Uh oh!
There was an error while loading. Please reload this page.
fix(metadata-protocol): refuse a non-canonical stored type at the publish pre-flight, and assert it at the audit writer (#8908) - #8986
Conversation
…publish pre-flight, and assert the audit writer's type (#8908) `publishPackageDrafts` reads sys_metadata rows AT REST, so #7894's `/meta` boundary fold never reached it. `promoteDraftForPublish` folds the stored spelling through the MANIFEST-collection map, which legitimately omits types that are not stack collections — for those the fold is a no-op, the draft resolves under its stored spelling, and the publish mints an ACTIVE row in the namespace `PUT /meta/field/...` answers 403 NOT_OVERRIDABLE for. Two tightenings, ruled as one card (#8908, auto-adjudicated 2026-08-15): 1. The batch publish refuses such a row at the PRE-FLIGHT — named, actionable, batch-atomic, one audit row per violation, `STORED_TYPE_NOT_CANONICAL`. The rule is derived from the two maps rather than hand-listed, which makes the class six spellings where the card named four (`externalCatalogs` and `email_templates` are the two a list would have missed). A manifest-PRESENT plural stays on its existing `NO_DRAFT` abort — deliberately not in scope. 2. `recordMetadataAudit` REFUSES a non-canonical `type` (`AUDIT_TYPE_NOT_CANONICAL`) rather than folding it silently. The old fold was both lenient and incomplete: it read the same manifest map, so the trail was canonical for the 29 types that never needed it and non-canonical for exactly the ones that did. Fold at the boundary, assert at the writer — the throw sits outside the writer's best-effort `try` so its own `catch` cannot degrade the assert into a warn. Option (b) on the card — `_migrate-stored` / boot reconciliation — is deliberately NOT implemented. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01XeQRiAa7vYRVX5Fog7Zby8
…mark the audit-column literal (#8908) The pre-flight ablation's red is not one verdict but two — `fields` dies at the draftability gate (`not_overridable`), `email_templates` at the row lookup (`no_draft`) — and the batch case additionally reports the healthy sibling in `failed[]`. That spread is the argument for the pre-flight placement, so the header records what was measured rather than what was predicted. `code: 'stored_type_not_canonical'` in the audit-row assertion is the persisted column's own lowercase vocabulary (ADR-0112 D6b), not an `error.code` — marked inline the way its `namespace_prefix` sibling already is. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01XeQRiAa7vYRVX5Fog7Zby8
…ifest-absent-plural-promote-refusal
…#8908) `gen:docs` output, not hand-written. Every hunk is this card's two ledger entries: `error-code-ledger.mdx` gains `AUDIT_TYPE_NOT_CANONICAL` and `STORED_TYPE_NOT_CANONICAL`, and the ten sibling pages carry the `ErrorCode` union's rendered size, `+267 more` to `+269 more`. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01XeQRiAa7vYRVX5Fog7Zby8
The latest updates on your projects. Learn more about Vercel for GitHub. 1 Skipped Deployment
|
📓 Docs Drift CheckThis PR changes 3 package(s): 106 hand-written doc(s) reference the affected code and may need an implementation-accuracy re-verification:
⛔ 7 release-owned page(s) also reference the affected code. These are read-only:
|
hotlong
commented
Aug 16, 2026
PM review — held as draft on purpose. Do not arm auto-merge on this PR. #8908 was auto-adjudicated by triage on 2026-08-15, not ruled by the maintainer. Under the adjudication protocol that makes execution a veto window, not a permission gate: the work lands as a draft and enters the round report's auto-adjudication list so the maintainer can overturn it. The window is open and this PR stays draft until he has seen it. What I verified myself, rather than accepting from the reportThe two exits this card was forbidden to take are the ones a report is least able to settle, so I read them on the branch at
Also checked, and consistent with how #8858 was closed: Fork clause did not fire, on evidence rather than on silence — the call-site enumeration found no runtime-reachable legitimate path that the refusal breaks. Had it fired, the card returned to Two things the report did right, noted because the opposite is the common failure
For the maintainer's attention in the veto windowBeyond the adjudication itself, the shape worth a deliberate look: this narrows an accept set and therefore registers two new error codes in CI is still running at the time of writing; Generated by Claude Code |
…ifest-absent-plural-promote-refusal
