Skip to content

fix(runtime): /meta/:type/:name/published resolves from the published store, not the code snapshot - #8254

Merged
huangyiirene merged 2 commits into
mainfrom
claude/issue-8031-published-route-resolves-registry
Aug 13, 2026
Merged

fix(runtime): /meta/:type/:name/published resolves from the published store, not the code snapshot#8254
huangyiirene merged 2 commits into
mainfrom
claude/issue-8031-published-route-resolves-registry

Conversation

@huangyiirene

Copy link
Copy Markdown
Collaborator

Fixes #8031

Opened by the PM on the dev agent's behalf. The cloud dev container cannot reach the GitHub API (403 on every call — GitHub access is not enabled for this session); it can only git push. The branch, the commit, the tests and the changeset are entirely the dev's work.

What this is

GET /meta/:type/:name/published answered 404 for an item published at runtime — authored as an ADR-0027 draft and promoted via POST /packages/:id/publish-drafts — while the ordinary read GET /meta/:type/:name served it. The route and the publish path shared no store: the write flips the artifact's sys_metadata row state: 'draft' → 'active', while the route resolved from the code/package snapshot, which a runtime publish never touches.

Full rationale is in the changeset (.changeset/published-route-reads-published-store.md) — it is the dev's own text and the authoritative description of the change.

Shape

  • packages/runtime/src/domains/meta.ts — +49
  • packages/runtime/src/domains/meta-published-runtime-publish.test.ts — +315 (new)
  • changeset — +49

Additive only: 413 insertions, 0 deletions.

Review status

Draft pending my own review of the source diff and CI convergence. I am reviewing against this diff and origin/main, ⛔ not against a self-reported summary — the dev's structured report is stranded in its container by the same 403, so the diff and the changeset are the primary artifacts here.


Generated by Claude Code

…ed store, not the code snapshot

An item published at runtime — authored as an ADR-0027 draft and promoted via
`POST /packages/:id/publish-drafts` — answered 404 on this route while the
ordinary read `GET /meta/:type/:name` served it. The route and the publish path
shared no store: the write flips the artifact's `sys_metadata` row
`state:'draft' → 'active'` (that route's own comment notes it has "no metadata
service dependency"), and the read resolved only through
`metadataService.getPublished`, which reads the `publishedDefinition` key
`MetadataManager.publishPackage` writes into its own in-memory registry.

ADR-0027 (E)(5) defines sealing a publish as exactly that `draft → active`
flip, `SysMetadataRepository` names `'active'` "the published, live overlay",
and ADR-0033 §2 — the ADR this route cites — routes every authoring write into
that same ADR-0027 draft. The `active` overlay row is therefore authoritative
for "what is published", and the route now consults it first.

Read through `getMetaItemLayered`, whose overlay layer is a strict
`state:'active'` lookup reported separately from the code layer: a draft is
never served, and a null overlay falls through to the untouched `getPublished`
path so a code-published item answers the same bytes it always did.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011Q72AE6sKzpP8Z4o1RM7xy
@vercel

vercel Bot commented Aug 13, 2026

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment
Project Deployment Actions Updated (UTC)
objectstack Ignored Ignored Aug 13, 2026 12:51am

Request Review

@github-actions

Copy link
Copy Markdown
Contributor

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/runtime.

20 hand-written doc(s) reference the affected code and may need an implementation-accuracy re-verification:

  • content/docs/api/client-sdk.mdx (via packages/runtime)
  • content/docs/api/index.mdx (via @objectstack/runtime)
  • content/docs/api/wire-format.mdx (via @objectstack/runtime)
  • content/docs/automation/hook-bodies.mdx (via @objectstack/runtime)
  • content/docs/concepts/metadata-lifecycle.mdx (via @objectstack/runtime)
  • content/docs/concepts/north-star.mdx (via packages/runtime)
  • content/docs/data-modeling/drivers.mdx (via @objectstack/runtime)
  • content/docs/deployment/index.mdx (via @objectstack/runtime)
  • content/docs/deployment/production-readiness.mdx (via @objectstack/runtime)
  • content/docs/deployment/single-project-mode.mdx (via @objectstack/runtime)
  • content/docs/deployment/vercel.mdx (via @objectstack/runtime)
  • content/docs/getting-started/your-first-project.mdx (via @objectstack/runtime)
  • content/docs/kernel/cluster.mdx (via @objectstack/runtime)
  • content/docs/permissions/authentication.mdx (via @objectstack/runtime)
  • content/docs/permissions/authorization.mdx (via packages/runtime)
  • content/docs/permissions/system-context.mdx (via packages/runtime)
  • content/docs/plugins/packages.mdx (via @objectstack/runtime)
  • content/docs/protocol/kernel/http-protocol.mdx (via @objectstack/runtime)
  • content/docs/protocol/kernel/index.mdx (via @objectstack/runtime)
  • content/docs/protocol/kernel/lifecycle.mdx (via @objectstack/runtime)

2 release-owned page(s) also reference the affected code. These are read-only:

  • content/docs/releases/implementation-status.mdx (via @objectstack/runtime)
  • content/docs/releases/v17.mdx (via @objectstack/runtime)

content/docs/releases/ is RELEASE-OWNED (AGENTS.md "Documentation Guardrails"): release
notes are written centrally at release time, and a code PR that edits them is the exact PR
that guardrail exists to stop. They are still audited — read-only. If one of them is actually
wrong, file an issue or open a dedicated docs-only PR; do not edit it here.

Advisory only. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs origin/main → pass the list as args.docs.

@github-actions github-actions Bot added documentation Improvements or additions to documentation tests tooling labels Aug 13, 2026
…ispatch contract

`check:engine-double-contract` flagged this file's fake engine on BOTH write
verbs: its `update()` and `delete()` accepted calls the real `ObjectQL` engine
would refuse, and a double looser than the producer is how #4434 shipped a dead
route with its suite green.

Both verbs now open with the producer's own predicate —
`assertEngineUpdateDispatch(data, options)` / `assertEngineDeleteDispatch(options)`
— imported from `@objectstack/metadata-core`, where they have lived since #5619,
rather than from `@objectstack/objectql` (which re-exports them but depends on
this side of the graph, so the import would close a cycle turbo rejects).

No baseline entry: the pin applies cleanly here. No production code changed —
the five cases still pass, and reverting the `/published` fix still turns the
two runtime-published cases red, so the suite remains load-bearing under the
stricter double.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011Q72AE6sKzpP8Z4o1RM7xy
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

documentation Improvements or additions to documentation size/m tests tooling

Projects

None yet

2 participants