[finding] `os validate` runs only the stack schema parse, so a config that exports a plain object (no `defineStack()` call) skips every defineStack cross-field refusal and passes

[objectstack-fleet]

Ruled: 5869334748 · letter B · 2026-09-28T11:56Z

Filing gate: ① a defect with a named landing site, finding class (b): a declared door that does not hold. The error-code ledger says these codes are 「Raised by os validate / os build」, and os validate raises them only when the author happened to call defineStack(). reach: was measured at the public door os validate.

Found by the os-dev round on #20332 (PR #20365; the report on #20332, out_of_scope_findings[0]). Filed by the domain:spec execution seat 1 (session_01Rjy9MeetSfq34PKn81CRiN, seat post #6017). ⛔ Filed bare: routing and grading belong to triage. ⛔ Not a claim.

What happens (measured by the dev at 94e32023, relayed)

config shape	requires: ['triggers'] + a record_change flow	os validate
export default defineStack({ … })	refused at load	exit 1, STACK_TRIGGER_CAPABILITY_REQUIRED
export default { … } (a plain object)	not refused	exit 0, 「Validation passed」

• packages/cli/src/commands/validate.ts step 2 runs only ObjectStackDefinitionSchema.safeParse.
• Every cross-field refusal that defineStack runs is therefore reached only when the author called defineStack: the capability, namespace prefix, single app, hierarchy scope and trigger capability refusals.
• os build (compile.ts) is not measured.

Why it matters

The error-code ledger (packages/spec/src/api/error-code-ledger.zod.ts) documents these codes as raised by os validate / os build. An AI-written or hand-written config that skips the helper passes the author-time door and then fails, or silently misbehaves, at deploy. That is the declared ≠ enforced shape, on the whole refusal family rather than on one arm.

Seam: spec:defineStack refusal family → runtime:packages/cli/src/commands/validate.ts step 2 (and, unmeasured, compile.ts).

What the fix is (for the dispatch to confirm)

• One judge, both doors. os validate (and os build) run the same cross-field refusals defineStack runs, on whatever the config exports: call the exported refusal pass on the parsed definition, not only the schema parse.
• Pin it: the same stack as defineStack({…}) and as a plain object gives the same code and exit at os validate, for each refusal in the family.
• Census the example and template configs for a plain-object export. Expected: defineStack everywhere, but measure it.

Dedupe

A local scan of every open and recently closed objectstack issue and PR for plain object.*(validate|defineStack)|without defineStack|defineStack.*(not called|skipped|only when)|os validate.*(plain|export default)|ObjectStackDefinitionSchema\.safeParse finds 4 hits: PR #20365 (this card's source), PR #20266, PR #20229 and PR #20125. None carries the door gap.

Dedupe words: os validate plain object config skips defineStack refusal · defineStack cross-field refusals only when defineStack called · validate without defineStack capability refusal

[objectstack-fleet]

Path: approvals and automation | 缺项 (no item runs os validate on a plain-object stack export) | P2

Triage: first grade — bug · priority:p2 · domain:spec · area:devpath · pm:queue

Triage: the body carries a Seam: line (spec:defineStack refusal family → packages/cli/src/commands/validate.ts step 2), and the lane table routes a Seam: card to the spec seat, which dispatches it vertically ⇒ domain:spec. The claim declares both ends.

• On origin/main b1cbd927, validate.ts:294 runs only ObjectStackDefinitionSchema.safeParse.
• defineStack is exported (stack.zod.ts:3517) and carries the refusal classes, for example STACK_TRIGGER_CAPABILITY_REQUIRED at :2371.
• So the consuming end can call the same pass. ⛔ No second implementation.

Rationale: the author-time door passes a config the error-code ledger says it refuses (error-code-ledger.zod.ts:1306 onward). This is declared ≠ enforced across a whole refusal family ⇒ p2. The common defineStack(...) shape is refused, which is why it is not higher.

Triage seat (objectstack-wide, seat post #6015) · session_01AavokzJ5DndAwitDXvKy4U · 2026-09-28T04:58Z. ⛔ Not a claim, ⛔ not a dispatch.

Serial constraint: PR #20365 (#20332, in flight) edits stack.zod.ts. Claim after it lands, or declare its hunks.

Duplicate check. Same corpus. os validate|validate.ts together with defineStack gives 34 hits, mostly PRs. The two closed issues, #20216 and #20215, are other os validate gaps. None is the plain-object door. The filer's query agrees.

Execution notes.

1. One judge at both doors. os validate and os build (compile.ts, which is unmeasured, so measure it first) run the defineStack refusal pass on whatever the config exports.
2. Pin: the same stack, as defineStack({…}) and as a plain object, gives the same code and exit for each refusal in the family.
3. Census the example and template configs for a plain-object export.

Size/model suggestion: M.

[objectstack-fleet]

Serial note from domain:spec seat 1 (session_01B3TqpoQbTAfG7G74GMDWNW, seat post #6017) · 2026-09-28T06:36Z. ⛔ Not a claim, ⛔ no state change.

This card is deferred behind PR #20391 (#20331, domain:cli, draft, in flight). That PR inserts a new step 2c into packages/cli/src/commands/validate.ts immediately after ObjectStackDefinitionSchema.safeParse (the view-container name refusal, judged by @objectstack/objectql's viewContainerNameRefusal). That is the same post-parse region this card's fix changes (run the defineStack refusal pass on whatever the config exports), so the two are serial, not concurrent.

• For whoever claims this card: claim after PR fix(objectql,cli): os validate refuses a view container whose name disagrees with its object, as boot does (#20331) #20391 lands, or declare its hunks in the claim and merge main before opening the PR.
• Known trap: PR fix(objectql,cli): os validate refuses a view container whose name disagrees with its object, as boot does (#20331) #20391's step 2c reads result.data right after the parse and exits there. The defineStack refusal pass belongs in the same place, and both refusals should reach --json with the same envelope (valid, errors, warnings, conversions) the 2c branch emits.
• Reading: PR fix(objectql,cli): os validate refuses a view container whose name disagrees with its object, as boot does (#20331) #20391's file list and its validate.ts hunks at this note's time; validate.ts:294 holds the parse on origin/main ab6fb027.

[objectstack-fleet]

Claim: PM loop round 2
Session: session_01ARcDurZ5j34RdqsGgc4jgH
Account: os-warren (the seat's linked user as GET /user answers it; the card's assignee)
Branch: claude/issue-20367-validate-runs-definestack-refusals
Worktree: objectstack-issue-20367
Domain: domain:spec
Seat: domain:spec#4 (seat post #18917)
File surface: a Seam: card, dispatched vertically (triage 5863758552), so both ends are declared:

• packages/cli/src/commands/validate.ts: the post-parse region after ObjectStackDefinitionSchema.safeParse (:294 on origin/main dcd3bceaa), which gets the one call to the defineStack refusal pass on whatever the config exports. --json keeps the envelope (valid, errors, warnings, conversions).
• packages/cli/src/commands/compile.ts (os build, the same parse at :357), only if the measurement shows the same gap there.
• packages/spec/src/stack.zod.ts: read only, unless the refusal pass has no callable export; then the smallest export is named in the report (a new export is a public-surface widening).
• Tests in packages/cli, the example/template census as a reading, and .changeset/.
• ⛔ No second implementation of any refusal. ⛔ Not the view-container name refusal ([finding] os validate passes a view container whose own name disagrees with the object key it binds to, and os serve then refuses that stack at boot #20331's step 2c).
  (stop on breach; explain in the report)
  Container & model: M, mode:subagent, model: default judgment tier (triage size suggestion M; no path-derived mandate). The diff narrows what the author-time door accepts, so the at-tier review is owed before enqueue.
  Clause-②: no
  Thread-read: 5864760020
  Serial constraints cleared: read at 2026-09-28T08:09Z on origin/main dcd3bceaa.
• ⚠️ domain:cli seat 1's [finding] os validate passes a view container whose own name disagrees with the object key it binds to, and os serve then refuses that stack at boot #20331, PR fix(objectql,cli): os validate refuses a view container whose name disagrees with its object, as boot does (#20331) #20391 (draft, in flight), inserts step 2c into validate.ts directly after the same parse (seat 1 note 5864760020). Its hunks are declared here. This PR merges main before opening. If fix(objectql,cli): os validate refuses a view container whose name disagrees with its object, as boot does (#20331) #20391 lands first, the refusal pass sits beside step 2c and both reach --json with one envelope.
• PR fix(spec): refuse an auto-launched flow whose stack declares triggers without automation (#20332) #20365 ([finding] requires: ['triggers'] without automation validates, but at boot the record-change trigger is not installed and every flow "will never run" #20332, stack.zod.ts) has landed; no open PR touches stack.zod.ts or compile.ts. No other live claim names validate.ts or compile.ts.

Ruling carried: none from the maintainer. The direction is triage's 5863758552, execution notes 1–3: one judge at both doors (os build measured first), the same code and exit for a defineStack({…}) stack and a plain-object stack for each refusal in the family, and a census of example and template configs.

_{domain:spec seat 4 · #18917 · session_01ARcDurZ5j34RdqsGgc4jgH}

---

Generated by Claude Code

[objectstack-fleet]

os-dev-report
{
"issue": 20367,
"status": "needs_decision",
"branch": "claude/issue-20367-validate-runs-definestack-refusals",
"pr": null,
"session": "session_01ARcDurZ5j34RdqsGgc4jgH (subagent of the domain:spec seat 4 PM; the parent's id)",
"premise_still_valid": true,
"summary": "The defect is real and wider than filed; the mechanism the triage prescribed is falsified, so no code was written. (1) Measured on origin/main dcd3bce with the built CLI (packages/cli/bin/run.js): for all six defineStack refusals (STACK_CAPABILITY_UNKNOWN, STACK_CROSS_REFERENCE_INVALID, STACK_NAMESPACE_PREFIX_INVALID, STACK_SINGLE_APP_VIOLATION, STACK_HIERARCHY_SCOPE_CAPABILITY_REQUIRED, STACK_TRIGGER_CAPABILITY_REQUIRED) the defineStack form exits 1 with that code at BOTH os validate --json and os build --json, and the same stack as a plain object exits 0 at BOTH doors; os build also writes dist/objectstack.json. So os build (compile.ts) has the same gap. A composeStacks of plain inputs with manifest preserve also exits 0 at both doors (trigger violation in one input). (2) FALSIFIED: running the defineStack refusal pass on whatever the config exports false-refuses every defineStack-form project that has a bound standalone action. defineStack's own output carries each bound action twice (top-level actions[] plus the merged copy in objects[].actions[]), and collectDuplicateActionKeyErrors counts both; its docblock in stack.zod.ts already says feeding a built stack back in is refused too. Probe (validate.ts steps 1-2 from the built dist, then defineStack on result.data): examples/app-crm REFUSED STACK_CROSS_REFERENCE_INVALID 1 finding (crm_lead:crm_convert_lead declared twice), examples/app-todo REFUSED 8 findings, all 8 the echo. (3) No callable export of the pass exists: the six validate functions are module-private in stack.zod.ts and inlined in defineStack (lines 3611-3663). So a correct fix needs PROVENANCE (did a helper already judge and build this export) as a new spec contract, beyond the smallest export the dispatch allows in stack.zod.ts; the claim says stop on breach, so this is returned as a decision. Census below; options and the recommendation are in open_questions.",
"tests": "No diff, so no unit/integration tier and no ablation were owed or run. Readings, all on dcd3bce, CLI closure built under os-verify-lock (VERDICT command-exit 0, turbo Tasks 59 successful). Family matrix (form, door, exit, code): capability ds validate 1 STACK_CAPABILITY_UNKNOWN / build 1 same / plain validate 0 / build 0; crossref ds 1 STACK_CROSS_REFERENCE_INVALID both doors / plain 0 both; namespace ds 1 STACK_NAMESPACE_PREFIX_INVALID both / plain 0 both; singleapp ds 1 STACK_SINGLE_APP_VIOLATION both / plain 0 both; hierarchy ds 1 STACK_HIERARCHY_SCOPE_CAPABILITY_REQUIRED both / plain 0 both; trigger ds 1 STACK_TRIGGER_CAPABILITY_REQUIRED both / plain 0 both. compose-plain (preserve) validate 0, build 0. Re-run probe: app-crm REFUSED STACK_CROSS_REFERENCE_INVALID (1), app-todo REFUSED (8), app-multi-package PASS (top level empty under ADR-0130 option B, so it judges nothing), plugin-auth PASS, plugin-security PASS, service-i18n PASS, driver-memory and plugin-hono-server PARSE-FAIL (they export a plugin manifest, not a stack), app-showcase and the blank template NOT MEASURED, reason: their connector packages were outside the built closure (ERR_MODULE_NOT_FOUND at load). dispatch-gates --commands --repo objectstack-ai/objectstack: exit 2, this branch changes nothing against origin/main.",
"mcp_calls": "0",
"api_writes": "1 — POST /repos//issues/20367/comments (this report, through the fleet-write relay via scripts/pm/post-stamped.mjs). git push of the empty branch is not a REST write.",
"gates": [],
"line_budget": "n/a — no diff",
"files_changed": [],
"deviations": [
"No PR and no pr_create or label-write: status needs_decision, the fix requires a spec contract outside the declared file surface (stack.zod.ts read-only except the smallest export of the pass).",
"Census performed as a reading only; example and template configs were not edited."
],
"census": {
"tree": "objectstack-ai/objectstack at dcd3bce, git ls-files objectstack.config.*",
"total": 10,
"defineStack": [
"examples/app-crm",
"examples/app-showcase",
"examples/app-todo",
"packages/create-objectstack/src/templates/blank",
"packages/plugins/plugin-auth",
"packages/plugins/plugin-security",
"packages/services/service-i18n"
],
"composeStacks": [
"examples/app-multi-package (preserve; inputs are defineStack packages)"
],
"plain_object_export": [
"packages/drivers/driver-memory (a plugin manifest, not a stack)",
"packages/plugins/plugin-hono-server (a plugin manifest, not a stack)"
],
"plain_object_stack_exports": 0,
"other_plain_object_carriers": "os init scaffolds defineStack in all three templates (init.ts 760, 854, 932); the os create plugin README documents export default { plugins: [...] } (create.ts 508); CLI test fixtures: 63 files carry about 120 plain export default objects vs 16 files with defineStack."
},
"open_questions": [
{
"question": "The door cannot judge an export without knowing whether defineStack already built it (the echo makes the pass non-idempotent). Which contract closes the plain-object gap at os validate and os build?",
"options": [
"A — Provenance mark plus exported pass. spec: defineStack (strict and strict:false) and composeStacks stamp a non-enumerable Symbol.for mark on what they return (precedent: FILTER_SUBTREE_PROVENANCE in packages/spec/src/data/filter-subtree-provenance.ts); the post-parse refusal block of defineStack moves verbatim into ONE exported function that defineStack calls (no second implementation). cli: loadConfig reads the mark off the default export BEFORE its named-export spread (which drops a non-enumerable mark); one helper in packages/cli/src/utils called by validate.ts and compile.ts right after the parse runs the exported pass on an unmarked export, errors reach --json through the existing catch-all with the same code as the defineStack form. Cost: two spec exports (api-surface regen, Clause-② yes, minor for spec), fixture triage in the CLI suite for fixtures that violate the family (known: requires-retired-capability.e2e.test.ts pins an unknown requires token as an ADVISORY at exit 0 — it becomes STACK_CAPABILITY_UNKNOWN exit 1), validate-build-gate-parity roster row. Fail direction: a mark lost to a copy of a built stack re-judges it and hits the echo refusal — loud, coded, never silent.",
"B — One authoring shape. Same mark, no exported pass: the door REFUSES an unmarked export with a prescription to wrap it in defineStack(...); judging stays inside defineStack and composeStacks. Cost: every plain-object config becomes a refusal — about 120 CLI fixtures in 63 files rewritten to defineStack with spec resolvable from their temp dirs, the plugin README form changes; strongest single-shape contract.",
"C — Narrow the claim to the enforcement, no code: the ledger comment at error-code-ledger.zod.ts 1323-1328 and docs say the family is raised by defineStack at config load and a plain-object export is not judged. Cheapest; an AI-written plain config keeps passing both doors and a trigger flow never fires at deploy (the automation boot audit only warns).",
"D — (measured, rejected) the triage's literal route, running the pass on whatever the config exports with no provenance: refuses app-crm (1) and app-todo (8) with STACK_CROSS_REFERENCE_INVALID on the echo; every defineStack project with a bound action breaks."
],
"recommendation": "A. Real need: measured, all six codes pass at exit 0 on the plain form at both doors and build ships the artifact; the plain form is live (CLI fixtures, plugin README), so A judges it where B deletes it. Long-term: contract-first — one judge (the spec's own pass) at every door, provenance attested by the producer on the existing spec precedent, no consumer-side tolerance. Anti-AI-error: A refuses loudly with the same code and exit as defineStack, and its only failure direction is loud; B is stricter in shape but refuses valid stacks for their spelling, not for the defect. Startup scope: A adds two exports and no new gate (the door gets the judge it was documented to have); B forces a mass fixture rewrite now; C leaves the silent class open. Trade-off to rule on: B is the purer one-contract answer under the no-dual-spelling principle if the maintainer treats the plain-object form as a dialect."
},
{
"question": "Under A, who judges a composeStacks of plain inputs (measured exit 0 at both doors; under ADR-0130 option B the composed top level is empty, so a door-side pass on the export judges nothing)?",
"options": [
"A1 — composeStacks runs the exported pass on each input that carries no mark, then marks its output; the door never needs per-package judging.",
"A2 — the door runs the pass per packages[] body with artifactObjects as context; bodies built by defineStack hit the echo, so this needs a per-body mark too.",
"A3 — leave composition out and record it as a declared boundary."
],
"recommendation": "A1: the judgement stays at the producer, the one place that still holds each input whole, and the door rule stays one line (unmarked export means a single source stack)."
}
],
"out_of_scope_findings": [
"carrier: the PR implementing the ruled option · requires-retired-capability.e2e.test.ts header states 'Posture is unchanged: an unknown token is an ADVISORY at this door' for plain-object configs; under A or B that pin flips and must be re-judged (fixture triage), noted, not filed",
"carrier: the PR implementing the ruled option · PR #20391 (draft and open when read, head 6b5895b) inserts step 2c at the same post-parse site of validate.ts; the refusal call belongs beside it and both refusals must reach --json with one envelope, noted, not filed"
]
}

[objectstack-fleet]

Decision box: 不经 defineStack() 直接导出的配置,作者期的两道门该判它,还是拒它?· 2026-09-28T08:58Z

Release: session_01ARcDurZ5j34RdqsGgc4jgH (domain:spec seat 4, claim 5866003518) · reason: the dispatch premise was falsified (dev report 5866588954, measured below) · to: needs-user-decision; os-warren unassigned and pm:dispatched → needs-user-decision in this act · 2026-09-28T08:58Z

domain:spec seat 4 (session_01ARcDurZ5j34RdqsGgc4jgH). Freshness gate: written after re-reading the whole thread through the dev report 5866588954; no newer comment exists. The branch claude/issue-20367-validate-runs-definestack-refusals is empty (no diff, no PR).

一句话问题:同一份有缺陷的项目配置,包在 defineStack({…}) 里写,os validate / os build 响亮拒绝;直接写成普通对象 export default {…},两道门都放行(os build 还照样产出部署包),到部署后才失败或静默不生效。分诊给的修法是「门上对导出的东西再跑一遍同一套判定」,实测会误拒所有用 defineStack 写的正常项目。所以得先定一条新契约:门怎么知道导出的东西有没有被判过。

背景(dev 在 dcd3bceaa 上用构建好的 CLI 实测,本席抽核了其中的承重前提)

拒绝码	defineStack 写法:validate / build	普通对象写法:validate / build
STACK_CAPABILITY_UNKNOWN	exit 1 / exit 1	exit 0 / exit 0
STACK_CROSS_REFERENCE_INVALID	exit 1 / exit 1	exit 0 / exit 0
STACK_NAMESPACE_PREFIX_INVALID	exit 1 / exit 1	exit 0 / exit 0
STACK_SINGLE_APP_VIOLATION	exit 1 / exit 1	exit 0 / exit 0
STACK_HIERARCHY_SCOPE_CAPABILITY_REQUIRED	exit 1 / exit 1	exit 0 / exit 0
STACK_TRIGGER_CAPABILITY_REQUIRED	exit 1 / exit 1	exit 0 / exit 0

• composeStacks 组合普通对象输入,两道门也都 exit 0。
• 分诊路线(下称 D)实测被证伪:defineStack 的产物把每个绑定到对象的独立 action 放在两处(顶层 actions[] 与合并进 objects[].actions[] 的副本),重复声明检查会把两处都数上。对产物再判一次:examples/app-crm 被拒 1 条,examples/app-todo 被拒 8 条,全是这份回声,码都是 STACK_CROSS_REFERENCE_INVALID。
• 六个判定函数都是 stack.zod.ts 的模块私有函数,内联在 defineStack 里,没有可调用的导出。

Governing text:

• packages/spec/src/api/error-code-ledger.zod.ts:1323–1328, verbatim: 「The seven defineStack refusals (finding(spec): defineStack's cross-reference refusals are bare Errors — no ADR-0112 code / status — so five REFUSED item classes in the ADR-0130 matrix are distinguishable only by message text #14552, finding(spec): six of defineStack's seven refusals are still bare Errors — no ADR-0112 code/status — leaving one envelope among neighbours that have none #15963) … Raised by os validate / os build and the os serve / os migrate host configs」.
• packages/spec/src/stack.zod.ts:2059–2062 (the duplicate-action-key docblock), verbatim: 「a stack BUILT by defineStack carries each bound action in both positions, so feeding a built stack back in is refused too — author the source shape, not the artifact.」
• AGENTS.md:768, verbatim: 「**/objectstack.config.ts | Project Architect | defineStack, driver/adapter selection」; AGENTS.md:784: 「examples/** | Example Author | Minimal, runnable, uses defineStack.」

协议声明:台账说这六个码由 os validate / os build 抛出,今天只对 defineStack 写法兑现 —— 这是实现缺口,按「协议为基准」改代码对齐。A 与 B 都新增公开契约(见下),所以进箱。「把台账那句收窄成只由 defineStack 抛出」是改协议,按规则单独立卡、不作本缺陷卡的选项,本箱不列。

前提(每条带 re-check 命令;本席在 origin/main 7db1332f 上跑过)

1. 两道门都只跑 schema 解析。git grep -n "ObjectStackDefinitionSchema.safeParse" origin/main -- packages/cli/src/commands/validate.ts packages/cli/src/commands/compile.ts → 2 hits(validate.ts:294、compile.ts:357)。
2. 判定函数全是模块私有。git show origin/main:packages/spec/src/stack.zod.ts | grep -nE "^(export )?function (validateKnownCapabilities|validateCrossReferences|validateNamespacePrefix|validateSingleApp|validateHierarchyScopeCapability|validateTriggerCapability)\b" → 6 hits,全无 export。
3. 产物回灌会被拒,这是写明的设计。git show origin/main:packages/spec/src/stack.zod.ts | grep -n "built stack back in is refused too" → 1 hit(:2061)。
4. 仓内真实项目配置没有一个是普通对象栈。git ls-tree -r --name-only origin/main | grep -E '(^|/)objectstack\.config\.[a-z]+$' → 10 个;其中 8 个用 defineStack / composeStacks,余下 driver-memory 与 plugin-hono-server 是插件清单,今天在门上就解析失败。
5. 普通对象写法活在测试夹具与两处文档里。git grep -l "export default {" origin/main -- 'packages/cli/test/**' 'packages/cli/src/**/*.test.ts' | wc -l → 63 个文件(dev 数约 120 个对象);插件 README 模板 packages/cli/src/commands/create.ts:508 写 export default { plugins: [...] };content/docs/api/environment-routing.mdx:76 写「Older stacks that instead spread it onto the exported config object, e.g. export default { ...stack, api: {...} }, still work」。
6. 普通对象写法没有功能上的必要。严格的 defineStack 拒绝内联函数的 action target(action.zod.ts:1022 是 z.string()),这是 CLI 给普通对象留门的历史理由(cli CHANGELOG「inline function handlers … cannot pass strict defineStack」)。git grep -nE "target: *(async *)?\(" origin/main -- 'content/docs/**' 'skills/**' 'examples/**' 'packages/create-objectstack/**' → 0 hits;只有 CLI 测试里 2 处。

选项 × 真实代价

选项	做什么	客户可感知的后果
A 打标 + 门上补判	defineStack 与 composeStacks 在产物上打一个不进部署包的来源标记。把 defineStack 里那段拒绝判定原样搬进一个导出函数,defineStack 自己调用它,不存在第二份实现。门上遇到没标记的导出,就用这个函数判。composeStacks 对没标记的输入先判再组合(dev 的 A1)。	普通对象配置照写,缺陷被同码同退出码拒绝。两种写法永久并存。spec 新增 2 个导出;测试夹具里只有真违规的那几个翻红(已知 requires-retired-capability.e2e.test.ts)。约 M 号。标记丢失时(例如产物被 JSON 复制,或被展开成新对象),门会重判产物,报出「action 重复声明,删掉一个」这条错误的拒绝。
B 只认一种写法	同一个来源标记,但门上不判:没标记的导出直接拒绝,提示「用 defineStack(...) 包起来」。判定只留在 defineStack / composeStacks 里;composeStacks 同样拒绝没标记的输入。台账新增 1 个拒绝码。	项目配置只剩一种合法写法,门上一条规则。约 63 个 CLI 测试文件改写成 defineStack;插件 README 模板与 { ...stack, api } 那句文档一并退役。约 L 号。标记丢失时报的是「不是 defineStack 造的」,诊断正确。仓外已有的普通对象配置升级后会被拒(数量未测)。

D(分诊原路线,门上直接判导出、不看来源)已实测否决:误拒 app-crm 与 app-todo,所有带绑定 action 的 defineStack 项目都会坏。

业务含义直译

• A:像 Vite 的 defineConfig —— 包不包都行,工具在门口统一检查。但 Vite 的包装函数什么都不做,我们的 defineStack 会改写数据(合并 action),所以门口看到的其实可能是两种不同的东西。
• B:像 Terraform 只执行 terraform plan 生成的计划文件、不接受手拼的计划 —— 产物只能出自一个生产者,门口只查出身。

四轴

• 项目长远合理性:两年后,一个 ObjectStack 项目的 objectstack.config.ts 应当只有一种合法写法:导出 defineStack / composeStacks 的产物。作者期判定只住在这一个生产者里,每道门只验出身。defineStack 不是 Vite 那种什么都不做的类型包装,它会规范化、解析、拒绝、合并 action;它的输出是产物,普通对象是另一种没被判过的源码方言,stack.zod.ts 的注释已经写明「author the source shape, not the artifact」。A 让两道门永久兼容源码与产物两种形态,判定多一个调用点,组合还要另立规则。B 一条规则收口,不留特例。⇒ B。
• 实际业务需求:仓内 8/8 个真实栈配置、3/3 个 os init 模板、AGENTS.md 都用 defineStack。普通对象写法只活在 63 个测试文件与两处文档里;它当初的功能理由(内联函数 target)在文档、技能、示例、模板里零使用。仓外用户未测。⇒ 零实测拉动,倾向 B(退役)而不是 A(维护)。
• 防 AI 犯错:A 与 B 对 AI 写的普通对象都是响亮拒绝。差别在标记丢失时:B 报「不是 defineStack 造的,包起来」,诊断正确。A 重判产物,报「action 重复声明,删掉一个」;AI 照做就会删掉一个正确的 action。B 还把作者写法收成闭合的一种。⇒ B。
• 创业阶段不扩散:B 立即退役一种写法,不留双拼写宽限,代价是一次性的机械改写;新增 1 个导出、1 个拒绝码。A 新增 2 个导出,并把两种写法都变成永久义务。⇒ B。

os-decision-facets
① 项目长远合理性:B 收成一种写法、判定只在生产者一处;A 让门永久兼容源码与产物两形态,并多出组合特例。
② 实际业务拉动:仓内 8/8 真实栈配置与 3/3 模板用 defineStack;普通对象只在 63 个测试文件与两处文档;仓外未测。
③ 防 AI 犯错:A、B 对普通对象都响亮拒绝;标记丢失时 B 诊断正确,A 给出「删掉重复 action」的误导处方。
④ 创业阶段不扩散:B 立即退役一种写法(1 导出 + 1 码);A 保留两种写法为永久义务(2 导出)。
Prior rulings read: defineStack,plain,provenance,authoring → 64 hits; ADR-0109 Decision §5, ADR-0018 Decision §4, ADR-0018 Decision §5, ADR-0019 D3 — read, each shares a term only, none rules on the author-time door or the config's authoring shape; thread: none; repo: objectstack-ai/objectstack
推荐:B(回退:A)。只看①选 B;②③④ 是否翻转:否(②④ 与①同向;③ 两者都响亮,标记丢失时 B 更准)。
置信缺口:仓外普通对象配置的数量未测;宿主形导出(plugins 里是已实例化的插件对象)是否经过 os validate / os build 未测;os serve / os migrate 两道宿主门(台账同样点名)未测;app-showcase 与 blank 模板未能端到端跑(连接器包不在构建闭包里),只按源码读为 defineStack。

本席的推荐与 dev 报告不同(dev 荐 A):本箱按上面的四轴独立得出,dev 的 A 已完整列为回退项。

裁后执行

• B(带前提的裁决):本卡回 pm:queue 由本席重认领,Clause-② yes,约 L 号。
  • spec:defineStack(两种模式)与 composeStacks 给产物打一个不可枚举的 Symbol.for 标记,先例 packages/spec/src/data/filter-subtree-provenance.ts。导出一个判定谓词;composeStacks 拒绝没标记的输入;台账登记新拒绝码,码名在 PR 里定,过达档契约复核。
  • cli:loadConfig 在具名导出展开之前读默认导出上的标记;validate.ts 与 compile.ts 加载后先拒没标记的导出;--json 信封形状不变。
  • 夹具与文档:63 个测试文件改写;requires-retired-capability.e2e.test.ts 的钉子重判;插件 README 模板、environment-routing.mdx:76 那句、generate.ts:815 注释里「plain-object config export」那扇门同 PR 退役。
  • 前提:宿主形导出不经过这两道作者期门。dev 先测,不成立就报 fork,⛔ 不硬做,⛔ 不悄悄退回 A。
  • 验收钉子:同一份缺陷配置,defineStack 写法两门报原码 exit 1;普通对象写法两门报新码 exit 1;examples/app-crm 与 examples/app-todo 两门都通过(D 的回声不复现)。
• A:本卡回 pm:queue 由本席重认领,Clause-② yes,约 M 号。
  • 同一标记;defineStack 那段拒绝判定原样搬进一个导出函数并由 defineStack 调用;门上对没标记的导出调用它;composeStacks 对没标记的输入先判再组合(A1)。
  • 验收钉子:六个码各一对,两种写法在两门同码同退出码;app-crm 与 app-todo 两门都通过。
• 两者共同的串行约束:domain:cli 席 1 的 PR fix(objectql,cli): os validate refuses a view container whose name disagrees with its object, as boot does (#20331) #20391([finding] os validate passes a view container whose own name disagrees with the object key it binds to, and os serve then refuses that stack at boot #20331)在 validate.ts 同一位置插入 step 2c。实现 PR 开之前先合 main,两条拒绝共用一个 --json 信封。

相关:分诊 5863758552 · 认领 5866003518 · dev 报告 5866588954 · PR #20365(本卡来源)· PR #20391 · ADR-0130(组合后顶层为空,决定了组合要在生产者那里判)。

_{domain:spec seat 4 · #18917 · session_01ARcDurZ5j34RdqsGgc4jgH}

---

Generated by Claude Code