hourly full run: red on main (CI)

os-hourly-full-run-ci — machine-findable marker for this generated card. ⛔ Do not delete this line: it is how the hourly full run finds this card instead of filing a new one every hour.

hourly full run: red on main (CI)

Swept 2026-10-15T02:16:33.623Z · run log · commit f3fd209b34c6c0c5f815ddc195ec70b6a64abaed · conclusion failure.
CI runs the FULL battery on main every hour (#16467). A push run on
main tests only the packages the merge touched, and a merge-queue build tests only what the group
contained — so this hourly run is the only thing that says whether the WHOLE tree is green, and
this card is the only channel that reports it. Nothing is blocked by it.
⛔ The remedy is never to narrow, skip or delete the failing check to make the hourly run green.
Fix what it names and let the next hourly run refresh this card; a card nobody reopens is closed by
the next green run being uneventful, not by editing this one.

What landed since the last green hourly run

Range: 8226755ee9 (run 38651452634, the last green CI schedule run) .. f3fd209b34 — compare

1d79556766 feat(spec,core,runtime,plugin-auth)!: API keys get a lifecycle: 90-day default expiry, one-year ceiling, 90-day inactivity expiry, one-year grace, distinct refusal codes (feat(spec,core,runtime,plugin-auth)!: API keys get a lifecycle: 90-day default expiry, one-year ceiling, 90-day inactivity expiry, one-year grace, distinct refusal codes #23541)
be16febf36 feat(verify): flows.run takes the system principal, starting a flow as its own trigger does (feat(verify): flows.run takes the system principal, starting a flow as its own trigger does #23551)
0b9391b827 fix(cli)!: os migrate organization-ownership --apply refuses beside a SQLite holder, as its siblings do; the plan warns (fix(cli)!: os migrate organization-ownership --apply refuses beside a SQLite holder, as its siblings do; the plan warns #23548)
086fa4640f feat(cli,plugin-dev): an app that declares its own sys_organization default record page boots under os serve and DevPlugin; the conflict remedy names a page, not a package (feat(cli,plugin-dev): an app that declares its own sys_organization default record page boots under os serve and DevPlugin; the conflict remedy names a page, not a package #23550)
b57228913a test(spec): scoped-context and connector-author-shape compile their probes in one program, reading only the probe files' diagnostics (test(spec): scoped-context and connector-author-shape compile their probes in one program, reading only the probe files' diagnostics #23547)
7ffc57846a fix(metadata-protocol): an object's references list a permission set named only by its fields keys (metadata-protocol: findReferencesToMeta ("Used by") misses a permission set that names an object only in its fields keys (OBJECT.FIELD), so the panel can call an object safe to delete while field rules name it #23539) (fix(metadata-protocol): an object's references list a permission set named only by its fields keys (#23539) #23554)
252775d1d3 fix(cli): os meta delete says nothing was deleted when the reset door answers reset: false (fix(cli): os meta delete says nothing was deleted when the reset door answers reset: false #23557)
cdc42eb495 fix(metadata-protocol): duplicatePackage keeps a copied field's key and name, and a bare object's view item name, in step with what they name (fix(metadata-protocol): duplicatePackage keeps a copied field's key and name, and a bare object's view item name, in step with what they name #23559)
fa6a6085c0 fix(hono): createHonoApp's catch arms run the 5xx disclosure filter before shipping an undeclared throw's message (hono: createHonoApp's catch arms ship an undeclared 500's thrown message unfiltered, so a driver diagnostic (no such table: ghost) reaches the client; looksLikeInternalErrorLeak is never asked #23532) (fix(hono): createHonoApp's catch arms run the 5xx disclosure filter before shipping an undeclared throw's message (#23532) #23564)
f3fd209b34 docs(adr-0076): OQ#9 — correct the partition's i18n and storage entries against a boot (refs runtime/service-i18n: the i18n paths have two owners, and the likely live one (the dispatcher) relays an undeclared 5xx's caught text unless it reads like SQL, so #23174's plugin-mount withholding may be shadowed (read from source, not yet measured) #23347) (docs(adr-0076): OQ#9 — correct the partition's i18n and storage entries against a boot (refs #23347) #23570)
Filed by .github/workflows/scheduled-full-run-card.yml. Generated by Claude Code

Triage: `domain:devx` → `domain:spec` · `pm:queue` · this red is PR #23541's census move · triage seat · `session_01AavokzJ5DndAwitDXvKy4U` · 2026-10-15T00:55Z

Read fresh. Run 38657693085 (schedule, 00:02Z, on b57228913a) has one red test, in Dogfood Regression Gate (3/3) (job 116171382655):

test/authz-probe-blind-spot.test.ts:88 (authz-conformance discover() reaches 1 of 17 route registrars in rest-server.ts — the ratchet's route-completeness guarantee is false for 66 of 85 mounted routes #13260's census) fails with control "enforceAuth" moved in packages/rest/src/rest-server.ts: expected 64 to be 61.

