fix(automation): which flows are packaged is the loader's fact, and every flow written through an authoring door is tenant-authored (#20761)

[objectstack-fleet]

Fixes #20761
Clause-②: yes (widening)

What this does

Stage 2 of #20761, under the maintainer's ruling B + A recorded in 5904938166. The platform now trusts only a fact it holds itself about which flows are packaged. For flows, "packaged" means exactly "loaded by the loader from a managed package".

1. The engine reads the loader's set, not the body (ruling point 1). The automation engine no longer classifies a flow by the provenance stamps its own definition carries. Every classification reads one reader over the loader's set: the ADR-0126 §7.3 subflow guards in both directions, the arming gate, the activation door, and the package an activation row is attributed to. The automation plugin attaches that reader. It asks the metadata protocol at question time, with nothing cached at boot, so it follows the registry across install, upgrade and reload exactly as the locked-base verdict does. The body's stamps are kept for display only.
2. One shared rule on every flow write door (ruling point 2). It lives in @objectstack/metadata-protocol, beside the access-security.packaged-flow-write-door-parity clauses 2 and 3 fail on main — detail withheld pending maintainer #20679 locked-base verdict. It is asked by the automation create door, the update door, the clone door and the /meta flow write.
   • A name the loader's set holds is refused as a locked base. That is access-security.packaged-flow-write-door-parity clauses 2 and 3 fail on main — detail withheld pending maintainer #20679's packagedBaseRefusal, reused, not re-implemented. So a round trip of a shipped flow is refused.
   • Any other name, with a body whose stamps would classify it as code-shipped, is refused loudly: 422 INVALID_METADATA, a code already registered to this package in the ADR-0112 ledger. No new code is minted. Nothing is written or registered.
   • A tenant row's own stamps, echoed on a round trip, agree with the server's fact and are a no-op (see "Round trips" below for the one case this had to measure).
3. Clone (ruling point 3). The copy still drops the base's whole protection envelope. flow-clone.ts already did that, and the envelope drop is pinned in automation-flow-clone.test.ts. The copy is now also judged by the same rule and saved as a tenant row through the metadata protocol's own save, env-wide. It reads back on the metadata door and survives a cold boot. The engine registers the copy first and the store saves it second, and a save that fails withdraws the registration, so no clone is reported that would not survive.
4. Scope (ruling point 5). /meta's handling of every other metadata type is unchanged: the rule answers nothing for them. The two server-stated rewrites of stored rows (stored-metadata migration, package duplication) are not authoring doors and keep their old handling.

Declared cross-lane touch

The card is domain:cli, and its entry is the automation doors in packages/runtime. The claim (5909772878) declares two cross-lane surfaces, and this PR stays inside them:

• domain:engine: metadata-protocol (packages/metadata-protocol/src/**). The shared rule and the loader's-set read, both new public members, and /meta's flow write applying the rule.
• domain:services: service-automation (packages/services/service-automation/src/**). The engine's classification reads the loader's set, and the plugin wiring hands it over.

Nothing under packages/spec/**, packages/objectql/** or packages/metadata-core/** is touched.

The seam

role	file	symbol
loader's-set read	packages/metadata-protocol/src/protocol.ts	ObjectStackProtocolImplementation.packagedArtifactOwner
the one authoring rule	packages/metadata-protocol/src/protocol.ts	ObjectStackProtocolImplementation.tenantAuthoredWriteRefusal (the lock branch calls packagedBaseRefusal)
/meta applies it	packages/metadata-protocol/src/protocol.ts	saveMetaItem, before the stamps are stripped
automation doors apply it	packages/runtime/src/domains/automation.ts	refuseUnauthoredFlowWrite (POST /, PUT /:name, clone)
clone saved as a tenant row	packages/runtime/src/domains/automation.ts	clone arm → protocol.saveMetaItem
engine reads the set	packages/services/service-automation/src/engine.ts	setPackagedFlowSource, packagedFlowOwner (every former body-stamp site)
wiring	packages/services/service-automation/src/plugin.ts	packagedFlowReader

