Repository navigation
QA run · priority:P0 (23/23) · 6679644a · 2026-10-25 · 19 PASS / 4 PARTIAL / 0 FAIL / 0 BLOCKED / 0 NOT-RUN #25812
Description
QA run record for selector priority:P0 of the 18.2.0 release test sweep (wave anchor #25807, card T1). Run by the checklist-test skill following docs/qa/platform-checklist/RUNNER.md, for the Version Packages PR #25640.
Environment fingerprint
- framework:
6679644a1a56b552d6864b125900221823ec78b3(objectstack-ai/objectstackmain, head at start, 2026-10-25T13:35Z), tree clean;pnpm install --frozen-lockfile+pnpm build --concurrency=276/76 green;node scripts/check-dev-prereqs.mjsgreen. The tree is unreleased, so/api/v1/healthreportsversion: 18.1.0(52 pending changesets). - console:
.objectui-sha=b41ed7f68956c8cfda21bc790548361af81b09ac, built withOBJECTUI_DEPS_BUILD_CMD='pnpm exec turbo run build --concurrency=2 --filter=@object-ui/console^...' pnpm objectui:build("dist ready … from objectui@b41ed7f68956");packages/console/dist/.objectui-shaequals the pin andpnpm check:console-shais green, sostale-console-bundleis ruled out for every console observation. A pin move is in flight (chore(console): move the objectui pin b41ed7f68956 → objectui main before the 18.2.0 cut (maintainer: bump first) #25810); the maintainer directed this run to stay onb41ed7f68956. - app:
examples/app-showcase; canonical bootOS_PORT=PORT setsid pnpm -C examples/app-showcase exec objectstack dev --ui --seed-admin -p PORT -d file:SCRATCH/ITEM.db, own port per item (ranges 41101–41599) and own file DB per item; items that author metadata, install or plant rows booted from a scratch copy of the app. Seed:--seed-admin(admin@objectos.ai) + showcase seed 132 rows. Walled leg: the same boot withOS_TENANCY_POSTURE=isolated,OS_PLATFORM_OWNER_EMAIL,OS_AUTH_MEMBERSHIP_POLICY=invite-only. - Tier 1: every framework file named in the items'
automated.ref, one vitest invocation per owning package at--maxWorkers=1, serialised across runners with a file lock; the Playwright pinexamples/app-showcase/e2e/showcase-smoke.spec.tsran against a live boot withOS_TEST_CHROMIUM_EXECUTABLE_PATH=/opt/pw-browsers/chromium. - Fixtures provisioned by the runners: v17 SQLite from npm
@objectstack/cli@17.7.0(os start, real 17.x shape); local Postgres 16 (scram-sha-256) for the datasource matrix; personas minted by invite + sign-up or admin create-user + change-password. - date: 2026-10-25 (UTC), container Linux 4 vCPU / 15 GB; runner: one orchestrator + 5 runner subagents in parallel (api ×2, cli ×1, browser/mixed ×2).
Scope
Selector priority:P0 resolved with node scripts/checklist-select.mjs priority:P0 --json → 23 runnable items; 1 blocked item hidden and not run (access-security.no-active-org-session-semantics, --include-blocked not passed); 0 planned items matched. Every item the selector returned has a verdict. Item · surface · revision · derived verdict:
| item | surface | rev | verdict |
|---|---|---|---|
| access-security.rls-both-sides | api | 7 | PARTIAL |
| access-security.write-path-guards | api | 6 | PASS |
| access-security.crud-permission-matrix | api | 7 | PARTIAL |
| access-security.owd-sharing-matrix | api | 4 | PASS |
| access-security.anonymous-deny-surfaces | api | 3 | PASS |
| access-security.walled-environment-metadata-operator-only | api | 5 | PARTIAL |
| ai.mcp-stdio-fail-closed | cli | 6 | PASS |
| api-backend.query-contract-matrix | api | 5 | PASS |
| api-backend.packaged-action-disabled-dispatch | api | 7 | PASS |
| approvals.account-app-entry | browser | 4 | PASS |
| automation.packaged-flow-disable-durable | api | 5 | PASS |
| cli.dev-boot-contract | cli | 7 | PASS |
| cli.organization-ownership-ceremony | cli | 4 | PARTIAL |
| identity-auth.default-organization-boot-invariant | api | 2 | PASS |
| integration-system.datasource-credential-refusal-matrix | mixed | 5 | PASS |
| platform-core.boot-health | mixed | 9 | PASS |
| platform-core.seed-integrity | api | 4 | PASS |
| platform-core.console-login | browser | 4 | PASS |
| platform-core.nav-surfaces-render | browser | 6 | PASS |
| platform-core.builtin-apps-nav-render | browser | 7 | PASS |
| platform-core.v18-boot-refusals | cli | 6 | PASS |
| records-forms.crud-roundtrip | browser | 13 | PASS |
| studio-authoring.first-run-loop | mixed | 6 | PASS |
Per-clause verdicts
Clause ids are 0-based over acceptance[]; N0… are negative[]. Evidence is text server truth (API / log / build / test output); a screenshot oracle is described in one line. Pins name the layer they reach (RUNNER rule 6).
| item | clause | verdict | evidence |
|---|---|---|---|
| access-security.rls-both-sides | 0 | pass | live :41101 — A list 200 titles [A note 2, A note 1] (no B), B list 200 [B note 1] (no A); identities proven by get-session |
| access-security.rls-both-sides | 1 | pass | A GET /data/showcase_private_note/‹B id› → 404 RECORD_NOT_FOUND (not-found-shaped denial) |
| access-security.rls-both-sides | 2 | pass | A PATCH ‹B id› {body:forged} → 404 RECORD_NOT_FOUND; admin re-read body=original-b, record JSON byte-identical (updated_at unchanged) |
| access-security.rls-both-sides | 3 | pass | admin GET list 200 n=3, contains A1, A2, B1 ids |
| access-security.rls-both-sides | 4 | pass | objectstack verify --rls (showcase, in-process HTTP): per-persona line "21 PROVEN (21 consistent, 0 HOLES) · 3 NOT PROVEN"; total line "all personas: 38 PROVEN (38 consistent, 0 HOLES) · 226 NOT PROVEN [unit: object ×… |
| access-security.rls-both-sides | 5 | blocked(dependency: the D11 judgement needs the private write-up named in knownGaps, #7463) | skipped half explainable: project_membership "no plain-text probe field", ext_customer/ext_order "external read-only"; hand spot-check of project_membership: baseline member GET/PATCH/list 403, row unchanged — D11 judge… |
| access-security.rls-both-sides | N0 | pass | forged PATCH answered 404 and admin re-read unchanged — no silent 2xx, no mutated row |
| access-security.rls-both-sides | N1 | pass | D11 verdict carried on this item only (acceptance[5]); owd-sharing-matrix A4 cross-references, not double-counted |
| access-security.rls-both-sides | N2 | pass | procedural: cited by item+clause only, bare handle not restated |
| access-security.write-path-guards | 0 | pass | admin POST contact {lead_score:10} → 201, header x-objectstack-dropped-fields "lead_score;reason=readonly", body droppedFields [{fields:[lead_score],reason:readonly}], GET lead_score=null |
| access-security.write-path-guards | 1 | pass | PATCH {lead_score:99} → 200 with dropped header readonly; GET lead_score still null (before=after) |
| access-security.write-path-guards | 2 | pass | Alice POST note owner_id=Bob → 403 PERMISSION_DENIED "owner_id … system-managed … requires the transfer grant"; admin filtered count title=planted total=0 |
| access-security.write-path-guards | 3 | pass | Alice self-owner POST 201 owner_id=Alice; PATCH owner_id=Bob 403, owner_id=null 403; re-read owner_id=Alice |
| access-security.write-path-guards | 4 | pass | Alice createMany bare array of 3 → 201; all 3 owner_id==Alice [true,true,true]; {records:[…]} wrapper → 400 VALIDATION_FAILED |
