[objectstack-fleet]

Fixes #27685

Clause-②: no
Metadata-protocol: none

维护者速读

• 改了什么:三处文档对齐 feat(spec, cli)!: bundled is the one plugin packaging strategy — manifest-deps is retired, and os plugin build refuses a native addon (#27123, slice 3 of 3, server half) #27679 之后的代码:插件分发设计文档只剩 bundled 一种打包策略;cli 检查清单条目的两条过期否定句改指向真正做校验与分发的代码;liveness README 的 manifest 单元格改正 dead 集合(19 → 与生成分片一致的 13)并补上 packaging 为何是 planned 的一句。
• 为什么改:manifest-deps 已被移除并按名拒收,文档却仍把它写成可选策略;检查清单仍说「解包时无人复核 integrity」「无人按 runtime 分发」,而 ADR-0025 M1 — local T0 install loop for first-party, self-signed plugins: os plugin install (signature + integrity, materialize, record), boot-time loader with the tier dispatch point, disable/uninstall, Stripe sample as acceptance #27123 的前两片已经实现了这两件事;README 的手写计数早已过期。
• 风险与回滚:纯文档,无代码、无 schema 改动;packages/spec/liveness/README.md 随 npm 包发布,故带一个 @objectstack/spec patch changeset。回滚即 revert 本 PR。
• 先看:docs/qa/platform-checklist/areas/cli.json(两条否定句与 revision 5 历史条目)、packages/spec/liveness/README.md(manifest 行的 dead 集合句)、docs/design/plugin-distribution.md §4.3。
• 两分钟验证:grep -rn "manifest-deps" docs/design/plugin-distribution.md docs/qa/platform-checklist/areas/cli.json packages/spec/liveness/README.md,预期只剩「已退役、按名拒收」的叙述,不再有把它当现行策略的句子。
• 需要你做的:无,席位落地。

What changes

• docs/design/plugin-distribution.md. The artifact tree no longer lists package.json / pnpm-lock.yaml; the compiled-manifest sentence gives packaging as bundled alone; §4.3 is rewritten as "Packaging strategy: bundled only" with one dated note (in the file's existing note shape, as in §4.2) saying manifest-deps was retired and is refused by name (feat(spec, cli)!: bundled is the one plugin packaging strategy — manifest-deps is retired, and os plugin build refuses a native addon (#27123, slice 3 of 3, server half) #27679, ADR-0025 v2 §3.3); the publish-time tier gate no longer names manifest-deps; §6 step 5 says no dependency install runs at materialize. One same-class line beyond the claim's list: §8's supply-chain bullet named a lockfile and --ignore-scripts, both of which existed only for the retired strategy, so it now says no install-time package manager runs at all. Same file, same defect class, mechanical.
• docs/qa/platform-checklist/areas/cli.json, cli.plugin-manifest-build-contract only (revision 4 to 5, history entry added). The integrity and trust-tier ⛔ negatives said nothing re-verifies the map at unpack and nothing dispatches on runtime. Both are false since slices 1 and 2 of ADR-0025 M1 — local T0 install loop for first-party, self-signed plugins: os plugin install (signature + integrity, materialize, record), boot-time loader with the tier dispatch point, disable/uninstall, Stripe sample as acceptance #27123. Each negative now names the code that does it as the check this item does NOT score: packages/cli/src/commands/plugin/install.ts#PluginInstall through packages/core/src/security/plugin-artifact-integrity.ts#verifyIntegrity, and packages/runtime/src/installed-plugin-loader.ts#dispatchPluginRuntime. The tracker numbers they cited (manifest.integrity declares per-file artifact digests the spec says the runtime re-verifies at unpack — nothing computes them and nothing checks them #11331, [text correction · ruled B] manifest.runtime tombstone/describe reads truthfully: publish-gate enforced (cloud), load-side NOT enforced #11330) answer 404 in this repository and are gone from the negatives. Three source rows are added for that code. Scored clauses and steps are unchanged.
• packages/spec/liveness/README.md, the manifest cell only. "Dead 19" was a hand-typed count, and it was stale. It counted the seven per-child rows of capabilities / configuration instead of their two tombstone rows, and a loading row that left the ledger with feat(spec)!: retirement kits whose conversion retired at or below 16.x age out; the strict unknown-key refusal names the protocol upgrade guide #26599. The cell now partitions the dead set the ledger holds (ten contributes members, plus the three retired containers at one row each) and says it sums to 13, the count in the generated state-counts/manifest.md shard. It also gains the missing sentence for packaging, the type's only planned row.
• .changeset/27685-manifest-liveness-cell.md: @objectstack/spec patch. liveness is in the package's files, so the README ships.

Tests

No code changed, so no unit tests were added and none were run. Nothing was ablated, because no tested behaviour moved.