Pins (ruling point 4)

pin	where
a disagreeing assertion is refused on create and on update (422 INVALID_METADATA), nothing registered or written	runtime automation-tenant-authored-write.test.ts; dogfood
a round trip of a shipped flow is refused as a locked base (403 NOT_OVERRIDABLE) on both doors	runtime; metadata-protocol protocol.tenant-authored-write.test.ts; dogfood
a clone of a shipped flow is saved as a tenant row: it reads back on the metadata door and survives a cold boot on the same database file	runtime (the save and its rollback); dogfood (read-back and cold boot)
a round trip of a customer flow is accepted unchanged, on both doors	runtime; metadata-protocol; dogfood
the §7.3 guards and the toggle door treat a customer flow as customer-authored, whatever its body's stamps say	service-automation packaged-flow-source.test.ts; dogfood
no activation row is attributed to a package from an authoring path	service-automation (a row is attributed to the package the set names, never the one the stamps name); dogfood (ledger read, no row)
/meta's flow write applies the same rule	metadata-protocol; dogfood
control: /meta on another type keeps its old handling	metadata-protocol; dogfood

At least one pin runs through the real HTTP composition: packages/qa/dogfood/test/flow-provenance-server-held.dogfood.test.ts boots the showcase through bootStack with a database file, and cold-boots it once.

Ablation, run once and not kept. The five fix sources were reverted to the merge base on the working tree, and the three packages were rebuilt. Each marker was proved absent from dist/ with scripts/ablation-dist-preflight.mjs --absent. The dogfood file then read 8 failed / 5 passed of 13. The five that stay green both ways are the preservation pins: the two locked-base refusals (#20679's), the two /meta round trips, and the other-type control. After the restore, git status --porcelain was empty, the markers were present in dist/ again, and the file read 13 / 13. A first attempt left @objectstack/service-automation's build red: its barrel still exported the new type. That meant @objectstack/runtime's dist/ was never rebuilt, so the first reading was void. It was redone with the barrel reverted too.

Round trips (the triage direction 5903721942)

• Studio: NOT MEASURED. The Studio source is in objectui, which is not in this container. What Studio receives was measured on the showcase boot: the served document on both read doors.
  • A customer flow created through the automation door is served with no provenance stamps.
  • A customer flow stored through /meta is served with none either.
  • A shipped flow is served with its package's stamps.
  • A customer flow stored bound to a package is served with that binding surfaced as a package stamp and no tenant marker. The canonical classifier alone reads that as code-shipped, so a literal "stamps classify it as code-shipped ⇒ refuse" rule would have broken this legitimate round trip (measured: 422 before the edge was fixed). The rule therefore also asks the server's own fact behind the stamp: the package the stored row of that name is bound to, or the base the write itself names. That round trip is pinned on both doors, including across a cold boot.
• CLI: os meta register sends a file's contents verbatim to PUT /meta/:type/:name (packages/cli/src/commands/meta/register.ts:59-76), and os meta get prints the served document. So a get → register round trip is the /meta round trip above: a customer flow is accepted, a package-bound customer flow is accepted, and a shipped flow is refused as a locked base. The CLI adds no stamps of its own.

Verification (at f0de8fe69, after merging origin/main 30839063b)

• pnpm --filter @objectstack/metadata-protocol exec vitest run: 192 files passed, 3 skipped; 2813 tests passed, 19 skipped.
• pnpm --filter @objectstack/service-automation exec vitest run: 158 / 158 files, 1984 / 1984 tests.
• pnpm --filter @objectstack/runtime exec vitest run: 298 / 298 files, 4961 passed, 1 skipped.
• dogfood: flow-provenance-server-held, packaged-flow-write-door-parity, automation-flow-clone-door, automation-toggle-tenant-scope and packaged-activation-ledger-reach passed, 42 / 42.
• typecheck: metadata-protocol, service-automation (with check:test-typecheck), runtime and dogfood, all exit 0.
• node scripts/pm/dispatch-gates.mjs --commands: all 69 derived families were run, each with its exit code recorded. --ran reconciles 69 derived, 69 run, 0 NOT-MEASURED, 0 UNRUN.
  • check-plugin-teardown-shape --self-test first exited 3 on the shallow clone. It exited 0 after deepening, as it prescribes.
  • check:dual-build-cjs-loads first answered PREREQUISITE NOT MET: eight unrelated packages had no dist/. It exited 0 after they were built.
• Lint, as a proven narrowing, not a full pnpm lint:
  1. Population: every changed TypeScript file sits under packages/**, which the packages/**/*.{ts,…} and **/*.{ts,…} blocks of eslint.config.mjs lint.
  2. eslint --no-inline-config --format json over the 23 changed files: 23 files, 0 errors, 0 warnings.
  3. Invariance: the config never enables type-aware linting (eslint.config.mjs:327-328), so this diff cannot move a verdict on any untouched file.

