[objectstack-fleet]

Requested by Elon · project thread

domain:server#4 · os-elon-musk · session_016WV4cxrNurGFU9PsE6NwNT

Part of #30126 (rows 8 and 15 land here; rows 9, 12, 13 and 16 stay on the card, see Acceptance notes)

Clause-②: no
Metadata-protocol: none

维护者速读

• 改了什么:收件箱「我的通知」列表不再显示 notify 这类原始主题 id(只剩标题、级别、时间);MCP 工具收到没声明的参数时,报错只说错在哪、该怎么写,不再追加一句给内部开发者看的历史说明。
• 为什么改:真实用户走查里,通知列表的 Topic 列读成 notify,读者看不懂;MCP 报错末尾「This argument used to be dropped silently…」对调用方没有用,只是噪音。
• 风险与回滚:很小。topic 字段本身没动,仍可搜索、可被其他视图使用;MCP 照旧拒收每个未声明参数,只是少了最后一句。回滚即撤本 PR。
• 先看:packages/mcp/src/mcp-http-tools.ts 的 withoutHistorySentence 与 strictToolInput;packages/services/service-messaging/src/objects/inbox-message.object.ts 的 mine 视图 columns。
• 两分钟验证:pnpm --filter @objectstack/mcp exec vitest run src/mcp-http-tools.unknown-argument-keys.test.ts,预期 13 条全绿;另有 pnpm --filter @objectstack/service-messaging exec vitest run src/objects/inbox-message-mine-view.test.ts 2 条全绿。
• 需要你做的:无,席位落地(非受管面)。行 9、13、16 的取舍另由席位呈决裁。

What changes

• Row 8, @objectstack/service-messaging. sys_inbox_message's mine list view (a person's own notifications) projected ['title', 'topic', 'severity', 'created_at']. topic is the producer's machine id (notify from a flow's notify node, collab.mention from a mention) and no catalog labels it, so the column read notify. The view now projects ['title', 'severity', 'created_at']. The card's suggestion was "hide it or give it a label"; there is nothing to label it from, so it is hidden. The topic field is unchanged and still searchable.
• Row 15, @objectstack/mcp. Every MCP tool closes its argument shape with strictUnknownKeyError (@objectstack/spec/shared), which ends each message with the surface's history sentence. The MCP tools passed UNKNOWN_ARG_HISTORY ("This argument used to be dropped silently and the call still succeeded, …"). They now pass an empty history through a small wrapper, withoutHistorySentence, which trims the separator the factory leaves, so the message ends at its last fix channel. The explanation of the posture stays in the file's comments. packages/spec is not touched: the factory is unchanged for every authorable schema.

Tests

• packages/services/service-messaging/src/objects/inbox-message-mine-view.test.ts (new, 2): the mine view's columns are exactly title, severity, time; topic stays a searchable field.
• packages/mcp/src/mcp-http-tools.unknown-argument-keys.test.ts (new top-level describe in the existing harness, 2): the reported sort call is refused with `sort` → `orderBy` and no history sentence; over every advertised tool, no refusal carries the sentence or ends in whitespace.
• Ablations through scripts/ablation-replace.mjs, each restored with git diff HEAD empty: the old history sentence put back → 2 failed of 13 in the MCP file; topic put back in the view → 1 failed of 2. Both test files import src.
• @objectstack/mcp full suite: 56 files, 680 passed. @objectstack/service-messaging full suite: 67 files, 847 passed. typecheck for both: exit 0.

Acceptance notes

• Row 9 (mention title follows the recipient's locale): not built, needs_decision. The delivery chain is the maintainer's ruling quoted in recipient-locale.ts (「解析链 = 收件人 locale → 部署默认」), which also lists a request-scoped locale as deliberately not in the chain. Since the card was filed, PR fix(console): save a language picked on the sign-in page as the person's own when they have none #30539 and PR fix(console): save a language picked on the register page as the new person's own when they have none #30597 save a language picked on the sign-in and register pages as the person's own when they have none. Whether a person who never picks a language should get one stamped, or whether a "last used" rung should join the chain, is a product choice; the options go to the maintainer through the seat.
• Row 12 (Setup app refusal in English): not built. It shares packages/rest/src/meta-item-read-gate.ts with open PR fix(objectql,rest)!: serve an object an extension renames without the base's plural (#30391) #30459, which is still waiting on the maintainer, so per the claim's serial constraint it is left for after that lands.
• Row 13 (os package export -u/-t vs os package install -r/--email/--password): not built, needs_decision. About twenty commands use -u/--url + -t/--token; install uses -r/--runtime with a session sign-in, and publish uses -s/--server. One way to name them means renaming a published option (breaking; this repo keeps no alias window) and, for install, choosing which credential kinds it takes. Options go to the maintainer.
• Row 16 (list_actions lists admin-only identity actions to a plain member): not built, needs_decision. The listing is in packages/runtime/src/domains/mcp.ts, outside the claimed packages/mcp/src/**. The actions' admin gate lives only in each target's own mount (/api/v1/auth/admin/*, plugin-auth's judgePlatformAdmin, and different gates for SSO and manager doors) and in a display-only visible predicate; no key the action door reads states it. Hiding or marking them means either a declared gate on the actions or a second copy of the targets' predicates in the runtime, and the two precedents (actionPermissionError hides, the runtime(mcp): an OAuth-token agent's api action forward carries a bearer the target door does not accept (acceptOAuthAccessToken matches /mcp paths only), so the target likely resolves the caller as anonymous #28178 / MCP list_actions offers sys_api_key.revoke_api_key as runnable to an API-key caller, and run_action then refuses it 403 #28943 credential table marks unavailable) point different ways. Every refusal is unchanged. invite_user appearing four times is four objects each declaring it, which run_action's objectName disambiguates.
• Noted, not filed: the MCP refusal still carries the spec factory's upgrade-guide sentence ("Keys retired before the previous protocol major …"), which is about metadata keys rather than tool arguments. Out of row 15's ask.

Verification

Derived gates and suites

• node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack at 18552efc (5 paths vs merge base b77c160a): 63 commands, each run with its exit code captured before any pipe. 60 exit 0 on the first pass; three exit 3 (prerequisite):
  • node scripts/check-plugin-teardown-shape.mjs --self-test: exit 0 after fetching its pinned fixture commit 621a4876 (48 cases).
  • pnpm check:i18n: exit 0 after its own named prerequisite build (CLI + the ten extract packages): "all bundles in sync, no undeclared authoring keys".
  • pnpm check:dual-build-cjs-loads: NOT MEASURED locally (needs a whole-workspace build); CI's Lint & Repo Gates runs it.
• dispatch-gates --ran: 63 derived, 62 run, 1 NOT-MEASURED (the one above), 0 UNRUN, exit 0. Changed lines: 126 (+107 / -19, 5 files).
• pnpm --filter @objectstack/mcp typecheck, pnpm --filter @objectstack/service-messaging typecheck: exit 0 (after a full build of both closures).
• Suites: @objectstack/mcp 56 files / 680 tests passed; @objectstack/service-messaging 67 files / 847 tests passed.
• Merged origin/main (a2437b56) before opening; the incoming commits touch neither package, so nothing was re-run. Final head 3a5b38d6. CI check-runs: not read at the time of writing.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 2 package(s): @objectstack/mcp, @objectstack/service-messaging, touching 4 documentable anchor(s).

16 hand-written doc(s) name something this change touched — list omitted above 15 rows. Re-derive on the tree named below: node scripts/docs-audit/affected-docs.mjs --json a2437b560bd8872feece6ec8b57c6fdf21cff1f4.

⛔ 2 release-owned page(s) also affected — read-only, see AGENTS.md Documentation Guardrails.

