os package publish sends the manifest's listing tags (cloud now stores them), and drops or maps the top-level tagline

Filing gate ①: the objectstack half that #27348 asks for ("Then the objectstack half (a new card in that repository, filed by whoever answers 1 and 2)"). Questions 1 and 2 were answered on #27348 (comment 6485953428). The cloud half landed as objectstack-ai/cloud#3361 (merged 2026-10-29 02:41Z as a32781f, Fixes cloud#3360). Filed by repo:cloud seat 2. ⛔ Not a claim.

Part of #27348 · follows #27325

维护者速读

cloud 的发布接口现在会校验并保存作者声明的 tags，市场可以按标签搜索了。但 os package publish 还没把清单里的 tags 发出去。这张卡让 CLI 发送 tags，同时把 #27325 临时警告的措辞改对：

publisher 和 isStarter 由平台决定，作者写了也不生效。警告应该这么说，而不是说「暂未携带」。
顶层 tagline 云端不存。CLI 在没有 description 时把它当 description 发，有 description 时不再发送。

Facts

Cloud, main a32781f. POST /api/v1/cloud/packages reads body.tags on create and on re-publish.
- The shape check is CreatePackageRequestSchema.shape.tags.
- Each tag is trimmed, empty tags are dropped, and repeats are removed. The bounds are at most 20 tags of at most 64 characters each.
- A malformed value gets a 400 INVALID_FIELD or VALUE_TOO_LONG, with details.field: 'tags', and nothing is written.
- When the body has no tags, the column is left alone. [] clears it.
Cloud: publisher. The control plane decides it alone (package-publish.ts, around :843-844). It never reads the body.
Cloud: isStarter. It is honoured only for a first-party service-mode seed. An author's value is ignored.
Cloud: top-level tagline. It is not read and has no column. The seat ruled on cloud#3360 that it gets none, because description is the short listing text (512 characters).
CLI, objectstack main 28872e6. packages/cli/src/commands/package/publish.ts sends pkgBody.tagline from m.tagline (around :547) and sends no tags.

Work

Send the manifest's tags as pkgBody.tags, an array of strings, when the manifest declares them. Pre-check the cloud bounds locally only if the check uses the same numbers; otherwise let the 400 speak. Print the server's refusal message as is.
In cli: os package publish silently drops the tags, publisher and isStarter keys objectstack.manifest.json declares (inherited from CreatePackageRequestSchema), so an author's listing tags never reach the catalog #27325's warning, drop tags from the "not carried" list. Reword publisher and isStarter as "decided by the platform; an author's value has no effect". preview is unchanged.
Top-level tagline: when no --description flag and no manifest description are given, send it as description. Otherwise stop sending it. The per-locale translations.*.tagline path is unchanged.
Tests: tags are sent; the reworded warning; the tagline-to-description mapping in both cases. Include an ablation.

Done when

os package publish of a manifest that declares tags leaves them in the hosted sys_package.tags, and the warning no longer names tags.

Reader

Triage routes this card. It is objectstack-only (CLI), so no cloud work remains.

triage#1 · os-zhuang · session_01AavokzJ5DndAwitDXvKy4U

Path: 发布并装进一个环境 | none | P④

Triage: p2 kept · `domain:server` · `area:devpath` · serial after #27325 · 2026-10-29T03:58Z

⛔ Not a claim.

Read fresh. The cloud half of cloud: confirm what the hosted package-publish endpoint accepts for tags, publisher, isStarter and a top-level tagline (spelling, shape, publisher gating), so os package publish can carry an author's declared listing keys #27348 has landed (cloud#3361): the publish endpoint now validates and stores tags. publisher and isStarter are platform-decided, and tagline is not stored. This card is the objectstack half: send tags, correct cli: os package publish silently drops the tags, publisher and isStarter keys objectstack.manifest.json declares (inherited from CreatePackageRequestSchema), so an author's listing tags never reach the catalog #27325's warning wording, and map or drop tagline.
Cloud rule check: the hosted side is done and answered, and the fix and its acceptance are in this repository, so it stays here.
Order: the same file (packages/cli/src/commands/package/publish.ts) as cli: os package publish silently drops the tags, publisher and isStarter keys objectstack.manifest.json declares (inherited from CreatePackageRequestSchema), so an author's listing tags never reach the catalog #27325, which is dispatched to domain:server seat 3. Either that seat folds this card into the cli: os package publish silently drops the tags, publisher and isStarter keys objectstack.manifest.json declares (inherited from CreatePackageRequestSchema), so an author's listing tags never reach the catalog #27325 PR before it lands, or this card lands straight after, on the same seat. ⛔ Two seats never edit publish.ts in parallel.
⛔ The CLI never sends publisher. Bounds are pre-checked only with the server's own numbers; otherwise the 400 speaks, verbatim.
domain:server, area:devpath, pm:queue.

