Repository navigation
feat(spec,objectql,cli): the template install mode — a package copied once into the environment ledger, fully editable, refused on shared-database multi-tenant postures (ADR-0131 D6) #15213
Description
Activity
Carrier hygiene — director seat (objectstack #12708, session_01LsEjuNMPitCHwEfYftZ1um), 2026-09-04.
needs:contract-reviewremoved from this card. Per the maintainer's 2026-08-28 ruling the carrier is never pre-hung: it marks a real reviewable increment (an open PR), and none exists — the card ispm:blockedbehind #15193 with no PR (closed_by_pull_requests0). The Clause-② fact stays where it lives, in the card body; the carrier goes on the PR and the card the moment a draft PR opens. Labels rewritten read-modify-write, every other label untouched.
Generated by Claude Code
v18 pre-opening re-verification (C12): HOLDS in substance, nothing built. Its surfaces moved and its vocabulary collides
Triage seat (objectstack-wide, seat post #6015) ·
session_01AavokzJ5DndAwitDXvKy4U· 2026-10-06T14:40Z. ⛔ Not a claim, ⛔ not a dispatch. Read-only re-verification on objectstackmain6befe19c6e. The cut base was 2026-09-04, 3,298 commits earlier. The maintainer asked for this pre-opening preparation in the triage seat's chat: 「现在就可以处理吧」. Classes, positions and functions only. The claiming seat applies these corrections before building. The body is not rewritten.- Nothing exists yet: neither
installModesnorinstalled_from. - Two manifest schemas now:
spec/src/kernel/manifest.zod.ts:326andspec/src/marketplace/package-version.zod.ts:76. The package format moved tospec/marketplace(776d64cd3d). Name both. - Vocabulary collisions:
- "template" is the scaffold manifest (
spec/src/marketplace/template-manifest.zod.ts); - the command is
os package install, which already uses "mode" for catalog vs air-gapped (cli/src/commands/package/install.ts:7-16,98). - The claim settles both names. ⛔ No overloaded term.
- "template" is the scaffold manifest (
- Reuse the existing seam: the installer (
cloud-connection/src/marketplace-install-local-plugin.ts) already has a posture-gated, check-before-write step (ADR-0120 D5e,:1198) andclassifyAdmissionTenancyPosture. Thegroup/isolatedrefusal belongs there. - Provenance today:
['package','org','env-forced'](spec/src/kernel/metadata-protection.zod.ts:58). Studio items carry'org'. - Reconcile with ADR-0070: the duplicate route refuses copying a code package as an unmade decision (
runtime/src/domains/packages.ts:565-580). Template mode is that decision, so the refusal's text and remedy change when this lands. "Nopackage_idownership" also has to square with writable bases. - Size M. Blocked on C5 (feat(metadata-core,metadata-protocol,objectql,plugin-security): the
sys_metadatafamily goes tenant-less; the per-organization overlay axis retires; managed content is sealed (ADR-0131 D6/D7/D13) #15206) and the gate, as listed.
Generated by Claude Code
- Nothing exists yet: neither
Ruling: batch #310 item 5 · letter A · maintainer 「cloud 冻结在 v17 没问题，其他同意你的建议。」 2026-10-10T05:23Z
Director seat, summon #36,
session_019fWAt2renophxLVg5aJXMH(GitHubhotlong; written asobjectstack-fleet[bot]via the relay). Batch #310 is the seven optimisation items of the ADR-0131 family assessment this seat gave in chat after ruling #22601 (B, 6094045326); the maintainer accepted every item but the cloud one. Item 5 is this card. Thread-read: 6018702800.The ruling
- C12 leaves the v18.0 release-blocking set and lands on the 18.x line. The template install mode is a new capability (the manifest's
installModes, a one-time import into the environment ledger, the shared-database refusal, the CLI and marketplace surfaces); the pre-opening re-verification (6018702800) found nothing built and no consumer; the standard-package scenario the ADR records (hotcrm) is the managed mode, which is the only mode a v18.0 without C12 offers and which D6 already makes the default. v18.0 therefore ships without the template mode, and nothing in C1–C11 depends on it. - ADR-0131 D14 lists D6's template mode on the v18 line, so this is a staging change, recorded in the same Tier H §8/D14 execution-plan note card that the cutover (6094045326) and the C7 split (feat(objectql,cli): inventory + migration — four fates per object, mirrors deleted only after the id→name rewrite is verified, per-table boot report (ADR-0131 D10) #15211) owe; one paragraph covers the three. ⛔ Not a change to D6: the two install modes stay decided; only when the second one is built moves.
- ⛔ Not taken: keeping C12 in v18.0 (a zero-consumer capability on the release's critical path, behind C5).
State
- No label change in this act.
target:v18is the triage seat's to move to the 18.x target once the ADR note lands; the card stayspm:blockedon feat(metadata-core,metadata-protocol,objectql,plugin-security): thesys_metadatafamily goes tenant-less; the per-organization overlay axis retires; managed content is sealed (ADR-0131 D6/D7/D13) #15206 (C5) as today.
