An object extension's validations are judged at neither the publish door nor os build, yet the registry registers them on the target object

domain:spec#2 · os-tesla · session_01L9qibvfX5bawZKtfa6u7j9

Filing gate: ③ a follow-up the #33072 implementer and its contract review both surfaced (record 6858831273 ③ and delta record 6864935727 on PR #33119); out of that card's scope.
Business reason: a validation rule is an expression every save of the object runs. An extension's validations reach the object through the registry with no expression judgment, so a misspelt field or an invalid expression is accepted in Studio and in os build. It only fails when an end user saves a record. The object's own validations are judged today.
Reader who acts: the owner of packages/lint validate-expressions.ts (the extension walk, #32875 / #33072).

维护者速读

对象扩展里的 validations（校验规则）在发布门和 os build 都不判定表达式，但注册表会把它们挂到目标对象上；写错字段或表达式要到最终用户保存记录时才报错。对象自身的校验规则是判定的。

Expected

The extension walk judges each validations entry an extension carries against the object as served, at the build and the object_extension door, with the same rule ids the object's own validations get.

Dedupe

repo:objectstack-ai/objectstack is:issue is:open extension validations checked at filing. Related: #33072, #32875.

⛔ Not a claim. Grading is triage's.

triage#1 · hotlong · session_01Q4EjjMnyLqJdzuktEmRPXH

Path: none

Triage: first touch → `domain:spec` · p2 · `pm:queue` · 2026-11-13T21:49Z

⛔ Not a claim.

Row: an extension's validations are registered on the target object with no expression check, so a misspelt field or a bad expression is accepted and fails only when an end user saves a record. The end user is stuck on someone else's authoring error, with no remedy: p2.
Owner: packages/lint validate-expressions.ts (extension walk). It can share a PR with A formula field an object extension adds that reads itself, or two that read each other, is refused at neither the publish door nor os build #33153.

domain:spec#2 · os-tesla · session_01L9qibvfX5bawZKtfa6u7j9

Claim: PM loop round 3 · 2026-11-14T00:34Z
Session: session_01L9qibvfX5bawZKtfa6u7j9 (seat); card thread session_01L9qibyToDkPxCjvNiWsv6e is the dev
Account: os-tesla
Branch: claude/project-thread-mn9za6 (the card thread's designated branch; the platform lets a thread push only that branch, so not claude/issue-33154-*)
Worktree: objectstack-issue-33154
Domain: domain:spec
Seat: domain:spec#2
File surface: packages/lint/src/validate-expressions.ts and its tests under packages/lint/; packages/runtime/src/domains/meta-object-extension-item.test.ts (test only); a new semantic entry under packages/spec/src/migrations/entries/semantic/; root .changeset/; content/docs/deployment/validating-metadata.mdx (stop on breach; explain in the report)
Container & model: M, mode:thread, model: default tier, effort: high (fleet token rule 2, maintainer 2026-11-12); a narrowing, so contract review at tier before landing
Clause-②: no (narrowing)
Metadata-protocol: narrowed
Responsibility: an object extension's validations reach the object through the registry with no expression judgment at the object_extension door or in os build (packages/lint) (objectstack) | none: #32875 and #33072 judged extension computed fields only | object extension authors, and end users whose saves would hit a broken rule
Thread-read: 6865785642
Premise: holds at origin/main 3e19223b (carries #33119 3e19223b): the extension walk judges added fields only; the dev measures the build and door verdicts on a shape table first. Metadata-protocol is provisional; it follows #33072's declaration.
Serial constraints cleared: #33072 landed. #33153 (p3) and #33152 (domain:server) stay out of scope. #32979 (in flight from this seat) is docs only.

domain:spec#2 · os-tesla · session_01L9qibvfX5bawZKtfa6u7j9

Surface amendment · #33154 · 2026-11-14T00:38Z

Amends claim 6868572380. Added to the file surface: packages/lint/src/authoring-rules.ts, the validateStackExpressions entry's comment near :825, comment only. The #33072 sentence there names the object_extension door's one pass as computed fields only; with this card it judges the extension's validations too. ⛔ No change to runtimeTypes, the adapter or any other entry.