Generated by Claude Code

domain:server#1 · os-sales · session_01L6bhgXcN9HaZYSEUdJWEjw

Claim: PM loop round 3 · in-seat subagent · p2 · 2026-10-29T12:02Z
Session: session_01L6bhgXcN9HaZYSEUdJWEjw
Account: os-sales (the seat's linked user; the card's assignee)
Branch: claude/issue-27364-publish-sends-tags
Worktree: objectstack-issue-27364
Domain: domain:server
Seat: domain:server#1
Ruling-ref: triage 6487515493: send tags, correct #27325's warning wording, map or drop tagline; ⛔ the CLI never sends publisher; bounds are pre-checked only with the server's own numbers, otherwise the 400 speaks verbatim.
File surface: packages/cli/src/commands/package/publish.ts, packages/cli/test/package-publish-uncarried-manifest-keys.test.ts (and a sibling test if needed), one changeset (stop on breach; explain in the report)
Container & model: S, mode:subagent (general-purpose subagent loading .claude/agents/os-dev.md as its role file), model: TIER_DEFAULT (dispatch-gates --tier: no path-derived mandate), effort: medium
Clause-②: no
Metadata-protocol: none
Responsibility: os package publish drops a manifest's tags although the hosted catalog now stores them (cloud#3361), and its warning still says the catalog does not carry them | a publisher's listing tags never reach the catalog | any change to the publish request body
Thread-read: 6487515493
Premise: holds (read at origin/main aef631b80b: publish.ts:282 lists tags in UNCARRIED_MANIFEST_KEYS, :299-323 warns the hosted catalog does not carry it, :606 still sends tagline; CreatePackageRequestSchema.tags exists at package.zod.ts:310). The serial order after #27325 is met: #27325 landed as 6e0e7d7a47 (#27368).
Serial constraints cleared: no open PR touches publish.ts or its tests (all 24 open PRs' file lists read).

domain:server#1 · os-sales · session_01L6bhgXcN9HaZYSEUdJWEjw
os-dev-report

{
  "issue": 27364,
  "status": "done",
  "branch": "claude/issue-27364-publish-sends-tags",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/27573",
  "head": "083edf170d601e01753719b541226f37a53aa266",
  "session": "session_01L6bhgXcN9HaZYSEUdJWEjw (in-seat subagent of domain:server#1)",
  "premise_still_valid": true,
  "summary": "os package publish now sends the manifest's tags as written (pkgBody.tags when declared; [] sent, absent key omitted), with no client-side bound: the hosted 400 is printed through the existing failure path. tags left UNCARRIED_MANIFEST_KEYS; publisher and isStarter get their own warning (decided by the platform, an author's value has no effect, never sent); preview keeps the not-carried-yet warning with CATALOG_SEND_ISSUE; visibility unchanged. Top-level tagline is sent as description only when neither --description nor manifest description is given, otherwise not sent and a warning names it; translations.LOCALE.tagline unchanged. Premise re-read at d4ff1a025f (branch base): same shape as the claim's aef631b80b reading. Importers of UNCARRIED_MANIFEST_KEYS / CATALOG_SEND_ISSUE: only the uncarried-keys test. No packages/spec edit. File surface held: publish.ts, the uncarried-keys test, one changeset.",
  "tests": "Red first at f2c48fc011 (test only, source unchanged): package-publish-uncarried-manifest-keys.test.ts Tests 9 failed | 5 passed (14), VERDICT command-exit 1. Green at 083edf170d: the 5 publish suites Test Files 5 passed, Tests 59 passed; pnpm --filter @objectstack/cli exec vitest run --project unit: Test Files 349 passed (349), Tests 5063 passed (5063), VERDICT command-exit 0; pnpm --filter @objectstack/cli typecheck VERDICT command-exit 0 (test layer 28 errors / 6 signatures held, unchanged). Integration layer declared to CI (no spawn entry touched). Ablation at fadb51292f via scripts/ablation-replace.mjs: anchor 'if (m.tags !== undefined) pkgBody.tags = m.tags;' x1->x0, replacement x0->x1, blob 4bc0cb2f227b->d0cced9bda65; Tests 3 failed | 11 passed (the three tags-sent cases); restored blob == HEAD 4bc0cb2f227b, git diff HEAD empty. No build in the path: the test imports src/commands/package/publish.js. Tagline and wording behaviours evidenced by the red leg only (one ablation run, for tags).",
  "gates": "Local at 083edf170d: dispatch-gates --commands derived 62; each run with exit captured before any pipe; 61 exit 0 (check:slot-lookup, check:query-options-erasure and check-comment-mask-corpus first hit my 300 s wrapper timeout, rerun to exit 0; check:i18n-coverage first exited 3 mid-build, rerun exit 0); check:dual-build-cjs-loads exit 3 PREREQUISITE NOT MET (reads every package dist; 10 packages outside the CLI closure unbuilt) = NOT-MEASURED locally. --ran reconciliation: '62 derived famil(ies) accounted for — 61 run, 1 NOT-MEASURED', exit 0. eslint --no-inline-config packages/cli exit 0. CI check-runs on 083edf170d, all completed: Lint & Repo Gates success, TypeScript Type Check success, Test Core success (8/8 shards success), Build Core success, Governed Surface Queue Guard success, Test UI success, Lint UI / Type Check UI / Build & E2E UI / Live E2E UI skipped (no ui/ paths), Check Changeset success, Dogfood Regression Gate success, PR-body guards success, Type Check (workspace, debt ledger, source gates, consumer gates) success.",
  "dogfood_battery": "n/a — no `!` in the PR title and no (narrowing) arm",
  "mcp_calls": "0",
  "api_writes": "2 — (1) fleet-write relay pr_create: POST /repos/objectstack-ai/objectstack/dispatches -> run 40882452331, executed as POST /repos/objectstack-ai/objectstack/pulls (draft #27573, no assignees, no reviewers, no labels; read-back 6104 bytes sent = stored); (2) this os-dev-report comment via scripts/pm/post-stamped.mjs on #27364. git push (empty branch probe, red commit, fix commit, merge) is not a REST write.",
  "open_questions": [
    {
      "question": "Two published docs pages become false or incomplete with this PR and sit outside the claimed file surface: content/docs/deployment/marketplace-handbook.mdx (warn callout near line 86 says the schema accepts `tags` 'but `os package publish` does not send them'; key table omits `tags`) and content/docs/deployment/cli.mdx (near line 2955 lists `tagline` among keys read, omits `tags`). Extend the surface, or file a follow-up?",
      "options": [
        "A — extend this card's file surface to those two lines and let me (or the seat) add one docs commit to #27573 before it lands",
        "B — land #27573 as is and file a docs follow-up card"
      ],
      "recommendation": "A, because the os-dev rule makes a published text this change falsifies a must-fix in the same change, and it is a two-paragraph edit; the PR body's Skills-docs line names both files as owed either way."
    }
  ],
  "out_of_scope_findings": [
    "carrier: none · noted, not filed — the two stale docs paragraphs above (content/docs/deployment/marketplace-handbook.mdx, content/docs/deployment/cli.mdx), recorded as an open question and in the PR's Acceptance notes and Skills-docs line"
  ]
}

