a5336b399db2ef18dd4700f97d579a328197dda, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 1b77c4b5450e40755f2b69dc665a2a026eaa9604 && git checkout 1b77c4b5450e40755f2b69dc665a2a026eaa9604
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 5a5336b399db2ef18dd4700f97d579a328197dda 1a30e47e0915a10a4beaa9459402843c46690165 && git checkout -B drift-repro 5a5336b399db2ef18dd4700f97d579a328197dda && git merge --no-ff 1a30e47e0915a10a4beaa9459402843c46690165
node scripts/docs-audit/affected-docs.mjs --json 5a5336b399db2ef18dd4700f97d579a328197dda

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 5a5336b399db2ef18dd4700f97d579a328197dda → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[os-trump]

Fixes#14705

What was wrong, re-verified on origin/main

os create example [name] wrote an objectstack.config.ts whose manifest:
block was name, version, description — nothing else
(packages/cli/src/commands/create.ts:130, confirmed at merge base 8f9ef6f7c8).
ManifestSchema requires id and type; namespace — the mandatory prefix of
every object name, and therefore each object's table name and REST path — was
absent too. defineStack refuses that, so the project a documented command had
just created failed on its first run, before the author wrote a line.

The ablation leg below reproduces the reported measurement verbatim, through the
real schema:

defineStack validation failed (2 issues):
x manifest.id: Required property 'id' is missing.
x manifest.type: Invalid value ''. Did you mean one of: 'ui', 'app'?

Every factual claim in the card holds. init.ts's three templates all stamp
id / namespace / type / engines.protocol; create's example template
is the one scaffold that had drifted. One clarification, not a correction:
create's plugin template emits no objectstack.config.ts at all — it
scaffolds a Plugin object in src/index.ts — so example is the only
create template ManifestSchema governs.

What changed

packages/cli/src/commands/create.ts (+19/-3) — the example template now
stamps what os init stamps: id: 'com.example.NAMESPACE', namespace,
type: 'app' and engines: { protocol: '^PROTOCOL_MAJOR' }, alongside the
version / name / description it already carried. The namespace comes from
init's own exported sanitizeNamespace, and the protocol range from the same
PROTOCOL_MAJOR constant init stamps, so the two scaffolders cannot answer
differently for the same input. The shipped comment explaining the protocol
range is copied from init's template, which is already pinned self-contained
(no monorepo-only reference, and its docs link resolves).

packages/cli/test/scaffold-manifest-schema.test.ts (new, 223 lines) — the
pin the card asks for. It sweeps both scaffolders: every init and create
template that emits an objectstack.config.ts is rendered through its own
emitter (configContent + writeTemplateSrcFiles for init; the .ts entries
of the files map for create), written to a throwaway directory under the
package's git-ignored tmp/, loaded back through bundle-require — the same
loader scaffold-validate.ts uses — and its manifest parsed through the real
ManifestSchema. Nothing is hand-copied: the population is derived from the two
template maps, so a template added later is swept the day it is added.

The standalone ManifestSchema parse is not redundant with the defineStack
call above it. ObjectStackDefinitionSchema.manifest is .optional(), so a
template that drops the block entirely, or one that calls
defineStack(config, { strict: false }), loads green at that door and ships a
project with no id, namespace or type. The header states both.

.changeset/create-scaffold-manifest-identity.md — patch for
@objectstack/cli.

File face

.changeset/create-scaffold-manifest-identity.md +37
packages/cli/src/commands/create.ts +19 -3
packages/cli/test/scaffold-manifest-schema.test.ts +223

Three files. packages/spec is untouched — the honest fix needed no schema
change; the scaffold was simply not declaring what the schema has always
required.

Measurements — all at 1a30e47e09, this PR's head

Reverse verification (three legs, one script, trap ... EXIT INT TERM).
Committed first, so the restore leg's reference (HEAD) already carried the fix.

leg	tree	result
1	fixed	Test Files 5 passed (5) · Tests 43 passed (43)
2	create.ts reverted to origin/main	Tests 1 failed | 5 passed (6) — the single failure is create:example, with the diagnostic quoted above
3	restored	blob hash back to 779e4fecfd, git diff HEAD empty

Mutation proved on disk, not by exit code: HEAD_BLOB=779e4fecfd... vs
MUT_BLOB=f706bb2199... (differ, non-empty), and the mutated file's
sanitizeNamespace / PROTOCOL_MAJOR occurrence counts both dropped to 0.
Restore proved the same way — the hash returned to HEAD_BLOB and the diff is
empty. The ablation direction is a plain red, and only in the scaffold the card
names: the three init scaffolds stayed green through both legs, so the pin is
specific rather than a blanket refusal.

Suite run (under the shared verify lock):
pnpm --filter @objectstack/cli exec vitest run --project unit --maxWorkers=2 test/scaffold-manifest-schema.test.ts test/create.test.ts test/init-scaffold-authoring-rules.test.ts test/init-template-comments-self-contained.test.ts test/commands.test.ts

Typecheck.pnpm --filter @objectstack/cli typecheck exit 0 (script echoed
tsc --noEmit, so not a zero-match pass). --listFiles says what that covers
and what it does not: src/commands/create.ts is in the program (1 hit); the
new test file is not (0 hits) — this package's tsconfig.json is
include: ["src"], which is why it carries a TEST_DEBT entry. So that green
says nothing about the new test, and the ratchet is measured separately below.

ESLint.pnpm lint — the whole repo, eslint . --no-inline-config — exit
0. No narrowing claimed and none needed.

Gate families.node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack
derives 37 for this diff (35 by path + 6 by change kind, 4 shared). Harvested
with --commands, re-run whole at this head: 34 green, 3 NOT MEASURED —
recorded as such, not as passes and not as reds:

• node scripts/check-test-completeness.mjs — exit 3, PREREQUISITE NOT MET:
  it grades a saved turbo run test log and there is none locally. CI passes
  the path on every invocation.
• node scripts/pm/check-half-states.mjs — exit 3, PREREQUISITE NOT MET: it
  needs repo-scoped REST egress this container does not have.
• pnpm check:type-check-debt (--re-measure) — killed by the 10-minute
  foreground ceiling mid-sweep; it re-runs tsc across 10 ledger packages.
  Substituted with a targeted measurement of the same quantity: a probe
  config extending this package's own tsconfig.json with
  include: ["src", "test"] reports 144 errors — exactly the frozen
  TEST_DEBT['@objectstack/cli'].errors of 144 — and zero of them are in
  scaffold-manifest-schema.test.ts. The new test file therefore cannot push
  the ratchet up. The probe config was deleted; it is not in the diff.

pnpm check:i18n, check:i18n-coverage and check:dual-build-cjs-loads each
refused on an unbuilt closure at first and were re-run green once the workspace
build caught up; the green readings above are the ones taken at this head.

