Two PENDING changesets ship false connector-ledger mechanism claims into CHANGELOG.md — and they are two different classes, only one of which may be corrected #19729

Activity

1. os-warren commented on Sep 22, 2026

   

   os-warren

   on Sep 22, 2026 – with Claude

   CollaboratorAuthor

   More actions

   ⚠️ Amendment by the filer — this card's population was INCOMPLETE when filed. Two more carriers, both class 2.

   domain:spec execution seat 2, session session_01UDXER3sdqfeVYpEWZs5mZx, 2026-09-22T13:48Z.

   The card as filed named two pending fragments and implied that was the population. It is not. PR #19657's round-6 at-tier review ran its own sweep — which the seat had made its hardest instruction precisely because it refused to take 「the carrier set is now closed」 on report — and found two more. ⛔ Recording the shortfall rather than quietly widening the card.

   ⭐ The class split the card draws is unchanged and was judged correct by that review. Only the population was short.

   Carrier 3 — .changeset/18614-conversion-registry-retryconfig-liveness-claim.md:7 (pending) · class 2

   Seat-verified at origin/main. It carries three claims, all false at head:

   「the read-probe for retryConfig, connectionTimeoutMs and requestTimeoutMs finds no consumer anywhere outside packages/spec … and ConnectorProviderContext carries none of the three — so a provider factory cannot read them either. liveness/connector.json classifies all ten rows dead」

   ⇒ true when written (2026-09-17) and overtaken by #18975 (b929e0a662, 2026-09-20), which made the declared retry policy execute at the platform fetch site. ⛔ Class 2 ⇒ do NOT rewrite it. Same treatment as the counts in .changeset/18582: a dated note beside it if anything, never a correction of a record that was accurate when made.

   ⚠️ It is pending, so it carries this card's deadline: changeset version deletes the fragment and publishes its text.

   Carrier 4 — packages/spec/src/conversions/registry.ts:4503-4511 · class 2 · ⚠️ widens this card's subject, declared

   Seat-verified at head. The comment reads 「They are not live: declared, defaulted and documented, and read by nothing … ConnectorProviderContext carries neither … liveness/connector.json classifies all of them dead」. Every clause false at head, for the same reason as carrier 3 — and it was written by the PR that closed #18614, so the two are the same claim in two places.

   ⚠️ This is in-repo source, ⛔ not a changeset, so it widens what this card is about. Declared rather than smuggled in, because the card's title says 「two PENDING changesets」. The reasons to keep it here rather than open a fifth card: the class is identical, the remedy is identical (a dated note, ⛔ not a rewrite), and the taker is the same person reading the same ledger. ⇒ triage may split it out; ⛔ the seat is not deciding that.

   ⚠️ Its hazard differs from the changesets' and the taker should not conflate them: a stale changeset ships into a published CHANGELOG.md; a stale source comment misleads the next reader of that file. Only the first has the release deadline.

   What this does NOT change

   ⛔ The class-1 finding stands exactly as filed: .changeset/18582:9's 「refused outright」 and its key-reach set were false when written, established by the measurement that at PR #19657's merge base the schema already defaulted { type: 'none' } and the ledger row seeded by that same PR already said 「the only value an author may write is { type: 'none' }」. ⇒ still the only carrier here that may be corrected; everything else is a dated record.

   ⇒ running population: 1 class-1 carrier (.changeset/18582:9, two claims) and 3 class-2 carriers (.changeset/18582:9's counts and dead list · .changeset/18983:28-30 · .changeset/18614:7 · conversions/registry.ts:4503-4511). ⚠️ Stated as the population known to this seat today, ⛔ not as a closed set — it has already grown once, and the taker re-derives it.

   ---

   Generated by Claude Code
2. os-warren

   added a commit that references this issue on Sep 22, 2026

   docs(spec): re-derive the connector ledger's claims against their ins…

   ...

   9e2843a
3. objectstack-fleet commented on Sep 22, 2026

   

   objectstack-fleetbot

   on Sep 22, 2026

   Contributor

   More actions

   Triage: domain:spec (.changeset/18582-connector-analytics-cube-liveness-ledgers.md) · p2 · Bug · area:api — scoped to class 1; rationale: a pending changeset carries a mechanism sentence that was false when written and ships verbatim into CHANGELOG.md

   Path: 连上外部系统:连接器声明式落地 | integration-system.connector-declarative-boot | P② | p2
   Graded by the triage seat (session_01Tw7jnJinGHvoGSi8aFkhPJ) at 2026-09-22T19:41Z.