The os-regen merge took main's side of every generated artifact; this restores this branch's contribution to them. The two new metadata-protocol error codes re-enter the rendered ErrorCode union (+267 -> +269 across the eleven reference pages that render it). Regenerated with the full chain, not by hand. gen:authorable-surface-base was deliberately not run: it re-anchors authorable-surface.base.json and is manual-only (check:generated lists it as such), and step 2 already took main's anchor. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01NTKPDRoynY8i3HmdSFUxFj
hotlong
commented
Aug 16, 2026
Correction to my review above — it was pinned to a sha this PR no longer carries. I verified at
The throw is still strictly outside the The regeneration did not silently roll the artifacts backThis is the failure mode worth naming, because it does not error — regenerating a generated file while the tree is still in MERGE state rewrites it from the fork point, discarding whatever arrived in the merge. The merge here brought in #8940, whose ADR-0087 entry lives in exactly the regenerated file, so it is the case that would have been lost:
The commit message records the intended order (merge → commit the merge → regenerate), and the artifact state is consistent with it having actually been followed. CIThe head move restarted CI; the previous run's results do not carry over. Current run (started 04:42Z): 12 success, 1 skipped, 12 in progress, 0 failures — including Unchanged: this PR stays draft and gets no auto-merge. The auto-adjudication veto window is what gates it, not CI, so a green run does not advance it. Generated by Claude Code |
os-zhuang
commented
Aug 16, 2026
PM landing record — takeover, ready-flip, enqueue.
|
| asserted | result |
|---|---|
this PR's AUDIT_TYPE_NOT_CANONICAL / STORED_TYPE_NOT_CANONICAL | present in error-code-ledger.zod.tsand the regenerated mdx |
sibling PR's 18.driver-sql-upsert-cross-row-identity-merge-refused — index in registry.ts | present (control: same count on origin/main) |
| …and its implementation body (the half that actually gets swallowed) | present, 70 lines |
Spec generated-artifact gates re-run locally, all green: check:generated (13 artifacts up to date), api-surface, spec-changes, upgrade-guide, migration-registry, authorable-surface, docs.
gen:authorable-surface-base was deliberately NOT run. It refused (shallow checkout, cannot walk history to re-anchor) and that refusal is correct rather than an obstacle: it re-anchorsauthorable-surface.base.json, step 2 already took main's correct anchor, and check:generated itself lists it as "Explicit, manual-only … never run here or by --fix". ⛔ Not bypassed, ⛔ not forced.
Enqueue
Ready-flip gated on each job's own conclusion, ⛔ never an aggregate. The push reset the farm, so the previous head's green did not carry forward — re-read twice, and the first read was held because Test Core (3/3) and TypeScript Type Check were still in_progress. Final: 27 runs, 26 success, 1 skipped (Console Pin Gate), zero red, including Temporal Conformance (live PG + MySQL) re-run against the 40-file merge from main.
Auto-merge armed (SQUASH). method: , enabled at ) — zero diagnostic value, so membership will be confirmed by a second reading (gh-readonly-queue/* or the commit on origin/main), not by that receipt. The queue is currently occupied by PR #8983; this one follows.
Cross-seat declaration for the two packages/spec ledger registrations is posted at #6017 with a stated deadline. Proceeding unless that seat overrules.
Generated by Claude Code
hotlong
commented
Aug 16, 2026
Returned to draft, removing it from the merge queue. Recording why, because reverting another actor's deliberate action is not self-explanatory and should never have to be reconstructed later. What happenedAt 05:03Z The authority I acted on
That instruction has three parts — land as draft, enter the auto-adjudication list, wait for his review — and readying the PR defeats the third. #8908 was adjudicated by triage on 2026-08-15, not by the maintainer; the veto window exists precisely so a decision no human made does not reach What I am not claimingI am not asserting
If this was automation reacting to CI going green, that is worth knowing independently of this PR, since it would close every auto-adjudicated card's veto window the same way. State
Generated by Claude Code |
hotlong
commented
Aug 16, 2026
CI is now complete at To be explicit, since green is the moment the temptation appears: this changes nothing about the PR's state. It remains draft and unqueued. What gates it is a human reading the 2026-08-15 auto-adjudication, and CI cannot supply that. Ready it when you have. Generated by Claude Code |
Uh oh!
