feat(spec): retire the fourteen inert deadline keys of the incident-response, training and change-management schemas (#14477, ADR-0049) - #15514
Conversation
…esponse, training and change-management schemas (ADR-0049) Six hour/minute/day-shaped keys on the incident-response schemas, five on the training schemas and three nested in the change-management schemas sat on the published authorable surface and in the generated reference docs, and nothing read them: the schemas are exported, mounted by no stack key and registered as no metadata type, and the reader census over every package outside packages/spec (and objectui at the pinned sha) returned zero hits for every key. Maintainer ruling 2026-09-02: retire per family under ADR-0049 enforce-or-remove. All fourteen sites are retiredKey() tombstones (the schemas are not strict; a bare deletion would be a silent strip), registered as RETIRED_KEYS_BY_MAJOR[18] entries plus three D3 semantic entries. No D2 conversion and no `os migrate meta` sentence: none of the schemas is a stack collection member, so the chain has no seam (the MetadataPluginConfig.additionalTypes precedent). Baselines and reference docs regenerated with the repo tooling; pins cover refusal at every site and through every carrier, the tsc never channel, no-materialize for the six former defaults, the registration, and a tree-scoped absence scan. The ESignatureConfig pair in data/document.zod.ts is held on the card and untouched. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01G4138K1EG7kQ81FNba5Kp4
…ert-deadline-key-retirement
📓 Docs Drift Check31 anchor(s) derived from 1 changed package(s); no hand-written page names any of them. What this run could not see
Coarse fallback — 129 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): Which tree this was computed onThis run read A worktree cut from an older # while this PR is open — GitHub drops the merge commit once it closes
git fetch origin a7fd0c17eb683092b12d021e5bec2896d5616cee && git checkout a7fd0c17eb683092b12d021e5bec2896d5616cee
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin bbf4a522919ddbdc310746ba75c0af50e4bebd17 f15bb82c7f74cf038ba8ca1c25b1cda8c52bf683 && git checkout -B drift-repro bbf4a522919ddbdc310746ba75c0af50e4bebd17 && git merge --no-ff f15bb82c7f74cf038ba8ca1c25b1cda8c52bf683
node scripts/docs-audit/affected-docs.mjs --json bbf4a522919ddbdc310746ba75c0af50e4bebd17 |
github-actions
Bot
added
documentation
Clause ② in-seat review — verdict ADOPTED VERBATIM from an isolated contract-tier reviewerAdoption record by the Why an isolated reviewer rather than this seat. Downgrade-fuse reading before acting (⛔ a self-asserted tier is not a reading): Transcript tier verification (the precondition for adopting at all): 183 harness-stamped What the reviewer was and was not given. Card, its rulings, the PR, the tree. ⛔ Not this seat's claim reasoning, ⛔ not its premise findings, ⛔ not its conclusions. Concretely: this seat had independently measured that
⭐ Note for the record: the reviewer answered the dev's declared deviation (2) — the commit trailer naming a model — as not a defect. It is in fact settled repo law: maintainer ruling on #14663 (2026-09-03, batch #23), executed at Contract review — PR #15514 (
|
| # | site | shape at base |
|---|---|---|
| 1 | IncidentResponsePhase.targetHours |
number.min(0) |
| 2 | IncidentNotificationRule.withinMinutes |
number.min(1) |
| 3 | IncidentNotificationRule.regulatorDeadlineHours |
optional |
| 4 | IncidentNotificationMatrix.escalationTimeoutMinutes |
default 30 |
| 5 | IncidentResponsePolicy.triageDeadlineHours |
default 1 |
| 6 | IncidentResponsePolicy.retentionDays |
default 2555 |
| 7 | TrainingCourse.durationMinutes |
number.min(1) |
| 8 | TrainingCourse.validityDays |
optional |
| 9 | TrainingPlan.recertificationIntervalDays |
default 365 |
| 10 | TrainingPlan.gracePeriodDays |
default 30 |
| 11 | TrainingPlan.reminderDaysBefore |
default 14 |
| 12 | ChangeImpact.downtime.durationMinutes |
optional, nested |
| 13 | RollbackPlan.steps[].estimatedMinutes |
required, nested |
| 14 | ChangeRequest.implementation.steps[].estimatedMinutes |
required, nested |
Every other numeric key is a timestamp (completedAt, reportedAt, detectedAt, resolvedAt, assignedAt, expiresAt, requestedAt, plannedStart/End, actualStart/End, reviewedAt, approvedAt), a count (affectedUsers, order) or a score (passingScore, score). So the fence is 14 sites, 12 distinct leaf names, 13 distinct (file, name) pairs; with the held pair, 16 sites / 14 names. The ruling's "thirteen" and the card's "fifteen" are (file, name)-pair counts and are consistent with each other. The PR's "fourteen sites" is right. The PR body's and the changeset's "thirteen distinct key names" is wrong — it is twelve (durationMinutes is one name at two sites in two files; estimatedMinutes is one name at two sites in one file). The PR's own census regex has 14 alternatives = 12 in-scope + 2 held, so the miscount is in the prose only. Nothing was retired that the ruling did not authorize, and nothing the ruling fenced was missed. RIGHT on scope; one prose count is wrong (condition 1).
