reader program 5/4 — `@objectstack/verify`: an option-B artifact makes `os verify` report a green run that measured nothing

[hotlong]

Part of #14122 · blocks #14512 · split out of #15210 (the by-shape sweep record — read it for the sweep method and the triaged false positives) · acceptance pin is #15004.

Reader half of the program ruled on #14512 (comment 5528589044). The artifact stays additive through this card.

Why this one carries priority:p2 while the rest of the program is p3

Every other reader card loses a capability. This one loses the verification itself, and reports success while doing it.

file:line	Reads	What an option-B artifact does to it
packages/verify/src/derive.ts:176	config.objects	deriveCrudCases derives ZERO CRUD round-trip cases
packages/verify/src/derive.ts:180	config.datasources	the datasource-by-name map is empty, so every derived case loses its datasource
packages/verify/src/rls.ts:134	config.positions	declaredPositionNames returns [] — no persona is built for any declared position
packages/verify/src/rls.ts:346	config.objects	rlsProbePermissionSet builds an EMPTY probe permission set — the persona that makes an RLS run a probe grants nothing and narrows nothing

Reached today from packages/cli/src/commands/verify.ts:155 (declaredPositionNames(config) on the loaded config; rlsProbeSecurity / deriveCrudCases run off the same object).

So a multi-package app under option B would get a passing os verify that asserts nothing about any of its objects. A missing collection is at least missing — someone eventually notices the gap. Zero derived cases dressed as a green run is the failure mode #15004 exists to make loud, arriving in the one place where a false green is most expensive: the command whose entire job is to tell you the app works.

The pin, already on main

#15004 merged. Read all three before writing implementation:

• packages/cli/test/fixtures/option-b-collection-zoo.ts
• packages/cli/test/fixtures/option-b-reader-probe.ts
• packages/cli/test/option-b-reader-acceptance.pin.test.ts

⚠️ Neither @objectstack/verify site has a row in OPTION_B_LOSSES today — which is exactly why the by-shape sweep, and not the pin, is what found them. So this card does both halves: add the rows that ledger the loss, then fix the readers and delete them. Do it in that order and say so in the PR, because a row that never existed is a row nobody can check you against.

The pin asserts by set equality: adding a row for a loss that is already fixed goes red just as surely as leaving a row for one that is not. ⛔ Never weaken the pin to pass — do not relax set equality, stop asserting a subsystem, or add rows to silence a red.

Acceptance

• Both files resolve their collections through resolveArtifactPackageOrder (@objectstack/core, ADR-0130 D4+D5, since fix(metadata): register a packages[] artifact per package at the metadata door so every object has one owner across every door (#14599) #14643) — flattened top level first, so today's additive artifact answers bit-identically and packages[] only supplies what the top level lacks. That ordering is what makes this card revertible on its own and safe before the emitter half.
• ⛔ Do not iterate config.packages directly — a second traversal is a second ordering.
• The probe grows a row per subsystem above, and each is deleted by the fix in the same PR.
• ⛔ Do not change composeStacks, packages/spec/src/stack.zod.ts, or what any command emits.
• ⛔ Never edit content/docs/releases/.

Sibling cards: #15005 (@objectstack/runtime), #15006 (@objectstack/cli), #15007 (@objectstack/plugin-security, landed as PR #15226), 6/4 (@objectstack/plugin-dev). Emitter half: #14512.

[hotlong]

Claiming this card.

• session: session_01UHvF5hyiZjnCyExFnfQB8m
• branch: claude/issue-15229-verify-option-b-readers

Scope stays inside @objectstack/verify plus the @objectstack/cli acceptance probe rows (#15004). Order is the one the card fixes: add the ledger rows and show them RED first, then fix the four readers, then delete the rows.

