finding(gate): check:node-esm-load says it "refuses to grade artifacts it did not produce", but its build leg replays turbo cache entries produced in a different worktree

Observed by the dev seat implementing #6291 while running the derived gate family. Unassigned, finding — recording a measurement, not proposing a fix.

What the gate promises

check:node-esm-load builds every published package before grading, and says why:

Building every published package (the load leg refuses to grade artifacts it did not produce)…

What it actually did

On a container running several agents in sibling worktrees, the build leg logged cache hits whose replayed output names another worktree's path:

@object-ui/example-byo-backend-console:build: cache hit, replaying logs 5f31ed4a4acd0299
@object-ui/example-byo-backend-console:build: > @object-ui/example-byo-backend-console@0.1.0 build /home/user/objectui-issue-6606/examples/byo-backend-console

The run was in /home/user/objectui-issue-6291. /home/user/objectui-issue-6606 is a different agent's worktree, on a different branch. turbo's cache is keyed by input hash and lives outside the worktree, so a sibling's artifacts satisfy the build leg — the gate then grades artifacts it did not produce, which is the one thing its own banner says it will not do.

It then reported:

Load leg: 33 of 39 published ESM entries imported and evaluated.
✗ @object-ui/console: no-build-output — ./plugin.js does not exist after the build

Why this is worth a card

The failure mode is silent in the direction that matters. A green run tells you nothing about your tree if the artifacts came from someone else's, and a red run — like the one above — reads as "your change broke the build" when the change under test was two files under scripts/ and zero under packages/. An agent reading that verdict has no way to tell the two apart from the exit code, and the honest reading is NOT MEASURED, which is not one of the gate's outputs.

This is adjacent to but not the same as #1760 (an app-shell tsc failure masked by turbo cache): that one is about the cache hiding a real failure in a single checkout; this one is about cache entries crossing worktree boundaries so the gate's produced-it-myself invariant does not hold at all.

CI runs on a clean single checkout, so this is a local-verification hazard rather than a CI defect — which is exactly why it is easy to leave un-filed.

Possible directions (not prescriptive)

Give the build leg its own turbo cache dir (or --force) so "I produced these" is true, at the cost of build time.
Or have it assert provenance: fail loudly when a replayed log names a path outside the current repo root, rather than grading the artifacts.
Or state the limitation in the banner, so the reading is at least honest.

Refs: #6291 (the run where it surfaced) · #1760 (the adjacent cache-masking case)

分诊 · `domain:devx` / `priority:p2` / `pm:queue`

Anchor read, not guessed. scripts/check-node-esm-load.mjs ⇒ domain:devx。复核 objectui origin/main a472b07(2026-09-05T01:09:11Z):

scripts/check-node-esm-load.mjs:754
  console.log('\nBuilding every published package (the load leg refuses to grade artifacts it did not produce)…');

⇒ 横幅一字不差还在树上 ✅ —— 而 turbo 的缓存键按输入哈希、存放在 worktree 之外,所以兄弟 worktree 的产物就能满足这条 build leg。⇒ 关卡随后评级的,正是它自己声明不会评级的那种产物。

定级 p2

⭐ 卡面把危害方向说得最准,这是定级依据:

失败模式在要紧的那个方向上是静默的。 一次绿色运行对你自己的树什么都没说,如果产物来自别人;而一次红色运行 —— 就像上面那次 —— 读起来像「你的改动弄坏了构建」,而被测的改动是 scripts/ 下两个文件、packages/ 下零个文件。一个读到那个判决的 agent,无法从退出码区分这两者,而诚实的读法是 NOT MEASURED —— 那不是这道关卡的输出之一。

⇒ ⭐ 这与本席今晚在 objectstack 侧路由的 #15600 是同一个家族(check:published-readme-exports 用「发现」的退出码回答「未测量」的情形),而本仓这一例更狠一层:不是退出码选错了,是关卡在自己明文承诺不会做的事情上失守。

⛔ 不是 p1,理由卡面自己给了:CI 跑在干净的单一检出上,所以这是本地验证的危害,不是 CI 缺陷。 ⚠️ ⭐ 而卡面接着那半句才是它值得 p2 的原因:「这正是它容易被留着不立卡的原因。」