What I deliberately did NOT do

• os create is untouched as a command. Not removed, not deprecated, not
  redirected at os init, and it does not call init internally. Whether two
  scaffolders should coexist is a CLI-surface decision and is not this PR's.
  Fixing the template forecloses nothing there.
• packages/spec is untouched. No schema change was needed or made.
• create's plugin template is untouched. It emits no package manifest,
  so ManifestSchema has nothing to say about it, and pretending otherwise
  would have put a surface in the sweep that the schema does not govern.
• The scaffold's package.json / tsconfig.json are not emitted by the pin.
  They are monorepo-relative (workspace:*, extends: '../../tsconfig.json')
  and resolve to nothing from a throwaway directory, and neither can change what
  the manifest declares. The test header records this and why.

Draft, per dispatch. Not flipped ready, no auto-merge armed.

🤖 Generated with Claude Code

https://claude.ai/code/session_016yfqQh2dBgPAymYd7xipza

Generated by Claude Code

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/cli, touching 1 documentable anchor(s).

4 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/deployment/cli.mdx(via os create (command, read off packages/cli/src/commands/create.ts))
• content/docs/plugins/index.mdx(via os create (command, read off packages/cli/src/commands/create.ts))
• content/docs/protocol/kernel/index.mdx(via os create (command, read off packages/cli/src/commands/create.ts))
• content/docs/protocol/kernel/plugin-spec.mdx(via os create (command, read off packages/cli/src/commands/create.ts))

What this run could not see

• 1 anchor(s) matched too much of the corpus to be a work list: objectstack.config.ts (literal, 32 pages)
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 22 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 5a5336b399db2ef18dd4700f97d579a328197dda → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 1b77c4b5450e40755f2b69dc665a2a026eaa9604 — the merge of head 1a30e47e0915a10a4beaa9459402843c46690165 into base 5a5336b399db2ef18dd4700f97d579a328197dda, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 1b77c4b5450e40755f2b69dc665a2a026eaa9604 && git checkout 1b77c4b5450e40755f2b69dc665a2a026eaa9604
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 5a5336b399db2ef18dd4700f97d579a328197dda 1a30e47e0915a10a4beaa9459402843c46690165 && git checkout -B drift-repro 5a5336b399db2ef18dd4700f97d579a328197dda && git merge --no-ff 1a30e47e0915a10a4beaa9459402843c46690165
node scripts/docs-audit/affected-docs.mjs --json 5a5336b399db2ef18dd4700f97d579a328197dda

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 5a5336b399db2ef18dd4700f97d579a328197dda → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[os-trump]

Fixes#14705

What was wrong, re-verified on origin/main

os create example [name] wrote an objectstack.config.ts whose manifest:
block was name, version, description — nothing else
(packages/cli/src/commands/create.ts:130, confirmed at merge base 8f9ef6f7c8).
ManifestSchema requires id and type; namespace — the mandatory prefix of
every object name, and therefore each object's table name and REST path — was
absent too. defineStack refuses that, so the project a documented command had
just created failed on its first run, before the author wrote a line.

The ablation leg below reproduces the reported measurement verbatim, through the
real schema:

defineStack validation failed (2 issues):
x manifest.id: Required property 'id' is missing.
x manifest.type: Invalid value ''. Did you mean one of: 'ui', 'app'?

Every factual claim in the card holds. init.ts's three templates all stamp
id / namespace / type / engines.protocol; create's example template
is the one scaffold that had drifted. One clarification, not a correction:
create's plugin template emits no objectstack.config.ts at all — it
scaffolds a Plugin object in src/index.ts — so example is the only
create template ManifestSchema governs.

What changed

packages/cli/src/commands/create.ts (+19/-3) — the example template now
stamps what os init stamps: id: 'com.example.NAMESPACE', namespace,
type: 'app' and engines: { protocol: '^PROTOCOL_MAJOR' }, alongside the
version / name / description it already carried. The namespace comes from
init's own exported sanitizeNamespace, and the protocol range from the same
PROTOCOL_MAJOR constant init stamps, so the two scaffolders cannot answer
differently for the same input. The shipped comment explaining the protocol
range is copied from init's template, which is already pinned self-contained
(no monorepo-only reference, and its docs link resolves).

packages/cli/test/scaffold-manifest-schema.test.ts (new, 223 lines) — the
pin the card asks for. It sweeps both scaffolders: every init and create
template that emits an objectstack.config.ts is rendered through its own
emitter (configContent + writeTemplateSrcFiles for init; the .ts entries
of the files map for create), written to a throwaway directory under the
package's git-ignored tmp/, loaded back through bundle-require — the same
loader scaffold-validate.ts uses — and its manifest parsed through the real
ManifestSchema. Nothing is hand-copied: the population is derived from the two
template maps, so a template added later is swept the day it is added.

The standalone ManifestSchema parse is not redundant with the defineStack
call above it. ObjectStackDefinitionSchema.manifest is .optional(), so a
template that drops the block entirely, or one that calls
defineStack(config, { strict: false }), loads green at that door and ships a
project with no id, namespace or type. The header states both.

.changeset/create-scaffold-manifest-identity.md — patch for
@objectstack/cli.

File face

.changeset/create-scaffold-manifest-identity.md +37
packages/cli/src/commands/create.ts +19 -3
packages/cli/test/scaffold-manifest-schema.test.ts +223

Three files. packages/spec is untouched — the honest fix needed no schema
change; the scaffold was simply not declaring what the schema has always
required.

Measurements — all at 1a30e47e09, this PR's head

Reverse verification (three legs, one script, trap ... EXIT INT TERM).
Committed first, so the restore leg's reference (HEAD) already carried the fix.

leg	tree	result
1	fixed	Test Files 5 passed (5) · Tests 43 passed (43)
2	create.ts reverted to origin/main	Tests 1 failed | 5 passed (6) — the single failure is create:example, with the diagnostic quoted above
3	restored	blob hash back to 779e4fecfd, git diff HEAD empty

Mutation proved on disk, not by exit code: HEAD_BLOB=779e4fecfd... vs
MUT_BLOB=f706bb2199... (differ, non-empty), and the mutated file's
sanitizeNamespace / PROTOCOL_MAJOR occurrence counts both dropped to 0.
Restore proved the same way — the hash returned to HEAD_BLOB and the diff is
empty. The ablation direction is a plain red, and only in the scaffold the card
names: the three init scaffolds stayed green through both legs, so the pin is
specific rather than a blanket refusal.

