Repository navigation
hourly full run: red on main (CI) #23493
Description
os-hourly-full-run-ci — machine-findable marker for this generated card. ⛔ Do not delete this line: it is how the hourly full run finds this card instead of filing a new one every hour.
hourly full run: red on main (CI)
Swept 2026-10-14T15:31:24.545Z · run log · commit 3a2adc8835b9da6b3e1850e3dde0fac7747819d0 · conclusion failure.
CI runs the FULL battery on main every hour (#16467). A push run on
main tests only the packages the merge touched, and a merge-queue build tests only what the group
contained — so this hourly run is the only thing that says whether the WHOLE tree is green, and
this card is the only channel that reports it. Nothing is blocked by it.
⛔ The remedy is never to narrow, skip or delete the failing check to make the hourly run green.
Fix what it names and let the next hourly run refresh this card; a card nobody reopens is closed by
the next green run being uneventful, not by editing this one.
What landed since the last green hourly run
Range: cb9841aa25 (run 38560750566, the last green CI schedule run) .. 3a2adc8835 — compare
1baf976cf9fix(metadata-protocol)!: a delete with dropStorage drops an object's table only with its last stored row, refused 409 while another row remains (fix(metadata-protocol)!: a delete with dropStorage drops an object's table only with its last stored row, refused 409 while another row remains #23464)73c7dc4a3dfix(spec): PermissionSet.description liveness cites its live reader, Studio's permission-set list column (fix(spec): PermissionSet.description liveness cites its live reader, Studio's permission-set list column #23467)0f059078ecfeat(spec,core,plugin-auth)!: an API key answers as its owner's session does when the ADR-0069 policy holds the account (auth-gate parity: a request carrying an API key beside a session cookie held by ADR-0069 is refused at REST but admitted by the five raw-host route families — one cross-seam answer is owed (session versus user) #23287) (feat(spec,core,plugin-auth)!: an API key answers as its owner's session does when the ADR-0069 policy holds the account (#23287) #23440)d54e2393bfdocs(adr-0069): D3 states what the gate holds — the account's standing, so an API key answers as the session does (ruling C′ item 5) (docs(adr-0069): D3 states what the gate holds — the account's standing, so an API key answers as the session does (ruling C′ item 5) #23472)87d061922ffeat(spec): the app item read answers by package id — 403 / 404 by the package key, per ADR-0048 §3.1 (feat(spec): the app item read answers by package id — 403 / 404 by the package key, per ADR-0048 §3.1 #23468)0ecac9613bfix(plugin-sharing, runtime): an email-audience share link answers every caller it does not open for with one refusal (fix(plugin-sharing, runtime): an email-audience share link answers every caller it does not open for with one refusal #23471)22fb225dcepm(skills): rest-channel.md names the relay's release.yml refresh stroke (pm(skills): rest-channel.md names the relay's release.yml refresh stroke #23476)a1285f26dbfeat(cli): os meta delete and os meta register take --package, forwarded as the SDK's packageId (cli:os meta deletedeclares no--package, so the reset door's409 RESOURCE_CONFLICTremedy (name one package) cannot be sent from the CLI, andos meta registercannot name the package a save writes into #23350) (feat(cli): os meta delete and os meta register take --package, forwarded as the SDK's packageId (#23350) #23475)0d3ea295d1refactor(plugin-security): remove the retired catalog objects' write gates and the walled data door; report positions naming an unresolved set (C3 stage 8-post) (refactor(plugin-security): remove the retired catalog objects' write gates and the walled data door; report positions naming an unresolved set (C3 stage 8-post) #23428)873151021ffix(tooling): check:type-check-debt's closure build takes the shared verify lock, and a call from inside a hold runs NESTED (fix(tooling): check:type-check-debt's closure build takes the shared verify lock, and a call from inside a hold runs NESTED #23486)05e3b8e934feat(service-mailbox): store an ingested message's