There was an error while loading. Please reload this page.
Fixes#8908
Two tightenings, ruled as ONE card (auto-adjudicated 2026-08-15, option (a) plus the audit-writer question carried onto the same card). Draft: the maintainer's veto window on that adjudication is still open.
The defect
publishPackageDraftsreadssys_metadatarows at rest, so #7894's/metaboundary fold never reaches it.promoteDraftForPublishfolds the stored spelling throughPLURAL_TO_SINGULAR— the manifest-collection map, which legitimately omits types that are not stack collections. For those the fold is a no-op: the lookup key equals the stored spelling, the draft resolves, and the publish mints an ACTIVE row in the namespacePUT /meta/field/…answers 403 NOT_OVERRIDABLE for. Every registry read and every compliance query onfieldthen misses an item the platform just reported as published.The ADR-0010 row recorded the same plural, because
recordMetadataAuditre-folded through the same incomplete map — tolerant AND incomplete: canonical for the 29 types that never needed it, non-canonical for exactly the ones that did.1. The publish refuses it, at the pre-flight, batch-atomically
Same shape as the ADR-0028 namespace-prefix gate already standing there: found before anything is promoted, failing the whole batch (
publishedCount: 0,published: []) rather than publishing the healthy siblings around it, one audit row per violation.failed[].codeis the newSTORED_TYPE_NOT_CANONICAL; the audit column's spelling isstored_type_not_canonical. The message names the row, names the canonical type, and states the re-author path.The rule is derived, not a list. A spelling the URL/registry map folds elsewhere and the manifest map leaves unchanged. Against the real maps that is six spellings, where the card named four:
externalCatalogsandemail_templateswould have been missing from any hand-written list of four, and a newly declared type that never reaches the manifest map is covered on the day it is declared. The empty second line is the safety proof: no legitimate stored type can trip the gate.A manifest-present plural (
objects) is deliberately not in the class — it is already fail-closed at the promote (NO_DRAFT, batch aborted, pinned with its reasoning inprotocol.publish-side-effects-canonical-type.test.ts), and widening the gate over it would change a wire-visiblefailed[].codefor rows that are not this defect. A pin marks that boundary so a later "simplification" is visible.⛔ Deliberately not included: migrating the row (
_migrate-stored/ boot reconciliation). That was option (b), explicitly unruled.2.
recordMetadataAuditasserts itstypeinstead of folding ittype: PLURAL_TO_SINGULAR[entry.type] ?? entry.typeis gone. The writer now refuses a non-canonicaltypewithAUDIT_TYPE_NOT_CANONICAL/ 500, and every call site that builds a row out of an at-resttype— all of them onpublishPackageDrafts— folds withcanonicalMetaType. The throw sits outside the writer's best-efforttry, because inside it the method's owncatchwould degrade the assert into aconsole.warn— the softening the ruling forbids, reached by accident rather than by decision.The assert cannot refuse a canonical type, nor a plugin-registered or otherwise unrecognised kind (
canonicalMetaTypeis the identity for anything the static map does not carry): the accept set is narrowed, not closed.Premise-first: the enumeration the ruling required
Every
recordMetadataAuditcall site — the method is private toprotocol.ts, 11 call sites, plus 2 entry producers (lockWriteRefusal,optimisticConflictAuditEntry) reached throughrecordPendingDenialAudit:typeargumentsaveMetaItem,publishMetaItem,rollbackMetaItem,deleteMetaItem(allowed rows),assertLockAllowsDelete,recordOptimisticConflictAudit× 3request.typecanonicalizeMetaRequestTypefolds at every entry point before any of thempublishPackageDraftspre-flight rowsv.type(stored)publishPackageDraftsbatch_abortedcausal.type(stored)publishPackageDraftsallowed rowsp.d.type(stored)promoteDraftForPublishpending rows (lock / 409)request.typeEvery at-rest row producer.