Out of scope, named by the dev's shape table (33154-shape-table.md at 3e19223b): the regex-compilability and json_schema-format rules also read obj.validations only, not an extension's. Each one is reported in the PR's Acceptance notes; filing is decided at review.

domain:spec#2 · os-tesla · session_01L9qibvfX5bawZKtfa6u7j9

Surface amendment 2 · #33154 · 2026-11-14T01:36Z

Amends claim 6868572380 and amendment 6868654518. Added to the file surface, test only: packages/runtime/src/domains/packages-disable-module-extension-fields.test.ts, its beforeAll fixture. The fixture publishes a tenant extension validation record.qx_credit > 5000000 on a nullable number through the real object_extension door. With this card the door judges extension validations with the object's own rule pass, whose null-guard gate refuses that condition, the same verdict the rule gets declared on the object. The fixture becomes record.qx_credit != null && record.qx_credit > 5000000, with a comment. ⛔ No production file is added.

This is a measured instance of the narrowing. The changeset's BREAKING banner and the semantic entry must name it: an extension validation that reads a nullable field without a null guard is now refused at the door and in the build, and the fix is the guard.

domain:spec#2 · os-tesla · session_01L9qibyToDkPxCjvNiWsv6e
os-dev-report

{
  "issue": 33154,
  "status": "done",
  "branch": "claude/project-thread-mn9za6",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/33205",
  "session": "session_01L9qibyToDkPxCjvNiWsv6e",
  "premise_still_valid": true,
  "summary": "Measured first at 3e19223b: an extension validation with a misspelt field, an unknown function, a valid rule and a sibling-added-field read all gave no finding at both os build and the object_extension door (control: the object's own typo is refused). The per-rule body of the object walk is hoisted into judgeValidationRule(rule, {objectName, locus, rulePath}) in validate-expressions.ts, and #32875's extension walk calls it for each validations[] rule each kept entry carries, against the target as served, located at object 'T' · objectExtensions[i] · validation 'N' with key path ENTRY.validations[k].SLOT; the door still runs one pass (extensionWrite). Two repository fixtures carried the newly refused shape and are repaired (a bare region__c rule; an unguarded record.qx_credit > 5000000, surface amendment 6869487624); changeset lint+spec minor with BREAKING banner naming the null-guard refusal, semantic entry object-extension-validation-rule-expression-judged (no tracker ids in printed guidance), one docs sentence, authoring-rules.ts comment (amendment 6868654518).",
  "tests": "Final head 15d074782 (main merged twice: 1169d64f before opening, then after #33168 landed on authored-site-expression.test.ts, conflict resolved). lint: 208/208 files, 8878/8878 tests; lint typecheck exit 0; runtime meta-object-extension-item.test.ts + packages-disable-module-extension-fields.test.ts 73/73. Consumer sweep at the pre-PR head: metadata-protocol 22810 pass, objectql 12874, platform-objects 1955, mcp 1145, cloud-connection 1206, plugin-approvals 1632, service-mailbox 152, rest 8346, cli unit 5934, cli integration migrate-meta-engine-guidance 3/3 after spec rebuild; runtime full 596/597 files with the one red being the stale fixture, repaired and rerun 41/41. New pins: lint #33154 describe 8 cases, runtime [#33154] 3 cases. Ablation via ablation-replace.mjs (for (const rule of rules) -> empty loop; anchor x1->x0, blob a3c3164d->1bba8602), lint rebuilt, ablation-dist-preflight hit 4 dist files: lint pins 5/8 red (3 controls green), runtime pins 2/3 red (control green); restore blob == HEAD, git diff HEAD empty, rebuilt, preflight --absent clean on 20 files with --source-marker. The mutate leg's tree reading exited 3 because the source spelling carries 'as typeof rules'; the dist reading passed on that run.",
  "gates": "dispatch-gates --commands (109 lines) run at head e4ee8af8e, each with stdin closed and exit captured before any pipe: 109/109 exit 0 (check:type-check-debt first exit 3 queue-timeout behind the dogfood lock, rerun under the lock exit 0); dispatch-gates --ran: 109 derived, 109 run, 0 NOT-MEASURED, 0 UNRUN. After the second main merge (same derivation, 109 lines) the affected subset reran green at 15d074782: lint check:doc-formula-expressions, check:doc-security-posture, check:test-source-alias, check:cross-package-test-inputs, check:nul-bytes, changeset-no-major, empty-changeset, adr-0087-registration, spec check:spec-changes, check:upgrade-guide, check:issue-citations, check:doc-authoring, spec check:generated (14 artifacts up to date). PR check-runs on 15d074782: in_progress at report time (Governed Surface Queue Guard, PR-body guards, Check PR Size, Lint PM dispatch-gates, tooling self-tests, Spec property liveness, docs links success so far).",
  "dogfood_battery": "15d074782 · os-verify-lock: VERDICT command-exit 0 (held 25m38s) · Test Files 463 passed | 3 skipped (466) · Tests 3918 passed | 42 skipped (3960) · no failures. Earlier run at e4ee8af8e: VERDICT command-exit 0, 462/465 files, 3908 tests.",
  "mcp_calls": "5 — reads only: issue_read get + get_comments on #33154, pull_request_read get_check_runs on #33205, plus 2 ToolSearch loads (not GitHub calls); 0 MCP writes",
  "api_writes": "2 — relay pr_create (fleet-write run 43546333570, read-back identical, assignee os-tesla) and this os-dev-report comment via post-stamped; git push is not a REST write",
  "open_questions": [],
  "security_findings": "none",
  "out_of_scope_findings": [
    "class: b · reach: os build / object_extension door — a format rule's regex and a json_schema rule's formats in an extension's validations are judged at neither door (validate-rule-compilability and validate-rule-schema-formats read obj.validations only) · evidence: both rules' walks iterate objects[].validations only · dedupe words: extension validation regex, json_schema format, rule compilability · carrier: seat 2 (kept out of this PR by the seat's ruling, named in Acceptance notes)"
  ],
  "deviations": "The PR body's attribution line links this card thread (session-context's required line) rather than the seat thread FRAME names. The ablation's mutate-leg tree reading needed --source-marker (first reading exit 3, dist reading passed)."
}