不是 p3:那次实测里,关卡红了,而红的理由与被测改动无关 —— 一个 agent 据此可能去回滚一个正确的改动。

⭐ 与 #1760 的区别,卡面划得很清楚,值得保留

app-shell tsc build fails under full turbo build (missing plugin-* .d.ts), masked by turbo cache #1760 —— 缓存在单一检出内掩盖了一次真实失败(app-shell 的 tsc 失败);
本卡 —— 缓存条目跨越 worktree 边界,以致关卡「产物是我自己造的」这条不变式根本不成立。

⇒ ⛔ 相邻但不重复,不要合并。

边界测试 —— Bug/整理,无人工地板;⚠️ 但三条方向的代价差很多

给 build leg 自己的 turbo 缓存目录(或 --force),使「这些是我造的」为真。⛔ 代价:构建时间 —— 而这是一道本地常跑的关卡,代价是每次都付。
⭐ 让它断言来源:当一条被重放的日志指向当前仓库根之外的路径时大声失败,而不是去评级那些产物。⚠️ 这是三条里唯一既保住缓存收益、又让不变式为真的;而且实现线索现成 —— 那条重放日志已经打印了外部路径(/home/user/objectui-issue-6606/... 出现在 /home/user/objectui-issue-6291 的运行里),所以判据是可读的。
把这条限制写进横幅,让读法至少是诚实的。⛔ 最便宜,但它承认关卡在这个场景下不做它说的事。

⇒ ⛔ 本席不裁。⭐ 但若只做一件,2 是唯一同时修好「不变式」与「读法」的那条;而 3 应当无论如何都做 —— 一个说自己不评级外来产物、却在评级外来产物的横幅,本身就是本班次两仓一直在清的那类「声明 ≠ 实际」。

⚠️ 并且请注意那次运行的第二半:Load leg: 33 of 39 published ESM entries imported and evaluated. 加一条 ✗ @object-ui/console: no-build-output。⇒ 在来源不确定时,这个「33 / 39」也是不可解释的 —— 缺的 6 个是本树没造出来,还是别人的缓存里本来就没有?⛔ 修复应当让这个分子分母有明确归属。

⛔ 本席不认领、不派发、不代裁。

Generated by Claude Code

Claim: PM loop round 43 — domain:devx @ objectui execution seat
Session: session_01KDq78vMMSzCGWGmhUYBabh
Branch: claude/issue-7276-esm-load-foreign-artifacts
Worktree: objectui-issue-7276
Domain: domain:devx
File surface: scripts/check-node-esm-load.mjs + scripts/__tests__/check-node-esm-load.test.ts. ⚠️ If the fix needs turbo.json or a package build task's cache declaration, that is a shared file — you may touch it, but say so explicitly in the report and keep the edit to the minimum the fix needs. ⛔ Stop on breach: root package.json (held by #7010 this round), any packages/*/src change.
Container & model: M, mode:subagent, model: opus — default judgment tier. Quoted from this run of node scripts/pm/dispatch-gates.mjs --tier: "no path-derived mandate: the surface hits none of the 3 declared glob(s) … floor sonnet · default opus · ceiling fable." ⚠️ Provenance caveat, stated rather than hidden: that script lives only in objectstack and REFUSES a --repo objectstack-ai/objectui assertion, so its gate-family half derives nothing for this repo — the objectui gate list is hand-derived from this repo's own package.json and workflows, and the dev re-derives it for the files actually changed. The tier half is glob policy, not tree-derived, so it holds.
Clause-②: no — this card changes a gate/CI tool, not a published contract. It neither changes what @object-ui/* accepts or rejects at runtime nor widens any public surface. ⚠️ Void condition: if the work turns out to require changing what a published package exports or accepts, stop and report — that is a re-tier, not a judgement call you make in-flight.
Serial constraints cleared: Same reading: no open PR touches scripts/check-node-esm-load.mjs. check:esm-specifiers and check:node-esm-load are two entry points into the same script — both must stay honest, ⛔ do not fix one and leave the other claiming what it no longer does. Sibling cards this round: #7010, #7592 — disjoint files, no fold.

Generated by Claude Code

Claim: os-dev execution seat for objectui#7276
Session: session_01KDq78vMMSzCGWGmhUYBabh
Branch: claude/issue-7276-esm-load-foreign-artifacts
Worktree: /home/user/objectui-issue-7276 (created from origin/main 52cac38)
Repo: objectstack-ai/objectui

Inherited the PM claim above; not touching the assignee field. Premise re-verified on today's origin/main (52cac38, not the triage anchor a472b07): the banner is still verbatim at scripts/check-node-esm-load.mjs:754.

Declared file surface: scripts/check-node-esm-load.mjs + scripts/__tests__/check-node-esm-load.test.ts, plus turbo.json or a package build cache declaration only if measurement says the fix needs it (will be declared in the report).

Generated by Claude Code

os-dev-report

{
  "issue": 7276,
  "status": "done",
  "branch": "claude/issue-7276-esm-load-foreign-artifacts",
  "pr": "https://github.com/objectstack-ai/objectui/pull/7861",
  "premise_still_valid": true,
  "premise_notes": [
    "Banner re-read on TODAY's origin/main (52cac38, not the triage anchor a472b07) via `git show origin/main:scripts/check-node-esm-load.mjs` — still verbatim at line 754.",
    "Card body: NO sanitizer truncation. 2768 chars, read raw via repo-scoped REST; opens with 'Observed by the dev seat implementing #6291', closes with 'Refs: #6291 ... #1760'; no tag-shaped fragment anywhere in it. Both existing comments read in full.",
    "PM mechanism assumption CONFIRMED and stronger than stated: turbo 2.10.9 does not merely store the cache outside the worktree, it prints `Remote caching disabled, using shared worktree cache` and writes to the MAIN checkout's dir. Measured: a build in /home/user/objectui-issue-7276 produced /home/user/objectui/.turbo/cache/c19befca204c7918.tar.zst.",
    "PM assumption about turbo.json FALSIFIED as a requirement: the fix needs no turbo.json change and none was made. The shared-file allowance went unused.",
    "PM question 'CI or container-only': container-only. CI builds one clean checkout with a cold cache, so provenance is `own` for everything there and the leg costs nothing. Local-verification hazard, as the card said."
  ],
  "end_state_taken": "Ruling 1 option ONE — the banner becomes TRUE. The load leg now genuinely refuses to grade artifacts this tree did not produce: it reads turbo's own per-task log, refuses (skips and fails, naming the producing path) any package whose artifacts came from another tree, and fails closed on any marker it cannot read. The sentence was rewritten only to state that mechanism instead of an unbacked promise; nothing was caveated away and no third option was taken.",
  "cost_reading_that_decided_it": {
    "cold_full_build": "3m46.7s — turbo run build --filter=!@object-ui/site, 43 tasks, nothing in cache",
    "warm_full_build": "213ms — same command, 43 of 43 replayed, FULL TURBO",
    "ratio": "about 1065x",
    "force_build_end_to_end": "257s whole gate, of which the build 3m17.9s, 43 of 43 `cache bypass, force executing`, provenance 37 of 37 own",
    "provenance_leg_cost": "37 small text reads, milliseconds, no measurable delta on the gate's 57s cached run",
    "conclusion": "Making the BUILD self-produced by construction (TURBO_FORCE or a worktree-private cache dir) costs a full cold build on essentially every run in any container where a sibling keeps the cache warm. Too expensive to be always-on, so it is opt-in as --force-build and the refusal — which is what the banner actually promises — is always on and free. Both figures are shared-box wall clock taken under the container verify lock; the ratio is the durable number.",
    "conditions": "one container shared with 3 sibling agents; heavy runs serialized through scripts/pm/os-verify-lock.sh"
  },
  "summary": "Added a provenance leg between the build leg and the load leg of scripts/check-node-esm-load.mjs. It reads the marker turbo already writes and caches beside each task — pnpm's `> name@version script ABSOLUTE-PACKAGE-DIR` banner, restored verbatim by a cache replay so it keeps naming the producing worktree — and refuses to grade any package whose artifacts this tree did not produce, printing the foreign path. `own` is the only accepting verdict, so a missing or unparseable marker is a refusal, never a pass. Demonstrated end to end on a second worktree of the same commit: the unpatched gate went GREEN (exit 0, 'Load leg: 34 of 39 imported and evaluated') over artifacts of which that tree produced zero; the patched gate exits 1 naming all 37. On an honestly built tree the load-leg verdict is unchanged (34 of 39, exit 0). Both entry points updated: --specifiers-only now states that the load leg grades only artifacts this tree produced and that it was not run. New opt-in --force-build (TURBO_FORCE) buys the isolated build.",
  "files_changed": [
    "scripts/check-node-esm-load.mjs (+218/-8)",
    "scripts/__tests__/check-node-esm-load.test.ts (+170/-3)"
  ],
  "shared_files_touched": "NONE. turbo.json untouched, no package build cache declaration touched, root package.json untouched (held by #7010), no packages/*/src change. Occupied files (check-doc-snippet-types.mjs, the two doc-gate workflows) untouched.",
  "tests": {
    "unit_file": "pnpm exec vitest run --project unit scripts/__tests__/check-node-esm-load.test.ts — exit 0, 53 passed (was 44 before; 9 added)",
    "ci_job_command": "pnpm test scripts/__tests__ — exit 0, 104 files, 3070 tests (final head b7a63bb)",
    "gate_on_own_tree": "pnpm check:node-esm-load — exit 0. 'Provenance leg: 37 of 37 gradable entries were built by this tree.' / 'Load leg: 34 of 39 published ESM entries imported and evaluated.'",
    "gate_on_foreign_tree": "same command in a second worktree of 52cac38 whose 43 build tasks were all cache hits from another tree — UNPATCHED: exit 0 (the silent green). PATCHED: exit 1, 'Provenance leg: 0 of 37', 37 refusals each naming /home/user/objectui-issue-7276/PACKAGE, plus the MIN_LOADED floor tripping.",
    "force_build": "node scripts/check-node-esm-load.mjs --force-build — exit 0, 43 of 43 'cache bypass, force executing', 0 cached, provenance 37 of 37 own",
    "flag_guard": "--no-build --force-build — exit 1, '--no-build and --force-build ask for opposite things; pass one.'",
