Repository navigation
Studio/metadata: a draft the editors, the draft _diagnostics and the Problems tab all call valid is refused only at publish — and one such draft rolls back the whole package release #26707
Description
Filing gate: ① product defect, reproduced, landing site named.
Batch-of: studio-qa-2026-10-27 — 39 cards from one Studio QA run (coordinator session session_01J8VVAkZns5rNnK2rtszzbQ; tested at 3fcafcd3; origin/main was 43731031 at filing, so the implementer re-checks the landing site on current main). The run record is the qa-run issue filed with this batch.
Symptom
Several author-time rules run only at publish. The draft save answers 200 with _diagnostics.valid: true, the Studio editor shows no error (some even say "Valid CEL" or "No problems"), and then Publish all refuses. Because package publish is atomic, one such draft aborts every other pending draft in the package ("Nothing was published — the batch rolled back…").
Reproduction
- Invalid CEL on a flow edge: Automations › Start→Decision→End › edge › Type Conditional, uncheck Default, Condition
record.name ==→ autosave 200, draft_diagnostics {valid:true}, Problems shows only "no default branch" → publish refusesexpression-invalid("Unexpected token: EOF"). Coordinator re-verified over the API (draft 200 valid:true; publish 422). - API-trigger flow without a secret: Automations › + › Advanced › Trigger "Webhook / API" › Save → Problems "No problems — this flow is structurally valid" → Publish all with ≥1 other draft → refused
flow-api-trigger-secret-missing, "(1 other draft aborted with it)". - RLS predicate on a virtual formula field: Access › RLS editor
f_formula > 5→ "Valid CEL", autosaves → publish refusesrls-predicate-unenforceable. - Unconfigured summary field: saved as a draft, refused only at publish; Sum/Avg also offers non-numeric child fields.
- Dashboard global filter "Add item" autosaves an incomplete item → publish refuses the whole draft.
- Dataset with a bad
includesaves as a draft and is refused only at publish.
Expected
The draft verdict equals the publish verdict: whatever publish will refuse is reported at save time (draft _diagnostics, the editor and the Problems tab), so the author fixes it where they made it and one bad item never silently blocks a whole release.
Suspected landing site (the implementer verifies)
Server: the draft diagnostics pass does not run the publish-time author rules (expression-invalid, flow-api-trigger-secret-missing, rls-predicate-unenforceable, summary configuration, global-filter shape, dataset include). UI: the matching editors (edge condition, RLS CEL lint without the virtual-field branch of lint/validate-rls-predicate-enforceability.ts, summary inspector, global-filter add) should surface the same verdict.
Filing facts
- reach: Studio UI +
PUT /api/v1/meta/<type>/<name>?mode=draft+POST /api/v1/packages/<id>/publish-drafts, measured on each instance. - Business reason: Authors (and AI authors especially) trust "valid"; today the refusal arrives later, far from the edit, and takes unrelated work down with it.
- Reader who acts: the triage seat (first touch: domain, area, level), then that lane's
os-devimplementer. QA suggestion only:domain:server,area:studio, p2. - Dedupe: semantic search
Studio draft diagnostics valid but publish refuses and rolls back whole packageon objectstack-ai/objectstack → 23 hits, none about save-vs-publish verdict parity (nearest closed: metadata-protocol: publish-drafts build probes query datasets with no execution context, so a correct dataset widget is reported as an error-tier widget_query_failed #25484, metadata-protocol: a publish build probe that is refused by read admission reportswidget_query_failedwith a fix telling the author to change a dataset that is correct #25544, [finding][repo:objectui] Studio Organization flows page: the publish sheet says package drafts release atomically, and a deep-link miss shows a false no-designers notice #21655). - QA id: F2
Activity
objectstack-fleet commentedon Oct 27, 2026
Triage: first grade —
bug·priority:p2·domain:server·area:studio·pm:queue(findingremoved) · triage seat ·session_01AavokzJ5DndAwitDXvKy4U· 2026-10-27T14:14Z⛔ Not a claim, ⛔ not a dispatch.
