publish-smoke 的 tarball 钉表按 @objectstack/* 作用域构造,漏掉无作用域的 create-objectstack——17.2.0 候选烟测假红,钉表应从可发布集派生

[os-zhuang]

维护者 2026-08-23 裁决(发版现场,原文):「A:先修烟测再发(推荐)」。skills 席 session 757f0dc0-5dae-51d7-9053-c15c57ebfe3b 立卡即派发。本卡阻塞 17.2.0 发版,最高优先。

实测(run 32622283383,job Packed-tarball smoke (release candidate))

[ERR_PNPM_NO_MATCHING_VERSION] No matching version found for create-objectstack@17.2.0
This error happened while installing the dependencies of @objectstack/cli@17.2.0
The latest release of create-objectstack is "17.1.0".

三个已核事实:

1. 钉表按作用域构造(publish-smoke.yml:17 自述「@objectstack/* to the tarballs via the project's own pnpm [overrides]」)——无作用域的 create-objectstack 不被打包/钉住,pnpm 对它落回 registry,17.2.0 未发布 → 必红(鸡生蛋)。
2. 该依赖是本轮新增:npm 上 @objectstack/cli@17.1.0 的 dependencies 无 create-objectstack(registry 实测),所以既往发版烟测从未踩到。
3. 候选本身健康:create-objectstack 在 69 包 fixed 组、private:false,17.2.0 与 cli 同批发布——这是烟测盲区,非发布缺陷。

修法

scripts/publish-smoke-pack.mjs(+ 必要时 scripts/publish-smoke.sh / publish-smoke.yml):tarball 打包集与 override 钉表从可发布集派生——workspace 成员 ∧ private:false(或等价地从 .changeset/config.json 的 fixed 组读,择一并论证哪个是真源头),⛔ 不再用 @objectstack/* 作用域过滤,⛔ 不加手写名单——下一个无作用域包不得重蹈。派生处加断言:钉表集合 ≡ 可发布集(双向),缺一员即红并点名。

验证要求

• 本地复现先行:在 17.2.0 候选树上跑现钉表构造,证明 create-objectstack 缺席;修后同一构造包含它,并且本地跑通烟测安装段(pack 全集 + 脚手架安装,能跑多远跑多远,跑不动的部分说明并留给 CI);
• 若脚本带 self-test,扩自测钉住「无作用域包在集合内」与「集合≡可发布集」两个方向;
• dispatch-gates 派生并跑全族;check-governed-merges --test 判落地类(scripts/** + workflows 预期普通面);changeset 按门的处方(scripts-only 预期 skip-changeset);
• PR 正文附:失败 run 链接、修前/修后钉表集合差、以及给发版现场的一句话——合并后如何再触发一轮烟测拿真绿(读 publish-smoke.yml 的触发器写清楚)。

时序

本卡合并 → 重跑烟测真绿 → 维护者合 #10183(17.2.0)→ 批准 release 环境。#10183 无需重刷(本卡 scripts-only,不进发布集)。

[os-zhuang]

CLAIM — session 757f0dc0-5dae-51d7-9053-c15c57ebfe3b(skills 席),branch claude/issue-11253-smoke-unscoped-pin。维护者发版现场裁决「A:先修烟测再发」,阻塞 17.2.0,立卡即派发。

---

Generated by Claude Code

[os-zhuang]

