[finding] create-objectstack: non-blank remote templates fail first npm run build on published 16.1.0 — fix is at HEAD, needs 17.0.0 release + canary verification

Symptom

create-objectstack@16.1.0 (current npm latest) scaffolds a project from any non-blank published remote template, and its very first npm run build exits 2 with a namespace-prefix validation error. Reproduced on 4 independent templates in the QA run — todo / compliance / content / contracts (2 / 4 / 5 / 3 issues respectively); procurement was blocked(environment) (codeload 503/403 in the sandbox). The blank template is clean end to end. This triggers for any project name whose sanitized namespace differs from the template's own — i.e. every real user, and CI's own canary-app.

Root cause

Located, and already fixed at repo HEAD — the residual action is a release, not a repair.

Published 16.1.0 rewrites namespace: in objectstack.config.ts to the sanitized project name but not the object-name literals, because it reads the template's original namespace from objectstack.manifest.json only. A remote template's manifest is the template-registry document, which has no namespace key, so the guard falls through and the literal rewrite is silently skipped (config says namespace tpl_todo while the object literal still says name: 'todo_task').
The fix is present on origin/main (confirmed at filing time): packages/create-objectstack/src/rewrite-identity.ts makes objectstack.config.ts the authority and self-verifies via findStaleNamespacePrefixes, wired in at packages/create-objectstack/src/index.ts:311. The file's own comment names the prior incident fix(devx): init-service 门禁认全部服务访问器,不只 getService (#4835) #4902 ("all five published remote templates failed this way, and the nightly registry canary had been red on every one of them for weeks with nobody watching"). Pin packages/create-objectstack/src/rewrite-identity.test.ts is present (10/10 pass per the run).
Related prior code-bug issue: P0:5 个已发布模板对真实新用户是坏的 —— 脚手架的对象名前缀改写对所有远程模板静默跳过,夜间金丝雀连红 20 次无人察觉 #4926 (closed).

Reproduction

npx -y create-objectstack@latest canary-app -t todo --skip-skills --skip-install
cd canary-app &amp;&amp; npm install &amp;&amp; npm run build

Expected exit 0. Actual (with published 16.1.0) exit 2:

defineStack namespace-prefix validation failed (2 issues):
Object todo_label is missing the package namespace prefix.
Rename it to canary_app_todo_label (namespace = canary_app)

Residual asks (release-verification, not code repair)

Confirm the rewrite-identity.ts fix ships in the create-objectstack@17.0.0 release — npm latest is still 16.1.0, so every new user picking a non-blank template today gets a project that fails first build.
Confirm the nightly registry canary goes green once 17.0.0 is published.

Source

Extracted from the QA run #7628 (framework 92f26f7, console 6314e87).

Triage — dual-state resolution: finding + domain:cli + target:v17 kept; pm:queue removed (queue+finding is an illegal pair; one had to go).

Why finding, not queue: the code repair is already merged — verified on origin/main @ 5823d59: packages/create-objectstack/src/rewrite-identity.ts exists with the fix(devx): init-service 门禁认全部服务访问器,不只 getService (#4835) #4902 account in its header, wired at index.ts:311 (findStaleNamespacePrefixes). The residual asks (confirm the fix ships in create-objectstack@17.0.0, confirm the nightly canary goes green) are release-time verification steps — nothing is dispatchable to a dev today. Restart condition: the 17.0.0 cut; this card is the checklist entry for it.
target:v17 ratified by this seat (the label arrived at filing from the QA seat; target:* production for this backlog is the triage seat's — ratifying rather than stripping because the judgment is correct on the merits): published latest failing first build on every non-blank template is blocking class ④ (first-hour, follow-the-docs failure). The release-verification framing is exactly what the board's cut-time sweep consumes.
Routing: packages/create-objectstack ⇒ domain:cli per the domain table.
Dedup: P0:5 个已发布模板对真实新用户是坏的 —— 脚手架的对象名前缀改写对所有远程模板静默跳过,夜间金丝雀连红 20 次无人察觉 #4926/fix(devx): init-service 门禁认全部服务访问器,不只 getService (#4835) #4902 are the closed code-bug predecessors; no open card tracks the release-verification residual besides this one.

本评论来自分诊座位 Routine（#5474 试点），不构成认领。

Generated by Claude Code

Findings triage round, 2026-08-11 (PM session, maintainer-directed: 「跑一轮集中定级」).

Graded: promote. First-npm run build failure on every non-blank template for every real project name is release-blocker class ④ (first-hour experience), and the card already carries target:v17. Scope note: the fix is at HEAD, so the queued work is the canary verification once 17.0.0 ships — the release act itself is the maintainer's, per the human-release guardrail; this card must not be read as authorizing any publish.

finding → pm:queue (domain:cli, stays on the v17 board).

Generated by Claude Code

Hold — 2026-08-13 (domain:cli execution seat, round 1). pm:queue → pm:on-hold. Stays on the v17 board (target:v17 unchanged).

Reason: there is nothing dispatchable here today, and the blocking step is not an agent's to take. The grading round that promoted this to pm:queue said so itself — "the queued work is the canary verification once 17.0.0 ships" — but the release has not happened, so the card has been sitting in the dispatchable pool advertising work no dev can do. Measured just now:

$ npm view create-objectstack version dist-tags
version = '16.1.0'
dist-tags = { latest: '16.1.0', rc: '17.0.0-rc.6' }

latest is still the broken 16.1.0; 17.0.0 exists only as rc.6. Cutting the release is the maintainer's act under the human-release guardrail — no AI seat may run changeset publish, push a version tag, trigger a release workflow, or merge the Version Packages PR. So the honest state is "decision made, answer is not now", which is pm:on-hold, not pm:queue.

Restart condition (mechanically checkable): create-objectstack dist-tag latest reaches 17.0.0 or higher.

npm view create-objectstack version dist-tags     # restart when latest >= 17.0.0

On restart the queued work is exactly the two residual asks in the body, both verification and neither repair:

Confirm the rewrite-identity.ts fix ships in the published 17.0.0 — scaffold a non-blank remote template and check the first npm run build exits 0.
Confirm the nightly registry canary goes green.

Nothing about this hold questions the grading: first-npm run build failure on every non-blank template for every real project name is release-blocker class ④, the target:v17 label is correct, and this card remains the board's checklist entry for the cut. It is held because it is waiting on a human, not because it is unimportant — and it should be picked up at the cut without needing to be re-found.

Generated by Claude Code

Restart condition met — pm:on-hold → pm:queue.

v17.0.0 is GA. Measured on the npm registry at 2026-08-14 08:3xZ:

@objectstack/spec   latest = 17.0.0   published 2026-08-14T07:59:51Z
@objectstack/cli    latest = 17.0.0   published 2026-08-14T07:59:10Z
@objectstack/core   latest = 17.0.0   published 2026-08-14T07:59:15Z
create-objectstack  latest = 17.0.0   published 2026-08-14T07:59:14Z

This card's hold recorded a mechanically checkable restart condition: "create-objectstack dist-tag latest reaches 17.0.0 or higher". It has:

$ npm view create-objectstack dist-tags
{ latest: '17.0.0', rc: '17.0.0-rc.6' }

The queued work is exactly the two verification asks the hold named, neither of them repair:

Confirm the rewrite-identity.ts fix ships in the published 17.0.0 — scaffold a non-blank remote template, check the first npm run build exits 0.
Confirm the nightly registry canary goes green.

target:v17 left unchanged — the board entry is the grading seat's to retire once the canary reads green.

Authorization: maintainer directive (this session) —「先做 23 张 blocked 解锁 10 张 on-hold 按各自自述处理」· PM session 01JaVVMrSxt7Tgi1uwEuDtH7

Generated by Claude Code

test(publish-smoke): build the scaffolded project, and assert its ide…

Navigation Menu

Repository navigation

[finding] create-objectstack: non-blank remote templates fail first `npm run build` on published 16.1.0 — fix is at HEAD, needs 17.0.0 release + canary verification #7644

Symptom

Root cause

Reproduction

Residual asks (release-verification, not code repair)

Source

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

[finding] create-objectstack: non-blank remote templates fail first npm run build on published 16.1.0 — fix is at HEAD, needs 17.0.0 release + canary verification #7644

Description

Symptom

Root cause

Reproduction

Residual asks (release-verification, not code repair)

Source

Activity

os-zhuang commented on Aug 11, 2026

os-zhuang commented on Aug 11, 2026

os-zhuang commented on Aug 13, 2026

claude commented on Aug 14, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

[finding] create-objectstack: non-blank remote templates fail first `npm run build` on published 16.1.0 — fix is at HEAD, needs 17.0.0 release + canary verification #7644