SysMetadataRepositoryis instantiated in exactly one place (protocol.ts) and itsputis called from exactly one place (saveMetaItem, post-fold).promoteDraftmutates an existing row's state and cannot mint a spelling.migrateStoredMetadatarewrites throughsaveMetaItem, also post-fold. So no code path in this repository can mint a non-canonical storedtypetoday — the residue is historical, exactly as the card states, and the batch publish was the only route by which it reached an audit write.Fork clause: not triggered. The closest signal is
packages/core/src/fallbacks/authored-translation-sync.ts, which readstype: 'translations'at rest — but it is a read-side legacy fallback over ACTIVE rows, untouched by a refusal to promote. No legitimate path turns a working audit write into a failure.Also fixed, as a consequence of the fold
On the batch route
getEffectiveLock's overlay limb was queried with the raw stored spelling, so an ADR-0010_lockon the canonical active row was looked up under atypeno row has and came back'none'— the verdict "the author declared no protection". That is the batch twin of the hole #8769 closed onpublishMetaItem.Verification — union run at
92dbd15a8(the final commit, post-merge)packages/metadata-protocol/src/protocol.publish-stored-type-canonical.test.ts, 12 cases, both zones, each refusal paired with a positive control in the same describe.Ablations, run SEPARATELY — the two limbs are independent and each is shown load-bearing on its own. Directions predicted before running; measured directions recorded in the test file header, including where they differed from the prediction:
fields→[not_overridable] Metadata type 'field' is not draftable;email_templates→[no_draft] No pending draft exists for email_template/welcome. Two different wrong verdicts, plus the batch case reporting the healthy sibling infailed[](['ticket', 'legacy_field']) because the abort moves inside the transactionpromise resolved "undefined" instead of rejecting— the writer silently accepting the spelling, the defect verbatimRestored from the commit and proved byte-identical (
git hash-object=git rev-parse HEAD:…=d4642cbe9), not retyped.Suites (edited packages, then the DOWNSTREAM/dependents direction —
--filter '...@objectstack/metadata-protocol'):mainmoved 11 commits under this branch mid-run, one of them (#8371, PR #8936) intoprotocol.tsitself. It landed in thefindDatafilter gate, structurally disjoint from both edited regions — merged at75b41c0de, then everything above was re-run on the merged tree rather than trusted.Gates, all green at
92dbd15a8— re-run in full AFTER mergingorigin/main(b50c0ef27), not before:nul-bytes,error-code-casing,meta-type-normalized,stack-collection-maps,durability-log-level,filter-alias-parity,spec-parsed-alias,merge-driver,cross-package-test-inputs,tenant-chokepoint,query-options-erasure,route-envelope,adr-0087-registration,empty-changeset,type-check-coverage,doc-anchors,doc-authoring,type-check-debt --re-measure(33 ledger entries re-measured in 417.5s on a fully built closure, 1926 raw errors, none above its recorded number —metadata-protocol's own entry is 63 and did not move, so the new test file adds zero), plus the spec package'scheck:generated,check:authorable-surface,check:api-surface,check:spec-changes,check:upgrade-guide,check:migration-registry,check:docs.Run beyond the derived set, and it earned it.
meta-type-normalized/stack-collection-mapsjudge exactly the maps this change reads;tenant-chokepointis content-keyed and structurally invisible todispatch-gates.mjs. The spec package's owncheck:generated— which no root script and no path derivation names — caught the real one: the two ledger entries move the renderedErrorCodeunion across eleven generated reference pages (+267 moreto+269 more), regenerated withgen:docsin its own commit.Out of scope, filed
#8957 —
migrateStoredMetadatascans with the same manifest map, so it reports rows of this class ascanonical(nothing to do) while this PR teaches the publish to refuse them. The two doors disagree about the same row. Filed, not fixed: rewriting a storedtypeis an identity move, not a body edit.Generated by Claude Code
Generated by Claude Code