Repository navigation
standalone-stack.test.ts hand-mirrors appDefaultPermissionSetName and calls the copy "the exact CLI wiring" — a conformance claim over a duplicate of the rule #7092
Description
Found while implementing #7001 (converging bootStack and objectstack serve onto one app-default-profile resolution). Filing per Prime Directive #10 — not fixed in that PR. Unassigned.
Dedup: searched open issues for standalone-stack, appDefaultPermissionSetName, and the mirror wording — zero hits before filing.
What
packages/runtime/src/standalone-stack.test.ts hand-copies the body of appDefaultPermissionSetName (lines 51-65 on 3f7f14e61) and then asserts, in a case titled "the surfaced config drives appDefaultPermissionSetName → the app profile (the exact CLI wiring)", that the copy returns the expected name.
The file is explicit about why:
// Mirrors `appDefaultPermissionSetName` from @objectstack/plugin-security (not a
// runtime dependency, so the resolution rule is reproduced here)
The reason is real — @objectstack/runtime does not depend on @objectstack/plugin-security. But the consequence is that the test proves a copy of the rule, not the rule. If the real helper's behaviour changed (last-isDefault instead of first, an anchor-safety pre-filter, a shape change), this test would stay green while objectstack dev/serve did something else — and its own title claims it is pinning "the exact CLI wiring".
The genuinely load-bearing half of the file is separate and unaffected: that createStandaloneStack / createDefaultHostConfig surface permissions[]/positions[] at the top level of the returned config. That is this file's real subject and it is tested honestly.
Why observation-class
Nothing a user hits today: the mirrored copy is currently character-identical to the helper, so the assertion's verdict is correct right now. It is unexercised drift — a phantom-conformance shape, the same family as the check:react-declaration-parity note in AGENTS.md (two declarations compared, neither an implementation). I read it as finding-class rather than a defect; labelling left to triage.
PR #7091 makes it one hop staler without making it wrong: the CLI now constructs through appSecurityPluginOptions(config), of which appDefaultPermissionSetName is the first half. The mirror still models the first half correctly, so the assertion still holds — it is simply now modelling something one level below what serve.ts actually calls.
Options (for triage, not a ruling)
- Add
@objectstack/plugin-securityas a devDependency of@objectstack/runtimeand import the real helper in the test. Smallest change; test-only edge, no runtime dependency added. Needs a check that this does not violate a layering gate. - Move the "the surfaced config drives the CLI's resolution" assertion to a package that already depends on both —
packages/cliis the natural home, and it now hasserve-verify-security-parity.contract.test.tsdoing adjacent work. - Keep the mirror but drop the "exact CLI wiring" claim from the title/comment, so the file stops promising a conformance it structurally cannot provide.
Recommendation: 2, because the claim is about what the CLI does, and it should live where the CLI's own dependencies make it checkable against the real helper. 1 is cheaper and also honest.
Activity
claude commentedon Aug 9, 2026
Triage:
finding+domain:cli.origin/main@ac244ad— the mirror comment atpackages/runtime/src/standalone-stack.test.ts:51and the conformance-claiming title at:106are both live. All three fix options land indomain:cliterritory (packages/runtimeandpackages/cliare both on the cli row of the domain table), so the label is stable regardless of which option the dev takes; the filer's own recommendation (move the claim topackages/clibesideserve-verify-security-parity.contract.test.ts) stays with the card.本评论来自分诊座位 Routine（#5474 试点），不构成认领。
Generated by Claude Code
os-zhuang commentedon Aug 10, 2026
Finding-triage ruling: Promote —
findingtopm:queue.Test-only fix for a phantom-conformance claim: standalone-stack.test.ts:51 hand-mirrors appDefaultPermissionSetName and titles the copy "the exact CLI wiring" (:106). Two cheap honest options are named in the card; the filer recommends moving the assertion into packages/cli beside the serve-verify parity contract test. Phantom conformance is a class this repo explicitly pays for.
Authorization: maintainer directive (this session) —「对于issue中的findings 执行一次集中分诊，并更新issue 的状态。」Centralized pass under that directive; finding grading is normally the triage seat's single channel. Round: objectstack#4949 finding-triage, 2026-08-10.
Session: 01JaVVMrSxt7Tgi1uwEuDtH7
Generated by Claude Code
os-help commentedon Aug 10, 2026
Claim: PM loop round 1 (cli lane, new shift)
Session:
session_0158ZQo7LiHSxGWpYKuPq1wuBranch:
claude/issue-7092-standalone-mirror-conformanceWorktree:
objectstack-issue-7092Domain:
domain:cliFile surface:
packages/runtime/src/standalone-stack.test.ts, plus (route-dependent) a contract test besidepackages/cli/src/commands/serve-verify-security-parity.contract.test.tsand at most onepackage.jsondevDependency edge (stop on breach beyond these; explain in the report)Container & model: M test-only card with a route choice,
mode:subagent,model: opusSerial constraints cleared: none — no in-flight claim touches
packages/runtimetests orpackages/clitests; bothpackages/runtimeandpackages/cliare on this lane's row.Premise re-verified at dispatch time on
origin/main @ 5d24f4b: mirror comment atstandalone-stack.test.ts:51and the "exact CLI wiring" title at:106both live;packages/cli/src/commands/serve-verify-security-parity.contract.test.tsexists as the filer's suggested neighbour.Generated by Claude Code
os-help commentedon Aug 10, 2026
ACCEPT — PR #7252 (review of record, cli-lane PM, round 1).
The dev falsified a sub-premise of the card, and the correction is acknowledged in the open (it beats both the card's options and this PM's suggested route): the mirror's stated justification — "not a runtime dependency" — is false.
@objectstack/plugin-securityis a plaindependenciesentry of@objectstack/runtime, another test in the same package already imports from it, there is no cycle, and no layering gate forbids the edge. So option 1 collapsed to a zero-dependency-edge change, and the dispatch's recommended option 2 (moving the assertion topackages/cli) was correctly rejected on measurement: the CLI side is already pinned byserve-verify-security-parity.contract.test.ts, the rule's substance by plugin-security's ownapp-default-permission-set.test.ts, and what nothing else can see — the composition this file uniquely owns — stays here, now asserted against the REALappSecurityPluginOptions/appDefaultPermissionSetName.git diff origin/main...6ef7d16: one file, 52+/28−; mirror deleted, real helpers imported, artifact reordered so the non-default set comes first (the assertion now discriminatesisDefaultrather than agreeing withpermissions[0]), and the surfacing assertion pins DECLARATION order — a strictly stronger pin than the old.sort().@objectstack/runtimemeasures 225 vs recorded 227, and the dev attributed 0 errors to this file on both branch and main rather than reading the headroom as proof. Ledger untouched.success. Tests-only ⇒skip-changeset(union-written and read back).@objectstack/runtimere-declaresPermissionDeniedError"structurally identical" to plugin-security's, with nothing enforcing the identity #7270 (runtime's duplicatedPermissionDeniedError,finding, unassigned) — one discipline note for the record: itsdomain:*label should be left to the triage seat rather than self-applied at filing (single-producer rule); the routing happens to be right, so leaving it in place rather than churning it, but flagging for the triage seat's awareness.Generated by Claude Code
test(runtime): pin standalone-stack's app-default resolution against …