Merge remote-tracking branch 'origin/main' into claude/issue-18915-published-readme-examples-compile

Author: claude

content/docs/deployment/environment-variables.mdx

@@ -257,7 +257,7 @@ OS_MCP_STDIO_ENABLED=true OS_MCP_STDIO_API_KEY=osk_... os start   # start the lo
 |:---|:---|:---|:---|
 | `OS_MCP_SERVER_ENABLED` | boolean | `true` | The MCP **HTTP** surface (`/api/v1/mcp`) is a core capability and defaults **on**. Set `false` to disable it (endpoint 404s, the Connect-an-Agent page disappears). |
 | `OS_MCP_STDIO_ENABLED` | boolean | `false` | Auto-start the long-lived **stdio** transport at boot. Opt-in and **stricter** than the HTTP surface. **Requires `OS_MCP_STDIO_API_KEY`** — stdio runs as that key's identity with RLS/FLS/tenant applied; if the key is missing or invalid, boot **fails closed** (stdio refuses to start). See ADR-0101. |
-| `OS_MCP_STDIO_API_KEY` | string | — | The `osk_...` API key the **stdio** transport runs as. Resolved through the same verify chain as the HTTP/REST surfaces, so reads are scoped to that identity's permissions. Mint one from **Setup → Connect an Agent** (or `POST /api/v1/keys`). For full authority, mint a key on a platform-admin or dedicated **service** identity — there is deliberately no `system`/unscoped bypass. |
+| `OS_MCP_STDIO_API_KEY` | string | — | The `osk_...` API key the **stdio** transport runs as. Resolved through the same verify chain as the HTTP/REST surfaces, so reads are scoped to that identity's permissions. Mint one from the **Connect an Agent** page — **Account → Developer** for any signed-in user, **Setup → Connect an Agent** for platform admins — or `POST /api/v1/keys`. For full authority, mint a key on a platform-admin or dedicated **service** identity — there is deliberately no `system`/unscoped bypass. |
 | `OS_MCP_SERVER_NAME` | string | `objectstack` | Server name advertised to MCP clients. |
 | `OS_MCP_SERVER_TRANSPORT` | enum | `stdio` | `stdio` \| `http`. Use `http` (Streamable HTTP) for a remote client; `stdio` for a local one. |
 

content/docs/permissions/tenant-audit-census.mdx

@@ -217,6 +217,27 @@ cannot read, and they are neither in nor out.
 | object name is an `object: string` parameter | 19 |
 | object name is some other run-time expression | 57 |
 
+### Subtractions the census could NOT defend — enforced
+
+A same-named call on something that is not a data engine is subtracted, and the
+subtraction is DEFENSIBLE when this census can name why: the receiver is a `node:`
+builtin, a value it watched being constructed, a language global, a type THIS
+corpus declares and the door rule rejected, or an `UNTYPED_RECEIVERS` row.
+
+⚠️ Counted below are the subtractions it can name no such fact for — the
+receiver carries a declared type the engine type index does not hold, and that
+index is built from TRACKED sources only, deliberately. An untracked, generated
+or dependency-owned declaration is one this census never saw, and «never saw it»
+must not be spelled the same way as «read it, not an engine».
+
+| what | count |
+| :--- | ---: |
+| write calls subtracted with no defensible reason | **3** |
+| …whose declared type text states an engine door anyway | **2** |
+
+Every one of them is listed, by receiver and by the type text that could not be
+placed, in [`docs/audits/2026-08-tenant-audit-write-call-sites.counts.md`](https://github.com/objectstack-ai/objectstack/blob/main/docs/audits/2026-08-tenant-audit-write-call-sites.counts.md).
+
 The corpus walked is every tracked non-test source under `packages/services/`
 and `packages/plugins/`; calls to a same-named method on something that is not
 a data engine were subtracted. Every site is listed in
@@ -232,11 +253,11 @@ holds still. They are required to be HERE and to say WHEN they were true;
 their values are not compared. The reasoning, and the measurement behind it,
 are in `scripts/check-tenant-audit-census.mjs`.
 
-Measured on 2026-09-16 at `11daf7f69`.
+Measured on 2026-09-18 at `02bdeaaf2`.
 
 | corpus scale (not enforced) | count |
 | :--- | ---: |
-| tracked non-test sources scanned | 570 |
+| tracked non-test sources scanned | 573 |
 | engine-shaped types recognised | 63 |
 | declared objects in the registry | 117 |
 | same-named calls subtracted as non-engine | 146 |

docs/audits/2026-08-tenant-audit-write-call-sites.counts.md

@@ -43,6 +43,30 @@ silent, and `node scripts/tenant-audit-census.mjs --write` is the resolution.
 | Threading a decidably non-elevated context | 0 |
 | Threading a context of undecidable elevation | 102 |
 
+## Subtractions the census could NOT defend — enforced
+
+A same-named call on something that is not a data engine is subtracted, and the
+subtraction is DEFENSIBLE when this census can name why: the receiver is a `node:`
+builtin, a value it watched being constructed, a language global, a type THIS
+corpus declares and the door rule rejected, or an `UNTYPED_RECEIVERS` row.
+
+⚠️ Counted below are the subtractions it can name no such fact for — the
+receiver carries a declared type the engine type index does not hold, and that
+index is built from TRACKED sources only, deliberately. An untracked, generated
+or dependency-owned declaration is one this census never saw, and «never saw it»
+must not be spelled the same way as «read it, not an engine».
+
+| what | count |
+| :--- | ---: |
+| write calls subtracted with no defensible reason | **3** |
+| …whose declared type text states an engine door anyway | **2** |
+
+| file | receiver | verb | why | declared type | door | n |
+|---|---|---|---|---|---|---:|
+| `packages/plugins/plugin-auth/src/audience-gate-test-support.ts` | `engine` | `insert` | anonymous-type | `{ insert: (name: string, data: any, options?: any) => Promise<unknown> } \| null` | ⚠️ yes | 1 |
+| `packages/plugins/plugin-auth/src/sso-client-secret.ts` | `e` | `update` | anonymous-type | `{ find(object: string, query: unknown): Promise<Record<string, unknown>[]>; update(object: string, data: unknown, options?: unknown): Promise<unknown>; }` | ⚠️ yes | 1 |
+| `packages/plugins/plugin-hono-server/src/adapter.ts` | `this.app` | `delete` | type-not-in-corpus | `Hono` | no | 1 |
+
 ## Corpus scale — present and dated, ⛔ NOT enforced
 
 ⛔ These four describe the CORPUS this census walked, not the population it
@@ -52,11 +76,11 @@ holds still. They are required to be HERE and to say WHEN they were true;
 their values are not compared. The reasoning, and the measurement behind it,
 are in `scripts/check-tenant-audit-census.mjs`.
 
-Measured on 2026-09-16 at `11daf7f69`.
+Measured on 2026-09-18 at `02bdeaaf2`.
 
 | corpus scale (not enforced) | count |
 | :--- | ---: |
-| tracked non-test sources scanned | 570 |
+| tracked non-test sources scanned | 573 |
 | engine-shaped types recognised | 63 |
 | declared objects in the registry | 117 |
 | same-named calls subtracted as non-engine | 146 |

packages/spec/src/api/batch.test.ts

@@ -107,9 +107,19 @@ describe('BatchUpdateRequestSchema', () => {
 
   // [#3939] The count bounds moved OUT of the schema. They were a second source
   // of truth that never matched reality: the schema said 1..200 while the routes
-  // enforced nothing, and the one route that did cap read the deployment's
-  // configured `batch.maxBatchSize` (1..1000) instead. The cap is now enforced
-  // at the route from that config, and the schema carries shape only.
+  // enforced nothing, and the one route that did cap read the constructed
+  // `RestServerConfig.batch.maxBatchSize` (1..1000, default 200) instead. The
+  // cap is now enforced at the route from that config, and the schema carries
+  // shape only.
+  //
+  // Reachability: EMBEDDER-ONLY (#15543, #16801). ⛔ That config is NOT
+  // deployment policy: it is written only by a host that constructs the
+  // `RestServerConfig` itself, never by `os serve` or the dev plugin, so a
+  // CLI-started deployment always gets the default of 200 and no flag, config
+  // file or CLI option moves it. Same posture as the schema this file pins
+  // (`BatchUpdateRequestSchema` in `batch.zod.ts`) and
+  // `RestServer#enforceBatchSize`; the per-key record is the REACHABILITY row
+  // in `packages/spec/liveness/batch_endpoints.json`.
   it('accepts an empty record list — an empty batch is a no-op, not a client error', () => {
     expect(() =>
       BatchUpdateRequestSchema.parse({

pnpm-lock.yaml

@@ -394,3 +394,38 @@ overrides:
   '@xmldom/xmldom@>=0.8.0 <0.9.0': '^0.8.15'
   '@xmldom/xmldom@>=0.9.0 <0.10.0': '^0.9.12'
   'qs@>=6.0.0 <7.0.0': '^6.16.0'
+  # OSV 2026-09-18 (#18930) — one advisory, and it names a fixed version, so
+  # this is the "take the fix" path osv-scanner.toml's own header prescribes
+  # and NOT an exemption; that ledger stays at ZERO entries.
+  #   devalue GHSA-9rgm-9g3h-6x36 (5.3 medium) — flagged at the single resolved
+  #     line 5.9.0, fixed 5.9.2. It turned `Validate Package Dependencies` red
+  #     on `main` itself (scheduled run 35301766597, step 13), so every PR
+  #     touching any package.json inherited a red that was not its own.
+  #     Transitive-only: no workspace manifest declares devalue, so there is no
+  #     publishable declared range to keep in lockstep and
+  #     check-override-consistency.mjs lists it as an override it cannot
+  #     cross-check against a declared range — correct for this shape, and a
+  #     report, never a failure. Reached through svelte@5.56.9, which declares
+  #     `devalue: ^5.8.1` — a range that ALREADY admits 5.9.2, so this is a
+  #     dedupe onto the patched line rather than a forced upgrade past what the
+  #     dependent supports (the dompurify / nanoid shape above).
+  #     Why the pin rather than a bare resolver refresh: the lockfile sat on
+  #     5.9.0 purely through lockfile inertia — 5.9.0 satisfied ^5.8.1, so
+  #     nothing re-resolved it when 5.9.1 and 5.9.2 published, the same
+  #     mechanism the hono note above records. `pnpm update devalue -r --depth
+  #     Infinity` does clear it, but it re-resolves the whole tree and moved
+  #     twelve unrelated packages (type-fest, seroval, postcss, nanoid, knex,
+  #     picomatch, ip-address, isbot, node-abi, use-sync-external-store …) in
+  #     one 107/87-line lockfile churn; the override moves devalue alone and
+  #     leaves a floor behind, so a future transitive reintroduction lands on
+  #     the patched line instead of silently re-arming the advisory.
+  #     ONE resolved copy in the whole tree (measured, `pnpm why devalue`), so
+  #     the floorless selector forces nothing else onto the 5.x line.
+  #     Bound at the 6.0.0 major boundary per this block's header rule, never
+  #     `<5.9.2`, which would self-invalidate the day 5.9.2 is itself flagged
+  #     (the undici 7.28.0 / brace-expansion 5.0.8 specimens, #4961 / #5032).
+  #     ⚠️ The advisory's CONTENT is NOT characterised here: api.osv.dev and
+  #     GitHub's /advisories endpoint are both refused by the authoring
+  #     container's egress proxy, so the severity and the fixed version above
+  #     are read off the scanner's own output line and nothing else.
+  'devalue@<6.0.0': '^5.9.2'