QA run · priority:P0 (23/23) · c4c515ad · 2026-10-29 · 20 PASS / 3 PARTIAL / 0 FAIL / 0 BLOCKED / 0 NOT-RUN #27481

domain:devx#1 · sunhaolin · session_017xRBcV2ijbfB8Drvs2oik6
Part of #27377 (wave 3, W3-C1)

Release-candidate run of the standing smoke (priority:P0) for 18.3.0. Every one of the 23 runnable items has a verdict: 20 PASS, 3 PARTIAL, 0 FAIL, 0 BLOCKED, 0 NOT-RUN. No item reported a clause failure. The three partials each come from one blocked clause that the item's own fixtures.knownGaps predicts. The off-clause probes produced four low-severity product cards (extracted, see the close-out comment) and two security findings, detail withheld and fix dispatched (see "Off-clause probes").

Environment fingerprint

• Framework c4c515ad3cc342043a2b81b5a06a5793f79a23e8 (detached checkout, git status clean before and after the run), including ui/. The Console was built in-repo from the same commit: pnpm install --frozen-lockfile, then pnpm build --concurrency=2 (12m43s, exit 0), then pnpm console:build --concurrency=2 (exit 0). node scripts/check-dev-prereqs.mjs was green (105 artifacts).
• Stale-console-bundle ruled out: every boot served /_console/ entry assets/index-DkXHr74P.js, the same file as packages/console/dist/assets. The dispatcher checked this once and each browser runner re-checked it on its own boot.
• Node 22.22.0, pnpm 10.31.0, Playwright chromium build 1243 (matches /opt/pw-browsers; launched without the executablePath override).
• App: examples/app-showcase. One os dev compile boot by the dispatcher wrote dist/objectstack.json. Every runner boot afterwards used --no-compile (from the tree, or from a scratch copy outside the tree with node_modules symlinked), so concurrent boots never rewrote the shared artifact.
• Boot line: OS_PORT=PORT OS_STORAGE_LOCAL_ROOT=RUN/uploads setsid pnpm -C … exec objectstack dev --ui --seed-admin --no-compile -p PORT -d file:RUN/ITEM.db, with --fresh / --log-level info where an item asked for them. Seed: --seed-admin (admin@objectos.ai) plus the showcase seed (132 rows / 19 datasets, measured).
• Ports: 41101–41109 (R1), 41201–41209 (R2), 41301–41309 (R3), 41401–41409 (R4), 41501–41509 (R5), 41601–41609 (R6), 41701–41709 (R7), 41001 and 41010 (dispatcher). Each item ran on its own file DB under its runner's scratch dir.
• Walled leg: os dev with OS_TENANCY_POSTURE=isolated, OS_PLATFORM_OWNER_EMAIL and OS_AUTH_MEMBERSHIP_POLICY=invite-only. The banner read Tenancy: isolated, not degraded.
• The v17-shaped DB came from npm @objectstack/cli@17.7.0 --legacy-peer-deps, from a blank-scaffold os dev boot, because no 17.x showcase is published. The 18.0 pre-release DB is the cli-18-prerelease-db restore. Copies only, with a checksum or row diff around every step.
• Timestamps: prep 04:19Z–04:32Z, runners 04:34Z–05:14Z, 2026-10-29.

Execution

Parallel, per SKILL §2. Seven runner subagents (R1–R7), each with its own port range and file DBs. API and CLI items fanned out; browser items ran at most three at a time (R5, R6, R7, one browser each). The dispatcher checked every runner's verdicts against the raw evidence it captured (pin outputs, HTTP traces, boot logs), and independently reproduced the off-clause security probes on its own boot (port 41010, twice) before dispatching anything. Container memory stayed under 11 GiB throughout.

Scope: selector priority:P0, 23 runnable items (no planned or blocked items matched)

Per-clause verdicts

Layer note (RUNNER rule 6): a clause scored from a pin names the pin's layer in its evidence. Dogfood pins (bootStack) are in-process HTTP over a real engine and sqlite. objectql pins are engine over a mock or recording driver. Plugin-unit pins over stubs only corroborate. Every clause whose oracle is a public door's answer was also driven on a live boot, except where the row says otherwise.

Reproduction rules for fails

None: 0 clause fail this run.

