objectstack-ai
diff --git a/‎docs/adr/0020-state-machine-converge-and-enforce.md‎
Lines changed: 3 additions & 3 deletions b/‎docs/adr/0020-state-machine-converge-and-enforce.md‎
Lines changed: 3 additions & 3 deletions
diff --git a/‎docs/adr/0096-execution-surface-identity-admission.md‎
Lines changed: 3 additions & 3 deletions b/‎docs/adr/0096-execution-surface-identity-admission.md‎
Lines changed: 3 additions & 3 deletions
diff --git a/‎scripts/check-adr-symbol-anchors.mjs‎
Lines changed: 77 additions & 7 deletions b/‎scripts/check-adr-symbol-anchors.mjs‎
Lines changed: 77 additions & 7 deletions
@@ -42,7 +42,7 @@ The design intent is a **runtime guardrail**: declare which `status` transitions
 
 - `IWorkflowService` (`packages/spec/src/contracts/workflow-service.ts:58` <!-- anchor-exempt: HISTORICAL --> — unlinked: the contract file was deleted on 2026-08-01 by #4451 / #4473, which retired the `workflow` service slot outright, closing the follow-up this record left open below) has **no concrete implementation**.
 - There is **no XState interpreter** anywhere (no `createMachine` / `interpret` / transition engine).
-- The write-path validator [`validateRecord`](../../packages/objectql/src/validation/record-validator.ts#L198) reads only `objectSchema.fields` and validates **field data types** (string/number/date/…). It **never reads `objectSchema.validations`** at all — so *not one* of the nine validation-rule types (`state_machine`, `cross_field`, `script`, `unique`, `format`, `json_schema`, `async`, `custom`, `conditional`) is enforced by it.
+- The write-path validator [`validateRecord`](../../packages/objectql/src/validation/record-validator.ts) reads only `objectSchema.fields` and validates **field data types** (string/number/date/…). It **never reads `objectSchema.validations`** at all — so *not one* of the nine validation-rule types (`state_machine`, `cross_field`, `script`, `unique`, `format`, `json_schema`, `async`, `custom`, `conditional`) is enforced by it.
 - **Nothing reads `object.stateMachines`.**
 
 So the guardrail goal is currently unmet at runtime. The only artefacts that exist are declarations — e.g. `examples/app-crm/src/workflows/stale-opportunity.workflow.ts:19` <!-- anchor-exempt: HISTORICAL --> (`StateMachineConfig`; unlinked — this file describes the pre-ADR state and was itself removed by this record's own implementation, see the checklist below), which additionally **mixes orchestration into the machine** (it carries `email_alert` / `task_creation` actions that no engine executes — that orchestration belongs to a record-triggered Flow per ADR-0019).
@@ -58,7 +58,7 @@ Future automation is **AI-generated, human-previewed** (ADR-0010 / ADR-0011). Th
 - The audience for the *name* is the **model**, not a non-technical admin. The right heuristic is **"meet the model where its priors are"**: use the term that is densest in training data for this concept.
 - "**state machine**" is that term — Rails `state_machine`, AWS Step Functions "State Machine", XState, Spring Statemachine. An AI given a field named `state_machine` with a `{ from: [to] }` transition table hits its priors and produces correct code. A coined term (e.g. `lifecycle`) forces the model off its priors onto local docs alone.
 - `state_machine` also reads as **maximally distinct from `flow`** — eliminating the `flow` / `workflow` near-synonym ambiguity that makes an AI pick the wrong type.
-- `lifecycle` is additionally **already overloaded** in this codebase (managed-by buckets and toolbar "lifecycle actions" in [`object.zod.ts`](../../packages/spec/src/data/object.zod.ts) at L354/L371/L410/L765), so reusing it would create a *new* ambiguity.
+- `lifecycle` is additionally **already overloaded** in this codebase (managed-by buckets and toolbar "lifecycle actions" in [`object.zod.ts`](../../packages/spec/src/data/object.zod.ts)), so reusing it would create a *new* ambiguity.
 
 Corollary (a trap to avoid): if we name it `state_machine`, the **shape must also match the well-known shape**. A conventional name on a bespoke structure is the worst case — the model's priors fire on the name and mislead on the structure. Keep the shape textbook FSM.
 