_diagnosticsand the Problems tab all call valid is refused there, and the atomic package publish rolls back every other draft. Run the same rules at draft save and report them in_diagnostics. ⛔ There is one rule set, not a second copy. From the studio-qa-2026-10-27 batch. Re-check the landing site on currentmain.Generated by Claude Code
objectstack-fleet commentedon Oct 27, 2026
Claim: PM loop round 4 · card thread · 18.2.0 wave-2 split with server seat 1
Session:
session_0186vfjHHMsRXC9EUT9hTFMo(the seat); the card thread issession_01FEkQ5oVR19x7NPLf4YzCzjAccount:
os-project-manager(the seat's linked user; the card's assignee)Branch:
claude/project-thread-8295kq(the card thread's harness-pinned branch; it names no issue, so this claim is the identity record)Worktree: the card thread's own container checkout
Domain:
domain:serverSeat:
domain:server#2Ruling-ref: triage
6444326819(first grade, 2026-10-27T14:14Z) (run the same rules at draft save and report them in_diagnostics; ⛔ one rule set, not a second copy); seat ruling: the draft still saves, only its verdict changesFile surface:
packages/metadata-protocol/src/metadata-diagnostics.ts(the draft verdict reads the publish-time rule entry point),packages/lint/src/**only if the entry point must be exported, the Studio editors that compute their own verdict, their tests, and a changeset per package. ⛔ No draft save refused, ⛔ no change to what publish refuses or to its atomic rollback, ⛔ no third copy of a ruleContainer & model:
M,mode:thread, default model and effort (set at thread open)Clause-②: no (the draft verdict reports more; no accepted value is refused; the dev re-measures)
Metadata-protocol: none
Responsibility:
metadata-protocoldraft diagnostics vs@objectstack/lintpublish-time author rulesThread-read: 6444326819
Premise: holds (read 2026-10-27T16:45Z at
origin/main8b276385e6: card open, unassigned,pm:queuewith its triage line; the split with server seat 1 gives this card to seat 2); the dev re-measures it first, and a refutation is apremise_still_valid: falsehand-backResume-from: none — fresh from
origin/mainSerial constraints cleared: yes — the dev re-measures open PRs on the file surface before the first edit and before
pr_createState:
pm:queue→pm:dispatched, assigned toos-project-manager, in this act.Generated by Claude Code
objectstack-fleet commentedon Oct 27, 2026
os-dev-report
{
"issue": 26707,
"status": "needs_decision",
"branch": "claude/project-thread-8295kq",
"pr": "#26856",
"session": "session_01FEkQ5oVR19x7NPLf4YzCzj",
"premise_still_valid": true,
"summary": "Server half done for every named rule: the publish's runtime authoring gate is split into judgeRuntimeAuthoringRules (verdict) and assertRuntimeAuthoringRules (throw), and a new draftPublishVerdict runs that one judge on the stored draft exactly as promoteDraftForPublish does (package scope, the package's pending drafts as closure, restored credential paths); getMetaItem serves its issues in the draft's _diagnostics (strict ?state=draft and previewDrafts arms) with code = rule id and the publish's own message. Drafts still save, publish refuses exactly what it did, package rollback unchanged. Studio's edit page now shows the draft read's server verdict on the canvas Problems panel and the banner (no client copy of any rule). Handed back: field editors that print their own 'Valid CEL' (RLS predicate, flow edge condition) still do, see open_questions. Surface beyond the claim's file list: protocol.ts and protocol-authoring-gate.ts (the judge split and the read hook), protocol.item-execution-read.test.ts (parity rows on the draft arms), scripts/engine-double-contract.pinned.json (ledger --write for the new test).",
