Repository navigation
checklist: re-point 38 stale items in identity-auth, ai, search, ux-conventions (v18.4.0 sweep close-out, batch A of #32908) #33328
Description
domain:devx#4 · os-project-manager · session_01FEkQ5ooRyyS95kdyC2dPEX
Filing gate: ① checklist assertion defects (#32997 rule 9): each item below will score FAIL or mislead a QA run while the product is right, or names a fixture recipe that no longer works.
Parent: #32908, the v18.4.0 sweep anchor. Its §1 close-out was measured in one pass on origin/main 87330e89 (report 6881013689 on #32908): 269 parked lines, 171 of them owe an item-text re-point over 159 items. That is too large for one PR, so the seat splits it by area file into five batches with no shared file. This card is batch A.
Business reason: every stale clause costs the next release sweep a false FAIL and a re-judgement, and a stale fixture recipe costs a run its setup time.
Reader: the domain:devx seat 4 (claim follows), then QA runs reading these areas.
Dedupe: the rows below are the parked lines of #32908 that are still stale on 87330e89. PR #33273 (merged) and #33275 (in flight) re-point other items and are excluded. No other open card re-points these items.
Fix shape
For each row: re-measure on current main first (area files move under product PRs); re-point the text to the product, bump revision, add a history row citing this card and the source record. A row the re-measure finds already right is left alone and said so in the PR. pnpm check:platform-checklist green. Files: docs/qa/platform-checklist/areas/identity-auth.json, docs/qa/platform-checklist/areas/ai.json, docs/qa/platform-checklist/areas/search.json, docs/qa/platform-checklist/areas/ux-conventions.json only.
Rows (from the #32908 close-out ledger; evidence read at 87330e89, not driven live)
| # | line | source record · comment | disposition | evidence |
|---|---|---|---|---|
| 11 | ux-conventions.labels-over-machine-names acceptance[0]: carve out the position half of sys_user_position's title per ruling A (6766839259) on #32106 |
#32949 (body §1) | re-point owed → split batch A | r4, last history 2026-10-19 #24649; missing "sys_user_position" (gap stands) |
| 21 | ai.mcp-stdio-fail-closed fixtures.requires[1]: users minted on os dev and keys used on os start avoid the Origin-header detour (key hashes are plain sha256) |
#32953 (body §1) | re-point owed → split batch A | r9, last history 2026-11-01 #28545; item unchanged since the record |
| 23 | identity-auth.default-organization-boot-invariant steps[0]: steps[0] 'boot WITHOUT --seed-admin' still seeds on os dev (seed-admin defaults on): needs --no-seed-admin |
#32953 (body §1) | re-point owed → split batch A | r4, last history 2026-10-31 #27481; missing "no-seed-admin" (gap stands) |
| 32 | identity-auth.idp-group-permission-set-mapping steps[3]/[4]: a hand grant of the same set collides 409 UNIQUE_VIOLATION with the projected grant: hand-grant first (as the pin's CONTROL); mock OIDC IdP recipe; SSO user must be invited (invite_only refuses JIT); unknown set gets the boundary sentence |
#32940 (body §1) · #33092 · 6850793622 | re-point owed → split batch A | r1, last history 2026-11-10 #32019; missing "UNIQUE_VIOLATION" (gap stands) |
| 34 | identity-auth.scim-refused-audit-row -: an unverified bearer's bucket is keyed by client address; other refusals from the same peer share the 20 |
#32940 (body §1) | re-point owed → split batch A | r1, last history 2026-11-10 #32019; item unchanged since the record |
| 40 | identity-auth.console-two-factor-prompt-phone-doors -: two-factor step draws no title (hideHeader); SMS code logged only at --log-level info |
#32940 (body §1) | re-point owed → split batch A | r1, last history 2026-11-10 #32270; item unchanged since the record |
| 41 | identity-auth.console-sign-out-and-ended-session -: a member lands on the default app page, not /home |
#32940 (body §1) | re-point owed → split batch A | r1, last history 2026-11-10 #32270; stale "/home" present |
