Checklist cli

cli

Generated by pnpm gen:checklist-status from docs/qa/platform-checklist/areas/*.json. ⛔ Do not edit this page — edits go to the area JSON and this page follows on the next run. This page is Checklist-cli.

CLI — os dev/build/migrate/verify/test boot, load, execution & exit-code contracts, scaffold first-run, flag/command error UX

31 active · 0 planned

Active (31)

id	title	priority	status	personas
cli.dev-boot-contract	os dev boots to healthy with a loginable seeded admin, honest DB selection, reported port shifts, and a staleness warning	P0	active	operator (local shell)
cli.build-own-contract	os build's own contract: no computed value in the exit slot, located errors for schema and author-time rule failures, artifact + stats output, warnings never flip the exit	P1	active	operator (local shell)
cli.migrate-plan-apply-json	os migrate: bare command is a read-only plan, apply is safe-by-default, re-runs are idempotent, and --json exits 0 on success (#4873)	P1	active	operator (local shell)
cli.verify-verdict-exit-mapping	objectstack verify: verdict vocabulary is closed, exit is nonzero exactly on failure verdicts, and the inconclusive split (needs-fixture/skipped) never fails the run	P1	active	operator (local shell)
cli.scaffold-first-run	The published first-run closes: create-objectstack scaffold → install → validate → build → boot → health, with the skills boundary holding	P1	active	new user (published-registry consumer)
cli.qa-suite-execution	os test: a Quality Protocol suite is validated at LOAD, executed against a booted app, and its verdict is the exit code — capture/interpolation thread state, an unevaluable assertion FAILS	P1	active	operator (local shell), suite author (writes qa/*.test.json)
cli.flag-command-error-ux	Wrong flags and unknown commands error with usage and a nonzero exit — never silently ignored, never executed anyway	P2	active	operator (local shell)
cli.migrate-meta-codemod	os migrate meta replays the spec migration chain over authored sources and PRINTS the mechanical edit list the retirement messages prescribe — by default it rewrites no source file, and --write rewrites in place exactly the edits it can prove, held to a re-run of the chain; its --out snapshot is schema-valid, replay is idempotent, and a below-floor --from is refused	P1	active	build-time author (no session)
cli.scaffold-console-first-paint	The documented newcomer verification loop closes on a FRESHLY SCAFFOLDED project: os validate passes and the Console actually paints at /_console/ — the seam between the scaffold item and the showcase boot item	P1	active	a brand-new developer following the published docs, with no prior project (content/docs/getting-started/quick-start.mdx carries the validate/dev check but no create-objectstack command; the scaffold line is the scaffolder's own published usage)
cli.doctor-health-report	os doctor: every check emits an attributed row, an unparseable posture is an ERROR not a swallow, ledger rows print under every posture, the ✓ is withheld when the read was incomplete — and the two monorepo-anchored scans announce a named skip in a user app instead of blessing a tree they never walked	P1	active	operator (local shell)
cli.doctor-deprecation-scan	os doctor --scan-deprecations: every retired pattern is found with file:line attribution, decoys are skipped, the run warns without gating — and the remediation hint prescribes NO command, routing the operator to the per-finding → replacement instead	P2	active	operator (local shell), upgrading author (pre-major sweep)
cli.migrate-duplicates-inventory	os migrate duplicates: a read-only JSON inventory of identifiers minted across partitions — within-partition repeats excluded, nothing written, the live two-counter condition reported, and runnable BEFORE the #8686 repair destroys the evidence	P1	active	operator (local shell, pre-repair audit)
cli.datasource-introspect-codegen	os datasource list-tables/introspect/validate: the federation door answers, the generated draft is cwd-jailed and compiles, and schema drift maps to ✗ diffs with exit 1	P2	active	operator (local shell) whose token HOLDS manage_platform_settings — all three commands address federation READ routes, which require it since #9901/#10255, integration author (adopting a remote table), same capability
cli.hook-body-extraction-gates	Hook/action body extraction: --strict-body refuses every forbidden pattern with its own worded reason, capability tokens are inferred (and crypto.hash is NOT, #4391), free identifiers fall back to bundling — and the DEFAULT build's warn-and-bundle fallback SURFACES every refusal (#10678)	P1	active	build-time author (no session)
cli.lint-severity-exit-contract	os lint: the three-severity vocabulary is closed, exit is 1 exactly on errors, --json is the declared lint shape with duration inside the payload, the #4409 registry keeps lint and build in agreement, and the i18n fold hides platform noise honestly	P2	active	operator (local shell), metadata author (pre-build hygiene)
cli.plugin-manifest-build-contract	os plugin build enforces the manifest at the packaging boundary: an invalid manifest is refused with located errors, bundled is the one packaging strategy (the retired manifest-deps is refused at the manifest, a native addon is refused by name), and the compiled manifest the artifact carries is readable back	P2	active	plugin author (local shell, scratch plugin directory)
cli.dev-automigrate-policy	autoMigrate off|safe: a dev boot self-heals ONLY the safe-categorized drift and reports each applied op, off (the driver default) and NODE_ENV=production never touch the schema, and a unique index the stored rows already violate is blocked, never auto-applied	P1	active	operator (local shell)
