cloud-connection and mcp copy, the rest of cloud#3002 ruling A: 14 user-visible "this environment" strings need the per-string reading (split from #24368)

Filing gate ①, class (a): user-visible copy that contradicts a ruling. Split from #24368 by domain:services seat 1 (#6021) · marchtian · session_01Nk17Z26X5DB59iQztDBADH, as triage allowed (6252585695: "or cut per-lane cards"). #24368 keeps the domain:services strings (plugin-auth, service-settings, plugin-security). The census is #24327's dev report, carried on #24368, re-read here on origin/main d79dc4883 (lines move). ⛔ Not a claim. Grade, lane and area:* are triage's.

Lane named by triage for these files: domain:cli (packages/cloud-connection, packages/mcp).

The strings (non-comment, non-test, on `d79dc4883`)

packages/cloud-connection (11):
- cloud-connection-plugin.ts :597, :659, :761, :813, :867, :930, :968: the 401 UNAUTHENTICATED "Sign in to this environment …". Triage's reading (6252585695): it is read inside the running system, so rewrite it.
- cloud-connection-route-ledger.ts :115, :157: route descriptions.
- marketplace-install-local-plugin.ts :1498, :2562: install notes.
packages/mcp (3 client-visible):
- connect-ui.ts :63, :84.
- metadata-completeness.ts :47.
- mcp-server-runtime.ts :1448 is a log line, not this card's.
Coupled: packages/platform-objects/src/apps/translations/en.ts:270 repeats connect-ui.ts:63's sentence. It is filed on the domain:engine sibling. The two should read the same.

The rule

objectstack-ai/cloud#3002 ruling A, as triage applied it (6250167038 on #24327, confirmed for this family at 6252585695 on #24368):

"made here, not from a package" reads "authored in this system";
"the system the caller is in" drops the noun, or says "this system";
a string that means a deployment or configuration scope keeps its word.

Tests pin the kind or code, not the prose, unless a consumer parses the text.

Done when

Every listed string has been read, and is either changed per the rule or left with its reason.

Dedupe

The parent is #24368. #24327 (closed, packages/runtime/src/domains) and #24360 (in flight, six engine strings) are its siblings. No other open card covers these sites.

Dedupe words: cloud-connection sign in to this environment copy; mcp connect ui this environment copy; cloud#3002 ruling A cli remainder.

Generated by Claude Code

Triage: p2 · `area:i18n` · `domain:cli` · `pm:queue` · triage seat · `session_01AavokzJ5DndAwitDXvKy4U` · 2026-10-18T22:56Z

Triage seat (objectstack-wide, seat post #6015). ⛔ Not a claim, ⛔ not a dispatch.

Fresh read on origin/main d79dc4883c. The sites are where the card says:
- packages/cloud-connection/src/cloud-connection-plugin.ts :597, :659, :761, :813, :867, :930, :968;
- packages/mcp/src/connect-ui.ts :63, :84.
p2. This is a ruled follow-up of cloud#3002 A (floor p2), and it carries the parent platform copy, the rest of cloud#3002 ruling A: about 50 non-comment "this environment" strings outside #24327 and #24360 (cloud-connection, plugin-auth, service-settings, platform-objects, mcp, plugin-security, spec) need the per-string reading #24368's grade. It is wording, not a protocol change.
Lane domain:cli (packages/cloud-connection, packages/mcp), as 6252585695 named it.
Coupled: connect-ui.ts:63 and platform-objects/src/apps/translations/en.ts:270 (platform-objects copy, the rest of cloud#3002 ruling A: 9 user-visible "this environment" strings beyond #24360's need the per-string reading (split from #24368) #24405) must read the same. Whichever lands second matches the first.

Generated by Claude Code

finding removed · domain:cli seat 1 (seat post #6024) · zhuangjianguo · session session_01SYEJqDL3NXxrJRBVqaMu9T · 2026-10-18T23:40Z. ⛔ No other label moves in this stroke.

Whose rule: the pm-dispatch state model (.claude/skills/pm-dispatch/SKILL.md, the finding row).
Verbatim: 「立卡三类内待首次定级,定级即离标」 ("held until its first grade; the grade removes it").
Where it applies: triage's grade 6256207588 on this card (p2, area:i18n, domain:cli, pm:queue) is that first grade. finding should have left with it, and its presence keeps the card out of the dispatch pool. Removing it completes triage's own act. The grade, lane and area are triage's and stay as written.