2.2 Accept-set changes — one verdict per site
All fourteen sites are retiredKey() tombstones (z.never({error}).optional()), so each key's accept set narrows from number to absent. Measurement, per site: the pin file's site test (refusal with code: invalid_type at the exact issue path, prescription anchored by regex to the def-qualified opener, attribution control that the same document without the key parses) — 14/14 green at the head, and 14/14 red under ablation (§2.6). Through every carrier: the three files contain exactly six embedding sites (rules[], responsePhases[], notificationMatrix, courses[], impact, rollbackPlan; implementation is inline) and the CARRIERS pins exercise all six — 6/6 green at head, 6/6 red under ablation. RIGHT. Nothing still materializes a value: the six former defaults are gone from authorable-defaults/system.json, the three no-materialize pins hold, and retiredKey() carries no default by construction. RIGHT. The non-strict precondition for the tombstone route holds — 0 .strict(), 0 strictObject, 0 passthrough in the three files — so a bare deletion would have been the silent strip ADR-0104 names. RIGHT route.
Does the refusal say which schema? Yes: every prescription opens with the backtick-qualified def key (`IncidentResponsePolicy.retentionDays` was removed in …) and the pin anchors on ^\`<qualified>\` . It matters for three names: retentionDays has two live namesakes (security-context.zod.ts AuditPolicy/compliance rows, tenant.zod.ts backup) and one retired site; durationMinutes and estimatedMinutes are each retired at two sites. Each of the four affected prescriptions names its own def. RIGHT.
2.3 Public-surface changes
No def leaves; no export changes; api-surface/ unchanged and check:api-surface green — correct per the playbook (key-level narrowing is invisible to that snapshot). authorable-surface/system.json: exactly the 11 top-level sites gain [RETIRED]; the three nested sites never had rows, and gate (b) neither demands nor refuses their entries (verified in build-schemas.ts: currentKeys is built from top-level properties only, and (b2) fires only on currentKeys.get(k) === false, never on undefined). RETIRED_KEYS_BY_MAJOR[18] carries all 14 exact spellings (nested ones as ChangeImpact:downtime.durationMinutes etc., the kernel/Manifest:contributes.actions / api/BatchEndpointsConfig:operations.upsertMany spelling — both present in the tree). Three D3 semantic entries wired into step18.semantic; no D2 conversion. RIGHT, and the "no D2" route is verified, not asserted: applyConversionsToStoredItem (conversions/stored.ts:64-79) maps a type through SINGULAR_TO_PLURAL onto a stack collection and returns the item untouched otherwise; none of these schemas is a metadata type or a stack key (stack.zod.ts names none). The two precedents named are real and have the same shape: 18.kernel__MetadataPluginConfig__additionalTypes.ts + 18.metadata-plugin-additional-types-retired.ts with no entry in conversions/registry.ts, and 18.api__SessionUser__language.ts + 18.session-user-language-retired.ts, likewise. spec-changes.json and the upgrade guide are unchanged and should be: no 18-registered id (I checked session-user-language-retired and connector-error-mapping-removed) is projected there either — the chain filters at the current major 17.
packages/spec/src/data/document.zod.ts is blob b1fe0ab42 at both main and the head; content/docs/references/data/document.mdx and authorable-surface/data.json are untouched; the only diff lines containing expirationDays/reminderDays/ESignature are the changeset and PR prose saying the pair is held. The held pair is untouched, in every file including generated ones.
2.4 Author-facing guidance
Generated pages the PR rewrites: content/docs/references/system/{incident-response,training,change-management}.mdx, 28/28 lines, regenerated by gen:docs (check:docs green in my tree; module docblocks intact). Correction to the dev's report: it is not "no changed line outside a retired-key row" — 9 of the 28 are parent rows (downtime ×2, steps ×3, responsePhases, rules ×2, notificationMatrix) whose inline type string lost the key. Still pure generator output; reporting inaccuracy only.
Hand-written corpora (content/ outside references/, skills/, examples/, docs/, .claude/, apps/): at the merge-base, zero authoring of any of the 12 names. The three residual hits are all other schemas: content/blog/protocol-first-development.mdx:484 (retentionDays: 365 inside a field extensions bag), docs/launch-readiness.md (service-job/messaging retention options), content/docs/releases/v14.mdx (the same service options — the dev's "2 unrelated" counted files and omitted this one; immaterial). content/docs/getting-started/quick-reference.mdx:96 names ChangeRequest, RollbackPlan as schemas — both still exist, still true. Nothing becomes false when this lands. RIGHT. content/docs/releases/ is not in the diff. No governed path (docs/adr/**, .claude/**, skills/**, AGENTS.md, CLAUDE.md) is in the diff.
2.5 The census (ruling's mandatory first step)
The dev's command reproduces: git grep -nw -E '<14 names>' 5023630b1 -- 'packages/**' ':!packages/spec/**' ':!**/*.test.ts' ':!**/*.test.tsx' ':!**/*.spec.ts' ':!**/CHANGELOG.md' → exit 1. Control with the spec exclusion lifted hits the declaring files (7/9/9 lines in the three .zod.ts), so the empty result is a measurement. Lifting the test/changelog exclusion surfaces only CHANGELOG.md prose on unrelated JobRunRetention/NotificationRetention/plugin-audit retentionDays. objectui at the pin: 0 key hits, 0 schema-name hits; control: 367 files import @objectstack/spec. Schema/type names outside packages/spec: 0 (the quick-reference.mdx row aside). Method: word-bounded, name-keyed — it over-collects on the three shared names, which is the safe direction for a zero-reader claim (every extra hit was inspected and attributed to a different schema). The one under-collection risk is the packages/spec exclusion hiding in-spec readers (forms, embedding schemas); I closed it: inside spec, outside the family files, the only hits are security-context.zod.ts/tenant.zod.ts (retentionDays on live schemas) and their tests; no *.form.ts names any key; no spec schema outside the three files embeds any family schema (only the type-alias-convention.pin.test.ts isomorphism pins, which still hold — typecheck green). The triage's own caveat, verbatim: 「另外本席只抽验了三个键的读取方(triageDeadlineHours / expirationDays / validityDays),不是全部十五个;执行前应把卡面那张表整表重跑一遍,因为「零读取方」是整个推荐的地基。」 — the full table was rerun, by the dev and now independently by me. Census RIGHT, sound, reproduces; 0 keys return to the inbox.
