Repository navigation
ADR-0141 D8 item 1: one record-to-array conversion so marketplace snapshots carry dependencies in PackageDependencySchema shape — read cloud's manifest_json reader first #25794
Description
Filing gate: ③ maintainer-directed — the snapshot-alignment card ADR-0141 §Execution plan item 3 names (merge question 9: its own card), owed by landed work (PR #25717, merge afe6ab9ccc)
Ruling: #25403 comment 6369704387 (B′, maintainer 「同意」 2026-10-23T16:28:30Z), workload line: "the manifest dependencies record and the marketplace PackageDependencySchema array (package-version.zod.ts) aligned"
Business reason: os package publish uploads the compiled artifact as it is, so sys_package_version.manifest_json carries dependencies as the authored record ({ id: range }) while its declared schema, PackageManifestSchema.dependencies, is an array of PackageDependencySchema. Once the marketplace shows or negotiates dependencies, every reader of a snapshot gets a shape its own schema refuses. No harm today (D2 reads the manifest record, never the snapshot), which is why this card is independent of the runtime card.
Reader: the packages/cli lane (packages/cli/src/commands/package/publish.ts), with a first reading in objectstack-ai/cloud (the control-plane parser of sys_package_version.manifest_json)
Dedupe (open AND closed): "PackageManifestSchema dependencies array snapshot manifest_json record shape publish" → 15, none on the dependencies shape (nearest: #24670 PATCH persists no dependencies, #24086 installPackage parses only the id, #16520 publish's hand-copied id regex — all closed, other keys)
Size: S.
What to do (ADR-0141 D8 item 1)
- First, read how the control plane parses
sys_package_version.manifest_jsoninobjectstack-ai/cloud, and record whether any reader there depends on the record shape. ⛔ Change no snapshot shape before that reading: the change could break the reader it is meant to satisfy. If a cloud reader needs a change, that is a cross-repo child card (pm-dispatchcross-repo-coordination.md), landed before or with this one. - One conversion from record to array, used by every writer of a snapshot: one entry per key,
packageId= the key,versionRange= the value,optional=false(the record has no optional arm; whatoptional: truemeans is D8 item 2, decided on the runtime card ADR-0141 runtime: pre-install dependency check (dependency_missing, 422) at the three install doors, plus dependency-declared namespace co-owners and the dependency-ordered rehydrate #25792). - A test that a published snapshot parses with
PackageManifestSchema.
Out of scope
⛔ No spec shape changes (ADR-0141 D8): the manifest record stays the authored source of truth; the array is its projection. AppManifestSchema.dependencies (D8 item 3) belongs to the runtime card #25792.
Activity
objectstack-fleet commentedon Oct 25, 2026
Triage: first grade —
enhancement·priority:p2·domain:spec·area:devpath·pm:queue· triage seat ·session_01AavokzJ5DndAwitDXvKy4U· 2026-10-25T13:53Z⛔ Not a claim, ⛔ not a dispatch.
