docs(qa): wave-3 checklist accuracy slice S6 — api-backend.json, ai.json, automation.json (#27377)

domain:devx#2 · os-justin · session_01QSeKYmTYfaPbLQD4BJfomW

Sub-issue of #27377, the v18.3.0 release test sweep anchor. This is wave-3 checklist-accuracy slice S6, split out on the maintainer's word in seat session session_01QSeKYmTYfaPbLQD4BJfomW: 「同意」, to the seat's proposal to split S4–S8 into sub-issues so that both devx seats can work them. ⛔ Not a claim. Any devx seat may claim it. domain:devx is inherited from the parent.

Scope

Files: docs/qa/platform-checklist/areas/api-backend.json, docs/qa/platform-checklist/areas/ai.json, docs/qa/platform-checklist/areas/automation.json. No other file. ⛔ No product code.

Rows: 26, from the seat's read-only census of every finding parked on #27377 (census note 6539602007), taken at origin/main 501c864dd5. Re-verify each row against the current head before editing. A row that no longer holds is reported as fixed upstream.

census row	record	item	verdict	evidence (census)
1	#27392	`ai.mcp-run-action-exposure-gate`	GAP	A1 permitted half: verify already says score not-run(fixture). Recipe yes: runtime-author an ai.exposed action with requiredPermissions a persona lacks.
4	#27392	`api-backend.aggregate-contract-matrix`	GAP	knownGaps[0] says "seeding a few rows … is the honest close" but names no null annual_revenue or Mon/Sun/ISO-year rows. Recipe yes: 5 POSTs; fold into the slice.
5	#27392	`api-backend.aggregate-contract-matrix`	STALE	steps[5] "each message ends with the 'os migrate meta --from 16' instruction" and acc[3] the same. Live AGG_RETIRED_TAIL (query.zod.ts:92) names `os migrate meta` and the protocol-upgrade URL.
6	#27392	`api-backend.aggregate-contract-matrix`	STALE	steps4 "a query whose where matches nothing, grouped and ungrouped".
7	#27392	`api-backend.api-methods-verb-gate`	STALE	steps[4] "the import door with writeMode insert" gives no body shape.
8	#27392	`api-backend.api-methods-verb-gate`	STALE	steps[5] has no note that registry.ts warns once per object name. Use a distinct name per leg.
9	#27392	`api-backend.error-envelope-ledger`	STALE	fixtures.requires[1] "POST /api/v1/auth/sign-up/email also works on a stock dev boot".
10	#27392	`ai.agent-tool-skill-metadata-roundtrip`	STALE	acc[0].verify "agent.tools error prescribes `skills` + ADR-0064 + 'os migrate meta --from 16'" and "triggerPhrases … routes to triggerConditions".
13	#27392	`automation.packaged-flow-subflow-disable-refusal`	STALE	steps[8] "NO sys_metadata_activation row for showcase_notify_owner".
14	#27392	`automation.trigger-status-contract`	STALE	knownGaps[1] "has no stock trigger … scores that row not-run". r9 and r10 (10-30) left it unchanged.
15	#27392	`automation.trigger-status-contract`	STALE	steps[7] drives the purge endpoint and has no throwaway-DB warning.
27	#27409	`ai.mcp-oauth-private-host-transport`	GAP	A0 / A2 private leg. Recipe yes, but only if the matching accuracy row (unheld private OS_AUTH_URL) is accepted.
37	#27409	`automation.paused-run-trigger-record-masked`	GAP	Recipe yes, already in requires[1]: an object with an internal:true field. The runner skipped it. No ledger edit.
44	#27409	`ai.mcp-http-surface`	STALE	acc[4] "the documented principal-bound surface" (12 tools) names no transport; stdio lists 9.
46	#27409	`ai.mcp-validate-expression`	STALE	negative[0] has no blank-input boundary. Product half #27411 was closed by #27534, so add the clause.
47	#27409	`ai.mcp-oauth-private-host-transport`	STALE	requires[0] "A host that holds no RFC 1918 … address cannot stage boot (a): record blocked(fixture)". Light ruling; keep a held address for the e2e client leg.
48	#27409	`ai.mcp-coded-refusals-and-runtime-exposure`	STALE	acc[3]: fixtures name no producer recipe.
49	#27409	`api-backend.query-contract-matrix`	STALE	steps[1] shows only the single-condition AST form [field, op, value]; no prefix-compound note.
50	#27409	`api-backend.query-contract-matrix`	STALE	steps[2] has no case-sensitivity note ($icontains is only variants[16]).
58	#27409	`automation.trigger-type-matrix`	STALE	requires[1] names only OS_AUTOMATION_SCHEDULED_WORK_ENABLED. No daily-08:00 or fast-clone note.
59	#27409	`automation.durable-suspend-restart`	STALE	acc[1] "post-restart reads return the identical paused rows". The PT1M timer can complete first.
60	#27409	`automation.flow-authoring-refusals-v18`	STALE	acc[2] endpoint arm has no tenant-name or 403 NOT_OVERRIDABLE note.
70	#27441	`api-backend.formula-stdlib-matrix`	STALE	title, steps[0], acc[0], source[0]/[1] "exactly 29". The count is 30 (label()).
109	#27441	`automation.flow-node-type-matrix`	STALE	requires[0] map has no assignment carrier; steps[5] does not say the seed already leaves a paused run.
110	#27441	`automation.packaged-flow-clone-contract`	STALE	acc[0] "(code 'required')" for an empty name. It answers invalid_type.
124	#27441	`api-backend.formula-stdlib-matrix`	STALE	requires[1] names sharingModel only; the writable package and namespace prefix are missing.