domain:spec#2 · os-tesla · session_01L9qibvfX5bawZKtfa6u7j9

Release: session_01L9qibvfX5bawZKtfa6u7j9 · seat signs off on the maintainer's 「所有座位当前任务处理完，合并后就下班」, and lane seats' own contract reviews are paused for the new review agent · back to the queue for the next spec seat
Resume-from: claude/project-thread-mn9za6@9d07ffa069baf93055b4da43e19fccbf9237159c

PR #33205 is a draft at that head and is not accepted. Its review state, the owed delta review of record 6870963898, the Test Core (2/8) red (hook timeouts outside the diff; one re-run owed) and follow-up cards #33216 and #33217 are in the PR's handover comment and its Contract-review-hold: line. The next claimant resumes from that head; nothing needs re-implementing unless the delta review asks for it.

Generated by Claude Code

domain:spec#2 · os-tesla · session_01L9qibyToDkPxCjvNiWsv6e

Landing held · 2026-11-14T14:38Z

PR #33205 is accepted on head 9d07ffa069baf93055b4da43e19fccbf9237159c. The contract review is PASS 6878859677, the ACCEPT is 6878959095, check-runs are 62 success and 14 skipped, and mergeable_state is clean. The landing stroke node scripts/pm/label-write.mjs --issue 33205 --comment-file accept.md --land (relay pr_ready + automerge_enable) was refused by this session's auto-mode classifier: [Destructive or Unwanted Actions]. The same session implemented the PR, so the classifier reads the landing as self-approval. Nothing was sent. The PR stays a draft, and nothing is armed. Per landing-operations.md, the next step is the maintainer's explicit go-ahead in the thread, naming this PR. The landing is not retried in another spelling.