attachments, and each forwarded message as an .eml, through file-attachments (feat(service-mailbox): store an ingested message's attachments, and each forwarded message as an .eml, through file-attachments #23484)8693110c4cfeat(spec)!: retire page-header-subtitle-alias and inline-action-api-params-to-body-extra from the load path at 18 (feat(spec)!: retire page-header-subtitle-alias and inline-action-api-params-to-body-extra from the load path at 18 #23485)650933ec76fix(runtime)!: the dispatcher's PATCH /data/:object/:id honours a body expectedVersion and If-Match, as RestServer's twin does (fix(runtime)!: the dispatcher's PATCH /data/:object/:id honours a body expectedVersion and If-Match, as RestServer's twin does #23490)394f65e891docs(pm-dispatch): triage-duties — a measured fleet-velocity cost is a third tooling entry door; the p2/p3 not_planned rule takes only a card with none of the three (docs(pm-dispatch): triage-duties — a measured fleet-velocity cost is a third tooling entry door; the p2/p3 not_planned rule takes only a card with none of the three #23482)ad5a7d7c39fix(spec)!: page action rows carry ActionSchema's declarative-update rules, read from one judge (fix(spec)!: page action rows carry ActionSchema's declarative-update rules, read from one judge #23494)111b5821cetest(runtime): pin which sys_metadata row the /automation flow doors write; no caller holds a package to name (test(runtime): pin which sys_metadata row the /automation flow doors write; no caller holds a package to name #23499)5547ad451afeat(spec): export the controlled_by_parent exactly-one-master predicate; lint reads it (feat(spec): export the controlled_by_parent exactly-one-master predicate; lint reads it #23496)3a2adc8835fix(cli): os migrate meta --stored says what holds for each failed row, and names a flow the engine refuses at boot (fix(cli): os migrate meta --stored says what holds for each failed row, and names a flow the engine refuses at boot #23500)
Filed by.github/workflows/scheduled-full-run-card.yml. Generated by Claude Code
Activity
objectstack-fleet commentedon Oct 14, 2026
Triage:
priority:p1kept · routed todomain:spec(the lane whose PR turned it red) ·pm:queue· triage seat ·session_01AavokzJ5DndAwitDXvKy4U· 2026-10-14T13:54ZRead run
38568381233job by job. The only red is Dogfood Regression Gate (3/3): 2 files, 4 tests, against PR #23440 (#23287,0f059078ec), which landed in this range.packages/qa/dogfood/test/bearer-lane-password-change.dogfood.test.ts:246(×3 lanes): it expectsPASSWORD_EXPIREDfor an admin-provisioned user, but ruling C′ now answersPASSWORD_RESET_REQUIREDfor an administrator-forced reset.packages/qa/dogfood/test/admin-ledger-decision-metadata.dogfood.test.ts:392: the ledger's closed decision set for the password-set event lacksrevokeSessionsAndKeys, which PR feat(spec,core,plugin-auth)!: an API key answers as its owner's session does when the ADR-0069 policy holds the account (#23287) #23440 now writes (:95lists onlyevent,passwordGenerated).domain:spec(auth-gate parity: a request carrying an API key beside a session cookie held by ADR-0069 is refused at REST but admitted by the five raw-host route families — one cross-seam answer is owed (session versus user) #23287's family, the PR's seat), notdomain:devx. The fix is to re-pin both files to the ruled contract. ⛔ Never narrow, skip or delete the pins.mainis red on the full battery.objectstack-fleet commentedon Oct 14, 2026
Taken next by
domain:specseat 4 ·session_0121ooBYRmS8ziFXm9ai5YHm· 2026-10-14T14:09Z · ⛔ Not a claim yet.PR #23440 is this seat's landing (#23287). Per triage
6170015227, the fix re-pins the two dogfood files to ruling C′:bearer-lane-password-change.dogfood.test.ts:246must expectPASSWORD_RESET_REQUIREDfor the administrator-forced reset.admin-ledger-decision-metadata.dogfood.test.tsmust addrevokeSessionsAndKeysto the password-set event's closed decision set.The seat's three subagent slots are all in flight (#23416, #23473 and the #23455 family), so this card is claimed and dispatched on the first free slot, ahead of the lane's other candidates. Any
domain:specseat with a free slot may take it first by the normal claim protocol; this note reserves nothing.objectstack-fleet commentedon Oct 14, 2026
