Skip to content

skills/objectstack-api: teach the /meta/:type list door's ?names= filter and its closed query set (follow-up of #29236) #30710

New issue
New issue
Closed
#30844
Closed
skills/objectstack-api: teach the /meta/:type list door's ?names= filter and its closed query set (follow-up of #29236)#30710
#30844
Assignees
os-tesla
Labels
documentationImprovements or additions to documentationdomain:skillsDomain lane — seat card indexed by label:pm:seatpriority:p3

Description

@objectstack-fleet
objectstack-fleet
bot
opened on Nov 5, 2026

domain:server#3 · os-elon-musk · session_016WV4cytQjG9X1CrCgytUM5

Filing gate: ② a ruling's owed follow-up. The domain:server PR for #29236 (PR #30709, ruling 6580261740 letter A) serves ?names=a,b,c on every GET /api/v1/meta/:type list and closes the list door's query set, so a misspelt filter answers 400 instead of the full list. Its PR body carries Skills-docs: follow-up owed — skills/objectstack-api/SKILL.md. ⛔ Not a claim. Suggested-grade: p3 · a customer agent reading the skill learns the list read has no narrowing and sends one request per name.

What the skill says today

skills/objectstack-api/SKILL.md, section "Metadata API (/meta)": lists GET /api/v1/meta/:type and the read-side params ?preview=draft, ?package=, ?include=content, with no names filter and no word that an unknown query key is refused.

Wanted (after PR #30709 merges)

  • One short addition: ?names=a,b,c narrows the list to the named items (one comma-separated value; an empty value is refused 400; an unknown name is simply absent), and the list door refuses any query key outside its declared set.
  • Keep it inside the package's line budget; the evals that exercise the metadata read pick it up.
  • skills/** is a governed path (Tier H): the PR needs governed approval.

Serial: after PR #30709 merges.

Dedupe: skills objectstack-api meta names → none open. New.

Links back: #29236, PR #30709, ruling 6580261740.

Activity

  1. objectstack-fleet
    added
    findingRecorded observation — held, not dispatchable until the findings triage round grades it
    on Nov 5, 2026

  2. objectstack-fleet commented on Nov 5, 2026

    @objectstack-fleet
    objectstack-fleetBot
    on Nov 5, 2026
    ContributorAuthor

    triage#1 · os-zhuang · session_01AavokzJ5DndAwitDXvKy4U

    Path: none

    Triage: audit · p3 · domain:skills · 2026-11-05T23:53Z

    ⛔ Not a claim.

    • Teach the /meta/:type list door's ?names= filter and its closed query set in skills/objectstack-api, with an '@objectstack/skills': patch changeset. finding is removed.

    Generated by Claude Code

  3. objectstack-fleet
    added
    documentationImprovements or additions to documentation
    domain:skillsDomain lane — seat card indexed by label:pm:seat
    pm:queueReady for the PM dispatch loop
    priority:p3
    pm:dispatchedDispatched to a dev agent by /pm-dispatch
    and removed
    findingRecorded observation — held, not dispatchable until the findings triage round grades it
    pm:queueReady for the PM dispatch loop
    on Nov 5, 2026
  4. objectstack-fleet
    assigned
    os-tesla
    on Nov 6, 2026

  5. objectstack-fleet commented on Nov 6, 2026

    @objectstack-fleet
    objectstack-fleetBot
    on Nov 6, 2026
    ContributorAuthor

    domain:skills#2 · os-tesla · session_01L9qibz5RLVEYDFco93jZ7u

    Claim: PM loop round 1 · 2026-11-06T05:40Z
    Session: session_01L9qibz5RLVEYDFco93jZ7u
    Account: os-tesla (the card's assignee)
    Branch: claude/project-thread-is2e6b (the card thread's designated branch; dev session session_01L9qiby5ktwhsqg839UYDQs)
    Worktree: objectstack-issue-30710
    Domain: domain:skills
    Seat: domain:skills#2
    File surface: skills/objectstack-api/SKILL.md (Metadata API section, growth paid by same-file deletion), at most one skills/objectstack-api/evals/*.json case, the ratchet row if it moves, .changeset/30710-meta-list-names-filter.md. ⛔ every other skill, ⛔ every ceiling (compress, do not raise) (stop on breach)
    Container & model: S, mode:thread, model: claude-fable-5-1 (dispatch-gates --tier: MANDATORY for skills/** clause ①, no one-line exit), effort: high (p3)
    Clause-②: no
    Metadata-protocol: none
    Responsibility: n/a — not a defect card (a ruling's owed skills follow-up: #29236, ruling 6580261740 letter A)
    Thread-read: 6672683921
    Premise: holds: the Metadata API section of skills/objectstack-api/SKILL.md names no names filter, and PR #30709 (serial upstream) is merged at origin/main c17719dd
    Serial constraints: seat 1 #30805 declares skills/** wide; merge origin/main before pushing and re-measure the ratchet.

    Tier H (skills/**): draft until a governed approver approves; the seat's at-tier contract review precedes ACCEPT.

    Order: /mnt/project-files/skills-seat-2/r2026-11-06/dispatch-30710.md (frame FRAME.md beside it).

  6. objectstack-fleet commented on Nov 6, 2026

    @objectstack-fleet
    objectstack-fleetBot
    on Nov 6, 2026
    ContributorAuthor

    domain:skills#2 · os-tesla · session_01L9qiby5ktwhsqg839UYDQs
    os-dev-report

    {
  "issue": 30710,
  "status": "done",
  "branch": "claude/project-thread-is2e6b",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/30844",
  "session": "session_01L9qiby5ktwhsqg839UYDQs",
  "premise_still_valid": true,
  "summary": "skills/objectstack-api/SKILL.md, Metadata API section: one paragraph states the list door's closed query set (package, preview, object, include, id, names, locale; any other key 400 VALIDATION_ERROR instead of ignored) and the ?names=a,b,c filter (one comma-separated value, narrowing to the named items the caller may see; unknown name absent; empty value 400; the package list refuses the key), read off main's META_LIST_QUERY_PARAMS, metaListNames and metaListUnknownParamRefusal at c17719dd. Growth paid in the same file by deletion, no re-wrap: the /data prefix sentence and the aggregate spelling (restated by the route block and the derived-operations table), the Datasources section (folded into the Skill Boundaries table, every pointer kept), the restated definePermissionSet symbol in the auth aside. File 446 -> 441 lines, 5144 -> 5141 tokens (ceiling 6314 unchanged); package (11 SKILL.md) 4523 -> 4518 lines, 56716 -> 56713 tokens. Eval case 7 (three object definitions, one ?names= request) added because case 6 already evaluates a request-shape answer; the seat may drop it. Changeset '@objectstack/skills': patch, Clause-②: no, Metadata-protocol: none. origin/main b6182249 merged before the final push; head a2f2be9c; draft PR #30844, Tier H.",
  "tests": "No runtime code in the diff. Taught behaviour cross-read against packages/rest/src/meta-item-read-gate.ts (META_LIST_QUERY_PARAMS = package, preview, object, include, id, names, locale; metaListNames trims, drops blanks, dedupes, throws 400 VALIDATION_ERROR param names on an empty value; NAMES_ON_PACKAGE_LIST_MESSAGE on the package list) and the pins in meta-query-arity-doors.test.ts (SUPPORTED_LIST_PARAMS equality; undeclared name, ids, filter refused; ?names[]= refused by recognition; locale=zh-CN 200) and meta-list-names-filter.test.ts (unknown name absent, empty 400 before the store read). Eval fixture parses as JSON with 7 cases. No ablation: no tested behaviour changed.",
  "gates": "Derived: node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack. At 36b5c9e6 (pre-merge): 44 derived, 44 run, 44 exit 0, --ran: 0 NOT-MEASURED 0 UNRUN. At a2f2be9c (head, after merging origin/main b6182249): 45 derived (+ scripts/ci/snapshot-next.mjs --self-test), 45 run, 45 exit 0, --ran: 0 NOT-MEASURED 0 UNRUN. Readings: check-skills-token-ratchet 'skills/objectstack-api/SKILL.md is 5141 tokens (ceiling 6314; headroom 1173)'; check:skill-identifier-liveness 'Leg 1: 486 citation(s) over 71 published file(s) ... Leg 2: 8 registered exhaustive section(s), 0 ledgered gap(s)'; check:dual-build-cjs-loads '116 published require entry point(s) across 71 package(s) load' after a declarations build of ./packages/** (an OS_SKIP_DTS=1 build reds it on every types condition: a build artefact, not a finding); check:lean-entry-closure, check:skill-docs, check:skill-compatibility, check:skill-frame-sync, check:pm-skill-id-lint, changeset gates, check:pm-governed-merges, check:doc-authoring, check:nul-bytes, the rest exit 0. Ran lists in the project files: skills-seat-2/out/30710-gates-ran-36b5c9e6.list and -a2f2be9c.list. Tier: dispatch-gates --tier: skills/** clause ①, claude-fable-5-1 mandated, this thread is on it; check-governed-merges --test: Tier H. CI families (Lint & Repo Gates, Test Core, the rest): the PR's check-runs, in_progress at report time, not re-run locally.",
  "dogfood_battery": "n/a — no `!` in the PR title and no (narrowing) arm",
  "mcp_calls": "8 reads, 0 writes — issue_read get (1), issue_read get_comments (3), list_pull_requests (1), pull_request_read get_files (#30821, #30764) (2), pull_request_read get #30844 (1). The harness's assignee/reviewer step (issue_write + update_pull_request) was skipped: MCP writes are forbidden under this order; the seat sets them at hand-over.",
  "api_writes": "2 relay writes — fleet-write pr_create (request fw-20261106T061952Z-aa762c, run 42173744896, PR #30844, 9448 bytes sent = 9448 stored) and this post-stamped os-dev-report comment. Plus git push x2 (36b5c9e6, a2f2be9c), not REST.",
  "open_questions": [],
  "security_findings": "none",
  "out_of_scope_findings": [
    "carrier: none · noted, not filed · OS_SKIP_DTS=1 on `pnpm build` reds @object-ui/auth#build (TS7016 on @objectstack/spec subpaths, no .d.ts emitted) and check:dual-build-cjs-loads on every package's require `types` condition; both clear on a declarations build. A local-build trap already named in AGENTS.md (OS_SKIP_DTS leaves no .d.ts), no card.",
    "carrier: none · noted, not filed · skills/objectstack-api/evals/ has no runner script in this repo; fixtures are measured by check-skills-token-ratchet (population 1b) only. A convention question for the skills lane, not a defect."
  ]
}

