Repository navigation
providers: createObjectStackUploadAdapter documents scope as a free key prefix and forwards a generic path as the scope, but the server takes only its storage-scope vocabulary #12055
Description
Blocked-by: objectstack-ai/objectstack#22470
Filing gate: ① a product defect, measured server side. objectstack-ai/objectstack#22470's dev (report 6079733604) measured that an upload start naming a scope outside the server's vocabulary fails: today it answers 500 INTERNAL, and after objectstack-ai/objectstack#22470 it answers 400. Filed by the objectstack triage seat (seat post objectstack-ai/objectstack#6015, session_01AavokzJ5DndAwitDXvKy4U) as the objectui half that card names. ⛔ Not a claim.
What the adapter does (objectui main 972e56659f, packages/providers/src/UploadProvider.tsx)
:200–:203documentsscope?: stringas a "Logical key prefix … (e.g. "avatars", "logos", "attachments/case")". The server accepts onlyStorageScopeSchema(@objectstack/spec):user,tenant,public,private,temp,attachments. storage: thepublicstorage scope is described as "publicly accessible static assets", but after PR #22439 a default-acl file with that scope needs a signed-in caller — trim the value or enforce it objectstack#22443 retirespublic. Each example in the docblock butattachmentsfails, and so doesattachments/case.:258and:311sendscope: opts.scope ?? options.path. An upload's genericpathoption, a different concept, becomes the scope whenever the adapter was built without one. The console's app-wide adapter (apps/console/src/App.tsx:173) is built without a scope, so any caller that passes apathsends it as the scope.- In-repo callers today:
RecordAttachmentsPanelpassesscope: 'attachments'. The app-wide adapter passes none, and no in-repo upload passes apath. Third-party authors follow the docblock.
Acceptance
scopeis typed as the server's scope vocabulary, from@objectstack/spec'sStorageScopetype. It is not a free string. The docblock says what each value means and drops the prefix examples.- The
options.pathfallback is removed: a path is not a scope. With no scope, the adapter sends none and the server's default applies. - The owner declares
Clause-②: a published option type narrows. - Pins:
- an adapter built without a scope, uploading with a
path, sends noscope; - a typed scope is forwarded unchanged;
- a type-level pin refuses
scope: 'avatars'.
- an adapter built without a scope, uploading with a
Dedupe: search over objectui for the adapter's scope option, free key prefixes and the path fallback found nothing.
Activity
objectstack-fleet commentedon Oct 9, 2026
Claim: PM loop round 18 (serial)
Session:
session_01MgfduSkFrfM3eorB3UGfAUAccount:
os-billBranch:
claude/issue-12055-upload-scopeWorktree:
objectui-issue-12055Domain:
domain:uiSeat:
domain:ui#2Scope of this claim: the card's acceptance, as filed. The defect was measured server side in objectstack-ai/objectstack#22470's dev report
6079733604.createObjectStackUploadAdapter'sscopeoption is typed as the server's storage-scope vocabulary, from@objectstack/spec'sStorageScope, not a free string. Its docblock says what each value means and drops the key-prefix examples.scope: opts.scope ?? options.pathfallback is removed at both sites: a path is not a scope. Without a scope, the adapter sends none, and the server's default applies.path, sends noscope;scope: 'avatars'.File surface (as read on
main55e90fd; the dev re-reads it):packages/providers/src/UploadProvider.tsx: thescopeoption and its docblock, and bothopts.scope ?? options.pathsites;packages/providers/package.json, only if theStorageScopetype needs@objectstack/specdeclared there, plus the lockfile change the repo's own tooling regenerates;.changeset/12055-*.md.⛔ Not on it:
@object-ui/typesor any other package. A re-export would widen a published surface;@objectstack/specand storage: thepublicstorage scope is described as "publicly accessible static assets", but after PR #22439 a default-acl file with that scope needs a signed-in caller — trim the value or enforce it objectstack#22443's retirement ofpublic. The type follows whatever the pinned spec declares;RecordAttachmentsPanelandapps/console/src/App.tsx, unless measurement shows a caller that stops compiling. Then the dev reports it before editing;packages/i18nkey.Any file outside this list: the dev reports it before opening the PR (stop on breach; explain in the report).
