Uh oh!
There was an error while loading. Please reload this page.
feat(spec)!: remove dead enable.trash/mru capability flags (#2377 close-out, ADR-0049) - #3414
Merged
Merged
Conversation
…se-out, ADR-0049) Both flags parsed and defaulted to true but had no runtime consumer: every delete has always been a hard delete (no recycle bin) and MRU tracking was never implemented. First-party objects authored 'trash: false // Never soft-delete audit logs' believing a soft-delete existed to opt out of — the false affordance ADR-0049 exists to kill. - ObjectCapabilities is now .strict() (pattern of the tenancy block, #2763): retired trash/mru reject with upgrade guidance via CAPABILITIES_RETIRED_KEY_GUIDANCE; typos no longer strip silently (#1535). Strict immediately caught two latent unknown-key bugs: sys_secret and sys_setting_audit authored a never-existent 'enable.audit' flag. - ~46 first-party object definitions drop their inert trash:/mru: lines (platform-objects, plugin-security/audit/approvals/sharing, metadata-core, service-realtime, examples/app-todo). - Liveness ledger: both entries deleted (precedent: tags/recordName); README count table object row now 0 dead. Studio object.form.ts drops both rows. - Docs/skills stop advertising a recycle bin; the API skill's 'DELETE is soft-delete when trash: true' claim corrected to the real contract. - Spec 6820 green; liveness gate, api-surface check, docs check all pass; cli 442 green; all touched packages' suites green. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01RRCHNGhKw8uVhA3ghXKDpA
The latest updates on your projects. Learn more about Vercel for GitHub.
|
This was referenced Jul 22, 2026
Contributor
📓 Docs Drift CheckThis PR changes 9 package(s): 116 hand-written doc(s) reference the affected code and may need an implementation-accuracy re-verification:
|
os-zhuang
marked this pull request as ready for review
July 24, 2026 12:11
Uh oh!
There was an error while loading. Please reload this page.
This was referenced Jul 27, 2026
Closed
akarma-synetal pushed a commit
to akarma-synetal/framework
that referenced
this pull request
Aug 3, 2026
…h/mru removal + repoint tombstones at objectstack-ai#3146 (objectstack-ai#3207) (objectstack-ai#4734) The 16.x removal of the dead object capability flags (PR objectstack-ai#3414) tombstoned enable.trash / enable.mru in the .strict() capabilities block but registered no ADR-0087 D2 conversion, and its prescriptions pointed at objectstack-ai#1893 — closed 2026-07-24. Per the objectstack-ai#3207 ruling (2026-08-02): soft delete is parked at objectstack-ai#3146, and the retirement follows the full spec-property-retirement kit. - New conversion `object-enable-trash-mru-removed` (protocol 17, retiredFromLoadPath): stored 16.x rows replay clean through applyConversionsToStoredItem instead of flagging metadata_spec_invalid on every rehydration (objectstack-ai#3903 invariant — chain-owned history is not a current-contract violation), and `os migrate meta --from 16` rewrites authored sources. Wired into MIGRATIONS_BY_MAJOR[17] with rationale; fixture proves the strip is surgical (surviving `searchable` untouched). - Tombstones now name objectstack-ai#3146 (trash) and the `os migrate meta --from 16` rewrite (both); the restore legacy-apiMethod guidance and the api-derivation note drop the dead objectstack-ai#1893 pointer. - remove-enable-trash-mru changeset flipped minor -> major: v17 is the breaking window and the guard stands aside in pre-mode; a breaking removal listed under "Minor Changes" in the compiled CHANGELOG would mislead upgrading agents. - Pin tests: prescription must name objectstack-ai#3146 + the migrate command and must not resurrect objectstack-ai#1893; stored-row replay strips exactly the two keys. Gates: spec build green; check:generated all 8 green after gen:spec-changes/gen:upgrade-guide; liveness/empty-state/strictness-ledger/ skill gates green; spec 7400, cli 581, metadata-protocol 231 tests pass; check:i18n 9/9 in sync (zero drift). Claude-Session: https://claude.ai/code/session_0176qgxgCXTJCUv4YFLtusP9 Co-authored-by: Claude <noreply@anthropic.com>
This was referenced Aug 5, 2026
This was referenced Aug 6, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Final slice of #2377 (ADR-0049 enforce-or-remove), following #2402 and #3176. Removes the last two
deadentries in the object liveness ledger:enable.trashandenable.mru.Why these two are the worst kind of dead prop
Both parsed and defaulted to
truewith no runtime consumer: every delete has always been a hard delete (no recycle bin exists), and MRU tracking was never implemented. A default-true flag promising recoverability is an actively dangerous false affordance — first-party objects were authoringtrash: false // Never soft-delete audit logsin the belief that a soft-delete existed to opt out of, and the API skill taught agents thatDELETEis "soft-delete if trash enabled". Sinceobject.softDeletewas already removed in #3176 with a hard-delete migration note, keepingenable.trashhad the schema telling two contradictory stories.Changes
ObjectCapabilitiesis now.strict()(pattern of the tenancy block, [spec] Remove tenancy.strategy + tenancy.crossTenantAccess at the next major — no requirement (owner decision) #2763): the retiredtrash/mrureject with the upgrade prescription via a newCAPABILITIES_RETIRED_KEY_GUIDANCEmap, and unknown keys/typos fail loudly instead of stripping silently (Object-levelworkflows: [...](and any unknown ObjectSchema key) is silently stripped at build — no error/warning (ADR-0032 'no silent failure', metadata layer) #1535). Strict immediately proved its worth by catching two latent bugs:sys_secretandsys_setting_auditauthored a never-existentenable.auditflag (silently stripped until now).trash:/mru:lines (platform-objects, plugin-security/audit/approvals/sharing, metadata-core, service-realtime, examples/app-todo). Three spec test fixtures also carried the stalefeedEnabledkey (real flag:feeds) — fixed, and now guarded by the strict parse.tags/recordName); the README count table's object row now shows 0 dead. Studioobject.form.tsdrops both authoring-form rows.concepts/metadata-driven,data-modeling/objects,data-modeling/schema-design,protocol/objectql/schema, data + API skills). The API skill's common-mistakes section now states the real contract:DELETEis a hard delete; use per-fieldtrackHistoryor alifecyclepolicy for recoverability.gen:schema+gen:docs);api-surface.jsonverified unchanged (no public exports were removed).Migration
Delete any
enable.trash/enable.mrukeys from object metadata — they never changed behavior.ObjectSchema.create()/ObjectCapabilities.parse()now reject them with this prescription in the error. A real recycle bin or MRU feature, if built, returns as a live enforced flag (#1893 prune-or-build).Versioning
Breaking spec-surface change, versioned as a
minorchangeset per the launch-window policy (fixed-group monorepo; precedent #2402/#3176).Verification
check:api-surface✓;check:docs✓ (254 generated files in sync)enable.searchable)trash:/mru:set-sites, no other unknownenablekeysNote: the initial CI runs on this PR failed at workflow startup (3s, no logs) — a repo-wide Actions outage affecting every branch since ~20:57 UTC, not this diff; will re-run once Actions recover.
Closes#2377
🤖 Generated with Claude Code
https://claude.ai/code/session_01RRCHNGhKw8uVhA3ghXKDpA