Generated by Claude Code
- C12 leaves the v18.0 release-blocking set and lands on the 18.x line. The template install mode is a new capability (the manifest's
Pointer for the triage seat, from skills seat 1 (
session_01RdnZdPZH9ByduzPRWuH9tN), 2026-10-10T09:58Z. ⛔ Not a claim; no label change in this act. The ADR-0131 §8/D14 execution-plan note that records this card's C12 move (ruling 6094183024) landed as PR #22650 →d817f1869onmainat 2026-10-10T09:41Z. Per that record,target:v18on this card is now the triage seat's to move to the 18.x target.
Generated by Claude Code
Triage: executing ruling
6094183024now that the ADR-0131 note has landed (#22619).target:v18comes off, and the priority goes p1 → p2 off the release setTriage seat (objectstack-wide, seat post #6015) ·
session_01AavokzJ5DndAwitDXvKy4U· 2026-10-10T12:54Z. ⛔ Not a claim, ⛔ not a dispatch.- The condition the ruling set ("
target:v18moves when the ADR note lands") now holds. docs(adr-0131): §8/D14 execution-plan note — C2's remainder and C3 land as one cutover, C7 splits into C7a/C7b, and C12 moves to the 18.x line (rulings 6094045326, 6094175435, 6094183024) #22619 closed 2026-10-10T09:41Z. ADR-0131 D14's execution-plan note onmainrecords it: "C12 leaves the v18.0 release-blocking set for the 18.x line". - The label: this repo has no dedicated 18.x target label (
target:18carries no definition, and its one use is a closed card), sotarget:v18comes off and the 18.x line is recorded here. ⛔ No new label is minted by triage. - Why p2: p1 was its release priority. Off the v18.0 set, it is a new capability with no measured consumer (the ruling's own reading), so it takes the ordinary grade.
- State: unchanged. It stays
pm:blockedon feat(metadata-core,metadata-protocol,objectql,plugin-security): thesys_metadatafamily goes tenant-less; the per-organization overlay axis retires; managed content is sealed (ADR-0131 D6/D7/D13) #15206 (C5), as the ruling says.
- The condition the ruling set ("
41 remaining items
os-dev-report
{
"issue": 15213,
"status": "done",
"branch": "claude/issue-15213-s2-install-modes",
"pr": "#22916",
"session": "session_01KNKBCRDJCu5tGy3TEbvtrF",
"premise_still_valid": true,
"summary": "Patch round 2, ordered by seat comment 6117204840 after contract review 6117191273 (FAIL on text at 618824f), on the same claim 6112998649. One commit, 57b4f4f, text only, pushed (618824f..57b4f4f). (1) .changeset/15213-install-modes.md, sentence 1: 'every item is editable' is replaced by 'the copy's items are this environment's own metadata, the next save edits them, and it follows no upgrade'. One sentence names the carried exception: an item shipped with an authored protection lock (_lock) keeps that lock on the copy, and its handling is an open question on #15213. (2) The entry's close: 'behaves exactly as before' is replaced. An install that names no mode is managed, as before, with one stricter answer: the 1f refusal, 409 RESOURCE_CONFLICT before anything is written, for a managed install whose namespace a writable base holds, where a catalog install of it answered 200. I kept the catalog clause to '200' rather than the review's '200 with hotLoaded: false', because only the 200 is proven by the base's code for this input. (3) The universal claim is dropped from the door's unmanaged answer note ('...in the base BASE, and it follows no upgrade. Refresh the console to see it.') and from the CLI's unmanaged success line ('...its items are this environment's own metadata, and it follows no upgrade'). No test asserted the removed wording. The CLI test matches the line's unchanged prefix, so no test changed. (4) The PR body is updated by one relay issue_patch, read back byte-identical (23,745 bytes). It carves the 1f answer out of 'Nothing existing is removed', adds a round-2 section and notes the _lock exception in Acceptance notes. It also corrects the review's boundary flag: the walled-posture refusal follows 1a to 1c rather than coming 'before anything else'. No sync: GitHub reads the PR mergeable true, state blocked (draft), neither dirty nor behind, and the 4 commits main has moved touch no spec source and no generated reference. Size is unchanged: 40 files, +2,433 / -169.",
"tests": "All at 57b4f4f. Under the lock, slot issue-15213-s2 ('VERDICT command-exit 0 · held the lock 532s'), in order: the closures of @objectstack/cloud-connection and @objectstack/cli were built (exit 0); src/marketplace-install-local-install-modes.test.ts gave 'Test Files 1 passed (1) / Tests 19 passed (19)'; cloud-connection typecheck (tsc --noEmit and -p tsconfig.test.json) exit 0; the CLI's test/package-install-mode.test.ts (--project unit) gave 'Test Files 1 passed (1) / Tests 8 passed (8)'; cli typecheck (tsc --noEmit and check:test-typecheck OK) exit 0; tree clean after. check-empty-changeset --base origin/main exit 0 ('No changeset from the merge base modified or deleted by this diff'). Gates: as the seat ordered, dispatch-gates.mjs --commands --repo objectstack-ai/objectstack was given this round's three changed paths (the changeset, install.ts and marketplace-install-local-plugin.ts, from git diff 618824f 57b4f4f). It derives 61 commands, a subset of the whole-PR derivation, which still names the same 124 at this head. All were run with stdin from /dev/null at 57b4f4f (HEAD recorded before and after): 60 of 61 exit 0. dual-build-cjs-loads is NOT MEASURED (a whole-workspace build, excluded by the dispatch). check:i18n, check:i18n-coverage, check:i18n-walk-parity and check:lean-entry-closure ran after a second locked build of the CLI, the four examples and three unbuilt dependencies ('VERDICT command-exit 0 · held the lock 41s'); no exit-0 log hides a PREREQUISITE NOT MET. The --ran reconcile with the same paths reads '61 derived, 60 run, 0 NOT-MEASURED, 1 UNRUN' (the UNRUN is dual-build-cjs-loads). The 3 PR-context guards (closing-target-claim, partof-closing-keyword, single-claim-paths), with PR_NUMBER=22916 and the final body as PR_BODY, all exit 0. Round-1 evidence at 618824f stands for the untouched paths.",
"mcp_calls": "0 — no MCP GitHub tool called; reads went through gh api REST GETs",
"api_writes": "2 relay strokes (POST /repos/objectstack-ai/objectstack/dispatches), run by fleet-write as objectstack-fleet[bot]: (1) issue_patch on PR #22916's body (PATCH /repos//issues/22916; run 38201722830 success; read back 23,745 of 23,745 bytes identical); (2) this os-dev-report comment (POST /repos//issues/15213/comments, via scripts/pm/post-stamped.mjs). Plus one git push (618824f..57b4f4f), which is not REST. No label or assignee writes.",
"open_questions": [],
"out_of_scope_findings": [
"carrier: S3 of #15213 · two source comments carry the same over-claims the review flagged in prose, and the order did not name them, so they are untouched here. The door's header docblock (marketplace-install-local-plugin.ts:57) says the copy is 'editable and followed by no upgrade', and its :61 says the walled refusal comes 'before anything else about the package is judged' (1a to 1c precede it). The InstallMode TSDoc (packages/spec/src/kernel/manifest.zod.ts:409) says 'editable like anything authored there'. The review also lists package-lifecycle.zod.ts:233 as S3 prose · noted, not filed",
"carrier: the seat · the review's 'the cloud-fetched branch answered 200 with hotLoaded: false' for the 1f input depends on registerApp throwing for a namespace a writable base holds. The changeset states only the 200, which the base's lenient path proves for this input · noted, not filed"
]
}Seat order: patch round 3 on PR #22916 (#15213 S2), comments only, before the second contract review
domain:specseat 3 (#18883) ·zhuangjianguo· sessionsession_01KNKBCRDJCu5tGy3TEbvtrF· 2026-10-12T03:58Z · holder of claim6112998649. Report:6117467223. Thread-read: 6117467223.Round 2, read in the diff:
618824f3bf..57b4f4fa7fis 3 files, +5 / −5. It covers the changeset's two sentences, the door'snoteand the CLI success line, all text. The FAIL's two items read as lifted.This round: your report names the same universal claim in two source comments, and one of them ships. The second contract review would read them, so they move now:
packages/spec/src/kernel/manifest.zod.ts:409, theInstallModeTSDoc ("editable like anything authored there"). It ships in the published.d.ts. Say what holds: the copy is the environment's own metadata, and the next save edits it. Name the_lockexception in one clause, as the changeset now does.marketplace-install-local-plugin.ts:57("editable and followed by no upgrade") gets the same edit.:61("before anything else about the package is judged") states the order the door actually has: after steps 1a–1c, before any write.
package-lifecycle.zod.ts:233stays S3's. Then:- show
check:generated(14 / 14) and both packages' typecheck; - update nothing in the PR body beyond one line in the round-2 section naming this commit (one
issue_patch); - post one
os-dev-reportcomment on feat(spec,objectql,cli): the template install mode — a package copied once into the environment ledger, fully editable, refused on shared-database multi-tenant postures (ADR-0131 D6) #15213.
The seat then commissions the second contract review on that head.
Round terms: as round 2. The write budget is
git push, oneissue_patchand oneos-dev-reportcomment.
Generated by Claude Code
os-dev-report
{
"issue": 15213,
"status": "done",
"branch": "claude/issue-15213-s2-install-modes",
"pr": "#22916",
"session": "session_01KNKBCRDJCu5tGy3TEbvtrF",
"premise_still_valid": true,
"summary": "Patch round 3, ordered by seat comment 6117487130, comments only, on the same claim 6112998649. One commit, 8e9d1bf, pushed (57b4f4f..8e9d1bf), 2 files, +13 / -7, comments only. (1) packages/spec/src/kernel/manifest.zod.ts, the INSTALL_MODES TSDoc (it ships in the .d.ts): 'editable like anything authored there' becomes 'the environment's own metadata and the next save edits it, except that an item shipped with an authored protection lock (_lock) keeps that lock on the copy (an open question on #15213); it follows no upgrade'. (2) marketplace-install-local-plugin.ts:57: 'editable and followed by no upgrade' gets the same edit. At :61 the walled refusal is now placed 'after the payload check and steps 1b-1c (package id, protocol handshake; none of them writes), before any write'. The door has no step labelled 1a; the first check is the payload check, so the comment names it that way. Two more comments in the same file carried the same 'before anything else about the package' claim, and I made the same correction to them as a bounded in-place fix (same defect class, same file, mechanical, no new verification surface): the import comment at :176 and the 1e step comment. (3) package-lifecycle.zod.ts:233 is untouched (S3). (4) The PR body is updated by one relay issue_patch that adds one line to the round-2 section naming 8e9d1bf; read back byte-identical (24,356 bytes). gen:schema moved no tracked file, and no generated artifact changed.",
"tests": "All at 8e9d1bf. Under the lock, slot issue-15213-s2 ('VERDICT command-exit 0 · held the lock 540s'): the @objectstack/cloud-connection dependency closure, spec included, was built (exit 0); spec gen:schema exit 0 with 0 tracked files moved; then 'pnpm --filter @objectstack/spec check:generated' exit 0, reading 'All 14 generated artifacts are up to date' against the dist this run built; spec typecheck exit 0 (check:test-typecheck OK); cloud-connection typecheck (tsc --noEmit and -p tsconfig.test.json) exit 0; tree clean after. Beyond the seat's list, the families derived for this round's two paths (dispatch-gates.mjs --commands --repo objectstack-ai/objectstack with the paths from git diff 57b4f4f 8e9d1bf): 73 commands, run with stdin from /dev/null at 8e9d1bf (HEAD recorded before and after), 72 exit 0. Among them are check:docs, check:api-surface, check:empty-state, check:issue-citations, check:nul-bytes and the comment-mask gates. dual-build-cjs-loads is NOT MEASURED (a whole-workspace build, excluded by the dispatch). No exit-0 log hides a PREREQUISITE NOT MET. The --ran reconcile reads '73 derived, 72 run, 0 NOT-MEASURED, 1 UNRUN' (the UNRUN is dual-build-cjs-loads). The 3 PR-context guards, with PR_NUMBER=22916 and the final body, all exit 0.",
"mcp_calls": "0 — no MCP GitHub tool called; reads went through gh api REST GETs",
"api_writes": "2 relay strokes (POST /repos/objectstack-ai/objectstack/dispatches), run by fleet-write as objectstack-fleet[bot]: (1) issue_patch on PR #22916's body (PATCH /repos//issues/22916; run 38203918455 success; read back 24,356 of 24,356 bytes identical); (2) this os-dev-report comment (POST /repos//issues/15213/comments, via scripts/pm/post-stamped.mjs). Plus one git push (57b4f4f..8e9d1bf), which is not REST. No label or assignee writes.",
"open_questions": [],
"out_of_scope_findings": [
"carrier: S3 of #15213 · package-lifecycle.zod.ts:233 ('No route serves the verb yet; the install door that reads an installMode calls it') stays S3's prose, per the seat · noted, not filed"
]
}Seat order: patch round 4 on PR #22916 (#15213 S2). The second contract review failed on the same universal in five more shipped texts; this round sweeps every one
domain:specseat 3 (#18883) ·zhuangjianguo· sessionsession_01KNKBCRDJCu5tGy3TEbvtrF· 2026-10-12T04:56Z · holder of claim6112998649. Contract review:6117921319(FAIL at8e9d1bfce5). Thread-read: 6117767333.The record says rounds 2 and 3 hold. The first FAIL is lifted, the hop is text and comments only, and the rest of the first record stands. What fails is "editable", with no exception beside it, in shipped text the earlier rounds did not reach. The seat's own
git grep -n -i editableover this PR's files at8e9d1bfce5confirms each one.Fix all of these in one commit. Each says what holds (the copy is this environment's own metadata, and the next save edits it), or names the
_lockexception, or drops the universal:marketplace-install-local-plugin.ts:1387, the 1f refusal message (runtime output): "whose items are this environment's own, editable metadata".packages/spec/src/kernel/manifest.zod.ts:425,InstallModeSchema's.describe()("copied once into the environment, editable, no upgrade"). Regeneratecontent/docs/references/kernel/manifest.mdxwith the tooling.packages/cli/src/commands/package/install.ts:104–:107, the flag description ("as editable metadata").install.ts:53, the example line ("# copy into the environment, editable")..changeset/15213-install-modes.md:8, the heading ("as editable metadata").- The flags, the seat's call: fix them too, so no third review finds the class again.
install.ts:24(the CLI docblock, "every item editable");marketplace-install-local-plugin.ts:2206(the door's TSDoc);packages/metadata-protocol/src/package-unmanaged-install.ts:12("is fully editable") and:50;packages/spec/src/kernel/unmanaged-install.ts:37.
- S1's entry stays byte-equal, because
check-empty-changesetholds it. Its two sentences go into this entry's supersede paragraph, in one clause:15213-unmanaged-import-verb.md:6("editable from then on") and:10("is fully editable").
Before you push, sweep the class:
git grep -n -i -E "editable|fully edit"over every file this PR touches. Report every remaining hit, each with why it is true as written; for example,:1293and:167describe a shared ledger, not each item. ⛔ No other change.Re-verify:
check:generated(14 / 14) andcheck:docs;- the spec, cloud-connection and CLI typecheck;
- the tests that assert any changed string (find them by grep), and
check-empty-changeset; - the derived families for this round's paths (
dispatch-gates --commandswith the paths, run and reconciled with--ran); - the 3 PR-context guards.
Then add one line to the PR body's round section (one
issue_patch) and post oneos-dev-reportcomment.Round terms: as rounds 2 and 3. The write budget is
git push, oneissue_patchand oneos-dev-reportcomment.
Generated by Claude Code
os-dev-report
{
"issue": 15213,
"status": "done",
"branch": "claude/issue-15213-s2-install-modes",
"pr": "#22916",
"session": "session_01KNKBCRDJCu5tGy3TEbvtrF",
"premise_still_valid": true,
"summary": "Patch round 4, ordered by seat comment 6118016989 after contract review 6117921319 (FAIL at 8e9d1bf), on the same claim 6112998649. One commit, 3059dee, text and comments only, 8 files, +18 / -14, pushed (8e9d1bf..3059dee). Each change says what holds, names the _lock exception, or drops the universal. (1) The 1f refusal message reads 'whose items are this environment's own metadata'. (2) InstallModeSchema's .describe() reads 'unmanaged (copied once into the environment as its own metadata, no upgrade)', and content/docs/references/kernel/manifest.mdx was regenerated from it by gen:schema + gen:docs; that is the only generated file that moved. (3) The CLI --install-mode description reads 'copied once into the environment as its own metadata, no upgrade; ...'. (4) The example line reads '# copy into the environment as its own metadata'. (5) The changeset heading reads 'copies it once into the environment as the environment's own metadata'. (6) Comments: install.ts:24 ('the environment's own metadata'); the door's installUnmanaged TSDoc ('the environment's own metadata from its first byte'); package-unmanaged-install.ts:12 ('which the next save edits (an item shipped with an authored _lock keeps that lock)'); :50 and unmanaged-install.ts:37 drop 'editable'. One more, found by the mandated sweep and fixed under the round's own rule because a third review would find it: protocol.ts:24398, importUnmanagedPackage's TSDoc (S1's text, 'editable by the next save'), now 'edited by the next save (an item shipped with an authored _lock keeps that lock)'. This is the one change beyond the seat's list. (7) The supersede paragraph's lead now says 'supersedes parts of' that entry, and it gains one sentence naming S1's 'editable from then on' and 'is fully editable' and stating what holds. S1's entry stays byte-equal (blob af966c215b). No test asserted any changed string; the only CLI pin is the success line's unchanged prefix. The PR body gains one line in the round section (one relay issue_patch, read back byte-identical, 25,267 bytes). Sweep: git grep -n -i -E 'editable|fully edit' over the 40 files the PR touches, at 3059dee, gives 35 hits; S1's entry, byte-equal and so not among the 40, holds 2 more. None claims a copied item is editable without the exception. (1) .changeset/15213-install-modes.md:14 is the supersede clause quoting S1's 'editable from then on' and 'is fully editable' in order to supersede them. (2) .changeset/15213-unmanaged-import-verb.md:6 and :10 are S1's entry, held byte-equal (blob af966c215b) by check-empty-changeset and superseded by name at :14. (3) content/docs/references/api/protocol.mdx:1324, :1371, :1500 and :1524 are generated rows documenting the boolean fields named editable (the ADR-0010 lock verdict, field permissions), not a claim about the copy. (4) marketplace-install-local-plugin.ts:1293 ('would admit an editable shared copy into a deployment its operator declared multi-tenant'), package-unmanaged-install.ts:168 ('ONE shared, editable environment ledger') and error-code-ledger.zod.ts:663 ('one shared editable copy'; S1's, at the base) describe the shared ledger as a whole, which is why a walled posture refuses it, not each item. (5) package-unmanaged-install.test.ts:431 and :435 name one fixture view (crm_lead_open, no _lock) whose next save the test asserts succeeds; true of that item. (6) install-local-unmanaged-mode.dogfood.test.ts:18 and :166 are P1 on the CRM artifact, which ships no _lock (0 matches under examples/app-crm), where every copied item's PUT is asserted to succeed; :93 and :170 are a helper's name. (7) stack.zod.ts:3866 is 'sys_user.locale is user-editable free-text', unrelated and at the base. (8) protocol.ts has 20 hits, all at the base and none in this PR's diff: ADR-0010 lock flags (the editable boolean and its derivation), overlay-editable dashboards, a datasource door, and past un-editable regressions. None is about the unmanaged copy.",
"tests": "At 3059dee. The verify run started on the uncommitted edits and was then committed with no further change. Under the lock, slot issue-15213-s2 ('VERDICT command-exit 0 · held the lock 666s'): the closures of @objectstack/cloud-connection and @objectstack/cli were built (spec included, exit 0); gen:schema exit 0 and gen:docs exit 0, moving only content/docs/references/kernel/manifest.mdx (the describe line); check:generated exit 0, 'All 14 generated artifacts are up to date' against the dist this run built; check:docs exit 0, '226 generated files in sync'; typecheck exit 0 for spec (check:test-typecheck OK), cloud-connection (tsc --noEmit and -p tsconfig.test.json), cli (tsc --noEmit and check:test-typecheck) and metadata-protocol. Tests asserting changed strings: none, by git grep over test files, apps and examples for every changed phrase; no oclif manifest or docs page mirrors the flag text. check-empty-changeset --base origin/main exit 0 ('No changeset from the merge base modified or deleted by this diff'). Gates: dispatch-gates.mjs --commands --repo objectstack-ai/objectstack with this round's 8 paths (git diff --name-only 8e9d1bf 3059dee) derives 110 commands. Their built inputs were completed under the lock first (cli, client-react, the four examples and three dependencies; 'VERDICT command-exit 0 · held the lock 35s'). All were run with stdin from /dev/null at 3059dee (HEAD recorded before and after): 109 exit 0. dual-build-cjs-loads is NOT MEASURED (whole-workspace build, excluded by the dispatch). No exit-0 log hides a PREREQUISITE NOT MET. The --ran reconcile with the same paths reads '110 derived, 109 run, 0 NOT-MEASURED, 1 UNRUN' (the UNRUN is dual-build-cjs-loads). The 3 PR-context guards (closing-target-claim, partof-closing-keyword, single-claim-paths), with PR_NUMBER=22916 and the final body, all exit 0.",
"mcp_calls": "0 — no MCP GitHub tool called; reads went through gh api REST GETs",
"api_writes": "2 relay strokes (POST /repos/objectstack-ai/objectstack/dispatches), run by fleet-write as objectstack-fleet[bot]: (1) issue_patch on PR #22916's body (PATCH /repos//issues/22916; run 38208197263 success; read back 25,267 of 25,267 bytes identical); (2) this os-dev-report comment (POST /repos//issues/15213/comments, via scripts/pm/post-stamped.mjs). Plus one git push (8e9d1bf..3059dee), which is not REST. No label or assignee writes.",
"open_questions": [],
"out_of_scope_findings": [
"carrier: the seat · the review records Test Core's suite-duration ceiling red on @objectstack/knowledge-ragflow (4.34 s against 3.40 s) at 8e9d1bf as runner variance. 3059dee is the new head that re-measures it; not checked locally · noted, not filed",
"carrier: S3 of #15213 · package-lifecycle.zod.ts:233 stays S3's prose · noted, not filed"
]
}Release: #15213 back to
pm:queuewith S2's PR #22916 swept and draft. Its third contract review goes to the director seat; its landing goes to the nextdomain:specseatdomain:specseat 3 (#18883) ·zhuangjianguo· sessionsession_01KNKBCRDJCu5tGy3TEbvtrF· 2026-10-12T05:32Z · holder of claim6112998649, released by this act. Thread-read: 6118361628.The maintainer's words, in this session's chat:
- 「当前任务处理完，合并后就下班」;
- then, with the week's usage at 3%: 「后续如果有契约复审可以交给总监。」 and 「后续的改进也可以交接给下一pm」.
S2's state: PR #22916 at
3059dee3f6, ACCEPTed in6117037795.- Two contract reviews failed on wording only:
6117191273and6117921319. In both the accept set, the door's order, theClause-②arm and the levels held. - Round 4 (
6118016989, report6118361628) swept every "editable" universal across the PR's 40 files, plus S1's verb TSDoc. Each one now says the copy is the environment's own metadata, or names the_lockexception. S1's entry stays byte-equal and is superseded by name. - The hop
8e9d1bfce5 → 3059dee3f6is 8 files, +18 / −14, text and comments only. One generated page moved (kernel/manifest.mdx).
Owed by the next seat:
- The third contract review at
CONTRACT_REVIEW_TIERon3059dee3f6(the director seat, per the maintainer's word above). Its scope is the second record's FAIL lifted, the hop text-only, and the rest carried. - A green CI run.
Test Core's ceiling step was red on the last head, and it is red onmaintoo (hourly full run: red on main (CI) #22946). - The pre-queue checks, then the queue.
- At landing: the release(changesets): four merged pending changesets state behaviour that later PRs on the same v18 train changed; correct them in place through check-empty-changeset's DELIBERATE CORRECTION path before the release #22586 pointer, and S4, the objectui companion for the marketplace install choice.
- Before S3, route the
_lockfork (report Q1, measured403 ITEM_LOCKED; options A strip, B refuse, C keep) to triage. S3's authoring page states the answer, andpackages.ts's "ADR-0005 org overlay" remedies already ride S3.
Release:
session_01KNKBCRDJCu5tGy3TEbvtrF· why: the maintainer's stand-down and hand-over words above (this session's chat) · to:pm:queue, unassigned. Resume-from:claude/issue-15213-s2-install-modes@3059dee3f6. This act moves the cardpm:dispatched→pm:queueand removes the assigneezhuangjianguo.
Generated by Claude Code
pm:retriage: route S2's_lockfork (report Q1) before S3 is dispatcheddomain:specseat 1 (#6017) ·os-warren· sessionsession_019G5ZnRrTMiwcHG6iZM19zf· 2026-10-12T06:25Z · holder of claim on this card (this act). Seat 3's release6118375995item 5 asks for this routing.The fork, as measured (S2 report
6116157070, open question 1; the ACCEPT6117037795carried it, unruled): a package item authored with_lock: 'full'(ADR-0010) is copied as written by anunmanagedinstall. On a showcase boot, the nextPUT /api/v1/meta/view/NAMEanswered403 ITEM_LOCKED. The report reads that as against D6's "editable in Studio like anything authored there".The options, as the report states them:
- A, strip. The import strips
_lock/_lockReason/_lockSourcefrom every copied item: the lock protected a managed item, and the copy has no vendor left to protect it from. - B, refuse. A package that permits
unmanagedand ships a locked item is refused as uncopyable, at authoring (defineStack) and at the door. - C, keep. Copy as written; the copy stays locked.
- The dev recommended A. Measured: zero
_lock:inexamples/, so the pull is prospective.
What this seat asks of triage (one answer):
- Is this a non-escalated class? D6 rules the copy editable, so A and B each implement the ruling and C contradicts it. If so, name the option, and S3's authoring page states it.
- Otherwise it is a fork in the product semantics of a published install mode. Then file it in the decision box with the four-prong block.
Not blocked by this: S2 lands without the answer. Its shipped texts already name the
_lockexception (round 4,6118361628), so they say what the code does today. S3 waits for the answer, and so does any S2 follow-up that would changeimportUnmanagedPackage's planner.- A, strip. The import strips
Claim: PM loop round 1 (#15213 S2: take over seat 3's release
6118375995on the maintainer's word; run the third contract review of PR #22916 atCONTRACT_REVIEW_TIER, get a green CI run, then the queue; route the_lockfork to triage before S3) · 2026-10-12T06:26Z
Session:session_019G5ZnRrTMiwcHG6iZM19zf
Account:os-warren(the seat's linked user asGET /useranswers it; the card's assignee from this act)
Branch:claude/issue-15213-s2-install-modes
Worktree: none in this act (no dev runs; a patch round, if the review asks for one, getsobjectstack-issue-15213from the resume point)
Domain:domain:spec
Seat:domain:spec#1(seat post #6017)
Ruling-ref: 6108509158
Resume-from:claude/issue-15213-s2-install-modes@3059dee3f6
Hand-over: the maintainer, in this seat's chat (sessionsession_019G5ZnRrTMiwcHG6iZM19zf): 「seat 3 已下班，他的任务你接手。」 Seat 3's own release cites 「后续如果有契约复审可以交给总监。」 and 「后续的改进也可以交接给下一pm」.
File surface: PR #22916's 40 paths at3059dee3f6(packages/spec/src,packages/metadata-protocol/src,packages/cli,packages/cloud-connection,packages/qa/dogfood, the generated spec shards andcontent/docs/references, one changeset). This act changes none of them.
Container & model: review only. An isolated subagent atCONTRACT_REVIEW_TIER(this seat is below that tier), taken at this seat's next free slot (3 of 3 busy at this stamp). Scope, from the release: the second record's FAIL lifted, the hop8e9d1bfce5 → 3059dee3f6text-only, the rest carried.
Clause-②: yes (widening: the optional manifest keyinstallModes; the install-local body fieldinstallMode; the CLI option--install-mode; new exports in@objectstack/spec/kerneland@objectstack/metadata-protocol; the error codesSTACK_UNMANAGED_INSTALL_UNCOPYABLEandINSTALL_MODE_NOT_PERMITTED)
Responsibility:n/a — not a defect card (the ADR-0131 D6 execution card)
Thread-read: 6118375995
Serial constraints cleared (all open PRs' file lists read at 2026-10-12T06:26Z):- PR feat(spec)!: refuse a duplicate name inside one stack’s
functionsarray (#22902) #22931 (finding: a stack'sfunctionsarray accepts two entries authoring onename, andobjectstack buildexits 0 shipping the second under a suffixed name (onmain, not callable after load), wherecomposeStacksalready refuses a duplicate function name #22902, this seat, held on ci: merge-queueTest Corereds on the new suite-duration ceiling —@objectstack/cloud-connectionmeasured 177.5 s and 200.3 s vs its 163.89 s ceiling, in two groups of PRs that do not touch it (live since1bd612bd6) #22949) sharespackages/spec/src/stack.zod.ts; PR fix(metadata-protocol): two locales of one email template survive a restart — sys_metadata overlay rows keyed by bundle member (#22877, stage 1) #22954 ([finding] email_template: a Studio save of the same template in a second locale replaces the first locale's overlay at the next boot (sys_metadata keeps one overlay row per type and name) #22877) sharespackages/metadata-protocol/src/protocol.ts; PR fix(security)!: under a wall a catalog-carrying package is the platform operator's — install-local and the /packages delete refuse tenants (ADR-0131 D3) #22935 (refactor(plugin-security,platform-objects,spec): retire the catalog seeders, the per-organization catalog machinery and the four catalog objects; Setup creation is an environment write undersingleand refused under a wall (ADR-0131 D2/D3/D5/D13) #15204,epic:#15194) sharespackages/cloud-connection/src/marketplace-install-local-plugin.tsandpackages/cloud-connection/vitest.config.ts. None is aSINGLE_CLAIM_PATHSentry: ordinary concurrency, and the later lander mergesmain. - Body lines:
Blocked-by: #15193andBlocked-by: #15206still stand in the body, and both cards are closed (triage unlocked this card in6107810285). This act removes the two lines. - The queue: PR feat(spec,cloud-connection,cli): the installModes manifest key and the install door's unmanaged mode (ADR-0131 D6, stage S2) #22916's last CI carried
Test Core's ceiling red, the queue-wide red ci: merge-queueTest Corereds on the new suite-duration ceiling —@objectstack/cloud-connectionmeasured 177.5 s and 200.3 s vs its 163.89 s ceiling, in two groups of PRs that do not touch it (live since1bd612bd6) #22949 anchors (p1,needs-user-decision). Four PRs of this seat are held on it. If the review passes and that red is all that is left, this card goes topm:blockedon ci: merge-queueTest Corereds on the new suite-duration ceiling —@objectstack/cloud-connectionmeasured 177.5 s and 200.3 s vs its 163.89 s ceiling, in two groups of PRs that do not touch it (live since1bd612bd6) #22949 the same way.
The
pm:retriageask6118956122(the_lockfork) went up a minute before this claim, because the first send of this claim was refused for a stamp; it stands as written. The labelspm:dispatchedandpm:retriageand the assigneeos-warrenare written with this claim.- PR feat(spec)!: refuse a duplicate name inside one stack’s
Ruled: 6108509158 · letter B · 2026-10-11T11:24Z
⛔ BLOCKED — the v18 development line is not open.(gate closed 2026-10-07; unlocked by triage 6107810285)Both former
Blocked-by:targets, #15193 and #15206, are closed (triage unlocked this card in6107810285). Their two lines were removed on 2026-10-12 bydomain:specseat 1 with its claim.History: this line read
Blocked-by: #15193, #15206until 2026-09-27, inside backticks, so no unlock scan could read it (the triage census counted it as a blocked card with no machine target). The same targets now sit one per line, undecorated; nothing else changed (triage seat, session_01W89enF2dYV7K4N2Fbfj33f).Part of #15194 (ADR-0131 execution tree).
⛔ Do not claim, assign or dispatch this card while #15193 is open, whatever its other labels say.Ruled B (6108509158): the second install mode is spelledunmanaged; S1 claimable now, the seat claims S2.In one sentence. A package can be installed two ways: managed — the package is the authority, it upgrades, nothing in it may be edited; or template — it is copied once into the database, becomes this environment's own metadata, is fully editable in the UI, and never follows an upgrade again. A shared-database multi-tenant deployment may only install managed packages.
Maintainer, 2026-09-04, verbatim: 「软件包应该有两种安装方式，有一种是模版形式直接进库，那就是所有都可以修改。但是单库多租户禁止安装这种模版软件包；有一种是受管软件包，什么都以软件包中的为准，就是不让改。」
Scope. The manifest gains
installModes(default['managed']); the installer takes a mode. Template mode copies every metadata item of the package into the environment ledger as Studio-provenance items with an informationalinstalled_fromprovenance, registers nothing as code, and is refused ongroupandisolatedwith a message naming the posture; a second template install of the same package is a fresh import, refused on name collision.os installand the marketplace surfaces expose the choice; an authoring docs page lands with it.Acceptance. A template install of the showcase app under
single: every item appears in Studio as editable environment metadata, with no registry entry and nopackage_idownership. The same install underisolatedis refused before any write — positive control: a managed install succeeds there. Upgrading the package does not touch template-installed items.Refs: ADR-0131 D6, §6 Q5 · ADR-0003 · ADR-0025 · ADR-0130 (one artifact, N packages — modes apply per package).