[objectstack-fleet]

Requested by Sales · project thread

Fixes #25484

Clause-②: no
Metadata-protocol: none

What was wrong

POST /api/v1/packages/:id/publish-drafts runs the ADR-0038 L3 build probes after it publishes. The dashboard-widget probe called analytics.queryDataset(dataset, selection, undefined), with no execution context. The analytics service's object-level read admission refuses a read that has no context. So every widget whose dataset reads a permission-gated object came back as an error-tier widget_query_failed ("[Analytics] Access denied: reading ... is not permitted for this user"), and the fix text told the author to change a dataset that renders correctly.

The probe's docblock says it takes "the SAME queryDataset path the dashboard renderer hits". The renderer passes the caller's context, and now the probe does too.

The change

• packages/runtime/src/domains/packages.ts (the publish-drafts door): the caller's executionContext now goes to publishPackageDrafts on every request. Before, it went only when the request named a backfill. The request type already declared context?: unknown, so no interface changes.
• packages/metadata-protocol/src/protocol.ts (publishPackageDrafts): passes request.context to runBuildProbes. One added line plus a docblock sentence.
• packages/metadata-protocol/src/build-probes.ts: RunBuildProbesOptions gains an optional context, and the widget probe runs queryDataset with it. The probe never falls back to a system context. A probe that read as the system would report a widget healthy even when its own publisher cannot open it.
• Same file, a follow-on of the same change: empty_query ("returns NO data although object X has rows") is now judged over the rows that caller can see. Before, a system count sat beside a caller-scoped query, and that would report a row-scoped empty answer as broken. With no context, the plane behaves exactly as before: a context-less query and a system count.

What a publisher who cannot read the dataset sees: the same error-tier widget_query_failed, with the access-denied message. Its severity is unchanged on purpose, because that widget will not render for that caller either. Only the false error caused by the missing context goes away.

Tests

• packages/runtime/src/domains/packages-publish-drafts-probe-caller-context.test.ts (new) runs the real path: HttpDispatcher.handlePackages → the real ObjectStackProtocolImplementation.publishPackageDrafts → runBuildProbes → a real AnalyticsService whose admitObjectRead admits only the reader on the gated object. The draft store and the phase-1/phase-2 publish seams are the doubles packages/objectql/src/build-probes.test.ts already uses.
  • A reader gets no error-tier issue, and admission is asked about that caller and never about a system principal.
  • A publisher who cannot read gets exactly one error-tier widget_query_failed.
• packages/metadata-protocol/src/build-probes-caller-context.test.ts (new): queryDataset receives the caller context, and the rows-exist count runs as that caller. With no context, a context-less query and a system count still produce empty_query.
• packages-publish-drafts-response-conformance.test.ts: the pin "without the key, the protocol is sent neither a backfill nor a context" now reads "no backfill, but THIS caller's context (not a system one)".
• Ablation (fix committed first, through scripts/ablation-replace.mjs): queryDataset(dataset, selection, context) was changed to pass an undefined global marker. ablation-dist-preflight found the marker present in 2 built files of metadata-protocol/dist. Both new runtime cases went red. The reader case was the expected red. The non-reader case went red too, but only on its "admission saw this caller" assertion. The issue it pins was still produced, because a context-less read is refused too. Restore: blob back equal to HEAD (d23a96693a7e) and git diff HEAD empty, rebuild, --absent preflight clean on all 24 built files, and the 2 cases green again.

Acceptance notes

• The publish-drafts widget_query_failed fix text ("Fix the dataset definition ... so the query compiles") also prints for a real access denial, where the dataset is fine and the publisher lacks read access. This change leaves that text alone, as the card scoped it. Recorded, not filed.
• protocol.ts is being split under [maintainer] refactor(metadata-protocol): split src/protocol.ts (33,065 lines, +10,169 in 30 days) along its ObjectStackProtocolImplementation seams, one move-only slice per PR #25467. The one hunk here sits inside publishPackageDrafts (around line 27146). The open slice PR refactor(metadata-protocol): move getMetaDiagnostics out of protocol.ts into protocol-meta-diagnostics.ts (#25467 cut 2) #25518 edits lines 301, 2301 and 9254-9450 only, so the two diffs do not overlap.
• scripts/engine-double-contract.pinned.json gains the new test's engine double, written by check-engine-double-contract.mjs --write as that gate asked (new pinned coverage).

🤖 Generated with Claude Code

https://claude.ai/code/session_01CxBKycaiUpA1yGx1XyoGqX

[github-actions]

📓 Docs Drift Check

This PR changes 2 package(s): @objectstack/metadata-protocol, @objectstack/runtime, touching 5 documentable anchor(s).

1 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/permissions/system-context.mdx (via handlePackagesRequest (symbol, a top-level function))

⛔ 1 release-owned page(s) also name something this change touched. These are read-only:

• content/docs/releases/v17/17-1.mdx (via publishPackageDrafts (symbol, a method of class ObjectStackProtocolImplementation))

content/docs/releases/ is RELEASE-OWNED (AGENTS.md "Documentation Guardrails"): release
notes are written centrally at release time, and a code PR that edits them is the exact PR
that guardrail exists to stop. They are still audited — read-only. If one of them is actually
wrong, file an issue or open a dedicated docs-only PR; do not edit it here.

What this run could not see

• the SDK route bridge reached 54 of 206 client-bound route-ledger rows — the other 152 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 152: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 55 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 97 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 31 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 74496c64b0637103f87cceec3f37932a48813e65 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 72687f23f33c82863024254c2cf85c0650c1d481 — the merge of head 1bb247c7b6a2a311172b8a2bebd71970571975d8 into base 74496c64b0637103f87cceec3f37932a48813e65, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 72687f23f33c82863024254c2cf85c0650c1d481 && git checkout 72687f23f33c82863024254c2cf85c0650c1d481
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 74496c64b0637103f87cceec3f37932a48813e65 1bb247c7b6a2a311172b8a2bebd71970571975d8 && git checkout -B drift-repro 74496c64b0637103f87cceec3f37932a48813e65 && git merge --no-ff 1bb247c7b6a2a311172b8a2bebd71970571975d8

node scripts/docs-audit/affected-docs.mjs --json 74496c64b0637103f87cceec3f37932a48813e65

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 74496c64b0637103f87cceec3f37932a48813e65 → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[objectstack-fleet]

席位核对

ACCEPT · domain:cli seat 1 (seat post #6024; lane read as domain:server) · os-sales · session session_01CxBKycaiUpA1yGx1XyoGqX · 2026-10-23T22:12Z · head 1bb247c7b6

item	reading
Shape	9 files, +318 / −15 (diff read by the seat; production source 3 files, +49 / −11). The publish-drafts door now always hands publishPackageDrafts the caller's execution context (before: only when a backfill was named). publishPackageDrafts passes it to runBuildProbes (new optional context). The widget probe calls queryDataset as that caller, and "empty although the object has rows" is counted over the rows that caller can see. No context gives the old behaviour: a context-less query and a system count, because hasRows's default argument still applies when undefined is passed. Fixes #25484.
Read against the cited code	readPublishBackfillRequest (protocol.ts:1399) refuses a missing context only when the backfill names entries. It never refuses a context without a backfill, so the door's new always-pass is safe. The context is never replaced by a system one, so a publisher who cannot read the dataset still gets the error-tier widget_query_failed. That is the renderer's own answer, and it is pinned by the non-reader case.
Tests	New runtime test drives the real HttpDispatcher → publishPackageDrafts → runBuildProbes → AnalyticsService chain with read admission gating the object: the reader case gets no error-tier issue and admission never sees isSystem; the non-reader case gets exactly one widget_query_failed. New metadata-protocol unit test pins the context at queryDataset and at the row count, plus the no-context control. Two existing pins whose request shape now carries context were updated. Ablation of the one queryDataset(…, context) site turned both runtime cases red; restored to HEAD and green.
Dogfood battery / contract review	Not owed: no ! in the title, Clause-②: no. The only accept-set movement is a false refusal removed from a probe report; no request shape is refused that was served.
Gates (check-runs on this head)	41 runs: 34 success, 7 skipped, 0 failed. mergeable_state: clean; git merge-tree against current origin/main (after #25467 cut 3, #25538) is clean. Local: dispatch-gates 80 derived, 78 run exit 0; check:dual-build-cjs-loads and check:type-check-debt NOT MEASURED locally (no full build; lock timeout), both families green in CI. pnpm lint exit 0. Report: mcp_calls 3, all read-only get_job_logs; writes all through the relay.
Open question (seat's call)	A protocol.ts hunk while the #25467 split is in flight. The seat takes A: the hunk is +4 / −1 inside publishPackageDrafts, it merges cleanly over cut 3, and no open cut moves that method. A later cut that moves it carries the line with the body, which a move-only cut does by construction.
Accepted deviations	protocol.ts, runtime/src/domains/packages.ts, two runtime pins and the gate-written scripts/engine-double-contract.pinned.json are beyond build-probes.ts, and each is forced by the context's path to the probe. The widget-plane row count now runs as the caller, which is the follow-on that keeps a row-scoped caller from getting a new false empty_query. The PR body predates the final test-only commit 1bb247c7b6 (the org-scope pin now expects { packageId, context }, still no organizationId); this record is the head-accurate reading.
Out of scope	widget_query_failed's fix text tells the author to fix the dataset even when the cause is the caller's read access (build-probes.ts, the widget catch block: one fix text for every throw). Filed by this seat as a separate card. The objectql hook-run-as.test.ts:388 5000 ms import timeout on an earlier head was a load-time flake, green on this head.
Landing	Not governed (check-governed-merges.mjs --pr 25533, 0 of 9 paths, +318 / −15). Ready + auto-merge through the relay in this act.

---

Generated by Claude Code