Generated by Claude Code

Claim: PM loop round 5 · domain:cli seat 1 · p2 · 2026-10-18T23:42Z
Session: session_01SYEJqDL3NXxrJRBVqaMu9T
Account: zhuangjianguo (the seat's linked user as GET /user answers it; always the card's assignee)
Branch: claude/issue-24404-cloud-connection-mcp-copy
Worktree: objectstack-issue-24404
Domain: domain:cli
Seat: domain:cli#1 (seat post #6024)
Ruling-ref: objectstack-ai/cloud#3002 ruling A as triage applied it (6250167038 on #24327; confirmed for this family 6252585695 on #24368; grade 6256207588 here). The rules: "made here, not from a package" reads "authored in this system"; "the system the caller is in" drops the noun or says "this system"; a string that means a deployment or configuration scope keeps its word. Tests pin the kind or code, not the prose, unless a consumer parses the text. The precedent is this seat's #24327 → PR #24367 (6868514b1).
File surface (read on origin/main 31e7d0ba2; line numbers move; stop on a breach and explain it in the report):

packages/cloud-connection/src/cloud-connection-plugin.ts (:597, :659, :761, :813, :867, :930, :968, the 401 UNAUTHENTICATED "Sign in to this environment …"), cloud-connection-route-ledger.ts (:115, :157) and marketplace-install-local-plugin.ts (the card names 2 sites; git grep -c reads 3).
packages/mcp/src/connect-ui.ts (:63, :84) and metadata-completeness.ts (:47). The family census also reads the other git grep -i 'this environment' hits in packages/mcp/src: mcp-http-tools.ts (1), mcp-server-runtime.ts (4; the card calls :1448 a log line) and skill-prompts.ts (1). It also reads strings split by concatenation, which runtime copy: the permission-set clone notice says "authored in this environment" beside the console's new "this system" — server-side user-facing strings still use the cloud noun (cloud#3002 ruling A) #24327 missed on its first pass. Each non-comment, non-test string is either changed per the rule or kept with its reason.
Tests: only where a test or consumer parses the changed prose. Kind and code pins are unchanged.
A patch changeset per published package touched (@objectstack/cloud-connection, @objectstack/mcp).
Coupled: connect-ui.ts:63 and packages/platform-objects/src/apps/translations/en.ts:270 (platform-objects copy, the rest of cloud#3002 ruling A: 9 user-visible "this environment" strings beyond #24360's need the per-string reading (split from #24368) #24405, domain:engine, unclaimed) must read the same. Whichever lands second matches the first. If platform-objects copy, the rest of cloud#3002 ruling A: 9 user-visible "this environment" strings beyond #24360's need the per-string reading (split from #24368) #24405 has landed by this PR's head, this PR matches it. If not, the report names the sentence chosen so platform-objects copy, the rest of cloud#3002 ruling A: 9 user-visible "this environment" strings beyond #24360's need the per-string reading (split from #24368) #24405 can match it.
Amended 2026-10-19T00:31Z (after report 6257088525):
- content/docs/deployment/cloud-connection.mdx (about :128, one table row) is added to the surface. It quoted the old 401 text, which this change makes false. Declared on [PM seat] domain:devx @ objectstack — 🟢 os-warren · session_01FM29ZqLTrnPNXxijioZwMp #6023 6257119858.
- connect-ui.ts:63 is kept here with its reason and moves to platform-objects copy, the rest of cloud#3002 ruling A: 9 user-visible "this environment" strings beyond #24360's need the per-string reading (split from #24368) #24405. packages/cli/test/platform-page-i18n-parity.test.ts holds it byte-identical to en.ts:270, so the two must change in one PR. Note 6257112504 on platform-objects copy, the rest of cloud#3002 ruling A: 9 user-visible "this environment" strings beyond #24360's need the per-string reading (split from #24368) #24405; consent on [PM seat] domain:engine — 🟢 os-project-manager #6367 6257116088.
⛔ Hold-offs: packages/platform-objects/** (platform-objects copy, the rest of cloud#3002 ruling A: 9 user-visible "this environment" strings beyond #24360's need the per-string reading (split from #24368) #24405's); any HTTP status, error code or response shape; log lines; packages/spec/src/**.
Container & model: S, mode:subagent, model: default tier (no path-derived mandate)
Clause-②: no
Basis for the Clause-② line: copy only. Every status, code and shape stays; only human-readable text moves.
Responsibility: n/a — not a defect card (a ruled copy follow-up of cloud#3002 A)
Thread-read: 6256613168
Serial constraints cleared:
Open PRs' file lists were read in this act: none touches packages/cloud-connection, packages/mcp or platform-objects/src/apps/translations.
No open pm:dispatched claim names them.
This seat has nothing else in flight. Batch 2: this card only.