Suite run (under the shared verify lock):
pnpm --filter @objectstack/cli exec vitest run --project unit --maxWorkers=2 test/scaffold-manifest-schema.test.ts test/create.test.ts test/init-scaffold-authoring-rules.test.ts test/init-template-comments-self-contained.test.ts test/commands.test.ts

Typecheck.pnpm --filter @objectstack/cli typecheck exit 0 (script echoed
tsc --noEmit, so not a zero-match pass). --listFiles says what that covers
and what it does not: src/commands/create.ts is in the program (1 hit); the
new test file is not (0 hits) — this package's tsconfig.json is
include: ["src"], which is why it carries a TEST_DEBT entry. So that green
says nothing about the new test, and the ratchet is measured separately below.

ESLint.pnpm lint — the whole repo, eslint . --no-inline-config — exit
0. No narrowing claimed and none needed.

Gate families.node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack
derives 37 for this diff (35 by path + 6 by change kind, 4 shared). Harvested
with --commands, re-run whole at this head: 34 green, 3 NOT MEASURED —
recorded as such, not as passes and not as reds:

• node scripts/check-test-completeness.mjs — exit 3, PREREQUISITE NOT MET:
  it grades a saved turbo run test log and there is none locally. CI passes
  the path on every invocation.
• node scripts/pm/check-half-states.mjs — exit 3, PREREQUISITE NOT MET: it
  needs repo-scoped REST egress this container does not have.
• pnpm check:type-check-debt (--re-measure) — killed by the 10-minute
  foreground ceiling mid-sweep; it re-runs tsc across 10 ledger packages.
  Substituted with a targeted measurement of the same quantity: a probe
  config extending this package's own tsconfig.json with
  include: ["src", "test"] reports 144 errors — exactly the frozen
  TEST_DEBT['@objectstack/cli'].errors of 144 — and zero of them are in
  scaffold-manifest-schema.test.ts. The new test file therefore cannot push
  the ratchet up. The probe config was deleted; it is not in the diff.

pnpm check:i18n, check:i18n-coverage and check:dual-build-cjs-loads each
refused on an unbuilt closure at first and were re-run green once the workspace
build caught up; the green readings above are the ones taken at this head.

What I deliberately did NOT do

• os create is untouched as a command. Not removed, not deprecated, not
  redirected at os init, and it does not call init internally. Whether two
  scaffolders should coexist is a CLI-surface decision and is not this PR's.
  Fixing the template forecloses nothing there.
• packages/spec is untouched. No schema change was needed or made.
• create's plugin template is untouched. It emits no package manifest,
  so ManifestSchema has nothing to say about it, and pretending otherwise
  would have put a surface in the sweep that the schema does not govern.
• The scaffold's package.json / tsconfig.json are not emitted by the pin.
  They are monorepo-relative (workspace:*, extends: '../../tsconfig.json')
  and resolve to nothing from a throwaway directory, and neither can change what
  the manifest declares. The test header records this and why.

Draft, per dispatch. Not flipped ready, no auto-merge armed.

🤖 Generated with Claude Code

https://claude.ai/code/session_016yfqQh2dBgPAymYd7xipza

Generated by Claude Code

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/cli, touching 1 documentable anchor(s).

4 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/deployment/cli.mdx(via os create (command, read off packages/cli/src/commands/create.ts))
• content/docs/plugins/index.mdx(via os create (command, read off packages/cli/src/commands/create.ts))
• content/docs/protocol/kernel/index.mdx(via os create (command, read off packages/cli/src/commands/create.ts))
• content/docs/protocol/kernel/plugin-spec.mdx(via os create (command, read off packages/cli/src/commands/create.ts))

What this run could not see

• 1 anchor(s) matched too much of the corpus to be a work list: objectstack.config.ts (literal, 32 pages)
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 22 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 5a5336b399db2ef18dd4700f97d579a328197dda → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 1b77c4b5450e40755f2b69dc665a2a026eaa9604 — the merge of head 1a30e47e0915a10a4beaa9459402843c46690165 into base 5a5336b399db2ef18dd4700f97d579a328197dda, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 1b77c4b5450e40755f2b69dc665a2a026eaa9604 && git checkout 1b77c4b5450e40755f2b69dc665a2a026eaa9604
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 5a5336b399db2ef18dd4700f97d579a328197dda 1a30e47e0915a10a4beaa9459402843c46690165 && git checkout -B drift-repro 5a5336b399db2ef18dd4700f97d579a328197dda && git merge --no-ff 1a30e47e0915a10a4beaa9459402843c46690165
node scripts/docs-audit/affected-docs.mjs --json 5a5336b399db2ef18dd4700f97d579a328197dda

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 5a5336b399db2ef18dd4700f97d579a328197dda → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[os-trump]

Fixes#14705

What was wrong, re-verified on origin/main

os create example [name] wrote an objectstack.config.ts whose manifest:
block was name, version, description — nothing else
(packages/cli/src/commands/create.ts:130, confirmed at merge base 8f9ef6f7c8).
ManifestSchema requires id and type; namespace — the mandatory prefix of
every object name, and therefore each object's table name and REST path — was
absent too. defineStack refuses that, so the project a documented command had
just created failed on its first run, before the author wrote a line.

The ablation leg below reproduces the reported measurement verbatim, through the
real schema:

defineStack validation failed (2 issues):
x manifest.id: Required property 'id' is missing.
x manifest.type: Invalid value ''. Did you mean one of: 'ui', 'app'?

Every factual claim in the card holds. init.ts's three templates all stamp
id / namespace / type / engines.protocol; create's example template
is the one scaffold that had drifted. One clarification, not a correction:
create's plugin template emits no objectstack.config.ts at all — it
scaffolds a Plugin object in src/index.ts — so example is the only
create template ManifestSchema governs.

What changed

packages/cli/src/commands/create.ts (+19/-3) — the example template now
stamps what os init stamps: id: 'com.example.NAMESPACE', namespace,
type: 'app' and engines: { protocol: '^PROTOCOL_MAJOR' }, alongside the
version / name / description it already carried. The namespace comes from
init's own exported sanitizeNamespace, and the protocol range from the same
PROTOCOL_MAJOR constant init stamps, so the two scaffolders cannot answer
differently for the same input. The shipped comment explaining the protocol
range is copied from init's template, which is already pinned self-contained
(no monorepo-only reference, and its docs link resolves).

packages/cli/test/scaffold-manifest-schema.test.ts (new, 223 lines) — the
pin the card asks for. It sweeps both scaffolders: every init and create
template that emits an objectstack.config.ts is rendered through its own
emitter (configContent + writeTemplateSrcFiles for init; the .ts entries
of the files map for create), written to a throwaway directory under the
package's git-ignored tmp/, loaded back through bundle-require — the same
loader scaffold-validate.ts uses — and its manifest parsed through the real
ManifestSchema. Nothing is hand-copied: the population is derived from the two
template maps, so a template added later is swept the day it is added.