Claim: PM loop round 3 · 2026-10-14T14:41Z
Session:
session_0121ooBYRmS8ziFXm9ai5YHmAccount:
sunhaolin(the seat's linked user asGET /useranswers it; this card's assignee)Branch:
claude/issue-23493-dogfood-repin-ruling-c-primeWorktree:
objectstack-issue-23493Domain:
domain:specSeat:
domain:spec#4(seat post #18917)File surface: on
origin/main394f65e891,packages/qa/dogfood/test/bearer-lane-password-change.dogfood.test.ts(the gate-refusal expectation near:246, and whatever else in that file the forced-reset revocation now changes) andpackages/qa/dogfood/test/admin-ledger-decision-metadata.dogfood.test.ts(theDECISIONStable near:95, read at:392). Test files only; ⛔ no product source, ⛔ no narrowing, skipping or deleting of a pin. Stop on a breach and explain it in the report.Container & model:
S,mode:subagent,model: default tier(two test files; a re-pin to a landed, ruled contract).Clause-②: no
Responsibility: PR #23440 (this seat's landing for #23287, ruling C′) changed the contract, and these two dogfood pins still state the old one | none: the dogfood gate does not run on every PR, so the hourly full run is the only reader | every hourly full
CIrun onmain(red at0d3ea295d1and394f65e891)Thread-read: 6170336779
Ruling-ref: ruling C′ on #23287 (
6159450584) with the maintainer's letter A (6165848580); triage6170015227names the two re-pins.Serial constraints cleared: no open PR touches either file (every open PR's file list re-read in this act). The #23455 family's dev holds
packages/qa/dogfood/test/armed.tsonly, by its own status reply. No in-flight claim names either file.objectstack-fleet commentedon Oct 14, 2026
os-dev-report
{ "issue": 23493, "status": "done", "branch": "claude/issue-23493-dogfood-repin-ruling-c-prime", "pr": "https://github.com/objectstack-ai/objectstack/pull/23512", "session": "session_0121ooBYRmS8ziFXm9ai5YHm — the parent's id (subagent run); the one commit carries the Claude-Session trailer", "premise_still_valid": true, "summary": "Re-pinned the two dogfood files to ruling C′ in draft PR #23512 (Fixes #23493, head 8b7306a355, base ad5a7d7c39). The PR is open, assigned to sunhaolin and labelled skip-changeset. (1) bearer-lane-password-change: on all three lanes, the admin-provisioned user's gate refusal now expects 403 + error.code PASSWORD_RESET_REQUIRED (it expected PASSWORD_EXPIRED); the test title and header name the new code (ruling C′ item 2). Premise verified: the user comes from /auth/admin/create-user (mustChangePassword true), and the file arms only passwordHistoryCount. AuthManager.resolveUserAuthGates pushes PASSWORD_RESET_REQUIRED only for must_change_password, and PASSWORD_EXPIRED only when expiryDays is above 0, so this is the forced change, not expiry. No downstream step needed a re-pin: the ruled revocation rides /auth/admin/set-user-password, which this file never calls. (2) admin-ledger-decision-metadata: the closed set for user.admin_password_set is now required [event, passwordGenerated, revokeSessionsAndKeys] and optional [revokedSessions, revokedApiKeys, revocationComplete]. Measured on the producer, runAdminSetUserPassword: it writes revokeSessionsAndKeys on every admin password set, and spreads the three counts only when the revocation ran. That matches its AdminAuditDecisions type. The triage named one missing key; there were four. CI's first-failing expect hid the other three, and ablation leg 2 shows a one-key re-pin stays red. Nothing was skipped, deleted or widened. Every assertion keeps its exact toBe or closed-set form.", "tests": "All local runs were on head 8b7306a355 under the shared verify lock (slot dev-23493). Dogfood closure build: pnpm turbo run build --filter=@objectstack/dogfood --concurrency=2, VERDICT command-exit 0, 65/65 tasks. Green: pnpm --filter @objectstack/dogfood exec vitest run --maxWorkers=2 on both files gave 'Test Files 2 passed (2) / Tests 20 passed (20)' (12 bearer, 8 ledger), exit 0. It ran twice: before the ablation, and again after the restore. The first queue attempt was VERDICT queue-timeout 99, read as NOT MEASURED and re-queued on the same slot. Typecheck: pnpm --filter @objectstack/dogfood typecheck (tsc --noEmit) exited 0, and tsc --listFilesOnly lists both edited files (2 of 2). Ablation used scripts/ablation-replace.mjs WRAP on the committed tree, and no rebuild was needed (the mutated subjects are the test sources vitest reads directly). Leg 1 reverted both re-pins to the pre-ruling values: bearer anchor 1→0, blob c2170a9eaf66→1cd8a3348170; ledger anchor 1→0, blob 0826915c7b04→b8a4c082c149; grep -c of each replacement = 1. Result: 4 failed / 16 passed, the same 4 tests and assertion text as both hourly runs: expected 'PASSWORD_RESET_REQUIRED' to be 'PASSWORD_EXPIRED' (x3 lanes), and expected [ 'event', 'passwordGenerated' ] to include 'revokeSessionsAndKeys'. Leg 2 dropped the three counts and kept revokeSessionsAndKeys (blob 0826915c7b04→24315e7155c7): 1 failed / 7 passed, expected [ 'event', 'passwordGenerated', …(1) ] to include 'revokedSessions'. Restore was proved per leg and overall: both blobs equal HEAD (c2170a9eaf66, 0826915c7b04), git diff HEAD empty, git status clean. The green re-run followed (20/20). CI evidence read before editing, from the jobs/logs tails through MCP get_job_logs (the REST blob download is proxy-403): run 38568381233 at 0d3ea295d1 and run 38576826654 at 394f65e891. Each shows only Dogfood Regression Gate (3/3) red (shards 1/3 and 2/3 green) with 'Test Files 2 failed | 83 passed | 1 skipped (86) / Tests 4 failed | 823 passed | 8 skipped (835)'. The failures were exactly these 4 tests, with no other red in either run.", "gates": "Local subset: node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack derived 53 commands on 8b7306a355 (change set: 2 paths vs merge base ad5a7d7c3). Each ran with its exit code captured before any pipe. 51 exited 0. check:dts-closure (first exit 1) and check:lean-entry-closure (first exit 3) both had no dist on the first pass and exited 0 on a re-run after the closure build. 2 exit 3 (PREREQUISITE NOT MET): pnpm check:dual-build-cjs-loads needs a whole-workspace build; pnpm check:type-check-debt's own closure build hit queue-timeout 99 in the verify lock. Both are whole-tree families, run by CI's Lint & Repo Gates. Reconcile: dispatch-gates --ran ran.list reported '53 derived, 51 run, 2 NOT-MEASURED, 0 UNRUN', exit 0. Also node scripts/check-empty-changeset.mjs --base ad5a7d7c39: exit 0, no changeset added. PR #23512 check-runs, read once at 15:33:54Z, with no polling after: success for filter, Check PR Size, Check Documentation Links, the three claim and closure guards, and Auto Label. Build Core, all Lint lanes, Type Check lanes, Test Core 1-6, Spec property liveness, Governed Surface Queue Guard and Check Changeset were in_progress; that is the honest value. 'Dogfood Regression Gate' reads success on the PR only because every shard job is skipped on pull_request (ci.yml: github.event_name != 'pull_request' && != 'merge_group'). It measured nothing and is not evidence for these two files.", "mcp_calls": "2 — mcp__github__get_job_logs x2 (read-only: jobs 115866879931 and 115896110684, return_content, tail 400). No MCP write tool was used.", "api_writes": "5 — git push x2 (empty branch probe, then 8b7306a355; git, not REST). Three fleet-write relay strokes as objectstack-fleet[bot], each one POST /repos/objectstack-ai/objectstack/dispatches: (1) pr_create = POST /repos/objectstack-ai/objectstack/pulls (draft) + POST /repos/objectstack-ai/objectstack/issues/23512/assignees [sunhaolin], relay run 38590237104, read-back 9004 bytes identical; (2) labels_add skip-changeset = POST /repos/objectstack-ai/objectstack/issues/23512/labels via scripts/pm/label-write.mjs, relay run 38590367182, read-back matches (size/s, skip-changeset); (3) this os-dev-report comment = POST /repos/objectstack-ai/objectstack/issues/23493/comments via scripts/pm/post-stamped.mjs.", "deviations": [ "The ledger re-pin adds four keys, not the one the triage (6170015227) and the dispatch named. revokeSessionsAndKeys is required. The three revocation counts are optional: the producer writes them only when the switch is on, which is the default and this fixture's path. Measured from runAdminSetUserPassword and its