test doors: 8 product arms that no door reaches (v18.4.0 sweep): add a door or pin as unit-only #33352

Activity

1. objectstack-fleet

   added

   toolingFix lands in tooling, not a product package — enters pm:queue only with Unblocks: or a named surfaceFix lands in tooling, not a product package — enters pm:queue only with Unblocks: or a named surface

   priority:p2Medium: important, M3Medium: important, M3

   pm:queueReady for the PM dispatch loopReady for the PM dispatch loop

   domain:serverDomain lane — seat card indexed by label:pm:seatDomain lane — seat card indexed by label:pm:seat

   on Nov 14, 2026
2. objectstack-fleet commented on Nov 14, 2026

   

   objectstack-fleetBot

   on Nov 14, 2026

   ContributorAuthor

   More actions

   domain:server#5 · os-elon-musk · session_016WV4cw787kMeaX7oyz7DDC

   Claim: area-lease pilot #33059, area thread A4 · p2 · assigned to A4 by seat 5 (all rows, across their areas) · dispatched to an os-dev subagent of this area thread · per row: "unit-pinned: TEST_PATH" on this card where a unit test already pins the arm and no safe door exists; a test door only where it cannot be turned on by a production config (row 14's startFakeSmtp port option is the expected code change)
   Session: session_016WV4cw787kMeaX7oyz7DDC (area thread; subagent of it)
   Account: os-elon-musk
   Branch: claude/area-A4-33352
   Worktree: objectstack-a4-33352
   Domain: domain:server
   Seat: domain:server#5
   File surface: the plugin-email testkit (startFakeSmtp) and its callers' tests; any other door only after checking that no open PR of another area touches the file; one changeset if anything published moves. Stop on breach.
   Container & model: M, mode:subagent, model: default, effort: high
   Clause-②: no
   Metadata-protocol: none
   Responsibility: every row of this card ends with a door or a "unit-pinned:" line devx can copy into the checklist clause
   Thread-read: none
   Premise: each row re-read at origin/main before any edit
   Serial constraints cleared: open PRs of other areas checked per file before an edit
3. objectstack-fleet

   added

   lease:A4

   pm:dispatchedDispatched to a dev agent by /pm-dispatchDispatched to a dev agent by /pm-dispatch

   and removed

   pm:queueReady for the PM dispatch loopReady for the PM dispatch loop

   on Nov 14, 2026
4. objectstack-fleet

   assigned

   os-elon-musk

   on Nov 14, 2026
5. objectstack-fleet commented on Nov 14, 2026

   

   objectstack-fleetBot

   on Nov 14, 2026

   ContributorAuthor

   More actions

   domain:server#5 · os-elon-musk · session_016WV4cw787kMeaX7oyz7DDC
   os-dev-report

   Per-row outcome for #33352. Read at origin/main e0ce1b523. Code half: draft PR #33430, head 451e44f25. Every pin named below ran green under os-verify-lock on that tree, and every one is a vitest file in its package's test script, so CI's Test Core shards run it when the package is affected. The exception is @objectstack/verify, which CI runs through its own package.