The standalone ManifestSchema parse is not redundant with the defineStack
call above it. ObjectStackDefinitionSchema.manifest is .optional(), so a
template that drops the block entirely, or one that calls
defineStack(config, { strict: false }), loads green at that door and ships a
project with no id, namespace or type. The header states both.

.changeset/create-scaffold-manifest-identity.md — patch for
@objectstack/cli.

File face

.changeset/create-scaffold-manifest-identity.md +37
packages/cli/src/commands/create.ts +19 -3
packages/cli/test/scaffold-manifest-schema.test.ts +223

Three files. packages/spec is untouched — the honest fix needed no schema
change; the scaffold was simply not declaring what the schema has always
required.

Measurements — all at 1a30e47e09, this PR's head

Reverse verification (three legs, one script, trap ... EXIT INT TERM).
Committed first, so the restore leg's reference (HEAD) already carried the fix.

leg	tree	result
1	fixed	Test Files 5 passed (5) · Tests 43 passed (43)
2	create.ts reverted to origin/main	Tests 1 failed | 5 passed (6) — the single failure is create:example, with the diagnostic quoted above
3	restored	blob hash back to 779e4fecfd, git diff HEAD empty

Mutation proved on disk, not by exit code: HEAD_BLOB=779e4fecfd... vs
MUT_BLOB=f706bb2199... (differ, non-empty), and the mutated file's
sanitizeNamespace / PROTOCOL_MAJOR occurrence counts both dropped to 0.
Restore proved the same way — the hash returned to HEAD_BLOB and the diff is
empty. The ablation direction is a plain red, and only in the scaffold the card
names: the three init scaffolds stayed green through both legs, so the pin is
specific rather than a blanket refusal.

Suite run (under the shared verify lock):
pnpm --filter @objectstack/cli exec vitest run --project unit --maxWorkers=2 test/scaffold-manifest-schema.test.ts test/create.test.ts test/init-scaffold-authoring-rules.test.ts test/init-template-comments-self-contained.test.ts test/commands.test.ts

Typecheck.pnpm --filter @objectstack/cli typecheck exit 0 (script echoed
tsc --noEmit, so not a zero-match pass). --listFiles says what that covers
and what it does not: src/commands/create.ts is in the program (1 hit); the
new test file is not (0 hits) — this package's tsconfig.json is
include: ["src"], which is why it carries a TEST_DEBT entry. So that green
says nothing about the new test, and the ratchet is measured separately below.

ESLint.pnpm lint — the whole repo, eslint . --no-inline-config — exit
0. No narrowing claimed and none needed.

Gate families.node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack
derives 37 for this diff (35 by path + 6 by change kind, 4 shared). Harvested
with --commands, re-run whole at this head: 34 green, 3 NOT MEASURED —
recorded as such, not as passes and not as reds:

• node scripts/check-test-completeness.mjs — exit 3, PREREQUISITE NOT MET:
  it grades a saved turbo run test log and there is none locally. CI passes
  the path on every invocation.
• node scripts/pm/check-half-states.mjs — exit 3, PREREQUISITE NOT MET: it
  needs repo-scoped REST egress this container does not have.
• pnpm check:type-check-debt (--re-measure) — killed by the 10-minute
  foreground ceiling mid-sweep; it re-runs tsc across 10 ledger packages.
  Substituted with a targeted measurement of the same quantity: a probe
  config extending this package's own tsconfig.json with
  include: ["src", "test"] reports 144 errors — exactly the frozen
  TEST_DEBT['@objectstack/cli'].errors of 144 — and zero of them are in
  scaffold-manifest-schema.test.ts. The new test file therefore cannot push
  the ratchet up. The probe config was deleted; it is not in the diff.

pnpm check:i18n, check:i18n-coverage and check:dual-build-cjs-loads each
refused on an unbuilt closure at first and were re-run green once the workspace
build caught up; the green readings above are the ones taken at this head.

What I deliberately did NOT do

• os create is untouched as a command. Not removed, not deprecated, not
  redirected at os init, and it does not call init internally. Whether two
  scaffolders should coexist is a CLI-surface decision and is not this PR's.
  Fixing the template forecloses nothing there.
• packages/spec is untouched. No schema change was needed or made.
• create's plugin template is untouched. It emits no package manifest,
  so ManifestSchema has nothing to say about it, and pretending otherwise
  would have put a surface in the sweep that the schema does not govern.
• The scaffold's package.json / tsconfig.json are not emitted by the pin.
  They are monorepo-relative (workspace:*, extends: '../../tsconfig.json')
  and resolve to nothing from a throwaway directory, and neither can change what
  the manifest declares. The test header records this and why.

Draft, per dispatch. Not flipped ready, no auto-merge armed.

🤖 Generated with Claude Code

https://claude.ai/code/session_016yfqQh2dBgPAymYd7xipza

Generated by Claude Code

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/cli, touching 1 documentable anchor(s).

4 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/deployment/cli.mdx(via os create (command, read off packages/cli/src/commands/create.ts))
• content/docs/plugins/index.mdx(via os create (command, read off packages/cli/src/commands/create.ts))
• content/docs/protocol/kernel/index.mdx(via os create (command, read off packages/cli/src/commands/create.ts))
• content/docs/protocol/kernel/plugin-spec.mdx(via os create (command, read off packages/cli/src/commands/create.ts))

What this run could not see

• 1 anchor(s) matched too much of the corpus to be a work list: objectstack.config.ts (literal, 32 pages)
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 22 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 5a5336b399db2ef18dd4700f97d579a328197dda → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 1b77c4b5450e40755f2b69dc665a2a026eaa9604 — the merge of head 1a30e47e0915a10a4beaa9459402843c46690165 into base 5a5336b399db2ef18dd4700f97d579a328197dda, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 1b77c4b5450e40755f2b69dc665a2a026eaa9604 && git checkout 1b77c4b5450e40755f2b69dc665a2a026eaa9604
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 5a5336b399db2ef18dd4700f97d579a328197dda 1a30e47e0915a10a4beaa9459402843c46690165 && git checkout -B drift-repro 5a5336b399db2ef18dd4700f97d579a328197dda && git merge --no-ff 1a30e47e0915a10a4beaa9459402843c46690165
node scripts/docs-audit/affected-docs.mjs --json 5a5336b399db2ef18dd4700f97d579a328197dda

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 5a5336b399db2ef18dd4700f97d579a328197dda → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[os-trump]

Fixes#14705

What was wrong, re-verified on origin/main

os create example [name] wrote an objectstack.config.ts whose manifest:
block was name, version, description — nothing else
(packages/cli/src/commands/create.ts:130, confirmed at merge base 8f9ef6f7c8).
ManifestSchema requires id and type; namespace — the mandatory prefix of
every object name, and therefore each object's table name and REST path — was
absent too. defineStack refuses that, so the project a documented command had
just created failed on its first run, before the author wrote a line.

