[PM seat] repo:cloud · seat 3 — 🟢 hotlong · on-demand #30278

Activity

1. objectstack-fleet

   assigned

   hotlong

   on Nov 5, 2026
2. objectstack-fleet

   added

   pm:seatSeat registry post — protocol carrier, not dispatchable work; the label page is the fleet boardSeat registry post — protocol carrier, not dispatchable work; the label page is the fleet board

   on Nov 5, 2026
3. objectstack-fleet commented on Nov 5, 2026

   

   objectstack-fleetBot

   on Nov 5, 2026

   ContributorAuthor

   More actions

   repo:cloud#3 · hotlong · session_01Q4EjjRhUZjdy8VXs6Kkur2

   Opening marker · repo:cloud#3 · hotlong · round R1 · 2026-11-05T04:34Z

   • Seated on: the maintainer's words in this session, 「开始派发处理 cloud 车道任务，并发5」 (batch:5).
   • Mutex readings: ① no stand-down brief (a new seat); ② no earlier opening marker; ③ no pm:queue or pm:dispatched card in the lane carries a Seat: repo:cloud#3 claim; ④ no closed card does either. Mutex clear. Seat 2 ([PM seat] repo:cloud · seat 2 — 🟢 os-zhuang #24145) is live and untouched.
   • Charter touches (objectstack origin/main eb6199b3): SKILL.md and .claude/agents/os-dev.md 232d3bb5, references/** 76dfe0ee; all read this session. check-harness-current: CURRENT at HEAD eb6199b39b.
   • Round plan: claim and dispatch five cards (cloud#3598, cloud#3596, cloud#3585, cloud#3586, Cloud sign-up: the first-organization dialog opens with an empty name. Prefill a default (from a work-email domain, else 「<name>的组织」) so one click continues (cloud#3559 ruling A) #30136). The rest of the queue is held, and the reason for each is in the round report.
4. objectstack-fleet commented on Nov 7, 2026

   

   objectstack-fleetBot

   on Nov 7, 2026

   ContributorAuthor

   More actions

   repo:cloud#3 · hotlong · session_01Q4EjjRhUZjdy8VXs6Kkur2

   Stand-down brief · repo:cloud#3 · hotlong · round R7 closes · 2026-11-07T07:31Z

   • Stood down on: the maintainer's words, 「当前任务处理完，合并后就下班」. Every in-flight PR of this seat is merged or handed to the maintainer (Dataset order sorts a select/lookup dimension by its stored value, not the label the user reads #3680, docs(adr): ADR-0069 amended in place — per-organization overrides live in the settings tenant rung #31041 governed; feat(plugin-auth, service-settings)!: the access policy is set per organization, with three MFA levels #31013 over the human-merge line). No claim of this seat is left with a running dev.

   维护者速读

   本轮（R6 后半到 R7）cloud 车道合并了 13 个 PR，立了约 30 张卡，所有带裁决的事项都已记在各自卡上。还剩 3 个 PR 等你放行（2 个受治理，1 个超过人工合并线），CLI 发版还要继续按住，另有几件部署和运维动作要你来做，见下方「等维护者」。下一轮从「下一轮」那张清单开始。

   Landed this round (merged):

   • cloud: fix(ci): dogfood gate passes cancelled runs through — a cancelled matrix is not a failed one #3671 (audit retention), feat(analytics): cross-object grouping via FK-expand + generateSql scope preview (#3654 residual 2 + capability) #3672 (SCIM mock), fix(analytics): apply the effective date granularity to labels and drill ranges (#3588 follow-up) #3673 (SSO mock), feat(lint): page-component field bindings + non-dashboard chart bindings (#3583) #3684 (MCP door rules), docs(liveness): stop counting authoring/preview renderers as runtime consumers (#1878) #3685 (MCP sample-data removal), fix(auth): close the sso/scim parity hole; provision sys_scim_provider.provider_key (#3653) #3688 (approval pins), service-storage success bodies are three shapes, none carrying success: true — the other half of #3675 #3689 (catalog taxonomy, pin 90523379), 多租户缺陷:unique 物化为全局唯一索引、无视 tenancy,与按租户分裂的 autonumber 序列自相矛盾(跨租户必然撞号 + 存在性探测泄露) #3696 (hosted package persistence pin).
   • objectstack: feat(cli): os deploy — the managed-package dev loop in one command; installs pick the only environment, keep it across login, and refuse before any write #30933 (os deploy), feat(spec): a field declares the key(s) it was renamed from — renamedFrom on FieldSchema #30934 (renamedFrom), feat(spec)!: one marketplace taxonomy — business functions, industries, a solution type and maturity replace the single category #30980 (marketplace taxonomy), feat(spec,i18n): register the delete_package platform tool and label it in every pack (cloud#3656) #31037 (delete_package tool name), fix(spec)!: spell the seven multi-word taxonomy values as identifiers so a select can carry them #31078 (taxonomy identifiers).
   • Maintainer-merged: docs(adr): ADR-0146 amended in place — an upgrade plan may report a .custom override that hides a vendor change, as advice only #30899 (ADR-0146).

   Awaiting the maintainer:

   1. Merge the governed PRs (Tier H, contract review PASS): objectstack-ai/cloud#3680 (rollback reuses the built image) and docs(adr): ADR-0069 amended in place — per-organization overrides live in the settings tenant rung #31041 (ADR-0069 amendment).
   2. feat(plugin-auth, service-settings)!: the access policy is set per organization, with three MFA levels #31013 (per-organization access policy) is over the human-merge line (4058 lines > 3000). The queue ejected the seat's enqueue twice. It is back in draft, auto-merge is off, it carries pm:awaiting-merge, and review is requested from os-zhuang. Contract review is PASS (6695328434, then 6702665651 on the merged head), and CI is green. To land it: an APPROVED review from os-zhuang (the seat then lands it), or your own "Merge when ready". After it lands, the seat closes out Access policy per organization: allowed IP ranges, session idle/absolute/concurrent limits and an MFA requirement of off / administrators / everyone, with the deployment value as default and floor #30922 (its landed note is drafted).
   3. The CLI release stays held (do not merge chore: version packages) until cloud#3661's follow-up is deployed: the selects plus the re-map after the respell fix(spec)!: spell the seven multi-word taxonomy values as identifiers so a select can carry them #31078.
   4. Deploy cloud#3689, then run migrate-package-categories as a dry run and then --apply, with OS_REGISTRY_*, on staging then prod. Re-run the connector shelf script.
   5. hotcrm's objectstack.manifest.json: replace category: crm with facets before the CLI release. This seat has no hotcrm write access.
   6. Delete the merged branch claude/issue-3667-scim-mock-lifecycle (cloud#3672). The seat's delete was refused by the session classifier and not worked around.
   7. Standing: the IdP test tenants (checklist on cloud#3666), the docs PR on cloud#3642.

   Next round (in priority order; the claims are released or never taken):

   • p1: cloud#3661 follow-up (pin past fix(spec)!: spell the seven multi-word taxonomy values as identifiers so a select can carry them #31078; selects, translations and re-map; the S1/S3 carry-overs); cloud#3686 (merge main, pin past feat(spec,i18n): register the delete_package platform tool and label it in every pack (cloud#3656) #31037, review, land).
   • p2:
     • cloud#3694 (re-measure on the hosted slate first: the reading may be a rig artifact);
     • cloud#3681 (after Dataset order sorts a select/lookup dimension by its stored value, not the label the user reads #3680);
     • cloud#3697 (rig default to the hosted slate);
     • objectstack#31011 (console facets), spec liveness: template_manifest keys nothing reads (name, specVersion, skills, scaffold, visibility, publisher, isStarter) — enforce or remove under ADR-0049 #31035, spec: a distinct() refinement on array schemas is dropped from the JSON Schema projection — emit uniqueItems so the taxonomy facets keep their no-duplicates rule #31036, Marketplace listing shows which languages an app actually supports, derived at publish with coverage, and can be filtered by language #30284 (after 元数据面未做字段级权限掩码：/meta 返回完整 fields，导入模板列不受 FLS 约束，客户端 field.permissions 守卫是死代码 #3661);
     • runtime: export the disable door's dependent-validation-rule verdict for host doors, so a host that removes a package another way answers the same 409 #31067 → cloud#3693;
     • auth follow-ups of #30922: an org admin cannot read the judged client address before saving an IP list, and the console MFA notices over sys_organization.require_mfa are inert #31030 (auth follow-ups S6/S7/D1/D2/D3).
   • Blocked:
     • cloud#3604 (@objectstack/scenarios ships .ts-only exports, so a consumer's built entry cannot load ./score (ERR_MODULE_NOT_FOUND) or must inline it; give it a minimal unpublished build step and a narrow scorer entry #30915), [RETRACTED — not a regression] cloud service-ai embedder failure was a local build artifact, not f1a8114 #3665 (Data export writes no sys_audit_log row and the export action value is retired, so no export of any object (the audit ledger included) can be audited #30955), feat(lint): reference-integrity validation for object and action names (#3583) #3657 (seed loader: a declared seed row a person deleted comes back under a new id at the next seed replay — record landed keys per organization and skip the ones now absent #31021), test(auth): cover the lock itself and its expiry, not just the counter (#3624 follow-up) #3667 (plugin-auth: no door mints a SCIM connection bearer (mintScimConnectionCredential has no caller and the object refuses create), so no IdP can connect #30958), Enumerate the /auth/** dynamic route family — 54 SDK methods rest on a prefix claim, not a route #3656 ([P2] AI scope keys declared but unenforced: skill.permissions + agent.knowledge (enforce-or-prune) #3686);
     • cloud#3666 (cloud#3678, held by repo:cloud#1);
     • cloud#3619/feat(client): close the final 17 REST gaps — ratchet 17→0 (#3587 batches 4+5/5) #3633 (spec: a blueprint field cannot carry a default value, so a boolean flag built by AI starts empty instead of false (cloud#972 guidance is silently dropped) #30584);
     • cloud#3668 (Settings config_change audit records only a digest of the new value, so a policy change's before and after cannot be read from any door #30923/plugin-auth writes no audit row when policy refuses a sign-in (IP allow-list 403, MFA_REQUIRED hold), so no enforcement report can be built #30924, and Access policy per organization: allowed IP ranges, session idle/absolute/concurrent limits and an MFA requirement of off / administrators / everyone, with the deployment value as default and floor #30922 until feat(plugin-auth, service-settings)!: the access policy is set per organization, with three MFA levels #31013 lands).
   • domain:server cards filed by this seat (Data export writes no sys_audit_log row and the export action value is retired, so no export of any object (the audit ledger included) can be audited #30955, plugin-auth: no door mints a SCIM connection bearer (mintScimConnectionCredential has no caller and the object refuses create), so no IdP can connect #30958–plugin-auth: SCIM-driven writes leave sys_audit_log rows with actor, user_id and metadata null, so no audit row names the SCIM connection that acted #30960, plugin-auth SSO: every OIDC and SAML refusal answers one opaque error (token_not_verified / Invalid SAML response), so an admin cannot tell expiry, audience, issuer or key apart #30965–plugin-auth SSO: expose the operator knobs Enterprise SSO needs — IdP-initiated sign-in, IdP group to role / permission set, and refusing unknown users instead of JIT #30967, seed loader: a declared seed row a person deleted comes back under a new id at the next seed replay — record landed keys per organization and skip the ones now absent #31021–packages: DELETE /api/v1/packages/:id deletes unattributed (no actor), and the in-process deletePackage leaves the per-environment disable record behind #31023): routed to that lane, not this seat's to take.

   Lessons recorded:

   • Re-read a card's thread immediately before posting a claim. docs(adr): ADR-0106 — metadata-plane FLS, per-caller masking of object schemas (#3661 step ③) #3678 collided with repo:cloud#1; the claim was released before any work.
   • Rig measurements must use the hosted slate (HOSTED_FORCED_REQUIRES). Two "loss" readings this round were rig artifacts (cloud#3695, maybe feat(showcase): nav separator + badge specimens; correct the §3 item-8 verdict (#1878) #3694), hence cloud#3697.
   • Quote heredocs that carry backticks.