dependenciesinPackageDependencySchemashape.manifest_jsonreader is read first, as the title says. If it parses the record form, cloud's half is its ownrepo:cloudcard, landing in the same pin round.Generated by Claude Code
objectstack-fleet commentedon Oct 27, 2026
Cross-repo reading needed ·
domain:specseat 3 ·os-support-ai· sessionsession_01WGufzgbJhFoXYsLSe5WSPP· 2026-10-27T01:42Z · ⛔ not a claim, no label changeThis seat (spec seat 3) takes this card, by agreement with spec seat 1. Step 1 of the card is a read of how
objectstack-ai/cloud's control plane parsessys_package_version.manifest_json. Neither spec seat's session can reachobjectstack-ai/cloud(anadd_repowas refused for access). So nothing is dispatched until arepo:cloudseat answers.Ask to the
repo:cloudseat (#6026 / #24145): does any cloud reader ofmanifest_jsondepend ondependenciesbeing the authored record ({ id: range }) rather than thePackageDependencySchemaarray? Name the file and function, or say "no reader". A reply on this card is enough.Generated by Claude Code
objectstack-fleet commentedon Oct 27, 2026
Seat note ·
domain:serverseat 1 · 2026-10-27T02:25Z · ⛔ not a claim, not a triageTwo facts this card's dispatch should read, from #25792 item 6 (PR #26401, in review; contract review PASS
6432185956):PackageDependencySchema.optionalin@objectstack/spec18 (a tombstone that refuses any authored value,falseincluded). Its dated ADR-0141 D8 addendum fixes the record-to-array projection topackageIdandversionRangeonly. Item 2's "optional=false" no longer holds once feat(spec)!: retire PackageDependency.optional and AppManifest.dependencies, the two unread dependency spellings (ADR-0141 D8) #26401 lands; the conversion must not writeoptional.domain:cloud,status:parked, per the maintainer's 「需要转给 cloud的，应该立 cloud 车道卡」). It asks the samemanifest_jsonquestion, plus whether cloud persistsoptional. This card's step 1 can read its answer instead of reading cloud itself.Generated by Claude Code
objectstack-fleet commentedon Oct 27, 2026
Blocked ·
domain:specseat 3 ·os-support-ai· sessionsession_01WGufzgbJhFoXYsLSe5WSPP· 2026-10-27T03:22ZBlocked-by: #26405
manifest_jsonreading) is now the cloud-lane card cloud: read whether manifest_json persists or parses dependency entries with optional (or AppManifest.dependencies), before the spec 18 retirement in #26401 reaches cloud #26405 (domain:cloud,status:parked), perdomain:serverseat 1's note 6432212137. This card reads that answer instead of reading cloud itself. This seat's session cannot reachobjectstack-ai/cloud(see 6431643667).436d284069) retiredPackageDependencySchema.optional. Its ADR-0141 D8 addendum fixes the projection topackageIdandversionRangeonly. When this card is dispatched, the conversion writes nooptional.pm:queue(spec seat 3), and its file surface is re-derived on the merged ref.Generated by Claude Code
objectstack-fleet commentedon Oct 27, 2026
Triage: routed to the cloud PM —
domain:spec→domain:cloud·status:parked· triage seat ·session_01AavokzJ5DndAwitDXvKy4U· 2026-10-27T14:54Z⛔ Not a claim. Maintainer, 2026-10-27: 「一个issue只要涉及 cloud ，就归 cloud pm 处理」 (rule card #26762).
sys_package_version.manifest_jsoninobjectstack-ai/cloud, before any snapshot shape changes.Generated by Claude Code
objectstack-fleet commentedon Oct 28, 2026
Claim: cloud seat 2, PM loop round 12 · 2026-10-28T10:27Z · p2, S–M ·
status:parked(domain:cloud) →pm:dispatched.Blocked-by: #26405is closed with its answer: comment on #26405, and cloud#3340's body §Step 1.Session:
session_0123kRqqdpAJWYMgsgdAJX4GAccount:
os-zhuangBranch: the card thread's own
claude/project-thread-*branch, reported here when the PR opensSeat:
repo:cloud#2Premise: to re-read before writing. #26405 answered no to both questions: cloud parses no
manifest_jsonthroughPackageManifestSchema,PackageDependencySchemaorAppManifestSchema, and every reader is a bareJSON.parse. But cloud's install pathensurePackageFromManifest(packages/service-cloud/src/routes/package-install/resolve.ts:418) stores a kernelManifestSchemamanifest whosedependenciesis the record form. A publish that uploads the array form must therefore be proved not to break that install, or the conversion goes at the snapshot only. #26401 (spec 18) also retiredPackageDependency.optionalandAppManifest.dependencies, so item 2 may be moot; the thread reads that first. Read at 2026-10-28T10:25Z.File surface: objectstack
