verify: an in-process handle on the booted stack — run a hook, flow, action or validation rule against the REAL engine and assert, so an app never fakes `ctx.api` again (epic hotcrm#1579, step 5a)

[os-zhuang]

Sub-issue of the epic hotcrm#1579 (step 5a). Filed by the director seat (objectstack#12708, summon #15); pm:epic reserves it for the epic PM — ⛔ not pm:queue, domain seats do not take it. domain:* / type / priority are triage's.

Ruling (maintainer, 2026-09-05, live director chat, verbatim, in order)

1. 「新增平台公开面」 — the test capability is platform-side.
2. 「我认为平台的能力应该放在平台，但是平台该怎么设计提供这个能力，你需要完整的重新考虑」 — do not lift hotcrm's helpers into a package; redesign how the platform provides it.
3. 「是不是 把执行能力并进 @objectstack/verify / os test 更合理？」 → the seat's design B′ (below) → 「同意」.
4. 「应该还是刚才 hotcrm 专题卡的子卡片吧」 — filed as sub-issues of hotcrm#1579.

Governing text. hotcrm AGENTS.md § "Scope — a pure metadata application (2026-08-31 ruling)", rule 3: "Lint, validation, gates and diagnostics belong to the platform, uniformly … ⛔ Do not grow a gate farm." Protocol baseline (maintainer 2026-09-05): 「本项目以协议为基准。所以开发应该对其协议，协议有问题应该立卡修改协议」. ADR-0054 (prove-it-runs) is the ADR that created @objectstack/verify; this card extends it, it does not open a new territory.

Measured (objectstack origin/main 04679418; hotcrm origin/main 021db549; 2026-09-05T15:4xZ)

What exists. @objectstack/verify is published (packages/verify/package.json: 17.3.0, public). bootStack(config, options) (packages/verify/src/harness.ts) boots the real ObjectKernel + ObjectQLPlugin + Hono/REST + auth + SecurityPlugin(appSecurityPluginOptions(config)) + sharing + settings + analytics + PlatformObjectsPlugin on in-memory SQLite, request-injection, no socket. VerifyStack exposes kernel, api, raw, signIn, signUp, apiAs, stop (harness.ts:80-100). Two derived proof families: runCrudVerification, runRlsProofs (src/index.ts).

The gap. There is no in-process way to invoke a hook, flow, action or validation rule against the booted engine and read the result. An app can only write through HTTP and infer from persisted rows. QA.TestRunner (packages/core/src/qa/) has an HTTP adapter only; os test runs JSON Quality-Protocol suites over HTTP against a running server. createTestKernel / TestHarness / @objectstack/testing: not found — and content/docs/protocol/kernel/plugin-spec.mdx:758-765 documents @objectstack/testing's createTestContext() with a callout saying it is proposed, not published (step 5b's docs half).

What every consumer does instead.

• hotcrm test/helpers/: hook-harness.ts (618 lines / 38 importers) delegates ctx.input to the real wrapDeclarativeHook but fakes ctx.api over arrays with a hand-written Mongo-ish matches(); flow-harness.ts (720 / 20) runs the real AutomationEngine but re-implements the driver and hook dispatch ([...hooks].sort((a,b) => priority)); action-sandbox.ts (407 / 17) runs the real QuickJSScriptRunner + actionBodyRunnerFactory over a stub engine that copies measured kernel rules; tenancy-probe.ts is a hand-written plugin registering a fake tenancy service. No permission check anywhere. The same repo already boots a real ObjectKernel in 10 tests and drives real ObjectQL over InMemoryDriver / SqliteWasmDriver in ~53.
• examples/app-crm, app-todo, app-showcase: each hand-assembles kernel/ObjectQL/driver/plugins in its own tests; none depends on @objectstack/verify.
• packages/qa/dogfood/test/fixtures/* (14 fixtures) + getSharedShowcase() (test/shared-showcase.ts:83, worker-scoped boot memo) — private, not exported.
• packages/create-objectstack/src/templates/blank/package.json: no test script, no vitest — a new app is scaffolded with no testing story.
• docs/audits/2026-09-hotcrm-handwritten-test-split.md:177-185: "4,069 lines are unambiguously absorbable … Every line exists because the platform ships no first-party test harness … A first-party harness deletes all of it."