The cause: 1d79556766, PR #23541 (#23367, API-key lifecycle), merged at 23:15Z. It added three enforceAuth mentions to rest-server.ts, all inside docblock and inline comments (git show 1d79556766 -- packages/rest/src/rest-server.ts). The census counts the spelling textually, so the pinned reading moved. The dogfood shards skip on PRs and in the merge queue, so only this hourly run could see it. The 23:01Z run (8226755ee9) was green.

Lane domain:spec: [Decision] API key 的生命周期与存放：到期上限与不活动失效取多长，key 继续放自有 sys_api_key 还是迁到 @better-auth/api-key（#23287 裁决 C′ 的留项） #23367's seat landed the change. The fix is the census's own update, in packages/qa/dogfood/test/authz-probe-blind-spot.census.ts.
- Follow that file's rule for a moved positive control. Confirm that the three new mentions are comments, not new controls, then re-pin the reading with that reason.
- Or the census can skip comments, if its own rule allows. That is the seat's reading.
- ⛔ The control is not dropped or narrowed.
priority:p1 stays: main's full battery is red. The next green hourly run closes this card under the main-red convention.

Claim: PM loop round 1 (#23563, main red: the hourly full run's Dogfood Regression Gate (3/3) fails authz-probe-blind-spot.test.ts:88, "control enforceAuth moved in packages/rest/src/rest-server.ts: expected 64 to be 61". PR #23541 (1d79556766, #23367) added three enforceAuth mentions in comments. The census control is re-anchored by its own rule, with a provenance note, never relaxed or dropped; triage 6181887368) · 2026-10-15T01:28Z
Session: session_01YRp5z4kK6vgYkrdH97ztsy
Account: huangyiirene (the seat's linked user as GET /user answers it; always the card's assignee)
Branch: claude/issue-23563-census-enforceauth-reanchor
Worktree: objectstack-issue-23563
Domain: domain:spec
Seat: domain:spec#1 (seat post #6017)
File surface (at origin/main fa6a6085c or later; stop on a breach and explain it in the report):

packages/qa/dogfood/test/authz-probe-blind-spot.census.ts: the rest-server.ts row's enforceAuth control and its provenance note only (near :554–:645).
⛔ Not packages/rest/** (the comments PR feat(spec,core,runtime,plugin-auth)!: API keys get a lifecycle: 90-day default expiry, one-year ceiling, 90-day inactivity expiry, one-year grace, distinct refusal codes #23541 added stay as they are). ⛔ Not the test runner, any other census row or control, or any other file. ⛔ No changeset: @objectstack/dogfood is private.
Container & model: S, mode:subagent, model: default (dispatch-gates --tier: no path-derived mandate). No contract face: a private test-census pin. CI plus the seat's own read clear it.
Clause-②: no
Responsibility: @objectstack/dogfood's authz-conformance discover() reaches 1 of 17 route registrars in rest-server.ts — the ratchet's route-completeness guarantee is false for 66 of 85 mounted routes #13260 census, whose rest-server.ts row pins the textual count of enforceAuth as a control that the census still reads the file it thinks it does. | PR feat(spec,core,runtime,plugin-auth)!: API keys get a lifecycle: 90-day default expiry, one-year ceiling, 90-day inactivity expiry, one-year grace, distinct refusal codes #23541 moved the count with comment-only mentions; the dogfood shards skip on PRs and in the merge queue, so only the hourly run saw it. | main's full battery: red until re-anchored.
Thread-read: 6181887368
Serial constraints cleared:
Open PRs' file lists were read in this act. No open PR touches the census file.
PR fix(rest,runtime)!: both /data write doors validate the request as the caller sent it; a number expectedVersion is refused 400 #23571 (runtime: the dispatcher's PATCH /data/:object/:id has no request-schema gate, so a non-record body answers 500 with the engine's own error, where REST answers 400 VALIDATION_FAILED #23491, domain:cli) edits packages/rest/src/rest-server.ts. If it moves the enforceAuth count, the later lander re-anchors; the dev measures its head's count and reports it.

Generated by Claude Code

os-dev-report

{
  "issue": 23563,
  "status": "done",
  "branch": "claude/issue-23563-census-enforceauth-reanchor",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/23580",
  "session": "session_01YRp5z4kK6vgYkrdH97ztsy — subagent run, so this is the parent PM session id (the dispatch order and the commit Claude-Session trailer carry it)",
  "premise_still_valid": true,
  "summary": "Re-anchored the census's rest-server.ts row: controls.enforceAuth 61 -> 64, with a provenance paragraph in the voice of the earlier moves (RE-ANCHORED, not relaxed; exact count kept), in packages/qa/dogfood/test/authz-probe-blind-spot.census.ts only. H1 confirmed by the census's own deriveProbeFileCensus(): enforceAuth reads 61 at 8226755ee9 (last green, parent of 1d79556766), 64 at 1d79556766, 64 at fa6a6085c. The +3 are exactly the three lines 1d79556766 adds that spell the term, all comments: rest-server.ts:2395 and :2397 (docblock on apiKeyLifecycleRefusals) and :3471 (inline comment in computeExecCtx's outer catch); none removed, no call site or forwarder or interface member added, data-action-routes.ts untouched. H2 confirmed: population 70 / reachable 19 / blindSpot 51 and the six other controls read as pinned, and 0 other census rows moved. H4 measured: PR #23571's head 3dd76b2a8 reads enforceAuth 64 (its rest-server.ts diff adds/removes no line spelling the term; all other figures as pinned), so it does not move this control further; that PR was not touched.",
  "tests": "H3, the measurement of record (dogfood shards skip on pull_request and merge_group per ci.yml's dogfood job if:, and PR #23580's 'Dogfood Regression Gate (k/3)' check-run is completed/skipped): OS_VERIFY_LOCK_SLOT=os-dev-23563-census bash scripts/pm/os-verify-lock.sh -c 'pnpm --filter @objectstack/dogfood exec vitest run --maxWorkers=2 test/authz-probe-blind-spot.test.ts'. BEFORE on fa6a6085c (clean tree): 'AssertionError: control \"enforceAuth\" moved in packages/rest/src/rest-server.ts: expected 64 to be 61' at test/authz-probe-blind-spot.test.ts:88:76; 'Tests 1 failed | 46 passed (47)'; 'os-verify-lock: VERDICT command-exit 1'. AFTER on 11d842198 (PR head, git rev-parse --short HEAD): 'Test Files 1 passed (1)'; 'Tests 47 passed (47)'; 'os-verify-lock: VERDICT command-exit 0'. Declared narrowings: dogfood's full pnpm test (the three dogfood shards) not run locally; the census module's only importer is test/authz-probe-blind-spot.test.ts (git grep), run in full. pnpm --filter @objectstack/dogfood typecheck declared to CI's TypeScript Type Check (its PR selection includes the changed package); the edit is a numeric literal in a string-to-number record plus comments; the dependency closure build (step 1) was not run: 67 packages, 65 turbo cache MISS on a dry run, and the census test needs none of it (node builtins + vitest only). No ablation owed (dispatch: re-anchored pin; before-red/after-green is its proof).",
  "gates": "Local: node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack at 11d842198 derived 47 commands for the one changed path; all 47 run with exit captured before any pipe: 43 exit 0; 4 exit 3 PREREQUISITE NOT MET (need a workspace dist build) = NOT MEASURED locally: check:dts-closure, check:dual-build-cjs-loads, check:lean-entry-closure, check:sourcemap-no-sources-content. --ran reconciliation: '✓ dispatch-gates --ran: 47 derived famil(ies) accounted for — 43 run, 4 NOT-MEASURED (4 DERIVED from a recorded exit 3).' check:nul-bytes exit 0. CI on PR #23580 head 11d842198 at report time: Check Changeset completed/success (skip-changeset label run: completed/skipped); Dogfood Regression Gate completed/success, its 3 shards completed/skipped (PR event); Spec property liveness, Check Documentation Links, Flag docs affected by code changes, the three claim/closing guards completed/success; required contexts still in_progress: Lint & Repo Gates (Lint · CI, release & engine gates / docs & code guards / ESLint / PM dispatch-gates / repo & tooling gates / three scoped lanes all in_progress), TypeScript Type Check (Type Check · consumer gates / debt ledger / source gates / workspace in_progress), Test Core (1/6..6/6) in_progress, Build Core in_progress, Governed Surface Queue Guard in_progress. Not waited on, per the contract.",
  "mcp_calls": "0 — no MCP GitHub tool called",
  "api_writes": "3 — all through the fleet-write relay as objectstack-fleet[bot], each one POST /repos/objectstack-ai/objectstack/dispatches: (1) pr_create -> POST /repos/objectstack-ai/objectstack/pulls (draft) + POST /repos/objectstack-ai/objectstack/issues/23580/assignees [huangyiirene], run 38667404591, body read back byte-identical; (2) label-write labels_add -> POST /repos/objectstack-ai/objectstack/issues/23580/labels [skip-changeset], run 38667483380, read back matches (size/s from the labeler preserved); (3) this os-dev-report comment -> POST /repos/objectstack-ai/objectstack/issues/23563/comments. git push (2: empty-branch probe, then 11d842198) is not a REST write.",
  "open_questions": [],
  "out_of_scope_findings": [
    "carrier: none · noted in PR #23580 Acceptance notes, not filed · observation, not a defect: the census counts enforceAuth textually, comments included (its own stated rule), so any prose mention added to rest-server.ts or data-action-routes.ts moves the control, and because dogfood shards skip on PRs and in the merge queue only the hourly full run sees it; changing the rule is a census redesign outside this card"
  ],
  "line_budget": "n/a (no skills/** in the diff)",
  "deviations": [
    "Declared narrowings (accepted-deviation class): dogfood full suite and dogfood typecheck left to CI; dependency-closure build not run; 4 derived gates NOT MEASURED (exit 3, workspace build absent). Reasons in tests/gates.",
    "Measurement scaffolding outside the worktree, all removed: a detached comparison worktree at scratchpad/issue-23563/cmp (PR #23571 head, then 8226755ee9, 1d79556766, its parent) and a fetched ref refs/os-dev-23563/pr23571 in the shared .git (deleted with git update-ref -d).",
    "The harness attribution reminder proposed a model-named Co-Authored-By trailer and a different PR footer; AGENTS.md (the repo instruction it yields to) governs: commit carries the model-free Claude-Session / Co-authored-by pair (pre-push check:commit-card-trailers passed), PR body ends with the session-URL footer.",
    "No conflict found between the dispatch order and .claude/agents/os-dev.md."
  ],
  "files_changed": [
    "packages/qa/dogfood/test/authz-probe-blind-spot.census.ts"
  ]
}

Generated by Claude Code

ACCEPT → PR #23580 comment 6182546819 · domain:spec seat 1 (#6017) · session session_01YRp5z4kK6vgYkrdH97ztsy · 2026-10-15T01:50Z

Generated by Claude Code

Landed: PR #23580 → `07b56167b` (`Fixes #23563`) · 2026-10-15T02:32Z

domain:spec seat 1 (#6017) · huangyiirene · session session_01YRp5z4kK6vgYkrdH97ztsy · holder of claim 6182281865. Record: CI plus the seat's read (no contract face: a private test-census pin, Clause-②: no). ACCEPT ## 席位核对 6182546819 on 11d842198.

Reading	Probe	Answer
The PR	`GET /pulls/23580`	`merged: true` at 02:31:40Z, `merge_commit_sha` `07b56167b`
The queue branch	`GET /git/matching-refs/heads/gh-readonly-queue/main/pr-23580`	none left: the merge group was consumed
`origin/main`	`git merge-base --is-ancestor 07b56167b origin/main`	yes. `07b56167b` is the tip, a squash on `0f52f3256`
The pin against `main`	a textual `enforceAuth` count over `rest-server.ts` + `data-action-routes.ts` at the tip, against the census row	53 + 11 = 64; the census row reads `enforceAuth: 64`
The card	`GET /issues/23563`	`closed` / `completed` at 02:31:42Z, on the merge

What closes the red: the next hourly full run on main. The dogfood shards skip on PRs and in the merge queue, so only that run re-reads this census. If it is red again, scheduled-full-run-card.yml finds and refreshes this card by its marker line.

Carried, 承接者:无 (an observation, not filed): any further prose mention of enforceAuth in those two files moves the control again, and only the hourly run sees it.

State change: this act removes pm:dispatched.

Generated by Claude Code

Navigation Menu

Repository navigation

hourly full run: red on main (CI) #23563

hourly full run: red on main (CI)

What landed since the last green hourly run

Triage: `domain:devx` → `domain:spec` · `pm:queue` · this red is PR #23541's census move · triage seat · `session_01AavokzJ5DndAwitDXvKy4U` · 2026-10-15T00:55Z

Landed: PR #23580 → `07b56167b` (`Fixes #23563`) · 2026-10-15T02:32Z

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

hourly full run: red on main (CI) #23563

Description

hourly full run: red on main (CI)

What landed since the last green hourly run

Activity

objectstack-fleet commented on Oct 15, 2026

Triage: domain:devx → domain:spec · pm:queue · this red is PR #23541's census move · triage seat · session_01AavokzJ5DndAwitDXvKy4U · 2026-10-15T00:55Z

objectstack-fleet commented on Oct 15, 2026

objectstack-fleet commented on Oct 15, 2026

objectstack-fleet commented on Oct 15, 2026

objectstack-fleet commented on Oct 15, 2026

Landed: PR #23580 → 07b56167b (Fixes #23563) · 2026-10-15T02:32Z

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

Triage: `domain:devx` → `domain:spec` · `pm:queue` · this red is PR #23541's census move · triage seat · `session_01AavokzJ5DndAwitDXvKy4U` · 2026-10-15T00:55Z

Landed: PR #23580 → `07b56167b` (`Fixes #23563`) · 2026-10-15T02:32Z