   • row 73 (approvals.email-action-token-door, live-token legs): unit-pinned. No door is added, because any door that hands out a raw action token is a credential mint a deployment could enable.
     • unit-pinned: packages/plugins/plugin-approvals/src/approval-service.test.ts ('issueActionTokens: stores hashes only and binds approver + action', 'peek: validates without consuming (GET never mutates)', 'redeem: approves as the bound approver and burns the token (single-use)', 'redeem: dead tokens — invalid, expired, decided request, reassigned slot')
     • packages/plugins/plugin-approvals/src/action-page-member.integration.test.ts ('GET renders the confirm page for a live token, and never decides however often it is fetched', 'POST redeems as the bound approver — the audit row names that approver, not a system actor', 'a dead link — unknown, expired, consumed — is told on the page with 200, through GET and POST alike')
     • packages/plugins/plugin-approvals/src/sys-approval-token-generic-door.integration.test.ts, reminder-action-link-at-rest.integration.test.ts and approval-token-internal-hash.integration.test.ts, as the item's automated.ref names them
     • New in test: the fake SMTP sink takes a port; pin the activation door's metadata-plane 503 and the approver-bound dead-link pages #33430: action-page-member.integration.test.ts 'a link whose slot moved on — decided, or handed to someone else — is told WITH the request summary, and moves nothing'. It closes acceptance[4]'s not_pending / not_approver PAGES with their summary rows, through GET and POST, with no state moved. It also closes acceptance[0]'s non-pending-approver FORBIDDEN arm: an approver whose slot was reassigned is refused issueActionTokens, and the new holder is the control.
     • Still unpinned, and no safe door exists for any of them: acceptance[1]'s byte-identity of the actions timeline and consumed_at, acceptance[3]'s failed decide that still burns, acceptance[5]'s bearer probe, and the email-rendering leg.
   • row 74 (access-security.activation-write-operator-gate acceptance[4], the walled-leg grant): unit-pinned. No door is added, because placing a manage_metadata grant past the Layer 0 tenant wall over HTTP would be a wall bypass.
     • unit-pinned: packages/runtime/src/domains/automation-activation-posture-gate.test.ts ('ADR-0126 §5 — the activation write is operator-gated in walled postures', the group / isolated blocks, e.g. 'REFUSES a tenant org admin, loudly, and never enters toggleFlow')
     • packages/runtime/src/domains/action-activation-posture-gate.test.ts (the same matrix for the action door: 'REFUSES a tenant org admin, loudly, and never writes the row', 'ALLOWS the platform operator', '[Four server-side readers derive platform authority from the NAME in ExecutionContext.positions — same species as #15948's blocked escalation, and already reachable on main #15981] REFUSES a tenant admin holding only a MINTED platform_admin name')
     • For a live walled run, the grant recipe outside HTTP stays the one fixtures.requires[3] already names: the system-context engine insert in packages/qa/dogfood/test/wall-environment-metadata-refusal.dogfood.test.ts#boot.
   • row 76 (attachments-storage.upload-session-abort, the abort-failure and 'failed'-producer seams): unit-pinned. No door is added, because a fault-injecting storage backend is not a production config.
     • unit-pinned: packages/services/service-storage/src/attachment-lifecycle.test.ts ('VETOES on abort failure so backend_upload_id survives for the retry')
     • packages/services/service-storage/src/storage-routes.test.ts ("stamps 'failed' on the row when the backend completion throws" and "lets a retried completion overwrite 'failed' with 'completed'")
   • row 77 (api-backend.action-activation-door-contract acceptance[4], the metadata-plane 503 arm): it had no pin, so test: the fake SMTP sink takes a port; pin the activation door's metadata-plane 503 and the approver-bound dead-link pages #33430 adds one.
     • unit-pinned: packages/runtime/src/domains/action-activation-posture-gate.test.ts ('a metadata plane that cannot answer is 503, not the 404 a miss gets, and writes no row')
     • It asserts 503 SERVICE_UNAVAILABLE, the loader's error in the message, and setActionActive never entered.
     • Ablation: removing the declaration.degraded branch in packages/runtime/src/domains/actions.ts turns it red with expected 404 to be 503.
   • row 78 (ai.mcp-namespace-faces negative[2], the colliding-face pair): unit-pinned.
     • unit-pinned: packages/mcp/src/mcp-action-tools.test.ts ('a face two actions derive is refused once, naming both, and neither row is dropped'). It ran 25 of 25 green.
     • The item's automated.ref already names it at e0ce1b523, so the swept "missing from automated.ref" note is closed.
   • row 191 (attachments-storage.read-inherits-parent-rls, the bounded-probe warning half): unit-pinned.
     • unit-pinned: packages/services/service-storage/src/attachment-read-leaf.test.ts ('a probe past the bound says which class it was', 'a restricted probe that throws denies the whole read and says so — the leaves are not served alone')
     • packages/services/service-storage/src/attachment-read-leaf.integration.test.ts (ADR-0139 D5's two probe classes on a real engine)
   • row 234 (droppedFields over HTTP, fix(automation): a flow's answer also names the read-only fields its map items and resumed subflow children dropped (#33019) #33068): no new door is needed. The existing escape hatch OS_ALLOW_UNLINTED_METADATA_WRITES=1 (packages/metadata-protocol/src/runtime-authoring-gate.ts) turns the flow-update-readonly-field save refusal into a logged warning. That is the live fixture past the lint. It was not driven live this round.
     • unit-pinned: packages/services/service-automation/src/run-dropped-fields.test.ts ('delegated writes roll their drops up onto the parent's answer (automation: a flow's answer carries the dropped-field fact of its map items and of a subflow child that paused and resumed (delegated half of #32861) #33019)', the map and subflow cases)
     • packages/verify/src/action-flow-dropped-fields.test.ts ('answers the drop to the person who clicked: droppedFields names status, and the run still succeeded'), which drives the real kernel through the in-process POST /api/v1/actions/:object/:action twin
     • packages/runtime/src/action-flow-dropped-fields-relay.test.ts (the door relays the member through REST and MCP)
   • row 14 (the plugin-email testkit startFakeSmtp has no port option): door added in test: the fake SMTP sink takes a port; pin the activation door's metadata-plane 503 and the approver-bound dead-link pages #33430: packages/plugins/plugin-email/src/transports/fake-smtp.testkit.ts startFakeSmtp({ port }).
     • The default is 0, an ephemeral port, so in-tree callers are unchanged. A busy port rejects with EADDRINUSE rather than opening a sink elsewhere.
     • Pinned in packages/plugins/plugin-email/src/transports/smtp.wire.test.ts ('the fake SMTP sink takes a port, so a runner can keep it inside its own reserved range').
     • Clause text for devx (identity-auth.email-verification-loop fixtures.requires[2] and the self-service-password-reset harness): "the driver calls startFakeSmtp({ port: PORT }) with a port from the run's own reserved range and passes the same PORT to PUT /api/settings/mail".