@@ -105,7 +105,7 @@ The surviving guardrail is named **`state_machine`** (rule type, already so name
 
 Wire the `validations` union into the write path — today nothing evaluates it (see §prior-state plumbing gap). Concretely:
 
-1. **Plumb the prior/merged record in.** Extend the rule-evaluation entry point (today [`validateRecord(schema, data, mode)`](../../packages/objectql/src/validation/record-validator.ts#L198)) to receive the prior record on update — e.g. `validateRecord(schema, data, mode, previous?)`, or run the rule pass from a `beforeUpdate` step that already holds both old and new. This unblocks `state_machine` **and** the currently-crippled `cross_field` / `script` rules in one move; do it union-wide, not `state_machine`-only.
+1. **Plumb the prior/merged record in.** Extend the rule-evaluation entry point (today [`validateRecord(schema, data, mode)`](../../packages/objectql/src/validation/record-validator.ts)) to receive the prior record on update — e.g. `validateRecord(schema, data, mode, previous?)`, or run the rule pass from a `beforeUpdate` step that already holds both old and new. This unblocks `state_machine` **and** the currently-crippled `cross_field` / `script` rules in one move; do it union-wide, not `state_machine`-only.
 2. **Transition check.** On update: if `old[field] !== new[field]` and `new[field] ∉ transitions[old[field]]`, **reject** with the rule's `message`. On insert: validate `new[field]` is the declared initial state — derived from the `Field.select` option marked `default: true` (no separate `initial` key needed; showcase relies on this).
 3. **Introspection endpoint (follow-on).** Expose `legalNext(object, field, currentState)` so UI/Agents read the legal set instead of re-deriving it.
 
 
@@ -177,8 +177,8 @@ All trace to the same `positions==0 && permissions==0 && !userId → skip` predi
 | Site | Surface | Note |
 |:---|:---|:---|
 | `packages/plugins/plugin-security/src/security-plugin.ts#getReadFilter` | find/write middleware | the original seam (#2849) |
-| `packages/plugins/plugin-security/src/security-plugin.ts#getReadFilter` | `getReadFilter` (analytics / reports / raw-SQL RLS compile) | returns `undefined` = *no filter*; the analytics mirror of :626 |
-| `objectql/engine.ts` Layer-0 + `driver-sql` `applyTenantScope` (opt-in on `tenantId`) | tenant scoping | Layer-0 is computed **after** the :626 skip, and the driver scope is opt-in → a principal-less context gets **no tenant filter at either layer** (cross-tenant read/write) |
+| `packages/plugins/plugin-security/src/security-plugin.ts#getReadFilter` | `getReadFilter` (analytics / reports / raw-SQL RLS compile) | returns `undefined` = *no filter*; the analytics mirror of the middleware seam above |
+| `objectql/engine.ts` Layer-0 + `driver-sql` `applyTenantScope` (opt-in on `tenantId`) | tenant scoping | Layer-0 is computed **after** the `packages/plugins/plugin-security/src/security-plugin.ts#getReadFilter` skip, and the driver scope is opt-in → a principal-less context gets **no tenant filter at either layer** (cross-tenant read/write) |
 | `packages/rest/src/rest-server.ts#enforceAuth` (+ lookup) | guest / public-form routes | bypass `enforceAuth`; fall open when `guest_portal` unregistered (partly mitigated by the `publicFormGrant`) |
 | `packages/runtime/src/http-dispatcher.ts#executionContext` | custom `object_operation` API endpoints | **accidental** — `callData` invoked with no `executionContext` (every sibling threads it) |
 | `packages/runtime/src/sandbox/body-runner.ts` | authored action/hook **body** interior facade | the inside of #2849 — only the *invoke* is gated (#2964); the body's `api.object().find/insert/...` run context-less |
@@ -194,7 +194,7 @@ All trace to the same `positions==0 && permissions==0 && !userId → skip` predi
 | Scheduled reports (`packages/plugins/plugin-reports/src/report-service.ts#isSystem` `dispatchDue`) run `executeReport(..., {isSystem:true})` → a member-owned schedule emails the target object's **entire** table, RLS bypassed | CONFIRMED exploitable | #2980 |
 | Knowledge/RAG `applyPermissionFilter` (`packages/services/service-knowledge/src/knowledge-service.ts#applyPermissionFilter`) returns **all** hits when `ctx` is missing/system; `chatWithTools`'s `ToolExecutionContext.actor` is optional with a system fallback → agent retrieval escapes the data ceiling | CONFIRMED (framework); exposure gated on cloud impl | #2981 |
 
-These are *not* the :626 fall-open (they use an unconditional `SYSTEM_CTX`), but they are exactly what a D4 conformance row (`caller-scoped?` proof) + the D2 audit would have flagged. Fixed independently of the mechanism, tracked as the mechanism's motivating evidence.
+These are *not* the `packages/plugins/plugin-security/src/security-plugin.ts#getReadFilter` fall-open (they use an unconditional `SYSTEM_CTX`), but they are exactly what a D4 conformance row (`caller-scoped?` proof) + the D2 audit would have flagged. Fixed independently of the mechanism, tracked as the mechanism's motivating evidence.
 
 ### E3 — Structural: paths that never enter the security middleware (Class B)
 
 
@@ -85,7 +85,7 @@ import { dirname, join } from 'node:path';
 
 import { gitFreeEnv } from './git-env.mjs';
 import { isEntrypoint } from './invoked-as.mjs';
-import { ANCHOR_GRAMMAR, defineCorpus, sweepCorpus } from './symbol-anchors.mjs';
+import { ANCHOR_GRAMMAR, defineCorpus, extractAnchors, sweepCorpus } from './symbol-anchors.mjs';
 
 /* ── The declared path population (#13519 / check-declared-population-live) ───
  * These literals ARE the population this gate reads, and the self-test holds
@@ -137,11 +137,50 @@ export function runCheck(root = process.cwd()) {
     process.exit(1);
   }
 
-  console.log(
-    `✅ check-adr-symbol-anchors: ${counts.anchors} anchors across ${counts.docs} records resolve — ` +
-      `${counts.symbol} symbol (${counts.declaration} declaration, ${counts.literal} literal), ` +
-      `${counts.fileLevel} file-level, ${counts.crossRepo} cross-repo, ${counts.exempt} exempt, ` +
-      `${counts.continuation} continuation. 0 line anchors survive.`,
+  console.log(summaryLine(counts));
+}
+
+/* ── The verdict may not claim a census wider than the vocabulary it read ──
+ *
+ * This line used to end `0 line anchors survive.` -- full stop, no
+ * qualifier -- and that sentence was measured FALSE while it printed green.
+ * Nine line pointers were live in `docs/adr/**` at the time, in spellings this
+ * corpus does not judge: the path-less bare colon continuation (three in one
+ * record, where the path sat in a different table cell from the number) and the
+ * `L` pin, both bare in prose and written as a markdown link-target fragment
+ * (six across two records). The measurement was true, the SENTENCE was not: the
+ * gate's vocabulary is narrower than the class the #13556 ruling deleted, and
+ * the verdict spoke for the class.
+ *
+ * ⭐ So the repair is the CLAIM, not the reading. The two path-less spellings
+ * live in the shared grammar already and are OPT-IN per corpus
+ * (`scripts/symbol-anchors.mjs#defineCorpus`, `pathlessLineCitations`), and
+ * turning them on HERE was measured before this was written: 17 findings across
+ * 6 records, of which 2 are an ADR's dev-server ports -- correct prose no
+ * author can repair, whose only remedy is the maintainer-only exemption marker.
+ * Widening is therefore a decision with a price tag and not this sentence's to
+ * make; what this sentence owes is to stop reading as though the decision had
+ * already gone the other way.
+ *
+ * ⛔ Do NOT restore the unqualified form. The self-test pins all three halves
+ * -- that the corpus DECLARES the narrower vocabulary, that the shared grammar
+ * really does see the wider one when asked (so the caveat is a measurement and
+ * not a hedge), and that this sentence names both -- so a future author who
+ * flips the declaration is made to re-state the claim in the same edit.
+ */
+export const JUDGED_LINE_SPELLINGS =
+  'path-anchored, backticked continuation, fenced comment header, tilde';
+export const UNJUDGED_LINE_SPELLINGS =
+  'the two path-less spellings, which continue a filename named earlier in the sentence';
+
+export function summaryLine(counts) {
+  return (
+    `✅ check-adr-symbol-anchors: ${counts.anchors} anchors across ${counts.docs} records resolve — `
+    + `${counts.symbol} symbol (${counts.declaration} declaration, ${counts.literal} literal), `
+    + `${counts.fileLevel} file-level, ${counts.crossRepo} cross-repo, ${counts.exempt} exempt, `
+    + `${counts.continuation} continuation. 0 line anchors survive in the ${JUDGED_LINE_SPELLINGS} `
+    + `spellings this corpus judges — ⚠️ NOT a census of the deleted class: ${UNJUDGED_LINE_SPELLINGS}, `
+    + 'are opt-in and are OFF here (#18899).'
   );
 }
 
@@ -177,7 +216,7 @@ function assert(cond, msg) { if (!cond) { console.error(`❌ check-adr-symbol-an
 // not red. A battery BELOW its floor means cases stopped running; the remedy is
 // to find what stopped registering.
 const SELF_TEST_BATTERIES = Object.freeze({
-  'check-adr-symbol-anchors self-test': 17,
+  'check-adr-symbol-anchors self-test': 22,
 });
 
 // DELETING an entry silences that battery's floor exactly as effectively as
@@ -300,6 +339,37 @@ export function selfTest() {
   check(CENSUS_13556.rotRateIsLowerBound === true, 'the 72.1% figure is a LOWER bound and must be declared as one');
   check(CENSUS_13556.totalSurface === CENSUS_13556.distinctLineAnchors + CENSUS_13556.continuationAnchors, 'the declared surface must be the sum of its parts');
 
+  // 6. ⭐ The verdict's CLAIM, held against the vocabulary it actually read
+  //    (#18899). The three cases are one argument in three parts, and none of
+  //    them is worth anything without the other two:
+  //
+  //      (a) the narrower vocabulary is this corpus's DECLARATION, not an
+  //          accident of the grammar -- so the caveat names a choice;
+  //      (b) the shared grammar really does see the wider vocabulary when it
+  //          is asked to, on the SAME text -- so (a) is a measurement and the
+  //          caveat is not a hedge against a rule that matches nothing;
+  //      (c) the printed sentence names both halves, and ⛔ no longer ends in
+  //          the unqualified census claim that was measured false.
+  //
+  //    ⚠️ (b) is the light-on-a-literal control, and it is the case that makes
+  //    this battery worth running: without it, (a) and (c) would both hold just
+  //    as well on a day when `pathlessLineCitations` had stopped matching
+  //    anything at all, and the caveat would be documenting a dead rule.
+  const pathlessProbe = 'The mirror of :626 and the pin L198 both continue a filename named earlier.';
+  const asDeclared = extractAnchors(pathlessProbe, { pathlessLineCitations: CORPUS.pathlessLineCitations });
+  const widened = extractAnchors(pathlessProbe, { pathlessLineCitations: true });
+  check(CORPUS.pathlessLineCitations === false,
+    'the narrower vocabulary must be this corpus\'s DECLARATION — flip it and the verdict below must be re-stated in the same edit');
+  check(widened.lineAnchors.length === 2,
+    `the shared grammar must SEE both path-less spellings when asked, or the verdict's caveat documents a dead rule — got ${widened.lineAnchors.length}`);
+  check(asDeclared.lineAnchors.length === 0,
+    `and must not see them under this corpus's declaration, or the caveat is simply wrong — got ${asDeclared.lineAnchors.length}`);
+  const verdict = summaryLine({ anchors: 1, docs: 1, symbol: 1, declaration: 1, literal: 0, fileLevel: 0, crossRepo: 0, exempt: 0, continuation: 0 });
+  check(verdict.includes(JUDGED_LINE_SPELLINGS) && verdict.includes(UNJUDGED_LINE_SPELLINGS),
+    'the verdict must name BOTH the vocabulary it judged and the one it did not');
+  check(!/line anchors survive\.\s*$/.test(verdict),
+    'the verdict must not end in the unqualified claim `0 line anchors survive.` — that sentence printed green while nine pointers of the deleted class were live');
+
   // ── The floor: every declared battery RAN, and ran its cases (#13489) ────
   //
   // Evaluated after every battery has had its chance and BEFORE the verdict, so