domain:server#1 · os-sales · session_01L6bhgXcN9HaZYSEUdJWEjw

Claim amendment: file surface · 2026-10-29T13:49Z
File surface (added): content/docs/deployment/marketplace-handbook.mdx (the warn callout near L86 that says os package publish does not send tags, and the key table) and content/docs/deployment/cli.mdx (the keys-read list near L2955: tags sent, top-level tagline only as a missing description). Answers os-dev-report 6498414007 open question 1 with option A: a published text this change makes false is fixed in the same change, as one docs commit on PR #27573. The Skills-docs: line becomes updated here — <both pages>. The extra tagline-dropped warning is accepted (an authored key is never dropped silently). The rest of the claim stands.

domain:server#1 · os-sales · session_01L6bhgXcN9HaZYSEUdJWEjw

Landed — #27573 · 2026-10-29T15:03Z

Probe	Reading
PR #27573	merged 2026-10-29T15:03Z · merge commit `882d4e4a5cb9ef35ecacce0a35613776bd1289d9` · head `94a3512f57dc0aef7b63579268f662f46c61d885`
#27364	closed (completed) by the PR's `Fixes` line

State change: pm:dispatched removed, assignee os-sales cleared. Nothing remains on this card.

Navigation Menu

Repository navigation

os package publish sends the manifest's listing tags (cloud now stores them), and drops or maps the top-level tagline #27364

维护者速读

Facts

Work

Done when

Reader

Triage: p2 kept · `domain:server` · `area:devpath` · serial after #27325 · 2026-10-29T03:58Z

Landed — #27573 · 2026-10-29T15:03Z

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

os package publish sends the manifest's listing tags (cloud now stores them), and drops or maps the top-level tagline #27364

Description

维护者速读

Facts

Work

Done when

Reader

Activity

objectstack-fleet commented on Oct 29, 2026

Triage: p2 kept · domain:server · area:devpath · serial after #27325 · 2026-10-29T03:58Z

objectstack-fleet commented on Oct 29, 2026

objectstack-fleet commented on Oct 29, 2026

objectstack-fleet commented on Oct 29, 2026

objectstack-fleet commented on Oct 29, 2026

Landed — #27573 · 2026-10-29T15:03Z

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

Triage: p2 kept · `domain:server` · `area:devpath` · serial after #27325 · 2026-10-29T03:58Z