Container & model:
S,mode:subagent,model: opus(dispatch-gates --tier --repo objectstack-ai/objectui: no path-derived mandate; default tier)Clause-②: no (narrowing)
Responsibility:
objectui providers: the upload adapter documents scope as a free key prefix and forwards a generic path as the scope, which the server refuses (500 today, 400 after objectstack-ai/objectstack#22470) | the server's StorageScope vocabulary in @objectstack/spec | every host and author who builds an upload adapter or passes a pathThread-read: none
Serial constraints cleared: no open objectui PR touches
packages/providers/src/UploadProvider.tsx(read 2026-10-09T12:27Z). The batch is now serial: this is the only dispatch in flight, per the maintainer's 「当前任务处理完，合并后就改为串行派发。」.Why
Clause-②: no (narrowing): the published option type narrows fromstringto the server's own vocabulary, so nothing is widened. The accept set narrows to what the server already accepts; a value outside it is refused at the type level instead of by the server. The narrowing owes this seat's contract-tier review of record on the PR. The changeset isminorwith the breaking meaning stated, nevermajor.Generated by Claude Code
objectstack-fleet commentedon Oct 9, 2026
os-dev-report
{
"issue": 12055,
"status": "needs_decision",
"branch": "claude/issue-12055-upload-scope",
"pr": "#12058",
"session": "session_01MgfduSkFrfM3eorB3UGfAU",
"premise_still_valid": false,
"summary": "The card's type premise is false: at the installed @objectstack/spec 17.7.0, StorageScope (exported from @objectstack/spec/system) is global, tenant, user, session, temp, cache, data, logs, config, public. The server's upload vocabulary is a different list, the sys_file scope select in @objectstack/service-storage (user, tenant, public, private, temp, attachments). The spec's upload request declares scope as an open z.string(). Typing the option as StorageScope would refuse attachments (RecordAttachmentsPanel stops compiling, TS2322 measured) and private, and admit six values the server refuses, and both fixes are off the claim's surface, so the type half and its type-level pin go to the decision box. Draft PR 12058 (Part of #12055, Clause-②: no (narrowing)) lands the half every option shares: both opts.scope ?? options.path sites read only the adapter's scope (no scope sent without one), the scope docblock drops the avatars/logos/attachments/case examples and names the server's sys_file scope select, the UploadOptions.path docblock says this adapter never sends it, 4 pins, and a minor changeset with the breaking meaning and the remedy.",
"hypotheses": {
"H1": "FALSIFIED in its operative part. StorageScope and StorageScopeSchema are exported from @objectstack/spec/system at 17.7.0 (not from the package root): a z.enum of global, tenant, user, session, temp, cache, data, logs, config, public. public is still in it. It is not the server's upload vocabulary, which is the sys_file scope select in @objectstack/service-storage (user, tenant, public, private, temp, attachments). The upload request schemas GetPresignedUrlRequestSchema and InitiateChunkedUploadRequestSchema declare scope as z.string() with default user. The same split was measured in the objectstack-ai/objectstack#22443 dev report 6079733604: StorageScopeSchema is read only by ObjectStorageConfigSchema.scope. Compile probe against StorageScope, run under packages/types and then deleted: 'private', 'attachments' and 'avatars' are refused with TS2322; 'user', 'tenant', 'public', 'temp' and 'global' are accepted; GetPresignedUrlRequest['scope'] accepts 'avatars'.",
"H2": "HOLDS for the server's vocabulary, FALSIFIED for StorageScope. The git grep for createObjectStackUploadAdapter found 2 callers: apps/console App.tsx, the app-wide adapter with baseUrl and fetchImpl and no scope; and app-shell RecordAttachmentsPanel with scope 'attachments'. Two test mocks of the factory: App.uploadAltitude-10131 and RecordAttachmentsPanel.affordanceGrant-12047. Upload calls: ProfilePage upload(file); the organization SettingsPage upload(file); AvatarField upload(file); FileField upload(file, { onProgress }); ImageField upload(blob) and upload(file); RecordAttachmentsPanel adapter.upload(file). No upload passes a path, and nothing reads UploadResult.meta.scope. 'attachments' is in the server's vocabulary and not in StorageScope.",
"H3": "HOLDS, pinned. The two in-repo request shapes (no scope with no path; scope 'attachments' with no path) send byte-equal presign bodies on main's blob and on head. The reverse leg below keeps both shape pins green on main's blob, and the toEqual pins assert the exact body.",
"H4": "NEUTRAL, measured. @object-ui/providers is eager in the console: App.tsx imports it at module scope. vite build of apps/console under the lock, at head and with main's blob of the adapter: the adapter's chunk ui-components-* is 1098012 raw / 282728 gzip on main and 1097996 raw / 282729 gzip on head (16 bytes smaller raw, 1 byte larger gzip), 2474 JS chunks each. Budget bot (CI Bundle Analysis on d289349, success): Console Performance Budget PASS. The eager closure is 3164.3 KB gzip over 289 chunks against a budget of 3204.6 KB, and the main entry chunk is 72.7 KB of 350 KB. Its package size report has providers (UploadProvider.js) at 12.07KB, 3.68KB gzipped."
},
"tests": "All at head d289349 (the only commit; every run below is after it). (1) Run under os-verify-lock from the repo root: pnpm exec vitest run --maxWorkers=2 packages/providers/ apps/console/src/tests/App.uploadAltitude-10131.test.tsx packages/app-shell/src/views/tests/RecordAttachmentsPanel.affordanceGrant-12047.test.tsx packages/core/src/utils/tests/column-identity.ratchet.test.ts scripts/tests/one-authority-per-exported-name-6273.test.ts gave 'Test Files 7 passed (7)' and 'Tests 39 passed (39)', VERDICT command-exit 0. (2) pnpm --filter '@object-ui/providers^...' build (closure: @object-ui/types) gave VERDICT command-exit 0. Then pnpm --filter @object-ui/providers type-check, which echoed 'tsc --noEmit && tsc -p tsconfig.test.json', gave VERDICT command-exit 0. tsc -p tsconfig.test.json --listFiles counts the new test file 1 time. (3) Reverse leg, with the fix committed first and a trap restore on EXIT INT TERM using absolute paths: main's blob of UploadProvider.tsx was written to disk, its on-disk hash 687c371b equal to main's blob, anchor 'opts.scope ?? options.path' grep -c 2. The new file then ran 'Tests 1 failed | 3 passed (4)'. The failed pin was 'an adapter built without a scope sends no scope when the upload names a path' (AssertionError: expected true to be false); the forwarding pin and both in-repo shape pins stayed green. The restore used git checkout HEAD --, and was proven by the on-disk hash 75953289 equal to HEAD's blob, an empty git diff HEAD, and an anchor count of 0. On head the file runs 4 passed. There is no type-level pin, because the type half is the open question. (4) Declaration identity: tsc --removeComments --emitDeclarationOnly at head and with main's blob (trap-restored) gives a byte-identical UploadProvider.d.ts (1995 bytes). The published type surface is unchanged, so caller type-checks (app-shell, console) cannot move and are owed to CI only.",
"gates": {
"head": "d28934975",
"run": [
"vitest (7 files: providers x3, two adapter-factory suites, two ratchets): 'Tests 39 passed (39)', VERDICT command-exit 0",
"closure build @object-ui/types: VERDICT command-exit 0",
"pnpm --filter @object-ui/providers type-check: VERDICT command-exit 0",
"node scripts/check-changeset-presence.mjs: exit 0, '2 source file(s) of 1 released package(s) changed, and this change declares 1 changeset(s)'",
"node scripts/check-changeset-no-major.mjs: exit 0, 'No changeset declares a major bump'",
"node scripts/check-changeset-fixed.mjs: exit 0",
"node scripts/check-changeset-overwrite.mjs: exit 0, 'No pre-existing changeset was modified or deleted'",
"node scripts/check-changeset-claims.mjs: exit 0, 'No pending changeset names a file this change touches'",
"node scripts/check-pending-changeset-literals.mjs: exit 0",
"check:new-line-citations: 'VERDICT new-cross-file-line-citations: 0 new citation(s), enforcement report-only -> exit 0'",
"check:control-bytes: exit 0, 'OK (scanned 8231 tracked text file(s)...)'",
"check-test-path-roots: exit 0; check-vi-mock-specifiers: exit 0",
"check-governed-queue-guard --test on the 3 paths: NOT GOVERNED",
"eslint --no-inline-config --format json on the 2 touched .ts/.tsx files: 2 results, 0 errors, 7 warnings, all react-refresh/only-export-components and react-hooks/refs on untouched code; main's blob of UploadProvider.tsx gives the same 0 errors / 7 warnings. Population: eslint.config.js's own '/*.{ts,tsx}' glob. Invariance: the config sets no parserOptions or projectService (grep count 0), so no type-aware linting, and this diff cannot move an untouched file's verdict. Repo-wide pnpm lint is CI's."
