Merge remote-tracking branch 'origin/main' into claude/issue-7004-changeset-trailing-comment

Author: claude

.changeset/api-runtime-create-withdrawn.md

@@ -0,0 +1,77 @@
+---
+'@objectstack/spec': major
+'@objectstack/metadata-protocol': major
+'@objectstack/objectql': major
+---
+
+refactor(spec)!: `api` is code-only — withdraw a runtime create door the endpoint matcher could never read (#5488, ADR-0049 remove side)
+
+<!-- adr-0087: registered api-runtime-create-withdrawn -->
+
+**FROM → TO:** `PUT /api/v1/meta/api/{name}` (200 "Saved") → declare the endpoint as a
+stack artifact (`**/*.api.ts`, or `defineStack({ apis })`) and ship it through
+`publishPackage`. The runtime write now answers **403 `NOT_CREATABLE`**, in `?mode=draft`
+as well as direct-active. The artifact route is **unchanged** — a `**/*.api.ts` file valid
+before this release is valid after it, byte for byte.
+
+`DEFAULT_METADATA_TYPE_REGISTRY`'s `api` entry declared `allowRuntimeCreate: true` and the
+runtime never honoured it. Measured on a real showcase boot (`objectstack dev --fresh`, 47
+plugins):
+
+```
+PUT /api/v1/meta/api/e8_backdoor   → 200 {"success":true,…,"message":"Saved …"}
+GET /api/v1/apps/showcase/backdoor → 404      (anonymous AND authenticated)
+```
+
+…and **no** `[EndpointMatcher] … EXCLUDED` line anywhere in the boot log: the endpoint was
+not gated out, it was never in the index at all. The serving criterion belongs to
+`IMetadataService.matchEndpoint` → `EndpointMatcher` → `MetadataManager.listForIndex('api')`,
+which reads the manager's own registry plus its registered loaders
+(`["filesystem","memory"]` on dev/serve). A runtime write lands in `sys_metadata`, which is
+in neither. So the declaration promised a capability that could not exist.
+
+A declared-but-unhonoured capability is ADR-0049 false compliance, and "answers Saved, then
+404s forever" is its most dangerous shape for the AI authors ADR-0033 targets. The
+maintainer ruled REMOVE on 2026-08-07 rather than converge the read path: making the matcher
+read `sys_metadata` re-opens cache, invalidation, tenancy and the ADR-0110 D3
+miss-vs-outage distinction on a new read path, and there is no business pull for
+Studio-authored endpoints today — 17.x serves declarative endpoints through stack artifacts,
+which is what showcase uses (#5040 E8, LIVE).
+
+## The retirement kit
+
+- **`allowRuntimeCreate: false`** on the `api` registry entry. With `allowOrgOverride`
+  already `false`, the type is now **code-only** — the `job` / `agent` / `capability` shape —
+  so the existing #5086 inlet refuses before persistence, on every kernel, with
+  `code: 'NOT_CREATABLE'`, `status: 403` and a prescription derived from the entry's own
+  `filePatterns[0]`. No new refusal mechanism was written for this.
+- **`gateApiDraftsForPublish` is retired** (`metadata-protocol`), together with its nine
+  tests and the `PUBLISH_DRAFTS_NAMESPACE_REMEDY` string only it appended. It landed two
+  days earlier in PR #5279 and is removed **deliberately and on the record**, not lost in a
+  refactor: it gated a draft→active promotion into a state the matcher can never read, and
+  with the inlet closed no `api` draft can exist for it to judge. The in-place comment at
+  its old call site carries the reasoning.
+- **The `metadata-plugin.zod.ts` decision block is rewritten as a recorded overturn.** It
+  used to record CODE-ONLY as "considered and rejected"; its three bullets are kept verbatim
+  with what became of each, so the reversal is auditable rather than silently contradicted.
+- **The `api` create seed is removed** and `api` joins `KNOWN_UNSEEDED`. A pre-filled "New
+  API Endpoint" form whose save can only 403 is the UI half of the same false compliance.
+- **Pins, not deletions.** The two #5271 tripwire pins that asserted
+  `allowRuntimeCreate: true` are **replaced** by retirement pins asserting the new verdict —
+  their comments predicted this exact consequence, and both predictions were correct. Every
+  rejection case asserts `code` **and** `status` (ADR-0112 envelope), never `toThrow()`
+  alone (#6142).
+
+## What did NOT change
+
+`validateApiEndpointDeclarations` / `identityFreeEndpointGateFailure` remain the one judge
+of what is servable, on the route that serves: the stack schema, `publishPackage` (#5189),
+and again at load in `buildEndpointIndex` (PR #5203). ADR-0121's "publish REJECTS" ruling is
+intact. `deleteMetaItem` stays ungated so pre-existing rows can be cleaned up, and
+`OS_METADATA_WRITABLE=api` remains the single operator escape hatch — note it unlocks the
+**write** only; the endpoint still will not be served, which is why it is a diagnostic
+rather than a workaround.
+
+**Re-entry path**, recorded by the ruling: if #2657 Part B promotes `apis` to a registered
+type **with a real consumption path**, the flag and the publish gate come back together —
+implementation first, declaration second.