| access-security.write-path-guards | 5 | pass | paid invoice PATCH tax_rate → 200, header tax_rate;reason=readonly_when, re-read 5; paid line PATCH qty/price/product → dropped readonly_when, re-read unchanged; mixed updateMany: locked row results[0].droppedFields [qu… |
| access-security.write-path-guards | 6 | pass | updateMany continueOnError:true over [21, -5, 41] → succeeded 2 failed 1, row1 VALIDATION_FAILED "Qty must be ≥ 0"; re-read 21,3,41; default run → row2 NOT_ATTEMPTED, re-read 22,3,41 (stop shape also captured) |
| access-security.write-path-guards | N0 | pass | ADMIN insert owner_id=Bob 201 (persisted Bob); ADMIN transfer Alice→Bob 200 (re-read Bob) |
| access-security.write-path-guards | N1 | pass | pins packages/objectql engine-insert-static-readonly-strip ("isSystem seeds the readonly column") + engine-readonly-strip-caller-values ("an isSystem caller is untouched") — 2 files 55/55 passed, layer: engine (real Obj… |
| access-security.crud-permission-matrix | 0 | pass | live :41101 port of the pin over 41 showcase_* rows × 4 verbs: 87 allow cells all ‹300 with effect (create re-readable, edit re-reads changed, delete gone); 9 baseline-flip cells allowed; delegate sys_user_position C/R/… |
| access-security.crud-permission-matrix | 1 | pass | 77 deny cells: all "403 PERMISSION_DENIED" (77/77); delegate sys_* deny cells 403 PERMISSION_DENIED; sys_user create/delete → 405 OBJECT_API_METHOD_NOT_ALLOWED for delegate, plain AND admin |
| access-security.crud-permission-matrix | 2 | pass | every denied create: admin filtered count by marker = 0 (left=0 on all deny-create cells) |
| access-security.crud-permission-matrix | 3 | pass | auditor byId 200 + list contains foreign private_note/inquiry (plain-owned) and invoice/line (admin-owned); contributor byId 404 + list excludes, for all four |
| access-security.crud-permission-matrix | 4 | pass | ops PATCH admin-owned announcement 200 persisted; member_default identical PATCH 403 PERMISSION_DENIED, row unchanged |
| access-security.crud-permission-matrix | 5 | blocked(fixture: knownGaps[2], guest anchor ships unbound) | guest anchor ships unbound; a member holding guest_portal reads inquiries via baseline (measured POST 201 + GET own 200 — union, as knownGaps predicts) |
| access-security.crud-permission-matrix | 6 | pass | matrix 45 rows: 41 showcase_* rows = 164 cells (87 allow / 77 deny after union) driven for 8 sets + 4 field_ops_delegate × sys_* rows (16 cells) driven by hand = all 9 variants, one verdict per cell |
| access-security.crud-permission-matrix | N0 | pass | one denied cell per set run as admin: auditor inquiry.edit 200, client_liaison client_brief.delete 200, contributor account.create 201, executive inquiry.edit 200, guest_portal announcement.create 201, manager contact.c… |
| access-security.crud-permission-matrix | N1 | pass | 0 withheld cells answered 2xx (bad=0 over 164 cells + 16 delegate cells) |
| access-security.owd-sharing-matrix | 0 | pass | private: B list excludes A note; B GET 404, B PATCH 404; admin re-read body=orig; A GET own 200, A PATCH own 200 |
| access-security.owd-sharing-matrix | 1 | pass | public_read: B list contains admin announcement, B GET 200; B forged PATCH 403 PERMISSION_DENIED, admin re-read title unchanged |
| access-security.owd-sharing-matrix | 2 | pass | ops PATCH same foreign announcement 200, re-read title "ops-edit …" |
| access-security.owd-sharing-matrix | 3 | pass | public_read_write: C1 (contributor) PATCH admin project 200, re-read name changed; A (member_default) PATCH 403 PERMISSION_DENIED, name unchanged |
| access-security.owd-sharing-matrix | 4 | pass | cbp: C2 list excludes C1 line, C2 GET 404, C2 PATCH 404 + admin re-read unchanged (same updated_at); C1 list includes, GET 200, PATCH 200 re-read "c1 own" (D11 verdict carried on rls-both-sides A5 per dedupe rule) |
| access-security.owd-sharing-matrix | 5 | pass | auditor list showcase_invoice_line contains C1 line; auditor GET by id 200 |
| access-security.owd-sharing-matrix | 6 | pass | all four models driven per persona-verb (private/public_read/public_read_write/controlled_by_parent); pins 4 files 16/16 (HTTP, verify harness) |
| access-security.owd-sharing-matrix | N0 | pass | public_read foreign PATCH forged as direct request → 403, row unchanged |
| access-security.owd-sharing-matrix | N1 | pass | C2 line probes repeated as C1: list true, GET 200, PATCH 200 — route works, denial is derivation |
| access-security.anonymous-deny-surfaces | 0 | pass | anonymous 401 code UNAUTHENTICATED on /data, /meta, /actions, /automation/_status, /batch, /security/explain, /analytics query|sql|meta (12/12 probes incl. malformed + DELETE) |
| access-security.anonymous-deny-surfaces | 1 | pass | POST /actions/showcase_task/showcase_mark_done/anon-probe-id → 401 (member gets 404 RECORD_NOT_FOUND on same path) |
| access-security.anonymous-deny-surfaces | 2 | pass | each body matched exactly one family: rest-flat for data/meta/batch/security; dispatcher-wrapper for actions/automation/analytics×3 |
| access-security.anonymous-deny-surfaces | 3 | pass | analytics anon: query/sql/meta 401, malformed query/sql 401; member: query 200 (count rows), sql 200, meta 200, malformed → 400 VALIDATION_FAILED |
| access-security.anonymous-deny-surfaces | 4 | pass | member GET /data/showcase_private_note 200, GET /meta 200 |
| access-security.anonymous-deny-surfaces | 5 | pass | anonymous GET /api/v1/forms/contact-us → 200 (form body, object showcase_inquiry) |
| access-security.anonymous-deny-surfaces | 6 | pass | all 7 variant families probed live; pin showcase-anonymous-deny-surfaces 74/74 (HTTP, verify harness) |
| access-security.anonymous-deny-surfaces | N0 | pass | anonymous DELETE /automation/showcase_reassign_wizard → 401 dispatcher-wrapper; authed GET afterwards 200 (flow present) |
| access-security.walled-environment-metadata-operator-only | 0 | pass | pins at 6679644: rest meta-migrate-stored-walled-refusal 6/6; runtime packages-walled-write-refusal + automation-walled-definition-write + meta-walled-catalog-refusal 3 files 61/61 (plugin-unit/dispatcher-domain layer)… |
| access-security.walled-environment-metadata-operator-only | 1 | blocked(fixture: org-scoped manage_metadata grant not placeable through any HTTP door) | walled :41102 booted (Tenancy: isolated, Organizations mounted); org owner minted (create-user) + own org created; manage_metadata grant row not placeable: operator data-door insert 403 "outside the caller's organizatio… |
| access-security.walled-environment-metadata-operator-only | 2 | pass | walled :41102 operator PUT /meta/object/qa_walled_probe 200 "Saved … env-wide", read-back 200, deleted → 404; single :41101 admin PUT /meta/object/qa_single_probe 200, read-back 200, deleted |
| access-security.walled-environment-metadata-operator-only | N0 | blocked(fixture: same grant gap as clause 1) | needs the manage_metadata-holding org owner (same fixture gap); supplemental: organization_admin owner refused 403 on PUT object, PUT permission, publish, DELETE /packages, clone, _migrate-stored, POST /automation, noth… |