{
  "issue": 11253,
  "status": "done",
  "branch": "claude/issue-11253-smoke-unscoped-pin",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/11257",
  "premise_still_valid": true,
  "summary": "The defect and its release impact are confirmed exactly as the card describes; one mechanism correction. The pin set was NOT built from an @objectstack/* scope glob — publish-smoke-pack.mjs already derived from `private !== true`. The hole was a hand-written by-name exclusion on top of that derivation (`const EXCLUDE = new Set(['create-objectstack'])`), whose stated rationale ('no @objectstack/* manifest depends on it') expired when @objectstack/cli took a dependency on the scaffolder. A scope filter DID exist in the second site the card named: the registry-leak assertion in publish-smoke.sh grepped `'@objectstack/[^'@]+@[0-9]`, so it was blind in precisely the case it existed to catch — the failed run got `ok — 0 leaks` and then died inside pnpm 200 lines later. Both are fixed: the set is now the publishable population with no filter/exclusion/hand list, `assertPinSetTotal` re-checks pin set == publishable set in BOTH directions at the derivation site naming offenders, and the leak guard drives off the override map's own names. A --self-test is wired as `check:publish-smoke-pin` in lint.yml so the release-path assertion reddens on the PR that breaks it rather than on the operator's release run. Source of truth argued in the PR body: the workspace, because the .changeset fixed group is a derived declaration that check-changeset-fixed.mjs keeps honest — measured identical (69 == 69) on this branch.",
  "tests": "All at final commit c2fc2d9e (gate union run AFTER the last commit). REPRODUCTION: current construction yields 68 members, create-objectstack absent; after the fix 69, present — and it is the ONLY unscoped publishable package, which is why no all-@ fixture could catch it. FULL SMOKE RAN LOCALLY AND PASSED — `bash scripts/publish-smoke.sh` (pack mode) after building the closure: `Packing 69 publishable package(s)`, `wrote .../pnpm-workspace.yaml (69 overrides)` including `'create-objectstack': 'file:.../create-objectstack-17.1.0.tgz'`, new guard `ok — 58/69 pinned packages resolved from tarballs, 0 registry leaks`, auth + REST CRUD probes 200/201, `== Publish smoke passed (pack mode)`. No leg was left to CI. ISOLATED INSTALL LEG with the real tarballs, two throwaway projects differing only in the pin: OLD (68) lockfile reads `create-objectstack@17.1.0:` = npm REGISTRY; NEW (69) reads `create-objectstack@file:../tarballs/create-objectstack-17.1.0.tgz` = candidate tarball. Packed cli manifest confirms the trigger: `create-objectstack dep: \"17.1.0\"` (pnpm pack rewrites workspace:* to a concrete version). GUARD HALF against that same leaking lockfile: OLD scope grep returned ok (blind); NEW guard EXIT=1 naming `create-objectstack@17.1.0`. ABLATION (no build/dist involved — the script is executed directly, not resolved through a package `exports`, so no rebuild leg applies; each mutation was confirmed ON DISK by grepping for BOTH the injected and the removed text before running, not by the editor's exit code): restoring the by-name exclusion turned case 1 red (`unscoped public package dropped from the set: [\"@objectstack/cli\"]`); neutering the equality branch turned cases 2 and 3 red (`a pin set missing a publishable member was accepted`). RESTORE LEG re-verified with the mutation proven absent (grep count 0) and `SELF-TEST PASSED (4 cases)`; the ablation script carried a `trap ... EXIT INT TERM` restore. GATES: `node scripts/pm/dispatch-gates.mjs` (no hand-fed paths) derived 17 families from the real change set; all 17 green. check:type-check-debt initially refused with `--re-measure cannot run: 56 workspace dependenc(ies) ... have no built type entry point on disk`, so the closure was built as lint.yml does (turbo build, `70 successful, 70 total`) and it then printed `check-type-check-coverage --re-measure: OK — 33 ledger entr(ies) re-measured, 1897 raw tsc error(s) total, none above its recorded number` (its lowering hints are pre-existing, untouched by this diff). check:nul-bytes `OK (scanned 6527 text file(s) ... no raw ASCII control bytes)` plus a manual control-byte scan of the five changed files (no hits). Every verdict above is quoted from the gate's own printed line, never a bare $?; heavy steps ran through scripts/pm/os-verify-lock.sh. GOVERNED-MERGES: `node scripts/pm/check-governed-merges.mjs --test` on the final five-path file list → `0 of 5 path(s) hit the register` / `NOT governed — ordinary queue landing applies`; its --self-test passed 119 assertions. CHANGESET: none — `skip-changeset` applied and CONFIRMED BY READ-BACK (labels now ci/cd, dependencies, size/m, skip-changeset); nothing here ships to npm.",
  "open_questions": [],
  "out_of_scope_findings": []
}

For the release operator (also in the PR body): merging does not start a smoke run — publish-smoke.yml has only schedule (weekly registry canary) and workflow_dispatch. After this merges, open publish-smoke.yml → Run workflow → branch main → Run. That dispatch runs the pack-smoke job (if: github.event_name != 'schedule'), the leg that was failing.

---

Generated by Claude Code

[os-zhuang]

os-dev-report

(Supersedes the previous comment: its leading HTML-comment marker was eaten by GitHub's body sanitizer, which makes it invisible to a marker scan. Same report, literal-text marker. No comment-edit tool is available on this seat, hence a replacement rather than an edit.)

{
  "issue": 11253,
  "status": "done",
  "branch": "claude/issue-11253-smoke-unscoped-pin",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/11257",
  "premise_still_valid": true,
  "summary": "The defect and its release impact are confirmed exactly as the card describes; one mechanism correction. The pin set was NOT built from an @objectstack/* scope glob — publish-smoke-pack.mjs already derived from `private !== true`. The hole was a hand-written by-name exclusion on top of that derivation (`const EXCLUDE = new Set(['create-objectstack'])`), whose stated rationale ('no @objectstack/* manifest depends on it') expired when @objectstack/cli took a dependency on the scaffolder. A scope filter DID exist in the second site the card named: the registry-leak assertion in publish-smoke.sh grepped `'@objectstack/[^'@]+@[0-9]`, so it was blind in precisely the case it existed to catch — the failed run got `ok — 0 leaks` and then died inside pnpm 200 lines later. Both are fixed: the set is now the publishable population with no filter/exclusion/hand list, `assertPinSetTotal` re-checks pin set == publishable set in BOTH directions at the derivation site naming offenders, and the leak guard drives off the override map's own names. A --self-test is wired as `check:publish-smoke-pin` in lint.yml so the release-path assertion reddens on the PR that breaks it rather than on the operator's release run. Source of truth argued in the PR body: the workspace, because the .changeset fixed group is a derived declaration that check-changeset-fixed.mjs keeps honest — measured identical (69 == 69) on this branch.",
  "tests": "All at final commit c2fc2d9e (gate union run AFTER the last commit). REPRODUCTION: current construction yields 68 members, create-objectstack absent; after the fix 69, present — and it is the ONLY unscoped publishable package, which is why no all-@ fixture could catch it. FULL SMOKE RAN LOCALLY AND PASSED — `bash scripts/publish-smoke.sh` (pack mode) after building the closure: `Packing 69 publishable package(s)`, `wrote .../pnpm-workspace.yaml (69 overrides)` including `'create-objectstack': 'file:.../create-objectstack-17.1.0.tgz'`, new guard `ok — 58/69 pinned packages resolved from tarballs, 0 registry leaks`, auth + REST CRUD probes 200/201, `== Publish smoke passed (pack mode)`. No leg was left to CI. ISOLATED INSTALL LEG with the real tarballs, two throwaway projects differing only in the pin: OLD (68) lockfile reads `create-objectstack@17.1.0:` = npm REGISTRY; NEW (69) reads `create-objectstack@file:../tarballs/create-objectstack-17.1.0.tgz` = candidate tarball. Packed cli manifest confirms the trigger: create-objectstack dep resolved to the concrete string 17.1.0 (pnpm pack rewrites workspace:* to a concrete version). GUARD HALF against that same leaking lockfile: OLD scope grep returned ok (blind); NEW guard EXIT=1 naming `create-objectstack@17.1.0`. ABLATION (no build/dist involved — the script is executed directly, not resolved through a package `exports`, so no rebuild leg applies; each mutation was confirmed ON DISK by grepping for BOTH the injected and the removed text before running, not by the editor's exit code): restoring the by-name exclusion turned case 1 red (unscoped public package dropped from the set, leaving only @objectstack/cli); neutering the equality branch turned cases 2 and 3 red (`a pin set missing a publishable member was accepted`). RESTORE LEG re-verified with the mutation proven absent (grep count 0) and `SELF-TEST PASSED (4 cases)`; the ablation script carried a `trap ... EXIT INT TERM` restore. GATES: `node scripts/pm/dispatch-gates.mjs` (no hand-fed paths) derived 17 families from the real change set; all 17 green. check:type-check-debt initially refused with `--re-measure cannot run: 56 workspace dependenc(ies) ... have no built type entry point on disk`, so the closure was built as lint.yml does (turbo build, `70 successful, 70 total`) and it then printed `check-type-check-coverage --re-measure: OK — 33 ledger entr(ies) re-measured, 1897 raw tsc error(s) total, none above its recorded number` (its lowering hints are pre-existing, untouched by this diff). check:nul-bytes `OK (scanned 6527 text file(s) ... no raw ASCII control bytes)` plus a manual control-byte scan of the five changed files (no hits). Every verdict above is quoted from the gate's own printed line, never a bare $?; heavy steps ran through scripts/pm/os-verify-lock.sh. GOVERNED-MERGES: `node scripts/pm/check-governed-merges.mjs --test` on the final five-path file list → `0 of 5 path(s) hit the register` / `NOT governed — ordinary queue landing applies`; its --self-test passed 119 assertions. CHANGESET: none — `skip-changeset` applied and CONFIRMED BY READ-BACK (labels now ci/cd, dependencies, size/m, skip-changeset); nothing here ships to npm.",
  "open_questions": [],
  "out_of_scope_findings": []
}

For the release operator (also in the PR body): merging does not start a smoke run — publish-smoke.yml has only schedule (weekly registry canary) and workflow_dispatch. After this merges, open publish-smoke.yml → Run workflow → branch main → Run. That dispatch runs the pack-smoke job (if: github.event_name != 'schedule'), the leg that was failing.

---

Generated by Claude Code