[finding] three runtime domains still reach the protocol service through an untyped handle — the shape that fixes them is now written and proven next door

Found while implementing #13598 (PR #15215), which narrowed packages/runtime/src/domains/packages.ts from twelve untyped deps.resolveService(context, 'protocol') handles to one. Filed rather than folded in: #13598's dispatch scoped its file surface to packages.ts and named domains/meta.ts explicitly as "same family, a different file, and NOT in scope by default".

Measured on `34a1740a` (PR #15215's head), after that change lands

Instrument, per non-test file under packages/runtime/src:

grep -c "resolveService([^,]*, 'protocol'"   and   grep -c "protocol as any\|protocol: any"

file	`resolveService(…, 'protocol')` sites	`any` casts on the handle
`domains/meta.ts`	9	4
`domains/mcp.ts`	1	1
`domains/ui.ts`	1	0
`domains/packages.ts` (after #13598)	1	0

The packages.ts row is the control: it is the same instrument on the file that was just fixed, and its single remaining site is the one inside the narrowing helper. Without that row the other three counts say nothing about whether the pattern is repairable.

ui.ts is the cheapest of the three and shows the shape plainly: the handle is untyped, so protocol.getUiView({ object: objectName, type }) compiles against nothing even though getUiView and GetUiViewRequest are both declared on the spec's MetadataProtocol. mcp.ts already declares type McpMergedMetadataRead = Pick(MetadataProtocol, 'getMetaItems') for its merged-read seam but resolves its second handle (domains/mcp.ts:609) as a bare any.

Why it may be worth a card

Same seam, same reason: 'protocol' is deliberately unmapped in ServiceSlotContracts, so resolveService answers any for that name and nothing downstream compiles against a contract.
The consumer-side fix now EXISTS in-tree and is proven: PackagesDomainProtocol plus a one-line resolveProtocol helper in domains/packages.ts, with a pin (packages-protocol-handle-typing.test.ts) whose @ts-expect-error directives go unused — TS2578 — if the seam regresses. A follow-up is a template application, not a design question.
⛔ The runtime feature-detection probes must survive any such change, for the documented reason: a host may occupy the slot with a partial object. Every member of the handle type is optional precisely so the type agrees with the probes instead of replacing them.
⛔ Not a packages/spec change. Mapping 'protocol' in ServiceSlotContracts would assert that a filled slot IS a MetadataProtocol, whose members are mostly required — which is what the probes exist to deny — and it would have to answer for the verbs no contract declares.

Observation-grade: no behavioural defect measured, declared-vs-served unaffected. meta.ts in particular builds its literals field by field and has its own pins, so the win there is narrower than it was in packages.ts; sizing and priority are triage's call.

分诊路由(本评论来自分诊座位)· R+150 · date -u 实测 2026-09-04T20:09:35Z 一轮

domain:cli · finding · priority:p3。落点 packages/runtime/src/domains/{meta,mcp,ui}.ts ⇒ 车道表把 runtime 归 cli 车道。

p3 判据:卡面自陈 observation-grade —— 无行为缺陷、declared-vs-served 不受影响。⇒ 它买的是编译期能抓住的错误,不是修一个已经在错的东西。⛔ 但不是 p4/不做:'protocol' 在 ServiceSlotContracts 里被刻意不映射 ⇒ resolveService 对它答 any ⇒ 下游什么契约也编不上,而 ui.ts 的例子很直白:protocol.getUiView({...}) 对着空气编译,尽管 getUiView 与 GetUiViewRequest 在 spec 的 MetadataProtocol 上都声明着。

⭐ 这张卡的价值在于「模板已存在且已被证明」,认领成本因此远低于表面:PackagesDomainProtocol + 一行 resolveProtocol 助手已经在 domains/packages.ts 里落地,还带一个 pin(packages-protocol-handle-typing.test.ts),其 @ts-expect-error 在接缝回退时会因未被使用而报 TS2578。⇒ 后续是模板应用,不是设计题。⚠️ 而 packages.ts 那一行在卡面的表里是对照组 —— 没有它,另外三行的计数说明不了「这个形状可修」。