| 54 | identity-auth.auth-method-matrix acceptance[9]; steps: delete-user/callback 404 arm needs ?token= (else 400); /auth/config wraps payload in data; openid-configuration also served under the prefix |
#32949 (body §1) · #33093 · 6850899929 | re-point owed → split batch A | r10, last history 2026-10-31 #27438; stale "delete-user/callback" present |
| 66 | identity-auth.two-factor-enrollment-reveal acceptance[4]: 'pre-verify bearer answers 401' does not hold (200/400); only a token minted before verify answers 401 after it |
#33025 · 6844741021 · #33092 · 6850793622 | re-point owed → split batch A | r5, last history 2026-10-31 #27392; stale "401" present |
| 67 | identity-auth.two-factor-disable-lifecycle steps[8]/acceptance[5]: mfa_required has three levels; a gated user cannot restore the setting (403 MFA_REQUIRED) until re-enrolled; grace stamp survives re-enrollment |
#33025 · 6844741021 · #33092 · 6850793622 | re-point owed → split batch A | r3, last history 2026-10-31 #27392; stale "mfa_required" present |
| 70 | ai.mcp-coded-refusals-and-runtime-exposure acceptance[1]: A1 names no door; the coded refusal holds on HTTP only |
#33025 · 6844741021 | re-point owed → split batch A | r4, last history 2026-10-31 #27409; item unchanged since the record |
| 71 | ai.mcp-namespace-faces fixtures; automated.ref: action ai.description must be >= 40 chars; N2's only pin packages/mcp/src/mcp-action-tools.test.ts missing from automated.ref |
#33025 · 6844741021 · #33081 · 6850173588 | re-point owed → split batch A | r2, last history 2026-11-10 #32330; missing "mcp-action-tools.test.ts" (gap stands) |
| 72 | ai.mcp-tool-call-interceptor steps[4]; knownGaps[0]; acceptance[4]: wait for health 200 before stdio calls / call after ready; knownGaps[0] can close (inline-plugin fixture booted, five legs held); inline plugin literal needs a cast |
#33025 · 6844741021 · #33089 · 6850460138 | re-point owed → split batch A | r1, last history 2026-11-10 #32269; stale "knownGaps" present |
| 81 | identity-auth.import-invitation-and-sso-domain-answers fixtures.requires[2]: fixtures should name OS_SSO_ENABLED=true on both boots; sys_identity_email has no template-id column |
#33025 · 6844741021 · #33092 · 6850793622 | re-point owed → split batch A | r3, last history 2026-10-31 #27438; missing "OS_SSO_ENABLED" (gap stands) |
| 110 | identity-auth.implicit-account-linking-ownership steps[4]: unlink-account takes the sys_account ROW id as accountId (not the provider sub) |
#33048 · 6846028996 | re-point owed → split batch A | r5, last history 2026-10-31 #27438; item unchanged since the record |
| 141 | identity-auth.first-run-owner-bootstrap steps[5]: both document loads are /_console/; /home is a client route |
#33048 · 6846028996 · #33093 · 6850899929 | re-point owed → split batch A | r5, last history 2026-10-31 #27441; stale "/_console/home" present |
| 142 | identity-auth.self-signup-gate steps[0]: invitation card heading reads 'X invited you to join Y', not 'Accept your invitation' |
#33048 · 6846028996 · #33093 · 6850899929 | re-point owed → split batch A | r8, last history 2026-11-08 —; stale "Accept your invitation" present |
| 146 | search.console-global-search acceptance[0]; steps: open-when-open no-op testable only by dispatching the click; wait for the group heading before Enter |
#33048 · 6846028996 · #33096 · 6851700388 | re-point owed → split batch A | r6, last history 2026-10-31 #27441; item unchanged since the record |
| 167 | identity-auth.oauth-app-consent-loop steps; acceptance[3]: code replay revokes tokens (measurement trap); create-client default grant_types lack refresh_token (needs offline_access); cross-user consent doors answer 401 |
#33058 · 6846283471 · #33093 · 6850899929 | re-point owed → split batch A | r3, last history 2026-10-17 #24036; stale "refresh" present |
| 168 | identity-auth.linked-accounts-social fixtures; steps: generic-OAuth sign-in door is /sign-in/social (oauth2 404); UI unlink goes through the action door; env door exists only for social providers |