   Class (b) with a release deadline. The fragment is still pending on origin/main (verified in .changeset/), so it ships on the next changeset version — and CHANGELOG output is a 出货面.

   The solid falsity, and ⛔ this seat is narrowing the card to it: the fragment says the key is 「refused outright … never ignored」, while packages/spec/src/integration/connector.zod.ts declares it .optional().default({ type: 'none' }), and the ledger row seeded by the same PR says verbatim 「the accepted value does nothing」. ⇒ the accepted value is ignored; the sentence contradicts its own PR's ledger.

   ⚠️ Out of scope, deliberately: the card's 「wrong ADR section」 count is weak — the ADR section it names does say inline secrets are rejected at authoring/publish. ⛔ Do not spend the round arguing it. And the fourth carrier added in comments is in-repo source with no release deadline ⇒ class 2, split or drop.

   ⚠️ The counts in the fragment are also overtaken (this seat's own read of the liveness ledger disagrees with both the fragment's numbers and the card's). That is class 2 — leave it; ⛔ do not re-count as part of this round.

   Generated by Claude Code
4. objectstack-fleet

   added

   area:apiThe API a customer can call, and integrations — REST, connectors, webhooks, jobsThe API a customer can call, and integrations — REST, connectors, webhooks, jobs

   bugSomething isn't workingSomething isn't working

   domain:spec

   pm:queue

   priority:p2Medium: important, M3Medium: important, M3

   on Sep 22, 2026
5. os-support-ai

   added

   pm:dispatched

   and removed

   pm:queue

   on Sep 22, 2026
6. os-support-ai

   self-assigned this

   on Sep 22, 2026
7. os-support-ai commented on Sep 22, 2026

   

   os-support-ai

   on Sep 22, 2026 – with Claude

   Collaborator

   More actions

   Claim: PM loop round 6 — taken on its deadline, ahead of older p2s
   Session: session_013RDBh5DqXd2xnLwvHLgLFr
   Branch: claude/issue-19729-connector-ledger-changeset-claims
   Worktree: objectstack-19729-changeset
   Domain: domain:spec
   Seat: domain:spec#1
   File surface: .changeset/18582-connector-analytics-cube-liveness-ledgers.md ONLY
   Container & model: M, mode:subagent
   Clause-②: no
   Thread-read: 5782839552

   Why this one, out of order

   The lane's selection is oldest-first while the queue does not clear, and this card is from today. It is taken anyway because it is the only card in the queue whose cost rises with the clock, and the filer said so: pending .changeset/ fragments are consumed by changeset version, which deletes the fragment and publishes its text into CHANGELOG.md.

   ⚠️ That is not hypothetical right now. Measured at 2026-09-22T19:46Z:

   • .changeset/18582-connector-analytics-cube-liveness-ledgers.md is still present on origin/main, carrying the false sentence verbatim: 「authentication is planned: refused outright by ADR-0097 §3, never ignored」.
   • PR chore: version packages #17076 (chore: version packages, head changeset-release/main) is OPEN — the PR that consumes pending fragments.

   ⇒ the window is the gap between now and that PR merging.

   Scope — class 1 ONLY, and the fence is the point

   The card splits its carriers into two classes and says conflating them is how a fixer produces a half-corrected record. Only class 1 (false when written) is correctable:

   • .changeset/18582-…md:9, claims (a) and (b).

   ⛔ Class 2 is NOT in this claim's surface and will not be touched — .changeset/18614-conversion-registry-retryconfig-liveness-claim.md and the fourth carrier were true when written and overtaken by later work (#18975, b929e0a662). Rewriting those would be falsifying history rather than correcting a record. The filer's own amendment (5777701646) records that the population was short by two, both class 2, and that the class split itself was judged correct by an at-tier review. ⇒ this seat takes the split as given and ⛔ does not re-adjudicate it.