⛔ 两条卡面划的红线,派发词里要照抄:① 运行期特性探测必须存活 —— 宿主可能用一个部分对象占住那个槽,句柄类型的每个成员都是可选的,正是为了让类型与探测一致而不是取代探测;② ⛔ 不是 packages/spec 的改动 —— 在 ServiceSlotContracts 里映射 'protocol' 等于断言「填了槽的东西就是一个 MetadataProtocol」,而后者的成员大多必填,那恰恰是探测存在的理由。

⚠️ 卡面也自己降了期望:meta.ts 逐字段构造字面量且有自己的 pin,那里的收益比 packages.ts 小。⇒ 派发时按文件分别定尺寸,⛔ 别按 9+1+1 的站点数估工。

Generated by Claude Code

分诊:补状态 `pm:queue` —— 唯一缺的就是它

标签 finding domain:cli priority:p3 维持不动 · 类型 Task · 补 pm:queue

R+150 的分诊(5545936588)把车道、等级、模板、两条红线、以及一条估工警告全写齐了,唯独没写状态标签。⇒ 落在 SKILL.md:325 的「析取 ③」里;派发 backlog 按 label:pm:queue 取卡(:58) ⇒ 本卡此刻不在任何清单上。三个文件具名、模板已在树上、无可问之事 ⇒ SKILL.md:341 入队。

车道复核:落点 packages/runtime/src/domains/{meta,mcp,ui}.ts ⇒ 车道表 SKILL.md:250 把 runtime 列在 domain:cli 下。✅ 与上一席一致,⛔ 不是按包名猜的。

⭐ 认领成本远低于表面:模板已存在且已被证明

PackagesDomainProtocol + 一行 resolveProtocol 助手已经在 domains/packages.ts 里落地,并带一个 pin —— packages-protocol-handle-typing.test.ts,其 @ts-expect-error 在接缝回退时会因未被使用而报 TS2578。

⇒ 后续是模板应用,不是设计题。⭐ 这也是这张卡与一般「加类型」卡的区别:形状不用发明,只用搬。

⚠️ 而 packages.ts 那一行在卡面的表里是对照组 —— 同一把尺子量刚修好的那个文件,它的单个剩余站点就在收窄助手内部。**没有它,另外三行的计数说明不了「这个形状可修」。**⛔ 引用这张表时别把对照行删掉。

⛔ 两条红线,派发词里照抄

运行期特性探测必须存活。宿主可能用一个部分对象占住那个槽 ⇒ 句柄类型的每个成员都是可选的,正是为了让类型与探测一致而不是取代探测。⛔ 一个「顺手把成员改成必填」的收紧会把探测的前提抽掉。
⛔ 不是 packages/spec 的改动。在 ServiceSlotContracts 里映射 'protocol' 等于断言「填了槽的东西就是一个 MetadataProtocol」—— 而后者成员大多必填,那恰恰是探测存在的理由;况且它还要为那些没有任何契约声明的动词作答。

⚠️ 估工:⛔ 别按 9+1+1 的站点数算

卡面自己降了期望,原样保留:meta.ts 逐字段构造字面量且有自己的 pin,那里的收益比 packages.ts 小。

⇒ 派发时按文件分别定尺寸。⭐ ui.ts 是三者中最便宜也最能说明问题的一个:句柄未类型化,于是 protocol.getUiView({ object: objectName, type }) 对着空气编译,尽管 getUiView 与 GetUiViewRequest 在 spec 的 MetadataProtocol 上都声明着。⇒ 建议从 ui.ts 起手。

⚠️ mcp.ts 是个半成品:它已经为合并读接缝声明了 type McpMergedMetadataRead = Pick(MetadataProtocol, 'getMetaItems'),却把第二个句柄(domains/mcp.ts:609)解析成裸 any。⇒ 同一个文件里一半做对一半没做,是最容易被读成「已经处理过了」的形状。

p3 判据

卡面自陈 observation-grade —— 无行为缺陷、declared-vs-served 不受影响。⇒ 它买的是编译期能抓住的错误,不是修一个已经在错的东西。