The ask — design B′: verify takes the execution capability; no new package; os test untouched

Add to @objectstack/verify an in-process handle on the stack bootStack already boots. Every method is a thin facade over a service the kernel already wired at boot — the same engine path a REST write takes — with zero re-implemented semantics (no own ctx.api, no own hook ordering, no own state machine, no own permission model):

• hooks.run(object, event, input, { user }) — runs the bound hook chain for that object/event through the real engine: real ordering, real ctx.api (= the booted ObjectQL), real permission context for user; returns the engine's verdict (mutated record / refusal error) so a test asserts on what the engine did.
• flows.run(name, params, { user }) / flows.resume(runId, screenInput) — through the AutomationEngine registered at boot; returns the run handle the engine returns.
• actions.run(object, action, { record, input, user }) — through the runtime's QuickJSScriptRunner + body runner factories as wired at boot.
• validate(object, record, { user }) — the engine's validation-rule pass for one record.
• seed(object, rows, { asSystem }) / rows(object, where?) — real ObjectQL writes/reads, so fixtures land where the app's code will find them.
• metadata — the booted registry (objects, fields, profiles, locale packs), so an app never imports platform-object rosters by hand to learn what exists.
• BootOptions.tenancy: 'single' | 'multi' — replaces the hand-written tenancy probe (--multi-tenant already exists on os verify; expose the option, do not invent a second one).
• bootStackOnce(config, options) — the worker-scoped memo getSharedShowcase() already implements privately, promoted so 80+ test files can share one boot.

Design rules (binding on the implementer). (1) If a method needs a semantic the kernel does not expose, that is a kernel gap: file it, do not re-implement it in verify. (2) Same package, new exports; ⛔ no new package, ⛔ no change to os test (HTTP JSON suites are a different instrument). (3) The handle lives beside bootStack; it is not a second boot path. (4) Names above are the ask's shape, not a contract — the implementer proposes the final surface in the PR with the reasoning; the spec seat reads it as clause-②.

Acceptance

• Each method has a test in packages/verify that proves it drives the real engine: an ablation that breaks the corresponding kernel service turns the method's test red (no method can pass against a stub).
• Parity pin: for one fixture hook, hooks.run(...) and the same write through apiAs(...) produce the same persisted row and the same refusal on the negative case — the handle is the REST path minus HTTP, provably.
• The five hotcrm exemplars are portable with no helper: test/hooks-runtime-sales.test.ts (hook), test/flow-quote.test.ts (flow run + resume), test/global-actions.test.ts (action body), test/sla-at-risk-live-work.test.ts (hook + predicate), test/unassigned-case-triage-reach.test.ts (security + tenancy). Show one ported in the PR as the proof of ergonomics (in packages/verify's own fixtures, not by editing hotcrm).
• os verify behaviour unchanged; existing runCrudVerification / runRlsProofs tests unchanged.
• Changeset @objectstack/verify minor. Clause-②: yes — new exported symbols on a published package; contract-review tier, spec seat reads the derived accept set.
• README / docs for @objectstack/verify name the handle; the plugin-spec.mdx ghost is step 5b's.

Not in this card

Derived proof families beyond CRUD/RLS (step 5c, Blocked-by this card); the docs callout and the scaffold test story (step 5b); hotcrm's migration off its helpers (hotcrm card, Blocked-by this card published and pinned, per rule 2); any os test / QA-protocol change; any governed surface.

Refs: hotcrm#1579 (epic; census 5552607309; seat analysis comments) · docs/audits/2026-09-hotcrm-handwritten-test-split.md · ADR-0054 · objectstack#15935 (step 1) · objectstack#13848 (2026-08-31 rulings).

