Merge remote-tracking branch 'origin/main' into claude/issue-15068-seed-read-dead-org-rung

Author: claude

.changeset/inert-deadline-keys-retired.md

@@ -0,0 +1,140 @@
+---
+"@objectstack/spec": minor
+---
+
+feat(spec): retire the fourteen inert deadline keys of the incident-response, training and change-management schemas (#14477, ADR-0049)
+
+<!-- adr-0087: registered incident-response-deadline-keys-retired, training-deadline-keys-retired, change-management-duration-keys-retired -->
+
+**BREAKING** accept-set narrowing, landing after the v17.0.0 cut (the lockstep
+launch-window convention ships it as `minor`; the migration prescriptions are
+registered under protocol major 18, where `os migrate meta` users will look).
+Maintainer ruling 2026-09-02 on the census card (ruled A: retire per family):
+ADR-0049 enforce-or-remove decides it — declared-but-unenforced deadline
+surface with zero measured readers comes off.
+
+Fourteen hour/minute/day-shaped deadline, SLA and duration key sites — twelve
+distinct names, because `durationMinutes` and `estimatedMinutes` each occur at
+two sites — sat on the exported incident-response, training and
+change-management schemas and in the generated reference docs, and **nothing
+read them**: the schemas are exported from `@objectstack/spec/system`, mounted
+by no stack key, registered as no metadata type, absent from the 2026-06
+liveness ledgers, and the reader census over every package outside
+`packages/spec` (tests and changelogs excluded) and over objectui at the
+pinned sha returned zero hits for every key. An author could write
+`triageDeadlineHours: 4`, `validityDays: 365` or `regulatorDeadlineHours: 72`
+and reasonably expect the platform to escalate, expire or notify — it never
+did, and it never said so. Six of the keys carried defaults (30 minutes,
+1 hour, 2555 days; 365, 30 and 14 days) that were materialized into every
+parsed document without ever being consulted. A compliance-shaped deadline
+that fails silently is the worst form of the shape ADR-0049 names.
+
+**What is refused:** authoring any of the keys below, with any value, on the
+base schema and through every carrier that nests it (`Incident.responsePhases[]`,
+`IncidentResponsePolicy.notificationMatrix`, `TrainingPlan.courses[]`,
+`ChangeRequest.impact` / `.rollbackPlan` / `.implementation`). None of the
+schemas is `.strict()`, so each key is a `retiredKey()` tombstone rather than a
+bare deletion (a deletion would have stripped it in silence): authoring it is a
+`tsc` error (`never`) and a parse error carrying the prescription
+(`invalid_type` at the path of the key).
+
+| schema | retired keys |
+|:--|:--|
+| `IncidentResponsePhase` | `targetHours` |
+| `IncidentNotificationRule` | `withinMinutes`, `regulatorDeadlineHours` |
+| `IncidentNotificationMatrix` | `escalationTimeoutMinutes` (default 30) |
+| `IncidentResponsePolicy` | `triageDeadlineHours` (default 1), `retentionDays` (default 2555) |
+| `TrainingCourse` | `durationMinutes`, `validityDays` |
+| `TrainingPlan` | `recertificationIntervalDays` (default 365), `gracePeriodDays` (default 30), `reminderDaysBefore` (default 14) |
+| `ChangeImpact` | `downtime.durationMinutes` |
+| `RollbackPlan` | `steps[].estimatedMinutes` |
+| `ChangeRequest` | `implementation.steps[].estimatedMinutes` |
+
+**What stays, byte-identical:** every other key of the three families with its
+default and its (absent) readers, and every export — no def leaves the public
+surface. Parsed documents no longer carry the six former defaults.
+
+**Held, not touched:** the `ESignatureConfig` pair (`expirationDays`,
+`reminderDays` in `data/document.zod.ts`) — the ruling left that branch open
+pending the e-signature roadmap answer; it stays on the card.
+
+## FROM → TO
+
+```ts
+// before — parsed green; no engine ever read a single one of these numbers
+const policy: IncidentResponsePolicy = {
+  notificationMatrix: {
+    rules: [{ severity: 'critical', channels: ['pagerduty'], recipients: ['security_team'],
+              withinMinutes: 15, notifyRegulators: true, regulatorDeadlineHours: 72 }],
+    escalationTimeoutMinutes: 45,
+  },
+  defaultResponseTeam: 'security_team',
+  triageDeadlineHours: 2,
+  retentionDays: 3650,
+};
+const course: TrainingCourse = {
+  id: 'COURSE-SEC-001', title: 'Security Fundamentals', description: '…',
+  category: 'security_awareness', targetRoles: ['all_employees'],
+  durationMinutes: 60, validityDays: 365,
+};
+const rollback: RollbackPlan = {
+  description: 'Restore from backup',
+  steps: [{ order: 1, description: 'Restore backup', estimatedMinutes: 15 }],
+};
+
+// after — delete the keys; there is no replacement because no incident-response,
+// training-management or change-management engine exists to keep a deadline.
+// Record retention is the object-level `lifecycle` block (ADR-0057), declared on
+// the object that stores the records.
+const policy: IncidentResponsePolicy = {
+  notificationMatrix: {
+    rules: [{ severity: 'critical', channels: ['pagerduty'], recipients: ['security_team'],
+              notifyRegulators: true }],
+  },
+  defaultResponseTeam: 'security_team',
+};
+const course: TrainingCourse = {
+  id: 'COURSE-SEC-001', title: 'Security Fundamentals', description: '…',
+  category: 'security_awareness', targetRoles: ['all_employees'],
+};
+const rollback: RollbackPlan = {
+  description: 'Restore from backup',
+  steps: [{ order: 1, description: 'Restore backup' }],
+};
+```
+
+One-line fix: delete the key wherever it is authored. There is no
+`os migrate meta` edit list for these keys — none of the schemas is a stack
+collection member, so the conversion chain has no seam to walk (the
+`MetadataPluginConfig.additionalTypes` precedent); the tombstone prescription
+and the protocol-18 upgrade guide are the channels.
+
+The retirement kit:
+
+- `retiredKey()` tombstones at all fourteen sites (`packages/spec/src/system/
+  incident-response.zod.ts`, `training.zod.ts`, `change-management.zod.ts`;
+  each file's section comment records what the shape was and why no D2
+  conversion exists)
+- ADR-0087 registration: fourteen `RETIRED_KEYS_BY_MAJOR[18]` entries (the
+  three nested change-management sites spelled `ChangeImpact:downtime.durationMinutes`,
+  `RollbackPlan:steps.estimatedMinutes`, `ChangeRequest:implementation.steps.estimatedMinutes`)
+  and three D3 semantic entries, one per family
+- no liveness-ledger row: none of the three families is an enrolled ledger
+  type, so there is no row to keep or drop
+- pin tests (`deadline-keys-retirement.test.ts`): a refusal pin per site
+  asserting the issue path, code and prescription on the base schema and
+  through the nesting carriers; the tsc `never` channel; no-materialize pins
+  for the six former defaults; the ADR-0087 registration; and a tree-scoped
+  absence pin over every authored source in the repo
+- generated baselines and docs follow the schema: `authorable-surface/` gains
+  eleven `[RETIRED]` rows, `authorable-defaults/` loses six rows, the three
+  system reference pages are regenerated, and the gitignored `json-schema/`
+  output is re-emitted on the next build
+- `json-schema.manifest/` is unchanged, and correctly so: it ratchets def
+  *names*, and retiring keys removes no def from the published surface
+- `spec-changes.json` and the protocol upgrade guide are unchanged too: both
+  project the migration chain at the current protocol major (17), so these
+  protocol-18 registrations reach them at the 18 cut
+- zero authored occurrences in this repo's examples, skills and hand-written
+  docs, and zero hits in objectui at the pinned sha, so no in-repo source
+  changes ride along beyond the three families' own unit tests