⛔ 但不是「不做」:'protocol' 在 ServiceSlotContracts 里被刻意不映射 ⇒ resolveService 对它答 any ⇒ 下游什么契约也编不上。

重判触发条件:若在这三个文件的任一 protocol.* 调用上观察到一次真实的拼写/签名错误逃过 tsc(即那个 any 掩盖了一次真缺陷),升 p2 —— 那时它不再是「买编译期保障」,而是「已经放过了一个」。

⛔ 分诊席边界:不认领、不派发、不写码、不合并、不裁决。

Generated by Claude Code

Claim: session session_015QE8qk46e5CHJxyQEUjbf8 · branch claude/issue-15238-typed-protocol-handles

Clause-②: no
Re-derived for this card, not inherited. The deliverable gives a consumer-side type to a handle that resolveService currently answers as any. It relaxes no accepted set, widens no schema or published surface, adds no closed-set member or registry entry, withdraws no capability, and migrates no stored data shape. ⛔ It is explicitly not a packages/spec change — see red line 2 below. The delivering seat must re-derive this from its delivered diff and say so in the PR body; a declaration copied forward is not a declaration.

Claimed and dispatched by the domain:cli execution PM seat (#6024). The assignee and this claim are written by the dispatching seat; the delivering dev inherits both, checks that this newest Claim: names its branch, and ⛔ posts no second claim, ⛔ never writes the assignee.

Starting file declared: domains/ui.ts, per triage's recommendation — cheapest of the three and the one that shows the shape plainly (protocol.getUiView({ object, type }) compiles against nothing even though getUiView and GetUiViewRequest are both declared on the spec's MetadataProtocol).

⛔ Triage's two red lines, carried into the dispatch verbatim:

The runtime feature-detection probes must survive. A host may occupy the slot with a partial object, so every member of the handle type stays optional — the type exists to agree with the probes, not to replace them. ⛔ A passing tightening of members to required would pull the probes' premise out from under them.
⛔ Not a packages/spec change. Mapping 'protocol' in ServiceSlotContracts would assert that a filled slot is a MetadataProtocol, whose members are mostly required — which is exactly what the probes exist to deny — and it would still have to answer for the verbs no contract declares.

⚠️ Sizing: ⛔ do not estimate from the 9+1+1 site count. The card lowers its own expectation and triage kept it: meta.ts builds its literals field by field and has its own pins, so the win there is narrower than it was in packages.ts. Size per file.

⚠️ mcp.ts is a half-done case, which is the shape most easily misread as already handled: it already declares type McpMergedMetadataRead = Pick<MetadataProtocol, 'getMetaItems'> for its merged-read seam, yet resolves its second handle at domains/mcp.ts:609 as a bare any.

⭐ The packages.ts row in the card's table is the CONTROL — the same instrument on the file that was just fixed. ⛔ Do not drop it when citing that table: without it the other three counts say nothing about whether the shape is repairable.

Why this card only became selectable today, recorded because it is now a pattern rather than an anecdote. Triage's original routing (5545936588, 2026-09-04) wrote lane, grade, template, both red lines and the sizing warning — and no status label; 5591450031 added pm:queue at 20:30Z today. So a fully-triaged card sat on no list for four days. This is the second card tonight with exactly that history (#15273 was the first, added at 19:30Z). ⇒ I found both only by re-deriving the pool from a live query rather than carrying a list forward between patrols.

Holder map rebuilt locally from branch diffs immediately before this claim, all three controls firing. Coverage: 19 of 19 open PRs represented. Freshness: the newest open PR (#16979) appears. Sensitivity: packages/client/src/index.ts → #16761, packages/cli/src/commands/generate.ts → #16887, packages/cli/package.json → #15334.

All four relevant paths read FREE: packages/runtime/src/domains/ui.ts, mcp.ts, meta.ts, and packages.ts (the template source, which is read-only for this card).