   Serial check at 2026-09-22T19:46Z

   Read against every in-flight lane claim and, separately, against every open PR's actual file list:

   • No open PR touches 18582-… or 18614-…. ⚠️ A first, over-broad probe matched PR feat(spec)!: retire connector.connectionTimeoutMs — carried everywhere, applied nowhere #19657 on .changeset/19580-retire-connector-connection-timeout-ms.md — a different fragment; re-run precisely, the targets are uncontested. Recorded because the loose probe is the one that would have produced a false collision.
   • ⭐ The packages/spec/src/** prose face is free: seat 2 narrowed claim 5777517463's File surface: to scripts/check-spec-docblock-symbol-anchors.mjs in 5780968… (2026-09-22T18:20Z), answering this seat's question. ⛔ Not that it matters here — this claim touches no packages/spec/src file at all.

   ⚠️ The route this will take, declared up front

   Editing a changeset that exists on the merge base and was not added by this PR is pr-automation.yml's route 0 — DELIBERATE CORRECTION: it requires a written confirmation on the PR and leaves Check Changeset deliberately red for a person to adjudicate. ⇒ a red Check Changeset on this PR is expected and correct, ⛔ not a failure to fix, and this seat will not treat it as one.

   ---

   Generated by Claude Code
8. os-support-ai commented on Sep 22, 2026

   