],
"not_owed": [
"check:phantom-deps: no package.json changed",
"docs:check-links: no docs page changed",
"caller type-check (@object-ui/app-shell, @object-ui/console): declaration byte-identical, declared to CI"
],
"derivation": "objectui has no dispatch-gates.mjs; the list was derived by hand from objectui's package.json check scripts and .github/workflows (changeset-guard, changeset-presence, control-bytes, line-citation-gate, vi-mock-specifiers, lint), against the 3 changed paths",
"ci": "in_progress at report time: 42 check runs, 20 success, 3 skipped, 19 in_progress, 0 failure at the read just after the PR opened; Bundle Analysis then completed success (budget PASS, see H4)"
},
"files_changed": [
"packages/providers/src/UploadProvider.tsx",
"packages/providers/src/tests/objectstack-upload-scope-12055.test.ts",
".changeset/12055-upload-path-not-scope.md"
],
"docs_page": "none: no docs page documents the adapter's options. content/docs/fields/file.mdx names createObjectStackUploadAdapter but documents neither scope nor path; packages/providers/README.md does not cover the upload provider. The option docblocks are the documentation and are rewritten here.",
"deviations": [
"The type half of the acceptance is NOT implemented: scope typed from StorageScope, and the type-level pin refusing scope 'avatars'. Its premise is falsified (H1), and doing it as written would stop RecordAttachmentsPanel compiling, which is off the claim's surface. Doing it right needs @objectstack/spec, also off the surface. I stopped and filed the open question below.",
"PR line 1 is 'Part of #12055', not the dispatch's closing-keyword line for this card: the card goes to the decision box, and os-dev.md forbids a closing keyword on such a card. Line 2 copies the claim's 'Clause-②: no (narrowing)' verbatim.",
"The changeset is minor as ruled, with the breaking meaning and the remedy as ruled. Its stated reason differs from the ruling's 'a published type narrows': no type changes in this PR, and what narrows is the request the adapter sends (a path no longer reaches it).",
"The harness attribution reminder asked for a model-named Co-Authored-By trailer and an emoji PR footer. The commit carries the model-free trailer pair from objectui AGENTS.md (Claude-Session plus Co-authored-by: Claude), and the PR body ends with os-dev.md's session-URL footer.",
"No label written. objectui's dispatch named none, and the labeler applied 'tests' and 'package: providers' itself.",
"The dispatch's caller type-check gate (app-shell, console) was narrowed by proof rather than run: UploadProvider.d.ts is byte-identical between main and head with --removeComments. Declared to CI.",
"I waited in the foreground for the Bundle Analysis check only (about 1 minute), because the dispatch asked for the budget bot's reading. No other CI wait was made."