GAP rows are listed only where the census found a cheap fixture recipe. The other gaps stay parked on #27377.

Edit shape (wave 2's slices A–D; #27164 is the precedent)

revision goes up by 1.
main's history stays an exact prefix, with ONE appended row citing the run record (QA run · release-18.3.0-w3-manual-api (25/25) · c4c515ad · 2026-10-29 · 23 PASS / 2 PARTIAL / 0 FAIL / 0 BLOCKED / 0 NOT-RUN #27392, QA run · release-18.3.0-w3-tier1-a (73/73) · c4c515ad · 2026-10-29 · 59 PASS / 14 PARTIAL / 0 FAIL / 0 BLOCKED / 0 NOT-RUN #27409, QA run · release-18.3.0-w3-tier1-b (89/89) · c4c515ad · 2026-10-29 · 79 PASS / 6 PARTIAL / 4 FAIL / 0 BLOCKED / 0 NOT-RUN #27438, QA run · release-18.3.0-w3-manual-browser (54/55) · c4c515ad · 2026-10-29 · 44 PASS / 2 PARTIAL / 8 FAIL / 0 BLOCKED / 1 NOT-RUN #27441 or QA run · priority:P0 (23/23) · c4c515ad · 2026-10-29 · 20 PASS / 3 PARTIAL / 0 FAIL / 0 BLOCKED / 0 NOT-RUN #27481) and [sweep] v18.3.0 release test sweep #27377.
The text is fixed to what the code says today.
An edit may make a clause stronger or more precise. It never weakens a clause to make it pass.
A finding that, on reading, is a product defect is NOT edited. It is reported for the seat to file.
Keep pnpm check:platform-checklist green.
Changeset: none (label skip-changeset).
The PR says Fixes #<this card> and Part of #27377.

Not in this slice (held on #27377 until ruled)

studio-authoring.expression-editors;
the SCOPE-negatives sweep, which includes platform-core.notification-center negative[3];
ai.mcp-stdio-fail-closed;
the UNCLEAR rows: settings-organization-isolation-and-platform-rung and ux-conventions.write-feedback acc[1].verify, among others.

Generated by Claude Code

domain:devx#1 · os-zhuang · session_01QUs3BvP5Aq9USg5GtmgAAR

Claim: PM loop round 1
Session: session_01QUs3BvP5Aq9USg5GtmgAAR
Account: os-zhuang
Branch: claude/project-thread-wn41ai (the card thread's platform-assigned push branch, the measured platform exception to the protocol branch shape)
Worktree: objectstack-issue-28340
Domain: domain:devx
Seat: domain:devx#1
File surface: docs/qa/platform-checklist/areas/api-backend.json, docs/qa/platform-checklist/areas/ai.json, docs/qa/platform-checklist/areas/automation.json (stop on breach; explain in the report)
Container & model: M, mode:thread, model: default (dispatch-gates --tier: no path-derived mandate; judgment call: 26 census rows needing code reads), effort: xhigh (p1)
Clause-②: no
Metadata-protocol: none
Responsibility: n/a — not a defect card
Thread-read: none
Premise: holds (card filed from census 6539602007 at 501c864dd5; git log 501c864dd5..origin/main on the file surface is empty at 64c56685; the dev re-verifies each row at head, as the card says)
Serial constraints cleared: sibling slices #28338 (S4, this seat, platform-core.json), #28339, #28340, #28341, #28342 have disjoint file surfaces; held items are on #28345, none in this slice's rows; none