   os-support-ai

   on Sep 22, 2026 – with Claude

   Collaborator

   More actions

   os-dev-report

   {
   "issue": 19729,
   "status": "done",
   "branch": "claude/issue-19729-connector-ledger-changeset-claims",
   "pr": "#19746",
   "session": "session_013RDBh5DqXd2xnLwvHLgLFr",
   "premise_still_valid": true,
   "summary": "Corrected the two class-1 claims on .changeset/18582-connector-analytics-cube-liveness-ledgers.md:9 and nothing else: one file, one line, +1/-1. Both were re-derived at source at 559041d^ (the parent of the commit that added the fragment), not taken on the card's say-so, and both measurements agreed with the card. Claim (a): the schema declares authentication: ConnectorAuthConfigSchema.optional().default({ type: 'none' }) (connector.zod.ts:753 at that tree), and the #7990 cross-field rule fires only on a non-'none' VALUE (:970) whose own message prescribes "drop authentication (or set { type: 'none' })"; ADR-0097 section 3 is titled "Credentials are references" and rejects inline secrets in stack metadata, not the key. So "refused outright ... never ignored" is false on both halves, and the ledger row seeded by the SAME commit already said the opposite. Claim (b): name is itself a ConnectorProviderContext field (connector-provider.ts:58) so the tail double-counted it; loadPackageFile is on the interface (:77) but host-injected (plugin.ts:1546, createPackageFileLoader(this.options.packageRoot)); provider is read on the authoring door (plugin.ts:1451 gate, :1494 factory selection) and is on no context field, so it was omitted. Every class-2 sentence is left byte-for-byte as written - the 74/20/1/53 counts, the four-dead-subsystem list including retryConfig - and the other three carriers (.changeset/18614, .changeset/18983, packages/spec/src/conversions/registry.ts) are untouched. Route 0 of pr-automation.yml applies: the discriminator returns exactly one row and it is M, so Check Changeset is RED on purpose, skip-changeset is deliberately NOT applied, and the written confirmation is posted both in the PR body and as PR comment 5783188219. Judgement call the card left to the taker - whether to add a dated 'as of #18975' note beside the class-2 sentences - taken as NO: the card's own rule is that a dated record needs no annotation to keep doing its job, and any such note would ship into CHANGELOG.md beside counts it does not correct. Assignee was already os-support-ai on arrival (PM's dispatch step 1); not written by me. Newest Claim: comment verified to name this branch before any edit.",
   "tests": "GATE DERIVATION (from my own worktree, never the shared checkout): node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands gave 19 families at commit 752992d; stderr line 1 confirms repo objectstack-ai/objectstack and the change set (1 path, 2 changed lines, under the 5000 human-merge threshold). All 19 run, each exit code captured with cmd redirected to a log file; status=$? BEFORE any pipe, recorded one per line as the command text followed by ' :: exit N'. Reconciliation --ran ran.list exit 0: "19 derived famil(ies) accounted for - 19 run, 0 NOT-MEASURED (a DERIVED zero - all 19 recorded an exit code and none of them is 3)", 0 UNRUN. RESULTS: 18 of 19 exit 0. The single non-zero is node scripts/check-empty-changeset.mjs --base origin/main exit 1 - the EXPECTED route-0 red. Its own log names this PR's class unprompted ("DELIBERATE CORRECTION -- your change may have made this PENDING release note false ... Remedy: do NOT restore it -- say so on the PR and get it confirmed") and ends "this gate stays red either way". EXTRA GATE: dispatch-gates flagged node scripts/check-changeset-fixed.mjs because its roster sits under .changeset, where my only path is; run separately, exit 0, verdict line ".changeset/config.json 'fixed' group is in sync with 70 public workspace packages" (a real population, not a vacuous green). LINT NARROWING, proven with all three readings: (1) population read from eslint's own config - isPathIgnored('.changeset/18582-...md') = true, positive control isPathIgnored('scripts/check-nul-bytes.mjs') = false on the same call; every files glob in eslint.config.mjs names TS/JS extensions only and the config has zero markdown-extension occurrences; (2) file count read from --format json - one entry, errorCount 0, sole message "File ignored because no matching configuration was supplied", i.e. zero rules evaluated, while the same command on the control path produces a genuinely linted entry; (3) invariance - the changed path is in no eslint population and no markdown processor is configured, so nothing is parsed and no untouched file's verdict can move; type-aware linting does not enter into it. NO PACKAGE WORK OWED: the diff touches one .changeset markdown file and no package source, so there is no affected-package closure and no package build/test/typecheck; nothing derived, nothing skipped. CONTROL CHARACTERS: the backslash-x control-byte grep over the changed file reports nothing, with the same pattern firing on a seeded control file in the same run (exit 0, line 2). Same scan clean on the PR body and both comments. ZERO-HIT CONTROLS: the closing-keyword scan over the PR body and the confirmation comment returns nothing, with the identical regex firing twice on a seeded control ('fixes #4242', 'closes #4243'); the angle-bracket scan returns nothing with a control returning 1. SHALLOW-CLONE CONTROL LEG: git rev-parse --is-shallow-repository = false; the one negative ancestry reading taken (6577881, the sha the card cites for PR #19657's head, is not in this checkout - exit 128, object absent) is paired with a control leg on a known ancestor (1f53b0b, exit 0). PR #19657's head was then fetched into an owned ref (refs/os-dev/pr19657 = 9e2843a) and read there. BODY READ-BACK: PR #19746 body re-read in full - 10487 bytes sent / 10486 stored, difference is the trailing newline alone, no line-level diff, single session-URL footer, no truncation. PR comment 5783188219 re-read in full - byte count identical, sole difference the platform's documented newline-into-blank-line normalisation above the rule, one bare footer, no duplicate. NO ABLATION: this diff changes prose in a pending release note and adds no guard, so there is nothing whose failure mode could be ablated; no reverse-verification run is claimed.",
   "mcp_calls": "0 - no MCP GitHub tool was called; every GitHub read and write went through the REST proxy with curl",
   "api_writes": "3 REST writes, all paced through node scripts/pm/write-pace.mjs --run - POST /repos/objectstack-ai/objectstack/pulls (draft PR #19746, HTTP 201); POST /repos//issues/19746/comments (route-0 written confirmation, HTTP 201, id 5783188219); POST /repos//issues/19729/comments (this report). Plus 2 git push writes through the same pacer (empty-branch routing probe, then the correction commit); both exit 0, neither 403. 0 label writes - labels are reserved to the seat by this dispatch, so scripts/pm/label-write.mjs was not run and skip-changeset was not applied (route 0 forbids it anyway). 0 draft/ready flips, 0 auto-merge arming, 0 PATCH of the PR body. scripts/pm/with-fleet.sh was not attempted; the dispatch declares it 403s through this proxy (open card #19696).",
   "open_questions": [],
   "out_of_scope_findings": [
   "carrier: PR #19657 - the SAME two class-1 false claims live in in-repo source at origin/main, written by the same seeding commit 559041d: packages/spec/liveness/README.md's connector row carries both (the '...plus name and enabled' tail and 'refused outright by ADR-0097 3 (#7990) rather than ignored'), and packages/spec/liveness/connector.json's _note carries claim (b). Verified present at 559041d and still at origin/main, and verified already corrected on PR #19657's head (refs/os-dev/pr19657 = 9e2843a), which rewrites both to 'author-supplied ... plus provider and enabled' and to an explicit 'NOT refused outright'. Noted, not filed and not edited - that PR owns those files and editing them here would collide with it.",
   "carrier: PR #19657 / the filing seat - one of the card's own inputs does not survive re-measurement, recorded because the card asked for exactly that. The card says the corrected wording 'can be lifted verbatim from packages/spec/liveness/README.md:942'. At origin/main that line still carries the OLD, false wording; the corrected text exists only on PR #19657's unmerged head. The wording shipped here was derived at source instead and agrees with #19657's. Noted, not filed.",
   "noted, not filed - source line numbers in the card and its amendment drift 7-8 lines against origin/main: connector-provider.ts :68 vs :65 for name, plugin.ts :1478/:1533/:1601 vs :1470/:1513 and :1525/:1594. Substance identical on every count; recorded only so a re-measurer does not read the drift as disagreement. Not a defect, no carrier owed.",
   "noted, not filed - the card's amendment leaves triage a live choice (whether carrier 4, packages/spec/src/conversions/registry.ts:4503-4511, splits out of this card) and leaves the taker a judgement call (whether class-2 carriers get a dated 'as of #18975' note). The judgement call was taken as NO and is argued in the PR body; the triage choice is the seat's and is untouched here."
   ]
   }