Acceptance notes

• The automation create and update doors still persist nothing (not built here, as the claim allowed). Measured on the showcase boot with a database file:

  • a flow created through the create door answers 200 and reads 404 after a cold boot;
  • an update through the update door, on a flow stored through /meta, answers 200, and the stored definition wins after a cold boot.

  The clone's save does not cover these doors for free: making them durable changes both doors' contract. Named in the report; no carrier.

• A /meta flow save naming a package id no package has answers 200 on the showcase's host-config topology. Measured, out of scope. Named in the report.

• The loader's set is the registry's view, for both the lock and the engine. They read one source, so they cannot disagree. A dev-time artifact reload that adds a code flow is not re-registered into that view until restart (source reading, not measured). That is the same for the access-security.packaged-flow-write-door-parity clauses 2 and 3 fail on main — detail withheld pending maintainer #20679 lock.

• The engine used to count a flow stored bound to a package as packaged at boot, because its served definition carries that binding as a package stamp (see "Round trips"). It now reads the loader's set, so that misclassification is gone too.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 3 package(s): @objectstack/metadata-protocol, @objectstack/runtime, @objectstack/service-automation, touching 32 documentable anchor(s). ⚠️ 2 changed file(s) yielded no anchor (packages/runtime/src/flow-clone.ts, packages/services/service-automation/src/index.ts), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files.

23 hand-written doc(s) name something this change touched — list omitted above 15 rows. Re-derive on the tree named below: node scripts/docs-audit/affected-docs.mjs --json 05a7547c9f40e0dfab89a34f5e5b60f818af70d2.

⛔ 5 release-owned page(s) also affected — read-only, see AGENTS.md Documentation Guardrails.

What this run could not see

• 2 changed file(s) yielded no anchor (packages/runtime/src/flow-clone.ts, packages/services/service-automation/src/index.ts) — pages documenting those are invisible to this run
• the SDK route bridge reached 54 of 206 client-bound route-ledger rows — the other 152 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 152: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 55 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 97 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 32 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 05a7547c9f40e0dfab89a34f5e5b60f818af70d2 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 6b89073081646e2345bc4e052d1a27f258626d97 — the merge of head f0de8fe693acb6e58c037f191581c051b1a9f19e into base 05a7547c9f40e0dfab89a34f5e5b60f818af70d2, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 6b89073081646e2345bc4e052d1a27f258626d97 && git checkout 6b89073081646e2345bc4e052d1a27f258626d97
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 05a7547c9f40e0dfab89a34f5e5b60f818af70d2 f0de8fe693acb6e58c037f191581c051b1a9f19e && git checkout -B drift-repro 05a7547c9f40e0dfab89a34f5e5b60f818af70d2 && git merge --no-ff f0de8fe693acb6e58c037f191581c051b1a9f19e

node scripts/docs-audit/affected-docs.mjs --json 05a7547c9f40e0dfab89a34f5e5b60f818af70d2

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 05a7547c9f40e0dfab89a34f5e5b60f818af70d2 → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[objectstack-fleet]

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: f0de8fe693acb6e58c037f191581c051b1a9f19e
Local-runs: none

This is the record of record for PR #20853 at f0de8fe69, the stage-2 fix of card #20761 under the maintainer's ruling B + A (5904938166).

Inputs:

• card automation: a flow created through the authoring door can assert package provenance, and the ADR-0126 guards and the activation ledger then treat it as package-shipped #20761: its body and all eleven comments, in particular the ruling 5904938166 (rules 1–6 and the corrected pins), triage's order 5909424428, the seat's evidence 5905846738, the claim 5909772878 and the dev report 5911271822;
• PR fix(automation): which flows are packaged is the loader's fact, and every flow written through an authoring door is tenant-authored (#20761) #20853: its body, its file list (24 files, +1399/−70, no governed path, head repo = base repo, draft, auto-merge not armed) and the net diff against merge-base 30839063b (byte-identical in stat to the API file list);
• the head's 35 check-runs, latest per name: 32 success and 3 skipped (two path-filtered, one opt-in). Check Changeset, Governed Surface Queue Guard, Lint & Repo Gates, every Test Core and Type Check shard, the three Dogfood Regression Gate shards and Temporal Conformance are success. Nothing is failing or pending;
• the record on PR fix(runtime,metadata-protocol): the /automation write doors keep the packaged-base lock the /meta door keeps (#20679) #20817 (5908296340) for the Clause-② precedent on this door family; ADR-0126 §2/§3/§7 and ADR-0131 D6 at the merge-base.

Disclosure is kept at the card's level: doors, roles, codes and statuses. The body's package-provenance stamps are named only abstractly here.