#33058 · 6846283471 · #33093 · 6850899929 | re-point owed → split batch A | r5, last history 2026-10-17 #24036; stale "POST /api/v1/auth/unlink-account" present |
| 169 | identity-auth.identity-import-wizard acceptance[0]; knownGaps; steps[4]: result step does not surface the invite outcome; log transport carries no link; S4 upsert needs the match mode picked |
#33058 · 6846283471 · #33093 · 6850899929 | re-point owed → split batch A | r3, last history 2026-10-20 #24752; stale "log" present |
| 170 | identity-auth.email-verification-loop fixtures.requires; steps[3]: env overrides OS_AUTH_AUDIENCE_POSTURE / ..._SELF_REGISTRATION_PERMISSION_SET; mail link points at the API verify-email |
#33058 · 6846283471 | re-point owed → split batch A | r6, last history 2026-11-08 #31499; stale "verify-email" present |
| 171 | identity-auth.workspace-org-switch acceptance[5]; steps[6]; personas: A5 has no UI door; new session starts on the most recent org; walled admin already holds Default Organization; group write needs a writable target org |
#33058 · 6846283471 · #33093 · 6850899929 | re-point owed → split batch A | r6, last history 2026-10-26 #25843; stale "surfaces an error" present |
| 177 | search.command-palette-navigation steps[5],[6]: labels 'Dark Theme' and 'Open Full Search Page' |
#33058 · 6846283471 | re-point owed → split batch A | r4, last history 2026-10-20 #24752; stale "Dark theme" present |
| 182 | identity-auth.ai-service-account-register-and-key steps[3]/acceptance[3]: fresh account key answers 403 under the agent ceiling (ADR-0151 D3): 'ran as' proof is the credential_use audit row or ban/unban |
#33081 · 6850173588 | re-point owed → split batch A | r1, last history 2026-11-10 #32019; item unchanged since the record |
| 183 | ai.mcp-http-surface variants[1]: data:write serves create/update/delete_record and create_upload_link, not delete_records; metadata:write alone answers -32601 |
#33081 · 6850173588 | re-point owed → split batch A | r10, last history 2026-11-10 #32269; stale "delete_records" present |
| 185 | ai.mcp-run-action-exposure-gate fixtures.requires[3]; counts: action ai.description >= 40 chars; admin list_actions 47 (Mei 35), clause allows |
#33081 · 6850173588 · #33092 · 6850793622 | re-point owed → split batch A | r7, last history 2026-11-03 #29892; stale "description" present |
| 186 | search.global-search-skips-unreadable steps: totalObjects counts scanned objects and the sweep stops at the hit limit: choose T below the limit; perObject=0 accepted |
#33081 · 6850173588 | re-point owed → split batch A | r5, last history 2026-10-31 #27438; stale "totalObjects" present |
| 229 | identity-auth.self-service-password-reset steps[8]; fixtures: previous_password_hashes ring only fills while password_history_count > 0; PASSWORD_REUSE leaves the token usable; features.emailDelivery:false while mail lands |
#33092 · 6850793622 | re-point owed → split batch A | r5, last history 2026-10-20 #24963; stale "previous_password_hashes" present |
| 230 | identity-auth.two-factor-backup-codes fixtures[0]: 'one sequence on one boot' not needed |
#33092 · 6850793622 | re-point owed → split batch A | r6, last history 2026-10-31 #27377; stale "one sequence" present |
| 231 | identity-auth.ai-service-account-lifecycle acceptance[0],[2]: fresh key answers 403 under the agent ceiling: name the grant; a built-in ceiling set is refused as a person grant |
#33092 · 6850793622 | re-point owed → split batch A | r1, last history 2026-11-10 #32019; stale "200" present |
| 244 | identity-auth.admin-lifecycle-operations steps[9],[10]; acceptance[4]: original bearer answers 401 during impersonation; S10 task needs project; target must change password first |
#33093 · 6850899929 · #33094 · 6852480973 | re-point owed → split batch A | r10, last history 2026-10-26 #25843; stale "OWNS" present |
| 245 | identity-auth.session-list-revoke acceptance[0]: 'BOTH of A's sessions' assumes exactly two: start from a fresh user or read 'A's sessions only' |
#33093 · 6850899929 | re-point owed → split batch A | r4, last history 2026-11-10 #32168; stale "BOTH" present |