.changeset/truthful-stranded-decision-envelope.md

@@ -0,0 +1,17 @@
+---
+"@objectstack/types": minor
+"@objectstack/plugin-approvals": minor
+"@objectstack/rest": minor
+---
+
+An approval decision that lands while its flow run strands now says so in fields, not only in prose.
+
+`POST /api/v1/approvals/requests/{id}/reject` — and its sibling decision doors — could produce three coexisting outcomes from one call: the caller read HTTP 500, the request row **was** in its terminal status and had left the pending inbox, and the workflow run was stranded. A caller reading 500 has one honest inference available — "the rejection did not happen" — and it was the wrong one, so scripts and operators retried or escalated against a decision that was already durable. The only carrier of the truth was English prose in `error`, so finding the affected run meant regexing a run id out of a sentence, and nothing said whether that run could be repaired at all.
+
+The 500 stays. A recorded decision whose flow never advances is still a failure and is still reported as one; the door does not become atomic and no decision is ever rolled back. What changed is that it stops discarding what the engine already said:
+
+- **The `RESUME_FAILED` body gains four fields**, additively — `finalized` (always `true`: the decision stands), `decision`, `runId`, and `repairable`. Existing consumers see the same `code`, the same `error` and the same status.
+- **`repairable` carries the engine's own discriminator** — `AutomationResult.status === 'stranded'`, the state stamped on exactly the exit that journals a repair snapshot. `false` is the answer for every other failure, including a lost run: absence of the signal is not repairability, and a repair verb that would refuse is worse than no promise.
+- **`serviceResume` carries `status`** through to the door. It previously read only `success` / `code` / `error`, and the stranded exit reports a `status` and no `code` at all — so the platform's own repairability signal died one line before the envelope was built.
+
+`@objectstack/types` gains `strandedDecisionFailure` / `strandedDecisionDetails` and the `StrandedDecisionDetails` type — the constructor and its recogniser in one module, so the producing service and the REST door cannot drift. A `RESUME_FAILED` raised without that carrier answers exactly the body it always did; the door never synthesises the envelope.