| ai.mcp-stdio-fail-closed | 0 | pass | os start, OS_MCP_STDIO_ENABLED=true, no key: exit 1, 0 stdout bytes, health never 200; stderr '[MCP] The stdio transport is enabled (OS_MCP_STDIO_ENABLED / autoStart) but OS_MCP_STDIO_API_KEY is not set. … Refusing to s… |
| ai.mcp-stdio-fail-closed | 1 | pass | osk_unknown: exit 1 '[MCP] OS_MCP_STDIO_API_KEY did not resolve to a valid identity (unknown / revoked / expired / owner-less). Refusing to start stdio (ADR-0101).'; key revoked over PATCH sys_api_key (osk_wZOqlBLZ…): e… |
| ai.mcp-stdio-fail-closed | 2 | pass | INFO '[MCP] stdio transport principal-bound to OS_MCP_STDIO_API_KEY identity XGqq2jEnM1CdkzaaZYwzSyQ07wPvKIoc (RLS/FLS/tenant applied)' = contributor's sys_user id (liaison session: DujY6PHx…) |
| ai.mcp-stdio-fail-closed | 3 | pass | RLS (contributor key): MCP query_records showcase_invoice 2 rows INV-QAC-1/2 = REST GET 2 rows, identical 18-field set; get_record INV-1003 (linus) MCP isError 'Record … not found' / REST 404 RECORD_NOT_FOUND / admin RE… |
| ai.mcp-stdio-fail-closed | 4 | pass | count by status: MCP member rows [{draft:2}] = REST member POST /data/showcase_invoice/query [{draft:2}]; REST admin [{draft:4},{paid:5},{sent:5}] (member strictly lower) |
| ai.mcp-stdio-fail-closed | 5 | pass | liaison MCP aggregate_records sum(budget), count_distinct(spent), count groupBy budget: isError, {code PERMISSION_DENIED, status 403, message "[Security] Field read denied: not permitted to aggregate [budget|spent] on … |
| ai.mcp-stdio-fail-closed | 6 | pass | same stdio session: pre-revoke query_records 2 rows; admin PATCH /api/v1/data/sys_api_key/w0D4233Kc6zXITyA {revoked:true} 200; next query_records isError, content parses {error:{code:'API_KEY_REVOKED',status:403,…}}, 0 … |
| ai.mcp-stdio-fail-closed | 7 | pass | os start with neither var (env checked: 0 OS_MCP vars): health 200, INFO '[MCP] Transport not auto-started (HTTP is served per-request at /api/v1/mcp regardless). …' |
| ai.mcp-stdio-fail-closed | N0 | pass | no keyless/unknown/revoked/empty/whitespace-key start ever served (all exit 1, health 000) |
| ai.mcp-stdio-fail-closed | N1 | pass | MCP member rows == REST member rows (2 vs 2, INV-1003 hidden on both) |
| ai.mcp-stdio-fail-closed | N2 | pass | MCP member count 2 ≠ admin total 14 |
| ai.mcp-stdio-fail-closed | N3 | pass | every aggregate naming budget/spent refused, no numeric result |
| ai.mcp-stdio-fail-closed | N4 | pass | post-revoke read 0 rows and carries API_KEY_REVOKED |
| api-backend.query-contract-matrix | 0 | pass | 27 operator variants (eq,ne,gt,gte,lt,lte incl. 12M/8M boundaries & dates, in,not_in,between incl. inclusive ends, contains,not_contains,starts_with,ends_with, like x3 incl. no-wildcard=0 rows (not auto-wrapped), is_nul… |
| api-backend.query-contract-matrix | 1 | pass | orderby name windows (3,2),(4,8),(5,12): GET $top/$skip, POST limit/offset, POST top/skip all equal locally sorted slice (e.g. [Fabrikam,Globex,Hooli]); last window hasMore:false |
| api-backend.query-contract-matrix | 2 | pass | $select=name,status and fields:[name,status] → every record key set exactly {name,status} (no id), n=14; fields:[account.name] on showcase_invoice → 400 INVALID_FIELD, message "Read the related record with 'expand' (exp… |
| api-backend.query-contract-matrix | 3 | pass | annual_revenue asc+desc full 14-value sequence equals local sort on GET "$orderby=f dir", GET "-f", POST orderBy; $orderby=no_such_field and POST orderBy no_such_field → 400 INVALID_SORT |
| api-backend.query-contract-matrix | 4 | pass | LIVE (HTTP): contributor-bound member (admin create-user + sys_user_position contributor) POST showcase_invoice/query expand contact{fields:[name]} → 200, own invoice INV-QA-B-EXPAND returned, contact left as raw FK id … |
| api-backend.query-contract-matrix | 5 | pass | POST {status:{$nin:"done"}} → 400 VALIDATION_FAILED fields[0].field=query.where.status.$nin msg names $nin, status, ARRAY; POST AST [status,not_in,done] → 400 VALIDATION_FAILED fields[0].field=query.where (same text); G… |
| api-backend.query-contract-matrix | 6 | pass | GET ?$pageSize=5 → 400 UNSUPPORTED_QUERY_PARAM listing $top,$skip,$orderby,$select,$count,$search,$searchFields,$filter,$expand; GET ?not_a_field=x → 400 INVALID_FIELD; POST where not_a_field $eq and $ne, GET $filter no… |
| api-backend.query-contract-matrix | 7 | pass | POST where status $in [] → 200 rows=0; $nin [] → 200 rows=10 (= full task baseline) |
| api-backend.query-contract-matrix | 8 | pass | run record /tmp/qa-t1/B/matrix-1.json has a row per variant: 16 op variants (27 rows incl. extra boundaries) + params $top,$skip,$select,$orderby,$filter (above), $count (total=14 with $top=2), $search (Northwind→[North… |
| api-backend.query-contract-matrix | N0 | pass | POST {limit:"ten"} → 400 VALIDATION_FAILED field query.limit; POST {not_a_query_key:{…}} → 400 INVALID_FIELD; neither returned rows (no full-table 200) |
| api-backend.packaged-action-disabled-dispatch | 0 | pass | POST /actions/showcase_task/showcase_mark_done {recordId:no-such-record-0000} (disabled) → 409 ACTION_DISABLED "…switched off for this installation in the packaged-metadata activation ledger (sys_metadata_activation, AD… |
| api-backend.packaged-action-disabled-dispatch | 1 | pass | param_gallery disabled + {params:{bogus_key:1},recordId:bogus} → 409 ACTION_DISABLED; re-enabled identical request → 400 VALIDATION_ERROR "Invalid action params: Action param "p_text" is required; Unknown action param… |
| api-backend.packaged-action-disabled-dispatch | 2 | pass | disabled traces (mark_done, param_gallery) 409 with nonexistent recordId; corroboration: enabled mark_done same id → 404 RECORD_NOT_FOUND (stock boot, before flip) |
| api-backend.packaged-action-disabled-dispatch | 3 | pass | showcase_zoo_perm_missing enabled → 403 PERMISSION_DENIED "requires capability [showcase.restricted_ops]"; disabled → 403, bodies byte-identical (true); contributor persona also 403 when disabled |
| api-backend.packaged-action-disabled-dispatch | 4 | pass | LIVE MCP POST /api/v1/mcp tools/call run_action {actionName:showcase_portfolio_snapshot}: enabled → ok; disabled → isError:true, {code:ACTION_DISABLED,status:409}, message === REST /actions/global/… 409 message (strict … |
| api-backend.packaged-action-disabled-dispatch | 5 | pass | after cold restart (same action.db): ledger rows rehydrated; mark_done real id → 409 ACTION_DISABLED, task unchanged (done:false,progress:45); re-enable → 200, invoke → 200 operation update, task done:true progress:100;… |
| api-backend.packaged-action-disabled-dispatch | 6 | pass | showcase_bulk_reassign (type flow) disabled → 409 ACTION_DISABLED naming showcase_bulk_reassign (pre- and post-restart); showcase_reassign_wizard runs list empty ([]) — automation never ran |
| api-backend.packaged-action-disabled-dispatch | N0 | pass | no disabled invocation answered 400/handler/record shape (all 409); enabled control 400 proves params enforced only when enabled |
| api-backend.packaged-action-disabled-dispatch | N1 | pass | unentitled caller got 403 (never 409) in both states; stock boot with empty ledger (total 0): enabled mark_done answered 404 RECORD_NOT_FOUND, not ACTION_DISABLED |