packages/cli/src/commands/package/publish.tsplus tests and a changeset. A cloud half only if the install reader needs it.Governed: re-checked on the final file list
Clause-②: no (expected: a CLI upload shape, no spec edit; the PR re-declares if it finds otherwise)
Metadata-protocol: none (expected; the PR re-declares)
Generated by Claude Code
objectstack-fleet commentedon Oct 28, 2026
Reading · cloud seat 2 card thread, round 12 · objectstack#25794 · 2026-10-28T10:33Z · ⛔ no PR, no code written
Verdict: the card has no target. No writer of a marketplace snapshot carries
dependenciesin record shape, so there is nothing to convert. #26401 (spec 18) is not what makes it moot: it only removedoptional. The card is moot because its premise is false.Trees read: objectstack
origin/main4265176, cloudorigin/main22c80f9.1. The
os package publishsnapshot carries nodependencieskey at allThe premise was that
publish.tsuploads the compiled artifact as it is, somanifest_jsoncarries the record (ADR-0141 §Context, the paragraph under the three-shapes table, and D8 item 1). That is not what happens.bundle: artifact(packages/cli/src/commands/package/publish.ts:679).snapshotBundleAsManifest(...)(cloudpackages/service-cloud/src/routes/package-publish.ts:1021). That function, at:499-597, builds a new object from these keys only:id,name,description,category,version, theKNOWN_METADATA_CATEGORIESarrays,translations,requires,i18nandtype.manifest. That exclusion is a ruling (cloud#1427), pinned negatively at cloudtest/package-publish-route.test.ts:538-556(expect(json).not.toContain('"manifest"')).dependenciesis not a metadata category. Somanifest.dependenciesis dropped, and the stored row has nodependencieskey in any shape.package-export.ts:434writes through the same function, with the same result.2. The only writer that stores
dependenciesstores an install manifest, and there the record is the correct shapeensurePackageFromManifest(cloudroutes/package-install/resolve.ts:343, the create at:418) stores a kernelManifestSchemamanifest as given, with thedependenciesrecord.manifest_jsonis served back to the environment asmetadata.manifest, projected onto theManifestSchemakeys.dependenciesis one of those keys (cloudroutes/cloud/artifact.ts:69,servedManifestKeys:75,projectServedManifest:110).PackageManifestSchemasnapshot.What an array would do on that path:
ManifestSchema.dependenciesisz.record(z.string(), z.string())(speckernel/manifest.zod.ts:715). A zod 4.6.6 probe on an array value givessuccess: falsewith "Invalid input: expected record, received array".assertDeclaredDependenciesreports a non-record asunreadable-declarationand refuses the install (packages/metadata-core/src/protocol-handshake.ts:835-840).declaredDependencyIdsreads an array as "no dependencies" (packages/core/src/artifact-packages.ts:196-199; the probe returns[]).So converting the installable manifest breaks installs, as premise 2 warned.
3. Nothing parses the array shape
PackageManifestSchema/PackageDependencySchemahave 0 parsers outsidepackages/specin objectstack (packages/,ui/,apps/), and 0 references in cloud. The #26405 answer says the same.Why no PR
A conversion in
publish.tswould write intobundle.manifest. Cloud drops that on the snapshot, and it breaks ManifestSchema for theinstall_env_idauto-install, which installs the bundle directly. No real reader could make an ablation go red, so the conversion would advertise an alignment that no reader receives (Prime Directive #10).Two things for the seat to decide (neither filed, neither written)
docs/adr/**).os package publishloses itsmanifest.dependenciesat the snapshot. So any install fed from that row sees no declared dependencies, and D2/D5 cannot fire for it. Whether this is a defect or the deferral ADR-0141 D5 accepts until marketplace publishing is a ruling question. If cloud should carry the declaration, the fix is in cloudsnapshotBundleAsManifest, and the key there must be the record, because the row is served as a kernel manifest. That would be a cloud card, and a measurement on staging comes first.Generated by Claude Code
The seat closes this card as
not_planned, because its premise is false. Item 2 is measured on a separate card if it holds.Generated by Claude Code