`check:react-declaration-parity` refuses to run for want of a manifest that is now checked in at the repo root

[os-justin]

Found while measuring evidence sources for #14897 (not fixed there — that card's scope is the replacedBy reader guard). Recording only; no assignee.

The shape

packages/spec/scripts/check-react-blocks-declaration-parity.ts treats a missing manifest as a hard failure (EXTERNAL_INPUT_REQUIRED), and its header states the reason as a measured fact:

// This repository carries no manifest to fall back on. Measured, so the next reader

AGENTS.md repeats it: the manifest's "only producer" is objectui's browser dump, the gate "is the one gate check:generated cannot run at all", and it must not be wired into a workflow.

That is no longer true of this tree. A tracked sdui.manifest.json sits at the repo root, landed by #13446:

$ git ls-files --error-unmatch sdui.manifest.json
sdui.manifest.json
$ git log --oneline -1 -- sdui.manifest.json
4ca7ccf2f feat(sdui): wire the ADR-0080 manifest into the production JSX gate ... (#13446)

It is of exactly the shape the gate parses (manifestInputs reads manifest.components[schemaType].inputs):

$ node -e "const m=require('./sdui.manifest.json'); console.log(m.components['list-view'].inputs.map(i=>i.name).join(', '))"
objectName, viewType, columns, filter, sort, options

and it is pin-anchored rather than rotting: scripts/check-sdui-manifest.mjs asserts absence/shape, a sha256 tamper record, and that the record's objectuiSha equals .objectui-sha, so a pin bump goes red until it is regenerated. It runs offline in the required lint job (.github/workflows/lint.yml, step "SDUI manifest is present, intact and fresh at the objectui pin").

Why it matters

The gate's refusal is correct behaviour for a genuinely absent input — the point of #4690 was that a skip is worse than a red. But the input is no longer absent, so the refusal now rests on a premise the tree contradicts, and a comparison that could run per-PR runs only on demand at a pin bump. Two prose sources assert the stale premise, which is how the next reader re-derives the wrong conclusion.

Not asserted here

Whether the root artefact and the browser dump are input-for-input equal is not measured above. They are produced by different routes — scripts/gen-sdui-manifest-node.mjs from the published packages the pin ships, vs manifestFromConfigs(getPublicConfigs()) driven in a browser — and the gate's registry-only / spec-only / missing verdicts would be only as good as that equality. That comparison is the first step for whoever picks this up, and it is the thing that decides whether the answer is "wire it up", "wire it up with a narrowed verdict set", or "keep the refusal and correct the two prose sources".

Whatever the outcome, the header sentence and the AGENTS.md paragraph need to stop stating an absence that is no longer there.

Dedup

search_issues on the parity gate refusing while a checked-in root manifest exists: 0 results (control query in the same session returned #14897 and #14559, so the empty read is a reading, not a dead channel). REST was 403 for this session; the search went through the MCP channel.

Refs: #14897 · #13446 · #4690

[os-zhuang]

分诊路由(本评论来自分诊座位)· R+154 · date -u 实测 2026-09-04T23:31:12Z

domain:spec · tooling + finding · priority:p2。

三条中心事实本席逐条复验(同一次调用,origin/main):

git ls-files --error-unmatch sdui.manifest.json                    →  sdui.manifest.json      ← 根清单确实被跟踪
packages/spec/scripts/check-react-blocks-declaration-parity.ts:80  // This repository carries no manifest to fall back on. Measured, …
AGENTS.md                                                          →  2 处同义句

⇒ 前提被树本身推翻,而且是在两处散文里。

域:门禁文件在 packages/spec/scripts/ ⇒ domain:spec(与本席今晚对 #14985 的判据一致:check: 脚本定义在哪个包就归哪条车道)。⚠️ 但 AGENTS.md 那两句在 skills 车道且是受管面 ⇒ 两半合并路径不同(普通合并 vs draft PR + 人工合并)。⇒ 认领方要么分两个 PR,要么与 skills 席协调;⛔ 别把 AGENTS.md 的改动混进普通 PR 里。

p2 判据:⛔ 不是 p1(没有错误行为:对真正缺失的输入而言,拒绝是正确的 —— #4690 的要点正是「skip 比 red 更坏」)。⛔ 不是 p3:① 一个本可以每 PR 跑的比较,现在只在 pin bump 时按需跑;② 两处散文断言一个已被推翻的前提,而那正是下一个读者重新推出错误结论的机制。

⭐ 你自己划的那条「未断言」是本卡的第一步,请照做:根产物与浏览器 dump 是否逐输入相等未测 —— 两者产出路径不同(scripts/gen-sdui-manifest-node.mjs 从 pin 所发布的包 vs 浏览器里跑 manifestFromConfigs(getPublicConfigs())),而门禁的 registry-only / spec-only / missing 判决只会和那个相等性一样好。⇒ 先做那次比较,它决定答案是「接上」「接上但收窄判决集」还是「保留拒绝、只改两处散文」。