| api-backend.packaged-action-disabled-dispatch | N2 | pass | anonymous POST /actions/showcase_task/showcase_mark_done and POST /actions/_activation/… → 401 UNAUTHENTICATED |
| approvals.account-app-entry | 0 | pass | dist/.objectui-sha = .objectui-sha = b41ed7f…; grep dist/assets/index-B3gsloWY.js: ts({ref:approvals:inbox,label:Approvals Inbox,source:@object-ui/console,component:…Suspense…}) |
| approvals.account-app-entry | 1 | pass | nav click landed /_console/apps/com.objectstack.account/component/approvals/inbox; screenshot: 'Approvals Inbox', tabs My Pending 1 / Submitted by me / All, row INV-QA-APPR-D2 Pending, keyboard hint bar. Drawer is repla… |
| approvals.account-app-entry | 2 | pass | persona (sys_member role member; positions contributor+finance) GET /api/v1/meta/app → [showcase_app, account] (admin: +setup); ?id=setup → items []; account nav keeps component nav_account_approvals approvals:inbox |
| approvals.account-app-entry | 3 | pass | request page actions Approve/Reject/Reassign/Send back/Request info/…; Approve→Confirm POST …/approve 200; GET before {got:0,need:2, pending incl persona, viewer.can_act:true} after {got:1,need:2, pending [admin], can_a… |
| approvals.account-app-entry | 4 | pass | cold load …/component/approvals/inbox?request=areq_533b6ea8… → replaced to …/com.objectstack.account/sys_approval_request/record/areq_533b6ea8…, h1 'Invoice Dual Sign-off (parallel approval)', record INV-QA-APPR-D2 visi… |
| approvals.account-app-entry | 5 | pass | row link href /_console/apps/com.objectstack.account/showcase_invoice/record/EI8Y9BMETlOXDUk9 (current app segment); persona GET record 200; click rendered invoice in Account app |
| approvals.account-app-entry | 6 | pass | avatar › Preferences › Language → 中文（中国）: nav '待我审批', tabs 待我审批/我发起的/全部, All-tab status badge '待审批' |
| approvals.account-app-entry | N0 | pass | no component-not-found/blank pane; full inbox rendered |
| approvals.account-app-entry | N1 | pass | Approvals entry present for non-admin; setup absent from same session's meta/app |
| automation.packaged-flow-disable-durable | 0 | pass | toggle {enabled:false} → 200 {enabled:false}; sys_metadata_activation: exactly 1 row metadata_type=flow name=showcase_urgent_task_alert package_id=com.example.showcase active=false id=cI1GYrYwi5HvxIh7; key set has no or… |
| automation.packaged-flow-disable-durable | 1 | pass | POST /automation/showcase_urgent_task_alert/trigger → 409 FLOW_DISABLED "Flow 'showcase_urgent_task_alert' is disabled — it is switched off for this installation in the packaged-metadata activation ledger (sys_metadata_… |
| automation.packaged-flow-disable-durable | 2 | pass | cold restart (process group killed, new server same flow.db, --log-level info): /_status {enabled:false,bound:false}; boot log "[Automation] Activation ledger: 1 packaged flow(s) are switched off for this installation a… |
| automation.packaged-flow-disable-durable | 3 | pass | runs list 1 before and 1 after post-restart urgent create (and 1 after a low→urgent escalation PATCH); baseline pre-toggle create had produced run_e75b77c9… completed |
| automation.packaged-flow-disable-durable | 4 | pass | re-enable → 200; row cI1GYrYwi5HvxIh7 (same id) active:true, created_at 14:34:09 kept, updated_at 14:35:13; /_status enabled+bound true; final urgent create → runs 2, newest trigger.recordId = the new task, status compl… |
| automation.packaged-flow-disable-durable | N0 | pass | 2xx toggle was accompanied by the ledger row (1 row) — no ledger-less write |
| automation.packaged-flow-disable-durable | N1 | pass | post-restart enabled:false bound:false and no run row from post-restart create |
| automation.packaged-flow-disable-durable | N2 | pass | re-enable kept the row (same id, read by id 200) |
| automation.packaged-flow-disable-durable | N3 | pass | 409 message carries "packaged-metadata activation ledger (sys_metadata_activation" phrasing, not the bare status sentence |
| cli.dev-boot-contract | 0 | pass | health 200 after 7 polls; GET /api/v1/ready 200 {status:'ready',state:'running'} |
| cli.dev-boot-contract | 1 | pass | sign-in admin@objectos.ai/admin123 200 (wrong pw 401); restart same DB with --admin-password changed99: admin123 → 200, changed99 → 401 |
| cli.dev-boot-contract | 2 | pass | Database lines: -d file → file:/tmp/qa-t1/C/dev.db; -d :memory: → :memory:; OS_DATABASE_URL → file:/tmp/qa-t1/C/env.db; config default (named qa_home + datasourceMapping default) → file:‹proj›/.objectstack/data/qa_home.… |
| cli.dev-boot-contract | 3 | pass | '🧪 Fresh OS_HOME: /tmp/objectstack-dev-NZR6hK', Database file:/tmp/objectstack-dev-NZR6hK/data/objectstack.db; dir gone after SIGINT (exit 130) and a second run after SIGTERM (exit 143); cwd .objectstack/data/showcase_… |
| cli.dev-boot-contract | 4 | pass | instance B: '↪ server bound to port 41302 (requested 41301)', API/Console URLs printed with 41302, health on 41302 = 200; SIGINT → exit 0 |
| cli.dev-boot-contract | 5 | pass | '⚠ dist/objectstack.json is OLDER than your sources — this boot serves the STALE build. newest source: src/coverage.ts (15m newer than the artifact) fix: run objectstack build or start with --compile…' then health 2… |
| cli.dev-boot-contract | 6 | pass | empty dir: exit 1; stdout '✗ Config file not found in /tmp/qa-t1/C/noconf'; stderr 'Run in a directory with objectstack.config.ts, pass --artifact ‹path|url›, or run from the monorepo root.' |
| cli.dev-boot-contract | 7 | pass | dist stamp = pin b41ed7f; GET /_console/ 200 text/html → redirected to /_console/login; screenshot showed the ObjectOS 'Welcome back' sign-in card (email, password, Sign In, 'Sign in as dev admin') |
| cli.dev-boot-contract | N0 | pass | nothing-chosen boot persisted to unified file; QA probe task read back after restart |
| cli.dev-boot-contract | N1 | pass | --database-driver memory exit 2 (oclif allowlist); OS_DATABASE_DRIVER=memory|mingo|in-memory exit 1, 0 Database lines, text names --fresh and :memory:; -d memory:// and mingo:// exit 1 after 'Database: memory://' nami… |
| cli.dev-boot-contract | N2 | pass | legacy dev.db read with notice; no objectstack.db created beside it; QA probe row present |
| cli.dev-boot-contract | N3 | pass | shift reported (41302) in both the ↪ line and the URLs |
| cli.organization-ownership-ceremony | 0 | pass | @ 6679644, --maxWorkers=1: packages/cli apply-flags 7, organization-ownership-apply 112, occupancy.integration 5, dialect 19, apply-organization-ownership-gate.integration 5, comment-reactions.integration 7, host-suppl… |
| cli.organization-ownership-ceremony | 1 | pass | plan on v17 copy exit 0, plan.json kind organization-ownership-plan, ceremony 'ADR-0131 D10', inventoryDigest 74c9ab1d…, 134 tables all with a fate (73 present); sha256 b4480ee1… before = after; --apply w/o --plan-file … |
| cli.organization-ownership-ceremony | 2 | pass | cG (v17 copy, refused boot first): --apply --plan-file --backup-taken exit 0, complete true, blocking 0, 13/13 steps done; sys_migration marker verified_at set, blocking 0, details.checkpoint.shapeGeneration 1 (= ORGANI… |