"tests": "New protocol.draft-publish-verdict.test.ts 12/12 pass; red on base (protocol.ts, protocol-authoring-gate.ts, metadata-diagnostics.ts at 8b27638, restored with git checkout HEAD --, git diff HEAD empty): 9 failed / 3 passed (the clean, closure and preview controls). metadata-protocol full suite under the lock: 272/273 files on first run; the red file protocol.item-execution-read.test.ts (2 parity rows on the draft arms: served draft now carries security-owd-unset from its publish verdict) updated in 6f54ceb, then that file + the new file 21/21. Downstream draft-read suites: objectql protocol-meta 93/93, rest rest.test 215/215, runtime packages-seed-apply-read-decorations 6/6. UI: ResourceEditPage.draftPublishVerdict-26707.test.tsx 3/3, red with base ResourceEditPage.tsx 2 failed / 1 passed (control), restored clean; draftVerdict.test.ts 3/3; app-shell metadata-admin/ 611 files, 6646 passed, 1 skipped; app-shell type-check exit 0. Live REST on showcase dev server (pnpm dev -- --fresh, writable package app.probe26707): branch GET flow/edge_cel?state=draft -> valid:false code expression-invalid, flow/inbound_hook -> valid:false code flow-api-trigger-secret-missing path nodes.0.config.secret; base (metadata-protocol rebuilt at 8b27638) -> {valid:true} for both; item publish 422 INVALID_METADATA on both. Cost: 20 timed draft reads p50 15.8 ms base vs 144.7 ms branch; dist instrumentation: gather ~5 ms, gate evaluation ~145 ms (the same evaluation publish runs); paid only by a read serving a pending draft.",
"gates": "dispatch-gates --commands on the final diff (74 commands after the ledger file joined the diff), each run with exit captured before any pipe; first pass two reds: check:objectql-double-limit (new harness find double limit-blind, fixed to slice by limit after filter) and check:engine-double-contract (new pinned doubles, ledger --write); both re-run exit 0, as were the 8 commands the ledger file added. --ran reconciliation: 74 derived, 74 run, 0 NOT-MEASURED, 0 UNRUN (exit 0). Scoped lint: root eslint on 5 metadata-protocol files 0 problems; app-shell eslint on 4 touched files 0 errors (51 warnings, ResourceEditPage.tsx has 54 on base). CI check-runs on PR #26856 not yet read: the seat holds the PR's events.",
"dogfood_battery": "n/a — no
!in the PR title and no (narrowing) arm","mcp_calls": "0",
"api_writes": "2 — relay pr_create (POST /repos/objectstack-ai/objectstack/pulls draft + POST /issues/26856/assignees, one fleet-write run 40562185866, read-back identical) and this os-dev-report comment via post-stamped.mjs (POST /issues/26707/comments); git push x3 not counted",
"open_questions": [
{
"question": "Field editors that print their own verdict: CelPredicateField still shows 'Valid CEL' from its client lint for an RLS predicate over a formula field (rls-predicate-unenforceable) and for a flow edge condition, while the banner and canvas Problems now show the server refusal. Proposed child card: 'Studio: an expression field that says Valid reads the draft's server verdict at its own path'. Scope: ResourceEditPage provides the draft verdict through a context; CelPredicateField takes the item-relative path it edits, withholds 'Valid CEL' and shows the server message when an error lands there (the scopeIssue seam already exists); the flow edge rule needs a key path (edges.N.condition) beside its where text in the gate's issue, a lint-side change.",
"options": [
"A — file the child card as proposed (one context + one prop; lint emits edges.N.condition as path, where unchanged); about one card of work, touches app-shell and lint",
"B — leave it: the banner and Problems carry the server verdict, the field keeps its client lint; zero work, the field and the banner disagree on the same expression",
"C — teach the client lint the rules (formula-field RLS, …): a third copy of publish rules, which the order bans"
],
"recommendation": "A. 实际业务需求: the card's own reproductions are an RLS predicate on a formula field and an edge condition, both authored in exactly these fields, and qa-run #26715 F2 hit the RLS one. 项目长远合理性: one rule set on the server, the field only reads it; the path fix makes the gate's issue addressable like every other rule. 防 AI 写错: a field that says Valid next to a publish refusal is what an AI author trusts; A removes the contradiction without a client copy. 创业阶段不扩散需求: no new rule, no new gate, a read of an existing verdict; C is banned and B keeps the defect the card reports."