AdminAuditDecisions type, and proved necessary by ablation leg 2 (one-key reading: red on revokedSessions). The dispatch's own criterion, applied per key, decides required versus optional.", "Dispatch target vs CI (conflict named, no side picked): the target was 'a draft PR whose CI Dogfood Regression Gate runs the two files green'. The dogfood shard jobs never run on pull_request or merge_group (ci.yml), so PR #23512's CI cannot run them, and its aggregate 'Dogfood Regression Gate' success is a skip. The pre-landing evidence is the local lock-held run (20/20, plus the ablation). The authority is the first hourly full run after landing, or a workflow_dispatch of ci.yml on the branch if the seat wants it before landing. The relay's workflow_dispatch op allows only ref main, so that is not a dev act.", "origin/main was not merged before opening. It moved 4 commits past the base (111b5821ce, 5547ad451a, 3a2adc8835, f9b421716d). Over packages/qa/dogfood, plugin-auth, plugin-audit, core, rest and runtime, they touch only runtime/src/domains/automation.ts and its new test (the automation flow doors), not the auth gate or the ledger path. Re-running would rebuild the spec-rooted closure on a shared box for zero overlap. CI runs on the merge ref.", "Local narrowing, declared: 2 of the 53 derived gates are NOT MEASURED locally (check:dual-build-cjs-loads, check:type-check-debt; both whole-tree, both run by CI's Lint & Repo Gates).", "Commit trailer: the model-free pair (Claude-Session + Co-authored-by: Claude) per AGENTS.md. The harness reminder's model-named Co-Authored-By form was not used." ], "files_changed": [ "packages/qa/dogfood/test/bearer-lane-password-change.dogfood.test.ts", "packages/qa/dogfood/test/admin-ledger-decision-metadata.dogfood.test.ts" ], "open_questions": [], "out_of_scope_findings": [ "carrier: none (承接者:无) · noted, not filed: the doc comment above AdminAuditDecisions in packages/plugins/plugin-auth/src/admin-user-endpoints.ts still lists only event, passwordGenerated, placeholderEmail, membershipCreated and organizationId as the closed members, and says each is 'a decision that no field of the user stores, or a reference to another record'. It names none of PR #23440's four keys, and the three counts are neither a decision nor a reference. The type itself declares them, and no user-field value reaches the row (comment drift, no reachable defect). Recorded in PR #23512's Acceptance notes." ], "cleanup": "Worktree ../objectstack-issue-23493 removed (node_modules deleted first; git worktree remove exited 0 without --force; the pushed head equals local HEAD 8b7306a355). Every process this run started has exited; no dev server or monitor was started." }Generated by Claude Code
objectstack-fleet commentedon Oct 14, 2026
ACCEPT → PR #23512 comment 6172160884 ·
domain:specseat 4 ·session_0121ooBYRmS8ziFXm9ai5YHm· 2026-10-14T15:40ZLands once every check is green or skipped by design on
8b7306a355. The hourly full run after landing is the authority for the two dogfood files, which the PR and merge-queue runs skip by design.objectstack-fleet commentedon Oct 14, 2026
Landed · PR #23512 ·
domain:specseat 4 ·session_0121ooBYRmS8ziFXm9ai5YHm· 2026-10-14T16:19Z3f7cb1b0a3origin/main3f7cb1b0a3(this merge);PASSWORD_RESET_REQUIREDis inpackages/qa/dogfood/test/bearer-lane-password-change.dogfood.test.tstheregh-readonly-queue/main/pr-23512-*ref remainsState change: closed
completedbyFixes #23493, andpm:dispatchedis removed in this act.The dogfood shards skip on pull requests and in the merge queue, so the authority for these two files is the next hourly full
CIrun onmainat or after3f7cb1b0a3. This seat reads it. If it is red on these files, this card is reopened with that run's reading.objectstack-fleet commentedon Oct 14, 2026
Hourly full run read ·
domain:specseat 4 ·session_0121ooBYRmS8ziFXm9ai5YHm· 2026-10-14T17:49ZThe hourly full
CIrun38603056630at222293f60acontains PR #23512 (3f7cb1b0a3). Its conclusion issuccess.Dogfood Regression Gate(1/3, 2/3, 3/3) andDogfood Verify CLIare allsuccess. The two re-pinned files are green onmain, as the landing comment6172975058said this seat would read. This card stays closed.