| cli.organization-ownership-ceremony | 3 | pass | unmigrated cA: os serve exit 1 'This database carries no organization-ownership marker…' naming os migrate organization-ownership --out PLAN and the apply, no 17.x advice; migrated cE: '✓ Server is ready', health 200,… |
| cli.organization-ownership-ceremony | 4 | pass | fresh v17 copy cD: first run refused by the sibling gate refused_comment_reactions_unconverted (exit 1, applied 0, row diff 0); after comment-reactions --apply --yes ×2 (exit 0 both, 0 converted, verified): exit 1, mess… |
| cli.organization-ownership-ceremony | 5 | blocked(fixture: needs a showcase DB born under an 18.0.0-next.* build) | not consulted; an npm install of @objectstack/cli@18.0.0-next.5 resolved 18.1.0 deps and its DB carried an 18.1.0 birth marker, so it was discarded as evidence |
| cli.organization-ownership-ceremony | N0 | pass | plan runs (cB, cE, cG): checksum unchanged; refusals plan-file-required, backup-unacknowledged, plan-database-mismatch, existing --out: checksum unchanged; drop-gate refusals: row diff 0 |
| identity-auth.default-organization-boot-invariant | 0 | pass | @objectstack/plugin-auth ensure-default-organization.test.ts 57 passed (plugin unit); @objectstack/runtime identity-objects-default-organization.pin.test.ts 4 passed (real ObjectKernel+ObjectQL+DefaultDatasource = engin… |
| identity-auth.default-organization-boot-invariant | 1 | pass | fresh file DB, --log-level info: log line 919 "[default-org] created the Default Organization (org_mvnx8046nekgol14)" at 14:26:25.306 precedes line 1085 "Dev admin seeded" 14:26:29.738; sys_organization {id:org_mvnx8046… |
| identity-auth.default-organization-boot-invariant | 2 | pass | sys_member org=default: admin role owner, member2@qa-b.test (admin create-user) role member; get-session activeOrganizationId=org_mvnx8046nekgol14 for both (member2 before and after change-password); member2 isPlatformA… |
| identity-auth.default-organization-boot-invariant | 3 | pass | sys_business_unit 5 seeded rows (bu_acme,bu_east_coast,bu_field_ops,bu_hq_finance,bu_west_coast) all organization_id=org_mvnx8046nekgol14 |
| identity-auth.default-organization-boot-invariant | N0 | pass | 0 NULL organization_id on sys_business_unit; extra sweep on the seed boot: all 19 seeded objects, every row non-null org (single org id) |
| integration-system.datasource-credential-refusal-matrix | 0 | pass | 15 doors × build (os build per door: exit 2, no artifact, message names key + external.credentialsRef/credentialRef; encryptionKey names removal) and × runtime POST /api/v1/datasources (all 400 DATASOURCE_ADMIN_ERROR na… |
| integration-system.datasource-credential-refusal-matrix | 1 | pass | POST qa_pg_paved {host,port,database,username} secret→201 status ok; POST …/test {ok:true,tableCount:1}; remote-tables [probe]; PG password-auth proven (wrong pw → FATAL) |
| integration-system.datasource-credential-refusal-matrix | 2 | pass | admin door config {host,port,database,username} hasSecret:true; meta door same config + external.credentialsRef sys_secret:sec_41c7…; grep 'QaDsSecret-7781' 0 hits in both + lists + sys_metadata + sys_secret |
| integration-system.datasource-credential-refusal-matrix | 3 | pass | qa_pg_paved hasSecret:true vs qa_pg_nosecret hasSecret:false (same config, redactedConfigKeys [] both) |
| integration-system.datasource-credential-refusal-matrix | 4 | pass | planted (server stopped) rows passwd/pwd (pg), token/jwt (turso), auth_token (mysql), authtoken (mongodb), encryptionKey beside file: url; boot logged metadata_spec_invalid 'registered anyway'; admin door redactedConfig… |
| integration-system.datasource-credential-refusal-matrix | 5 | pass | driver qa_plugin_driver POST 201 (stored raw incl. password/authToken/url pw); both doors: url 'qadb://pluguser@127.0.0.1/x', password/authToken absent (redactedConfigKeys [authToken,password,url]); planted plugin row p… |
| integration-system.datasource-credential-refusal-matrix | 6 | pass | PATCH /api/v1/datasources/qa_pg_paved {config: admin-read config} 200; PUT 405; hasSecret still true, credentialsRef unchanged sys_secret:sec_41c7…; POST …/test ok:true tableCount 1 |
| integration-system.datasource-credential-refusal-matrix | 7 | pass | member (sys_member member): admin door 403 PERMISSION_DENIED, meta door 403, sys_metadata 403 on all 10 names + lists; anonymous: 401 everywhere; 0 planted hits; identities proven via get-session |
| integration-system.datasource-credential-refusal-matrix | N0 | pass | full-body greps across 3 doors × 3 personas: 0 cleartext hits; boot logs 0 hits |
| integration-system.datasource-credential-refusal-matrix | N1 | pass | every door refused at build AND runtime admin AND metadata write door — no disagreement |
| integration-system.datasource-credential-refusal-matrix | N2 | pass | metadata door redacts every planted key the admin door redacts |
| integration-system.datasource-credential-refusal-matrix | N3 | pass | all six alias spellings redacted |
| integration-system.datasource-credential-refusal-matrix | N4 | pass | unknown-driver canonical password/authToken/url-userinfo and aliases passwd/token redacted |
| integration-system.datasource-credential-refusal-matrix | N5 | pass | echoed config carries no mask; stored secret handle unchanged, connect ok |
| integration-system.datasource-credential-refusal-matrix | N6 | pass | every credential refusal names external.credentialsRef / auth.credentialRef; encryptionKey refusal names deletion (not a credential replacement case) |
| platform-core.boot-health | 0 | pass | curl /api/v1/health -› 200 {status:ok,version:18.1.0} at 12.3 s after launch (fresh DB, port 41401) |
| platform-core.boot-health | 1 | pass | GET /api/v1/ready -› 200 {status:ready,state:running} |
| platform-core.boot-health | 2 | pass | boot-window log (snapshot taken at first health 200, 51 lines): 0 ERROR lines, 0 ⚠ lines; Flows: '32 flow(s) 19 bound … · 8 draft' + two ℹ deployment-policy lines (showcase_task_due_reminder time_relative, showcase_sche… |
| platform-core.boot-health | 3 | pass | GET /api/v1/meta/app?id=showcase_app (admin bearer) -› 200 {type,items[1]}; item keys name,label,icon,branding,active,isDefault,navigation,_packageId,_packageVersion,_provenance,_diagnostics; no-query list = showcase_ap… |
| platform-core.boot-health | 4 | pass | diff authored src/ui/apps/index.ts (57 nav ids) vs served navigation: authored-not-served = []; grp_data served = showcase_project,task,account,contact,invoice,expense_report,product,team,category,business_unit,field_zo… |
| platform-core.boot-health | 5 | pass | GET /_console/ -› 200 text/html; charset=utf-8, ‹base href="/_console/"› shell HTML |
| platform-core.boot-health | N0 | pass | no SeedLoader rejection/dropped line in boot log; ready banner 'Seeds: com.example.showcase 132 rows' (no ⚠, no N ok / M errors) |
| platform-core.boot-health | N1 | pass | health 200 with 0 ERROR lines in the boot window (cut at the health-green instant); post-window log also 0 ERROR after probes |