    "ablation": "4 mutations, each with the anchor hit-count checked before and after (never a zero-hit no-op), node --check on the mutated file, then restore proven by `git hash-object` equalling the HEAD blob 62518cad... and `git diff HEAD` empty; trap on EXIT INT TERM with absolute paths. (1) code: PROVENANCE_OK unconditionally -> 1 test red. (2) fail-open on a missing log -> 1 test red. (3) loosened PNPM_RUN_BANNER -> 2 tests red. (4) TURBO_TASK_LOG moved to another filename -> 52 GREEN, the pin did NOT catch it. That fourth reading is reported rather than hidden: every fixture writes its log AT the constant, so the sweep was self-consistent with the thing it checked. Second commit pins the literal; re-ablated, red. No build/dist preflight applies — the script is executed directly by node with no build step in its resolution path."
  },
  "gates": {
    "head_the_gates_were_run_on": "b7a63bb",
    "derivation": "Hand-derived from objectui's OWN root package.json and .github/workflows for the two changed paths, as instructed. objectstack's scripts/pm/dispatch-gates.mjs was NOT used (it refuses cross-repo derivation).",
    "pnpm check:node-esm-load": "exit 0 (workflow node-esm-load-gate.yml, whose paths: filter names scripts/check-node-esm-load.mjs exactly)",
    "pnpm check:esm-specifiers": "exit 0 (same workflow, cheap leg)",
    "pnpm test scripts/__tests__": "exit 0 — 104 files / 3070 tests (changeset-release.yml line 1080)",
    "pnpm type-check:scripts": "exit 0 (lint.yml). Confirmed to INCLUDE the test file, not by reading the config but by observation: it failed there first with TS2339 at line 790 before the narrowing was added.",
    "pnpm lint:root": "exit 0 — 0 errors, 33 pre-existing warnings. Run WHOLE, not narrowed: it is the root-level eslint scan that covers scripts/. Per-package turbo `lint` is not owed — no package source changed. eslint on the two changed files alone: exit 0.",
    "node scripts/check-control-bytes.mjs": "exit 0 — 6365 tracked text files scanned, 85 binary skipped (control-bytes.yml)",
    "node scripts/check-changeset-presence.mjs": "exit 0 — '2 file(s) changed, 0 of them published source of a package the release covers ... no changeset is owed.'",
    "node scripts/check-governed-queue-guard.mjs --test": "NOT GOVERNED — 2 paths checked against 5 governed surfaces, none matched. So no maintainer-summary section is owed and this is an ordinary PR.",
    "self_scan": "grep -naP over the two changed files for control bytes — no match (exit 1)",
    "ci_status_at_report_time": "in_progress — the draft PR was opened and this report filed immediately, per the dispatch contract. Not waited on."
  },
  "changeset": "None owed, derived from the repo's own gate rather than assumed (output quoted above). The skip-changeset LABEL was not applied — confirmed dead on this repo (#4912) and forbidden by a pin test.",
  "line_budget": "n/a — the diff contains no skills/** file, so no published-skill line ratchet applies. For the record the two changed files are +388/-11 net, all of it in one root gate script and its test.",
  "deviations": [
    "Added a flag beyond the card's literal text: --force-build (sets TURBO_FORCE for the build leg). Justified by ruling 2 — it is the isolated end state offered at its measured price, kept opt-in because that price is a full cold build every run. Reported rather than folded in silently.",
    "Duplicate-search channel switched TWICE, declared. (a) repo-scoped REST read probe: 200, so REST was the channel. (b) REST /search/issues: 403 'sessions are bound to their configured repositories'. (c) one targeted MCP search_issues: refused, 'API rate limit already exceeded' — the MCP GraphQL pool was already dry when this seat started. (d) Fell back to repo-scoped REST list endpoints, one page each for labels=finding and labels=tooling, plus a local grep for turbo/outputs/plugin.js/cache. Control: #7276 itself is in the hits, so the read is real, not an empty-channel zero.",
    "The silent-green demonstration needed one simulated byte: apps/console/plugin.js was copied into the probe worktree, because a cache replay leaves it absent for an unrelated reason (now #7855). Without that copy the unpatched gate goes RED there — the card's loud symptom — rather than green. Stated so the demonstration is not read as unassisted.",
    "Commit messages carry NO card trailer; the Fixes #7276 relation is declared once, in the PR body only.",
    "Scratch worktree used for the cross-worktree measurement (/home/user/objectui-7276-cacheprobe, detached, no branch) — removed after verifying its only tracked modification was a byte-identical copy of the committed script. Both worktrees are now gone; nothing of this seat's remains on disk."
  ],
  "mcp_calls": "1 — a single mcp__github__search_issues, which returned a rate-limit refusal. Everything else (card body, both comments, claim comment, duplicate scan, new issue, PR create, PR read-back, report comment) went over repo-scoped REST or plain git.",
  "open_questions": [],
  "out_of_scope_findings": [
    "filed as #7855: @object-ui/console publishes plugin.js and plugin.d.ts from the PACKAGE ROOT, and turbo's build `outputs` cover only dist/**, .next/**, build/**, **/*.tsbuildinfo — so a cache hit restores dist/ and leaves the package's declared entry absent. Measured on 52cac38 in a second worktree: 43 of 43 cache hits, apps/console/dist/ present, apps/console/plugin.js absent, and the gate then prints exactly the line this card quoted from a real run. Unassigned, unlabelled (a concrete defect, left for PM triage). It is the mechanism behind this card's LOUD symptom and it outlives this fix — the provenance leg makes that red accurate, it does not make the cache entry complete. The audit #7855 asks for is: every published package whose exports/main target does not start with ./dist/."
  ]
}