The ablation leg below reproduces the reported measurement verbatim, through the
real schema:

defineStack validation failed (2 issues):
x manifest.id: Required property 'id' is missing.
x manifest.type: Invalid value ''. Did you mean one of: 'ui', 'app'?

Every factual claim in the card holds. init.ts's three templates all stamp
id / namespace / type / engines.protocol; create's example template
is the one scaffold that had drifted. One clarification, not a correction:
create's plugin template emits no objectstack.config.ts at all — it
scaffolds a Plugin object in src/index.ts — so example is the only
create template ManifestSchema governs.

What changed

packages/cli/src/commands/create.ts (+19/-3) — the example template now
stamps what os init stamps: id: 'com.example.NAMESPACE', namespace,
type: 'app' and engines: { protocol: '^PROTOCOL_MAJOR' }, alongside the
version / name / description it already carried. The namespace comes from
init's own exported sanitizeNamespace, and the protocol range from the same
PROTOCOL_MAJOR constant init stamps, so the two scaffolders cannot answer
differently for the same input. The shipped comment explaining the protocol
range is copied from init's template, which is already pinned self-contained
(no monorepo-only reference, and its docs link resolves).

packages/cli/test/scaffold-manifest-schema.test.ts (new, 223 lines) — the
pin the card asks for. It sweeps both scaffolders: every init and create
template that emits an objectstack.config.ts is rendered through its own
emitter (configContent + writeTemplateSrcFiles for init; the .ts entries
of the files map for create), written to a throwaway directory under the
package's git-ignored tmp/, loaded back through bundle-require — the same
loader scaffold-validate.ts uses — and its manifest parsed through the real
ManifestSchema. Nothing is hand-copied: the population is derived from the two
template maps, so a template added later is swept the day it is added.

The standalone ManifestSchema parse is not redundant with the defineStack
call above it. ObjectStackDefinitionSchema.manifest is .optional(), so a
template that drops the block entirely, or one that calls
defineStack(config, { strict: false }), loads green at that door and ships a
project with no id, namespace or type. The header states both.

.changeset/create-scaffold-manifest-identity.md — patch for
@objectstack/cli.

File face

.changeset/create-scaffold-manifest-identity.md +37
packages/cli/src/commands/create.ts +19 -3
packages/cli/test/scaffold-manifest-schema.test.ts +223

Three files. packages/spec is untouched — the honest fix needed no schema
change; the scaffold was simply not declaring what the schema has always
required.

Measurements — all at 1a30e47e09, this PR's head

Reverse verification (three legs, one script, trap ... EXIT INT TERM).
Committed first, so the restore leg's reference (HEAD) already carried the fix.

leg	tree	result
1	fixed	Test Files 5 passed (5) · Tests 43 passed (43)
2	create.ts reverted to origin/main	Tests 1 failed | 5 passed (6) — the single failure is create:example, with the diagnostic quoted above
3	restored	blob hash back to 779e4fecfd, git diff HEAD empty

Mutation proved on disk, not by exit code: HEAD_BLOB=779e4fecfd... vs
MUT_BLOB=f706bb2199... (differ, non-empty), and the mutated file's
sanitizeNamespace / PROTOCOL_MAJOR occurrence counts both dropped to 0.
Restore proved the same way — the hash returned to HEAD_BLOB and the diff is
empty. The ablation direction is a plain red, and only in the scaffold the card
names: the three init scaffolds stayed green through both legs, so the pin is
specific rather than a blanket refusal.

Suite run (under the shared verify lock):
pnpm --filter @objectstack/cli exec vitest run --project unit --maxWorkers=2 test/scaffold-manifest-schema.test.ts test/create.test.ts test/init-scaffold-authoring-rules.test.ts test/init-template-comments-self-contained.test.ts test/commands.test.ts

Typecheck.pnpm --filter @objectstack/cli typecheck exit 0 (script echoed
tsc --noEmit, so not a zero-match pass). --listFiles says what that covers
and what it does not: src/commands/create.ts is in the program (1 hit); the
new test file is not (0 hits) — this package's tsconfig.json is
include: ["src"], which is why it carries a TEST_DEBT entry. So that green
says nothing about the new test, and the ratchet is measured separately below.

ESLint.pnpm lint — the whole repo, eslint . --no-inline-config — exit
0. No narrowing claimed and none needed.

Gate families.node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack
derives 37 for this diff (35 by path + 6 by change kind, 4 shared). Harvested
with --commands, re-run whole at this head: 34 green, 3 NOT MEASURED —
recorded as such, not as passes and not as reds:

• node scripts/check-test-completeness.mjs — exit 3, PREREQUISITE NOT MET:
  it grades a saved turbo run test log and there is none locally. CI passes
  the path on every invocation.
• node scripts/pm/check-half-states.mjs — exit 3, PREREQUISITE NOT MET: it
  needs repo-scoped REST egress this container does not have.
• pnpm check:type-check-debt (--re-measure) — killed by the 10-minute
  foreground ceiling mid-sweep; it re-runs tsc across 10 ledger packages.
  Substituted with a targeted measurement of the same quantity: a probe
  config extending this package's own tsconfig.json with
  include: ["src", "test"] reports 144 errors — exactly the frozen
  TEST_DEBT['@objectstack/cli'].errors of 144 — and zero of them are in
  scaffold-manifest-schema.test.ts. The new test file therefore cannot push
  the ratchet up. The probe config was deleted; it is not in the diff.

pnpm check:i18n, check:i18n-coverage and check:dual-build-cjs-loads each
refused on an unbuilt closure at first and were re-run green once the workspace
build caught up; the green readings above are the ones taken at this head.