Retest (anchor §4, SKILL §5 trigger 2)

• api-backend.query-contract-matrix, fix data list door: a blank $select answers every column and an unrecognised $count value counts — malformed values are read as the absent default #26644 (empty $select / bad $count): the fix holds. Driven on two loads of the same DB:
  • GET /api/v1/data/showcase_task?$top=2&$select= answers 400 VALIDATION_ERROR "Query parameter '$select' names no field". So do $select=,, select=, fields= and whitespace values.
  • $count=maybe answers 400 "must be true or false". So do count=maybe, $count=, TRUE and 1.
  • The controls are unchanged: $select=title gives 1 column, $count=true gives total=10, $count=false gives no total.
  • The POST /query door answers 400 VALIDATION_FAILED at query.fields, query.select and query.count.
  • The fix pins pass: two rest door pins (17 passed) and the metadata-protocol pin (37 passed).
  • Residual, not a fail: the message names the parameter, but the envelope has no param key, and three codes answer this one class.

Pins and the Playwright smoke

• examples/app-showcase/e2e/showcase-smoke.spec.ts: 49 passed, 0 failed (2.6 min), run against a live boot on 41501 (SMOKE_API_URL), from a scratch copy.
• objectstack verify --rls, run separately from bare verify, on a scratch copy:
  • per-persona line: 21 PROVEN (21 consistent, 0 HOLES) · 3 NOT PROVEN (… 3 skipped);
  • total line: all personas: 38 PROVEN (38 consistent, 0 HOLES) · 226 NOT PROVEN [unit: one object × persona probe];
  • 10 of 10 positions probed.
  • The bare-verify control tail read 15 verified, 0 gaps, 0 FAILED, 1 needs-fixture, 8 skipped, with no PROVEN line.
• Dogfood pins (in-process HTTP), all green with --maxWorkers=1:
  • private-owd 8, rls-fixture 6, owner-anchor-and-bulk-writes 12, static-readonly 4, readonly-when-parent 9, crud-persona-matrix 49, permission-zoo 12;
  • public-read-owd 4, invoice-line-contributor-pair 5, controlled-by-parent 4, invoice-cbp 4;
  • anonymous-deny-surfaces 75;
  • wall-environment-metadata-refusal 23, wall-catalog-refusal 17, wall-package-doors-refusal 23;
  • showcase-expand-crud-gate 10, packaged-action-disabled-dispatch-live plus packaged-activation-ledger-reach 19.
• Engine and unit pins, all green:
  • objectql engine.test.ts and filter-array-lowering 196, readonly-strip and isSystem 55;
  • rest request-schema-gate 16 and data list door: a blank $select answers every column and an unrecognised $count value counts — malformed values are read as the absent default #26644 doors 17, metadata-protocol 37;
  • runtime action-activation-dispatch 11, service-automation flow-activation-ledger 47;
  • rest meta-migrate-stored-walled-refusal 6, runtime packages-walled 30, automation-walled 12, meta-walled-catalog 19;
  • runtime identity-objects-default-organization pin 4, plugin-auth ensure-default-organization 57;
  • cli ownership-ceremony and boot-refusal pins 179 (8 files), runtime boot-guard 22 plus kernel 10, plugin-security 3.
• Not run, and scored by hand instead, with the reason stated:
  • ui/e2e/live/record-history-display.spec.ts and ui/e2e/live/studio-object-designer.spec.ts need the console dev server on fixed ports outside the runner ranges;
  • packages/mcp/src/__tests__/plugin.test.ts is a plugin unit over a mocked ctx and corroborates only; every ai.mcp-stdio-fail-closed clause was scored on live os start stdio legs.