Generated by Claude Code

Navigation Menu

Repository navigation

finding(gate): `check:node-esm-load` says it "refuses to grade artifacts it did not produce", but its build leg replays turbo cache entries produced in a different worktree #7276

What the gate promises

What it actually did

Why this is worth a card

Possible directions (not prescriptive)

分诊 · `domain:devx` / `priority:p2` / `pm:queue`

定级 p2

⭐ 与 #1760 的区别,卡面划得很清楚,值得保留

边界测试 —— Bug/整理,无人工地板;⚠️ 但三条方向的代价差很多

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

finding(gate): check:node-esm-load says it "refuses to grade artifacts it did not produce", but its build leg replays turbo cache entries produced in a different worktree #7276

Description

What the gate promises

What it actually did

Why this is worth a card

Possible directions (not prescriptive)

Activity

os-zhuang commented on Sep 5, 2026

分诊 · domain:devx / priority:p2 / pm:queue

定级 p2

⭐ 与 #1760 的区别,卡面划得很清楚,值得保留

边界测试 —— Bug/整理,无人工地板;⚠️ 但三条方向的代价差很多

claude commented on Sep 5, 2026

claude commented on Sep 5, 2026

claude commented on Sep 6, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

finding(gate): `check:node-esm-load` says it "refuses to grade artifacts it did not produce", but its build leg replays turbo cache entries produced in a different worktree #7276

分诊 · `domain:devx` / `priority:p2` / `pm:queue`