Repository navigation
runtime gate: full runtime-safe rule snapshot for the publish door — the expensive half split out of the object-gating card #9612
Description
Split from the object-gating P2 card by maintainer ruling (2026-08-18, verbatim: 「objectstack cloud 还没有正式上线,简化开发。」→「同意」on the simplification package; adjudication record: #4716 comment 5328603673). The parent card narrows to gating 5 rules on object writes; THIS card carries the half the cost measurement showed to be expensive and severable.
Scope (was the parent card's second bullet)
RUNTIME_NEEDS_FULL_SNAPSHOTrule batch: construct the full registry snapshot (option (a) from the P1 design) so rules reading whole-stack collections (pages / dashboards / nav / translations / seeds) can run at the runtime write door.- The measured pricing this card must answer to (all
origin/main@66beee0f3, thread comment 5309105113): option (a) per-save p50 = 201 ms at 306 items, 822 ms at 1530, 1.8 s at 3060; snapshot construction is free (0.001–0.011 ms) — 86% of the bill is at-gate rules being handed the whole stack (validateStackExpressionsalone 70%). Any implementation must beat or bound this, or gate it (size threshold / caching + invalidation / per-rule scoping). - Known lazy-dep hazard: an object-write snapshot carrying a
json_schemavalidation loadsajv+ajv-formatson the kernel path; the tripwire test's object leg landed via PR test(lint): give the runtime lazy-deps guard an object-write leg #9295 and must stay red-capable for any type this card widens onto. - Inherited constraint from the parent body: upgrading
validateCapabilityReferences-class advisories to gating is a severity change — its own PR, never a rider here.
Not in this card
- Gating the 5
RUNTIME_OBJECT_WRITES_P2rules on object writes (the narrowed parent card). - The pre-existing linear cost of the shipped gate (506 ms per flow publish at 420 objects) — filed as its own finding today.
Triage note: lands where the parent lands (packages/metadata-protocol gate + packages/lint snapshot machinery) — suggested domain:metadata, triage decides; pm vocabulary intentionally only pm:queue here pending triage.
Activity
os-support-ai commentedon Aug 18, 2026
Triage: lands where the parent lands (
packages/metadata-protocolgate +packages/lintsnapshot machinery) →domain:metadata, matching parent #4716's routing; typeTask(brings declared rules to the runtime write door under a measured performance bound — engineering task, not a contract-surface change).Blocked-by: #4716
The narrowed parent is
pm:dispatchedon the same gate seam right now; this card is the severable expensive half split out by the 2026-08-18 maintainer ruling (adjudication record on #4716, comment 5328603673). Dispatching both concurrently would put two agents in the same gate files, so it holdspm:blockeduntil the parent's PR lands. Unlock discipline: on #4716's close, re-verify the file surface on the merged ref before dispatch — the parent's landing may absorb part of the snapshot scaffolding.(
Blocked-by:line carried in this comment per the body-escape convention; unlock scans read comment-level lines.)Generated by Claude Code
os-warren commentedon Aug 19, 2026
Unlock scan (triage seat, 2026-08-19 ~09:1xZ round): declared blockers (#9851, #4716) closed; the stated gate PR #9920 merged 08:51Z today →
pm:blockedremoved, back to queue. Re-scope together with sibling #9613 on the post-#9920 ref, under the maintainer's input-narrowing ruling (08:08Z on this card's thread).Generated by Claude Code
feat(lint,metadata-protocol): judge a package write against its own c…
docs(deployment): the four-doors matrix names rule families and doors…
docs(deployment): the four-doors matrix names rule families and doors…
docs(metadata-protocol): re-anchor the remaining dead tracker and com…
test(spec): the second api/ file group's test titles state each cited…
fix(lint)!: a list view bound outside the written package's closure i…