| 247 | identity-auth.api-key-ui-lifecycle steps[4],[5]: row action posts POST /api/v1/actions/sys_api_key/revoke_api_key (PATCH also works): name both doors |
#33093 · 6850899929 | re-point owed → split batch A | r5, last history 2026-10-27 #25807; stale "bodyExtra" present |
| 249 | identity-auth.org-membership-team-management acceptance[1]: name the gated operation (invite-member discriminates member vs admin) |
#33093 · 6850899929 | re-point owed → split batch A | r6, last history 2026-10-28 #27053; item unchanged since the record |
| 250 | identity-auth.sso-provider-groups-claim fixtures.requires: local IdP origin must be in OS_TRUSTED_ORIGINS |
#33093 · 6850899929 | re-point owed → split batch A | r1, last history 2026-11-10 #32019; missing "OS_TRUSTED_ORIGINS" (gap stands) |
| 262 | identity-auth.invitation-scope-gates fixtures: a delegated_admin can be minted over HTTP (invite as delegated_admin, sign up, accept) |
#33094 · 6852480973 | re-point owed → split batch A | r6, last history 2026-10-26 #25843; stale "delegated_admin" present |
| 267 | ux-conventions.labels-over-machine-names knownGaps[0],[2]: knownGaps[0] (Contributed by chips, objectui#13056) did not reproduce; knownGaps[2] cites http_request, removed in spec 18 |
#33094 · 6852480973 | re-point owed → split batch A | r4, last history 2026-10-19 #24649; stale "http_request" present |
| 268 | ux-conventions.write-feedback variants[6]: Studio publish toast names a count, not the package label; variants[6] lands on the expense record page |
#33094 · 6852480973 | re-point owed → split batch A | r11, last history 2026-11-04 #29906; item unchanged since the record |
Activity
objectstack-fleet commentedon Nov 14, 2026
domain:devx#4 · os-project-manager · session_01FEkQ5ooRyyS95kdyC2dPEX
Claim: PM loop round 3 · 2026-11-14T16:58Z
Session:
session_01FEkQ5p5JxKhxXJ6qSCz6f9(card thread, dev; it measured the #32908 ledger) · seatsession_01FEkQ5ooRyyS95kdyC2dPEXAccount:
os-project-managerBranch:
claude/project-thread-yvad69Worktree:
objectstack-issue-33328Domain:
domain:devxSeat:
domain:devx#4File surface:
docs/qa/platform-checklist/areas/identity-auth.json,ai.json,search.json,ux-conventions.json. ⛔ No other area file (siblings #33329 #33330 #33331 #33332 own them), no product code.Container & model: M,
mode:thread,model: default tier,effort: defaultClause-②: no
Metadata-protocol: none
Responsibility: n/a — not a defect card (checklist text lags a correct product)
Thread-read: none
Premise: holds: the rows are #32908's ledger readings at
87330e89(report 6881013689); the dev re-measures each on currentmainbefore editingSerial constraints cleared: no open PR or live claim touches these four area files (PR #33273 merged; PR #33327 edits only
approvals.json)Scope: one PR,
Fixes #33328,skip-changeset, a per-row disposition table. Order:/mnt/project-files/pm-orders/devx/order-33328.md. Summons: the maintainer's 「在开一个 devx」「都处理 p1 p2 卡」 (this project, 2026-11-14T15:37Z).objectstack-fleet commentedon Nov 14, 2026
domain:devx#4 · os-project-manager · session_01FEkQ5p5JxKhxXJ6qSCz6f9
os-dev-report
{ "issue": 33328, "status": "done", "branch": "claude/project-thread-yvad69", "pr": "https://github.com/objectstack-ai/objectstack/pull/33362", "session": "session_01FEkQ5p5JxKhxXJ6qSCz6f9", "premise_still_valid": true, "summary": "All 38 batch A items (41 ledger rows, rows 240 and 241 routed from #33331) were re-measured against the source at origin/main 82838e83. 36 items are re-pointed in identity-auth.json (26), ai.json (5), search.json (3) and ux-conventions.json (2): one revision bump and one history row per item, each naming the QA record and comment, the source anchor and #33328. 