.github/workflows/lint.yml

@@ -3188,6 +3188,23 @@ jobs:
       - name: Console-intercept disarm
         run: node scripts/check-console-intercept-disarm.mjs --self-test && node scripts/check-console-intercept-disarm.mjs
 
+      # Declared registry log level (#15425, origin #13517). objectql's
+      # SchemaRegistry logs one `[Registry] Registered …` line per registered
+      # item per construction, at its shipped `info` default; a suite that boots
+      # app stacks pays items x boots of that on a shard log nobody reads.
+      # PR #13985 and PR #14016 declared `OS_REGISTRY_LOG` in four harnesses and
+      # removed ~47,900 lines — and nothing held them there, so deleting the
+      # line restored five figures of output with every suite still green. This
+      # asserts the declaration in every package whose OWN TEST SOURCES boot the
+      # engine, a DERIVED population (registry construction / `bootStack` /
+      # example-app import), not a roster: the tree's own audit
+      # (docs/audits/2026-09-test-log-volume-census.md) measures packages/rest at
+      # 528 residual `[Registry]` lines, so a roster of the four that already
+      # declared would have shipped a known-incomplete list. Self-test first,
+      # then the real scan; reads ~72 manifests and their test sources.
+      - name: Declared registry log level
+        run: node scripts/check-registry-log-declared.mjs --self-test && node scripts/check-registry-log-declared.mjs
+
       # Live-server database isolation (#10382). CI provisions ONE Postgres and
       # ONE MySQL for the whole temporal-conformance job and points every live
       # leg at them, and every live suite in the repo issues a `drop` when it

content/docs/permissions/system-context.mdx

@@ -64,7 +64,7 @@ not on any flag.
 ## How the flag is set
 
 `isSystem` is **server-constructed and never client-supplied**. Inbound HTTP
-cannot set it (`packages/rest/src/rest-server.ts:1548`, `:1577`), and neither
+cannot set it (`packages/rest/src/rest-server.ts:1553`, `:1582`), and neither
 can an action body (`packages/runtime/src/domains/actions.ts:414`). It is
 written by internal callers only, as an option on the engine call:
 
@@ -103,7 +103,7 @@ that silently does not happen.
 | 14 | MCP stdio bridge skips the object API-exposure gate | mcp | Get: the bridge reaches objects whose `apiEnabled` / `apiMethods` would refuse an external caller | `stdio-data-bridge.ts:246` |
 | 15 | **Read-audit rows are not written** | plugin-audit | Lose: the "a person opened this record" trail. `sudo()` keeps the caller's `userId`, so this flag is the only thing separating a human read from a platform one | `read-audit.ts:556` |
 | 16 | Approval snapshot payload redaction skipped | plugin-approvals | Get: the whole snapshot on `find` / `findOne` — the audit/replay channel. Lose: field-visibility redaction over approval payloads | `payload-redaction-middleware.ts:115` |
-| 17 | REST anonymous-deny seam satisfied | rest | Get: `enforceAuth` passes with no `userId`. Not reachable from the wire — `isSystem` is never set on an inbound request | `rest-server.ts:1580` |
+| 17 | REST anonymous-deny seam satisfied | rest | Get: `enforceAuth` passes with no `userId`. Not reachable from the wire — `isSystem` is never set on an inbound request | `rest-server.ts:1585` |
 