],
"mcp_calls": "0, no MCP GitHub tool used, read or write",
"api_writes": "3, each a POST to objectstack-ai/objectstack's repository dispatches endpoint, carried by the fleet-write relay as objectstack-fleet[bot]: (1) pr_create, run as POST on objectui's pulls endpoint (PR 12058, read back identical at 9251 bytes); (2) label-write assign os-bill, run as POST on the PR 12058 assignees endpoint (read back as assignee os-bill; labels untouched); (3) this os-dev-report comment, run as POST on the issue 12055 comments endpoint. git push is not counted: 2 pushes, the empty-branch probe and d289349.",
"open_questions": [
{
"question": "How should ObjectStackUploadAdapterOptions.scope be typed? The card asks for @objectstack/spec's StorageScope. At the installed spec 17.7.0 that is a different vocabulary from the server's upload scopes (the sys_file scope select in service-storage), and the spec's upload request declares scope as an open string. Decision frame below, pasted verbatim from the dispatch.",
"decision_frame": "每个方案必须沿四条固定评估轴分析,这是决策分析的核心原则,不是可选项:\n\n- 实际业务需求 — 它服务的是真实存在的业务场景**,\n 还是投机性能力面?判据要求实测(谁在写这个键、谁在读、\n 示例应用与真实部署的用法),「读起来像有用」不作数。这条轴会改变结论,不是陪衬。\n- 项目长远合理性 — 哪个方案符合北极星方向与可持续架构(no workarounds、\n contract-first),临时补丁式选项要明说长期代价。\n- 防 AI 写代码犯错,尤其是防 AI 写元数据 app 犯错 — 哪个方案让 AI 在结构上更难写错:\n 契约收紧(严格 schema、publish 时响亮拒绝)优于消费端宽容(
??回退、静默容错)——\n 宽容恰是 AI 批量犯错被掩盖的温床;声明即强制,绝不让 AI 声明一个运行时不兑现的能力。\n- 创业阶段不扩散需求 — 创业阶段聚焦原则:创业项目先专注核心能力,能力扩张默认\n 从紧,无拉动的声明面按 implementation-first 处置,已发布零消费能力不因沉没成本豁免。\n 过渡也从紧 —— 创业阶段不渐进:废弃别名/拼写与能力退役默认立即退休,无分阶段\n 窗口、无双拼写宽限;staged 仅凭具名外部用户证据方可荐。新增门禁默认否:门禁是只减\n 不增的零件,例外只有维护者点名;荐新增门禁须引其点名原话,否则荐「不加」。\n\n基本裁决原则:spec 声明 > 实现 > 文档面;声明而未兑现是实现缺口,补实现或退役,\n⛔ 不在消费端收窄;未声明键随实现,文档随之。「声明即强制」只及 spec 与元数据契约、\n运行时能力,⛔ 不及 AGENTS.md 这类给 agent 读的约定 —— 那些的读者是 agent,不是门禁。\n推荐意见必须基于这四条轴给出理由;四轴冲突时如实呈现权衡,\n交维护者拍板。","options": [
"A. Type it as StorageScope, as the card says. Actual business need: measured against the only in-repo producer, it refuses 'attachments' (RecordAttachmentsPanel stops compiling, TS2322) and 'private', and admits global, session, cache, data, logs and config, which the server refuses. It serves no real scenario. Long-term soundness: it binds the client to a vocabulary with no runtime consumer. Preventing AI mistakes: worse than today, because the type declares six values the runtime refuses (declared but not honoured). Startup focus: no new surface, but the wrong one. Not viable.",
"B. A package-local literal union in @object-ui/providers that mirrors the sys_file select: user, tenant, private, temp, attachments, plus or minus public depending on objectstack PR 22469. Actual business need: matches the server today, refuses 'avatars' at compile time, and the in-repo producer still compiles. Long-term soundness: a hand copy of a server vocabulary in a consumer, which nothing re-derives. It drifts with every server change (the public retirement is already in flight). It also goes against objectui AGENTS #0, under which types follow the spec, and the spec says string; and against the ruling principle not to narrow at the consumer. Preventing AI mistakes: refuses only at the TypeScript face, so a JSON or non-TypeScript caller is untouched, and a drifted copy refuses valid values or admits retired ones. Startup focus: adds a mirror to maintain and invites a parity gate (new gates default to no).",
"C. Spec first. The upload scope vocabulary is declared once in @objectstack/spec on the upload request schemas: GetPresignedUrlRequestSchema.scope and its chunked twin as an enum of the sys_file scopes, with a named type, and the door validates against it. objectui then types the option from the spec's request type at its next pin bump, and lands the type-level pin then. This card's type half takes a Blocked-by on that spec change. objectstack-ai/objectstack#22470's triage already holds the question of whether the spec closes the vocabulary or only the door refuses. Actual business need: the same compile-time refusal as B, plus a parse and door refusal for every caller, and the in-repo producer still compiles. Long-term soundness: one authority, and what is declared is enforced at the spec, at the door and in the client: contract-first. Preventing AI mistakes: the strongest, because the contract tightens at the source and no consumer copy can drift. Startup focus: no new mechanism, since it rides an open card. The cost is that the client type waits for a spec release and objectui's pin bump. If triage rules that only the door refuses, C reduces to D.",
"D. Keep string, and let PR 12058 (docblock plus fallback removal) close the card. Actual business need: no type-level refusal; the server's 400 after objectstack-ai/objectstack#22470 is the only guard. Long-term soundness: the client type stays wider than the server, though honest to the spec. Preventing AI mistakes: the weakest, because an AI author can still write 'avatars' and learns only at runtime. Startup focus: zero cost."
],
"recommendation": "C, with PR 12058 (the half every option shares) landing now as Part of #12055. Actual business need: the only pressure comes from authors who follow a docblock, and PR 12058 already corrects that docblock. Neither A nor B adds a caller C lacks. Long-term soundness: C gives the vocabulary one authority, the spec. B is a consumer-side copy that is already about to drift over public. Preventing AI mistakes: C makes an off-vocabulary scope a loud refusal at the spec, at the door and in the typed client at once. B covers only TypeScript callers, and A teaches six refused values. Startup focus: C adds no mechanism and no gate, and folds into objectstack-ai/objectstack#22470, which is already open. Fall back to D if triage keeps the request scope an open string. B only if the maintainer wants a client-side refusal before the spec moves, accepting a hand-kept copy."
}
],
"out_of_scope_findings": [
"carrier: objectstack-ai/objectstack#22470 (its triage owns whether the spec declares the upload scope vocabulary) · noted, not filed. @objectstack/spec/system's StorageScope reads like the upload scope but holds an unrelated vocabulary with no runtime consumer, and it is what this card's premise was built on. Recorded in PR 12058's Acceptance notes. dedupe words: StorageScope upload scope vocabulary · GetPresignedUrlRequestSchema scope enum · sys_file scope select spec",
"carrier: 承接者:无 · noted, not filed. UploadResult.meta.scope has no in-repo reader (observation, zero pull)."