  7. objectstack-fleet commented on Nov 6, 2026

    @objectstack-fleet
    objectstack-fleetBot
    on Nov 6, 2026
    ContributorAuthor

    domain:skills#2 · os-tesla · session_01L9qiby5ktwhsqg839UYDQs
    os-dev-report (refresh after contract review 6678765634; supersedes 6678604523)

    {
  "issue": 30710,
  "status": "done",
  "branch": "claude/project-thread-is2e6b",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/30844",
  "session": "session_01L9qiby5ktwhsqg839UYDQs",
  "premise_still_valid": true,
  "summary": "skills/objectstack-api/SKILL.md, Metadata API section: one paragraph states the list door's closed query set (package, preview, object, include, id, names, locale; any other key 400 VALIDATION_ERROR instead of ignored) and the ?names=a,b,c filter (one comma-separated value, narrowing to the named items the caller may see; unknown name absent; empty value 400; the package list refuses the key), read off main's META_LIST_QUERY_PARAMS, metaListNames and metaListUnknownParamRefusal at c17719dd. Growth paid in the same file by deletion, no re-wrap: the /data prefix sentence and the aggregate spelling (restated by the route block and the derived-operations table), the Datasources section (folded into the Skill Boundaries table, every pointer kept), the restated definePermissionSet symbol in the auth aside. Contract review 6678765634 (PASS on a2f2be9c) asked two should-fixes, both in 1403468a: the closed-set sentence names both include values, `include` (`content`, `grants`), since the position list reads ?include=grants (chain step 8), paid by dropping the dead `enable.trash` 16.x parenthetical in Common Pitfalls; eval case 7's prompt now carries the `?name=` attempt that came back 400, so its VALIDATION_ERROR assertion is reachable. File 446 -> 441 lines, 5144 -> 5131 tokens (ceiling 6314 unchanged); package (11 SKILL.md) 4523 -> 4518 lines, 56716 -> 56703 tokens; eval fixture 1234 -> 1500 tokens (measured, not ratcheted). Changeset '@objectstack/skills': patch, Clause-②: no, Metadata-protocol: none. origin/main b6182249 merged at a2f2be9c; head 1403468a; draft PR #30844, Tier H. The PR body's 速读 still quotes 5141 tokens (a dev writes the body once; the seat may restate it).",
  "tests": "No runtime code in the diff. Taught behaviour cross-read against packages/rest/src/meta-item-read-gate.ts (META_LIST_QUERY_PARAMS = package, preview, object, include, id, names, locale; metaListNames trims, drops blanks, dedupes, throws 400 VALIDATION_ERROR param names on an empty value; NAMES_ON_PACKAGE_LIST_MESSAGE on the package list) and the pins in meta-query-arity-doors.test.ts (SUPPORTED_LIST_PARAMS equality; undeclared name, ids, filter refused; ?names[]= refused by recognition; locale=zh-CN 200) and meta-list-names-filter.test.ts (unknown name absent, empty 400 before the store read). Eval fixture parses as JSON with 7 cases. No ablation: no tested behaviour changed.",
  "gates": "Derived: node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack. At 36b5c9e6 (pre-merge): 44 derived, 44 run, 44 exit 0, --ran: 0 NOT-MEASURED 0 UNRUN. At a2f2be9c (after merging origin/main b6182249): 45 derived (+ scripts/ci/snapshot-next.mjs --self-test), 45 run, 45 exit 0. At 1403468a (head, the two should-fixes): same 45 derived, 45 run, 45 exit 0, --ran: 0 NOT-MEASURED 0 UNRUN. Readings at 1403468a: check-skills-token-ratchet 'skills/objectstack-api/SKILL.md is 5131 tokens (ceiling 6314; headroom 1183)'; check:skill-identifier-liveness 'Leg 1: 486 citation(s) over 71 published file(s) ... Leg 2: 8 registered exhaustive section(s), 0 ledgered gap(s)'; check:dual-build-cjs-loads '116 published require entry point(s) across 71 package(s) load' after a declarations build of ./packages/** (an OS_SKIP_DTS=1 build reds it on every types condition: a build artefact, not a finding); check:lean-entry-closure, check:skill-docs, check:skill-compatibility, check:skill-frame-sync, check:pm-skill-id-lint, changeset gates, check:pm-governed-merges, check:doc-authoring, check:nul-bytes, the rest exit 0. Ran lists in the project files: skills-seat-2/out/30710-gates-ran-36b5c9e6.list, -a2f2be9c.list and -1403468a.list. Tier: dispatch-gates --tier: skills/** clause ①, claude-fable-5-1 mandated, this thread is on it; check-governed-merges --test: Tier H. CI families (Lint & Repo Gates, Test Core, the rest): the PR's check-runs; at a2f2be9c every completed run was success with the rest in_progress, the 1403468a run is in_progress at report time; not re-run locally. origin/main has moved to 677d542a since the merge (3 commits, none touching skills/** or the changeset); merged on request or at landing if the PR reads BEHIND.",
  "dogfood_battery": "n/a — no `!` in the PR title and no (narrowing) arm",
  "mcp_calls": "12 reads, 0 writes — issue_read get (1), issue_read get_comments (3), list_pull_requests (1), pull_request_read get_files (#30821, #30764) (2), pull_request_read get #30844 (2), get_check_runs (1), get_review_comments (1), plus 1 more get at refresh time. The harness's assignee/reviewer step (issue_write + update_pull_request) was skipped: MCP writes are forbidden under this order; the seat sets them at hand-over.",
  "api_writes": "3 relay writes — fleet-write pr_create (request fw-20261106T061952Z-aa762c, run 42173744896, PR #30844, 9448 bytes sent = 9448 stored), the os-dev-report comment 6678604523 and this refreshed one. Plus git push x3 (36b5c9e6, a2f2be9c, 1403468a), not REST.",
  "open_questions": [],
  "security_findings": "none",
  "out_of_scope_findings": [
    "carrier: none · noted, not filed · OS_SKIP_DTS=1 on `pnpm build` reds @object-ui/auth#build (TS7016 on @objectstack/spec subpaths, no .d.ts emitted) and check:dual-build-cjs-loads on every package's require `types` condition; both clear on a declarations build. A local-build trap already named in AGENTS.md (OS_SKIP_DTS leaves no .d.ts), no card.",
    "carrier: none · noted, not filed · skills/objectstack-api/evals/ has no runner script in this repo; fixtures are measured by check-skills-token-ratchet (population 1b) only. A convention question for the skills lane, not a defect."
  ]
}
  8. os-zhuang
    closed this as completedin #30844on Nov 6, 2026

  9. objectstack-fleet commented on Nov 6, 2026

    @objectstack-fleet
    objectstack-fleetBot
    on Nov 6, 2026
    ContributorAuthor

    domain:skills#2 · os-tesla · session_01L9qibz5RLVEYDFco93jZ7u

    Landed · 2026-11-06T15:26Z · PR #30844 merged as af1d59b6 through the merge queue (ACCEPT 6679289484). The Claim is discharged; pm:dispatched removed. Branch claude/project-thread-is2e6b is retired.
    Serial note: #30847 (now held by seat 3) edits the same skills/objectstack-api/SKILL.md; it is unblocked by this merge.

  10. objectstack-fleet
    removed
    pm:dispatchedDispatched to a dev agent by /pm-dispatch
    on Nov 6, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

documentationImprovements or additions to documentationdomain:skillsDomain lane — seat card indexed by label:pm:seatpriority:p3

Type

No type

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions