[objectstack-fleet]

Requested by 田騏 · project thread

Fixes #27569

Clause-②: no
Metadata-protocol: none

维护者速读

• 改了什么： packages/lint/src/lint-liveness-properties.ts 里 live-elsewhere 判定的两处举例（文档注释和默认提示语）不再点名 manifest.runtime，改成通用描述：「本仓零分发、唯一执行者是另一个仓库的门（例如市场发布门），台账行的 evidence 指明它」。规则 id、消息、提示语的指令（保留该属性、看台账行的 evidence）都没动。
• 为什么改： manifest.runtime 这行台账在 ADR-0025 M1 — local T0 install loop for first-party, self-signed plugins: os plugin install (signature + integrity, materialize, record), boot-time loader with the tier dispatch point, disable/uninstall, Stripe sample as acceptance #27123 之后已是 live（本地有加载期分发点），而提示语还把它当作 live-elsewhere 的样板，作者读到的与台账相反。今天 packages/spec/liveness/*.json 里 live-elsewhere 行为零，所以没有现成的真实样板可换，只能改成通用说法。
• 风险与回滚： 只改注释和一条提示字符串，无行为变化；回滚即 revert 本 PR。packages/lint/CHANGELOG.md 未动（发布流程所有）。
• 先看： packages/lint/src/lint-liveness-properties.ts 的 defaultHint（live-elsewhere 分支）那一个 hunk，再看上面文档注释的 hunk。
• 两分钟验证： grep -n "manifest.runtime" packages/lint/src/lint-liveness-properties.ts 应无命中；pnpm --filter @objectstack/lint test 全绿（177 个文件）。
• 需要你做的： 无，席位落地。

What changes

lintLivenessProperties carried manifest.runtime as its worked example of a live-elsewhere row in two places: the describe() doc comment and the live-elsewhere verdict's defaultHint. Measured on main @ 178b5238:

• grep -n "manifest.runtime" packages/lint/src/lint-liveness-properties.ts → 2 hits (L217, L295).
• packages/spec/liveness/manifest.json, row runtime: "status": "live", "verifiedAt": "2026-10-29", "evidenceScope": "in-repo"; its note opens ENFORCED AT LOAD SINCE #27123 (ADR-0025 §3.5 M1), AND STILL AT THE CLOUD PUBLISH GATE — so the verdict FLIPPED live-elsewhere → live on local evidence.
• grep -rc '"status": "live-elsewhere"' packages/spec/liveness/*.json → 0 rows today (statuses present: live 899, dead 80, planned 30, experimental 1). So there is no real row to swap in, and both places describe the verdict generically instead, as the card's second option allows. The ledger README (packages/spec/liveness/README.md, the live-elsewhere section) keeps the manifest.runtime account as the historical worked example by its own statement, and is not touched.

The swap:

• Doc comment: the parenthetical now reads "a key with zero local dispatch whose only enforcer is a gate in another repository, a marketplace publish gate for instance, named by the ledger row's evidence", followed by its own sentence "No shipped row holds the verdict today; the ledger README keeps the historical worked example."; "That row is not deletable" becomes "Such a row is not deletable". (The first head named "a closed runtime's check" as a second shape; the review's nit 1 removed it, because the README's own rule keeps a key consumed only by the closed runtime at live.)
• Hint string: (for \manifest.runtime`, the cloud marketplace publish gate)becomes(a marketplace publish gate, for instance)`. The sentence around it — "Keep it — nothing reads it when the stack loads here, but a sibling repo enforces it (…); see the ledger row's evidence for the enforcer." — is unchanged.
• Rule id liveness-live-elsewhere-property, the message kind and the hint's instruction are unchanged. No behaviour change.
• Changeset .changeset/27569-liveness-lint-elsewhere-example.md: @objectstack/lint patch (the hint string ships in the package's dist), with the Clause-②: no / Metadata-protocol: none lines. packages/lint/CHANGELOG.md is not edited.

Tests

No test pins the old example text. The existing pins on this verdict still hold and were run: toContain('sibling repo'), toContain('evidence'), toContain('keep it'), not.toContain('Remove it'), and the default-hint equality pins (lint-liveness-properties.test.ts). The test file's comments that mention manifest.runtime describe the history ("until #27123 flipped that row") accurately and are outside the ruling's two places, so they are left as they are.

• pnpm --filter @objectstack/lint test @ 16006a58 (under os-verify-lock): Test Files 177 passed (177) · Tests 7599 passed | 5 skipped (7604), VERDICT command-exit 0.
• pnpm --filter @objectstack/lint typecheck @ 16006a58: tsc --noEmit + check:test-typecheck green, VERDICT command-exit 0.

Acceptance notes

• The commit's doc comment drops the sentence that manifest.runtime was the first row carrying the verdict; that history stays in the ledger README's worked example and in the test file's comments, which this card does not touch.
• Out of scope, noted only: packages/lint/CHANGELOG.md still carries the old hint sentence in its released entries, which is release-owned text and stays as shipped.

Verification

Local subset, run on the final head f1d90c65 (the derived list from node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack, 52 commands, each exit code captured to a file before any pipe, then --ran reconciliation):

• dispatch-gates --ran: 52 derived families accounted for — 50 run (all exit 0), 2 NOT-MEASURED (recorded exit 3, PREREQUISITE NOT MET): node scripts/check-plugin-teardown-shape.mjs --self-test (its fixture needs an unshallowed clone; this checkout is shallow) and pnpm check:dual-build-cjs-loads (needs the whole pnpm build; only the lint, objectql and spec closures were built here). Both are CI's on a full checkout and build.
• Among the 50 green: check:doc-authoring, check:nul-bytes, check:changeset-no-major, check:empty-changeset, check:adr-0087-registration, check:docs-transcript-drift, check:lean-entry-closure, check:issue-citations, check:published-files, check:test-source-alias, check:cross-package-test-inputs.
• pnpm --filter @objectstack/lint test @ f1d90c65: Test Files 177 passed (177), Tests 7604 passed (7604), VERDICT command-exit 0.
• pnpm --filter @objectstack/lint typecheck @ 16006a58 (the only later edits are comment and string text in the same file; the head run of tsc is CI's TypeScript Type Check): VERDICT command-exit 0.
• node scripts/check-commit-card-trailers.mjs --range origin/main..HEAD: green (no card relation, no model identifier in the trailer pair).
• Not run locally, declared to CI: test:repo (the vitest repo project, Test Core), the lint workflow's whole-tree farm, and the dogfood battery (n/a: no ! in the title and no (narrowing) arm).

Independent full review record: posted as a comment on this PR (PASS WITH NITS on 16006a58, nits applied; delta PASS; whole-PR PASS at f1d90c65).

---

Generated by Claude Code

[objectstack-fleet]

domain:spec#4 · marchtian · session_017ihL2dZmutT6YPdL6nSFmM

Independent full review (spec rule: a complete second-model review before merge)

Reviewer: an isolated subagent fed the card, the triage ruling, the full diff and the governing text (AGENTS.md documentation guardrails and changeset rules, the liveness ledger README's live-elsewhere section, the runtime row of packages/spec/liveness/manifest.json, the check-liveness.mts criteria), not the author's conclusions.

Record 1 — first head 16006a58 (vs base 178b5238): PASS WITH NITS, no must-fix

1. nit — the generic example "a publish gate or a closed runtime's own check" sat one step from the README's rule that a key consumed only by the closed AI runtime stays live; the README and elsewhere.mts keep exactly one enforcer example (the marketplace publish gate), so the safest neutral wording names only that shape. Suggested hint text supplied.
2. nit — the doc comment's five-line parenthetical nested an em-dash pair and a semicolon inside an outer em-dash clause; restructuring suggested, every fact kept.
3. nit (informational) — "no shipped row holds the verdict today" is a dated fact nothing in packages/lint pins; it mirrors the README's own "No row holds it today", so the two rot together and the README is the authority. Acceptable as written.
4. nit — the changeset's Clause-②: no — … line carried trailing decoration; clause2-line.mjs reads it as declared · no, sibling changesets use the bare form. Trim suggested.
5. nit, out of scope — test-file comments still mentioning manifest.runtime are accurate layered history; the ruling limits the card to the doc comment and the hint string, so leaving them is correct.

Answers: scope exact (both places generic, rule id / message kind / hint instruction byte-identical apart from the parenthetical, CHANGELOG untouched); wording accurate against the README and the criteria; changeset correct (@objectstack/lint patch, both declaration lines read as declared, no tracker number, no model identifier); no test pins the old text and the existing pins hold (111/111 in lint-liveness-properties.test.ts); check-doc-authoring and check-empty-changeset green.

Record 2 — delta fd648a4d..f1d90c65 (nits 1, 2, 4 applied): PASS

Nit 1 resolved (hint now (a marketplace publish gate, for instance), doc comment and changeset aligned); nit 2 resolved (single-clause parenthetical, status/README pointer in its own sentence, every fact retained; the rewrap commit is content-identical); nit 4 resolved (bare Clause-②: no, Metadata-protocol: none, both read as declared). Pins still hold on the final text: 111/111. Delta touches only the two files of the original diff; manifest.runtime occurs 0 times in the lint source; no tracker number or model identifier in any added line or commit message.

Combined verdict for the whole PR at head f1d90c65: PASS.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

Nothing in this diff resolved to a documentable surface (no symbol, route or SDK anchor derived from 1 changed package(s)), so this run has no opinion about the docs.

What this run could not see

• 1 name(s) were too generic to anchor anything (single lowercase words)
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 4 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 144702ca5dd1bb74bd6c0151068d75c73c00c3c5 → packageMentionDocs.

[objectstack-fleet]

domain:spec#4 · marchtian · session_017ihL2fi9zfJhUTubyJYb6V

席位核对 · ACCEPT · card #27569 · 2026-10-29T16:26Z

• Shape: 2 files, +22 / −9: the doc comment (L216–L226) and the live-elsewhere defaultHint in packages/lint/src/lint-liveness-properties.ts, plus a @objectstack/lint patch changeset carrying Clause-②: no / Metadata-protocol: none. No governed path, no packages/spec/src/** file ⇒ none of the four contract faces (contract-review.md) is hit; not Tier H.
• Premise, measured by the seat on origin/main: git grep '"status": "live-elsewhere"' -- packages/spec/liveness/ → 0 hits, so a generic example is right (no live row to name). After the diff, manifest.runtime stays only in lint-liveness-properties.test.ts comments that record the ADR-0025 M1 — local T0 install loop for first-party, self-signed plugins: os plugin install (signature + integrity, materialize, record), boot-time loader with the tier dispatch point, disable/uninstall, Stripe sample as acceptance #27123 flip as history (L1415, L1452, L1465, L1471, L1953), which is correct.
• Behaviour: the rule id, the verdict branch and the hint's instruction ("Keep it … see the ledger row's evidence") are unchanged; only the example text moved. packages/lint/CHANGELOG.md untouched.
• Independent review: Fable PASS 6502280928 (whole PR at the head below). os-dev-report 6502313790.
• Gates: the dev's 52 derived, 50 green, 2 NOT MEASURED locally (both CI's). The landing waits for every check on this head to be green.
• Out of scope: none.

Contract review

Served-tier: TIER_DEFAULT
Head-sha: f1d90c65c2871509655a89ffc9394a04aff55221
Local-runs: none
Scope: packages/lint/src/lint-liveness-properties.ts, .changeset/27569-liveness-lint-elsewhere-example.md + packages/spec/liveness/manifest.json

① Derived judgments

No accept set or public surface changes: one hint string and one doc comment. The hint is author-facing text, and the new text names no row that the ledger contradicts.

② Semver level

@objectstack/lint patch, matching a text-only change.

③ Boundary flags

None raised by the dev; none found. Author objectstack-fleet[bot] (relay).

Implemented-by: claude/project-thread-1bbcjc
Reviewed-by: session_017ihL2fi9zfJhUTubyJYb6V

VERDICT: PASS