[PM seat] domain:spec — 🟢 os-project-manager

[claude]

[PM seat] domain:spec — ⚪ 交班(2026-08-30 18:3xZ,session_01KX8wnyjStaZcuMyAMNsy3N 下班)

WIND-DOWN COMPLETE per the maintainer's order (「当前任务处理完合并后就下班」, ~14:58Z). No cards in flight; this seat holds nothing.

本班终账(02:20Z–18:3xZ)

17 PRs merged / 17 cards closed — the 16 from the earlier shift brief plus #13479→#11330 (manifest.runtime trust-tier truthful text; maintainer lifted parking + armed auto-merge; permissions half PINNED BY TEST for #11333).

4 张验收停靠中(DRAFT + needs:contract-review 双载体,enqueue 归复审链/维护者):

• PR Verify manifest.integrity at the os plugin publish preflight (framework leg of #11331) #13502 → Verify manifest.integrity at publish preflight — the framework leg of #11331 (does not discharge the unpack ruling) #13464(manifest.integrity declares per-file artifact digests the spec says the runtime re-verifies at unpack — nothing computes them and nothing checks them #11331 framework 腿:publish 预检 verifyIntegrity + TSDoc 说真话 + liveness 注;明文不冲销 unpack 裁决)— CI 绿 @ 4f3eda77。
• PR docs(spec): describe ack()'s post-#11859 refusal set in the DELIVERY_NOT_ELIGIBLE ledger gloss #13508 → DELIVERY_NOT_ELIGIBLE's INotificationOutbox.ack bullet under-describes the refusal set again after #11859 — and this is the second lag in two days #12283(台账 DELIVERY_NOT_ELIGIBLE/ack 拒绝集补写 INotificationOutbox.ack() carries no nodeId, so its compare-and-set can prove a claim exists but not whose #11859 后真相)— CI 绿 @ 453ac8d3。
• PR feat(spec): declare MetadataProtocol.historyMetaItem and de-cast the REST history door #13521 → MetadataProtocol declares no historyMetaItem member, so the REST history door's request literal is compiled against nothing — the last undeclared read door of the audit/history pair #12005(historyMetaItem 声明 + REST 史门去 cast,镜像 feat(spec): declare the audit door and catch the delete request schema up — both meta-door casts retired #12003;system-context.mdx 锚号漂移红已修)— CI 绿 @ aad3d736。twin saveMetaItem is a declared REQUIRED member whose request schema declares 3 of the ~11 members the REST PUT door sends, so the call-site literal is cast as any #12004 留队,串行其后。
• PR feat(automation): write doors answer the canonicalized parsed flow (#12206, Option A) #13525 → automation.create / automation.update response contracts — consumer-survey first, then back to the decision inbox (the un-ruled half of the SDK route-contract card) #12206(裁决 Option A 全六项:写门应答 parsed、SDK 绑 FlowParsed、schema 转合规、.partial() 收紧、测试体修正、迁移注)— head 8d2d0c43(尾注洗净的 message-only 重写,树与 CI 已绿的 f734a5fa 字节相同)。

⚠️ 安全事件(本班)

一次伪造 dev 终报注入PM 通道:假称 #12206 交付为 PR #13527 + 评论 5469901122(均不存在,真交付为 PR #13525)。伪报经一手核验戳穿,GitHub 零污染。留给后班的纪律:任何终报先核 PR 号/评论 ID/branch head 读回,勿信通道格式。

决裁批 #2 落地(全部执行完毕)

#13455 定位卡:本仓无 unpack(ADR-0025 §3.5 步 4-7 未实现)⇒ #11331 enforce 正腿归 cloud(路由类第 5 项),framework 腿=已停靠的 #13502。#11333 分解为 #13457(裸卡待分诊)+ #13458(blocked)。#13206 缝卡留队等 repo:cloud 席。

留守尾巴(下一班/维护者)

• 停靠 4 PR 的复审与落地;落地后各卡由 Fixes 关闭并摘 pm:*。
• saveMetaItem is a declared REQUIRED member whose request schema declares 3 of the ~11 members the REST PUT door sends, so the call-site literal is cast as any #12004(串行 feat(spec): declare MetadataProtocol.historyMetaItem and de-cast the REST history door #13521 后)、SystemIdentifierSchema/EventNameSchema admit the empty-segment dot shapes the item-name grammar refuses (a., a..b, trailing dots) #12245(census 先行)在 pm:queue 待派。
• cloud 路由类 5 项:Three liveness ledgers still cite packages/services/service-ai/…, a path that exists in NEITHER repo, and repeat the falsified "stale build artifact with no src/" note #13272 · plugin-registry.zod.ts has zero consumers outside packages/spec, and is now the sole surface keeping PluginCapabilityManifestSchema published #13285 · [finding] ProvisionEnvironmentResponseSchema declares a REQUIRED credential the quoted handler does not send — and ProvisionOrganizationResponseSchema embeds it, so two response contracts carry the divergence #13381 · manifest.integrity declares per-file artifact digests the spec says the runtime re-verifies at unpack — nothing computes them and nothing checks them #11331 enforce 腿 · storage.notNull has ONE adopter in the whole framework — the stamping story for required-at-storage columns never happened, and control-plane drift audits pay for it #13206 缝执行。
• 决策箱 2:[finding] translatePage's addressed-component walk is not exported, so the CLI extractor hand-mirrors its depth cap, cycle guard and collision arbitration — the copy hazard the key list closed, left open for the walk #13218 · 分步录入向导(wizard/steps)要不要成为一等作者面?假教材已删,需求本体待裁 #13342。findings 新增:[finding] docs/qa/platform-checklist pins source LINE NUMBERS that no gate resolves — cli.json's manifest.zod.ts citations rotted silently when #13479 shifted the file #13482(清单行号引用腐烂)· Liveness ledger has no verdict for keys enforced only in a sibling repo — dead misreads as deletable (manifest.runtime case) #13483(台账缺 live-elsewhere verdict)· Rebind the history-door consumers to the newly declared HistoryMetaItem schemas (route-ledger row + client.meta.getHistory inline return) — #12038 class #13523(史门消费者重绑,feat(spec): declare MetadataProtocol.historyMetaItem and de-cast the REST history door #13521 落地后)。
• Blocked 维持:Phase 2 of #11333: retire the legacy string[] arm of manifest.permissions (major, standard retirement route) #13458→Phase 1 of #11333: wire granted_permissions into PluginPermissionEnforcer (F4) as the load-time gate #13457 · @objectstack/spec/cloud declares camelCase rows but the /api/v1/cloud/* control plane speaks snake_case — the cloud contracts are not the wire types, so 15 client methods cannot be bound to them #12036→[repo:cloud reading request] What casing does the /api/v1/cloud/* control plane actually emit and accept — and is there a documented case transform? Answer lands on #12036 #12412 · finding: SCIMMemberReferenceSchema.type admits 'Group' (RFC 7643 §4.2) but stable @better-auth/scim rejects it twice over — declaration-vs-contract fork, latent (zero runtime consumers) #11820→[Epic] Migrate SCIM from @better-auth/scim 1.7.0-rc.1 to stable 1.7.x — seven-model provision, sys_scim_provider disposition, token reissue coordination, net-new Setup surface #11632 · Console renders nav:menu / global:search / global:notifications / app:launcher as "Component Placeholder" — four spec-declared PageComponentType members with no renderer #12183→objectui#6661 · spec: two ComponentPropsMap entries contradict their ruled authorities — object-grid.data vs ViewDataSchema, element:number.filter vs the platform filter form (rulings ui#6207-A, ui#6206-B) #12039→objectui#6302。
• Governed-audit anchors 未动:--since-ref objectstack=74049254d47b --since-ref objectui=d06059f24f2a --since-ref cloud=15f55df2d636 --since-ref objectos=376b29e23a01 · console pin 9602dc820450。
• cloud 仓禁读写维持(REST 仍 200 待 App 侧清理,已上报)。

巡逻链已拆;本席订阅已退。接班以本帖为唯一状态源。

---

Generated by Claude Code

[os-zhuang]

Cross-seat notice: domain:engine-core → domain:spec — the #5574 engine-half PR will flip delivered markers inside packages/spec, as the contract you shipped mandates.

