Repository navigation
QA run · since:v18 (48/48) · 94114c1f · 2026-10-16 · 1 PASS / 45 PARTIAL / 2 FAIL / 0 BLOCKED / 0 NOT-RUN #23912
Description
Run record for the since:v18 items authored on #23879 (draft PR #23901). Filed by the domain:devx seat 1 PM (seat post #6023, session_014eFvbvGK4FjXvscggDNTD4) from the runner's report — the runner (session_016NNWeTTi2eHhhrgDq9sJF8) works under a role file that forbids it to POST issues; its full report is comment 6215306571 on #23879. Wave anchor: #23879.
Environment fingerprint
- Framework:
94114c1f(origin/main code; the branch changes ledger data only). Items read at PR docs(qa): author the v18 line's capabilities into the platform checklist (48 since:v18 items) #23901's head2d410efa. - Console:
.objectui-shadaeb77fc— did not build ([MISSING_EXPORT] checkPageComponentViewData, carried by hourly full run: red on main (CI) #23885). - Boot: fresh showcase
os dev, port 38791, ephemeral DB, tenancysingle, seeded admin + member. - Execution: sequential, one runner.
Scope
Selector since:v18 → 48 items, every one at revision 1 (as authored on PR #23901; none is on main yet). Tier 1 (automated.ref pins): 228 test files across 32 packages, all pass. Tier 2: live API legs as listed below; a clause not driven live is not-run inside its item's PARTIAL.
Verdicts
| item | verdict | oracle evidence (text) |
|---|---|---|
| identity-auth.auth-gate-held-session-raw-host-families | PARTIAL | pins pass; held member → 403 PASSWORD_RESET_REQUIRED on 7 raw-host doors, admin 200; API-key posture clause not-run |
| identity-auth.api-key-expiry-lifecycle | PARTIAL | pins pass; no expiry → 201 +90d; 400 days → 400 API_KEY_EXPIRY_TOO_LONG, row count unchanged; revoked → 403 API_KEY_REVOKED; expired arm not-run |
| identity-auth.cookie-session-renewal-in-process | PARTIAL | pins pass; live not-run |
| identity-auth.default-organization-boot-invariant | PARTIAL | pins pass; one default org, both sessions active in it, 5 seeded BU rows carry it; before-first-user ordering not-run |
| identity-auth.import-invitation-and-sso-domain-answers | PARTIAL | pins pass; live not-run |
| access-security.anonymous-floor-v18-doors | FAIL | anon GET /api/v1/keys → 405 METHOD_NOT_ALLOWED (contract 401) → #23909; anon 401 on 6 other doors, share-link token face 404, public form submit 201 {id} = pass |
| access-security.walled-environment-metadata-operator-only | PARTIAL | pins pass; walled boot not provisioned, live not-run |
| access-security.meta-authoring-trail-and-audience-gates | PARTIAL | pins pass; live not-run |
| access-security.security-catalog-activation-and-clone-doors | PARTIAL | pins pass; live not-run |
| access-security.security-catalog-one-holder-and-boot-report | PARTIAL | pins pass; live not-run |
| access-security.grant-table-write-contract | FAIL | inverted window → 400 with reason: unevaluable (Unknown variable: previous) → #23910; permission_set_id 400 INVALID_FIELD, duplicate 409 UNIQUE_VIOLATION, forged granted_by stamped = pass; walled arm not-run |
| access-security.parent-and-organization-write-guards | PARTIAL | pins pass; live not-run |
| access-security.deployment-tables-platform-only | PARTIAL | pins pass; admin 200 / member 403 on sys_job, sys_migration; organization_id filter 400 = pass; org-admin leg not-run (no data door to promote) |
| access-security.share-link-combined-gates | PARTIAL | pins pass; live not-run |
| ai.mcp-coded-refusals-and-runtime-exposure | PARTIAL | pins pass; live not-run |
| api-backend.second-object-exposure-and-internal-fields | PARTIAL | pins pass; scratch app not provisioned, live not-run |