| platform-core.seed-integrity | 0 | pass | 19 datasets, expected counts from src/data/seed/index.ts (loaded via tsx; equals dist/objectstack.json) vs GET ?$top=1 total: 19/19 equal, 132=132 (account 14, contact 32, inquiry 3, product 4, project 5, task 10, categ… |
| platform-core.seed-integrity | 1 | pass | Specimen — Full: 21 scalar fields equal; f_multiselect/f_checkboxes/f_tags/f_vector set-equal; f_json,f_location,f_address,f_composite,f_repeater,f_record structurally equal; f_lookup = Northwind id, f_lookups = {Northw… |
| platform-core.seed-integrity | 2 | pass | banner "Seeds: com.example.showcase 132 rows" (no ⚠/error/lost-link); info "[Seeder] Seed loading complete {inserted:132,updated:0,skipped:0,errored:0}"; 0 "dropped record" lines |
| platform-core.seed-integrity | 3 | pass | restart same seed-integrity.db: "[Seeder] Seed loading complete {inserted:0,updated:0,skipped:132,errored:0}"; second sweep diff vs first: 0 rows differ |
| platform-core.seed-integrity | 4 | pass | expected-absent: f_user null, f_users null, f_secret null; showcase_task.cover null on all 10 rows |
| platform-core.seed-integrity | N0 | pass | no seeded object reads 0 (min 1: showcase_preference) |
| platform-core.seed-integrity | N1 | pass | no count grew on restart (132 → 132) |
| platform-core.console-login | 0 | pass | form sign-in (Playwright fill + submit) -› POST /api/v1/auth/sign-in/email 200 + set-auth-token; landed /_console/home; screenshot: header + 'Your apps' launcher (Showcase tile), no sidebar (by design); main 'Good after… |
| platform-core.console-login | 1 | pass | after reload URL stays /_console/home; first authed calls GET /api/v1/auth/get-session 200 (bearer), /discovery 200; in-page GET /api/v1/meta/app?id=showcase_app -› 200 items=[showcase_app] |
| platform-core.console-login | 2 | pass | POST /api/v1/auth/sign-out (bearer) -› 200 {success:true}; same bearer (still in localStorage) GET /api/v1/meta/app?id=showcase_app -› 401 UNAUTHENTICATED; get-session -› 401 (2/2 runs) |
| platform-core.console-login | 3 | pass | full navigation after expiry -› redirected to /_console/login?redirect=%2Fapps%2Fcom.example.showcase%2Fshowcase_task, login form shown (screenshot); in-shell client nav after expiry -› data region shows named 'Sign in … |
| platform-core.console-login | 4 | pass | re-sign-in 200 -› returned to /_console/apps/com.example.showcase/showcase_task (same route); meta/app 200, meta/object 200, meta/view 200; fresh read GET /api/v1/data/showcase_task -› 200 {object,records,total,hasMore}… |
| platform-core.console-login | N0 | pass | wrong password -› 401 {code:INVALID_EMAIL_OR_PASSWORD}, no set-cookie, no set-auth-token; UI alert 'Invalid email or password. Please try again.'; cookies [] and localStorage token null after (2/2) |
| platform-core.console-login | N1 | pass | no dead shell observed: server 401s every authed call after sign-out and the console either redirects to login (navigation) or shows the named sign-in-required state (in-shell nav) |
| platform-core.nav-surfaces-render | 0 | pass | layer: real Chromium against live HTTP boot :41404 (pin = oracle layer). flock … SMOKE_API_URL=http://localhost:41404 OS_TEST_CHROMIUM_EXECUTABLE_PATH=/opt/pw-browsers/chromium playwright test e2e/showcase-smoke.spec.ts… |
| platform-core.nav-surfaces-render | 1 | pass | served meta/app?id=showcase_app leaves 49 (page 25/object 17/dashboard 3/report 4) mapped to console paths vs SURFACES 49: served-not-in-SURFACES [] , SURFACES-not-served []; rendered sidebar (all groups expanded) 50 hr… |
| platform-core.nav-surfaces-render | 2 | pass | /_console/apps/com.example.showcase/object_that_does_not_exist: screenshot shows shell (header + sidebar) alive; main = 'Object Not Found — The object "object_that_does_not_exist" does not exist in the current configura… |
| platform-core.nav-surfaces-render | 3 | pass | none encountered: 49/49 smoke + 1 hand-walk + 6 bad-route probes (object/page/dashboard/report/view/record not-found) all rendered named states inside the shell; ErrorBoundary fallback never triggered, 0 pageerrors |
| platform-core.nav-surfaces-render | N0 | pass | no blank ‹main› on any of 50 surfaces (smoke mainText›0 assertion 49/49 + hand-walk) |
| platform-core.nav-surfaces-render | N1 | pass | smoke at this revision refuses [data-boot-splash] and both English splash lines; 49/49 past splash; pin b41ed7f is after objectui 54159d3 (marker present) |
| platform-core.nav-surfaces-render | N2 | pass | bad route kept header + sidebar; no white page |
| platform-core.nav-surfaces-render | N3 | pass | chart assertions polled (pollUntil, SURFACE_BUDGET_MS 25000); no chart red to classify |
| platform-core.builtin-apps-nav-render | 0 | pass | admin, groups expanded (Advanced/Developer included): Setup 43 sidebar hrefs (42 served + 'reports') and Account 9 (8 + 'reports') walked, screenshot-first: 0 pageerror, 0 blank main, 0 placeholder, 0 boundary; Browse M… |
| platform-core.builtin-apps-nav-render | 1 | pass | admin ?id=setup: 9 anchors group_overview/apps/people_org/access_control/approvals/configuration/diagnostics/integrations/advanced, 42 leaves; vs source (setup-nav.contributions.ts + security/sharing/approvals/webhooks/… |
| platform-core.builtin-apps-nav-render | 2 | pass | member Mei (positions org_member,everyone; isPlatformAdmin false): /_console/apps/com.objectstack.setup and /apps/setup -› named 'You don't have access to this app — This app exists, but your account is not authorized…'… |
| platform-core.builtin-apps-nav-render | 3 | pass | forged member GET /api/v1/meta/app?id=setup -› 200 {items:[]}; GET /api/v1/meta/app/setup and /meta/app/com.objectstack.setup -› 403 PERMISSION_DENIED; member no-query list = showcase_app,account |
| platform-core.builtin-apps-nav-render | 4 | pass | member ?id=setup -› items:[] so nav_api_keys + manage_platform_settings settings URLs unreachable; CONTROL: admin vs member ?id=account navigation JSON byte-identical (8 vs 8 leaves), carries no permission-gated entries |
| platform-core.builtin-apps-nav-render | 5 | pass | nav_organizations (requiresService org-scoping) absent; /auth/config tenancyPosture single, multiOrgEnabled false; nav_business_units present and sys_business_unit registered (meta 200, data 200) |
| platform-core.builtin-apps-nav-render | 6 | pass | no sys_verification/sys_device_code/sys_sso_provider/sys_jwks entry in setup or account payloads; /auth/config features.sso false (SSO absent per knownGap); sys_jwks data 404 OBJECT_API_DISABLED (why it is not in nav); … |
| platform-core.builtin-apps-nav-render | N0 | pass | 0 blank ‹main› / placeholder across 52 admin destinations; the one 'Failed to load' is the named marketplace egress state with its own error panel and Retry |
| platform-core.builtin-apps-nav-render | N1 | pass | member never obtained Setup: app routes refused, meta/app/setup 403, ?id=setup empty; console system routes /apps/setup/system/settings/‹ns› are refused per-namespace server-side (403 SETTINGS_FORBIDDEN requires setup.a… |
