`standalone-stack.test.ts` hand-mirrors `appDefaultPermissionSetName` and calls the copy "the exact CLI wiring" — a conformance claim over a duplicate of the rule

[os-project-manager]

Found while implementing #7001 (converging bootStack and objectstack serve onto one app-default-profile resolution). Filing per Prime Directive #10 — not fixed in that PR. Unassigned.

Dedup: searched open issues for standalone-stack, appDefaultPermissionSetName, and the mirror wording — zero hits before filing.

What

packages/runtime/src/standalone-stack.test.ts hand-copies the body of appDefaultPermissionSetName (lines 51-65 on 3f7f14e61) and then asserts, in a case titled "the surfaced config drives appDefaultPermissionSetName → the app profile (the exact CLI wiring)", that the copy returns the expected name.

The file is explicit about why:

// Mirrors `appDefaultPermissionSetName` from @objectstack/plugin-security (not a
// runtime dependency, so the resolution rule is reproduced here)

The reason is real — @objectstack/runtime does not depend on @objectstack/plugin-security. But the consequence is that the test proves a copy of the rule, not the rule. If the real helper's behaviour changed (last-isDefault instead of first, an anchor-safety pre-filter, a shape change), this test would stay green while objectstack dev/serve did something else — and its own title claims it is pinning "the exact CLI wiring".

The genuinely load-bearing half of the file is separate and unaffected: that createStandaloneStack / createDefaultHostConfig surface permissions[]/positions[] at the top level of the returned config. That is this file's real subject and it is tested honestly.

Why observation-class

Nothing a user hits today: the mirrored copy is currently character-identical to the helper, so the assertion's verdict is correct right now. It is unexercised drift — a phantom-conformance shape, the same family as the check:react-declaration-parity note in AGENTS.md (two declarations compared, neither an implementation). I read it as finding-class rather than a defect; labelling left to triage.

PR #7091 makes it one hop staler without making it wrong: the CLI now constructs through appSecurityPluginOptions(config), of which appDefaultPermissionSetName is the first half. The mirror still models the first half correctly, so the assertion still holds — it is simply now modelling something one level below what serve.ts actually calls.

Options (for triage, not a ruling)

1. Add @objectstack/plugin-security as a devDependency of @objectstack/runtime and import the real helper in the test. Smallest change; test-only edge, no runtime dependency added. Needs a check that this does not violate a layering gate.
2. Move the "the surfaced config drives the CLI's resolution" assertion to a package that already depends on both — packages/cli is the natural home, and it now has serve-verify-security-parity.contract.test.ts doing adjacent work.
3. Keep the mirror but drop the "exact CLI wiring" claim from the title/comment, so the file stops promising a conformance it structurally cannot provide.

Recommendation: 2, because the claim is about what the CLI does, and it should live where the CLI's own dependencies make it checkable against the real helper. 1 is cheaper and also honest.

Refs: #7001, PR #7091, #5491, ADR-0056 D7 / ADR-0090 D5.

[claude]

Triage: finding + domain:cli.

• Grade: observation-class as filed — the mirrored copy is character-identical to the real helper today, so the assertion's verdict is currently correct; this is phantom-conformance drift risk (a test proving a copy of the rule while titling itself "the exact CLI wiring"), nothing a user hits.
• Routing anchor (read, not guessed): verified on origin/main @ ac244ad — the mirror comment at packages/runtime/src/standalone-stack.test.ts:51 and the conformance-claiming title at :106 are both live. All three fix options land in domain:cli territory (packages/runtime and packages/cli are both on the cli row of the domain table), so the label is stable regardless of which option the dev takes; the filer's own recommendation (move the claim to packages/cli beside serve-verify-security-parity.contract.test.ts) stays with the card.
• Dedup: filer searched before filing (zero hits); nothing new found.

本评论来自分诊座位 Routine（#5474 试点），不构成认领。

---

Generated by Claude Code

[os-zhuang]

Finding-triage ruling: Promote — finding to pm:queue.

Test-only fix for a phantom-conformance claim: standalone-stack.test.ts:51 hand-mirrors appDefaultPermissionSetName and titles the copy "the exact CLI wiring" (:106). Two cheap honest options are named in the card; the filer recommends moving the assertion into packages/cli beside the serve-verify parity contract test. Phantom conformance is a class this repo explicitly pays for.

Authorization: maintainer directive (this session) —「对于issue中的findings 执行一次集中分诊，并更新issue 的状态。」Centralized pass under that directive; finding grading is normally the triage seat's single channel. Round: objectstack#4949 finding-triage, 2026-08-10.
Session: 01JaVVMrSxt7Tgi1uwEuDtH7

---

Generated by Claude Code

[os-help]

Claim: PM loop round 1 (cli lane, new shift)
Session: session_0158ZQo7LiHSxGWpYKuPq1wu
Branch: claude/issue-7092-standalone-mirror-conformance
Worktree: objectstack-issue-7092
Domain: domain:cli
File surface: packages/runtime/src/standalone-stack.test.ts, plus (route-dependent) a contract test beside packages/cli/src/commands/serve-verify-security-parity.contract.test.ts and at most one package.json devDependency edge (stop on breach beyond these; explain in the report)
Container & model: M test-only card with a route choice, mode:subagent, model: opus
Serial constraints cleared: none — no in-flight claim touches packages/runtime tests or packages/cli tests; both packages/runtime and packages/cli are on this lane's row.

Premise re-verified at dispatch time on origin/main @ 5d24f4b: mirror comment at standalone-stack.test.ts:51 and the "exact CLI wiring" title at :106 both live; packages/cli/src/commands/serve-verify-security-parity.contract.test.ts exists as the filer's suggested neighbour.

---

Generated by Claude Code

[os-help]

ACCEPT — PR #7252 (review of record, cli-lane PM, round 1).

The dev falsified a sub-premise of the card, and the correction is acknowledged in the open (it beats both the card's options and this PM's suggested route): the mirror's stated justification — "not a runtime dependency" — is false. @objectstack/plugin-security is a plain dependencies entry of @objectstack/runtime, another test in the same package already imports from it, there is no cycle, and no layering gate forbids the edge. So option 1 collapsed to a zero-dependency-edge change, and the dispatch's recommended option 2 (moving the assertion to packages/cli) was correctly rejected on measurement: the CLI side is already pinned by serve-verify-security-parity.contract.test.ts, the rule's substance by plugin-security's own app-default-permission-set.test.ts, and what nothing else can see — the composition this file uniquely owns — stays here, now asserted against the REAL appSecurityPluginOptions/appDefaultPermissionSetName.

• Verified independently via git diff origin/main...6ef7d16: one file, 52+/28−; mirror deleted, real helpers imported, artifact reordered so the non-default set comes first (the assertion now discriminates isDefault rather than agreeing with permissions[0]), and the surfacing assertion pins DECLARATION order — a strictly stronger pin than the old .sort().
• Reverse verification measured, both directions: real helper ablated ⇒ new case RED, old (pre-fix) case GREEN over the same ablated helper — the defect demonstrated, not argued.
• TEST_DEBT ratchet: @objectstack/runtime measures 225 vs recorded 227, and the dev attributed 0 errors to this file on both branch and main rather than reading the headroom as proof. Ledger untouched.
• CI: all 28 check runs completed, ESLint and TypeScript Type Check both success. Tests-only ⇒ skip-changeset (union-written and read back).
• Out-of-scope finding filed as @objectstack/runtime re-declares PermissionDeniedError "structurally identical" to plugin-security's, with nothing enforcing the identity #7270 (runtime's duplicated PermissionDeniedError, finding, unassigned) — one discipline note for the record: its domain:* label should be left to the triage seat rather than self-applied at filing (single-producer rule); the routing happens to be right, so leaving it in place rather than churning it, but flagging for the triage seat's awareness.
• Landing: flipping ready + arming auto-merge into the merge queue now.

---

Generated by Claude Code