[0 of #7891] ADR-0091 seed pair crosses the publish door: `runtimeTypes: ['seed']` — measured trip-free first slice

[hotlong]

Programme slice of #7891 (split by the domain:spec seat, session session_01Euoy6wyfzgiWtgCg4s6JK2, per the triage note of 2026-08-12 sanctioning a Blocked-by:-ordered split). Independent — no Blocked-by:.

Scope

One decision crossing the wall whole, per the parent card's own staging: register runtimeTypes: ['seed'] for the ADR-0091 pair (security-grant-expired-at-authoring, security-delegation-missing-reason) so they enforce at the runtime publish door, plus the pin that records the crossing.

Measured facts inherited from PR #7886 (re-run, do not trust)

• The pair reads only stack.data[]; the seed → data stack key was corrected under fix(lint): make validateSecurityPosture's surfaceReason a measured claim (#7576) #7886.
• Trip-free on the shipped corpus (showcase + CRM + todo + blank): zero error findings at both surfaces.
• Re-check: packages/lint/src/validate-security-posture.runtime-surface.test.ts is the executable measurement.

Constraints

• The whole sub-family crosses by this one decision — if measurement shows either rule now trips on the corpus, stop and report rather than exempting shapes ad hoc.
• ⛔ No partial security-role-word wiring smuggled in (parent card's [finding] The four views[] visibility-predicate rules are CLI-only — a Studio/REST/MCP view write bypasses all of them; if they move to runtime-publish, they must move together #7220 constraint).

Sequencing

⛔ Hold until #8116's PR merges — its dev is in flight in packages/lint (different files, same package; serialized by the seat to keep batches package-disjoint). Size S-mechanical once unblocked.

Part of #7891.

[hotlong]

Claim: PM loop round 2 (backfill slot after #7816 close; maintainer 2026-08-13: 「任务很多,并发加到3」)
Session: session_01Euoy6wyfzgiWtgCg4s6JK2
Branch: claude/issue-8307-seed-pair-runtime-types
Worktree: objectstack-issue-8307
Domain: domain:spec
File surface: the validateSecurityPosture registration in packages/lint (runtimeTypes gains 'seed') + the runtime-surface pin extension; changeset (stop on breach; explain in the report)
Container & model: S (mechanical — correctness judged by the gate farm), mode:subagent, model: sonnet
Serial constraints cleared: the packages/lint hold released — #8116 / PR #8342 MERGED (2d8dba312); no in-flight claim touches packages/lint (in flight this round: #8273 → error-code-ledger + service-settings, #8057 → objectql engine + kernel schema). Upstream #8308 (blocker-A seed repair) MERGED via PR #8338 — the measured trip-free premise for the seed pair is refreshed by that landing's own pins.

---

Generated by Claude Code

[hotlong]

<!-- os-dev-report -->

{
  "issue": 8307,
  "status": "done",
  "branch": "claude/issue-8307-seed-pair-runtime-types",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/8390",
  "premise_still_valid": true,
  "summary": "Registered runtimeTypes: ['seed'] on the whole `validateSecurityPosture` registry entry in packages/lint/src/authoring-rules.ts (surfaces: CLI_ONLY -> CLI_AND_RUNTIME), putting the ADR-0091 seed pair (security-grant-expired-at-authoring, security-delegation-missing-reason) on the runtime publish door. Extended validate-security-posture.runtime-surface.test.ts with real runRuntimeAuthoringRules pins (not the pre-crossing mirror): the crossing itself, a clean-write positive control, and an isolation proof that a seed write leaks no finding from the other 11 rule ids this one entry also carries (proven against a context object that would trip two of them if isolation failed). Added a changeset.",
  "tests": "pnpm --filter @objectstack/lint build -> exit 0. pnpm --filter @objectstack/lint test -- --maxWorkers=2 -> Test Files 72 passed (72), Tests 1978 passed (1978). pnpm --filter @objectstack/lint typecheck -> clean. Corpus re-measurement (hard constraint, re-run not inherited): grepped every defineSeed() call site across all four shipped stacks (examples/app-showcase, examples/app-crm, examples/app-todo, packages/create-objectstack/src/templates/blank) -- none authors a sys_user_position or sys_user_permission_set seed row at all (zero hits for valid_until/delegated_from and both object names across all three source trees; blank has no seed data). So the ADR-0091 loop body never executes for the current corpus -- a structural zero, not a counted-and-hoped-stays-zero one. No STOP condition was hit. Local gates re-derived via node scripts/pm/dispatch-gates.mjs against the committed diff: check:spec-parsed-alias OK, check:cross-package-test-inputs OK, check:changeset-gate-self-tests OK, check:objectui-changeset/pin-fresh self-tests OK, check-changeset-no-major.mjs 'no major bump', check-adr-0087-registration.mjs 'adds no declared-breaking changeset', check:query-options-erasure ratchet holds (new test file didn't add unswept sites), check:type-check-coverage unaffected, check:nul-bytes OK. check:api-surface untouched as expected (no packages/spec source in this diff).",
  "open_questions": [],
  "out_of_scope_findings": []
}