Generated by Claude Code

---

Generated by Claude Code

[hotlong]

os-dev-report

{
  "issue": 15229,
  "status": "done",
  "branch": "claude/issue-15229-verify-option-b-readers",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/15281",
  "premise_still_valid": true,
  "summary": "All four `@objectstack/verify` reads now resolve through `resolveArtifactPackageOrder` (flattened top level FIRST, `packages[]` only where that came back falsy), so an option-B artifact no longer yields an `os verify` that derives zero CRUD cases, builds an empty RLS probe permission set, mints no persona for any declared position, and prints a green run. Done in the card's order and the history carries it: commit 8583bfbba adds four probe rows (all calling shipped readers) and shows them RED as unledgered losses, then ledgers them; commit 5c0de742c fixes the readers, the pin goes RED naming the four lines to delete, and the same commit deletes them; commit 4525eee11 adds the alias/`paths` rules `check:test-source-alias` and `check:type-source-resolution` prescribe for the two new cross-package imports (neither shrink-only registry widened). The datasource site needed a fixture member the zoo lacked — a write-opted-in federated object in one package gated by a federated datasource in the other — so the pin's anti-vacuity control list grows by that object; set equality, the asserted subsystems and the control itself are untouched, and the ledger is 24 rows before and after. `composeStacks`, `packages/spec/src/stack.zod.ts`, command emission and `content/docs/releases/` are untouched. Two contract notes for the PM: (1) per the dispatch base contract I never write `assignee` — the card was unassigned when it reached me and the claim comment carrying this session id and branch is the identity marker, which conflicts with this dispatch prompt's instruction to self-assign; (2) the REST read channel is 403 in this container and `gh` is absent, so GitHub reads and writes went through MCP.",
  "tests": "All measurements on the final head 4525eee11 (a merge of origin/main 460134af8), heavy runs through scripts/pm/os-verify-lock.sh. RED #1 (rows in, ledger lines absent): `A subsystem lost a collection that the ledger does not carry ... B2 · verify declaredPositionNames · positions / B2 · verify deriveCrudCases · objects / B2 · verify deriveCrudCases federated write gate · datasources / B2 · verify rlsProbePermissionSet · objects`, observed 0 / 'no case derived at all' / 0 / '0 granted object(s), 0 owner-scope rule(s)', with BASELINE green in the same run. RED #2 (readers fixed, ledger untouched): `A ledgered subsystem now SEES its collections under option B ... Delete these lines from OPTION_B_LOSSES:` naming the same four. GREEN after deletion: `pnpm --filter @objectstack/cli exec vitest run test/option-b-reader-acceptance.pin.test.ts` = Test Files 1 passed, Tests 6 passed. `pnpm --filter @objectstack/verify exec vitest run` (whole package, re-run after the vitest alias landed) = Test Files 10 passed, Tests 58 passed. `pnpm --filter @objectstack/verify typecheck` clean; `pnpm --filter @objectstack/cli typecheck` clean with its test-typecheck debt unchanged (3 files / 28 errors / 6 pinned signatures). Gates: `node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands` derived 42 for this change set, re-derived identical after the config commit; all 42 run, 40 green. NOT MEASURED, never counted green: `pnpm check:dual-build-cjs-loads` exit 3 `PREREQUISITE NOT MET` (reads built output; only the @objectstack/cli closure was built here, 12 packages have no dist/), and `node scripts/check-test-completeness.mjs` exit 3 (parses a full `turbo run test` summary a targeted run does not produce). `check:test-source-alias` and `check:type-source-resolution` were RED on first pass and are green after 4525eee11. 7 extra gates run beyond the derived list (console-intercept-disarm, test-completeness, published-files, type-check-coverage, cross-package-test-inputs, nul-bytes, cli-test-child-env). Every exit code captured before any pipe (`cmd > log 2>&1; EXIT=$?`); no ablation was performed. No CI wait: report filed at draft-PR time per the dispatch contract.",
  "mcp_calls": "11 — 5 issue reads (#15229 + its comments, #15210, #15004, #15007), 1 dedupe search_issues, 1 claim comment, 1 create_pull_request, 1 pull_request_read (body read-back), plus this report comment and its read-back.",
  "open_questions": [],
  "out_of_scope_findings": [
    "already filed as #15145: `packages/verify/tsconfig.json` excludes `**/*.test.ts`, so the package's `typecheck` script covers none of its 10 test files, including the one this PR adds. Re-measured here with a throwaway program that includes them: 3 errors, all TS2835 in three pre-existing `harness.*.test.ts` files, 0 in the new file. No new issue filed; the `paths` rule this PR adds lives in the build program and carries over unchanged when that card lands the `tsconfig.test.json` sibling."
  ]
}

Generated by Claude Code

---

Generated by Claude Code