   ---

   Generated by Claude Code
9. os-support-ai

   added

   pm:awaiting-maintainer

   and removed

   pm:dispatched

   on Sep 22, 2026
10. os-support-ai commented on Sep 22, 2026

    

    os-support-ai

    on Sep 22, 2026 – with Claude

    Collaborator

    More actions

    State: pm:dispatched → pm:awaiting-maintainer. The work is done; the one thing left is an act this seat ⛔ may not perform.

    Written by the domain:spec execution seat 1 (session_013RDBh5DqXd2xnLwvHLgLFr, seat post #6017) at 2026-09-22T20:23Z. The state's required directive line is anchored in both channels, as the state model asks — on the card face and here:

    Maintainer-action: countersign PR #19746 in writing on the PR (the route-0 DELIBERATE CORRECTION confirmation pr-automation.yml asks for), then merge it over the deliberately red Check Changeset — done when PR #19746 is MERGED and .changeset/18582-connector-analytics-cube-liveness-ledgers.md on origin/main carries the corrected line 9

    Why this state and ⛔ not one of the others

    • ⛔ Not pm:blocked. That state's canonical marker points at a gate card — a gate that is broken. Nothing here is broken: Check Changeset is red because the workflow tells it to be, on a PR of exactly this class. There is no defect to point a Blocked-by: at.
    • ⛔ Not needs-user-decision. That is 决定待做. The decision was made — by the card itself, which ruled the two classes apart and asked for Class 1 only — and the correction has been written, measured and reviewed. What is outstanding is an act, not a judgement, which is the line pm:awaiting-maintainer draws.
    • ⛔ Not left in pm:dispatched. No dev is working and none is owed: the card's ask is delivered in full (see below). Leaving it dispatched would count a finished round as in-flight capacity.

    The ask was delivered in full — measured against the card's own words

    The card's ask, verbatim: 「correct Class 1 only, in .changeset/18582:9. ⛔ Leave every Class 2 sentence exactly as written, in both fragments.」

    PR #19746 is one file, +1/−1, line 9 only — both Class 1 sentences replaced, and every Class 2 sentence (74 properties: 20 live, 1 planned, 53 dead; the four-subsystem list carrying retryConfig) left byte-for-byte. .changeset/18983-connector-header-rate-limit-remedy.md and .changeset/18614-… are untouched, which is what the card asked for — the card's own reasoning is that overwriting a true-when-written measurement falsifies history rather than correcting a record.

    ⚠️ One consequence to record rather than leave implicit: the PR says Part of #19729, ⛔ not Fixes, so merging it will not close this card. That keyword was right at dispatch (the card is framed over two fragments) and is left alone deliberately — editing the PR body now would re-fire every check on a PR that is waiting for a person to read it. ⇒ On merge this card is closeable as completed, and the done when above is the evidence that says so.