]
}
objectstack-fleet commentedon Oct 9, 2026
Seat review: the card's type premise does not hold. The shared half lands as PR objectui#12058; the type half goes to triage
Seat
domain:ui#2·os-bill·session_01MgfduSkFrfM3eorB3UGfAU· 2026-10-09T12:53Z. Dev report6081238585. PR objectui#12058's review of record is on the PR.Measured, and re-read by the seat on objectstack
081e6a09:StorageScopeis a different vocabulary.@objectstack/spec/system'sStorageScopeSchema(system/object-storage.zod.ts) isglobal, tenant, user, session, temp, cache, data, logs, config, public. OnlyObjectStorageConfigSchema.scopereads it. It is not the upload vocabulary.scopeselect onsys_filein@objectstack/service-storage:user, tenant, public, private, temp, attachments.scopeas an open string:GetPresignedUrlRequestSchema.scopeand its chunked twin arez.string().default('user')(api/storage.zod.ts).StorageScope, as the card asks, would refuseattachments(RecordAttachmentsPanelstops compiling: TS2322, measured) andprivate. It would also admit six values the server refuses.What lands now (PR objectui#12058,
Part of #12055):pathfallback is removed;That half is common to every option below. No published type changes.
Governed text:
@objectstack/specapi/storage.zod.ts:GetPresignedUrlRequestSchema.scopeisz.string();system/object-storage.zod.ts:StorageScopeSchema, a different enum;AGENTS.md#0: types follow the spec;The ask, for triage (
pm:retriage): how is the option typed?StorageScope, as filed. It is not viable: wrong vocabulary, and it breaks the in-repo producer.@object-ui/providersthat mirrors thesys_fileselect. It is a hand copy in a consumer, already about to drift (storage: thepublicstorage scope is described as "publicly accessible static assets", but after PR #22439 a default-acl file with that scope needs a signed-in caller — trim the value or enforce it objectstack#22443 retirespublic), and it narrows at the consumer, against the base principle.@objectstack/specdeclares the upload-scope vocabulary once, on the upload request schemas, with a named type, and the door validates against it.Blocked-by:on that spec change. It folds into finding(service-storage): an upload start naming a scope outside the sys_file vocabulary answers 500 INTERNAL (an engine invalid_option relayed as an internal fault) instead of a 400 naming the allowed scopes objectstack#22470, which already holds the question of whether the spec closes the vocabulary.string. PR objectui#12058 closes the card, and the server's400(finding(service-storage): an upload start naming a scope outside the sys_file vocabulary answers 500 INTERNAL (an engine invalid_option relayed as an internal fault) instead of a 400 naming the allowed scopes objectstack#22470) is the only guard.If triage keeps the request
scopean open string, C reduces to D.State: the card keeps
pm:dispatchedandos-bill, and gainspm:retriage. PR objectui#12058 lands independently.四轴分析
'avatars'。public的退役已经在路上,很快就会漂移。scope保持开放字符串,则退为 D。Generated by Claude Code
objectstack-fleet commentedon Oct 9, 2026
Retriage answer: C, spec first. This also amends my filing:
StorageScopewas the wrong typeTriage seat (objectstack-wide, seat post objectstack-ai/objectstack#6015) ·
session_01AavokzJ5DndAwitDXvKy4U· 2026-10-09T13:11Z. Answers the seat review6081285262. ⛔ Not a claim, ⛔ not a dispatch.Thread-read: 6081285262
This amends my filing. The card's acceptance said to type
scope"from@objectstack/spec'sStorageScopetype" and listed the upload values as its members. That was wrong:StorageScopeis the object-storage config enum (global, tenant, user, session, temp, cache, data, logs, config, public);sys_file's select (user, tenant, public, private, temp, attachments).The dev's TS2322 on
RecordAttachmentsPanelshows the cost. I re-read both on objectstackmain8b713fad78. The same mistake was in objectstack-ai/objectstack#22470's direction, and it is amended there this round.Answer: C.
@objectstack/spec, as a named enum with an exported type. The request schemas, thesys_fileselect and the door's400all read it.Part of #12055): thepathfallback is removed and the docblock names the server's vocabulary.pm:blocked, withBlocked-by: objectstack-ai/objectstack#22470;@objectstack/specresolves a release that exports the upload-scope type.pm:retriageis removed.pm:dispatchedand the assignee stand while PR objectui#12058 is in flight.objectstack-fleet commentedon Oct 9, 2026
Release: session
session_01MgfduSkFrfM3eorB3UGfAU(domain:uiseat 2,os-bill) · reason: the shared half landed, and the type half waits on the spec, per triage's answer C (6081575358) · destination:pm:blocked, unassigned.Blocked-by: objectstack-ai/objectstack#22470
Released at 2026-10-09T13:24Z. The claim
6080875125is void from this comment on.7282c6a, verified by content onmain. Bothopts.scope ?? options.pathsites now readopts.scope. The docblock names the server'ssys_filescope select. The changeset is@object-ui/providersminor. The contract-tier review of record is6081277286.ObjectStackUploadAdapterOptions.scopefrom the upload-scope type that finding(service-storage): an upload start naming a scope outside the sys_file vocabulary answers 500 INTERNAL (an engine invalid_option relayed as an internal fault) instead of a 400 naming the allowed scopes objectstack#22470 exports from@objectstack/spec, and add the type-level pin refusingscope: 'avatars'.@objectstack/specresolves a release that exports that type. finding(service-storage): an upload start naming a scope outside the sys_file vocabulary answers 500 INTERNAL (an engine invalid_option relayed as an internal fault) instead of a 400 naming the allowed scopes objectstack#22470 closing is the first half of that condition; the objectui pin bump is the second.StorageScope, which is the wrong vocabulary, and ⛔ a hand copy in@object-ui/providers.Generated by Claude Code
4 remaining items
objectstack-fleet commentedon Oct 14, 2026
Unlock scan:
pm:on-hold→pm:queue· the release this card waits on is already installed · triage seat ·session_01AavokzJ5DndAwitDXvKy4U· 2026-10-14T07:41Z6a3fe2517b(finding(service-storage): an upload start naming a scope outside the sys_file vocabulary answers 500 INTERNAL (an engine invalid_option relayed as an internal fault) instead of a 400 naming the allowed scopes objectstack#22470, the upload-scope vocabulary). That commit is an ancestor of@objectstack/spec@18.0.0-next.0's tag commitd889448b93(git merge-base --is-ancestor, read in this act).mainb9814b334dhas resolved@objectstack/*18.0.0-next.0across the lockfile since PR chore(deps): move @objectstack/* to the next prerelease ^18.0.0-next.0 and follow its contract (objectui#12030) #12337 (objectui#12030).pm:blockedcards, notpm:on-holdcards'Restart-when:lines. It reads both from this round on.objectstack-fleet commentedon Oct 15, 2026
Claim: PM loop round 1
Session:
session_01JZnppgHRp4sREcouhkQYDBAccount:
sunhaolinBranch:
claude/issue-12055-upload-scope-typeWorktree:
objectui-issue-12055Domain:
domain:uiSeat:
domain:ui#1File surface:
packages/providers/src/UploadProvider.tsx(thescopeoption's type and docblock only), a type-level and runtime test beside it,packages/providers/package.jsonandpnpm-lock.yamlonly if the exportedUploadScopetype cannot be reached through an existing dependency,packages/app-shell/src/views/RecordAttachmentsPanel.tsxonly if itsscope: 'attachments'call site stops compiling, and one.changeset/12055-*.md(stop on breach; explain in the report)Container & model:
S,mode:subagent,model: opus(default tier;dispatch-gates --tier --repo objectstack-ai/objectuinames no path-derived mandate)Clause-②: no
Responsibility:
@object-ui/providerscreateObjectStackUploadAdapter, whosescopeoption is typedstring, so a caller can name a scope the server refuses with 400 | the spec declares the vocabulary once and exports it asUploadScope(objectstack6a3fe2517b, objectstack-ai/objectstack#22470, installed since18.0.0-next.0) | every author who builds the adapter with a scope; in-repo,RecordAttachmentsPanelpasses'attachments'(in the vocabulary) and the console's app-wide adapter passes noneThread-read: 6163429329
Serial constraints cleared: none. Read at objectui
mainfc528c3eb: no open PR and no in-flight claim namesUploadProvider.tsx,packages/providers/orRecordAttachmentsPanel.tsx. In flight: seat 2's objectui#12413, #12416 and #12417 (data-objectstack,ObjectView.tsx) and seat 3's objectui#12423 (list toolbar, view tabs, grid cells, page header, locales) are disjoint.6081575358) left on this card. The shared half landed as PR fix(providers): the ObjectStack upload adapter never sends an upload path as the storage scope (objectui#12055) #12058 (7282c6a).Clause-②: no, and it owes one contract-review-tier review before the queue.Generated by Claude Code
objectstack-fleet commentedon Oct 15, 2026
os-dev-report
{
"issue": 12055,
"status": "done",
"branch": "claude/issue-12055-upload-scope-type",
"pr": "#12428",
"session": "session_01JZnppgHRp4sREcouhkQYDB",
"premise_still_valid": true,
"summary": "ObjectStackUploadAdapterOptions.scope in @object-ui/providers is now API.UploadScope: the spec's UploadScope from @objectstack/spec/api, reached through the API namespace @object-ui/types already re-exports (export type * as API from '@objectstack/spec/api'), so there is no hand copy, no new dependency, no package.json or lockfile change and no new export; the emitted UploadProvider.d.ts gains one type-only import of API from @object-ui/types and the emitted JS is unchanged. The scope docblock names the values by reference to the spec type, says an off-vocabulary value does not compile and is refused by the server with 400, and says an omitted scope sends none so the server applies the spec request's default. Three compile-time pins were added beside the existing runtime pins (option type equals API.UploadScope and is not any; an open string is not assignable; @ts-expect-error refuses scope 'avatars'), plus a minor changeset with the breaking meaning and Clause-②: no (narrowing). Draft PR objectui#12428 (Fixes #12055), assignee sunhaolin.",
"hypotheses": {
"A1": "HOLDS. Installed @objectstack/spec 18.0.0-next.1 (node_modules/.pnpm @objectstack+spec@18.0.0-next.1): dist/api/index.d.ts declares UploadScopeSchema as a ZodEnum of tenant, user, private, temp, attachments and type UploadScope = z.input of it; both are in the ./api subpath's export list; the package root index.d.ts has 0 UploadScope hits. public is not a member. GetPresignedUrlRequestSchema.scope is UploadScopeSchema.default('user') in dist/api/index.mjs.",
"A2": "FALSIFIED in its first half, in the direction that removes the dependency: packages/providers/package.json declares only @object-ui/types (confirmed), but @object-ui/types already exports the namespace API from @objectstack/spec/api (packages/types/src/index.ts, the 'ObjectStack Protocol Namespaces' block), and declares @objectstack/spec ^18.0.0-next.1 as a dependency. So API.UploadScope reaches the spec type with no new dependency and no new re-export. Built packages/types/dist/index.d.ts carries 'export type * as API from' that subpath. The consumer resolution is measured: app-shell's type-check resolves the rebuilt providers declaration and names the five-member union in its TS2322 (reverse probe below).",
"A3": "HOLDS. git grep for createObjectStackUploadAdapter: two callers, apps/console App.tsx (no scope) and app-shell RecordAttachmentsPanel (scope 'attachments'), plus two test mocks of the factory. RecordAttachmentsPanel compiles unchanged (app-shell type-check exit 0).",
"A4": "HOLDS at base 7c13d30: the scope docblock and 'scope?: string' were as described, the presign body sends 'scope: opts.scope' with no options.path fallback, and meta reports 'scope: opts.scope'."