---

Generated by Claude Code

[hotlong]

os-dev-report (correcting the marker in the previous comment, which was posted HTML-entity-escaped by mistake and not the literal <!-- os-dev-report --> text)

{
  "issue": 8307,
  "status": "done",
  "branch": "claude/issue-8307-seed-pair-runtime-types",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/8390",
  "premise_still_valid": true,
  "summary": "Registered runtimeTypes: ['seed'] on the whole `validateSecurityPosture` registry entry in packages/lint/src/authoring-rules.ts (surfaces: CLI_ONLY -> CLI_AND_RUNTIME), putting the ADR-0091 seed pair (security-grant-expired-at-authoring, security-delegation-missing-reason) on the runtime publish door. Extended validate-security-posture.runtime-surface.test.ts with real runRuntimeAuthoringRules pins (not the pre-crossing mirror): the crossing itself, a clean-write positive control, and an isolation proof that a seed write leaks no finding from the other 11 rule ids this one entry also carries (proven against a context object that would trip two of them if isolation failed). Added a changeset.",
  "tests": "pnpm --filter @objectstack/lint build -> exit 0. pnpm --filter @objectstack/lint test -- --maxWorkers=2 -> Test Files 72 passed (72), Tests 1978 passed (1978). pnpm --filter @objectstack/lint typecheck -> clean. Corpus re-measurement (hard constraint, re-run not inherited): grepped every defineSeed() call site across all four shipped stacks (examples/app-showcase, examples/app-crm, examples/app-todo, packages/create-objectstack/src/templates/blank) -- none authors a sys_user_position or sys_user_permission_set seed row at all (zero hits for valid_until/delegated_from and both object names across all three source trees; blank has no seed data). So the ADR-0091 loop body never executes for the current corpus -- a structural zero, not a counted-and-hoped-stays-zero one. No STOP condition was hit. Local gates re-derived via node scripts/pm/dispatch-gates.mjs against the committed diff: check:spec-parsed-alias OK, check:cross-package-test-inputs OK, check:changeset-gate-self-tests OK, check:objectui-changeset/pin-fresh self-tests OK, check-changeset-no-major.mjs 'no major bump', check-adr-0087-registration.mjs 'adds no declared-breaking changeset', check:query-options-erasure ratchet holds (new test file didn't add unswept sites), check:type-check-coverage unaffected, check:nul-bytes OK. check:api-surface untouched as expected (no packages/spec source in this diff).",
  "open_questions": [],
  "out_of_scope_findings": []
}

---

Generated by Claude Code

[hotlong]

ACCEPT — reviewed by the dispatching seat (session session_01Euoy6wyfzgiWtgCg4s6JK2) against PR #8390's diff.

Verified: 4 files, surface exact (the runtime-gate.ts stale-comment refresh on the now-load-bearing seed: 'data' mapping is in-spirit and declared). The whole-entry runtimeTypes: ['seed'] declaration is safe by the baseline/candidate differential — and the PR proves it with an isolation positive-control test (a context that would trip security-owd-unset + security-role-word if the diff leaked, asserting zero leaked findings) rather than asserting it in prose. The trip-free corpus claim was re-measured, not inherited, and came back STRUCTURAL: none of the four shipped apps seeds a grant/delegation row at all, so the ADR-0091 loop body never executes for the current corpus. Changeset minor follows the #7220 family-crossing precedent over the dispatch's patch default — the justified deviation is correct. object/permission/book and security-role-word correctly untouched (#8310's residue).

Process notes: this dev stalled once on a background wait (the #8294 shape, second instance this shift) and delivered cleanly after a foreground reset; its first report comment had a self-broken marker, caught by its own read-back and re-posted — both incidents recorded for the #8294 thread's evidence pile.

Landing: draft until gate jobs conclude; flip + auto-merge (squash) on the timed check. On merge, the #7891 programme checklist advances: slice 0 done, slice 1 (#8308) done, slice 2 (#8309) on #4463, slice 3 (#8310) still blocked.

---

Generated by Claude Code