build: objectstack validate / compile accept unknown keys in a plugin node's config (e.g. an approval node's escalation) — the build-time refusal map covers built-in node types only

[objectstack-fleet]

QA-source: #21845 · approvals.sla-escalation · acceptance[4]

Clause A5 of approvals.sla-escalation (rev 2) fails in the follow-up run #21845 (subject 316be321e); an independent verifier (RUNNER rule 7) reproduced it: low-medium, predates 17.6.0.

Reproduction

1. In a scratch copy of the showcase, add a flow whose approval node has escalation {…, bogusKey: 1} (or the timeout alias).
2. objectstack validate → exit 0; objectstack compile → exit 0, and the key is copied into dist/objectstack.json.
3. Boot: the flow is dropped with only a WARN; the server stays healthy.

• Expected: the build refuses the unknown key with a located error (as the runtime registration door already does, [Decision] One seam, two strictness levels: POST /api/v1/automation hard-refuses an undeclared node config key but accepts an unknown node type #7545).

Mechanism

packages/spec/src/automation/flow-node-config-refusals.ts:94-111 holds config contracts for the 13 built-in node types; plugin node types (approval) are not consulted at build time. The timeout alias is correctly refused (aliases only drive the "did you mean" text).

Done when

The build consults registered plugin node descriptors (or a declared contract map) and refuses unknown keys and invalid values; a test pins the approval escalation case.

---

Generated by Claude Code

[objectstack-fleet]

Path: the road — start: the build is the author's first gate | approvals.sla-escalation (the build door) | P1

Triage: first grade — bug · priority:p3 · domain:spec · area:workflow · pm:queue. The build's node-config refusal map covers the plugin node types the spec declares

Triage seat (objectstack-wide, seat post #6015) · session_01AavokzJ5DndAwitDXvKy4U · 2026-10-05T09:00Z. ⛔ Not a claim, ⛔ not a dispatch.

Triage: lands in packages/spec/src/automation/flow-node-config-refusals.ts (about :94–:111) ⇒ domain:spec; rationale: the map holds the 13 built-in node types' contracts, and the approval node's config contract is declared in the spec too (approval.zod.ts).

• Why p3. The runtime door already refuses unknown keys ([Decision] One seam, two strictness levels: POST /api/v1/automation hard-refuses an undeclared node config key but accepts an unknown node type #7545). The build accepts them and the boot drops the flow with a warning, so the author is told late, not never. The verifier graded it low to medium. It predates 17.6.0.
• Direction: the card's "declared contract map". The approval node's config schema joins the map, so validate and compile refuse unknown keys and invalid values with a location.
  • ⛔ No build-time plugin loading.
  • A plugin whose node contract is not declared in the spec stays outside the map, as today.
• Pins: escalation.bogusKey and timeoutHours: 0.5 both fail validate with a location.
• Pairs with automation: an approval node's escalation values are checked only at execution — timeoutHours 0.5 registers and activates, then every run fails and the record is created with no approval gate #21848 (the same schema at registration).

---

Generated by Claude Code

[objectstack-fleet]

Claim: PM loop round 1 (17.7 pre-release follow-up, dispatched on the maintainer's direct order)
Session: session_018zT8d8NpiQ1ExhuNd5TxY6
Account: hotlong (the seat's linked user as GET /user answers it; always the card's assignee)
Branch: claude/issue-21850-build-plugin-node-config
Worktree: objectstack-issue-21850
Domain: domain:spec (card label, as triage set it)
File surface: packages/spec/src/automation, packages/cli/src, .changeset/
Container & model: M, mode:subagent, model: opus (default tier; no path-derived mandate)
Clause-②: no
Thread-read: 5991330471
Serial constraints cleared: none named

Provenance: the maintainer, in Claude Code session session_018zT8d8NpiQ1ExhuNd5TxY6, 2026-10-05, verbatim: 「都开单派发」; landing per the standing order 「开发完整就进队列合并」. Dispatched one at a time within the session's load cap. Where the card withholds detail, this session holds it and the dispatch carries it privately.

---

Generated by Claude Code

[objectstack-fleet]

Release: session session_018zT8d8NpiQ1ExhuNd5TxY6 · cause: re-route before dispatch (no dev was started on this card) · destination: back to pm:queue for the domain:spec lane seat to claim.

Provenance: the maintainer, in Claude Code session session_018zT8d8NpiQ1ExhuNd5TxY6, 2026-10-05, verbatim: 「只有不能公开的才需要你派发处理」. This card withholds nothing, so its dispatch belongs to the lane. The claim above is withdrawn, the assignee is cleared, and the triage grading stands.

---

Generated by Claude Code