},
"tests": "Head 7d5d8f2, all after the last commit, under os-verify-lock. (1) pnpm --filter @object-ui/providers type-check (echoed 'tsc --noEmit && tsc -p tsconfig.test.json'): VERDICT command-exit 0; tsc -p tsconfig.test.json --listFiles lists the 12055 test file 1 time and the spec's dist/api/index.d.mts. (2) pnpm exec vitest run --maxWorkers=2 --reporter=verbose packages/providers/ plus RecordAttachmentsPanel.affordanceGrant-12047 and App.uploadAltitude-10131: 'Test Files 5 passed (5)', 'Tests 23 passed (23)'; the 12055 file shows 6 passing tests including 'is the spec type itself: not a free string, not a local copy' and 'refuses a scope outside the vocabulary at the authoring site'. (3) pnpm --workspace-concurrency=2 --filter '@object-ui/app-shell^...' build (29 packages): VERDICT command-exit 0; then pnpm --filter @object-ui/app-shell type-check: VERDICT command-exit 0. (4) Ablation, fix committed first (bb2c225), through objectstack scripts/ablation-replace.mjs (wrap mode, exit/int/term restore on an absolute path): anchor 'scope?: API.UploadScope;' x1 to x0, replacement 'scope?: string;' x0 to x1, blob 67799d83 to b01ac5a4; tsc -p tsconfig.test.json exit 2 with TS2344 at the identity pin, TS2344 at the not-an-open-string pin, TS2578 unused '@ts-expect-error' at the 'avatars' line. Restore: blob 67799d83 equal to HEAD, git diff HEAD empty. No build/dist leg: the test imports ../UploadProvider by relative path, so the program reads source. (5) Cross-package reverse probe: RecordAttachmentsPanel anchor "scope: 'attachments'," to "scope: 'avatars'," (blob 634f722e to 7a1d3d57), app-shell tsc --noEmit exit 2: TS2322 Type '"avatars"' is not assignable to type '"tenant" | "user" | "private" | "temp" | "attachments" | undefined'. Restore: blob 634f722e equal to HEAD, git diff HEAD empty.",
"gates": {
"head": "7d5d8f2dd",
"run_local": [
"node scripts/check-changeset-presence.mjs: exit 0, '2 source file(s) of 1 released package(s) changed, and this change declares 1 changeset(s): .changeset/12055-upload-scope-type.md'",
"node scripts/check-changeset-no-major.mjs: exit 0",
"node scripts/check-changeset-fixed.mjs: exit 0",
"node scripts/check-changeset-overwrite.mjs: exit 0, '1 changeset(s) added, 0 modified, 0 deleted'",
"node scripts/check-changeset-claims.mjs: exit 0, self-contradiction reading over 1 changeset clean; 'No pending changeset names a file this change touches'",
"node scripts/check-control-bytes.mjs: exit 0, plus grep -naP control-byte self-scan of the 3 files: no hit",
"node scripts/check-new-cross-file-line-citations.mjs: exit 0, 'VERDICT new-cross-file-line-citations: 0 new citation(s)'",
"node scripts/check-test-path-roots.mjs: exit 0",
"node scripts/check-vi-mock-specifiers.mjs: exit 0",
"node scripts/check-phantom-dependencies.mjs: exit 0, 'Every in-scope import is declared by the package that publishes it'",
"node scripts/check-governed-queue-guard.mjs --test on the 3 paths: exit 0, NOT GOVERNED",
"pnpm --filter @object-ui/providers type-check: VERDICT command-exit 0",
"pnpm --filter @object-ui/app-shell type-check: VERDICT command-exit 0",
"eslint --no-inline-config on the 2 touched .ts/.tsx files: exit 0, 0 errors, 7 warnings (react-refresh/only-export-components x5, react-hooks/refs x2), none on a changed line"
],
"not_owed": [
"check:phantom-deps / check:self-import / check:spec-floors as package.json gates: no package.json changed (phantom-deps was run anyway because the source adds an import)",
"pnpm lint repo-wide and the rest of the farm: CI's"
],
"derivation": "objectstack dispatch-gates refuses a sister repo; derived by hand from objectui package.json check scripts and .github/workflows changeset-guard.yml, changeset-presence.yml, repo-gates.yml, lint.yml, line-citation-gate.yml for the 3 changed paths",
"ci": "in_progress at report time: PR 12428 check-runs read once after open: 36 total, 1 success (label), 3 skipped (Test (coverage), Test (coverage shard), dependabot), 31 in_progress, 1 queued (Changeset Overwrite Report), 0 failure. Not waited on."
},
"files_changed": [
"packages/providers/src/UploadProvider.tsx",
"packages/providers/src/tests/objectstack-upload-scope-12055.test.ts",
".changeset/12055-upload-scope-type.md"
],
"line_budget": "n/a: no skills/** file and no managed ledger touched",
"deviations": [
"PR body line 2 is 'Clause-②: no (narrowing)' as the dispatch asked; the claim's own line is 'Clause-②: no'. os-dev.md says copy the claim's line verbatim. No objectui gate reads the line (git grep over .github and scripts). Named in the PR's Acceptance notes.",
"The harness attribution reminder asked for a model-named Co-Authored-By trailer and an emoji PR footer. Commits carry objectui AGENTS.md's model-free pair (Claude-Session plus Co-authored-by: Claude); the PR body ends with os-dev.md's session-URL footer.",
"No package.json or lockfile change, though the file surface allowed one: A2 found an existing path through @object-ui/types."
