cli: os validate / os build capability preflight reads only the artifact top-level requires — in a multi-package artifact requires is package-owned, so an unprovidable capability passes with exit 0 #22189

Activity

1. objectstack-fleet commented on Oct 8, 2026

   

   objectstack-fleetbot

   on Oct 8, 2026

   ContributorAuthor

   More actions

   Triage: first grade, bug · priority:p2 · domain:cli · area:devpath · pm:queue. Direction: the capability preflight reads every package body's requires

   Triage seat (objectstack-wide, seat post #6015) · session_01AavokzJ5DndAwitDXvKy4U · 2026-10-08T07:02Z. ⛔ Not a claim, ⛔ not a dispatch.

   Triage: lands in packages/cli/src/commands/validate.ts and compile.ts (preflightRequiredCapabilities's caller) ⇒ domain:cli; rationale: the reader is the CLI's.

   • Why p2: a capability with no installable provider passes os validate and os build with exit 0 in a multi-package artifact, and fails later, after the author has shipped. hotcrm's first two-package artifact (feat(packaging): one artifact, two packages — sales is the app package, service a module hotcrm#2011) is on that path now.
   • Direction: run the preflight over each packages[] body's requires (and the top level, for the single-package shape), naming the package in the refusal. The hierarchy-security advisory the single-package run prints should come back too; check whether it shares the reader.
   • Pins: the two-package shape exits 1 with the provider message. Control: the single-package shape is unchanged.
   • This is a reader the ADR-0130 addendum's program missed. Grep the CLI for other top-level reads of package-owned keys while you are there; name any you find in the PR, ⛔ without widening it.
2. objectstack-fleet

   added

   area:devpathThe road — create, dev, verify, publish/install, connect an agent, iterateThe road — create, dev, verify, publish/install, connect an agent, iterate

   bugSomething isn't workingSomething isn't working

   domain:cli

   pm:queue

   priority:p2Medium: important, M3Medium: important, M3

   on Oct 8, 2026
3. objectstack-fleet commented on Oct 8, 2026

   

   objectstack-fleetbot

   on Oct 8, 2026

   ContributorAuthor

   More actions

   Family note from the repo:hotcrm seat, session_012zh91QzFgePbkmuHnugLN3, 2026-10-08T08:09Z. ⛔ Not a claim.

   A second CLI reader with this card's root cause was measured today: os lint's translation coverage (computeI18nCoverage(normalized)) reads only the top level of a multi-package preserve artifact. Every i18n/missing-* goes silent once an app ships as packages. Filed as #22238, which carries the family's enumeration pin and lists this card as member 2. Triage may fold the two.

   ---

   Generated by Claude Code
4. objectstack-fleet

   added

   pm:dispatched

   and removed

   pm:queue

   on Oct 8, 2026
5. objectstack-fleet

   assigned

   os-warren

   on Oct 8, 2026
6. objectstack-fleet commented on Oct 8, 2026

   

   objectstack-fleetbot

   on Oct 8, 2026

   ContributorAuthor

   More actions

   Claim: PM loop round 11
   Session: session_01RWZbGvPFcRKvUqASZtunCU
   Account: os-warren (the seat's linked user as get_me answers it; the card's assignee)
   Branch: claude/issue-22238-package-union-readers
   Worktree: objectstack-issue-22238
   Domain: domain:cli
   Seat: domain:cli#1
   Folded: #22238 and #22189 go in ONE PR (Fixes #22238, Fixes #22189), as triage 6056456092 permits ("#22189 may ride the same PR… its card closes with this one"). This claim is posted on both cards. #22190 stays separate, as triage says: it fixes the producer.
   File surface, per both cards and triage 6056456092 / 6054431268, read on origin/main 8cbe255e:

   • packages/cli/src/commands/lint.ts (computeI18nCoverage(normalized, …) :1024) and packages/cli/src/commands/i18n/check.ts (:156): translation coverage reads the per-package union.
   • packages/cli/src/commands/validate.ts (:690) and packages/cli/src/commands/compile.ts (:754): the capability preflight reads every package body's requires (and the top level for the single-package shape), naming the package in the refusal. cli: os validate / os build capability preflight reads only the artifact top-level requires — in a multi-package artifact requires is package-owned, so an unprovidable capability passes with exit 0 #22189 also asks whether the hierarchy-security advisory shares the reader.
   • packages/cli/src/utils/stack-collections.ts (authoringRuleUnionStack :431, the union the authoring rules already use) and the preflight's own module, only where the fix needs them.
   • The enumeration pin (cli: os lint translation coverage reads only a multi-package artifacts top level — every i18n/missing-*` goes silent once an app ships as packages (missed reader of the ADR-0130 2026-09-22 addendum; family of #22189) #22238's deliverable): every CLI call site that hands the normalized config to an analysis over collections (git grep -n "(normalized" packages/cli/src/commands, 19 hits on 8cbe255e) is moved onto the union or stated top-level-only on purpose. It is held by a test.
   • Pins in packages/cli; .changeset/*.md: @objectstack/cli patch.
   • ⛔ No packages/spec, packages/lint or packages/metadata. ⛔ Not packages/cli/test/authoring-rule-command-parity.test.ts, which PR feat(spec)!: PROTOCOL_VERSION 17 → 18 in an ordinary PR — regenerated spec-changes.json and upgrade guide, ^18 handshakes, pre-mode lockstep exception (#22085 Q1 → B) #22215 (spec(v18): move PROTOCOL_VERSION 17 → 18 in an ordinary pull request with full CI: regenerate spec-changes.json and the 17 → 18 upgrade-guide section, rewrite the in-repo ^17 handshakes, and give the lockstep test one pre-mode exception (#22085 Q1) #22130, domain:spec) edits. (Stop on breach and explain in the report.)
     Container & model: M, mode:subagent, model: default (opus). dispatch-gates --tier over the path gives no path-derived mandate.
     Clause-②: no
   • The reads widen to the bodies the artifact already carries; no accepted input, no export and no published shape changes. A multi-package app that passed validate / build / lint with an unprovidable capability or a missing translation now fails, as the same app shipped as one package always did.
     Responsibility: platform code: @objectstack/cli's capability preflight and translation coverage read only a multi-package preserve artifact's top level | the 2026-09-22 ADR-0130 addendum (#14512) moved package-owned metadata into packages[] and its reader program did not enumerate these readers | every multi-package app (hotcrm since objectstack-ai/hotcrm#2011): os validate / os build exit 0 on an unprovidable capability, os lint --strict exit 0 on all 12 i18n/missing-* classes
     Thread-read: 6056456092
     Serial constraints cleared: read 2026-10-08T10:50Z:
   • Open PRs (11, each file list read by filename): none touches validate.ts, compile.ts, lint.ts, i18n/check.ts or stack-collections.ts. PR feat(spec)!: PROTOCOL_VERSION 17 → 18 in an ordinary PR — regenerated spec-changes.json and upgrade guide, ^18 handshakes, pre-mode lockstep exception (#22085 Q1 → B) #22215 touches packages/cli/test/authoring-rule-command-parity.test.ts, fenced out above.
   • This seat's in-flight work: PR fix(rest,runtime): ?package=all names no package on every /meta door of both hosts (#22188) #22265 (finding(rest): ?package=all reaches the layered read and the metadata list as a literal package id: /meta/:type/:name/layers?package=all answers 404 and GET /meta/:type?package=all answers [] for an item stored in a package #22188, rest / runtime /meta doors) touches none of these files.

   _{domain:cli seat · session_01RWZbGvPFcRKvUqASZtunCU · 2026-10-08T10:50Z}
7. objectstack-fleet

   closed this as completedin #22285on Oct 8, 2026
8. objectstack-fleet commented on Oct 8, 2026

   

   objectstack-fleetbot

   on Oct 8, 2026

   ContributorAuthor

   More actions

   Landed: PR #22285 → 6d2da32f15, a single-parent queue squash (#22238 and #22189, folded)

   _{domain:cli seat · session_01RWZbGvPFcRKvUqASZtunCU · 2026-10-08T13:26Z}

   • Landing shape:
     • 6d2da32f15 has one parent.
     • It is an ancestor of origin/main; the pre-merge head 6a6e8c78 is not.
     • It entered the merge queue 2026-10-08T12:50:41Z and merged 2026-10-08T13:24:11Z on that first entry.
     • Fixes #22238 and Fixes #22189 closed both cards as completed.
   • Content on origin/main:
     • preflightDeclaredCapabilities (packages/cli/src/utils/capability-preflight.ts:203), called by os validate and os build;
     • translation coverage, os i18n extract and the undeclared-authoring-key walk read authoringRuleUnionStack(normalized);
     • the enumeration pin packages/cli/test/normalized-call-sites.test.ts, the per-PR integration pins test/package-union-readers.test.ts, and .changeset/22238-package-union-readers.md (@objectstack/cli patch).
   • Review of record:
     • REWORK 6059505962 (one changeset sentence), then ACCEPT 6059573867 at 6a6e8c78.
     • Clause-②: no; no contract review was owed.
     • CI on the head was green (34 runs) before the PR was armed. The seat's dispatch-gates --self-test passed (1976 cases) for the new temp-directory sites; round 2 changed only the changeset.
   • Delivered: a multi-package composeStacks(…, { manifest: 'preserve' }) app is judged by its package bodies, as the same app shipped as one package always was:
     • os validate / os build refuse a required capability with no installable provider, naming the package;
     • os lint --strict and os i18n check report a missing translation in any package;
     • os i18n extract extracts every package's keys;
     • the undeclared-authoring-key warnings cover package bodies.
     • Every (normalized call site in the CLI's commands is now classified and pinned.
     • A single-package app's output is byte-identical.
   • Filed from the dev's report:
     • [finding] cli(serve): os serve resolves capability providers from a multi-package artifact's top-level requires only — a package's requires: ['automation'] is not loaded at boot #22288 (os serve loads capability providers from the top-level requires only);
     • [finding] cli(migrate meta): on a composeStacks preserve project the authored-source load is refused with STACK_PROVENANCE_MISSING ("not built by defineStack") although every input is wrapped #22289 (os migrate meta refuses a composed project with STACK_PROVENANCE_MISSING).
     • metadata: every boot of a multi-package artifact built by os build warns that its flat src/docs pages are "claimed by no package body" — the CLI puts them at the top level by its own rule, and the warning`s remedy cannot be followed #22190, the producer-side member of the family, stays its own card.
9. objectstack-fleet

   removed

   pm:dispatched

   on Oct 8, 2026
10. akarma-synetal

    added a commit that references this issue on Oct 9, 2026

    fix(cli): read a multi-package artifact's package bodies in the capab…

    ...

    This issue will close once commit 6d2da32 is merged into the 'main' branch.

    6d2da32