 ### 2. Write pipeline and data integrity
 
@@ -145,7 +145,7 @@ The largest single consumer — **17 of the 106 sites**.
 |:--|:---|:---|:---|:---|
 | 40 | **Approval record lock released** — a locked record is writable | plugin-approvals | Get: engine self-writes (the status mirror) pass. Lose: the lock that stops edits while an approval is live. Note there is deliberately **no admin exemption** here — only `isSystem` | `lifecycle-hooks.ts:347` |
 | 41 | Delegation write guard bypassed | plugin-approvals | Get: service / seed / import may write delegation rows naming another delegator | `lifecycle-hooks.ts:570` |
-| 42 | Approval actor / submitter / pending-approver checks bypassed (8 sites) | plugin-approvals | Get: approve, reject, recall, reassign without being a pending approver or the submitter | `plugin-approvals/src/approval-service.ts:963`, `:1072`, `:3196`, `:3342`, `:3509`, `:3580`, `:3769`, `:3809` |
+| 42 | Approval actor / submitter / pending-approver checks bypassed (8 sites) | plugin-approvals | Get: approve, reject, recall, reassign without being a pending approver or the submitter | `plugin-approvals/src/approval-service.ts:963`, `:1072`, `:3248`, `:3396`, `:3564`, `:3635`, `:3824`, `:3864` |
 | 43 | Saved-report ownership is **assignable**, and an update may reassign it | plugin-reports | Get: `ownerId` from input is honoured. A non-system caller always owns what it creates and can never reassign | `plugin-reports/src/report-service.ts:404`, `:425` |
 | 44 | Saved-report access / export / mutation gates bypassed | plugin-reports | Get: read, bulk-export and overwrite any report | `plugin-reports/src/report-service.ts:343`, `:372`, `:447`, `:684` |
 | 45 | Attachment access hooks return early (insert + update + delete, and the read AST) | service-storage | Lose: attachment visibility scoping | `attachment-access-hooks.ts:300`, `:349`, `:448`, `:524` |
@@ -158,7 +158,7 @@ The largest single consumer — **17 of the 106 sites**.
 |:--|:---|:---|:---|:---|
 | 48 | Object API-exposure gate bypassed (`apiEnabled` / `apiMethods`) | runtime | Get: internal self-writes ignore exposure declarations — these govern **external** exposure, not engine self-writes | `action-execution.ts:138` |
 | 49 | Action `requiredPermissions` bypassed | runtime | Get: engine self-invocation runs any action | `action-execution.ts:401` |
-| 50 | `manage_metadata` bypassed on metadata writes | runtime, rest | Get: schema writes without the capability | `domains/meta.ts:471`, `:874`, `rest-server.ts:4967`, `:6381`, `:6629`, `:7060`, `:7253` |
+| 50 | `manage_metadata` bypassed on metadata writes | runtime, rest | Get: schema writes without the capability | `domains/meta.ts:471`, `:874`, `rest-server.ts:4972`, `:6386`, `:6634`, `:7065`, `:7258` |
 | 51 | The shared metadata-write verdict itself returns `allowed` | metadata-core | Get: the one function all of row 50's doors consult answers yes before any capability is examined | `meta-write-capability.ts:134` |
 | 52 | Anonymous-deny seam satisfied on the domain dispatchers and the package/federation routes | runtime, rest | Get: passes with no `userId` | `domains/actions.ts:421`, `domains/ai.ts:60`, `domains/automation.ts:989`, `domains/meta.ts:232`, `domains/security.ts:78`, `domains/packages.ts:422`, `external-datasource-routes.ts:302`, `package-routes.ts:97` |
 | 53 | MCP principal check satisfied | runtime | Get: MCP surface reachable with no user | `domains/mcp.ts:61` |
@@ -199,7 +199,7 @@ assuming `isSystem` covers it is a documented source of bugs.
 | "It preserves a supplied `updated_at` / `updated_by`" | **No.** That is `preserveAudit`, a separate opt-in — and an UPDATE-path exemption only | `field.zod.ts:1580` (#3493 / #6640) |
 | "It stamps `created_by`" | **No.** Audit stamping reads `userId` from the context. A user-less system write stamps nothing — that is today's behaviour, not an error | `runtime-identity.ts:280`–`281` |
 | "It bypasses every guard" | **No.** The last-admin guard applies to **every** context, `isSystem` included — the deprovision path that actually locks an org out is the system one | `last-admin-guard.ts:299` |
-| "A client can request it" | **No.** Never settable from inbound HTTP or from an action body | `rest-server.ts:1548`, `:1577`; `domains/actions.ts:414` |
+| "A client can request it" | **No.** Never settable from inbound HTTP or from an action body | `rest-server.ts:1553`, `:1582`; `domains/actions.ts:414` |
 
 ---