What I deliberately did NOT do

• os create is untouched as a command. Not removed, not deprecated, not
  redirected at os init, and it does not call init internally. Whether two
  scaffolders should coexist is a CLI-surface decision and is not this PR's.
  Fixing the template forecloses nothing there.
• packages/spec is untouched. No schema change was needed or made.
• create's plugin template is untouched. It emits no package manifest,
  so ManifestSchema has nothing to say about it, and pretending otherwise
  would have put a surface in the sweep that the schema does not govern.
• The scaffold's package.json / tsconfig.json are not emitted by the pin.
  They are monorepo-relative (workspace:*, extends: '../../tsconfig.json')
  and resolve to nothing from a throwaway directory, and neither can change what
  the manifest declares. The test header records this and why.

Draft, per dispatch. Not flipped ready, no auto-merge armed.

🤖 Generated with Claude Code

https://claude.ai/code/session_016yfqQh2dBgPAymYd7xipza

Generated by Claude Code

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/cli, touching 1 documentable anchor(s).

4 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/deployment/cli.mdx(via os create (command, read off packages/cli/src/commands/create.ts))
• content/docs/plugins/index.mdx(via os create (command, read off packages/cli/src/commands/create.ts))
• content/docs/protocol/kernel/index.mdx(via os create (command, read off packages/cli/src/commands/create.ts))
• content/docs/protocol/kernel/plugin-spec.mdx(via os create (command, read off packages/cli/src/commands/create.ts))

What this run could not see

• 1 anchor(s) matched too much of the corpus to be a work list: objectstack.config.ts (literal, 32 pages)
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 22 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 5a5336b399db2ef18dd4700f97d579a328197dda → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 1b77c4b5450e40755f2b69dc665a2a026eaa9604 — the merge of head 1a30e47e0915a10a4beaa9459402843c46690165 into base 5a5336b399db2ef18dd4700f97d579a328197dda, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 1b77c4b5450e40755f2b69dc665a2a026eaa9604 && git checkout 1b77c4b5450e40755f2b69dc665a2a026eaa9604
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 5a5336b399db2ef18dd4700f97d579a328197dda 1a30e47e0915a10a4beaa9459402843c46690165 && git checkout -B drift-repro 5a5336b399db2ef18dd4700f97d579a328197dda && git merge --no-ff 1a30e47e0915a10a4beaa9459402843c46690165
node scripts/docs-audit/affected-docs.mjs --json 5a5336b399db2ef18dd4700f97d579a328197dda

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 5a5336b399db2ef18dd4700f97d579a328197dda → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[os-trump]

Fixes#14705

What was wrong, re-verified on origin/main

os create example [name] wrote an objectstack.config.ts whose manifest:
block was name, version, description — nothing else
(packages/cli/src/commands/create.ts:130, confirmed at merge base 8f9ef6f7c8).
ManifestSchema requires id and type; namespace — the mandatory prefix of
every object name, and therefore each object's table name and REST path — was
absent too. defineStack refuses that, so the project a documented command had
just created failed on its first run, before the author wrote a line.

The ablation leg below reproduces the reported measurement verbatim, through the
real schema:

defineStack validation failed (2 issues):
x manifest.id: Required property 'id' is missing.
x manifest.type: Invalid value ''. Did you mean one of: 'ui', 'app'?

Every factual claim in the card holds. init.ts's three templates all stamp
id / namespace / type / engines.protocol; create's example template
is the one scaffold that had drifted. One clarification, not a correction:
create's plugin template emits no objectstack.config.ts at all — it
scaffolds a Plugin object in src/index.ts — so example is the only
create template ManifestSchema governs.

What changed

packages/cli/src/commands/create.ts (+19/-3) — the example template now
stamps what os init stamps: id: 'com.example.NAMESPACE', namespace,
type: 'app' and engines: { protocol: '^PROTOCOL_MAJOR' }, alongside the
version / name / description it already carried. The namespace comes from
init's own exported sanitizeNamespace, and the protocol range from the same
PROTOCOL_MAJOR constant init stamps, so the two scaffolders cannot answer
differently for the same input. The shipped comment explaining the protocol
range is copied from init's template, which is already pinned self-contained
(no monorepo-only reference, and its docs link resolves).

packages/cli/test/scaffold-manifest-schema.test.ts (new, 223 lines) — the
pin the card asks for. It sweeps both scaffolders: every init and create
template that emits an objectstack.config.ts is rendered through its own
emitter (configContent + writeTemplateSrcFiles for init; the .ts entries
of the files map for create), written to a throwaway directory under the
package's git-ignored tmp/, loaded back through bundle-require — the same
loader scaffold-validate.ts uses — and its manifest parsed through the real
ManifestSchema. Nothing is hand-copied: the population is derived from the two
template maps, so a template added later is swept the day it is added.

The standalone ManifestSchema parse is not redundant with the defineStack
call above it. ObjectStackDefinitionSchema.manifest is .optional(), so a
template that drops the block entirely, or one that calls
defineStack(config, { strict: false }), loads green at that door and ships a
project with no id, namespace or type. The header states both.

.changeset/create-scaffold-manifest-identity.md — patch for
@objectstack/cli.

File face

.changeset/create-scaffold-manifest-identity.md +37
packages/cli/src/commands/create.ts +19 -3
packages/cli/test/scaffold-manifest-schema.test.ts +223

Three files. packages/spec is untouched — the honest fix needed no schema
change; the scaffold was simply not declaring what the schema has always
required.

Measurements — all at 1a30e47e09, this PR's head

Reverse verification (three legs, one script, trap ... EXIT INT TERM).
Committed first, so the restore leg's reference (HEAD) already carried the fix.

leg	tree	result
1	fixed	Test Files 5 passed (5) · Tests 43 passed (43)
2	create.ts reverted to origin/main	Tests 1 failed | 5 passed (6) — the single failure is create:example, with the diagnostic quoted above
3	restored	blob hash back to 779e4fecfd, git diff HEAD empty

Mutation proved on disk, not by exit code: HEAD_BLOB=779e4fecfd... vs
MUT_BLOB=f706bb2199... (differ, non-empty), and the mutated file's
sanitizeNamespace / PROTOCOL_MAJOR occurrence counts both dropped to 0.
Restore proved the same way — the hash returned to HEAD_BLOB and the diff is
empty. The ablation direction is a plain red, and only in the scaffold the card
names: the three init scaffolds stayed green through both legs, so the pin is
specific rather than a blanket refusal.