① Derived judgments

(a) Rule 1 — the engine reads the loader's set: RIGHT, with two named residuals.

• At the head, engine.ts holds no remaining read of the body's stamps on any path that decides package treatment. Every former site now asks isPackagedFlow / packagedFlowOwner: the §7.3 caller guard (packagedSubflowCallers), the removal guard in unregisterFlow, the child-side guard (disabledPackagedSubflows and its ledger walk), the enable guard, the trigger arming gate (declineOntoDisabledSubflows), the toggle door's customer refusal, and the activation row's package attribution, which is now read once with the verdict and never from the definition. The runtime domain and the rest package carry no flow-stamp reader of their own.
• One source, so the lock and the classification cannot disagree: packagedArtifactOwner answers from lookupArtifactItem → SchemaRegistry.getArtifactItem, which is exactly the lookup packagedBaseRefusal's isArtifactBacked asks. The plugin's packagedFlowReader resolves the protocol service at question time with nothing cached; a protocol registered after the reader was built is still read (pinned).
• Why the set holds only loader facts: the artifact view admits an entry only when it carries a genuine package id and is not tenant-authored. The loader stamps package provenance at registration; the boot hydration of stored rows forces the tenant marker onto every row (stateTenantAuthorship) and registers it under the bare key with no package argument, so a stored row can never enter that view on its own. The only way a hydrated row acquires code provenance is the graft of a real artifact's envelope of the same name, in which case the name IS in the loader's set.
• Residual 1, named by the dev and carried: a dev-time artifact reload that adds a code flow is not re-registered into the registry's artifact view until restart (source reading, unmeasured). It is the same gap the access-security.packaged-flow-write-door-parity clauses 2 and 3 fail on main — detail withheld pending maintainer #20679 lock has, the two read one source, and the direction of error is fail-closed (the new code flow is neither locked nor packaged). Package install and upgrade register through the manifest service, and a Studio republish promotes tenant rows, which are never artifacts, so those cases stay right.
• Residual 2, not in the dev's report: boot-time precedence (resolveFlowPrecedence in flow-precedence.ts) still classifies its contenders with describeFlowContender, i.e. from the registry bodies' stamps, not from the reader. It is not reachable from an authoring door: its input is the registry's own list at start, populated only by the loader and by the hydration that forces the tenant marker, and the card measured precedence as unaffected by the assertion. The PR body does not claim precedence among the replaced sites, so nothing is overstated; ruling rule 1's parenthetical names it, so the seat should carry it as a follow-up (route the precedence classifier through the same reader). Not blocking.

(b) Rule 2 — one shared function, and the code: RIGHT.

• tenantAuthoredWriteRefusal is asked by POST /, PUT /:name and the clone arm of the automation domain (through refuseUnauthoredFlowWrite, before the engine is entered), and by saveMetaItem for flows only, before the silent strip. Each door relays the verdict verbatim through errorFromThrown; no door re-derives or re-stamps.
• A name in the set gets packagedBaseRefusal's own answer (403 NOT_OVERRIDABLE, and the named-base ITEM_LOCKED when /meta's own save names a read-only base), so a round trip of a shipped flow is refused as a locked base on every door. That is access-security.packaged-flow-write-door-parity clauses 2 and 3 fail on main — detail withheld pending maintainer #20679's check reused, not re-implemented; the optional packageId added to packagedBaseRefusal only lets /meta's save reach the named-base answer it already gave, and the automation doors pass none, so their answer is unchanged from fix(runtime,metadata-protocol): the /automation write doors keep the packaged-base lock the /meta door keeps (#20679) #20817.
• INVALID_METADATA / 422 is a ledgered code of @objectstack/metadata-protocol (its row in the ADR-0112 ledger), already the code saveMetaItem emits for a body carrying keys a client may not persist. It is right over the alternatives: 400 would open a second dialect on the same door, 409 is wrong because the name is free and nothing about current state is contested, 403 is wrong because no caller can be authorized into asserting a provenance. No code is minted. Nothing is written or registered on refusal (pinned on both doors and in the dogfood boot).
• The type is folded at the producer, so a plural spelling cannot address around the rule (pinned).

(c) The agreement edge, judged adversarially: display-only. No reader is fooled.

