feat(spec,cli): 治理最后 9 个元数据类型 —— 活性账本覆盖注册表全集，PENDING_GOVERNANCE 清空 (#4488) - #4510
Merged
Merged
Conversation
…rage complete (#4488) Nine new ledgers (app, book, doc, email_template, job, mapping, seed, translation, validation; ~150 verdicts, all verifiedAt-stamped), emptying PENDING_GOVERNANCE: every registered metadata type is now governed. - check-liveness.mts: unwrap() sees through z.preprocess pipes (takes the OUT side when IN is a transform) — translation's registered schema was unwalkable before this. - CLI lint TYPE_COLLECTIONS registers the six new types carrying authorWarn entries, with pins in the test suite (21 tests). - liveness/README.md: the count-table method is decided and recorded (mirrors check-liveness --json byStatus); all rows regenerated, the stale webhook row rewritten to the post-#3489/#3494 state. Key findings, all recorded in ledger notes and tracked in #4509: - email_template: the ENTIRE authoring surface is disconnected from sendTemplate (false compliance on auth mail). - app: areas[].visible / areas[].requiredPermissions are fail-open dead gates; homePageId dead; selector includeAll deliberately ignored. - translation.validationMessages: read by nothing while #3778's own migration table steers authors into it. - job / validation: runtime-authoring doors disconnected from their execution points. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01WsgTqRF58HsQYKLsrZ5pQY
|
The latest updates on your projects. Learn more about Vercel for GitHub. 1 Skipped Deployment
|
os-zhuang
enabled auto-merge
August 1, 2026 14:08
github-actions
Bot
added
documentation
Contributor
📓 Docs Drift CheckThis PR changes 2 package(s): 113 hand-written doc(s) reference the affected code and may need an implementation-accuracy re-verification:
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #4488
结论
app / book / doc / email_template / job / mapping / seed / translation / validation 九个类型全部入账（约 150 条判定，全部
verifiedAt2026-08-01），PENDING_GOVERNANCE清空——注册表里的 27 个类型现在每一个都有账本。#4487 建的闸门从"承认缺口"走到了"没有缺口"；ratchet 保留，新注册类型不入账即红。方法（#4487 的边界结构法，逐类型复用）
每个类型先找"到达执行点的结构"再判定：seed 的边界是 SeedLoaderService、doc/book 是 REST 读层 +
resolveBookTree、job 是IJobService.schedule+ 三个 adapter、mapping 是 import 管线、validation 是evaluateValidationRules、translation 是 resolver 家族、app 是filterAppForUser+ objectui shell。grep 只证存在，结论一律闭合调用图（objectui 证据钉在@940ba24）。审计发现（都已记录在账本注记，enforce-or-remove 追踪在 #4509）
四个"授权门断连"——不是死键，是整扇门通向空地：
email_template整个可授权表面 dead（最严重）：sendTemplate只读sys_email_template行，行的唯一写入者是内置模板 + 代码构造的插件选项；stack/文件/Studio/PUT-meta 四扇授权门全部落进没人读回的元数据存储（包导入路径还显式排除它）。管理员在 Studio"修好"密码重置邮件 → 保存成功 → 用户继续收到内置版。认证邮件上的 ADR-0078 false compliance。warn 按 webhook 先例载于name（每工件一条）。job运行时条目永远不被调度：allowRuntimeCreate: true，但只有编译 bundle 的jobs到达调度器（handler 也只能从 bundle 函数表解析）。validation独立条目绑不到对象：schema 没有对象绑定键、没有合并代码；Studio 里建一条 state_machine 规则（ADR-0020！）保存成功、从不拦截。规则词汇本身全活——经由object.validations内嵌路径，evaluator 确证 active/events/priority/severity 全部强制执行（zod 头注释那句"只读 type/condition/…"是陈旧散文）。action导航项点不动：渲染、门控一切正常，点击派给宿主onAction——没有任何 shipped shell 传它。失效开放的门：
app.areas[].visible/areas[].requiredPermissions无人评估——"隐藏"的区域对所有人渲染，而条目级同名键在服务端+客户端都强制执行（#4001 自己说的"fail open 是 silent-strip 最坏形状"）。都已authorWarn，hint 指向强制执行的条目级/应用级替代。平台亲手立的假路标（capabilities.readOnly 系列 +2）：
translation.validationMessages无人解析，而 #3778 自己的 legacy-key 迁移表把errors:作者引向它；book.translations两处 inline map 无人读，而两个文件之外的doc.translations在每条读路径上都工作。险些误判：
translation.messages差点判死——resolver 家族里确实没人读它；真正的消费者是 plugin-audit 用拼接键调t()（messages.activityCreated…），按组名 grep 永远找不到。工具修复
z.preprocess：unwrap()对 pipe 一律取in侧，而 preprocess 的 in 是 transform——translation的注册 schema 在本 PR 前根本走不了查（--dump translation直接抛错）。现在 in 侧是 transform 时取 out 侧。authorWarn的新类型注册进TYPE_COLLECTIONS；测试补五组 pin（21 通过），含"schema 默认值物化不得误报"的反向 pin——mapping.errorPolicy/batchSize、selectorincludeAll/placement因默认值在编译期物化而不可 warn（_authorWarnSkipped，default(true) 布尔规则的非布尔实例）。README 计数口径（#4488 点名要的决定）
表镜像
check-liveness.mts --json的byStatus——CI 强制执行的那个数，取代数账本 JSON 行的 python 片段（它漏 marker 解析、框架 overlay 自动 live、childrenDefault 扇出，#4487 写作期间用它机械重写产生过两处回归）。全表从一次运行重新生成；webhook行两代陈旧（还在说"整个表面 dead"——#3489/#3494 早已修完，现 11/0/0），重写为现状并保留为"dead 判定是工单不是墓碑"的范例。验证
@objectstack/spec—— 7051 tests passed@objectstack/cliutils —— 288 tests passed（含新 pin）Generated by Claude Code