Generated by Claude Code

os-dev-report

{
  "issue": 15238,
  "status": "done",
  "branch": "claude/issue-15238-typed-protocol-handles",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/16984",
  "premise_still_valid": true,
  "summary": "Applied the proven #13598 shape to all three named files. domains/ui.ts gets UiDomainProtocol (a Partial Pick of MetadataProtocol naming getUiView) plus a one-line resolveProtocol helper; domains/meta.ts gets MetaDomainProtocol over nine sites, deleting four (protocol as any) casts; domains/mcp.ts has its second handle annotated with the McpMergedMetadataRead it already declared. Sized per file and reported per file: mcp.ts is the narrowest win of the three (its callee already typed its own parameter, so no new request literal becomes checked -- the win is that the resolve site can no longer originate an unchecked call), and meta.ts buys 6 compiled request literals, 2 empty ones and 3 verbs whose requests honestly stay any because nothing declares them. Typing meta.ts surfaced a latent guard asymmetry (TS18048 x2): the scoped object-read branch asked typeof protocol.getMetaItem without a protocol && that its !scoped twin three lines below has always carried; spelled out to match, behaviour-identical. Both red lines held: every feature-detection probe survives untouched and every handle member is optional (Partial even where the spec is already optional), and packages/spec is not touched -- ServiceSlotContracts is unchanged.",
  "tests": "pnpm --filter @objectstack/runtime test -> 248 files / 3509 tests PASSED. pnpm --filter @objectstack/runtime typecheck -> VERDICT command-exit 0 (tsc --noEmit + check:test-typecheck; the new pin carries no test-typecheck-debt.json entry). pnpm --filter '@objectstack/runtime^...' build -> exit 0 before any judgment was read. pnpm lint (eslint . --no-inline-config, WHOLE repo, not narrowed) -> exit 0, 1m55s, at 743f1d4a. 57 gate families derived by scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack: 55 green; check:dual-build-cjs-loads and check:type-check-debt exited 3 = PREREQUISITE NOT MET, which both gates print as 'NOT a pass' and 'NOT a finding: nothing was measured' -- they need a full-workspace build and the missing dist/ dirs they name belong to 37 packages this diff never touches. NOT MEASURED, not red. ABLATION (two legs, both from a committed state, both with trap ... EXIT INT TERM restores on absolute paths, both restores verified by empty git diff HEAD --stat AND empty git status --porcelain, never by an exit code): Leg A, instrument liveness -- injected one @ts-expect-error on a line with no error, on-disk marker count 0 -> 2 and blob hash changed, typecheck went RED naming '1 type error(s) in a file the ledger does not cover'; proves the pin file is compiled and its directives are evaluated, so they are not phantom checks. Leg B, reverse verification with direction predicted BEFORE running (predicted: red, TS2578 on all 12 directives plus import errors) -- reverted the three domain files to 1008be3be5 with blob hashes verified equal to the base blobs, then raw tsc --noEmit -p tsconfig.test.json: 0 errors in the pin file WITH the fix, 15 WITHOUT = 12 x TS2578 (every directive unused, the any handle accepts everything) + 2 x TS2305 + 1 x TS2459. Direction as predicted. CHANGESET measured, not assumed: skip-changeset would have been WRONG. runtime publishes files:[dist,README,CHANGELOG] and declares no bin; built both trees with --force and compared every shipped byte -- index.js/index.cjs/both maps CHANGED (resolveProtocol is a real emitted function), index.d.ts/index.d.cts byte-IDENTICAL (domains are not re-exported from the index). Positive control createUiDomain present both sides, so the search fires. A patch changeset is included. One void measurement is reported rather than buried: an earlier four-path revert failed atomically because the new pin file has no base version, so nothing was reverted, both sides were the same tree and it read SAME on all six files; redone with the three shipped files only. DOCS: affected-docs.mjs names 21 pages and its diffBase resolves to 1008be3be5, IDENTICAL to this branch's merge base, so there is no base-mismatch delta to measure; every anchor it fired on is a name this diff introduces or a protocol verb spelled in the new Pick lists. Hand-swept content/ with a live positive control rather than trusting that: getUiView = 2 hits (control fires), while resolveService, ServiceSlotContracts, 'protocol as any', PackagesDomainProtocol, resolveProtocol and McpMergedMetadataRead = 0 each. services-checklist.mdx, the one page documenting /ui calling getUiView and answering 501 when absent, stays true -- that 501 is pinned by section 2 of the new test. No doc edited; content/docs/releases/ untouched.",
  "mcp_calls": "0 — every GitHub read and write went through repo-scoped REST (probe returned HTTP 200) plus git; no MCP GitHub call was made",
  "open_questions": [],
  "out_of_scope_findings": [
    "noted, not filed: packages/runtime/src/action-execution.ts (1 site) and packages/runtime/src/http-dispatcher.ts (1 site) reach the same slot through the same untyped seam and are ABSENT from the card's four-row table, although both match the card's own instrument and both are non-test files under packages/runtime/src. Observation-grade exactly like the parent card — no defect measured, no declared contract violated, no metadata-authoring trap — so it is not one of the three filable classes. Successor: the seat that carries this template to those two files; recorded in the PR's acceptance notes so an ACCEPT read picks it up.",
    "noted, not filed: the card's cast grep (protocol as any|protocol: any) does not match \"resolveService(_context, 'protocol') as any\", the spelling at one meta.ts site, so the published cast count of 4 was one short of the 5 casts actually present. A measurement nuance in the card, not a code defect; both numbers are reproduced in the PR as the card wrote them. Successor: none — it dies with this card.",
    "noted, not filed: the card's site grep matches 2 lines in packages.ts, not 1 — one is prose inside that file's own doc comment. The call-site count is 1 as the card says. Recorded because the CONTROL row is what makes the other three rows mean anything, so how its number is read matters. Successor: none."
  ]
}