Derived item verdicts and fixture gaps

• access-security.rls-both-sides: PARTIAL. acceptance[5] is blocked{by: dependency, ref: knownGaps[0] / qa(checklist): park the blocked partial-coverage gaps of the 17.7 pre-release runs (#21720, #21721, #21782, #21784) — each gets a fixture recipe, a pin, a re-pointed clause or a recorded knownGap #22017 row 11}: the D11 spot-check needs the maintainer-held private write-up. The public half (the three benign skip lines, plus a hand spot-check of project_membership and the ext_* objects as a plain member) holds.
• access-security.crud-permission-matrix: PARTIAL. acceptance[5] is blocked{by: dependency, ref: security: no door can bind a permission set to the guest anchor — ADR-0138 D3 item 5 has no enforcer (PUT /meta/position/guest answers 403 NOT_OVERRIDABLE; guest suggestions are refused) #23267} per knownGaps[2]: no door binds a set to the guest anchor. Re-observed: PUT /meta/position/guest answers 403 NOT_OVERRIDABLE, and anonymous requests answer 401.
• cli.organization-ownership-ceremony: PARTIAL. acceptance[5] is blocked{by: fixture} on one leg: the cli-18-prerelease-db dump's reset token expired at 2026-10-27T17:42:21Z, one hour after the dump was generated, so the reset answers 400 INVALID_TOKEN. Every other leg of acceptance[5] held (refused first boot, reviewed apply complete with blocking 0, moved rows with 0 diffs, sign-ins 200/401, one sys_http_delivery row).
• Coverage notes on passing items: the walled item's install-local leg rests on the wall-* pins (an admitted install writes into the shared tree); platform-core.nav-surfaces-render's ErrorBoundary fallback is still unexercised (existing knownGap); platform-core.builtin-apps-nav-render's marketplace catalog content is environment-blocked (egress denied, existing knownGap); the v17 fixture is a blank-scaffold DB, not a showcase DB.

Off-clause probes (RUNNER rule 8)

53 runner-minutes in total, after the clauses had verdicts, on the same boots and as the same personas: R1 4, R2 10, R3 5, R4 8, R5 10, R6 8, R7 8. R1 and R3 were under the 10–15 minute budget.

• Doors:
  • data CRUD, list and query, clone, batch create/update/delete, shares, field-access, export, analytics;
  • meta/app, meta/apps, /api/settings/:ns, sign-in and get-session, /ready;
  • actions, activation and the flow trigger; the approvals request, decision and actions routes;
  • MCP key admission and MCP reads and writes;
  • datasource and sys_metadata side channels;
  • the walled overlay types;
  • the ownership-ceremony command and os dev -d "".
• Personas: admin, plain member, contributor, client_liaison, auditor, ops, field_ops_delegate, an approver, anonymous, and a bogus or empty bearer token.
• Boundary classes:
  • empty, whitespace and comma-only values;
  • unknown, empty and trailing-slash ids, and key-case variants;
  • forged owner, id and audit overrides; non-object overrides; RLS-invisible targets; foreign requests;
  • opposite posture (walled against single; setup for a non-admin); readers outside scope.
• Findings, each in its own card (listed in the close-out comment):
  • api-backend.query-contract-matrix · observed beside the clauses: a blank $searchFields is read as absent;
  • records-forms.crud-roundtrip · observed beside the clauses: the history "Changes" line shows a currency value unformatted;
  • records-forms.crud-roundtrip · observed beside the clauses: clone accepts a non-object overrides with 201;
  • approvals.account-app-entry · observed beside the clauses: the approvals actions sub-route answers 200 [] for an unknown request.
• Security findings:
  • records-forms.crud-roundtrip · observed beside the clauses · security finding — detail withheld, fix dispatched
  • records-forms.crud-roundtrip · observed beside the clauses · security finding — detail withheld, fix dispatched
• Recorded, not filed:
  • the publish response for a namespace-prefix refusal is HTTP 200 with an inner outcome: "refused", which is how that response is designed;
  • a PATCH of a stored legacy datasource row carries its withheld invalid keys forward, with no cleartext served;
  • a field-zoo clone does not carry a masked password field (its source read is masked).

Time

• Environment prep: 13 min (install and full build) plus about 2 min (dispatcher compile boot and bundle check), then 30 runner-minutes of per-runner prep (scratch copies, persona minting, the walled boot, the v17 DB, scratch Postgres).
• Testing: 40 min wall clock (04:34Z–05:14Z), or 114 runner-minutes of clause work plus 53 of probes.
• Ratio: about 1 : 2.7 by wall clock (15 min prep to 40 min testing), and about 1 : 5.6 by runner-minutes (30 to 167).

Checklist-accuracy findings from this run are parked on #27377 as ledger edits for the devx lane; they are not repeated here.

Generated by Claude Code