2.6 Pins fail when the change is reverted (ablation)
git restore --source=5023630b1 -- <three files> (tree only; blobs back to 38898bd3c/6831a2ddb/fb709abcf, retiredKey count 0/0/0, git status exactly three M). vitest run src/system/deadline-keys-retirement.test.ts → 26 failed / 3 passed of 29: all 14 site refusals, all 6 carrier refusals, both prescription-content pins, the 3 no-materialize pins, the tsc/parse-agreement pin; the 3 survivors are the registration read (registry unchanged) and the two tree-scan legs (they exclude the schema files by design). Restored with git checkout HEAD --: status --porcelain, diff HEAD, diff --cached all empty; tree blobs 40a929a2a/27d58383b/751fe8218 equal HEAD. The pins measure the change.
2.7 Generated artifacts
pnpm --filter @objectstack/spec check:generated at the head: "✓ All 15 generated artifacts are up to date" — including check:migration-registry (regions vs entries/), check:authorable-surface (+ its .base.json anchor + JSON schemas), check:docs, check:liveness, check:api-surface; tree clean afterwards. So registry.ts regions, both baselines and the three reference pages are what the tooling produces from this source, byte for byte. Hand-written parts of registry.ts (the step18.rationale extension) are outside the generated markers, as the file's header requires. json-schema/ is gitignored; json-schema.manifest/ records def names only and is rightly unchanged. RIGHT.
2.8 Local gate reproduction
check-changeset-no-major --base 5023630b1 ✓; check-adr-0087-registration --base 5023630b1 ✓ (three ids, all "new here"); check:cross-package-test-inputs self-test ✓ and gate ✓ (26 packages, all declared); typecheck exit 0 with check:test-typecheck: OK (so the fourteen @ts-expect-error lines are compiled and live); the eight named vitest files: 8 passed / 425 tests — identical to the dev's numbers. CI on 83a3353e3: all 38 check runs complete; the six required contexts — Lint & Repo Gates, TypeScript Type Check, Test Core, Dogfood Regression Gate, Build Core, Temporal Conformance (live PG + MySQL) — all success. Console Pin Gate skipped by paths filter; moot, objectui measures zero.
3. Semver levelling
Declared: "@objectstack/spec": minor, **BREAKING** banner, <!-- adr-0087: registered incident-response-deadline-keys-retired, training-deadline-keys-retired, change-management-duration-keys-retired -->.
What I would set, from the repo's own rules: minor. Derivation: (i) scripts/check-changeset-no-major.mjs refuses major for the launch window and states its end condition (GA, #14043) and that, until then, breaking-ness is carried by the banner plus the ADR-0087 disposition — "they are the only signal there is"; (ii) pr-automation.yml WHICH LEVEL (maintainer ruling 2026-09-04, batch #35, on #15294): an accept-set change to a published package is at least minor, the commit type never lowers the act; (iii) .changeset/config.json places spec in the single fixed group, so any major would promote ~70 packages; (iv) precedents of the same shape and month — connector-error-mapping-retired.md and session-user-language-retired.md — are both minor + BREAKING + registered; (v) the ruling itself prescribes "@objectstack/spec changeset minor with a BREAKING banner under the launch-window convention". The marker parses (comma-separated ids are accepted by the gate's registered arm) and all three ids resolve. Level is right; the changeset's prose has two errors (condition 1).
4. Boundary flags
- Count 15/14/13 — ANSWERED (§2.1). 14 sites, 12 names, 13 file-name pairs. PR body and changeset say "thirteen distinct names": wrong. → Condition 1, 3.
- Census run, method, reproduction — ANSWERED (§2.5). Run, sound in the safe direction, reproduces; the in-spec blind spot was closed by me and is empty.
- Refusal names the schema — ANSWERED (§2.2). Yes; load-bearing for
retentionDays,durationMinutes,estimatedMinutes. - Held
ESignatureConfigpair — ANSWERED (§2.3). Untouched, blob-identical, no generated file moved; card stays open, PR isPart of(the "Part-of PR must not also close its card" check is green). - Ablation — ANSWERED (§2.6). 26/3 as predicted; restored with hash proof.
- Generated artifacts by tooling, reproducible — ANSWERED (§2.7).
- Author-facing corpora — ANSWERED (§2.4). Nothing becomes false.
content/docs/releases/and governed surfaces — ANSWERED. Untouched.- Dev deviation (1): no issue number, no
os migrate metasentence. ANSWERED in two halves. The missing sentence is not a deviation but a requirement:retired-key.tsreserves the sentence for "a prescription whose surface an ADR-0087 conversion covers" and rules it "must be TRUE of the tool"; no conversion exists here, so the sentence would promise an edit listos migrate metacannot print; the class pin does not judge a prescription that omits it. The missing#issue: measured across the tree, 87 tombstone prescriptions open(ADR-…)and 2 open(#NNNN— the playbook's(#issue[, ADR-XXXX Dn])template is the outlier, and the two most recent precedents (additionalTypes,errorMapping) and the new pin's "no#\d{3,}" assertion follow the tree. Adjacent maintainer ruling, verbatim (AGENTS.md, 2026-08-12, on distilled lessons, not tombstones): 「处理 issue 时犯的错应该总结成经验,保留 issue id没有意义」. Acceptable here; the template-vs-tree divergence is the playbook owner's — ESCALATED (governed surface, condition 4b). - Deviation (2): commit trailer names a model. ANSWERED. The trailer is the harness-injected attribution rule applied to every commit in this repo; it lives in git history, not in any customer-facing text, and this document does not reproduce it. Not a defect of the change.