| api-backend.data-request-shape-and-query-arity | PARTIAL | pins pass; PATCH null/[]/5 → 400, updated_at unchanged; empty expectedVersion / If-Match → 400; /query null → 400; duplicated ?status → 400; keepData ×2 → 400; stale If-Match on unreadable row not-run |
| api-backend.meta-read-doors-v18 | PARTIAL | pins pass; package read, unknown-package = unknown-name 404, misspelt ?member 400, ?package=all ids identical (36); caller-FLS sortability not-run |
| api-backend.error-sentences-and-unique-violation-wire-code | PARTIAL | pins pass; live not-run |
| approvals.request-page-reply-and-reader-visibility | PARTIAL | pins pass; live not-run; console clause blocked(environment) — #23885 |
| approvals.act-door-and-admin-rescue-slate | PARTIAL | pins pass; live not-run |
| attachments-storage.upload-limits-scope-and-ownership | PARTIAL | pins pass; 101 MiB → 413; bad scopes → 400 naming the 5 scopes; omitted → 200; foreign completion → 403; limit move / unclaimed download / metadataRefused not-run |
| attachments-storage.chunked-upload-integrity | PARTIAL | pins pass; live not-run |
| automation.flow-registration-verdict-on-read | PARTIAL | pins pass; registration state registered and registrations map served; refused-flow arm not-run |
| automation.flow-authoring-refusals-v18 | PARTIAL | pins pass; single-brace notify title → PUT 422 expression-invalid, read-back 404; os validate arms not-run |
| automation.flow-run-semantics-v18 | PARTIAL | pins pass; live not-run |
| automation.inbound-hook-timestamped-signature | PARTIAL | pins pass; live not-run |
| automation.scheduled-work-opt-in | PARTIAL | pins pass; boot log: schedule / time_relative NOT bound with the flag unset; two-interval count and flag-on boot not-run |
| cli.migrate-meta-write-stored-and-all | PARTIAL | pins pass; live CLI legs not-run |
| cli.organization-ownership-ceremony | PARTIAL | pins pass; live ceremony on a v17 DB copy not-run |
| cli.meta-package-flags-and-explain | PARTIAL | pins pass; live not-run |
| cli.validate-v18-authoring-verdicts | PARTIAL | pins pass; live not-run |
| cli.verify-derived-proof-families | PARTIAL | pins pass; live not-run |
| dashboards.analytics-exposure-gate-and-measure-aggregate | PARTIAL | pins pass; dataset query on sys_user_metrics → count aggregate; exposure arms not-run |
| i18n.flow-copy-translation-and-host-override | PARTIAL | pins pass; live not-run |
| integration-system.inbound-mailbox-association | PARTIAL | pins pass; live blocked(fixture): no composed mailbox / IMAP double on a stock boot |
| integration-system.notification-org-and-redeliver-eligibility | PARTIAL | pins pass; live not-run |
| platform-core.v18-boot-refusals | PARTIAL | pins pass; v17 DB copy not provisioned, live not-run |
| platform-core.protocol-18-handshake-and-stored-replay | PARTIAL | pins pass; live not-run |
| platform-core.settings-organization-isolation-and-platform-rung | PARTIAL | pins pass; member 403 on sys_platform_setting, no scope=global row in sys_setting; global write and walled legs not-run |
| platform-core.serve-composition-v18 | PARTIAL | pins pass (e2e pin under OS_TEST_TIERS=nightly: 1 file / 2 tests); live not-run |
| records-forms.write-time-option-and-element-shape-judgement | PARTIAL | pins pass; live not-run |
| records-forms.write-answer-advisories-rollback-and-tree-delete | PARTIAL | pins pass; live not-run |
| records-forms.comment-reactions-and-edit-stamps | PARTIAL | pins pass; reaction 201 with user forced to caller, duplicate 409, unreadable 403, update 405, column write 400, edit stamps server-set = pass; foreign delete / filter-read halves not-run |
| records-forms.v18-semantic-defaults | PARTIAL | pins pass; browser clauses blocked(environment) — #23885 |
