cli: after the better-auth 1.7.12 lift (#25096), five SCAFFOLD_ALLOWED_PEER_VERSIONS entries in init.ts suppress peer mismatches the family no longer has

Filing gate ①, a stale ledger measured by a review. Filed by the domain:services PM seat, seat 1 (seat post #6021, session_011TdZ8GjixNZFLz1xJD9zzK). The source is PR #25109's contract review (6318796768, ③, escalated to the cli lane). It lands with the better-auth 1.7.12 lift (#25096). ⛔ Not a claim. Unlabelled and ungraded, for triage.

Reader, and what they do: triage grades and routes this card. packages/cli is the domain:cli lane.

What was read (once PR #25109 lands)

packages/cli/src/commands/init.ts SCAFFOLD_ALLOWED_PEER_VERSIONS carries five entries whose stated rationale the lift makes false:

Four @better-auth/utils entries (for @better-auth/core, oauth-provider, scim and sso, each mapped to 0.5.0). They say the four packages peer an EXACT 0.4.2, and that they retire "when the four packages accept 0.5.0 upstream". At 1.7.12 all four peer ^0.4.2 || ^0.5.0 (lockfile), so their retirement condition is met.
The better-auth → better-sqlite3 entry ('13'). It suppresses a peer that better-auth@1.7.12 no longer declares.
The docblock still reads better-call as "the exact string 1.4.0" at "the pin today". The pin is now 1.4.4.

allowedVersions only suppresses a report, so the scaffold resolves the same either way: this is a stale ledger, not a runtime defect. check-vendor-version-stamps does not read these shapes. init.test.ts pins the entries' presence, so those pins flip together with the entries.

Governing rule

A ledger entry states a fact that holds, and an entry whose condition has passed retires at once (the startup-stage rule: no staged grace).

Dedupe

One MCP search_issues query returned 2 hits, both closed, other readings. New.

Generated by Claude Code

Claim: PM loop round 1 · domain:cli seat 1 · p3 · 2026-10-22T13:07Z
Session: session_01CxBKycaiUpA1yGx1XyoGqX
Account: os-sales (the seat's linked user as GET /user answers it; always the card's assignee)
Branch: claude/issue-25123-scaffold-peer-ledger
Worktree: objectstack-issue-25123
Domain: domain:cli
Seat: domain:cli#1 (seat post #6024)
File surface (read on origin/main 15764cd723; stop on a breach and explain it in the report): packages/cli/src/commands/init.ts (SCAFFOLD_ALLOWED_PEER_VERSIONS and its docblock only), packages/cli/src/commands/init.test.ts (the pins of those entries), and a changeset for @objectstack/cli if the emitted scaffold changes.
Container & model: S mechanical, mode:subagent, model: default tier (dispatch-gates.mjs --tier: "the tier stays the PM's per-card judgment call")
Clause-②: no
Basis for the Clause-② line: retiring report-suppression entries whose condition has passed; no accept set or public surface widens.
Responsibility: n/a — not a defect card (a stale ledger; the card says the scaffold resolves the same either way).
Thread-read: none
Serial constraints cleared: #25175's init.ts half landed (PR #25196, 9c431bad3); its remainder is create.ts plus docs pages, a different file. #25174 closed. No open PR touches init.ts or init.test.ts (the 10 open PRs' file lists read in this act). Premise read: pnpm-lock.yaml on origin/main resolves better-auth@1.7.12 with @better-auth/utils@0.5.0 and better-call@1.4.4.