| platform-core.builtin-apps-nav-render | N2 | pass | member payloads carry no Setup entries at all; account entries identical to admin and every one rendered for the member (profile, sessions/mine 4 own rows, api_keys/mine empty state) |
| platform-core.v18-boot-refusals | 0 | pass | @ 6679644: packages/runtime organization-ownership-boot-guard.test.ts 22 passed + .kernel.test.ts 10 passed (engine layer, real kernel+SQLite); packages/plugins/plugin-security authz-identity-objects-boot-refusal.test.… |
| platform-core.v18-boot-refusals | 1 | pass | os serve (OS_DATABASE_URL=file:cA.db, 17.7.0-born) exit 1, 0 ready/listening lines; '✗ This database carries no organization-ownership marker: … sys_audit_log, sys_job, sys_job_queue, sys_job_run, sys_metadata, sys_meta… |
| platform-core.v18-boot-refusals | 2 | pass | node:sqlite row diff: 74 pre-existing tables, 144 rows before/after, 0 row/value/column differences, 0 tables dropped; 40 tables created, all 0 rows; additive columns on 41 tables; marker read → no row |
| platform-core.v18-boot-refusals | 3 | pass | live rig: scratch stack plugins [new SecurityPlugin()], tiers ['core'], os serve --dev --no-server --preset minimal → exit 1 '✗ SecurityPlugin cannot boot: … does not register sys_user, sys_member … mount createIdenti… |
| platform-core.v18-boot-refusals | N0 | pass | v18 serve never served the v17 copy; row diff zero |
| records-forms.crud-roundtrip | 0 | pass | form POST /api/v1/data/showcase_account 201 body {industry:finance,status:active,sales_region:amer,name:os-qa-d2a}; filtered GET total 1 echoes every key verbatim, website null (not defaulted) |
| records-forms.crud-roundtrip | 1 | pass | UI Edit→Save sent one PATCH body {annual_revenue:1234567} 200; full-row before/after diff = annual_revenue null→1234567 + updated_at stamp only |
| records-forms.crud-roundtrip | 2 | pass | row-menu Delete → confirm dialog 'Delete Account "os-qa-d2a"?' → DELETE 200; filtered GET total 0; reloaded list shows no os-qa-d2a (16 records) |
| records-forms.crud-roundtrip | 3 | pass | screenshot after full reload: create showed os-qa-d2a with Active/Finance chips (15 records); after delete row absent (16 incl. CJK+clone); detail shows $1,234,567.00 after update |
| records-forms.crud-roundtrip | 4 | pass | History tab (screenshot then text): 'Dev Admin UPDATE Annual Revenue: — → 1234567'; CREATE expanded 'Owner: Dev Admin · Industry: Finance · Lifecycle: Active · Sales Region: AMER'; no raw ids/values, no Unknown user, no… |
| records-forms.crud-roundtrip | 5 | pass | form create os-qa-d2a-华宁 201; filtered GET name bytes hex-identical; $search=华宁 → 2 (华宁科技, os-qa-d2a-华宁); UI quick-search sent search=华宁 and grid showed both (2 records) |
| records-forms.crud-roundtrip | 6 | pass | admin clone 201 {id≠sourceId,sourceId,record}, diff only id/created_at/updated_at/name(override); member clone of field_zoo 201 owner_id=member (src=admin), created_by=member, f_autonumber 0002→0003; readonly half: plan… |
| records-forms.crud-roundtrip | 7 | pass | contributor-bound member (recipe search:qa-contributor-bound-member, list 0→1 own invoice): GET INV-1003 404 RECORD_NOT_FOUND (premise); POST clone 404 code RECORD_NOT_FOUND; admin invoice count 13→13; control clone of … |
| records-forms.crud-roundtrip | N0 | pass | Create with empty name: no POST sent, field error 'Account Name is required', count 14→14 |
| records-forms.crud-roundtrip | N1 | pass | clone never carried id/audit/autonumber (re-derived, see acc[6]); RLS-invisible clone refused 404, no row |
| records-forms.crud-roundtrip | N2 | pass | substituted showcase_invoice (name required, no default): POST {account} → 400 VALIDATION_FAILED fields[{field:name,code:required}] |
| records-forms.crud-roundtrip | N3 | pass | POST showcase_account tax_id 'abc' → 400 VALIDATION_FAILED fields[{field:tax_id,code:invalid_format,'Tax ID must look like 12-3456789.'}]; 0 rows stored |
| studio-authoring.first-run-loop | 0 | pass | wizard POST /api/v1/packages 201 {manifest id com.example.repairs, namespace repairs (derived), status installed}; switcher (studio-pkg-chip) lists 维修中心 Writable; 2nd package com.example.qaprobe: window marker survived … |
| studio-authoring.first-run-loop | 1 | pass | after Publish all (POST …/publish-drafts 200 publishedCount 1, toast 'Published 1 item in this package (one atomic release)') GET /api/v1/meta/object/repairs_repair_ticket status {type:select, options open/Open,in_progr… |
| studio-authoring.first-run-loop | 2 | pass | Studio Records → Add record POST /api/v1/data/repairs_repair_ticket 201 {name,status:in_progress}; GET lists 1 row status in_progress |
| studio-authoring.first-run-loop | 3 | pass | Create app seeded nav (default-ON checkbox) → publish 200; meta/app names add repair_center, ?id=repair_center navigation [{type:object,objectName:repairs_repair_ticket}]; Home launcher tile 'Repair Center' → /apps/com.… |
| studio-authoring.first-run-loop | 4 | pass | studio.boot.log 'Server is ready' ×1; listener pid 14204 started 14:37:50 unchanged at loop end; zero code edits |
| studio-authoring.first-run-loop | 5 | pass | forged PUT meta/object/showcase_qa_probe?package=com.example.showcase → 422 WRITABLE_PACKAGE_REQUIRED; add-field PUT showcase_account (draft, package=showcase) → 403 ITEM_LOCKED-class 'read-only managed package'; plain … |
| studio-authoring.first-run-loop | N0 | pass | no silent acceptance (see acc[5]) |
| studio-authoring.first-run-loop | N1 | pass | launcher shows app; list renders label chip |
Fails — reproduction rules and disposition
None. No clause failed, so no RUNNER rule 7 verifier was owed and no product defect is extracted from this record. No authentication or authorization finding (each runner checked its auth-class candidates and ruled them out with evidence: member DELETE on a foreign private note answers 403 for an unknown id too, so there is no existence oracle; the org-wide sys_user read is the sys_user_org_members peer directory by design).
Derived item verdicts
19 PASS / 4 PARTIAL / 0 FAIL / 0 BLOCKED / 0 NOT-RUN — 198 clauses pass, 5 blocked, 0 fail. Each PARTIAL carries only blocked clauses beside passes:
access-security.rls-both-sidesc5 — blocked(dependency): the D11 judgement needs the private write-up the item's knownGaps names; the skipped-explanation half holds.access-security.crud-permission-matrixc5 — blocked(fixture): the item's own knownGaps[2] (guest anchor ships unbound on a stock boot).access-security.walled-environment-metadata-operator-onlyc1, N0 — blocked(fixture): the walled boot itself now comes up (Tenancy: isolated, Organizations mounted) and the operator half (c2) passes live, but the org owner's org-scopedmanage_metadatagrant cannot be placed through any HTTP door (operator insert 403 "outside the caller's organization scope"; owner self-grant 403 under ADR-0090 D12 condition (c)). Supplemental: theorganization_adminowner was refused 403 at 7 metadata doors and nothing was stored.cli.organization-ownership-ceremonyc5 — blocked(fixture): needs a showcase DB born under an 18.0.0-next.* build; a published prerelease CLI resolves 18.1.0 dependencies (measured), so it is not a substitute.