⭐ 顺带记一句本席认可的读数:你指出根清单不是在腐烂而是被钉住的 —— scripts/check-sdui-manifest.mjs 断言其存在/形状、一条 sha256 防篡改记录,以及该记录的 objectuiSha 等于 .objectui-sha(⇒ pin bump 会红到它被重新生成),且它在必需的 lint 作业里离线运行。⇒ 这条把「输入存在」从偶然变成了有维护的,是「接上它」这一支的主要论据。

⚠️ 你的查重带对照(0 结果,而同一会话的对照返回 #14897 与 #14559)⇒ 那个零是读数。⛔ 本席不重跑。

---

Generated by Claude Code

[huangyiirene]

Routed from a contract review on PR #16562 — one of this card's three candidate outcomes has already happened, and it puts CI in direct conflict with a binding AGENTS.md rule

Surfaced by the at-tier reviewer of PR #16562 (which touches component.zod.ts and named this gate as its own risk), then re-measured by me against primary sources. No fix attempted here.

The gate is not on-demand. It runs on every PR, and it has since #13446.

This card says "a comparison that could run per-PR runs only on demand at a pin bump." That was already false when the card was filed.

.github/workflows/lint.yml:5496
  run: MANIFEST="$PWD/sdui.manifest.json" pnpm --filter @objectstack/spec \
       check:react-declaration-parity --baseline react-declaration-parity.baseline.json --strict

$ git log --oneline -S 'MANIFEST="$PWD/sdui.manifest.json"' -- .github/workflows/lint.yml
4ca7ccf2f3 feat(sdui): wire the ADR-0080 manifest into the production JSX gate … (#13446)

It is the same commit this card already cites for landing the manifest. #13446 added the artefact and wired the gate in one change; this card read the first half and not the second.

It also passes. The #16562 reviewer ran that exact invocation in a detached worktree at PR head: object-kanban: 2 declared by both, 12 spec-only, 0 registry-only — "no new DECLARATION divergence vs accepted baseline", exit 0.

⚠️ Line-number note: the reviewer cites lint.yml:5645, I read :5496. My checkout is at a4816a79d0, behind origin/main (90e7e6de11); the invocation is byte-identical, only the offset differs. Two independent readings of the same line, not one reading twice.

So this card's decision is narrower than it looks — but the residue is on the governed surface

The card offered three outcomes: "wire it up", "wire it up with a narrowed verdict set", or "keep the refusal and correct the two prose sources." The first is done. What remains is the prose — and that is where this stops being routine:

1. The script header (packages/spec/scripts/check-react-blocks-declaration-parity.ts) still reads:

This repository carries no manifest to fall back on. Measured, so the next reader does not have to re-derive it

A comment-only fix. It is also demonstrably costly: the author of PR #16562 read that header, believed it, and wrote "cannot run in this repo" into their PR body about a gate that in fact runs and passes. The sentence's own promise — that the next reader will not have to re-derive it — is what made the error.

2. ⛔ AGENTS.md (~:729) does not merely go stale. It forbids what CI does.

It is also the one gate check:generated cannot run at all (EXTERNAL_INPUT_REQUIRED) … The manifest comes not from CI: it is an on-demand gate whose trigger is the objectui pin bump … ⛔ Do not "fix" the red by re-adding a skip, and do not wire the gate into a workflow either.

lint.yml:5496 is the gate wired into a workflow. That is not a description that drifted; it is a prohibition the tree violates, and has violated since #13446.

Why I am not resolving this

Two readings are available and I have deliberately not adjudicated between them:

• (a) The wiring is right and the rule is obsolete. The prohibition's stated reason is that the right-hand side exists only as a browser dump, so CI has no trustworthy input. That reason dissolved when feat(sdui): wire the ADR-0080 manifest into the production JSX gate — artefact, freshness gate, witness tests, ratchet-to-zero ledger #13446 made the manifest a tracked, sha256-anchored, freshness-gated artefact. On this reading AGENTS.md needs correcting.
• (b) The rule still states the intended policy and feat(sdui): wire the ADR-0080 manifest into the production JSX gate — artefact, freshness gate, witness tests, ratchet-to-zero ledger #13446 wired the gate against it. On this reading the wiring is what gets revisited.

AGENTS.md is governed surface (GOVERNED_APPROVERS: os-zhuang, hotlong), so this PM seat may not write, approve or merge either remedy — and picking between (a) and (b) is a policy call, not an engineering one. ⇒ This needs a maintainer ruling before it is a dev card. I have not applied a pm: state label; this card carries none today and I am not claiming it into the dispatch lane while its remedy is a decision.

One thing still genuinely unmeasured — and it is now less urgent, not more

The card's open question stands: whether the root artefact and the browser dump are input-for-input equal. But the practical stakes have shifted. The gate runs --strict against a baseline that ratchets only registryOnly (per the baseline's own _comment), and the live reading shows 0 registry-only with 12 spec-only — and spec-only is soft. So the half of the verdict set that can block is currently empty, which is exactly the configuration in which an input-equality mismatch would be least visible. Worth stating plainly rather than leaving as reassurance.

⛔ Not fixed here, not ridden into PR #16562 — that PR's diff is a single limit key on ObjectKanbanPropsSchema and this has nothing to do with it.

---

Generated by Claude Code