Taken at 2026-10-31T06:02Z by the full order in alternation with seat 2 (S4, S6, S8 are seat 1's odd positions; S5 and S7 stay with seat 2). Concurrency raised to 5 by the maintainer: 「并发5」.

domain:devx#1 · os-zhuang · session_01QUs3BvP5Aq9USg5GtmgAAR
os-dev-report

{
  "issue": 28340,
  "status": "done",
  "branch": "claude/project-thread-wn41ai",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/28362",
  "head": "8de73450a82ff0ca535c7c0aa4c4440674bda836",
  "session": "session_01QUs3BvdUqqhcRdQJHjUSXA",
  "premise_still_valid": true,
  "gates": {
    "derived": 16, "run": 16, "not_measured": 0,
    "all_exit_0": true,
    "note": "lint check:doc-formula-expressions first exited 3 (prerequisite unbuilt); exit 0 after building formula + lint under the verify lock",
    "platform_checklist": "OK, 352 items, 10/10 recipes referenced, symbol anchors 1066/1076"
  },
  "line_budget": { "changed": 244, "added": 159, "removed": 85, "budget": 3000 },
  "items_edited": 18,
  "census_rows_corrected": 25,
  "deviations": [
    "Rows 27/47 (ai.mcp-oauth-private-host-transport): the census's light ruling was applied from source (isOAuthEligibleBaseUrl judges the host literal only); flagged for the seat, hunk revertible on its own.",
    "Two GAP recipes are derived from source and not yet run live: qa_ai_gated (row 1) and the fast time_relative clone (row 58). Both history rows say so.",
    "Row 37 (automation.paused-run-trigger-record-masked) not edited: requires[1] already asks for an internal:true field; the run used an object without one (runner deviation)."
  ],
  "out_of_scope_noticed": [
    "ai.agent-tool-skill-metadata-roundtrip variants still label agent.tools, agent.knowledge and skill.triggerPhrases as retiredKey and have no agent.lifecycle variant; changing variants changes the run matrix, left for a seat call."
  ],
  "product_defects": [],
  "files_changed": [
    "docs/qa/platform-checklist/areas/api-backend.json",
    "docs/qa/platform-checklist/areas/ai.json",
    "docs/qa/platform-checklist/areas/automation.json"
  ],
  "api_writes": 2,
  "api_writes_detail": "relay pr_create (draft, plus skip-changeset label) and this comment via post-stamped",
  "mcp_calls": 3,
  "mcp_calls_detail": "all reads: ToolSearch, issue_read get, issue_read get_comments"
}

domain:devx#1 · os-zhuang · session_01QUs3BvP5Aq9USg5GtmgAAR

Landed · 2026-10-31T07:14Z — PR #28362 merged through the queue as 02d6507275.

probe	reading
PR state	`merged: true`, merge commit `02d6507275`
content on `origin/main`	`ai.json`, `api-backend.json`, `automation.json`: blob sha1 on main identical to the PR head

State change: card closed completed by Fixes; pm:dispatched removed in this stroke.

Navigation Menu

Repository navigation

docs(qa): wave-3 checklist accuracy slice S6 — api-backend.json, ai.json, automation.json (#27377) #28340

Scope

Edit shape (wave 2's slices A–D; #27164 is the precedent)

Not in this slice (held on #27377 until ruled)

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

docs(qa): wave-3 checklist accuracy slice S6 — api-backend.json, ai.json, automation.json (#27377) #28340

Description

Scope

Edit shape (wave 2's slices A–D; #27164 is the precedent)

Not in this slice (held on #27377 until ruled)

Activity

objectstack-fleet commented on Oct 31, 2026

objectstack-fleet commented on Oct 31, 2026

objectstack-fleet commented on Oct 31, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions