QA run · surface:api (89/89) · 251a7dd4 · 2026-10-04 · 68 PASS / 7 PARTIAL / 14 FAIL / 0 BLOCKED / 0 NOT-RUN #21720

Activity

1. objectstack-fleet

   added

   qa-run

   on Oct 4, 2026
2. objectstack-fleet commented on Oct 4, 2026

   

   objectstack-fleetbot

   on Oct 4, 2026

   ContributorAuthor

   More actions

   Close-out

   Every fail has a disposition re-derived by an independent verifier (RUNNER rule 7):

   Extracted: #21057 · access-security.crud-permission-matrix · acceptance[0]
   Extracted: #21723 · api-backend.rest-metadata-config-contract · acceptance[3]
   Extracted: #21724 · automation.trigger-status-contract · acceptance[4]
   Extracted: #21727 · platform-core.manifest-install-contract · acceptance[1]
   Extracted: #21728 · platform-core.marketplace-install-local-lifecycle · acceptance[4]
   Extracted: #21725 · automation.trigger-status-contract · outside the item's clauses
   Extracted: #21726 · access-security.sharing-rules-widen · outside the item's clauses
   Extracted: #21729 · attachments-storage.attach-requires-parent-edit · outside the item's clauses
   Extracted: #21730 · attachments-storage.field-accept-maxsize-server-enforced · outside the item's clauses
   Extracted: #21731 · identity-auth.two-factor-enrollment-reveal · outside the item's clauses
   Parked-on: #21735 · access-security.share-link-capability-tokens · acceptance[4]
   Parked-on: #21735 · ai.agent-tool-skill-metadata-roundtrip · acceptance[3]
   Parked-on: #21735 · api-backend.batch-transactional-discovery · acceptance[4]
   Parked-on: #21735 · api-backend.server-timing-admin-gated · acceptance[1]
   Parked-on: #21735 · identity-auth.two-factor-enrollment-reveal · acceptance[5]
   Parked-on: #21735 · identity-auth.two-factor-backup-codes · acceptance[5]
   Parked-on: #21735 · integration-system.external-schema-introspection · acceptance[0]
   Parked-on: #21735 · platform-core.activation-ledger-registration-home · acceptance[4]
   Parked-on: #21735 · platform-core.marketplace-install-local-lifecycle · acceptance[6]
   Parked-on: #21735 · records-forms.field-unique-enforcement · acceptance[0]
   

   Product defects

   card	from	severity (verifier)	note
   #21057 (existing)	crud-permission-matrix A1	P2, fails closed	still reproduces at 251a7dd4
   #21723	rest-metadata-config-contract A4	P1 / medium, authorization	detail withheld pending maintainer (RUNNER rule 2)
   #21724	trigger-status-contract A5–A7	P2	resume refusals lose their engine codes
   #21725	found in trigger-status / approver-matrix recipes	P2	an active PUT /meta/flow save is not armed until restart
   #21726	found in sharing-rules-widen	P3, diagnostic	explain credits sharing for a depth grant
   #21727	manifest-install-contract A2	P2	protocol refusal: 500, diagnostic dropped
   #21728	marketplace-install-local-lifecycle A5	P2	purge-sample-data never works; seed rows carry no id
   #21729	found in attach-requires-parent-edit	P2, fails closed	parent editor cannot delete another's attachment
   #21730	field-accept-maxsize knownGap	P3	FileConstraintError → 500
   #21731	found in two-factor-enrollment-reveal	low	TOTP issuer "Better Auth"

   None is a 17.7 regression: every defect above reproduces against code unchanged since 17.6.0 or earlier.

   Candidate observations — not verified, not extracted

   Seen once by a runner, low severity or possibly by design; listed so they are not lost:

   • POST /automation/{flow}/runs/{id}/resume silently drops variables when inputs is also sent (inputs ?? variables).
   • GET /meta/flow/{packaged flow}?layers=true reports lock:'none', editable:true, deletable:true while every write door answers 403 (also seen in the 17.6.0 run).
   • POST /sharing/rules naming a package-seeded rule creates a second, org-stamped row of the same name.
   • An authoring refusal (422 INVALID_METADATA) is logged as [REST] Unhandled error with a full stack.
   • updateMany / deleteMany answer per-row PERMISSION_DENIED for an invisible id vs RECORD_NOT_FOUND for a nonexistent one (an existence signal for ids the caller already holds; nothing mutated or read).
   • An unevaluable warning-severity validation rule logs "… — write rejected." while the write lands 201 (rule-validator.ts reuses the error message).
   • A seed saved straight to active (PUT /meta/seed/{n} without mode=draft) writes no rows; rows go live only through publish.
   • Approvals: remind on a request with two slots for the same person mints two token pairs but the deduped notification carries one; reassign accepts a nonexistent to id.
   • POST /datasources/test creates the SQLite file it probes; two-factor/disable revokes the bearer session that called it; get-totp-uri re-reveals the enrolled secret with the password (conflicts with the dialog's "shown only once" copy).
   • Runtime api saves through the OS_METADATA_WRITABLE=api hatch answer "Saved … state=active" with no warning that the endpoint is not served (by design per api 注册表条目声明 allowRuntimeCreate: true,但运行时创建的端点匹配器永远看不见 —— 声明的能力运行时不兑现(真实 boot 实测) #5488; UX only).

   Checklist-accuracy findings (no fail attached; for the checklist owner)

   1. access-security: sharing-rules-widen step 7 — sys_record_share is read-only (405); edit the seeded rule via POST /sharing/rules; the position variant cannot discriminate (manager reads contacts at org depth); the unit_and_subordinates audience is decided by sys_business_unit_member. write-path-guards step 5 — createMany takes a bare array; step 7 needs options.continueOnError. suggested-binding knownGaps stale (suggested-binding-loop (a): the isDefault audience-binding suggestion is never surfaced on stock (auto-bound at boot, then skipped) #7677 fixed; a pending row can only be provisioned by deleting the suggestion row, which the API refuses 405). org-override: the field variant is stale (meta-field-write-inert: an accepted field PUT never reaches the object — a runtime-created field is stored valid=true and is absent from fields forever #7893), codes are uppercase, new objects need sharingModel. me-permissions persona W: provision via organization/update-member-role. record-view-read-audit: needs --log-level info. platform-owner A5 live leg can use a stopped-server email_verified stamp. crud-permission-matrix: delegate DELETE answers 200 {success:true}, not 204.
   2. ai: mcp-http-surface A5 lists 11 tools — there are 12 (resume_run, feat(mcp): resume_run completes a paused screen flow — the caller's own run, behind run_action's gates #19985); the data:read family is 6 (adds validate_expression, aggregate_records). list_actions takes no args (MCP query_records silently ignores unknown sort/filter keys while fields hard-errors on unknown values #16913); MCP run_action takes actionName, get_record takes recordId. validate-expression: the field is estimate_hours, and record.-prefixed refs are ok under flow_condition. open-edition discovery slot is {enabled, status, message}. Fixture apps need sharingModel and engines.protocol.
   3. api-backend: rest-crud/batch-config knownGaps say the mount half is unpinned — rest-config-mount-table.pin.test.ts pins it. aggregate step 6's non-array answer is VALIDATION_FAILED "expected array". api-methods: search needs searchable. packaged-action A2 code is VALIDATION_ERROR. activation-door 400s carry error.details.fields. bulk-write: door shapes (createMany bare array, updateMany {records:[{id,data}]}, deleteMany {ids}). error-envelope step 6 uses the stripped options.atomic spelling. package-rest scope:'custom' is refused (cloud / system / project). route-ledger: 18 families (reports retired, retire the saved-report stack — sys_saved_report / sys_report_schedule, /api/v1/reports, client.reports, IReportService, the reports capability and @objectstack/plugin-reports (zero consumers; not the report metadata kind) #20102). batch fixture: showcase_task requires project. query fixture: no progress field. filter A2: array / operator-less probes now get the shape-face sentence (analytics: a list comparand at a scalar operator ({ amount: { $gt: [10, 99] } }) answers 200 bound to its first member on the engine-aggregate face (and on both faces for a text column), where the spec's verdict refuses the list form #21448). rest-metadata-config-contract step 3 names showcase_account, which no stock persona masks — the stock fixture is client_liaison on showcase_project.
   4. approvals / attachments: email-action-token A1 token_hash is internal: true (fix(plugin-audit,platform-objects,plugin-auth,plugin-sharing,plugin-approvals,objectql)!: the audit ledger honours internal, and the credential-class census is declared internal #21301) — verify at the DB; expiry cannot be backdated over the API (405). approver-matrix: scratch flows need PUT /automation/{name} (see automation: a flow saved active through PUT /api/v1/meta/flow is never registered with the running engine (404 until restart), unlike hooks and actions #21725); the queue warning no longer cites 审批节点「处理人 Value」应改为记录 lookup(现查 metadata 端点→只能手填);附 approver value 语义核实 + queue 未实现 #3508; sys_team (405) and sys_user.manager_id (403) need DB writes. attach-requires-parent-edit A3 code is PERMISSION_DENIED. sys-file-status step 8. status-mirror persona plan needs a create grant. A scratch permission set is POST /data/sys_permission_set, not PUT /meta/permission_set (400).
   5. automation: recipe qa-flow-status-doors steps 2–3 (use PUT /automation, see automation: a flow saved active through PUT /api/v1/meta/flow is never registered with the running engine (404 until restart), unlike hooks and actions #21725); recipe qa-contributor-bound-member step 5 must set owner to the member's email; disable-durable's ledger line needs OS_LOG_LEVEL=info.
   6. identity / integration: verify-to-activate step 4 refusal is INVALID_TWO_FACTOR_COOKIE; settings live at /api/settings/… (not /api/v1). datasource-admin: result.status (no action), driver id mongodb, config.filename (file → did-you-mean 400), health field status + statusReason. federated-read A3 still declares oracle: screenshot; $filter must be JSON. declarative-boot: the ready-instance log line is not printed at the default level; listing body {success, data:{connectors,total}}.
   7. platform-core: manifest-install step 2 scope:'custom' (fix(runtime): the package install door parses its whole body through PackageInstallBodySchema #20218), engine.objectstack needs full semver, leg 8b needs overwrite:true. ledger row contract: 405 allowed list is 5 verbs; the table has a __search column. docs-audience A3 unknown-audience deny has no test case. seed-mode: author with ?mode=draft (not state), no name key in the body. marketplace step 5: storageDir is on the envelope; install-local writes into {cwd}/.objectstack (needs a scratch cwd).
   8. records-forms: field-unique updateMany is per-id, not predicate; validation-rule cross_field targets fields[0] (start_date), invalid_initial_state is only drivable on showcase_project; predicate-traversal A2's verify names a rule name the envelope does not carry, and the knownGap "member_default does not grant account read" is false.

   Environment notes are in the record body. The 17.6.0 run's open items (#21330) not re-judged here are browser-side and carry forward to the post-#21696 run.

   ---

   Generated by Claude Code
3. objectstack-fleet commented on Oct 6, 2026

   

   objectstack-fleetbot

   on Oct 6, 2026

   ContributorAuthor

   More actions

   Close-out addendum: grep-able lines for three disposed rows. The record stays open for its partials

   Triage seat (objectstack-wide, seat post #6015) · session_01AavokzJ5DndAwitDXvKy4U · 2026-10-06T16:09Z. The maintainer approved clearing the open qa-run records' close-out debt: 「同意，动手」. This was audited row by row (read-only) against checklist-test §5 before this write.

   Parked-on: #21735 · api-backend.server-timing-admin-gated · A3
   Parked-on: #21735 · integration-system.external-schema-introspection · A3
   Extracted: #21724 · api-backend.trigger-status-contract · A5–A7

   • These rows were already disposed in qa(checklist): re-point 17 clauses on 16 items that the 17.7 pre-release runs (#21720 / #21721 / #21722) proved stale or mis-asserted #21735's table and in automation: a refused flow resume answers status-derived codes (VALIDATION_ERROR / RESOURCE_NOT_FOUND) instead of INVALID_SCREEN_INPUT / INVALID_SIGNAL / RUN_NOT_FOUND #21724, but no grep-able line named them.
   • Still undisposed: seven partials.
     • access-security.rls-both-sides A6;
     • access-security.write-path-guards N2;
     • api-backend.declarative-endpoint-execution A3;
     • records-forms.predicate-relationship-traversal A4;
     • three browser halves deferred "post-chore(objectui): bump the console pin to objectui main (past 973fc20f) before the 17.7 checklist run — carries objectui#11574, #11578, #11581 and the V1 declared-node slot #21696" that no browser run re-selected: api-backend.route-ledger-live-parity A10, automation.packaged-flow-clone-contract A7, platform-core.metadata-registry-serving A7.

   ---

   Generated by Claude Code
4. objectstack-fleet commented on Oct 6, 2026

   

   objectstack-fleetbot

   on Oct 6, 2026

   ContributorAuthor

   More actions

   Close-out complete: the blocked partial gaps are parked. The record closes completed

   Triage seat (objectstack-wide, seat post #6015) · session_01AavokzJ5DndAwitDXvKy4U · 2026-10-06T17:06Z. The maintainer approved clearing the open qa-run records' close-out debt: 「同意，动手」. ⛔ No verdict on this record is changed.

   Parked-on: #22017 · access-security.rls-both-sides · A6 blocked(dependency)
   Parked-on: #22017 · access-security.write-path-guards · N2 no door, no pin
   Parked-on: #22017 · api-backend.declarative-endpoint-execution · A3 code-only by design (#5488)
   Parked-on: #22017 · records-forms.predicate-relationship-traversal · A4 persona fixture, knownGap to re-check

   • Every fail was already disposed, in this record's close-out and in addendum 6020403609.

   • The three browser halves deferred past chore(objectui): bump the console pin to objectui main (past 973fc20f) before the 17.7 checklist run — carries objectui#11574, #11578, #11581 and the V1 declared-node slot #21696 are not-run, and stay on this record's handoff list (§4, ⛔ no second list):

     • api-backend.route-ledger-live-parity A10;
     • automation.packaged-flow-clone-contract A7;
     • platform-core.metadata-registry-serving A7.

     The next release-candidate Tier 1 run re-selects them (§5, trigger 1).
5. objectstack-fleet

   closed this as completedon Oct 6, 2026
6. akarma-synetal

   added 2 commits that reference this issue on Oct 7, 2026

   docs(qa): record A1 of crud-permission-matrix as a known v18 gap (obj…

   ...

   8cbba54

   docs(qa): park the 24 partial-coverage gaps of the 17.7 pre-release r…

   ...

   47f6355