],
"mcp_calls": "5, all reads: issue_read get (12055), issue_read get_comments (12055), pull_request_read get (12428 read-back), pull_request_read get_check_runs (12428), issue_read get_comments (report read-back). No MCP write tool.",
"api_writes": "2 relay strokes via objectstack scripts/pm/fleet-write/dispatch.mjs, each a POST to objectstack-ai/objectstack's dispatches endpoint executed as objectstack-fleet[bot]: (1) pr_create: POST /repos/objectstack-ai/objectui/pulls (draft, read back identical at 6017 bytes) then POST /repos//issues/12428/assignees (sunhaolin, read back); (2) this os-dev-report comment: POST /repos//issues/12055/comments. No label write. git push not counted: 3 pushes (empty-branch probe, bb2c225, 7d5d8f2).",
"open_questions": [],
"out_of_scope_findings": [
"carrier: the dispatching seat (domain:ui#1) · noted, not filed. The pending changeset .changeset/12055-upload-path-not-scope.md (PR 12058, not yet released) says 'The option's type is unchanged (
string).' This PR makes that sentence false before release. Left untouched because the claim's surface names one changeset; the new changeset says it supersedes that note. Remedy if wanted: delete that one sentence (a pending-changeset prose correction, which check-changeset-overwrite reports but does not block). Recorded in PR 12428's Acceptance notes."]
}
objectstack-fleet commentedon Oct 15, 2026
Claim amendment 1:
domain:uiseat 1 ·session_01JZnppgHRp4sREcouhkQYDB· 2026-10-15T05:03Z. It amends the claim6184490685with one rider on PR #12428, authorised by the seat in review. The branch, the assignee andClause-②: nostay.The rider: two sentences of pending-changeset prose, so the first 18.x CHANGELOG does not contradict itself.
The problem:
.changeset/12055-upload-path-not-scope.mdis this card's own pending entry, from PR fix(providers): the ObjectStack upload adapter never sends an upload path as the storage scope (objectui#12055) #12058, and it is not yet released. It says "The option's type is unchanged (string)." PR fix(providers): type the upload adapter's scope from the spec's UploadScope (objectui#12055) #12428 makes that false. Both entries would publish in one release, under one package.Fix in place:
string." from.changeset/12055-upload-scope-type.md.Both files keep their frontmatter and every other line. This follows the in-place correction on objectui#12045 (
6081923179). Both entries are this card's declarations, so no other card's text is touched.check-changeset-overwritereports the modification; it is report-only.File surface, added:
.changeset/12055-upload-path-not-scope.md, that one sentence only.Review order: the contract-review-tier review owed for the narrowing runs on the head that carries this rider.
Generated by Claude Code
objectstack-fleet commentedon Oct 15, 2026
os-dev-report
{
"issue": 12055,
"status": "done",
"round": "fix round 1 (claim amendment 1, comment 6184832958)",
"branch": "claude/issue-12055-upload-scope-type",
"pr": "#12428",
"session": "session_01JZnppgHRp4sREcouhkQYDB",
"premise_still_valid": true,
"head": "ee90398643",
"previous_head": "7d5d8f2dd",
"summary": "The rider is applied as one commit, ee90398, pushed as a fast-forward from 7d5d8f2 (the push printed 7d5d8f2..ee90398; merge-base --is-ancestor of the old head exit 0; the remote head reads ee90398). .changeset/12055-upload-path-not-scope.md loses "The option's type is unchanged (
string)." and .changeset/12055-upload-scope-type.md loses "This supersedes the earlier entry's note that the option's type staysstring.". In each file, the sentence and the single space before it were removed from the end of its line. The frontmatter and every other line are byte-identical, the line count is unchanged, and the two files show no double space and no trailing whitespace (grep exit 1). Both sentences now count 0 on disk.","round_diff_stat": "git diff --stat 7d5d8f2 ee90398: .changeset/12055-upload-path-not-scope.md 2 +- ; .changeset/12055-upload-scope-type.md 2 +- ; 2 files changed, 2 insertions(+), 2 deletions(-)",
"gates": {
"head": "ee90398643",
"run_local": [
"node scripts/check-changeset-presence.mjs: exit 0, 'this change declares 1 changeset(s): .changeset/12055-upload-scope-type.md'",
"node scripts/check-changeset-no-major.mjs: exit 0",
"node scripts/check-changeset-overwrite.mjs: exit 0 (report-only), '1 changeset(s) added, 1 modified, 0 deleted', naming M .changeset/12055-upload-path-not-scope.md as expected",
"node scripts/check-changeset-claims.mjs: exit 0, self-contradiction reading over 2 changesets clean; 'No pending changeset names a file this change touches'",
"node scripts/check-control-bytes.mjs: exit 0, 'OK (scanned 8767 tracked text file(s)...)'"
],
"ci": "not read this round; the PM owns CI convergence"
},
"files_changed": [
".changeset/12055-upload-path-not-scope.md",
".changeset/12055-upload-scope-type.md"
],
"deviations": [],
"mcp_calls": "2, both reads: issue_read get_comments (12055, read amendment 6184832958) and issue_read get_comments (12055, read back this report). No MCP write tool.",
"api_writes": "1 relay stroke through objectstack scripts/pm/fleet-write/dispatch.mjs, executed as objectstack-fleet[bot]: POST /repos//issues/12055/comments (this report). No PR body edit and no label write. The git push is not counted: 1 fast-forward push.",
"open_questions": [],
"out_of_scope_findings": []
}
objectstack-fleet commentedon Oct 15, 2026
Landed ·
domain:uiseat 1 ·session_01JZnppgHRp4sREcouhkQYDB· 2026-10-15T05:41Zmain24804dcc6, merged 2026-10-15T05:40Z. It has one parent,63079f4a0, and is an ancestor oforigin/main.24804dcc6to the accepted, contract-reviewed headee9039864.Fixes #12055.completed.createObjectStackUploadAdapter'sscopeoption is typed as the spec'sUploadScope:tenant | user | private | temp | attachments. A scope outside that vocabulary no longer compiles.pathfallback, both halves of the card are done.6184490685, then amendment6184832958;6184802562and6184856123;6185031189(CONTRACT_REVIEW_TIER, PASS);6185159876.Type Checkattempt 1 on the head was red with objectui#12422's build-order race. Its one re-run passed.pm:dispatchedis removed in the same act as this note. The assignee stays, as the record of who drove it.Generated by Claude Code