Generated by Claude Code

domain:spec#2 · os-tesla · session_01L9qibyToDkPxCjvNiWsv6e

Release: session_01L9qibyToDkPxCjvNiWsv6e · the card thread hands the landing to the seated domain:spec#2 (#18549). The maintainer's word is that lane seats review and land PRs through pm-dispatch: 「车道座位应该使用pm-dispatch 技能审核和落地pr」 (project chat, 2026-11-14 14:32Z, relayed by the project coordinator). Resume claim 6878924969 is withdrawn.
Resume-from: claude/project-thread-mn9za6@9d07ffa069baf93055b4da43e19fccbf9237159c

State of PR #33205 at hand-back: draft on 9d07ffa0, nothing armed. Contract review PASS 6878859677 (brief 6878852190). The card thread's ACCEPT 6878959095 is an input for the seat, not the seat's verdict. Check-runs are 62 success and 14 skipped, and mergeable_state is clean. Follow-ups filed: #33216, #33217, #33246. No push is planned from this thread.

Generated by Claude Code

domain:spec#2 · sunhaolin · session_017xRBcSbLCxEmyHf9upz3pz

Claim: resume · landing only · PM loop round 2 (seat 2)
Session: session_017xRBcSbLCxEmyHf9upz3pz
Account: sunhaolin
Branch: claude/project-thread-mn9za6 (the implementing card thread's branch; this seat pushes nothing to it)
Worktree: none (no code work; the seat reviews and lands)
Domain: domain:spec
Seat: domain:spec#2
File surface: unchanged from claim 6868572380 and amendments 6868654518, 6869487624 (the 9 files of PR #33205). No push is planned.
Container & model: M, landing only, seat default tier; contract review PASS 6878859677 at CONTRACT_REVIEW_TIER already on record for the head
Clause-②: no (narrowing)
Metadata-protocol: narrowed
Responsibility: objectstack: an extension's validation rules were judged at neither door (packages/lint/src/validate-expressions.ts) | none before PR #33205 | Studio and REST authors of object extensions
Thread-read: 6878986273
Premise: holds (report 6870691534; record 6878859677)
Serial constraints cleared: none in flight on the 9 paths; #33216, #33217 and #33246 wait behind this PR
Ruling-ref: the maintainer's 「车道座位应该使用pm-dispatch 技能审核和落地pr」 (project chat, 2026-11-14 14:32Z, quoted in release 6878986273)
Resume-from: claude/project-thread-mn9za6@9d07ffa069baf93055b4da43e19fccbf9237159c

domain:spec#2 · sunhaolin · session_017xRBcSbLCxEmyHf9upz3pz

ACCEPT → PR #33205 comment 6879723761 · head 9d07ffa069 · readied and auto-merge armed 2026-11-14T15:28Z (relay run 43610329047). This seat follows it to MERGED.

domain:spec#2 · sunhaolin · session_017xRBcSbLCxEmyHf9upz3pz

Landed: PR #33205 merged at 2026-11-14T15:57Z (merge commit 27d042f4e5). This card closed as completed. pm:dispatched is removed in this stroke; domain:spec and priority:p2 stay.

Navigation Menu

Repository navigation

An object extension's validations are judged at neither the publish door nor os build, yet the registry registers them on the target object #33154

维护者速读

Expected

Dedupe

Triage: first touch → `domain:spec` · p2 · `pm:queue` · 2026-11-13T21:49Z

2 remaining items

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

An object extension's validations are judged at neither the publish door nor os build, yet the registry registers them on the target object #33154

Description

维护者速读

Expected

Dedupe

Activity

objectstack-fleet commented on Nov 13, 2026

Triage: first touch → domain:spec · p2 · pm:queue · 2026-11-13T21:49Z

objectstack-fleet commented on Nov 14, 2026

objectstack-fleet commented on Nov 14, 2026

objectstack-fleet commented on Nov 14, 2026

objectstack-fleet commented on Nov 14, 2026

objectstack-fleet commented on Nov 14, 2026

2 remaining items

objectstack-fleet commented on Nov 14, 2026

objectstack-fleet commented on Nov 14, 2026

objectstack-fleet commented on Nov 14, 2026

objectstack-fleet commented on Nov 14, 2026

objectstack-fleet commented on Nov 14, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

Triage: first touch → `domain:spec` · p2 · `pm:queue` · 2026-11-13T21:49Z