• The edge admits stamps that agree with a fact the server already holds: a stored row of that name bound to the stamped package (a store read, any state and scope), or the base the write itself names. The measured cause is real: a stored tenant flow bound to a package is served with its binding surfaced as a package stamp and no tenant marker, so the canonical classifier reads its round trip as code-shipped, and the literal rule broke that round trip (measured 422 before the edge).
• What the edge can and cannot do. It decides only whether the write is refused. What the write produces is a tenant row: the automation doors register in the engine only, and /meta strips the stamps and stores a row bound at most to the package it already was. At the next boot that row hydrates with the tenant marker forced, under the bare key. "Packaged" for every reader is exclusively the artifact view, which such a row cannot enter. Hence: it cannot lock the name (isArtifactBacked reads the same view), cannot make the §7.3 guards count it as a shipped caller or child, cannot pass the toggle door (refused 409 before any write), and cannot attribute an activation row to the stamped package (the ledger's package is packagedFlowOwner, reachable only past that refusal). The dogfood suite pins exactly this after a cold boot: the package-bound customer flow round-trips through the automation door and is still the customer's, with no ledger row.
• Together with the dev's second finding (the /meta save door accepts a binding to a package id no installed package has): an author can therefore manufacture a stored row bound to an arbitrary id, and then satisfy the edge for that name with that id. The result is the same tenant row with a misleading display stamp; none of the four readers above changes its answer, because none reads the store's binding or the served body. The one place a bound tenant row WAS read as code-shipped before this PR, the engine's boot-time sync from the protocol's execution view, now reads the set (the dev's fourth Acceptance note). Named-base agreement does not bypass the package door either: the rule runs before refusePackagedBaseOverride, which still judges the named base afterwards.
• Verdict on the edge: right, and correctly bounded. The store read is paid only on the rare stamped path; an unprovisioned store answers "no" and the refusal stands; any other read failure is re-raised, never turned into a verdict (pinned).

(d) Rule 3 — the clone: RIGHT and pinned.
The copy is judged by the same rule (the protocol is resolved before anything is registered, so a failing slot cannot leave a registered-but-unsaved clone), registered in the engine, then saved through protocol.saveMetaItem env-wide with no organization and no package, with no provenance on the item; a failing save withdraws the registration and relays the store's own failure. Pinned in the runtime suite (save shape, rollback) and in the dogfood boot (reads back on the metadata door, refused at the toggle door as customer-authored, survives a cold boot on the same database file). A composition with no store keeps the engine-only clone, stated in code. One unmeasured edge for the seat, not blocking and not security: the clone door's name-taken check consults the engine only, so a stored-but-unregistered row of the target name (a draft) would be overwritten by the clone's save.

(e) Fail-closed engine: RIGHT. With no reader attached nothing is packaged, the guards protect nothing and the toggle door refuses every flow (pinned). Every real composition has the protocol: ObjectQLPlugin assembles it by default, the verify harness composes ObjectQLPlugin, and the CLI serve roster carries both. The only engine composed without a door is the data-migration helper, which runs the engine unarmed. Observation, declared on both sides: in a composition with no protocol the #20679 lock is fail-open (the #20817 record's declared decision) while this classification is fail-closed; the asymmetry is harmless where no door exists and worth one line in the seat's notes.

(f) The reversal of #20679's pin: CONSISTENT with ruling point 2. The pin asserted that a body claiming a package on the customer's own flow is accepted 200; the ruling (rendered before that pin's record) says such a body is refused loudly with an existing code, and its point 4 replaced triage's earlier round-trip pin. The assertion now reads 422 INVALID_METADATA, engine never entered, definition unchanged. Rightly listed as a deviation and rightly made.

(g) Scope (rule 5): RIGHT. The rule answers null for every non-flow type, so /meta's handling of other types is unchanged (pinned as a control on both the unit and dogfood sides). The two exemptions are the two server-stated rewrites and nothing else: migrateStoredMetadata passes its stated source and duplicatePackage its stated write face; neither the REST door, the runtime dispatcher door nor the automation clone passes a source, and no door forwards one from a client, so the exemption cannot be reached from the wire (pinned: an authoring save asks the rule once, the two rewrites ask it zero times). Exempting the rewrites is right: a pre-#16702 row may carry stale stamps and failing its rewrite would be a regression of a server act.

(h) Prose, PR body and titles: ACCURATE and within the disclosure discipline. The changeset names exactly the delivered members (setPackagedFlowSource, packagedFlowOwner, the exported PackagedFlowSource type, packagedArtifactOwner, tenantAuthoredWriteRefusal, the optional named base on packagedBaseRefusal), the two statuses, the clone's save and rollback, the other-type scope, and carries the author's one-line fix. The PR body's "Round trips" section states Studio as NOT MEASURED with the server-side echo measured instead, and the ablation's first void run is disclosed. Neither the changeset, the PR body, the report nor any test title spells a request body, header or field key; stamps and markers are named abstractly. The refusal text itself names the keys to remove, which is runtime prose to the author, not a public surface. No tracker number in runtime strings.