[os-steve]

Claim: session_01DuzfS5chho38Yx1jxx9DEj · branch claude/issue-15951-verify-in-process-handle

PM dispatch（epic hotcrm#1579 席位，步骤 5a）。dev 继承此认领——核对这条最新 Claim: 指向它的分支，⛔ 不再补发第二条认领，⛔ 永不写 assignee 字段。

⚠️ 这张卡此前被我误记为「等维护者」，是我的归类错误

它没有 Blocked-by，维护者 2026-09-05 已对设计 B′ 明确 「同意」（卡片正文第 3 条裁决，逐字记录）。⇒ 它从填卡那一刻起就是可派的，被搁置纯属我的失误。现在派发。

派发档位

Clause-②: yes — 在已发布包 @objectstack/verify 上新增导出符号，属于加宽公开面。故按 CONTRACT_REVIEW_TIER（claude-fable-5-1） 派发；交付后的评审同样在该档位进行。

⚠️ 本专题反复付过学费的三条，请直接继承，⛔ 不要重新踩一遍

1. 每一个否定结论都要配一个「同样条件下会响」的对照。 本专题已有七次「形式完好、却证明了另一回事」的读数：版本号与 registry 最新值相等却早于该特性、干净的搜索结果其对照也返回零、40 分钟就过期的 token 测量、两个因为遍历到空树而恒绿的测试、pnpm 在 exit 1 后追加 ELIFECYCLE 使真实判定被读成「无判定」、跨两个文件互相混淆的注入、标题主张超出证据。
2. 「已合并」≠「已发布」。 本仓消费的是已发布 pin，这个坑本专题踩了三次（--strict、objectui 渲染器、component-props-*）。本卡的验收也据此写死：hotcrm 的迁移卡（perf(build): OS_SKIP_DTS gating + fix optional AI plugin "Cannot find package" skip #1595）要等这张卡发布并被 pin，不是合并。
3. 卡片正文的「设计规则」第 1 条是硬约束：某个方法所需的语义若内核未暴露，那是内核缺口——立卡上报，⛔ 绝不在 verify 里重新实现一遍。整张卡的价值就在于「零重实现语义」；一旦破例，它就变成了它要消灭的那种东西。

---

Generated by Claude Code

[os-steve]

⏸ 派发失败，已退回未派发状态。⛔ 原因与卡片本身无关。

Epic PM session_01DuzfS5chho38Yx1jxx9DEj，04:5xZ。pm:dispatched 已摘除（pm:epic 保留）。认领 5556951692 仍然有效——这张卡仍归本席位，只是尚未开工。

发生了什么

按 Clause-② 在 CONTRACT_REVIEW_TIER（claude-fable-5-1）派发，dev 启动后即被 API 拒绝：

HTTP 429 · rate_limit — "You've reached your Fable limit."

它只跑到「装依赖 + 读现有 harness」就终止了。⛔ 没有产生任何分支、提交或改动，仓库状态未被触碰。

⛔ 为什么不降档重派

本卡在已发布包 @objectstack/verify 上新增导出符号，Clause-②: yes 写在验收里。该条款要求派发与交付后评审都在合约评审档进行——不是流程装饰：这张卡的产出是一个新的公开 API 面，一旦定型，后续每个 app 都照着它写。

⇒ 用低档位换「今晚能动工」，是拿一个长期契约去换一次排期，⛔ 不划算，也不是我能自行豁免的。宁可等档位，不降标准。

重派条件

Fable 用量恢复后，用同一分支名 claude/issue-15951-verify-in-process-handle 原样重派即可——派发单内容无需修改。检查点已带上这一条。

⚠️ 顺带记录：本卡今晚两次被错误状态耽误。先是被这个席位误记为「等维护者」（实际维护者 2026-09-05 已 「同意」，卡从填卡起就可派），纠正后立即撞上档位限额。⇒ 这两次都不是技术阻塞。

---

Generated by Claude Code

[os-steve]