Compared with the 18.0 P0 record #24556 (17/5/1): platform-core.v18-boot-refusals and integration-system.datasource-credential-refusal-matrix are PASS now, the walled boot is no longer refused, and the ownership ceremony is live again (rev 4, #24681) and was scored on it.
Checklist-accuracy findings / fixture gaps
For the wave anchor #25807 (collected there; not extracted, no checklist edit in this run).
- RUNNER environment facts: (1) the walled-boot entry is stale —
examples/app-showcase/package.jsonnow declares@objectstack/organizations, so a walled run boots from the tree with three env vars, no scratch copy; (2) the Playwright entry is stale —/opt/pw-browsersnow holds chromium 1243 and the alias resolves there (the alias advice still works). platform-core.boot-healthc2: deployment-policy unbound flows print as ℹ lines, not ⚠; the clause still describes ⚠.platform-core.nav-surfaces-render: the console-added "All reports" sidebar destination is outside both meta/app nav andSURFACES, so the served-vs-SURFACES diff cannot see it; step 1'stest:smokealso collects two other specs beside the pin.platform-core.builtin-apps-nav-render: marketplace knownGap names "Forbidden", the screen reads "HTTP 502 · fetch failed" (MARKETPLACE_PROXY_FAILED); step 6 namessys_approval_request/my_pendingfor Account Approvals, the served entry iscomponent/approvals/inbox; no clause covers a member opening Setup's url-type entries (they render inside the Showcase shell while the server refuses every namespace 403).approvals.account-app-entry: "drawer" wording in steps 6–7 and acc[1], acc[3], acc[4] is stale — objectui removed the side sheet (objectui#12484); a row click or?request=now opens/apps/APP/sys_approval_request/record/ID; the account app answers on two URL segments (accountandcom.objectstack.account), which matters for acc[5].records-forms.crud-roundtrip: the owner half of acc[6] says "not yet run" — it was replayed this run.integration-system.datasource-credential-refusal-matrixstep 2: anschemaMode: 'external'datasource needs anexternal: {}block or it answers 400, easy to misread as a refusal.automation.packaged-flow-disable-durable: steps 2/8/10 task POST needsproject; step 4's "reads are open" holds only at the apiMethods layer (a contributor gets 403 onsys_metadata_activation).identity-auth.default-organization-boot-invariant: step 3 filtersorganization = default, the column isorganization_idand takes the org id;fixtures.requiressays--freshbut c1 needs--log-level infoand a readable file DB; acc[0] prescribes--maxWorkers=2against RUNNER's memory fact.platform-core.seed-integrity: the Specimen diff should name the canonical time form ("14:30" → "14:30:00"); step 2's baseline lists 9 of the 19 seeded datasets.access-security.crud-permission-matrixknownGaps[1]: a plain member reads the whole orgsys_userdirectory, not a self-scoped row (sys_account/sys_sessionare the self-scoped ones); the pin header says 6 delegate × sys_* rows, the matrix has 4.access-security.walled-environment-metadata-operator-only: steps name showcase objects while the wall-* dogfood pins boot the CRM app — worth stating in the item.cli.organization-ownership-ceremony: planning a raw v17 DB before any v18 boot blocks the apply at therewritestep (resumable after one boot) — put the refused boot before the plan; apply needsOS_AUTH_SECRET(or--dev) or it blocks atauthored-conversion; on a real 17.x DB the drop gate's first refusal isrefused_comment_reactions_unconverted, soos migrate comment-reactions --apply --yes(step 4, which also lacks--yes) must come before step 3; acc[0] prescribes--maxWorkers=2; c5 knownGaps should say a published prerelease CLI is no substitute.platform-core.v18-boot-refusalsstep 1: productionos serve --preset minimalis refused earlier ("This stack mounts no auth…");os serve --dev --no-serveris the spelling that reaches the SecurityPlugin refusal.ai.mcp-stdio-fail-closedsteps 2 and 9: the INFO lines need--log-level infoonos start;query_recordscapslimitat 50.
Fixture gaps (parked on #25807): the walled org-scoped grant (above); the 18.0.0-next.* born DB (above); the guest anchor (crud-permission-matrix knownGaps[2]); the marketplace catalog needs egress to cloud.objectos.ai (named error state scored); no fixture throws inside a route, so the ErrorBoundary fallback stands on "none encountered".
Off-clause probes (RUNNER rule 8)
About 63 minutes over five runners, after every clause had a verdict, on the same boots. Doors: by-id data doors and side write doors (/batch, updateMany, deleteMany), search / analytics / security/explain read channels, /actions and _activation, /automation toggle, sys_metadata_activation, auth sign-in/sign-out, meta/app, console bad routes, approvals act doors, datasource read doors (history, audit, draft/raw, search), stdio admission, ownership plan/apply, dev DB resolution. Personas: admin, baseline members, contributor-bound member, liaison, auditor, outsider member, seeded member, anonymous. Boundary classes: unknown / empty / blank ids, empty strings on every query param, missing booleans, bad windows ($top −1, abc, 100000), bad comparands ($in [null], reversed and 3-value $between, $regex), repeated params, owner forging on bulk doors, double approve, act-as another position, foreign plan file, existing --out, missing --backup-taken, empty and whitespace stdio keys. Nothing found that passes the filing gate. Observed, not filed (no declared contract or by design): member marketplace page says admin-only while GET /api/v1/marketplace/packages proxies upstream for the member (502 here, could not judge with egress closed); the ownership plan's missing-column note sits only in tables[].grants.note, and two mid-apply blockers that are knowable before any write are reported only after attribution and up to 7 steps are written (resumable by design); the in-shell session-expiry state offers "Retry" rather than a sign-in link; the History tab shows currency raw.
Timing
- Environment preparation ≈ 17 min orchestrator wall (
pnpm install18 s,pnpm build6 m 32 s, console build ≈ 11 min) + ≈ 36 min of runner provisioning summed over five runners (boots, scratch copies, the v17 npm fixture, Postgres, personas). - Testing ≈ 108 min summed over five runners (Tier 1 pins serialised, live clause driving, probes); wall 14:25–15:07Z.
- Environment : testing ≈ 53 : 108 ≈ 1 : 2.
Generated by Claude Code
Activity
objectstack-fleet commentedon Oct 25, 2026
Close-out for this record at 2026-10-25T15:10Z. No FAIL was scored, so no clause needs a four-way disposition and nothing is extracted. The four PARTIAL items carry only blocked clauses; each gap is parked on the wave anchor, and the checklist-accuracy findings in the body close out there too.
Parked-on: #25807 · access-security.rls-both-sides · acceptance[5] blocked on the D11 private write-up
Parked-on: #25807 · access-security.crud-permission-matrix · acceptance[5] guest anchor ships unbound
Parked-on: #25807 · access-security.walled-environment-metadata-operator-only · acceptance[1] and negative[0] need an org-scoped manage_metadata grant no HTTP door places
Parked-on: #25807 · cli.organization-ownership-ceremony · acceptance[5] needs a showcase DB born under an 18.0.0-next build
This record supersedes the 18.1.0 P0 record #25478 (10/23); all 23 items were re-judged here, so nothing is carried forward.
Generated by Claude Code