Reported by the os-dev round on #17356 and filed by the domain:spec seat (a dev reports the three classes; the seat files them).
The defect
packages/spec/scripts/liveness/check-liveness.mts builds its governance denominator from listMetadataTypeSchemaTypes(), under a comment reading "i.e. exactly the set of authorable metadata types".
⚠️ That is the same sentence #17356 measured false, one gate over. listMetadataTypeSchemaTypes() deliberately omits UNREGISTERED_KIND_SCHEMAS — per #6245, enrolling those entries 「would claim a status this change is careful not to grant」 — while the kinds in that map (analytics_cube, connector, sharing_rule, webhook) are authored through real doors (stack.connectors[], stack.analyticsCubes[], PUT /api/v1/meta/:type/:name).
⇒ the denominator answers "which types are REGISTERED", but the question the ratchet is asking is "which types does somebody AUTHOR". Two different questions, one function.
What it costs
webhook is patched in by hand — an EXTRA_SCHEMAS row plus a liveness/webhook.json. The other three (connector, sharing_rule, analytics_cube) are in neither GOVERNED nor PENDING_GOVERNANCE, so report.ungoverned structurally cannot name them.
⇒ the "no new undeclared surface" ratchet is blind to three authorable kinds, and — this is the part that makes it a finding rather than a nit — the blindness is invisible in its own output: a type that is in no bucket produces no row anywhere, so the report looks complete. A reader cannot tell the difference between "nothing ungoverned here" and "never looked".
Class
(b), violating a declared contract: the comment states the denominator IS the authorable set, and it measurably is not — the same shape #17356 proved for the reachability gate, in a second consumer of the same function.
⚠️ NOT measured and ⛔ not claimed: whether any key on those three kinds would actually be flagged if the denominator were corrected. The defect asserted here is the structural blindness, ⛔ not a count of what it hides.
Corroboration worth keeping
packages/spec/src/ui/door-reachability.testkit.ts runs the same kind of root enumeration and is not blind — it pushes ObjectStackSchema as an extra root and reaches connector through stack.connectors[]. ⇒ the codebase already contains a correct reading of "authored-document roots ≠ registered-type set"; the two gates simply disagree.
Suggested shape (⛔ not a ruling — the owning seat decides)
Whatever #17356 settles on for its own root union is probably the right shape here too — one spelling for "the kinds somebody authors", read by both gates, distinct from listMetadataTypeSchemaTypes(), which keeps answering the registration question correctly and untouched. ⛔ #6245's guarantee must survive either way.
查重词
liveness governance denominator · listMetadataTypeSchemaTypes · unregistered kinds · ungoverned · PENDING_GOVERNANCE
⛔ Not de-duplicated by this seat — 「立卡者不查重,只附 3–5 个查重词」. Filed bare (no domain:*, no priority:*): 「执行席永不定级或路由裸卡」.
Generated by Claude Code
Reported by the
os-devround on #17356 and filed by thedomain:specseat (a dev reports the three classes; the seat files them).The defect
packages/spec/scripts/liveness/check-liveness.mtsbuilds its governance denominator fromlistMetadataTypeSchemaTypes(), under a comment reading "i.e. exactly the set of authorable metadata types".listMetadataTypeSchemaTypes()deliberately omitsUNREGISTERED_KIND_SCHEMAS— per #6245, enrolling those entries 「would claim a status this change is careful not to grant」 — while the kinds in that map (analytics_cube,connector,sharing_rule,webhook) are authored through real doors (stack.connectors[],stack.analyticsCubes[],PUT /api/v1/meta/:type/:name).⇒ the denominator answers "which types are REGISTERED", but the question the ratchet is asking is "which types does somebody AUTHOR". Two different questions, one function.
What it costs
webhookis patched in by hand — anEXTRA_SCHEMASrow plus aliveness/webhook.json. The other three (connector,sharing_rule,analytics_cube) are in neitherGOVERNEDnorPENDING_GOVERNANCE, soreport.ungovernedstructurally cannot name them.⇒ the "no new undeclared surface" ratchet is blind to three authorable kinds, and — this is the part that makes it a finding rather than a nit — the blindness is invisible in its own output: a type that is in no bucket produces no row anywhere, so the report looks complete. A reader cannot tell the difference between "nothing ungoverned here" and "never looked".
Class
(b), violating a declared contract: the comment states the denominator IS the authorable set, and it measurably is not — the same shape #17356 proved for the reachability gate, in a second consumer of the same function.
Corroboration worth keeping
packages/spec/src/ui/door-reachability.testkit.tsruns the same kind of root enumeration and is not blind — it pushesObjectStackSchemaas an extra root and reachesconnectorthroughstack.connectors[]. ⇒ the codebase already contains a correct reading of "authored-document roots ≠ registered-type set"; the two gates simply disagree.Suggested shape (⛔ not a ruling — the owning seat decides)
Whatever #17356 settles on for its own root union is probably the right shape here too — one spelling for "the kinds somebody authors", read by both gates, distinct from
listMetadataTypeSchemaTypes(), which keeps answering the registration question correctly and untouched. ⛔ #6245's guarantee must survive either way.查重词
liveness governance denominator·listMetadataTypeSchemaTypes·unregistered kinds·ungoverned·PENDING_GOVERNANCE⛔ Not de-duplicated by this seat — 「立卡者不查重,只附 3–5 个查重词」. Filed bare (no
domain:*, nopriority:*): 「执行席永不定级或路由裸卡」.Generated by Claude Code