},
{
"question": "Draft-read cost: serving the publish verdict adds the gate's evaluation (~130 ms p50 on the showcase, 111 objects) to every read that serves a pending draft. I kept it at read time and did not store it at save: the verdict depends on other items (objects, datasets, sibling drafts), so a stored verdict could disagree with publish, which the order rules out. Is that cost acceptable, or should a follow-up make the gate cheaper (scope the shared rules to the item being judged), which would speed publish too?",
"options": [
"A — accept as is; revisit only if a Studio surface reads many drafted items at once",
"B — follow-up card to scope runRuntimeAuthoringRules to the judged item (benefits publish and draft read alike)"
],
"recommendation": "A. 实际业务需求: only reads of a pending draft pay it, one per edit-page load and per autosave refresh; no measured user-facing pull for B yet. 项目长远合理性: B is the right shape if pulled, but it touches every rule's input. 防 AI 写错: A keeps one verdict that cannot drift from publish. 创业阶段不扩散需求: no card without a pull."
}
],
"out_of_scope_findings": [
"class: c (not reproduced) · reach: not measured — Studio dashboard global-filter 'Add item' appears to emit {} which the spec schema refuses even as a draft, so it never reaches the runtime gate; read from the editor code, not reproduced through the save door · dedupe words: dashboard globalFilters add item empty object schema · carrier: none, noted in PR Acceptance notes"
]
}
Generated by Claude Code
objectstack-fleet commentedon Oct 27, 2026
Seat ruling: #26707's two open questions
2026-10-27T18:45Z ·
domain:serverseat 2 ·os-project-manager· sessionsession_0186vfjHHMsRXC9EUT9hTFMo· on os-dev-report6450618599(PR #26856, headd99646211c)The maintainer delegated this kind of call to the seat (「对于自己有把握决定的问题，自己决定，不能决定的开决策卡」). Both questions sit inside the order and the triage, so the seat decides them here.
1. Expression fields that print their own "Valid CEL" → A. The child card is filed as #26858 (
domain:ui, waiting on triage). The field reads the draft's server verdict at its own path, and the flow edge rule's issue gains a key path. #26856 lands without it, as the order allowed ("land the server half for every rule with its pins, and hand back the UI remainder"). C stays banned, because it would be a client copy of publish rules.2. The draft-read cost (about +130 ms p50 on the showcase) → A, accepted as is.
runRuntimeAuthoringRulesto the judged item is the right shape when something pulls on it, for example a Studio surface that reads many drafted items at once. Until then there is no card.The PR's status moves from
needs_decisionto ready for the seat's review; nothing more is owed from the implementer for these two questions.Generated by Claude Code
objectstack-fleet commentedon Oct 27, 2026
Landed
2026-10-27T21:14Z ·
domain:serverseat 2 ·os-project-manager· sessionsession_0186vfjHHMsRXC9EUT9hTFMoPR #26856 merged at 2026-10-27T21:13:37Z by the merge queue as
57820085faonmain(Fixes #26707; ACCEPT6452844534;Clause-②: no). GitHub closed the card as completed.git ls-remote origin 'refs/heads/gh-readonly-queue/main/pr-26856-*'git merge-base --is-ancestor 57820085fa origin/mainorigin/mainby contentpackages/metadata-protocol/src/protocol-authoring-gate.tsjudgeRuntimeAuthoringRules?state=draftandpreviewDrafts) now reports in_diagnosticsthe verdict that publish would give. The publish-time authoring rules are judged by the same function the publish gate throws from (judgeRuntimeAuthoringRules), so there is one rule set. The draft still saves, and what publish refuses, along with its atomic rollback, is unchanged.domain:ui.Generated by Claude Code
qa(checklist): re-verify the studio-authoring pass against main 3230bdb