Suite run (under the shared verify lock):
pnpm --filter @objectstack/cli exec vitest run --project unit --maxWorkers=2 test/scaffold-manifest-schema.test.ts test/create.test.ts test/init-scaffold-authoring-rules.test.ts test/init-template-comments-self-contained.test.ts test/commands.test.ts

Typecheck.pnpm --filter @objectstack/cli typecheck exit 0 (script echoed
tsc --noEmit, so not a zero-match pass). --listFiles says what that covers
and what it does not: src/commands/create.ts is in the program (1 hit); the
new test file is not (0 hits) — this package's tsconfig.json is
include: ["src"], which is why it carries a TEST_DEBT entry. So that green
says nothing about the new test, and the ratchet is measured separately below.

ESLint.pnpm lint — the whole repo, eslint . --no-inline-config — exit
0. No narrowing claimed and none needed.

Gate families.node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack
derives 37 for this diff (35 by path + 6 by change kind, 4 shared). Harvested
with --commands, re-run whole at this head: 34 green, 3 NOT MEASURED —
recorded as such, not as passes and not as reds:

• node scripts/check-test-completeness.mjs — exit 3, PREREQUISITE NOT MET:
  it grades a saved turbo run test log and there is none locally. CI passes
  the path on every invocation.
• node scripts/pm/check-half-states.mjs — exit 3, PREREQUISITE NOT MET: it
  needs repo-scoped REST egress this container does not have.
• pnpm check:type-check-debt (--re-measure) — killed by the 10-minute
  foreground ceiling mid-sweep; it re-runs tsc across 10 ledger packages.
  Substituted with a targeted measurement of the same quantity: a probe
  config extending this package's own tsconfig.json with
  include: ["src", "test"] reports 144 errors — exactly the frozen
  TEST_DEBT['@objectstack/cli'].errors of 144 — and zero of them are in
  scaffold-manifest-schema.test.ts. The new test file therefore cannot push
  the ratchet up. The probe config was deleted; it is not in the diff.

pnpm check:i18n, check:i18n-coverage and check:dual-build-cjs-loads each
refused on an unbuilt closure at first and were re-run green once the workspace
build caught up; the green readings above are the ones taken at this head.

What I deliberately did NOT do

• os create is untouched as a command. Not removed, not deprecated, not
  redirected at os init, and it does not call init internally. Whether two
  scaffolders should coexist is a CLI-surface decision and is not this PR's.
  Fixing the template forecloses nothing there.
• packages/spec is untouched. No schema change was needed or made.
• create's plugin template is untouched. It emits no package manifest,
  so ManifestSchema has nothing to say about it, and pretending otherwise
  would have put a surface in the sweep that the schema does not govern.
• The scaffold's package.json / tsconfig.json are not emitted by the pin.
  They are monorepo-relative (workspace:*, extends: '../../tsconfig.json')
  and resolve to nothing from a throwaway directory, and neither can change what
  the manifest declares. The test header records this and why.

Draft, per dispatch. Not flipped ready, no auto-merge armed.

🤖 Generated with Claude Code

https://claude.ai/code/session_016yfqQh2dBgPAymYd7xipza

Generated by Claude Code

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/cli, touching 1 documentable anchor(s).

4 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/deployment/cli.mdx(via os create (command, read off packages/cli/src/commands/create.ts))
• content/docs/plugins/index.mdx(via os create (command, read off packages/cli/src/commands/create.ts))
• content/docs/protocol/kernel/index.mdx(via os create (command, read off packages/cli/src/commands/create.ts))
• content/docs/protocol/kernel/plugin-spec.mdx(via os create (command, read off packages/cli/src/commands/create.ts))

What this run could not see

• 1 anchor(s) matched too much of the corpus to be a work list: objectstack.config.ts (literal, 32 pages)
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 22 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 5a5336b399db2ef18dd4700f97d579a328197dda → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 1b77c4b5450e40755f2b69dc665a2a026eaa9604 — the merge of head 1a30e47e0915a10a4beaa9459402843c46690165 into base 5a5336b399db2ef18dd4700f97d579a328197dda, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 1b77c4b5450e40755f2b69dc665a2a026eaa9604 && git checkout 1b77c4b5450e40755f2b69dc665a2a026eaa9604
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 5a5336b399db2ef18dd4700f97d579a328197dda 1a30e47e0915a10a4beaa9459402843c46690165 && git checkout -B drift-repro 5a5336b399db2ef18dd4700f97d579a328197dda && git merge --no-ff 1a30e47e0915a10a4beaa9459402843c46690165
node scripts/docs-audit/affected-docs.mjs --json 5a5336b399db2ef18dd4700f97d579a328197dda

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 5a5336b399db2ef18dd4700f97d579a328197dda → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[os-trump]

Fixes#14705

What was wrong, re-verified on origin/main

os create example [name] wrote an objectstack.config.ts whose manifest:
block was name, version, description — nothing else
(packages/cli/src/commands/create.ts:130, confirmed at merge base 8f9ef6f7c8).
ManifestSchema requires id and type; namespace — the mandatory prefix of
every object name, and therefore each object's table name and REST path — was
absent too. defineStack refuses that, so the project a documented command had
just created failed on its first run, before the author wrote a line.

The ablation leg below reproduces the reported measurement verbatim, through the
real schema:

defineStack validation failed (2 issues):
x manifest.id: Required property 'id' is missing.
x manifest.type: Invalid value ''. Did you mean one of: 'ui', 'app'?

Every factual claim in the card holds. init.ts's three templates all stamp
id / namespace / type / engines.protocol; create's example template
is the one scaffold that had drifted. One clarification, not a correction:
create's plugin template emits no objectstack.config.ts at all — it
scaffolds a Plugin object in src/index.ts — so example is the only
create template ManifestSchema governs.

What changed

packages/cli/src/commands/create.ts (+19/-3) — the example template now
stamps what os init stamps: id: 'com.example.NAMESPACE', namespace,
type: 'app' and engines: { protocol: '^PROTOCOL_MAJOR' }, alongside the
version / name / description it already carried. The namespace comes from
init's own exported sanitizeNamespace, and the protocol range from the same
PROTOCOL_MAJOR constant init stamps, so the two scaffolders cannot answer
differently for the same input. The shipped comment explaining the protocol
range is copied from init's template, which is already pinned self-contained
(no monorepo-only reference, and its docs link resolves).

packages/cli/test/scaffold-manifest-schema.test.ts (new, 223 lines) — the
pin the card asks for. It sweeps both scaffolders: every init and create
template that emits an objectstack.config.ts is rendered through its own
emitter (configContent + writeTemplateSrcFiles for init; the .ts entries
of the files map for create), written to a throwaway directory under the
package's git-ignored tmp/, loaded back through bundle-require — the same
loader scaffold-validate.ts uses — and its manifest parsed through the real
ManifestSchema. Nothing is hand-copied: the population is derived from the two
template maps, so a template added later is swept the day it is added.