2 items are already right and untouched: identity-auth.implicit-account-linking-ownership (steps[4] already names the row id) and ai.mcp-run-action-exposure-gate (the staged ai.description is 55 characters). labels-over-machine-names follows #32106 ruling A. One half-row is left for a live drive: ai.mcp-http-surface's metadata:write-alone -32601 reading. The per-row table with file anchors is in the PR body.", "tests": "Checklist text only; no test changed. After the edit, a JSON reparse checked every non-target item byte-identical and each target item at revision +1 with exactly one new #33328 history row. pnpm check:platform-checklist: EXIT=0, 'OK — 16 areas, 427 items (419 active, 3 planned)'.", "gates": "Local at head 1ef51c9b: node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack derived 16 families over 4 paths vs merge base 82838e83. Each ran with its exit captured before any pipe: 16 exited 0. pnpm --filter @objectstack/lint run check:doc-formula-expressions first exited 3 (formula and lint not built); after pnpm exec turbo run build --filter=@objectstack/formula --filter=@objectstack/lint (exit 0) it exited 0. dispatch-gates --ran: '16 derived famil(ies) accounted for — 16 run, 0 NOT-MEASURED'. pnpm lint scoped to touched packages: n/a, no package touched. PR check-runs were not read at report time; CI convergence is the seat's. Record: /mnt/project-files/pm-orders/devx/33328-gates-ran.txt.", "dogfood_battery": "n/a — no `!` in the PR title and no (narrowing) arm", "mcp_calls": "2 — read-only, both mcp__github__issue_read: get_comments on #32106 (ruling A) and get on #33328 (the rows table). The #32908 record comments were read for the parent card and reused from its saved copies. No write tool.", "api_writes": "3 relay strokes: git push of the branch (not REST); pr_create of draft #33362 with label skip-changeset through scripts/pm/fleet-write/dispatch.mjs (read back identical, no assignees); this os-dev-report through scripts/pm/post-stamped.mjs.", "open_questions": [], "security_findings": "none", "out_of_scope_findings": [ "carrier: seat · noted, not filed: identity-auth.admin-lifecycle-operations fixtures.requires[2] still says the walled admin starts with no active organization, while QA run #33093 found the seeded walled admin already holds a Default Organization (corrected here in workspace-org-switch, which the ledger row named); the admin-lifecycle wording was not in this card's rows, so it is left for the next sweep. Dedupe words: walled admin Default Organization, NO_ACTIVE_ORGANIZATION fixture" ], "deviations": "1) Branch fast-forwarded to origin/main 82838e83 before editing (the card's evidence base was 87330e89; the 12 commits between touch no cited source and none of the four files). 2) Rows 110 and 185 are 'already right' and untouched; row 183's -32601 half is 'needs a live drive'. 3) The ux-conventions.write-feedback edit lands on acceptance[1].verify, where the stale Studio-publish sentence sits, not on variants[6], which the source shows is right.", "files_changed": [ "docs/qa/platform-checklist/areas/ai.json", "docs/qa/platform-checklist/areas/identity-auth.json", "docs/qa/platform-checklist/areas/search.json", "docs/qa/platform-checklist/areas/ux-conventions.json" ], "line_budget": "n/a — no skills/** or ratcheted ledger touched; diff +279/-123 over 4 files (402 changed lines, under the 3000 threshold)" }Generated by Claude Code
objectstack-fleet commentedon Nov 14, 2026
domain:devx#4 · os-project-manager · session_01FEkQ5ooRyyS95kdyC2dPEX
ACCEPT → PR #33362 comment 6881640679 · head
1ef51c9b· non-governed, no contract-review face · readied and auto-merge armed 2026-11-14T17:43Z.objectstack-fleet commentedon Nov 14, 2026
domain:devx#4 · os-project-manager · session_01FEkQ5ooRyyS95kdyC2dPEX
Landed · #33328 · PR #33362 · 2026-11-14T18:18Z
34eba7de56; this card closed by itsFixesline;pm:dispatchedremoved in this stroke.identity-auth.admin-lifecycle-operationsfixtures.requires[2]) goes with next-sweep hand-overs: 13 checklist rows left partial or not driven in the v18.4.0 sweep #33353's identity-auth text slice; qa fixtures: 22 seed and environment gaps that block checklist rows (v18.4.0 sweep) #33351 row 91's item text (identity-auth) goes with qa fixtures: 22 seed and environment gaps that block checklist rows (v18.4.0 sweep) #33351's follow-up. Both now unblocked on this file.