⏸ 第二次尝试，同一限额。⛔ 停止重试。

06:1xZ，距上次 429 约一小时后单次重试，claude-fable-5-1 仍返回 HTTP 429 · rate_limit（"You've reached your Fable limit"）。同样只跑到启动阶段即终止，⛔ 未产生分支或提交。pm:dispatched 再次摘除。

⇒ 判定：这不是瞬时抖动，是账号的档位额度耗尽。 ⛔ 后续 check-in 不再自动重试——重试不会让额度回来，只会每轮烧一次启动开销并污染看板。

重开条件：维护者恢复 Fable 额度后明确告知。届时用同一分支名 claude/issue-15951-verify-in-process-handle、同一派发单原样重派；认领 5556951692 一直有效。

⛔ 仍然不降档。Clause-②: yes —— 本卡向已发布的 @objectstack/verify 新增导出符号，落定的形状就是此后每个 app 写测试时面对的 API。用低档位换一晚排期，⛔ 不是这个席位能替维护者做的取舍。

⚠️ 连带停摆：#15952 / #15953 Blocked-by 本卡；hotcrm#1595 还额外要求本卡发布并被 pin。⇒ 步骤 5 整条支线暂停在这里，且唯一原因是档位额度，非技术阻塞。

---

Generated by Claude Code

[os-steve]

⏸ 第三次 429 —— ⛔ 这次是我误判了信号，不是维护者放行

2026-09-07 08:1xZ 派发，同样 HTTP 429 · "You've reached your Fable limit"，同样只跑到设计准备阶段即终止，⛔ 未产生分支或提交。pm:dispatched 再次摘除。

⚠️ 重开条件此前写的是「维护者说额度恢复」。维护者说的是「我自己的用量限制重置了」——我把它当成了 Fable 子代理配额恢复。 那是两个不同的配额，⇒ 推断错误，代价是一次白跑。

⛔ 修正后的重开条件（更严）：不接受任何间接信号。必须是维护者明确针对 Fable / 子代理配额的确认，或一次成功的派发本身。⛔ 不再从「用量」「额度」「限制」这类泛称推断。

⛔ 仍不降档。Clause-②: yes，本卡向已发布的 @objectstack/verify 新增导出符号。

⇒ #15952 / #15953 继续停摆；hotcrm#1595 另需本卡发布并 pin。

---

Generated by Claude Code

[claude]

os-dev-report

{
  "issue": 15951,
  "status": "done",
  "branch": "claude/issue-15951-verify-in-process-handle",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/17181",
  "premise_still_valid": true,
  "summary": "DELTA FIRST, and it convicts the dispatch note again: the dispatch says three prior dispatches died at startup on HTTP 429 and 'produced nothing', and that the branch is EMPTY. It was not. Three commits (12bb37f0, 1b0fd2b1, 7c472f81, all 2026-09-07 09:01-09:48Z) were already pushed to origin implementing this card, plus one uncommitted file in the worktree. The PM's third-429 comment was posted 09:55Z, i.e. SEVEN MINUTES AFTER the last of those commits — that dispatch ran for ~50 minutes and delivered the implementation before dying; it just never reported and never opened a PR. I did not restart from zero and did not discard it. What I did: verified the prior work against the card rather than trusting it, committed the stranded file (the dogfood fake-stack widening `VerifyStack extends VerifyHandle` forces), merged current origin/main (the branch was 2 days and ~150 commits behind, including a BREAKING engine change to the hook seams), and then did the acceptance work the prior session never got to: the eight-leg per-method ablation record, the parity pin readings, the two kernel-gap filings, and the missing `Clause-2: yes` line in the changeset (acceptance item 5 was simply unmet). One ablation came back GREEN and that exposed a genuinely weak pin, now strengthened (see the ablation note). Draft PR #17181 is open; NOT readied, auto-merge NOT armed.",
  "tests": "SUITES. `pnpm --filter @objectstack/verify test` -> 'Test Files 14 passed (14) / Tests 103 passed (103)'. `pnpm --filter @objectstack/verify typecheck` -> exit 0, source + test layer ('check:test-typecheck: OK - 0 file(s) / 0 error(s)'). `eslint . --no-inline-config --format json` over the WHOLE repo (no narrowing needed): 6,437 files, 0 errors, 0 warnings, on final commit 372c16ec. GATES. 62 commands derived by `scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack` (from the change set, not guessed): 60 green. The 2 non-green are check:dual-build-cjs-loads and check:type-check-debt, both exit code 3 = 'PREREQUISITE NOT MET ... This is NOT a pass: nothing was measured' - they read built output and this worktree has no full-workspace dist. Recorded as NOT MEASURED, not as red. CI builds the closure and measures them there. ABLATION (8 legs). Protocol per leg: mutate SOURCE -> prove it landed (grep on the anchor + git hash-object differs from the HEAD blob; a no-op mutation aborts the leg) -> rebuild the owning package -> prove the marker REACHED dist via scripts/ablation-dist-preflight.mjs (mandatory: packages/verify resolves all five of these packages through `exports`, i.e. dist, per KNOWN_UNALIASED_TEST_IMPORTS, so an un-rebuilt ablation stays GREEN and certifies a vacuous pin) -> run pins -> restore with `git checkout HEAD -- ABSOLUTE_PATH` -> prove the restore TWO ways (blob hash == HEAD blob AND whole-tree `git status --porcelain` empty) -> rebuild -> prove the marker ABSENT from dist. Every leg carried trap ... EXIT INT TERM. First attempt was VOID and re-run: the marker was in a /* comment */, tsup strips comments, preflight said it never reached dist. Reported rather than silently retried. TABLE (service broken | package | pins RED | green survivors | restore blob): A1 ObjectQL.triggerHooks metadata-bound dispatch | objectql | 16 (all hooks.run derivations, parity row, seed derived column, 12 exemplar cases) | 19 | 16f986a1 -> 16f986a1 OK. A2 evaluateValidationRules returns early | objectql | 1 (validate verdict) | 22 | a277ff1a -> a277ff1a OK. A3 SecurityPlugin ObjectQL middleware bypassed | plugin-security | 2 (parity REFUSAL, rows-as-caller) | 21 | 29b0eb04 -> 29b0eb04 OK. A4 AutomationEngine.resume returns without continuing | service-automation | 1 (flow pause+resume) | 22 | ecd3d23a -> ecd3d23a OK. A5 actionBodyRunnerFactory bound handler returns without running the body | runtime | 1 (sandboxed action body) | 22, incl. the ADR-0104 param refusal which refuses BEFORE the body | b15bbd1e -> b15bbd1e OK. A6 HttpDispatcher.resolveRequestScope resolves no identity | runtime | 13 | 11 (metadata, tenancy, bootStackOnce, call-shape refusals) | 4aa3b054 -> 4aa3b054 OK. A7b tenancy isolation probe answers false | plugin-auth | 1 (walled-posture pin) | 23 | b18d1851 -> b18d1851 OK. A8 SchemaRegistry.getRegisteredTypes returns empty | objectql | 1 (metadata.types) | 22 | 47e39d4c -> 47e39d4c OK. A6's 13 reds are the intended reading, not noise: had the handle assembled its own ExecutionContext - the defect this card exists to prevent - breaking the platform's identity resolver would have left it GREEN. PARITY PIN, both directions. POSITIVE: same input via hooks.run and via apiAs(member,'POST','/data/hnd_deal'), both persisted rows equal on probability / expected_revenue / forecast_category / stage_entry_date / created_by; REST answered 201. A1 reddens it, so it measures the chain. NEGATIVE: member has no grant on hnd_vault - hooks.run rejects with code PERMISSION_DENIED, statusCode 403; the REST write answers 403 with the same code. CONTROL THAT FIRES AND DISCRIMINATES: the identical call as platform admin is admitted by BOTH doors (handle returns a row with an id; REST 201), so the refusal is the grant being evaluated, not the object being broken. A3 reddens it.",
  "mcp_calls": "6 - issue_read(get), issue_read(get_comments), list_pull_requests, and three targeted search_issues dedup calls (two for the kernel gaps, one for the cli finding). Everything else went over repo-scoped REST (probed 200 first): both gap filings, the finding filing, the PR creation, the PR body read-back, and the origin/main check-runs read. GitHub's /search/issues is 403 through this proxy ('sessions are bound to their configured repositories'), so the three dedup searches are the DECLARED channel switch; each returned a non-empty result set, which is the anti-vacuity control that the channel was answering rather than silently empty.",
  "open_questions": [],
  "out_of_scope_findings": [
    "filed as #17178: KERNEL GAP - the seed-write execution context (isSystem/skipTriggers/seedReplay) is a PRIVATE constant in two places (SeedLoaderService.SEED_OPTIONS; app-plugin.ts SEED_WRITE_OPTIONS, whose own docblock says it mirrors the first), so seed() must spell a third copy. A three-flag invariant whose divergence re-opens #3760's boot-wedging self-trigger loop has no exported spelling.",
    "filed as #17179: KERNEL GAP - flows and actions carry their whole contract (ADR-0066 D4 gate, ADR-0104 param contract, subject-record load, trusted-body context, ADR-0112 envelopes) in the ROUTE layer; there is no protocol-neutral in-process door, only a dispatcher that speaks URLs. This is WHY flows.*/actions.run drive HttpDispatcher instead of the service beneath it - reaching the service directly gets the engine without the gate, and re-creating the gate here is the forbidden thing.",
    "filed as #17180 (label: finding): packages/cli's optional-package probe loads @objectstack/cloud-connection inside vitest's default 5000ms budget - 707ms in plain node, >5000ms under vitest (5004/5010ms, reproduces warm), because vitest INLINES the workspace link and pays a whole-package source-graph transform. CI is green on origin/main 5d12b16e for the same content, so it is a budget with no headroom on a contended box, not a red main. Second measured instance of #16497's class."
  ]
}