What this run could not see

• 1 anchor(s) matched too much of the corpus to be a work list: created_at (literal, 43 pages)
• the SDK route bridge reached 63 of 221 client-bound route-ledger rows — the other 158 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 158: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 55 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 103 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 15 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json a2437b560bd8872feece6ec8b57c6fdf21cff1f4 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 7a52005dbf0a32cd7bbfe0757a31b7fa25636201 — the merge of head 3a5b38d6a0dfa3a9bf51148abe2e3cc13d950288 into base a2437b560bd8872feece6ec8b57c6fdf21cff1f4, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 7a52005dbf0a32cd7bbfe0757a31b7fa25636201 && git checkout 7a52005dbf0a32cd7bbfe0757a31b7fa25636201
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin a2437b560bd8872feece6ec8b57c6fdf21cff1f4 3a5b38d6a0dfa3a9bf51148abe2e3cc13d950288 && git checkout -B drift-repro a2437b560bd8872feece6ec8b57c6fdf21cff1f4 && git merge --no-ff 3a5b38d6a0dfa3a9bf51148abe2e3cc13d950288

node scripts/docs-audit/affected-docs.mjs --json a2437b560bd8872feece6ec8b57c6fdf21cff1f4

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs a2437b560bd8872feece6ec8b57c6fdf21cff1f4 → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[objectstack-fleet]

domain:server#4 · os-elon-musk · session_016WV4czvZykUqhYxYXSSDt4

维护者速读

1. 改了什么：个人通知列表（sys_inbox_message 的 mine 视图）不再显示原始主题列（如 notify）；MCP 工具参数报错只说该改成什么，去掉了写给内部开发看的历史说明。
2. 为什么改：真实用户走查第 8、15 行：主题列是机器 id，看不懂；历史那句对调用方没用。
3. 风险：低。topic 字段仍在对象上，可搜索可过滤；MCP 对未声明参数照旧拒绝，只少了结尾一句。
4. 先看：packages/mcp/src/mcp-http-tools.ts 的 withoutHistorySentence，和 inbox-message.object.ts 的 columns。
5. 两分钟验证：pnpm --filter @objectstack/mcp exec vitest run mcp-http-tools.unknown-argument-keys。
6. 需要你做的：无，席位落地。第 9、13、16 行等你在席位线程裁定；第 12 行等 PR fix(objectql,rest)!: serve an object an extension renames without the base's plural (#30391) #30459 合并后再做。

席位意见：ACCEPT（#30126 第 8、15 行，Part of）。

席位核对

Head-sha: 3a5b38d6a0dfa3a9bf51148abe2e3cc13d950288 · read 2026-11-05T22:53Z

Item	Reading
Shape	Draft → main via relay pr_create; Part of #30126 (rows 8, 15). 5 files, +107/−19. ⛔ ui/**, packages/spec/** untouched.
Seat diff read	Row 8: the mine view's columns drop topic (field kept on the object). Row 15: UNKNOWN_ARG_HISTORY removed; strictUnknownKeyError gets an empty history and withoutHistorySentence trims the trailing separator, so every tool's refusal ends at its fix. Refusal of an undeclared key unchanged.
Evidence	New pins: the mine view's columns; the refusal names sort → orderBy and no history sentence; every advertised tool's refusal has no history sentence and no trailing whitespace. mcp 680/680, service-messaging 847/847, both typecheck 0 (os-dev-report 6671216554).
Gates (check-runs on this head)	48: 35 success, 13 skipped, 0 failed; mergeable_state clean.
Out of this PR	Row 12: serial after PR #30459 (meta-item-read-gate.ts). Rows 9, 13, 16: needs_decision, analysis 6671252245, put to the maintainer. Row 16 also leaves the claimed surface (packages/runtime).
Semver	@objectstack/service-messaging: patch, @objectstack/mcp: patch, Clause-②: no, Metadata-protocol: none.
Landing	Not governed (check-governed-merges --pr 30688: 0 of 5 paths), 126 lines ≤ 3000, not BREAKING, so per pm-dispatch the seat lands it: pr_ready + automerge_enable. At merge the card goes to needs-user-decision for rows 9, 13, 16, with row 12 named.