The standalone ManifestSchema parse is not redundant with the defineStack
call above it. ObjectStackDefinitionSchema.manifest is .optional(), so a
template that drops the block entirely, or one that calls
defineStack(config, { strict: false }), loads green at that door and ships a
project with no id, namespace or type. The header states both.

.changeset/create-scaffold-manifest-identity.md — patch for
@objectstack/cli.

File face

.changeset/create-scaffold-manifest-identity.md +37
packages/cli/src/commands/create.ts +19 -3
packages/cli/test/scaffold-manifest-schema.test.ts +223

Three files. packages/spec is untouched — the honest fix needed no schema
change; the scaffold was simply not declaring what the schema has always
required.

Measurements — all at 1a30e47e09, this PR's head

Reverse verification (three legs, one script, trap ... EXIT INT TERM).
Committed first, so the restore leg's reference (HEAD) already carried the fix.

leg	tree	result
1	fixed	Test Files 5 passed (5) · Tests 43 passed (43)
2	create.ts reverted to origin/main	Tests 1 failed | 5 passed (6) — the single failure is create:example, with the diagnostic quoted above
3	restored	blob hash back to 779e4fecfd, git diff HEAD empty

Mutation proved on disk, not by exit code: HEAD_BLOB=779e4fecfd... vs
MUT_BLOB=f706bb2199... (differ, non-empty), and the mutated file's
sanitizeNamespace / PROTOCOL_MAJOR occurrence counts both dropped to 0.
Restore proved the same way — the hash returned to HEAD_BLOB and the diff is
empty. The ablation direction is a plain red, and only in the scaffold the card
names: the three init scaffolds stayed green through both legs, so the pin is
specific rather than a blanket refusal.

Suite run (under the shared verify lock):
pnpm --filter @objectstack/cli exec vitest run --project unit --maxWorkers=2 test/scaffold-manifest-schema.test.ts test/create.test.ts test/init-scaffold-authoring-rules.test.ts test/init-template-comments-self-contained.test.ts test/commands.test.ts

Typecheck.pnpm --filter @objectstack/cli typecheck exit 0 (script echoed
tsc --noEmit, so not a zero-match pass). --listFiles says what that covers
and what it does not: src/commands/create.ts is in the program (1 hit); the
new test file is not (0 hits) — this package's tsconfig.json is
include: ["src"], which is why it carries a TEST_DEBT entry. So that green
says nothing about the new test, and the ratchet is measured separately below.

ESLint.pnpm lint — the whole repo, eslint . --no-inline-config — exit
0. No narrowing claimed and none needed.

Gate families.node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack
derives 37 for this diff (35 by path + 6 by change kind, 4 shared). Harvested
with --commands, re-run whole at this head: 34 green, 3 NOT MEASURED —
recorded as such, not as passes and not as reds:

• node scripts/check-test-completeness.mjs — exit 3, PREREQUISITE NOT MET:
  it grades a saved turbo run test log and there is none locally. CI passes
  the path on every invocation.
• node scripts/pm/check-half-states.mjs — exit 3, PREREQUISITE NOT MET: it
  needs repo-scoped REST egress this container does not have.
• pnpm check:type-check-debt (--re-measure) — killed by the 10-minute
  foreground ceiling mid-sweep; it re-runs tsc across 10 ledger packages.
  Substituted with a targeted measurement of the same quantity: a probe
  config extending this package's own tsconfig.json with
  include: ["src", "test"] reports 144 errors — exactly the frozen
  TEST_DEBT['@objectstack/cli'].errors of 144 — and zero of them are in
  scaffold-manifest-schema.test.ts. The new test file therefore cannot push
  the ratchet up. The probe config was deleted; it is not in the diff.

pnpm check:i18n, check:i18n-coverage and check:dual-build-cjs-loads each
refused on an unbuilt closure at first and were re-run green once the workspace
build caught up; the green readings above are the ones taken at this head.

What I deliberately did NOT do

• os create is untouched as a command. Not removed, not deprecated, not
  redirected at os init, and it does not call init internally. Whether two
  scaffolders should coexist is a CLI-surface decision and is not this PR's.
  Fixing the template forecloses nothing there.
• packages/spec is untouched. No schema change was needed or made.
• create's plugin template is untouched. It emits no package manifest,
  so ManifestSchema has nothing to say about it, and pretending otherwise
  would have put a surface in the sweep that the schema does not govern.
• The scaffold's package.json / tsconfig.json are not emitted by the pin.
  They are monorepo-relative (workspace:*, extends: '../../tsconfig.json')
  and resolve to nothing from a throwaway directory, and neither can change what
  the manifest declares. The test header records this and why.

Draft, per dispatch. Not flipped ready, no auto-merge armed.

🤖 Generated with Claude Code

https://claude.ai/code/session_016yfqQh2dBgPAymYd7xipza

Generated by Claude Code

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/cli, touching 1 documentable anchor(s).

4 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/deployment/cli.mdx(via os create (command, read off packages/cli/src/commands/create.ts))
• content/docs/plugins/index.mdx(via os create (command, read off packages/cli/src/commands/create.ts))
• content/docs/protocol/kernel/index.mdx(via os create (command, read off packages/cli/src/commands/create.ts))
• content/docs/protocol/kernel/plugin-spec.mdx(via os create (command, read off packages/cli/src/commands/create.ts))

What this run could not see

• 1 anchor(s) matched too much of the corpus to be a work list: objectstack.config.ts (literal, 32 pages)
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 22 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 5a5336b399db2ef18dd4700f97d579a328197dda → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 1b77c4b5450e40755f2b69dc665a2a026eaa9604 — the merge of head 1a30e47e0915a10a4beaa9459402843c46690165 into base 5a5336b399db2ef18dd4700f97d579a328197dda, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 1b77c4b5450e40755f2b69dc665a2a026eaa9604 && git checkout 1b77c4b5450e40755f2b69dc665a2a026eaa9604
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 5a5336b399db2ef18dd4700f97d579a328197dda 1a30e47e0915a10a4beaa9459402843c46690165 && git checkout -B drift-repro 5a5336b399db2ef18dd4700f97d579a328197dda && git merge --no-ff 1a30e47e0915a10a4beaa9459402843c46690165
node scripts/docs-audit/affected-docs.mjs --json 5a5336b399db2ef18dd4700f97d579a328197dda

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 5a5336b399db2ef18dd4700f97d579a328197dda → pass the list as
args.docs, on the commit named under Which tree this was computed on.