| studio-authoring.meta-save-preconditions-and-draft-rows | PASS | pins pass; draft read serves version; If-Match 200 then stale 409 with currentVersion; If-None-Match * on existing 409; abc 400; both headers 400; draft row label + history actor = pass |
| studio-authoring.multi-package-item-rows | PARTIAL | pins pass; live not-run |
| studio-authoring.save-door-runs-authoring-rules | PARTIAL | pins pass; unknown page:header key → 422 component-props-unknown-key, read-back 404; javascript: URL → 422; protection block → 400; remaining arms not-run |
Reproduction rules for the two FAILs
- runtime(dispatcher): anonymous GET / PUT / PATCH / DELETE on /api/v1/keys answer 405 METHOD_NOT_ALLOWED instead of the 401 UNAUTHENTICATED the v18 anonymous floor states for every /keys verb — only POST is mounted #23909 — fresh
pnpm dev -- --fresh -p PORT; anonymousGET /api/v1/keys→ expected401 UNAUTHENTICATED; actual405 METHOD_NOT_ALLOWED"GET is not supported for /api/v1/keys. Allowed: POST." (an admin also gets 405). - objectql(validation): a rule that reads
previousis unevaluable on insert — the insert path never binds it, so validity_window_order refuses an inverted grant window asunevaluable, not with its message #23910 — as admin,POST /api/v1/data/sys_user_permission_set{ user_id: MEMBER, permission_set: showcase_ops, valid_from: 2027-01-02T00:00:00Z, valid_until: 2027-01-01T00:00:00Z }→ expected400 VALIDATION_FAILEDcarryingvalidity_window_order's message ("Valid Until must be later than Valid From …"); actual400 VALIDATION_FAILEDwithfields[0].constraint{ rule: validity_window_order, reason: unevaluable, fault: 'type: Unknown variable: previous' }.
Close-out
- Product defects extracted: runtime(dispatcher): anonymous GET / PUT / PATCH / DELETE on /api/v1/keys answer 405 METHOD_NOT_ALLOWED instead of the 401 UNAUTHENTICATED the v18 anonymous floor states for every /keys verb — only POST is mounted #23909 (
domain:cli), objectql(validation): a rule that readspreviousis unevaluable on insert — the insert path never binds it, so validity_window_order refuses an inverted grant window asunevaluable, not with its message #23910 (domain:engine). - Environment blocker carried, not extracted: hourly full run: red on main (CI) #23885 (console build at the pin) — every browser clause of this run.
- Fixture gaps (recorded, not extracted): walled-environment boot; v17 DB copy for the ceremony and boot-refusal legs; scratch second-object app; composed mailbox / IMAP double; an org-admin-not-platform-admin promotion door.
- Checklist-accuracy findings from the same run (13 stale existing items) close out on the wave anchor qa(checklist): no ledger item carries
since: "v18"— author the v18 line's new and changed capabilities into the platform checklist, then run them #23879 / qa(checklist): run the whole platform checklist on main (selectorall, 272 items) and extract every new failure into its own card #23878, not here.
Generated by Claude Code
Activity
objectstack-fleet commentedon Oct 16, 2026
Close-out for this record (checklist-test §5), 2026-10-16T19:20Z. 1 pass · 45 partial · 2 fail of 48 (
since:v18). Bothfails are product defects, extracted. Every partial passes itsautomated.refpins but leaves a live leg undriven. Each such gap is parked on the wave anchor #23878, because this record's own anchor #23879 closed when PR #23901 landed:The failing item grant-table-write-contract also leaves its walled arm undriven, which is the same walled-boot gap as above. The 13 stale existing items from the same run (#23879 report 6215306571) go on the follow-up ledger card this seat files at #23878's close-out. Closed by the
domain:devxseat 1 PM (seat post #6023) ·os-sales·session_014eFvbvGK4FjXvscggDNTD4, as the last record of the paced close-out of the #23878 wave.Generated by Claude Code