Repository navigation
qa(checklist): standing regression between releases — a retest-owed reader over QA-source cards, a touched:SHA selector in checklist-select, and checklist-test §5 cadence for a weekly P0 + api run and a post-publish npm smoke (maintainer, 2026-10-29) #27383
Description
domain:devx#1 · sunhaolin · session_017xRBcVy4VXmkQjn2MGeaWk
Filing gate: ③ a maintainer-directed task. The maintainer, in session session_017xRBcVy4VXmkQjn2MGeaWk on 2026-10-29, asked how to improve periodic testing so platform problems are found in time (verbatim: 「你也可以和我沟通如何完善定期测试，及时发现平台的问题」). Asked which items to land first, they selected all four of the proposed options (option labels as shown to them): 「欠测清单脚本 + 周检」, 「增量选择器 touched:sha」, 「每周 P0 + api 例行」, 「发版后 npm 冒烟例行」. Then: 「这些都应该写到 checklist skills 中」.
Business reason: between releases nothing re-runs the checklist. The measured cost of that gap:
- Retest debt goes unseen. SKILL §5 trigger 2 says the seat accepting a QA-extracted fix appends the affected items to the wave anchor's retest list. On the 18.2.0 anchor [sweep] v18.2.0 release test sweep #25807, 20 such fix cards closed after wave 2's subject (console: a non-participant reader is offered inline edit on a record whose pending approval locks it (lockRecord: true), and the save answers 409 RECORD_LOCKED #25934, console: the standalone /forms/:name route renders select option labels untranslated — a zh-CN user on an en-US browser reads Chinese field labels over English options (FormPage normalizeOptions skips the localizer) #26452, records-forms.record-discussion-mentions: authorization-class finding (18.2.0 wave-2 sweep) — detail withheld pending maintainer #26453, app-showcase: record-action success messages name no record ("Task marked done.") — fails the write-feedback naming rule (ruling C on #25849); the runner fills {{ }} holes, so the copy can name the record #26459, app-shell: the full-page record form (/new, /edit route) still toasts "Task updated successfully" — #26172's fix covered AppContent's dialog paths only; RecordFormPage passes the object label alone #26461, metadata-protocol: GET /meta/:type/:name/diff answers 200 for a version that does not exist — "no change" or "everything removed" — while rollback refuses the same version 404 VERSION_NOT_FOUND #26462, spec: a single-word language name ("Chinese", "English", "Japanese") still passes as a translation
locale— the #25822 fix refuses multi-word names only, though its changeset and refusal text say "a language name" is refused #26463, service-settings: sys_setting_audit.old_hash is never written (hard-coded null) and new_hash for a non-secret value is an FNV-32 digest, while both columns declare "SHA-256 of the … value" #26465, automation: switching off a packaged flow or a packaged action writes the activation-ledger row and its audit row with a null actor, so nothing records which admin did it #26474, approvals: approving a request whose flow was deleted while paused answers 500 RESUME_FAILED after recording the decision, and the run is stranded #26477, cli build: the legacy runtime bundle hash changes on every identical rebuild, because the temp entry path (pid + Date.now()) is embedded in the bundle and its inline sourcemap #26478, storage: a file field accepts a presigned upload that was never completed (sys_file status pending) and claims it #26479, package install: OS_PROTOCOL_INCOMPATIBLE for a package declaring a NEWER protocol major prescribes "migrate meta --from 19", which cannot apply #26480, PostgreSQL: the NULL-safe row identity of sys_setting and sys_notification_preference never lands — DROP INDEX is refused by the declared UNIQUE constraint (2BP01) and CREATE UNIQUE INDEX IF NOT EXISTS then no-ops as success (18.2.0) #26630, docs(upgrading): the Per-release specifics table has no v18.2.0 row — 18.2.0 is published and its upgrade checklist (releases/v18/18-2) is not linked from the upgrade guide #26631, console: every record page on a deployment without the approvals service logs two console errors for the designed 501 of GET /approvals/records/OBJECT/ID/lock (18.2.0 scaffold) #26632, security(plugin-audit): a sys_secret confidentiality gap, observed beside the 18.2.0 wave-2 clauses — detail withheld pending maintainer #26640, security explain answers 200 allowed:true for a userId that matches no sys_user row, built from the synthesized baseline principal #26641, create-objectstack accepts a project name that is not a legal npm package name and writes it to package.json, where npm publish later refuses it #26642, data list door: a blank $select answers every column and an unrecognised $count value counts — malformed values are read as the absent default #26644, object door: fieldGroups[].visibleWhen naming an unknown field saves 200, while the same predicate on actions[].visible or fields.*.visibleWhen is refused 422 #26646, Studio/metadata: a draft the editors, the draft_diagnosticsand the Problems tab all call valid is refused only at publish — and one such draft rolls back the whole package release #26707), and its §4 retest list still read "None yet". This session had to derive the list by hand for [sweep] v18.3.0 release test sweep #27377 §4. A discipline step nobody performs needs a reader that computes it instead. - Delta selection is done by hand. "Which items cite a file changed since the last run" was computed ad hoc for wave 2 and again for wave 3. It found 254 of 352 items touched in 514 commits, and QA run · tier1:24681-touched (63/82) · 307ce4c4 · 2026-10-20 · 10 PASS / 53 PARTIAL / 0 FAIL / 0 BLOCKED / 19 NOT-RUN #24840/QA run · t2:24681-touched (28/28) · 307ce4c4 · 2026-10-20 · 12 PASS / 16 PARTIAL / 0 FAIL / 0 BLOCKED / 0 NOT-RUN #24841 used a hand-made
tier1:24681-touchedset.checklist-selecthas no selector for it. - The post-publish npm smoke finds the most. It found 3 FAILs on 18.2.0 (QA run · smoke:npm-18.2.0 (25/25) · 27f38ada · 2026-10-27 · 22 PASS / 0 PARTIAL / 3 FAIL / 0 BLOCKED / 0 NOT-RUN #26629) and 5 on 18.0.0 (QA run · smoke:npm-18.0.0 (27/27) · 06cab484 · 2026-10-20 · 22 PASS / 0 PARTIAL / 5 FAIL / 0 BLOCKED / 0 NOT-RUN #24908) with about 25 cells each: the highest yield per item of any run shape. It only happens when someone remembers to start it.
Reader: the runner and PM sessions that run checklist-test, plus the scheduled tasks the dispatching PM session will create once this lands. Those tasks are a weekly regression and a release watch, created by that session as scheduled tasks; they are not repository code.
Dedupe (open AND closed): "checklist-select selector items touched since sha retest owed QA-source fixed cards scheduled weekly checklist run" returns 162 hits, and none of them is a selector, a reader or a cadence. scripts/qa/qa-rollup.mjs answers "latest verdict per selector and its staleness". It does not answer "which fixes landed after the verdict that found them". Extend it if that is the cleaner home.
Deliverables
- Retest-owed reader. A read-only script,
scripts/qa/retest-owed.mjsor aqa-rollupmode.- It lists every closed issue whose body carries a
QA-source: #RECORD · area.item · clauseline and whose close time is after the subject commit time of the newestqa-runrecord that judgedarea.item. - Output per row: item id, fix card(s), the record that last judged the item, and whether a later record already re-judged it.
- It has a
--jsonmode and an offline--self-testin the repository's existing self-test battery style. - ⛔ It writes nothing to GitHub.
- It lists every closed issue whose body carries a
touched:SHAselector inscripts/checklist-select.mjs.- It selects the runnable items whose
source[]paths, orautomated.reffiles, changed inSHA..HEAD, comparing paths with the anchor suffix (#symbol) stripped. - Directory sources match by prefix.
- It is deterministic and listed in the selector table. Self-test cases go in the existing battery, and its pinned floor rises.
- It selects the runnable items whose
- checklist-test SKILL.md cadence text, in §5 or a new short section.
- Weekly regression: the retest-owed list, plus
touched:the previous weekly record's subject, pluspriority:P0, plussurface:api, onmainHEAD. Oneqa-runrecord per selector. The supersede protocol keeps at most one open weekly record per selector. - Post-publish npm smoke: after each published release, the
smoke:npm-VERSIONrun in the shape of QA run · smoke:npm-18.2.0 (25/25) · 27f38ada · 2026-10-27 · 22 PASS / 0 PARTIAL / 3 FAIL / 0 BLOCKED / 0 NOT-RUN #26629. Its fix cards are re-judged there. - This adds a fourth retest trigger to §5's "three and only three". Write it with the ruling cited above. ⛔ Keep the rule that hand-feel reruns are not a trigger.
- Weekly regression: the retest-owed list, plus
- RUNNER.md only if a definition there needs the new selector named.
Gates to expect
node scripts/checklist-select.mjs --self-testmust pass, with its floor raised.node scripts/check-platform-checklist.mjsstays green.- The pm-skill line ratchet applies if it covers
checklist-test, as qa(checklist-test): writes through the pm-dispatch doors, every defect filed in the run, auth/authz fixes dispatched at once #26567 had to handle. A net increase needs the ruling id, and the seat posts the ruling on [sweep] v18.3.0 release test sweep #27377 before ACCEPT. skip-changeset: no package publishes.
Out of scope
- Creating the scheduled tasks. The dispatching PM session does that after this lands.
- Any change to verdict rules.
- Any CI workflow.
Clause-②: no. Metadata-protocol: none.
Generated by Claude Code
Activity
objectstack-fleet commentedon Oct 29, 2026
triage#1 · os-zhuang · session_01AavokzJ5DndAwitDXvKy4U
Path: 什么算做好 | none | none
Triage: p1 ·
domain:devx·area:devpath· 2026-10-29T04:54Z⛔ Not a claim.
touched:SHAselector inchecklist-select, a weekly P0 + api run, and a post-publish npm smoke.qa-runcards. They are not merge gates (「新增门禁默认否」), and the PR keeps it that way: nothing here adds a required context.tooling,priority:p1,domain:devx,area:devpath,pm:queue.Generated by Claude Code
objectstack-fleet commentedon Oct 29, 2026
domain:devx#1 · os-elon-musk · session_01LKHDniRQSWjRJyDtacwpEd
Claim: PM loop round 1 · 2026-10-29T14:53Z
Session:
session_016WV4d1oYpq8eEjYF141fC3(card thread, dispatched by seat sessionsession_01LKHDniRQSWjRJyDtacwpEd)Account:
os-elon-muskBranch:
claude/project-thread-j3pqng(the harness-pinned branch for the card thread; it names no issue, so this claim is the identity record)Worktree:
objectstack-issue-27383Domain:
domain:devxSeat:
domain:devx#1File surface:
scripts/qa/retest-owed.mjs(or aqa-rollupmode),scripts/checklist-select.mjs(touched:SHAselector + self-test),.claude/skills/checklist-test/SKILL.md§5 cadence text, and their tests (stop on breach; explain in the report)Container & model:
L,mode:thread,model: default,effort: xhighClause-②: no
Metadata-protocol: none
Responsibility: between releases nothing re-runs the checklist, and retest debt after QA-sourced fixes goes unseen (20 such fix cards closed on #25807 with its retest list still empty) | no reader, no selector, no cadence | every release sweep and every regression that lands between them
Thread-read: 6488316134
Premise: maintainer-directed 2026-10-29 (four options chosen, then 「这些都应该写到 checklist skills 中」); the dev re-reads
checklist-selectandqa-rollupon origin/main firstSerial constraints cleared: the dev lists open PRs touching
scripts/checklist-select.mjs,scripts/qa/**and.claude/skills/checklist-test/**before editing; #27382 and #27390 (seat 2's share) also editchecklist-test/SKILL.md, so one card per file: whichever lands second merges main firstSeat pick on the full order with seat 2 (#20163), alternation (knock 6499301324). Contract review: required —
.claude/skills/checklist-test/SKILL.mdis governed (Tier S, CONTRACT_REVIEW_TIER); the build runs at the default tier, a CONTRACT_REVIEW_TIER review of record (in-seat at tier or an at-tier subagent) gives a same-head PASS, and that PASS precedes the seat's hand-off.Generated by Claude Code
objectstack-fleet commentedon Oct 29, 2026
os-dev-report
{ "issue": 27383, "status": "done", "branch": "claude/project-thread-j3pqng", "pr": "https://github.com/objectstack-ai/objectstack/pull/27647", "session": "session_016WV4d1oYpq8eEjYF141fC3", "premise_still_valid": true, "summary": "Three deliverables on head 8bf59c16. scripts/qa/retest-owed.mjs is a read-only reader of QA-source fix cards against the newest qa-run record that judged each item, with --json, --as-of and an offline --self-test. checklist-select gains touched:SHA, which selects items whose source[] or automated.ref files changed in SHA..HEAD, on whole path segments, with the anchor cut. checklist-test SKILL.md gains §6 standing regression and retest trigger 4, and the ratchet ceiling moves 246 to 256 under ruling #27377 comment 6501246005 (+10 measured). RUNNER.md is unchanged. On the #25807 anchor, --as-of 2026-10-29T00:00Z accounts for all 22 named fix cards: 16 owed, 5 Not read (two-field observation lines), and #26707 absent (no QA-source line).", "tests": "checklist-select --self-test: 45 cases pass (floor 31 to 45; brace case ablated red before it was made load-bearing). retest-owed --self-test: 57 assertions in 9 batteries. Live run: 214 API reads, 0 writes, 160 records, 17,967 issues scanned, 32/32 shas resolved; as-of 20 owed rows, now 15.", "gates": "All exit 0, captured before any pipe: check-platform-checklist, check:platform-checklist, pm-skill-ratchet, pm-skill-id-lint, pm-dispatch-gates (fast tier 1937), entry-guard, parse-guard, agent-test-spelling, bash32-floor, ci-filter-parity, cli-command-ids, cross-package-test-inputs, doc-authoring, doc-formula-expressions (after turbo build of formula+lint), pm-governed-merges, pnpm-filter-targets, pnpm-flag-spellings, ratchet-remedy-authority, scripts-symbol-anchors (red on a header example anchor in the first commit, fixed in the second), skill-frame-sync, nul-bytes, declaration-mirrors, self-test-wired, self-test-workflow-commands, whole-set-label-write, plan-test-core-shards --self-test, check-harness-current --self-test, skills-token-ratchet, published-list-mirrors, commit-card-trailers, eslint. CI on #27647 is pending at report time.", "dogfood_battery": "n/a — no ! in the PR title and no (narrowing) arm", "mcp_calls": "reads only (mcp__github__issue_read); the exact count was not kept across a context compaction; no write tool used", "api_writes": "2 — relay dispatches: pr_create (POST /repos/objectstack-ai/objectstack/pulls, POST /issues/27647/labels skip-changeset), comment (POST /issues/27383/comments, this report)", "open_questions": [], "out_of_scope_findings": [ "qa-rollup follows the next link verbatim; its /repositories/ID form answers 403 from a cloud session on page 2 · carrier: Devx seat (taken as its own card) · noted, not filed", "retest-owed --self-test is not run by CI, same as qa-rollup --self-test; wiring it means adding it to the check:platform-checklist alias · carrier: Devx seat · noted, not filed" ] }Generated by Claude Code