cli.migrate-meta-write-stored-and-all	os migrate meta on v18: --from 17 --write rewrites the provable mechanical edits in place (byte-preserving otherwise), lists what it cannot write with a reason and restores + exits 1 when a re-run disagrees; --stored lists a TODO per refused stored shape; and provably-absent semantic notices collapse into one line that --all expands	P1	active	metadata author running the CLI in a scratch copy of the showcase app (no server needed)
cli.organization-ownership-ceremony	os migrate organization-ownership upgrades a database 17.x or an 18.0 pre-release (18.0.0-next.*) created (18.x): a bare run writes the reviewed plan and changes nothing; --apply --plan-file PLAN --backup-taken runs every step — attribution through the moves, the declared webhook and sharing-rule settlements, the column drops and NOT NULL — and certifies the marker at this release's ownership shape generation; the served boot refuses an uncertified database, naming the command, and boots a certified one; os migrate apply --allow-destructive still withholds every organization_id drop the ceremony owns, and os migrate comment-reactions --apply stays pinned	P0	active	metadata author running the CLI in a scratch copy of the showcase app (no server needed)
cli.meta-package-flags-and-explain	CLI authoring commands on v18: os meta delete|register --package ID address one package's row (an empty --package is refused before send), os meta register --force passes a 409 DESTRUCTIVE_CHANGE, a no-op delete prints "Nothing deleted", and os explain RULE_ID explains a lint rule (unknown id exits 1)	P2	active	metadata author running the CLI in a scratch copy of the showcase app (no server needed), seeded admin (admin@objectos.ai / admin123) — the Default Organization owner and platform admin on a fresh boot
cli.validate-v18-authoring-verdicts	os validate / os build verdicts new on v18: an unknown seed record key (with did-you-mean), a misspelt record[…] / previous[…] field, a duplicate stack entry name, a controlled_by_parent object without exactly one required master_detail (also through objectExtensions), a component-props finding (now an error), and a credential in stack email/sms config each fail the build	P1	active	metadata author running the CLI in a scratch copy of the showcase app (no server needed)
cli.verify-derived-proof-families	os verify gains five derived proof families on v18 — --reference-shapes, --delete-behaviors, --unique-scopes, --parent-write-reach, --dashboard-windows — each clean (exit 0) on the showcase with its report in --json, and non-zero on a planted defect	P2	active	metadata author running the CLI in a scratch copy of the showcase app (no server needed)
cli.fresh-install-migrate-apply-first	A fresh install whose first command is os migrate apply boots on its first os serve (18.1.0): the apply creates the tables on an empty database and writes the organization-ownership birth marker (the sys_migration row adr-0131-organization-ownership), so the serve reaches its serving line with no ownership refusal	P1	active	operator (local shell) whose deploy script runs os migrate apply before the first os serve of a fresh install
cli.packageless-overlay-ceremony-and-close	os migrate packageless-overlays previews, then with --apply --yes moves, each package-less overlay row of a shipped name into .custom as a declared override; after it, a write naming no package — or naming the read-only base — onto that item is refused 403 NOT_OVERRIDABLE naming the pair	P1	active	operator (runs the CLI against the deployment's database, server stopped), admin (the REST legs)
cli.address-grammar-reserved-names	The address grammar reserves its segments: a bucket 2/3 name led by _ is refused at defineStack and os validate; a namespace that spells a grammar literal is refused by os validate and os build (exit 1, no artifact) and at the running install door, while a package the boot registers keeps booting with a warning; and lint's namespace-prefix rule judges only capabilities and positions	P2	active	developer at the CLI, admin (the seeded admin): the install leg
cli.migrate-stored-references	os migrate stored-references reports every stored package reference the boot could not bind, read-only, and os migrate stored-references bind writes one reviewed row per run with its audit row, refusing a package that is not a candidate	P1	active	operator at the CLI, pointed at the deployment's database
cli.serve-multi-replica-local-database-refusal	os serve refuses to start several replicas declared on the redis cluster driver over a database local to each replica, naming a shared Postgres, before anything connects	P1	active	an operator scaling a deployment to several replicas
cli.start-multi-replica-auth-secret-refusal	os start refuses a declared multi-replica boot on the redis cluster driver without OS_AUTH_SECRET, instead of minting a sign-in secret per replica, and writes no secret	P1	active	an operator scaling a deployment to several replicas
cli.deploy-runtime-dry-run-json	os deploy to a self-hosted runtime builds, previews the upgrade plan and installs: --dry-run prints the plan and installs nothing, --json writes one document to stdout with every human line on stderr, and an install that needs a confirmation says so and how	P1	active	a developer with a local shell, targeting a runtime as its admin
cli.validate-target-restriction-profile	os validate --target judges the stack against a target's restriction profile: each refused item printed as [rule] where: message with exit 1, a profile that cannot be read refused and never judged as no restriction, and a version drift warned only	P2	active	a developer with a local shell
cli.package-upgrade-plan-override-advice	A package upgrade's dry run returns the plan and writes nothing, and lists as advice the customizations that would hide a change of the upgrade; the upgrade installs without a token	P2	active	seeded admin (admin@objectos.ai / admin123), over the CLI and REST