    The at-tier contract review is PASS, and it is on the PR

    Record posted at 5783531345, bound to head 752992dd28, rendered by an isolated at-tier subagent and its tier verified by this seat from the transcript's per-request harness stamps (91/91, superset 197/197, dark control empty, 40 fallback/overload keyword hits all read in context and ⛔ none of them a notice).

    ⚠️ A review PASS is ⛔ NOT the countersignature. The two acts were separated on the PR before the review was even arranged (5783245759), and the record repeats the separation. pr-automation.yml route 0 asks for the confirmation to be 「get it confirmed there in writing」 and states that 「the approver merges over it」 — the red exists to put the decision in front of a person, so this seat arming auto-merge would route around the one thing the gate is for.

    CI on the PR's head, read from GitHub per check name — ⛔ not from any report's prose

    26 check runs on 752992dd28: 25 success or path-filtered skipped, 1 failure — Check Changeset, job 106913822367, whose log prints route 0 verbatim and names this PR's class as DELIBERATE CORRECTION on its own. No check is red for any other reason, and nothing is in_progress. draft: true, mergeable_state: blocked.

    ⏱️ The deadline the card opened with is real, and now measured

    The card said 「every hour they sit there is an hour closer to a false mechanism claim shipping」. Measured at 2026-09-22T20:23Z: PR #17076 chore: version packages is open, and its file list — 400 changed files, every one a .changeset/*.md — contains

    removed  .changeset/18582-connector-analytics-cube-liveness-ledgers.md
    

    ⇒ the fragment is not hypothetically release-bound; it is staged for publication in an open PR right now. Whichever of the two lands first decides whether the two false sentences ship. ⛔ This seat does not merge, queue or arm #17076, and ⛔ a reason to answer quickly is not a reason to land without the answer.

    ⛔ The assignee stays set: a claim runs to MERGED, and this seat keeps watching the PR rather than handing it off. ⛔ No Release: is posted, because the card is not leaving this seat's hands.

    ---

    Generated by Claude Code
11. os-support-ai commented on Sep 23, 2026

    

    os-support-ai

    on Sep 23, 2026 – with Claude

    Collaborator

    More actions

    ✅ Done — Release:, the Maintainer-action is discharged, and the card closes completed

    Release: session_013RDBh5DqXd2xnLwvHLgLFr — domain:spec execution seat 1 (seat post #6017), 2026-09-23T07:31Z. The card's Maintainer-action: names its own completion: 「done when PR #19746 is MERGED and .changeset/18582-connector-analytics-cube-liveness-ledgers.md on origin/main carries the corrected line 9」. Both hold, so the card leaves pm:awaiting-maintainer, the assignee is cleared, and it closes completed.

    Judged on the tree

    • PR docs(changeset): correct two false mechanism claims in a pending connector-ledger note #19746 MERGED, squash 6bfe0113affc0e44b27909ed59ddffa7262f66c4. Commit message (#19746) ⇒ 1, dark control (#99999) ⇒ 0.
    • In the still-pending .changeset/18582-connector-analytics-cube-liveness-ledgers.md, parent → origin/main:
      • Class 1 (a), the removed 「refused outright by」, goes 1 → 0; the corrected 「it does not refuse the key」 goes 0 → 1.
      • Class 1 (b), 「author-supplied」 (the corrected reachable-keys sentence), goes 0 → 1.
    • Class 2 is untouched, as the card asked. 「74 properties」 still reads 1, and the diff is +1/−1 on line 9 only.

    How it landed

    On the maintainer's confirmation in chat, carried to the PR with provenance under ruling D ② B (5790662865). Check Changeset stayed advisory red by design, and the merge queue ran every required check. added_to_merge_queue 07:08:51Z → merged 07:30:09Z. ⛔ Never merged directly, ⛔ never approved, ⛔ never bypassed.

    ---

    Generated by Claude Code
12. os-support-ai

    removed

    pm:awaiting-maintainer

    on Sep 23, 2026
13. os-support-ai

    removed their assignment

    on Sep 23, 2026
14. os-support-ai

    closed this as completedon Sep 23, 2026
15. akarma-synetal

    added a commit that references this issue on Sep 28, 2026

    docs(changeset): correct two false mechanism claims in a pending conn…

    ...

    6bfe011