Surface inventory:

1. @objectstack/metadata-protocol: packagedArtifactOwner, tenantAuthoredWriteRefusal, and the optional named base on packagedBaseRefusal: widenings, right.
2. @objectstack/service-automation: setPackagedFlowSource, packagedFlowOwner, the PackagedFlowSource type: widenings, right. packagedFlowReader is exported from the plugin module but not from the barrel. The test stand-in reads stamps by design and is test-only, not barrel-reachable.
3. Behaviour: the four flow write doors refuse a client-asserted provenance (422) and a shipped name (403); the clone is persisted; the engine's package treatment is the loader's fact. No route, query set or schema changes.

② Semver level

• minor for @objectstack/metadata-protocol and @objectstack/service-automation (added public members): right.
• patch for @objectstack/runtime: right. No public member is added; the doors move to the declared contract.
• Clause-②: yes (widening): right. The new 422 on the authoring doors is not a narrowing that needs (narrowing), a BREAKING banner or an ADR-0087 disposition. The accept-set that shrank was never declared: the spec's provenance decorations are server-derived read decorations (loader-introduced items carry package provenance), ADR-0126 §2 locks the packaged base and forbids silent override, ADR-0131 D6 seals managed definitions, and /meta already treated the stamps as not the client's (it stripped them). Accepting the assertion on the automation doors was the defect this security card measured. That is the negative boundary of clause ② exactly as the fix(runtime,metadata-protocol): the /automation write doors keep the packaged-base lock the /meta door keeps (#20679) #20817 record judged the same door family's 403, and here the maintainer's ruling itself orders the loud refusal over the silent strip. The changeset still carries the migration sentence, which is right practice for a refusal that a get-edit-register workflow will meet. Check Changeset and the repo gates are green.

③ Boundary flags

• Deviations, all five answered: the dedicated worktree on the claim branch (fast-forward, no force-push) is the rule, not a deviation; the access-security.packaged-flow-write-door-parity clauses 2 and 3 fail on main — detail withheld pending maintainer #20679 pin reversal is ordered by ruling point 2 (see ① f); the ten suites attaching a test-only stand-in keep their guard-logic pins honest while the set-vs-stamps contract is pinned separately; the fold-population count 14 → 16 reflects the two new folding verbs; the void first ablation was redone with the barrel reverted and disclosed.
• Open questions, all five self-decided rightly: Q1 INVALID_METADATA / 422 (see ① b); Q2 agreement with the server's fact (see ① c, display-only); Q3 fail closed with no reader (see ① e); Q4 the two server-stated rewrites exempt, and only those (see ① g); Q5 runtime patch (see ②).
• Out-of-scope findings:
  • Class a, the automation create and update doors persist nothing (200, then 404 or the stored definition after a cold boot): measured on a real boot with a database file at the head, so the evidence supports class and reach (any author of those doors). It confirms the seat's own evidence 5905846738 items 1–2. The claim allowed naming it; the seat files it, and the clone's new save is the shape to reuse.
  • Class a, the /meta flow save accepts a binding to a package id no installed package has (200 on the host-config topology): measured at the head, so the evidence supports class. Its reach must be stated as it now stands: after this PR the orphan binding is display-only (it cannot lock, classify or attribute, see ① c); at the merge-base it had engine reach through the boot-time sync. Measured on one topology; the environment-kernel path is not stated. The seat files it with that reach.
  • The dev-time artifact reload observation: carried as residual 1 in ① a, shared with access-security.packaged-flow-write-door-parity clauses 2 and 3 fail on main — detail withheld pending maintainer #20679, fail-closed, unmeasured.
• Residuals from this review, none blocking: boot-time precedence still classifies from registry bodies (① a residual 2, follow-up for the seat); the clone-onto-stored-draft overwrite edge (① d, unmeasured); the fail-open/fail-closed asymmetry in a protocol-less composition (① e, observation).
• origin/main has advanced past the merge-base; the head's mergeable state is clean and the diff reviewed is the net diff against the merge-base.

Implemented-by: claude/issue-20761-provenance-server-held
Reviewed-by: session_01VvcEokUG1tvVxkceYfR5XB

VERDICT: PASS

---

Generated by Claude Code