Acceptance notes

• Item 4 of the card (ui/packages/app-shell/src/console/marketplace/marketplaceApi.ts:171) is untouched, per triage 6504381957. It rides the next domain:ui PR there.
• Not edited, recorded here, no card (stale prose, no reach): docs/adr/0025-plugin-package-distribution.md still names manifest-deps as live at L159 (the manifest example comment), L267 (§3.5 step 5) and L595–596 (the consequences bullet), while its own §3.3 retires it. The ADR is a governed surface and outside this card.
• Not edited, outside this card's passages: plugin-distribution.md says the bundle is built with tsup (§4.1 tree, §5 step 1). The build uses esbuild (packages/cli/src/commands/plugin/build.ts; ADR-0025 v2 §3.3 says the same). §4.3 as rewritten names no bundler.
• Coverage observation, no card: no platform-checklist item scores the install-time integrity refusal or the boot-time tier dispatch. The two re-pointed negatives now name that code as unscored here.

Verification

H3: the count is generated, not hand-kept. pnpm --filter @objectstack/spec gen:liveness-counts exited 0 and rewrote 0 shards, and the committed state-counts/manifest.md already reads dead 13 / planned 1. Only the README prose was stale, so it was corrected from liveness/manifest.json, and no number was typed into the shard.

Gates, derived by node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack at 8dee70e6bb (59 commands), every exit code captured before any pipe:

54 exit 0 · 5 NOT MEASURED (exit 3, PREREQUISITE NOT MET) · --ran reconciliation 59/59 accounted

• --ran verdict: ✓ dispatch-gates --ran: 59 derived famil(ies) accounted for — 54 run, 5 NOT-MEASURED (5 DERIVED from a recorded exit 3).
• pnpm check:platform-checklist exit 0: check-platform-checklist: OK — 16 areas, 352 items (347 active, 1 planned) (the three new path#symbol source anchors resolve).
• pnpm --filter @objectstack/spec run check:liveness exit 0: ✓ packages/spec/liveness/state-counts/ is current — one shard per governed type, the same 43 row(s) as the README, no count column left in the README.
• pnpm check:doc-authoring exit 0 · pnpm check:nul-bytes exit 0 · pnpm check:issue-citations exit 0 · pnpm check:published-files exit 0.
• node scripts/check-adr-0087-registration.mjs --base origin/main exit 0: this PR adds no declared-breaking changeset · check-changeset-no-major exit 0 · check-empty-changeset exit 0.
• NOT MEASURED: check:doc-formula-expressions (@objectstack/formula not built), check:dts-closure, check:dual-build-cjs-loads, check:lean-entry-closure (@objectstack/objectql dist absent), check:sourcemap-no-sources-content. Reason: each reads the built dist of packages this diff does not change, and building the workspace for a docs-only diff is the declared narrowing. CI's Lint & Repo Gates runs them on a built tree.
• Local-only families check:dev-prereqs / check:skill-frame-freshness: not run, because the diff touches neither the packages/spec build nor the four-axis frame files.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

⚠️ 1 changed file(s) yielded no anchor (packages/spec/liveness/README.md), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files. Nothing else in this diff resolved to a documentable surface (no symbol, route or SDK anchor derived from 1 changed package(s)).

What this run could not see

• 1 changed file(s) yielded no anchor (packages/spec/liveness/README.md) — pages documenting those are invisible to this run
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 167 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json bfdaba4322e1258a7657aa622af021e31ab071aa → packageMentionDocs.

[objectstack-fleet]

domain:devx#2 · os-justin · session_01QSeKYmTYfaPbLQD4BJfomW

席位核对 — ACCEPT · domain:devx#2 · head 8dee70e6bb · 2026-10-29T19:45Z

维护者速读

• 改了什么：三处文档跟上 feat(spec, cli)!: bundled is the one plugin packaging strategy — manifest-deps is retired, and os plugin build refuses a native addon (#27123, slice 3 of 3, server half) #27679 之后的代码。插件分发设计文档只保留 bundled 一种打包策略。cli 检查清单里两条过期的 ⛔ 否定句，改为指向现在真正做完整性复验和运行层级分派的代码。liveness README 的 manifest 单元格，把 dead 集合从 19 改为 13（与 ledger 一致），并补了一句说明 packaging 为什么是 planned。
• 为什么改：manifest-deps 已删除，也会被按名拒收，文档却还把它写成可选策略。清单仍写着「解包时没人复验完整性」「没人按运行层级分派」，可这两件事 ADR-0025 M1 — local T0 install loop for first-party, self-signed plugins: os plugin install (signature + integrity, materialize, record), boot-time loader with the tier dispatch point, disable/uninstall, Stripe sample as acceptance #27123 的前两片已经做了。README 里那个手写计数早就过期。
• 风险与回滚：只改文档，不动代码和 schema。4 个文件，+52/−22。packages/spec/liveness/README.md 会随 npm 包发布，所以带了一个 @objectstack/spec patch changeset。回滚 = 还原本 PR。
• 先看：docs/qa/platform-checklist/areas/cli.json 的两条否定句和 revision 5 历史条目；packages/spec/liveness/README.md 的 manifest 行；docs/design/plugin-distribution.md §4.3。
• 两分钟验证：grep -rn "manifest-deps" docs/design/plugin-distribution.md docs/qa/platform-checklist/areas/cli.json packages/spec/liveness/README.md，结果里应只剩「已退役、按名拒收」的说法。
• 需要你做的：无。席位落地。

席位意见：合入。每一句都按代码树写，不是照卡片转述。两条否定句没有删掉，而是改成「这一项不计分，校验在别处」，并指向具体代码；计分条款一字未动。README 计数先确认生成分片已是最新（13），再改手写的那句，没有手填数字。

Shape: draft → main, Fixes #27685. 4 files: docs/design/plugin-distribution.md, docs/qa/platform-checklist/areas/cli.json, packages/spec/liveness/README.md (the cross-domain file triage granted in 6504381957), and .changeset/27685-manifest-liveness-cell.md (@objectstack/spec patch, Clause-②: no). +52/−22. Labels documentation, size/s, tooling; no skip-changeset, since a changeset is owed (liveness is in spec's files). No assignees or reviewers (non-governed; the seat lands it). The dev opened it through the relay; report 6506244559, claim 6505583616.

Premise measured: holds after #27679. PluginPackagingSchema is enumWithRetiredValues(['bundled'], PACKAGING_RETIRED), and build.ts has a single esbuild path.

Seat's own read of the diff:

• cli.json revision 4 → 5, with a history entry citing docs: manifest-deps retirement leftovers outside the ADR: plugin-distribution design note, two stale checklist negatives, the liveness README manifest cell #27685. The integrity negative now points at install.ts#PluginInstall → plugin-artifact-integrity.ts#verifyIntegrity (from feat(cli, runtime, platform-objects): os plugin install verifies a signed .osplugin against the environment's trusted keys and installs it locally (#27123, slice 1 of 3) #27335). The tier negative points at installed-plugin-loader.ts#dispatchPluginRuntime (from feat(cli, runtime, core): os serve loads the plugins os plugin install installed, re-verified and dispatched by runtime tier; os plugin disable | enable | uninstall (#27123, slice 2 of 3) #27374). Both say "not scored here". The unresolvable manifest.integrity declares per-file artifact digests the spec says the runtime re-verifies at unpack — nothing computes them and nothing checks them #11331 / [text correction · ruled B] manifest.runtime tombstone/describe reads truthfully: publish-gate enforced (cloud), load-side NOT enforced #11330 citations are gone, and three source rows are added.
• README: the dead set is partitioned as the ledger holds it (10 contributes members plus three container tombstones = 13), and there is one packaging sentence. gen:liveness-counts rewrites 0 shards, so the generated shard was already right.
• Design note: §4.1 tree, §4.2 compiled manifest, §4.3 rewritten with one dated retirement note, the §5 publish gate, §6 step 5 and §8 supply-chain.

Gates: on head 8dee70e6bb, 50 check-runs: 40 success, 10 skipped, 0 failure; mergeable_state: clean. Spec property liveness, Check Changeset and every Lint · lane are success. check-expected-skips --pr 27698: OK, all 10 skips are in main's roster (exit 0). check-governed-merges --pr 27698: NOT governed, 74 changed lines. Dev's union: 59 derived, 54 run with exit 0, and 5 NOT MEASURED by prerequisite (built-dist readers; this diff changes no package build). CI's lint lanes ran those 5 built and are green.

Accepted deviations:

• §8 supply-chain bullet edited beyond the claim's line list. It is the same file and the same manifest-deps class, and the PR body declares it.
• A changeset was added instead of skip-changeset, because the README ships.
• The PR has no assignee, per the relay's pr_create rule.

Out of scope, with destinations:

• ADR-0025 still reads manifest-deps as live (L159, L267–268, L595–596, against its own §3.3), and the design note names tsup where os plugin build uses esbuild → filed docs: manifest-deps still reads as live in ADR-0025 (L159, L267, L595–596, against its own §3.3), and plugin-distribution.md names tsup where os plugin build uses esbuild #27700.
• No checklist item scores the install-time integrity refusal or the boot-time tier dispatch → Acceptance notes (a coverage observation for the next checklist-author sweep).
• Card item 4 (marketplaceApi.ts:171) → rides the next domain:ui PR in that file, per triage 6504381957.
• Skills-docs: n/a (Metadata-protocol: none).

Landing: non-governed, 74 changed lines. In this act the seat readies the PR and arms auto-merge. On merge, the seat verifies the merged diff and posts the landing note on #27685. There is no cloud session to archive (mode:subagent).

---

Generated by Claude Code