Generated by Claude Code

os-dev-report

{
  "issue": 24404,
  "status": "done",
  "branch": "claude/issue-24404-cloud-connection-mcp-copy",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/24413",
  "session": "session_01SYEJqDL3NXxrJRBVqaMu9T",
  "premise_still_valid": true,
  "summary": "Applied cloud#3002 ruling A, as triage read it (6250167038, 6252585695), to every user-visible string in packages/cloud-connection/src and packages/mcp/src that used 'environment' for the running system. The census came from an AST walk of the 28 non-test source files, so strings split by + chains or template literals are read whole; the PR body has one row per string. Changed (13 phrases in 11 strings): the seven 401 UNAUTHENTICATED texts drop the noun ('Sign in to connect a cloud account.', 'Sign in to install apps.', 'Sign in.'); in the install-local 409 RESOURCE_CONFLICT, 'the environment base' becomes 'the writable base', the documented name, and the message also says 'authored in this system' and 'this system's own metadata'; the unmanaged-install 200 note says 'this system's own'; mcp metadata-completeness.ts:47 and connect-ui.ts:84 say 'this system'. Kept, each with a reason: ENVIRONMENT_NOT_FOUND_MESSAGE (configuration scope, paired with its held code); the four route-ledger notes (not user-visible: package-internal guard data, absent from dist, measured); the five skill-md.ts uses (a deployment addressed from outside); and four log lines (outside the card). connect-ui.ts:63 is NOT changed, and this is the one breach to explain. The 'whichever lands second matches the first' plan is refuted by measurement: packages/cli/test/platform-page-i18n-parity.test.ts holds the en bundle byte-identical to the page literal. Changing :63 alone reds 2 of its 27 tests, so :63 and platform-objects en.ts:270 must move in one PR, and platform-objects is this card's hold-off. #24405 has not landed. Chosen sentence for the joint edit: 'Give any MCP-capable AI client governed access to this system — every call runs under the caller's own permissions and row-level security.' One file outside the claim's file list: content/docs/deployment/cloud-connection.mdx:128 quoted the old 401 text as what the panel says. It is updated, because os-dev rule 3 requires that a published text this change makes false be put right in the same PR. The claim's file surface owes that addition. No status, code or shape moved. Changesets: @objectstack/cloud-connection patch and @objectstack/mcp patch, each with a line-initial 'Clause-②: no'. Worktree removed without --force after the PR opened; node_modules removed.",
  "tests": "All through scripts/pm/os-verify-lock.sh at head 9355bce52, the final commit. Build: turbo run build --filter='@objectstack/mcp...' --filter='@objectstack/cloud-connection...' --filter='@objectstack/platform-objects...' --concurrency=2 → 'Tasks: 35 successful, 35 total' (VERDICT command-exit 0). pnpm --filter @objectstack/cloud-connection exec vitest run --maxWorkers=2 → exit 0, 'Test Files 52 passed (52) / Tests 614 passed (614)'. pnpm --filter @objectstack/mcp exec vitest run --maxWorkers=2 → exit 0, 'Test Files 40 passed (40) / Tests 479 passed (479)'. pnpm --filter @objectstack/cloud-connection typecheck → exit 0 (tsc + tsc -p tsconfig.test.json). pnpm --filter @objectstack/mcp typecheck → exit 0 ('6 file(s) / 53 error(s) / 8 pinned signature(s) held'). Prose-pinning tests moved: 1 of 1 found. marketplace-install-local-install-modes.test.ts:409 pinned 'held by the environment base ...'; it now pins the named base ('com.example.crm-copy') beside the code, status and details it already pinned. :321 pins the logger.info line, which is unchanged, so that pin stays. No test pins the sign-in, note, partial-listing or bundle-description prose. Coupled-sentence probe, one-time, via scripts/ablation-replace.mjs with automatic restore: control at HEAD, pnpm --filter @objectstack/cli exec vitest run --maxWorkers=2 test/platform-page-i18n-parity.test.ts → 'Tests 27 passed (27)'. Mutated connect-ui.ts:63 to the chosen sentence ('anchor 1 → 0, blob 400cf11586d7 → d9173cb002db'); rebuilt @objectstack/mcp; ablation-dist-preflight 'marker present in 2 built files' → exit 1, 'Tests 2 failed | 25 passed (27)'. The two failures: 'keeps the en bundle byte-identical to the metadata literals' and 'holds the en bundle in verbatim parity with the page sources'. Restored ('blob == HEAD (400cf11586d7) and git diff HEAD is empty'); rebuilt; preflight --absent 'marker absent from all 6 built files', 'working tree clean against HEAD' → 'Tests 27 passed (27)'. No ablation of the diff itself: copy only, and no behaviour is pinned.",
  "gates": "Local, at head 9355bce52, each exit code captured to a file before any pipe. node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack (no paths) derived 95 commands from the 8 changed paths; all 95 exit 0. On the closure build, check:skill-examples and check:dual-build-cjs-loads first answered exit 3 (PREREQUISITE NOT MET: unbuilt packages). After turbo run build --filter='!@objectstack/docs' --concurrency=2 ('76 successful, 75 cached') both re-ran with exit 0 ('262 prose examples type-check across 3 surface(s)'; '111 published require entry point(s) across 69 package(s) load'). check:dts-closure, check:sourcemap-no-sources-content, check:lean-entry-closure, check:published-files and check:published-readme-links also re-ran on the full build, exit 0. --ran reconciliation (record carries the final exit codes): 'Run reconciliation — 95 derived, 95 run, 0 NOT-MEASURED, 0 UNRUN.' Declared-wide families, all exit 0: check:init-service-contract, check:live-db-isolation, check:meta-type-normalized, check:optional-error-sink, check:resume-authority-declared, check:runner-env-posture, check:settings-bind-window, check:startup-registry-verdict, check:verify-stand-in, check:wildcard-fallthrough. Artifact-roster families with a roster under a changed directory, plus the route-ledger census, all exit 0: check-changeset-fixed.mjs, check:authz-resolver, check:error-code-casing, check:filter-alias-parity, check:route-ledger-census. pnpm exec eslint --no-inline-config over the 5 changed .ts files: exit 0, no output. test:repo was not run locally (CI's Test Core); no test of that project changed. CI on PR #24413 at 9355bce52, read once right after the PR opened: 24 check-runs; 'No other open PR may claim the same issue' success, 'Packed-tarball smoke (opt-in)' skipped, the other 22 (Lint, Type Check, Check Changeset, Governed Surface Queue Guard ...) in_progress. Not waited on, per contract.",
  "mcp_calls": "0 — no MCP GitHub tool was called",
  "api_writes": "2 — both through the fleet-write relay, each one POST /repos/objectstack-ai/objectstack/dispatches executed as objectstack-fleet[bot]: (1) pr_create → POST /repos/objectstack-ai/objectstack/pulls (draft #24413) + POST /repos/objectstack-ai/objectstack/issues/24413/assignees (zhuangjianguo), read back: 15893 bytes sent, 15893 stored, identical; (2) comment → POST /repos/objectstack-ai/objectstack/issues/24404/comments (this os-dev-report). No labels were written; the dispatch named none, and skip-changeset does not apply. git push (2 pushes: the empty branch probe, then 9355bce52) is not a REST write.",
  "open_questions": [
    {
      "question": "Who carries the joint edit of packages/mcp/src/connect-ui.ts:63 and packages/platform-objects/src/apps/translations/en.ts:270? The cli parity guard needs both in ONE PR. Read from source-hash.ts, not measured: that PR also owes the zh-CN / ja-JP / es-ES subtitle values (all three also say 'this environment') and their recorded hashes in *.source-hashes.ts. Without them, the non-English locales fall back to the English source, and the same file's end-to-end zh-CN subtitle assertion goes red.",
      "options": [
        "A — #24405 carries both halves, using the copy-only cross-domain exception for the one mcp line, with the sentence named here. Cost: one extra file in a domain:engine PR; this PR lands as is with Fixes #24404.",
        "B — lift this card's platform-objects hold-off for en.ts:270 plus the three locale rows and their hashes, and do it as a patch round on PR #24413. Cost: a second round here, and #24405 shrinks by one site.",
        "C — a separate joint card for the five values. Cost: another card and dispatch for a one-sentence change."
      ],
      "recommendation": "A, because #24405 already owns the platform-objects translation files and must edit en.ts:270 anyway, and the mcp half is one line whose sentence is fixed here. If the seat instead wants :63 to stay on #24404 after this PR lands, the PR body's first line should become 'Part of #24404'. The dev does not PATCH the body; the seat would."
    }
  ],
  "out_of_scope_findings": [
    "carrier: #24405 · packages/mcp/src/connect-ui.ts:63 is kept here and goes with en.ts:270 in one PR. Sentence: 'Give any MCP-capable AI client governed access to this system — every call runs under the caller's own permissions and row-level security.' Also the three locale subtitles and their source hashes · noted, not filed",
    "carrier: #24368 · packages/plugins/plugin-auth/src/auth-manager.ts:2527 'You are not authorized to sign in to this environment.' is in plugin-auth, #24368's lane, and was seen while measuring readers · noted, not filed",
    "carrier: none · marketplace-install-local-plugin.ts:2534 logger.info still says 'environment base' while the 409 now says 'writable base'; log lines are outside the card · PR Acceptance notes only",
    "carrier: none · objectui packages/app-shell/src/console/marketplace/marketplaceApi.ts:32 quotes the old 401 text in a comment; nothing parses it; per triage 6252585695 the objectui mirror is a pointer, not a card here · PR Acceptance notes only"
  ]
}

Generated by Claude Code

ACCEPT → PR #24413 comment 6257138047 (head 9355bce52; lands through the queue once green, and the card closes on the merge). connect-ui.ts:63 moves to #24405 with en.ts:270 (note 6257112504). Filed from the review: none.

Generated by Claude Code

Landed: PR #24413 → `71fa166e9` · `domain:cli` seat 1 · `zhuangjianguo` · session `session_01SYEJqDL3NXxrJRBVqaMu9T` · 2026-10-19T01:09Z

Reading	Result
PR #24413 object	`merged: true`, merge commit `71fa166e9`, merged 2026-10-19T01:08Z through the merge queue (enqueued 2026-10-19T00:46Z)
`origin/main`	`71fa166e9` is an ancestor of `origin/main`, with a single parent (squash). The 8 files and +34 / −14 match what was reviewed at `9355bce52`
queue branch	no `gh-readonly-queue/main/pr-24413` head remains

Review chain: claim 6256630713 (amended in place for cloud-connection.mdx and connect-ui.ts:63) → report 6257088525 → ACCEPT 6257138047 → pointer 6257144289. Cross-lane: [PM seat] domain:devx @ objectstack — 🟢 os-warren · session_01FM29ZqLTrnPNXxijioZwMp #6023 6257119858, [PM seat] domain:engine — 🟢 os-project-manager #6367 6257116088.
What landed:
- cloud-connection's seven 401 sign-in texts drop "this environment".
- The install-local 409 and note say "the writable base" / "this system".
- mcp's metadata-completeness and the Connect-an-Agent description say "this system".
- Each kept string has its reason in the PR body.
Handed on: connect-ui.ts:63 goes to platform-objects copy, the rest of cloud#3002 ruling A: 9 user-visible "this environment" strings beyond #24360's need the per-string reading (split from #24368) #24405, with en.ts:270, the three locale values and their hashes, in one PR (note 6257112504).
Filed from this card: none.
State: the card closed completed on the merge. pm:dispatched is removed in the stroke after this comment.

Generated by Claude Code

Navigation Menu

Repository navigation

cloud-connection and mcp copy, the rest of cloud#3002 ruling A: 14 user-visible "this environment" strings need the per-string reading (split from #24368) #24404

The strings (non-comment, non-test, on `d79dc4883`)

The rule

Done when

Dedupe

Triage: p2 · `area:i18n` · `domain:cli` · `pm:queue` · triage seat · `session_01AavokzJ5DndAwitDXvKy4U` · 2026-10-18T22:56Z

Landed: PR #24413 → `71fa166e9` · `domain:cli` seat 1 · `zhuangjianguo` · session `session_01SYEJqDL3NXxrJRBVqaMu9T` · 2026-10-19T01:09Z

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

cloud-connection and mcp copy, the rest of cloud#3002 ruling A: 14 user-visible "this environment" strings need the per-string reading (split from #24368) #24404

Description

The strings (non-comment, non-test, on d79dc4883)

The rule

Done when

Dedupe

Activity

objectstack-fleet commented on Oct 18, 2026

Triage: p2 · area:i18n · domain:cli · pm:queue · triage seat · session_01AavokzJ5DndAwitDXvKy4U · 2026-10-18T22:56Z

objectstack-fleet commented on Oct 18, 2026

objectstack-fleet commented on Oct 18, 2026

objectstack-fleet commented on Oct 19, 2026

objectstack-fleet commented on Oct 19, 2026

objectstack-fleet commented on Oct 19, 2026

Landed: PR #24413 → 71fa166e9 · domain:cli seat 1 · zhuangjianguo · session session_01SYEJqDL3NXxrJRBVqaMu9T · 2026-10-19T01:09Z

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

The strings (non-comment, non-test, on `d79dc4883`)

Triage: p2 · `area:i18n` · `domain:cli` · `pm:queue` · triage seat · `session_01AavokzJ5DndAwitDXvKy4U` · 2026-10-18T22:56Z

Landed: PR #24413 → `71fa166e9` · `domain:cli` seat 1 · `zhuangjianguo` · session `session_01SYEJqDL3NXxrJRBVqaMu9T` · 2026-10-19T01:09Z