   Nothing in #33430 publishes: the testkit is outside files[], with zero dist/ hits after a build and the SmtpTransport control present. The PR therefore wants skip-changeset. Per the dispatch, the label is the seat's to apply.

   {
     "issue": 33352,
     "status": "done",
     "branch": "claude/area-A4-33352",
     "pr": "https://github.com/objectstack-ai/objectstack/pull/33430",
     "session": "session_016WV4cw787kMeaX7oyz7DDC",
     "premise_still_valid": true,
     "summary": "Every row ends with a door or a unit-pinned line (above). Row 14: startFakeSmtp takes a port (default 0, EADDRINUSE on a busy port). Row 77 had no pin: a 503 metadata-plane pin is added. Row 73 gains a page-level pin for the not_pending / not_approver pages and the non-pending-approver FORBIDDEN arm. Rows 74, 76, 78 and 191 are unit-pinned on existing tests. Row 234's live fixture is the existing OS_ALLOW_UNLINTED_METADATA_WRITES escape hatch, plus unit pins.",
     "tests": "at 451e44f25 unless noted: plugin-email whole package 53/53 files, 1042/1042 (42ce2a539); runtime action-activation-posture-gate.test.ts 30/30 (dba662b0c); plugin-approvals action-page-member.integration.test.ts 13/13, whole package 120/120 files, 1652/1652 (42ce2a539); cited pins 492+19+184+25+18+2 all green. Ablations via ablation-replace.mjs, each restored to the HEAD blob: degraded branch gives 'expected 404 to be 503'; GET page without request red at 'not_pending GET'; pending check off gives 'promise resolved instead of rejecting'; listen(0) reds the two port cases.",
     "gates": "dispatch-gates --commands: 55 derived at merge base e0ce1b523; all 55 exit 0 at 451e44f25; --ran: 55 run, 0 NOT-MEASURED (a DERIVED zero). typecheck plugin-email / plugin-approvals / runtime OK. eslint --no-inline-config on the 4 files: exit 0. CI check-runs: in_progress at report time.",
     "dogfood_battery": "n/a — no ! in the PR title and no (narrowing) arm",
     "mcp_calls": "0",
     "api_writes": "2 — fleet-write relay pr_create (objectstack-ai/objectstack#33430); post-stamped comment on #33352 (this one)",
     "open_questions": [],
     "security_findings": "none",
     "out_of_scope_findings": ["carrier: devx (the clause owner of this card) · the checklist text of rows 73, 74, 76, 77, 78, 191, 234 and 14 to be updated from the lines above; noted, not filed"]
   }
6. objectstack-fleet

   closed this as completedin #33430on Nov 14, 2026