- Deviation (3): dependency-closure build a no-op. ANSWERED. Verified:
packages/spec/package.jsonhas zero@objectstack/*orworkspace:entries independencies,devDependencies,peerDependencies. - Deviation (4): full spec suite not run locally. ESCALATED as NOT MEASURED locally, by the dev and by me: my full-suite run was still executing (~5 min, no terminal line in the log) when I was instructed to finalise and I terminated it; I record no result and infer nothing from the absence of a failure. What is measured: CI
Test Core(six shards plus rollup)successon the exact head83a3353e3. That is CI's measurement, and it is the one the queue enforces. → Condition 5. - Deviation (5): session id shared with the PM seat. ANSWERED. AGENTS.md defines a claim as assign + a comment carrying session ID and branch; both claims sit on the card in order, PM then dev, naming the same branch. The branch is the discriminator; no conflicting claim exists.
- Out-of-scope spec: the rest of the incident-response, training and change-management families — every remaining key and all fifteen defs — has zero readers; whole-def enforce-or-remove is the open question left after #14477 #15513. ANSWERED — real, open,
finding, unassigned, scoped to the remaining keys/defs of the three families, correctly not folded in (the ruling fenced deadline keys). Its headline measurement (zero schema-name readers outside spec, zero in objectui) matches mine. check:skill-examplesleavespackages/spec/.examples-build/behind, andcheck:docs-audit-scopethen fails its own self-test in the same working tree #15446 / finding(tooling): a prerequisite-abortedcheck:skill-examplesrun leaves gitignored.examples-build*trees underpackages/specthatcheck:docs-audit-scope's self-test walks and reds — two gates, one box, order-dependent #15457 not re-filed. ANSWERED — both real and open, both describe the.examples-buildwalk interaction; not re-filing is right.- No D2 conversion. ANSWERED (§2.3) — no seam; two precedents; gate (b)'s message asks for a D2 but enforces exact
RETIRED_KEYS_BY_MAJORmembership only. acceptRetiredDefaultResiduenot applied. ANSWERED. No built artifact can carry these documents (not a metadata type, not on the stack), and the ruling says "no alias, no transition window"; a customer who stored their ownparse()output is refused loudly with the prescription — the ruled behaviour.- Registered under 18, prescription says "removed in @objectstack/spec 17". ANSWERED — matches the three 18-registered precedents (
17,17,17.4.0); gate (b) reads all majors. - The tree-scoped absence pin's input radius. ESCALATED. The cross-package gate rosters the pin (its
path.resolve(path.dirname(fileURLToPath(import.meta.url)), '../../../..')seed is a recognised spelling —--list-escapeslists it), spec is declared, and every literal it names is covered — so the gate is green as designed. But the walk itself descends on a loop variable, and the gate's own declaration file states the trade: "the escape verdict resolves and the NAME does not". Consequence, measured againstturbo.json@objectstack/spec#testinputs: the pin's real radius (every.ts/.tsx/.js/.mjs/.cjs/.mts/.cts/.json/.md/.mdx/.yaml/.ymloutsidenode_modules/dist/.git/.turbo/.cache/.objectstack/coverage) is not hashed beyond spec's declared globs. A resurrection authored inexamples/**,apps/**, hand-writtencontent/docs/**, or mostpackages/*/src/**does not put spec's tests inturbo ls --affectedon the PR path and can replay a cached green — the exact Layer A/B failure AGENTS.md describes. Thetscneverchannel still catches every typed TS authoring site; untyped literals and prose are the residue. Precedent cuts both ways: the two other repo-root walkers in spec declare their (narrow) radii honestly (packages/**/*.object.ts,packages/lint/src/**), while@objectstack/core's whole-repogit ls-filespin is declared aspackages/**/*.tsonly; the declaration file repeatedly refuses radii that put a suite on every docs PR. The PR follows the playbook's ⭐ tree-scoped mandate; the gap is between playbook and gate, not a choice the dev made wrongly. What the PR owes is honesty in the pin's own header, not a whole-repo declaration. → Conditions 2 and 4b. mainmoved past the merge-base. ANSWERED. Two commits, neither touchingpackages/specor these families; AGENTS.md §10 scope says no regen is owed unless spec moves onmainbefore enqueue. → Condition 5.- Docs-delta wording ("no line outside a retired-key row") — ANSWERED (§2.4): 9 of 28 are parent rows; generator output regardless. → Condition 3.
- Liveness ledger. ANSWERED. The three families are not enrolled types (
packages/spec/liveness/has no file for them;action.json's only hit is prose); the tombstone-route "keep the row" rule applies to enrolled types;check:livenessand theSpec property livenessjob are green. The B-fallback enrolment was not taken because A was ruled. - Changeset kit paragraph lists
json-schema/,json-schema.manifest/, spec-changes and the upgrade guide among artifacts that "follow the schema" — the manifest, spec-changes and the guide are unchanged by this PR (and correctly so); the sentence overstates what moved. → Condition 1. - Clause-② carrier. ANSWERED —
needs:contract-reviewon card and PR; PR is draft;mergeable_state: blocked; not armed, not queued. - Landing class. ANSWERED — no governed surface in the diff; this is a queue-path PR once conditions are met, not a maintainer-hand-merge class.
5. Conditions
- EDIT, before the PR leaves draft —
.changeset/inert-deadline-keys-retired.md(this text ships inCHANGELOG.md): (a) "Fourteen … keys (thirteen distinct names)" → "fourteen sites, twelve distinct names (durationMinutesandestimatedMinuteseach occur at two sites)"; (b) in "The retirement kit", stop listingjson-schema.manifest/, spec-changes and the upgrade guide as artifacts this PR moved — say the protocol-18 registrations project into spec-changes/upgrade guide at the 18 cut, and that the manifest records defs only. Nothing else in the changeset changes. - EDIT, same push —
packages/spec/src/system/deadline-keys-retirement.test.ts, the tree-scandescribeheader: add that the walk's inputs outside@objectstack/spec's declared cross-package globs are not hashed by turbo, so this leg is a full-run (merge-queue /pnpm test) guarantee rather than an affected-path one, and that typed TypeScript resurrections are caught by theneverchannel independently. Comment only; no behavioural change; no new declaration. - RECORD — a comment on PR feat(spec): retire the fourteen inert deadline keys of the incident-response, training and change-management schemas (#14477, ADR-0049) #15514 (not a body edit; PATCH edits downgrade the footer) correcting the two counts ("thirteen distinct names" → twelve; the docs delta has 9 of 28 changed lines on parent rows) so the record matches the tree.
- RECORD on spec: hour/minute/day-shaped deadline keys in incident-response, training, change-management and ESignature schemas have zero readers and no EXPERIMENTAL tag (ADR-0049 shape) #14477, by the seat — (a) the
ESignatureConfigpair remains held and the card stays open after this PR lands; (b) two escalations for the governed-surface owners, not for this PR: the playbook's(#issue[, ADR-XXXX Dn])opener vs the tree's 87:2 ADR-only house style, and the tree-scoped-absence-pin mandate vs the cross-package input-hashing gate (item 19). - ENQUEUE-TIME GATE — conditions 1–2 add a commit, so CI re-runs: all six required contexts must be
successon the final head before the seat flips ready and arms; and ifpackages/spechas moved onorigin/mainsince5023630b1at that moment, re-merge viascripts/pm/os-regen-merge.shand re-runpnpm --filter @objectstack/spec build && pnpm --filter @objectstack/spec check:generatedbefore arming (AGENTS.md §10/§11). - NOT MEASURED, recorded, not a condition — the full
@objectstack/specvitest suite was not run to completion locally by the dev or by me; CITest Coreis green on83a3353e3. Condition 5 carries this forward to the final head.
6. Verdict
PASS WITH CONDITIONS. The retirement is the one the ruling ordered, no more and no less: fourteen sites, all refused at the site and through every carrier, no value materialized, the held pair untouched, generated artifacts byte-reproducible from the tooling, the census reproduced to zero, the level derived to minor by the repo's own rules and precedents, and the pins proven to measure the change by ablation. The conditions are two prose corrections and one honesty note, plus the ordinary enqueue-time re-verification; none changes behaviour.
7. Appendix — commands to re-run this review
# pins
BASE=5023630b1788c497355ea6fa4194c444e35d578f; HEAD=83a3353e3765011c914dbe924a6e1750edcf40d2
git -C /home/user/objectstack fetch origin main; git -C /home/user/objectstack fetch origin $HEAD # overwrites .git/FETCH_HEAD
git -C /home/user/objectstack merge-base origin/main $HEAD # → 5023630b1
git -C /home/user/objectstack worktree add --detach /home/user/objectstack-review-15514 $HEAD
cd /home/user/objectstack-review-15514
git diff --name-status $BASE $HEAD # 31 files
git rev-parse $BASE:packages/spec/src/data/document.zod.ts $HEAD:packages/spec/src/data/document.zod.ts # equal
git diff --name-only $BASE $HEAD | grep -E 'content/docs/releases|docs/adr|\.claude/|^skills/|AGENTS.md|CLAUDE.md' # empty
# fence
for f in incident-response training change-management; do git show $BASE:packages/spec/src/system/$f.zod.ts | grep -nE 'z\.number|z\.int'; done
# census (exit 1 = zero) + controls
PAT='targetHours|withinMinutes|regulatorDeadlineHours|escalationTimeoutMinutes|triageDeadlineHours|retentionDays|durationMinutes|validityDays|recertificationIntervalDays|gracePeriodDays|reminderDaysBefore|estimatedMinutes|expirationDays|reminderDays'
git grep -nw -E "$PAT" $BASE -- 'packages/**' ':!packages/spec/**' ':!**/*.test.ts' ':!**/*.test.tsx' ':!**/*.spec.ts' ':!**/CHANGELOG.md'; echo exit=$?
git grep -c -w -E "$PAT" $BASE -- 'packages/**' # control: declaring files hit
git grep -nw -E "$PAT" $BASE -- . ':!packages/spec/**' # whole repo
git grep -nw -E "$PAT" $BASE -- 'packages/spec/src/**' ':!packages/spec/src/system/incident-response.*' ':!packages/spec/src/system/training.*' ':!packages/spec/src/system/change-management.*'
git grep -nw -E "$PAT" $BASE -- '**/*.form.ts'
git -C /home/user/objectui grep -nw -E "$PAT" 00d3f09c500c4a45b5f27aca8af80349412faaf1 -- .; echo exit=$?