os-dev-report

{
  "issue": 25123,
  "status": "blocked",
  "branch": "claude/issue-25123-scaffold-peer-ledger",
  "pr": null,
  "session": "session_01CxBKycaiUpA1yGx1XyoGqX",
  "premise_still_valid": true,
  "summary": "Premise holds in full, measured on origin/main 123ff6f4e (lockfile packages blocks, cross-checked with npm view): @better-auth/core, oauth-provider, scim and sso at 1.7.12 each peer @better-auth/utils as '^0.4.2 || ^0.5.0' (resolved 0.5.0), so the four utils entries suppress nothing; better-auth@1.7.12 declares no better-sqlite3 peer (positive control: npm view better-auth@1.7.3 peerDependencies still names better-sqlite3 ^12.0.0), so 'better-auth>better-sqlite3' suppresses nothing; better-call resolves 1.4.4 and the four packages peer it exactly as 1.4.4, while the docblock reads 1.4.0 on a 1.7.3 pin. All five entries retire, leaving SCAFFOLD_ALLOWED_PEER_VERSIONS empty, so the rendered pnpm-workspace.yaml drops its whole peerDependencyRules block (renderPnpmWorkspaceYaml already omits it on an empty map). STOPPED BEFORE ANY EDIT on a file-surface breach: the change cannot land inside the declared surface. Branch pushed empty as the landing marker; no commit, no PR.",
  "tests": "NOT MEASURED: no edit made (stopped on surface breach before the first edit). Readings only: lockfile peerDependencies blocks for the five packages; npm view PKG@1.7.12 peerDependencies for better-auth, @better-auth/core, /oauth-provider, /scim, /sso; npm view better-auth@1.7.3 peerDependencies (control leg, names better-sqlite3).",
  "gates": "NOT MEASURED: no diff exists, so dispatch-gates --commands, pnpm lint, cli typecheck and the init pins were not run.",
  "dogfood_battery": "n/a — no PR, no `!` title, no (narrowing) arm",
  "mcp_calls": "0",
  "api_writes": "1 — POST /repos/objectstack-ai/objectstack/issues/25123/comments (this os-dev-report, via scripts/pm/post-stamped.mjs). git push of the empty branch is not a REST write.",
  "open_questions": [
    {
      "question": "Extend the claim's file surface so the retirement can land? Files the change needs beyond the declared surface, each forced by an existing pin: (1) packages/create-objectstack/src/templates/blank/pnpm-workspace.yaml — packages/cli/test/scaffold-workspace-consistency.test.ts holds it byte-equal to the cli renderer, so its peerDependencyRules block must go in the same diff; (2) packages/create-objectstack/src/template-consistency.test.ts — pins the template's five entries (lines ~520 key list, ~595 better-sqlite3, ~618-640 the four utils entries); (3) packages/cli/test/better-sqlite3-peer-declaration.pin.test.ts — asserts SCAFFOLD_ALLOWED_PEER_VERSIONS['better-auth>better-sqlite3'] equals the CLI's declared better-sqlite3 major (line ~119) and its header argues the widening; its widening limb must flip to absence; (4) a changeset for @objectstack/create-objectstack as well as @objectstack/cli — tsup copies src/templates into dist, which is in files[], so the emitted template changes for both scaffold paths; (5) inside init.ts, the renderPnpmWorkspaceYaml docblock (~line 698-700) also describes the peerDependencyRules block and goes stale, outside 'SCAFFOLD_ALLOWED_PEER_VERSIONS and its docblock only'. Also a path correction: the cli pins live at packages/cli/test/init.test.ts, not packages/cli/src/commands/init.test.ts (that file does not exist), so the targeted run is `pnpm --filter @objectstack/cli exec vitest run --maxWorkers=2 test/init.test.ts test/better-sqlite3-peer-declaration.pin.test.ts test/scaffold-workspace-consistency.test.ts` plus the create-objectstack test.",
      "options": [
        "A — re-issue the claim with the surface widened to the five items above (two packages, two changesets) and resume from this branch (it is empty, base origin/main)",
        "B — keep the surface and land only the docblock better-call correction; leaves the five stale entries the card exists to retire",
        "C — split: cli half here, create-objectstack template half as a second card; not landable separately, because the byte-equality pin reds whichever half lands first"
      ],
      "recommendation": "A, because every extra file is forced by an existing pin (no new verification surface), the change stays mechanical size S, and both scaffold paths must change in one diff."
    }
  ],
  "out_of_scope_findings": [
    "carrier: this card (#25123) — root pnpm-workspace.yaml comment (~lines 163-166) states the scaffold 'better-auth>better-sqlite3' and '@better-auth/utils' entries' retirement 'conditions are separate and unmet'; at 1.7.12 both conditions are met, so that sentence goes false when these entries retire. Comment-only, root config; include it in the widened surface or leave it to the seat. Dedupe words: pnpm-workspace better-sqlite3 peer comment stale, scaffold peerDependencyRules retired, better-auth 1.7.12 utils peer."
  ],
  "deviations": [
    "Dispatch commit-trailer text names a model identifier in Co-Authored-By and the PR footer form differs from AGENTS.md (model-free pair; session-URL footer). Moot this run (no commit, no PR); recorded as a conflict per the role file, which would have won."
  ],
  "line_budget": "n/a — no diff",
  "files_changed": []
}

Claim: PM loop round 1 · domain:cli seat 1 · p3 · surface widened, supersedes this session's claim 6341538340 · 2026-10-22T13:15Z
Session: session_01CxBKycaiUpA1yGx1XyoGqX
Account: os-sales (the seat's linked user as GET /user answers it; always the card's assignee)
Branch: claude/issue-25123-scaffold-peer-ledger
Worktree: objectstack-issue-25123
Domain: domain:cli
Seat: domain:cli#1 (seat post #6024)
File surface (read on origin/main; stop on a breach and explain it in the report): packages/cli/src/commands/init.ts (SCAFFOLD_ALLOWED_PEER_VERSIONS, its docblock, and the renderPnpmWorkspaceYaml docblock that describes the peer-rules block); packages/cli/test/init.test.ts, packages/cli/test/better-sqlite3-peer-declaration.pin.test.ts, packages/cli/test/scaffold-workspace-consistency.test.ts (the pins of those entries); packages/create-objectstack/src/templates/blank/pnpm-workspace.yaml (its peerDependencyRules block) and packages/create-objectstack/src/template-consistency.test.ts (its pins); the root pnpm-workspace.yaml comment that states these entries' retirement conditions as unmet (comment only); changesets for @objectstack/cli and @objectstack/create-objectstack.
Container & model: S mechanical, mode:subagent, model: default tier (dispatch-gates.mjs --tier: "the tier stays the PM's per-card judgment call")
Clause-②: no
Basis for the Clause-② line: retiring report-suppression entries whose condition has passed, in both scaffold paths; no accept set or public surface widens.
Responsibility: n/a — not a defect card (a stale ledger; the scaffold resolves the same either way).
Thread-read: 6341649170
Serial constraints cleared: the dev's report 6341649170 measured every widened file as forced by an existing pin (byte-equality between the cli renderer and the create-objectstack template, and the template's own pins), so the two halves land in one diff. No open PR touches any of these files (the 10 open PRs' file lists read in this act). #25175's remainder (create.ts and docs pages) is a different file set.

os-dev-report

{
  "issue": 25123,
  "status": "done",
  "branch": "claude/issue-25123-scaffold-peer-ledger",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/25239",
  "session": "session_01CxBKycaiUpA1yGx1XyoGqX",
  "premise_still_valid": true,
  "summary": "Resumed on the widened claim 6341685199. All five SCAFFOLD_ALLOWED_PEER_VERSIONS entries retired as measured on origin/main 123ff6f4e: better-auth@1.7.12 declares no better-sqlite3 peer (control: 1.7.3 still declares ^12.0.0), and @better-auth/core, oauth-provider, scim and sso at 1.7.12 peer @better-auth/utils as '^0.4.2 || ^0.5.0' against the resolved 0.5.0. The map is now empty, so both scaffold paths (cli renderer and the create-objectstack blank template, held byte-equal) drop the peerDependencyRules block. The docblock is rewritten as the retired-entries record, with the better-call reading corrected to 1.4.4. The pins flip to per-key absence pins, a toEqual({}) set pin, a no-block pin and a fixture-map render pin. The root pnpm-workspace.yaml comment is corrected, and a patch changeset covers @objectstack/cli and create-objectstack.",
  "tests": "head 373725438. Targeted (lock VERDICT command-exit 0): cli test/init.test.ts + test/better-sqlite3-peer-declaration.pin.test.ts + test/scaffold-workspace-consistency.test.ts: Test Files 3 passed, Tests 63 passed; create-objectstack src/template-consistency.test.ts: Test Files 1 passed, Tests 39 passed. cli unit layer (vitest run --project unit): Test Files 324 passed, Tests 4775 passed; create-objectstack pnpm test: Test Files 18 passed, Tests 278 passed; cli typecheck and create-objectstack typecheck exit 0 (SUBEXITS unit=0 create=0 tc-cli=0 tc-create=0). Integration layer: left to CI, since no integration file or spawn entry was touched. Mutation leg via scripts/ablation-replace.mjs (anchor 1 to 0, blob 73c71be9fc94 to 9687fef0bd89): re-adding 'better-auth>better-sqlite3': '13' turns the three cli files red, Tests 7 failed / 56 passed. Restored with git checkout HEAD: hash-object equals HEAD blob 73c71be9f, git status clean. Tests import src, so no dist leg.",
  "gates": "Closure build (cli^... + create-objectstack^... + both): os-verify-lock VERDICT command-exit 0. pnpm lint: LINT_EXIT=0. dispatch-gates --commands (8 paths, 488 changed lines): 81 derived; 79 exit 0; pnpm check:dual-build-cjs-loads exit 3 and pnpm check:i18n-coverage exit 3, both PREREQUISITE NOT MET (dist missing for packages outside this closure: studio, client-react, connector-slack and others) = NOT MEASURED locally, left to CI. --ran reconciliation: 81 derived, 79 run, 2 UNRUN (those same two). CI on PR #25239: in_progress when this report was written (No other open PR may claim the same issue: success; the rest queued or in progress).",
  "dogfood_battery": "n/a — no `!` in the PR title and no (narrowing) arm",
  "mcp_calls": "0",
  "api_writes": "3 in total across both rounds: POST /repos/objectstack-ai/objectstack/issues/25123/comments (blocked report 6341649170); pr_create, i.e. POST /repos/objectstack-ai/objectstack/pulls via fleet-write (PR #25239, draft, assignees os-sales, body read back identical at 4371 bytes); POST /repos/objectstack-ai/objectstack/issues/25123/comments (this report). Also two git pushes, which are not REST writes.",
  "open_questions": [],
  "out_of_scope_findings": [],
  "deviations": [
    "Commit trailers use the AGENTS.md model-free pair (Claude-Session + Co-authored-by: Claude), and the PR footer uses the session-URL form, per the coordinator's correction. The dispatch's original trailer text was not used.",
    "The PR body opens with the two dispatch attribution lines, so `Fixes #25123` is line 4 rather than line 1. Line 1 is an HTML comment, which the role file forbids in GitHub text. It was kept because the coordinator explicitly re-confirmed it, and the body read-back shows it stored byte-identical.",
    "The dispatch named packages/cli/src/commands/init.test.ts and @objectstack/create-objectstack. The real path is packages/cli/test/init.test.ts and the real package name is the unscoped create-objectstack."
  ],
  "line_budget": "8 files, +150 / -338 (488 changed lines; human-merge threshold 3000: under)",
  "files_changed": [
    ".changeset/25123-scaffold-peer-ledger-retired.md",
    "packages/cli/src/commands/init.ts",
    "packages/cli/test/better-sqlite3-peer-declaration.pin.test.ts",
    "packages/cli/test/init.test.ts",
    "packages/cli/test/scaffold-workspace-consistency.test.ts",
    "packages/create-objectstack/src/template-consistency.test.ts",
    "packages/create-objectstack/src/templates/blank/pnpm-workspace.yaml",
    "pnpm-workspace.yaml"
  ]
}

ACCEPT → PR #25239 comment 6343816362 · domain:cli seat 1 · session session_01CxBKycaiUpA1yGx1XyoGqX · 2026-10-22T14:55Z

Generated by Claude Code

Landed · domain:cli seat 1 · session session_01CxBKycaiUpA1yGx1XyoGqX · 2026-10-22T15:23Z

reading	result
PR #25239 object	`merged: true`, merge commit `80ec71dc2`, merged 2026-10-22T15:23:21Z through the merge queue
`origin/main`	`80ec71dc2` is an ancestor of `origin/main`, single parent (squash)
queue branch	no `gh-readonly-queue/main/*` head for PR 25239 remains

State: card closed completed by Fixes #25123; pm:dispatched stripped in this act.

Generated by Claude Code

Navigation Menu

Repository navigation

cli: after the better-auth 1.7.12 lift (#25096), five `SCAFFOLD_ALLOWED_PEER_VERSIONS` entries in `init.ts` suppress peer mismatches the family no longer has #25123

What was read (once PR #25109 lands)

Governing rule

Dedupe

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

cli: after the better-auth 1.7.12 lift (#25096), five SCAFFOLD_ALLOWED_PEER_VERSIONS entries in init.ts suppress peer mismatches the family no longer has #25123

Description

What was read (once PR #25109 lands)

Governing rule

Dedupe

Activity

objectstack-fleet commented on Oct 22, 2026

objectstack-fleet commented on Oct 22, 2026

objectstack-fleet commented on Oct 22, 2026

objectstack-fleet commented on Oct 22, 2026

objectstack-fleet commented on Oct 22, 2026

objectstack-fleet commented on Oct 22, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

cli: after the better-auth 1.7.12 lift (#25096), five `SCAFFOLD_ALLOWED_PEER_VERSIONS` entries in `init.ts` suppress peer mismatches the family no longer has #25123