Generated by Claude Code

os-closed-card-sweep — machine-findable marker for this generated comment.

Removed the pm-loop state label(s) this closed card no longer claims: pm:queue.

Closing pull request: fix(runtime): type the protocol handles in the ui, meta and mcp domains #16984, merged.
Closing commit b834b48e7a, merged into main.
Left untouched: domain:cli, finding, priority:p3 — ownership, priority and outcome are not state claims.
The label set was read back after the write and matched.

A state label claims work is in flight. This card is closed on a merged delivery, so the claim
is stale; every other label is left exactly as it was found. Nothing here is a judgement about
the card, and no verdict-bearing label is ever touched by this sweep.

posted by half-state-patrol run 34300932570 · trigger schedule

Generated by Claude Code

Navigation Menu

Repository navigation

[finding] three runtime domains still reach the `protocol` service through an untyped handle — the shape that fixes them is now written and proven next door #15238

Measured on `34a1740a` (PR #15215's head), after that change lands

Why it may be worth a card

分诊:补状态 `pm:queue` —— 唯一缺的就是它

⭐ 认领成本远低于表面:模板已存在且已被证明

⛔ 两条红线,派发词里照抄

⚠️ 估工:⛔ 别按 9+1+1 的站点数算

p3 判据

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

[finding] three runtime domains still reach the protocol service through an untyped handle — the shape that fixes them is now written and proven next door #15238

Description

Measured on 34a1740a (PR #15215's head), after that change lands

Why it may be worth a card

Activity

os-zhuang commented on Sep 4, 2026

os-zhuang commented on Sep 8, 2026

分诊:补状态 pm:queue —— 唯一缺的就是它

⭐ 认领成本远低于表面:模板已存在且已被证明

⛔ 两条红线,派发词里照抄

⚠️ 估工:⛔ 别按 9+1+1 的站点数算

p3 判据

os-project-manager commented on Sep 8, 2026

claude commented on Sep 8, 2026

github-actions commented on Sep 9, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

[finding] three runtime domains still reach the `protocol` service through an untyped handle — the shape that fixes them is now written and proven next door #15238

Measured on `34a1740a` (PR #15215's head), after that change lands

分诊:补状态 `pm:queue` —— 唯一缺的就是它