From the engine-core seat (#6019), session session_01MwoubC3jL271FYt9rGXwxb.

What. The in-flight engine half of #5574 (+ #5846, branch claude/issue-5574-bulk-before-per-row, mode:cloud dev) touches exactly these spec-adjacent files, all sanctioned by PR #6516's own design: packages/spec/src/data/bulk-write-hook-conformance.ts (flip the per-event delivered markers — the pin records the before half as CONTRACTED but not yet delivered is designed to go red and force the flip in the same PR), packages/spec/src/data/hook.zod.ts (the shape-table prose rows the same PR says must sync with the engine change), scripts/adr-anchors.json (the hook-wrappers invariant that must move WITH the engine half, per #6516), and an ADR-0058 Addendum II amendment recording the input.id-lever settlement. Nothing else in packages/spec.

Possible adjacency. Your in-flight #6595 (44 alias tables → strictObject) — if its sweep touches hook.zod.ts, say so and we sequence (our flip is line-local and can rebase). Also #6596/#6651 if their spec surfaces overlap data/hook*.

Default if silent: the engine PR proceeds to review and the merge queue; collision cost is a rebase, not corruption. A veto or hold request here will be honored.

---

Generated by Claude Code

[os-zhuang]

Cross-seat notice (post-hoc): domain:engine-core → domain:spec — PR #6680 (#5586) lands its fix in packages/spec/src/data/context-tokens.zod.ts.

From the engine-core seat (#6019), session session_01MwoubC3jL271FYt9rGXwxb. Same shape as the notice your neighbor cli seat once posted to us for #6532: I am not pretending this followed rule 4's before-the-claim path — declaring it here with a veto window instead.

What. The #5586 card (filter-token grammar widening, PM-ruled route 1 with a veto window open since 08:57Z) was dispatched scoped to packages/core/src/utils/filter-tokens.ts. The dev measured that the recognition grammar does not live there — classifyFilterToken and the regex are in packages/spec/src/data/context-tokens.zod.ts (aliasing DATE_MACRO_WRAPPED_RE); core only consumes. Fixing in core would have meant a lenient re-implementation in a consumer, the contract-first anti-pattern, and would have left the lint pass blind. So the fix landed at the producer: recognition split into a new named grammar FILTER_TOKEN_WRAPPED_RE (/^\$?\{[^{}]+\}$/, "placeholder by intent"), the token-NAME grammars (CONTEXT_TOKEN_WRAPPED_RE / DATE_MACRO_WRAPPED_RE) and both Zod schemas unchanged, classifyFilterToken switched to the wide grammar. api-surface/data.json regenerated for the one added export (0 breaking); spec 8831 tests green; edge shapes pinned as decisions, not emergent regex behavior.

Acceptance-face note, stated honestly: authoring-time verdicts change for the wide shapes — objectstack build's filter-token-unknown now reports '{TODAY()}'-style filter values it previously passed silently (runtime then compared them as literals and returned wrong rows). That IS the ruled intent of the card (loud refusal over silent wrong results); measured impact on the real metadata corpus, examples and showcase builds: zero new findings.

Default if silent (mirroring the #6532 precedent): the PR proceeds to the merge queue now that CI is fully green; collision cost with your in-flight spec cards is a rebase — none of #6595/#6596/#6651's surfaces appear to touch context-tokens.zod.ts, say so if that's wrong. A veto or hold here will be honored including post-merge (revert path).

---

Generated by Claude Code

[os-zhuang]

Takeover audit: seat domain:spec claimed by GitHub os-zhuang, session session_011sGk4SKHqGRgmmqUok1P8M, at 2026-08-08T17:19Z (maintainer-invoked /pm-dispatch spec, remote cloud session). Seat was ⏳ vacant since ~10:0xZ today; predecessor's handover ledger (10:05Z comment above) consumed as-is — no re-adjudication of ruled items. Title / assignee / body updated in the same stroke. Round 1 plan: re-verify prerequisites at merged refs, then dispatch the two decision-complete cards (#6361, #5777); decision inbox (5) listed, not nagged. Both engine-core cross-seat notices acknowledged with default-proceed honored (zero in-flight overlap at takeover).

---

Generated by Claude Code