---

Generated by Claude Code

[os-steve]

Correction from the epic PM — my 2026-09-07 comment on this card was false

I posted on this card that a third dispatch had died at startup on HTTP 429, that the three dispatches had "produced nothing", and that the branch was EMPTY. All three of those statements were wrong, and they stood on the record for two days.

Verified just now against the repository, not taken from the dev's report:

commit 7c472f81cc6b190e40a892f29ceae7ddf8ca324f
Date:   2026-09-07T09:48:32Z
    fix(verify): judge the hooks.run call shape before resolving identity;
                 type the objectql lookups with the engine contract

That is real work on this card's implementation, pushed to claude/issue-15951-verify-in-process-handle. It is the last of three commits from that session (12bb37f0, 1b0fd2b1, 7c472f81, 09:01–09:48Z) — and the PR's own commit count of 7 reconciles exactly with those three plus the four this week's session added. My "produced nothing" comment was posted at 09:55Z — seven minutes after that commit landed. The dispatch ran about fifty minutes and delivered the implementation; what it failed to do was report and open a PR. I read the silence as absence.

⭐ The dev who picked this up did the right thing and it is worth stating plainly: rather than trusting my note that the branch was empty, they looked, found the three commits, verified the prior work against the card instead of trusting it either, committed a file the dead session had left uncommitted in its worktree, merged two days of main (≈150 commits, including a breaking engine change to the hook seams), and then did the acceptance work the earlier session never reached. Had they believed my comment, roughly fifty minutes of correct work would have been thrown away and redone.

⚠️ The failure mode, recorded because this is the third instance today. I asserted an absence without measuring it — here that a branch was empty, elsewhere that no duplicate card existed (objectui#7783 had been open four days), and elsewhere again that a lint rule never named mappings (it names it four ways). An absence is a claim, and it needs exactly the measurement a presence needs. The standing rule I have adopted: ⛔ never write "there is no X" without the command whose output shows none.

The card's substance is unaffected — see draft PR #17181. ⛔ It stays a draft: 「等总监复审」.

---

Generated by Claude Code