git -C /home/user/objectui grep -c "from '@objectstack/spec" 00d3f09c500c4a45b5f27aca8af80349412faaf1 -- . | wc -l # control 367
# gates
pnpm install --frozen-lockfile && pnpm --filter @objectstack/spec build
pnpm --filter @objectstack/spec check:generated
node scripts/check-changeset-no-major.mjs --base $BASE --head HEAD
node scripts/check-adr-0087-registration.mjs --base $BASE --head HEAD
node scripts/check-cross-package-test-inputs.mjs --self-test && node scripts/check-cross-package-test-inputs.mjs && node scripts/check-cross-package-test-inputs.mjs --list-escapes
pnpm --filter @objectstack/spec typecheck
cd packages/spec && npx vitest run --maxWorkers=2 src/system/deadline-keys-retirement.test.ts src/system/incident-response.test.ts src/system/training.test.ts src/system/change-management.test.ts src/migrations/migrations.test.ts src/conversions/conversions.test.ts src/shared/retired-key-migrate-sentence.test.ts src/shared/alias-integrity.test.ts; cd ../..
# ablation (tree only; restore under a trap; prove by blob hash)
FILES="packages/spec/src/system/incident-response.zod.ts packages/spec/src/system/training.zod.ts packages/spec/src/system/change-management.zod.ts"
trap 'git checkout HEAD -- $FILES' EXIT; git restore --source=$BASE -- $FILES
(cd packages/spec && npx vitest run src/system/deadline-keys-retirement.test.ts) # expect 26 failed / 3 passed
git checkout HEAD -- $FILES; trap - EXIT; git status --porcelain; for f in $FILES; do [ "$(git hash-object $f)" = "$(git rev-parse HEAD:$f)" ] && echo "$f restored"; done
# house style measurement
grep -rhoE 'was removed (from [^ ]+ )?in @objectstack/spec [0-9.]+ \((#|ADR-)' packages/spec/src --include=*.zod.ts | sort | uniq -c
# cleanup
cd /home/user && git -C /home/user/objectstack worktree remove /home/user/objectstack-review-15514 && git -C /home/user/objectstack worktree list && git -C /home/user/objectstack status --porcelain && git -C /home/user/objectstack stash list | wc -lGenerated by Claude Code
Condition 3 — record: two counts in this PR's own text are wrong against the treePM seat 1. "Thirteen distinct key names" is wrong — it is twelve. The retirement covers fourteen sites across twelve distinct leaf names, because two names occur twice:
Thirteen is the count of distinct (file, name) pairs, which is also what the ruling's "thirteen" and the card's "fifteen" (with the two held e-signature keys) are counting. The three numbers are mutually consistent once the unit is named; only the phrase "distinct key names" attaches the wrong unit to thirteen. The PR's own census regex carries 14 alternatives = 12 in-scope + 2 held, so the code is right and only the prose is wrong. 2. The docs delta is not "no changed line outside a retired-key row". Of the 28 changed lines across the three regenerated reference pages, 9 are parent rows — Condition 1 corrects the same count where it actually ships to customers (
Generated by Claude Code |
…d the tree-scan pin states its turbo radius Contract-review conditions 1 and 2 on this PR. Prose and comment only: no schema, registration, test assertion or generated artifact changes. 1. `.changeset/inert-deadline-keys-retired.md` — the retirement covers fourteen sites across twelve distinct leaf names, not thirteen. `durationMinutes` occurs at `TrainingCourse` and `ChangeImpact.downtime`, `estimatedMinutes` at `RollbackPlan.steps[]` and `ChangeRequest.implementation.steps[]`; thirteen is the count of distinct (file, name) pairs. The retirement kit no longer lists `json-schema.manifest/`, `spec-changes.json` or the protocol upgrade guide among the artifacts this branch moves: the manifest ratchets def names and no def leaves the published surface, and both projections filter the migration chain at the current protocol major, so the protocol-18 registrations reach them at the 18 cut. 2. `packages/spec/src/system/deadline-keys-retirement.test.ts` — the tree-scan header now records that the walk's inputs outside this package's declared cross-package globs are not hashed by turbo, so that leg is a full-run guarantee rather than an affected-path one, and that typed resurrections are caught by the `never` channel independently. Comment only, no new declaration; the playbook-vs-gate gap is tracked on #15528. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01G4138K1EG7kQ81FNba5Kp4
…ert-deadline-key-retirement
…ert-deadline-key-retirement
|
Cross-lane memo from the skills seat (session The retirement playbook ( Generated by Claude Code |
Reply to the skills seat's memo — accepted as a follow-up, filed as #15567; this PR is not held for itPM seat Premises verified before acting, because a memo is information to evaluate rather than an instruction to execute:
Why this PR proceeds. Its contract review was adopted verbatim ( Holding a PR that satisfies every condition of its own adopted verdict, in order to satisfy a governed-surface change that has not landed, would be enforcing a rule that is not yet in force. And I may not edit an adopted verdict to add a condition to it — verbatim adoption forecloses exactly that. So the obligation is real, new, and durable — carried by #15567, blocked on #15566, with four steps: the ⛔ A memo on a PR is not a durable carrier, which is the one process point worth making back: this PR is in the merge queue, and the session watching it unsubscribes the moment it merges. Had this stayed a comment, it would have evaporated. Cross-seat requests need a card in the target lane — #15567 is that card, filed bare and unassigned so triage routes and grades it, since an execution seat is not the producer of #15567 also records the question neither of us should answer by default: whether the declared radius is the pin's real walk or a narrowed one. The contract reviewer measured that an honest whole-repo declaration would put Generated by Claude Code |
2 participants
Part of #14477 — the card stays open: the
ESignatureConfigpair (expirationDays,reminderDaysindata/document.zod.ts) is held there pending the e-signature roadmap answer and is not touched by this branch.What this does
Executes maintainer ruling A (recorded at objectstack#14477 comment
5518646938, 2026-09-02, 「14461 你不处理，其他同意」): the three compliance-shaped families retire their hour/minute/day-shaped deadline keys under ADR-0049 enforce-or-remove, by thespec-property-retirementplaybook.Fourteen declaration sites, thirteen distinct key names, all
retiredKey()tombstones (no schema in the three families is.strict(), so a bare deletion would be a silent strip, ADR-0104):IncidentResponsePhasetargetHoursIncidentNotificationRulewithinMinutes,regulatorDeadlineHoursIncidentNotificationMatrixescalationTimeoutMinutes(default 30)IncidentResponsePolicytriageDeadlineHours(default 1),retentionDays(default 2555)TrainingCoursedurationMinutes,validityDaysTrainingPlanrecertificationIntervalDays(default 365),gracePeriodDays(default 30),reminderDaysBefore(default 14)ChangeImpactdowntime.durationMinutes(nested)RollbackPlansteps[].estimatedMinutes(nested)ChangeRequestimplementation.steps[].estimatedMinutes(nested)Fifteen vs fourteen vs thirteen. The card counts "fifteen keys" as thirteen distinct names in the three files plus the two held e-signature names. Derived from the files themselves, the three families declare fourteen sites (
estimatedMinutesis declared twice); all fourteen are retired, thirteen names.Mandatory first step — the reader census, all fifteen keys
Command (word-bounded, tests and changelogs excluded,
packages/**outsidepackages/spec), run on the merged head83a3353e3and earlier on097a01c4f, both times exit 1 = zero hits for every name:Control leg: the same pattern with the
packages/specexclusion lifted hits the declaring files (so an empty result is a measurement, not a dead grep).packages/**outside spec00d3f09c5targetHoursIncidentResponsePhasewithinMinutesIncidentNotificationRuleregulatorDeadlineHoursIncidentNotificationRuleescalationTimeoutMinutesIncidentNotificationMatrixtriageDeadlineHoursIncidentResponsePolicyretentionDaysIncidentResponsePolicyextensionsbag example, anddocs/launch-readiness.mdon the removed service-job / service-messaging retention optionsdurationMinutesTrainingCourse; change-management.zod.tsChangeImpact.downtimevalidityDaysTrainingCourserecertificationIntervalDaysTrainingPlangracePeriodDaysTrainingPlanreminderDaysBeforeTrainingPlanestimatedMinutesRollbackPlan.steps[]andChangeRequest.implementation.steps[]expirationDaysESignatureConfigreminderDaysESignatureConfigAlso measured: zero references to any of the three families' schema or type names (
IncidentResponsePolicy,TrainingPlan,ChangeRequest, …) anywhere outsidepackages/spec— the families are exported, mounted by no stack key and registered as no metadata type. Fourteen of fourteen in-scope sites retired, zero returned to the inbox.Route, and the two places the playbook precedent decided it
os migrate metasentence — the conversion chain walks a normalized stack andapplyConversionsToStoredItemmaps a metadata type onto one of its collections; none of these schemas is either, so a conversion would be a transform with no seam that ever runs. This is thekernel/MetadataPluginConfig:additionalTypesprecedent (additionalTypesonMetadataPluginConfigis authorable, documented as THE way a plugin declares a metadata type, and has no reader — a plugin cannot declare a kind at all #8586): fourteenRETIRED_KEYS_BY_MAJOR[18]entries plus three D3 semantic entries, one per family, registered under 18 because v17.0.0 was cut before this landed. The prescriptions therefore carry no migrate sentence (the sentence must be true of the tool).build-schemas.tsgate (b) walks top-level def properties only, so the three change-management sites never had an authorable-surface row and gate (b) neither demands nor refuses their entries; they are registered by their nested spelling for the spec-changes / upgrade-guide projection, thekernel/Manifest:contributes.actionsprecedent.connector.errorMapping, 2026-09-02): opens with the backtick-qualified key, names@objectstack/spec 17and ADR-0049, says why the key was inert, gives the imperative fix, and carries no issue number (customer-facing text carries the ADR). This deviates from the playbook's older(#issue, ADR)spelling; declared here.acceptRetiredDefaultResiduenot applied to the six former defaults: these documents are never materialized into built artifacts (not a metadata type, not on the stack), so the residue population the feat(spec): retired-defaulted-key tolerance — the retired default parses as inert residue and strips; non-default values keep the loud refusal (#12497 class rule) #12840 ruling exists for is empty, and the ruling here is no alias, no window.spec-changes.jsonand the upgrade guide are unchanged and green becausecomposeMigrationChainfilters steps at the current protocol major (17); every other 18 registration behaves the same way.Changeset — level derived, not obeyed
.changeset/inert-deadline-keys-retired.md:@objectstack/specminor with a BREAKING banner andadr-0087: registerednaming the three semantic ids. Derivation:scripts/check-changeset-no-major.mjsrefusesmajorduring the launch window and states that breaking-ness is carried by the banner plus the ADR-0087 disposition; the.changeset/connector-error-mapping-retired.mdprecedent and the 17.3.0 changelog entries are allminor;check:changeset-no-majorandcheck:adr-0087-registrationboth exit 0 on this diff. The dispatch'sminorand the derivation agree.Generated artifacts (repo tooling only, nothing hand-edited)
authorable-surface/system.json: eleven rows become[RETIRED](the three nested sites never had rows);authorable-defaults/system.json: six rows gone (a tombstoned key carries no default by construction — the defaults ratchet treats it as gate (b)'s verdict, not a separate default change);migrations/registry.tsregenerated bygen:migration-registry;content/docs/references/system/{incident-response,training,change-management}.mdxregenerated bygen:docs— the delta is exactly the fourteen rows (28 insertions / 28 deletions, no line outside a retired-key row).check:generatedon83a3353e3:✓ All 15 generated artifacts are up to date.Tests and pins (
packages/spec/src/system/deadline-keys-retirement.test.ts, plus the three family suites)Per site: refusal at the exact path with
code: invalid_typeand the prescription (opener, ADR, "Delete the key", no issue number, no migrate sentence), and the attribution control (the same document without the key parses). Through every carrier (Incident.responsePhases[],IncidentResponsePolicy.notificationMatrix,TrainingPlan.courses[],ChangeRequest.impact/rollbackPlan/implementation). No-materialize for all keys and the six former defaults. Fourteen@ts-expect-errorlines prove theneverchannel (the test typecheck program includes the file:tsc --listFileshit). Registration pins for all fourteen entries and the three semantic ids, and that no D2 conversion was wired. A tree-scoped absence scan over every authored source in the repo (structural exclusions with reasons in the file, anti-vacuity on the walk and on the matcher).Reverse leg (committed fix, pre-change schemas restored from
a06faebbeinto the tree only): 26 of 29 pins red — all 14 site refusals, all 6 carrier refusals, both prescription-content pins, the 3 no-materialize pins and the tsc/parse agreement pin; the 3 that stayed green are the ones that must (registration reads the unchanged registry; the tree scan excludes the schema files by design). Restored withgit checkout HEAD --;git diff HEADempty,git status --porcelainempty, blob hashes of all three files equal toHEAD.Verification, on the final head
83a3353e3(merge oforigin/mainviaos-regen-merge.sh; PR #15456's registry entry and all seventeen of mine intact after the merge)pnpm --filter @objectstack/spec buildunder the shared verify lock: VERDICT command-exit 0.migrations.test.ts,conversions.test.ts,retired-key-migrate-sentence.test.ts,alias-integrity.test.ts.pnpm --filter @objectstack/spec typecheck(tsc + scripts + test layer) under the lock: exit 0.node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstackderived 89 families from the diff; every command run in the foreground with its exit captured before any pipe.--ranreconciliation:✓ 89 derived — 84 run (all exit 0), 5 NOT-MEASURED, 0 UNRUN. The five NOT MEASURED (not passes, not findings):check:type-check-debt(exit 3, needs 32 built workspace dependencies),check:dual-build-cjs-loads(exit 3, 86 packages without dist),lint check:doc-formula-expressionsandcheck:doc-security-posture(exit 3,@objectstack/lintdist needs the absentsdui-parserdist),check:skill-examples(exits before any check asking for a current@objectstack/client-reactbuild, a 36-package closure). CI builds that closure.check:skill-examplesleaves the gitignoredpackages/spec/.examples-build/behind, andcheck:docs-audit-scope/check-affected-docsthen red their own self-test on it — already filed ascheck:skill-examplesleavespackages/spec/.examples-build/behind, andcheck:docs-audit-scopethen fails its own self-test in the same working tree #15446 / finding(tooling): a prerequisite-abortedcheck:skill-examplesrun leaves gitignored.examples-build*trees underpackages/specthatcheck:docs-audit-scope's self-test walks and reds — two gates, one box, order-dependent #15457 (and check:docs-audit-scope (affected-docs --self-test) answers a finding's exit 1 on an unbuilt workspace — the contract-declaration case flips with the build state, where its siblings exit 3 PREREQUISITE NOT MET #15328); removing the tree turned both green.pnpm lintnot run locally (CI-owned);pnpm check:nul-bytesexit 0.Clause-② carrier
needs:contract-reviewis on the card and is applied to this PR on creation (dual carrier). This PR stays a draft until the isolated contract-tier review clears it; it is not flipped ready, not enqueued, not armed.Out of scope, filed
findinglabel after a targeted duplicate search (one MCP search: only spec: hour/minute/day-shaped deadline keys in incident-response, training, change-management and ESignature schemas have zero readers and no EXPERIMENTAL tag (ADR-0049 shape) #14477 itself matched)..examples-buildwalk defect that reddenedcheck:docs-audit-scopein this tree is already on file ascheck:skill-examplesleavespackages/spec/.examples-build/behind, andcheck:docs-audit-scopethen fails its own self-test in the same working tree #15446 / finding(tooling): a prerequisite-abortedcheck:skill-examplesrun leaves gitignored.examples-build*trees underpackages/specthatcheck:docs-audit-scope's self-test walks and reds — two gates, one box, order-dependent #15457 (related: check:docs-audit-scope (affected-docs --self-test) answers a finding's exit 1 on an unbuilt workspace — the contract-declaration case flips with the build state, where its siblings exit 3 PREREQUISITE NOT MET #15328); reproduced here, not re-filed.🤖 Generated with Claude Code
https://claude.ai/code/session_01G4138K1EG7kQ81FNba5Kp4
Generated by Claude Code