.changeset/todo-task-completion-trigger-armed.md

@@ -0,0 +1,51 @@
+---
+"@objectstack/example-todo": patch
+---
+
+fix(example-todo): `task_completion` is a real record-change flow again — it bound to nothing and gated on a key nothing reads (#6882)
+
+`examples/app-todo`'s `TaskCompletionFlow` declared `type: 'record_change'` and then
+declared neither key that arms one. It was 1 of the 34 authored flows across the three
+bundled apps, and the only dead one.
+
+**Two faults on one start node, both silent.**
+
+1. **No `triggerType` at all.** `AutomationEngine.resolveTriggerBinding` claims a
+   record-change flow only when the authored token starts with `record-`. With the key
+   absent every later branch missed too (`timeRelative`, `config.schedule`,
+   `flow.type === 'schedule'`, `flow.type === 'api'`), the method returned `undefined`,
+   and `activateFlowTrigger` returned without binding. The flow declared itself
+   record-triggered and was, at runtime, a manual flow that never fired.
+2. **The predicate was written to `triggerCondition`.** The trigger gate is
+   `config.condition` — the key the binding copies and `execute()` evaluates. A node
+   `config` is an open slot by design (ADR-0018), so the misspelling parsed silently.
+   Fixing (1) alone would have been *worse* than dead: the flow would have fired on every
+   update of every task.
+
+**Why no channel reported it.** `getTriggerBindingAudit` — the platform's own silent-miss
+surface, and the source for both the automation plugin's `kernel:bootstrapped` warn loop
+and the CLI startup summary's `unbound` list — opens with `if (!resolved) continue`,
+reading "no binding" as "manual/screen flow, nothing to bind". So the missing key did not
+*add* a diagnostic; it removed the flow from every diagnostic channel there is. The only
+trace anywhere was the startup banner counting one more flow registered than bound, with
+no name and no reason.
+
+**The repair.** `triggerType: 'record-after-update'` plus the predicate moved to
+`config.condition` as `status == "completed" && previous.status != "completed"` — the
+shape `showcase_task_completed` already uses for this exact semantic. `-after-update`
+rather than `-after-write` on purpose: "marked as complete" is a transition, and the
+insert leg has no `previous` to transition from — `previous` binds to `null` there, and
+`previous.status` against `null` aborts the whole CEL predicate with `No such key:
+status` rather than answering false.
+
+A third fault surfaced the moment the flow could run: `get_task` filtered on `{taskId}`,
+an `isInput` variable nothing ever bound (a record-change run seeds `params` from the
+triggering record, which carries `id`, not `taskId`), so the first armed run failed with
+"1 filter condition(s) resolved to nothing and were dropped from the query". It now reads
+`{record.id}`, the handle every other record-change flow in the corpus uses, and the dead
+declaration is gone.
+
+`@objectstack/example-todo` also runs its own vitest suite now (`vitest run`, as
+`app-crm` and `app-showcase` already do) instead of `objectstack test`, which is a
+Quality-Protocol runner that needs a live server and matched no `qa/*.test.json` here —
+so the package's test files had never executed in CI.