Skip to content

finding(ci): e2e/live/ci/backend.env pins OBJECTSTACK_VERSION=17.0.0-rc.2 while the lockfile resolves 17.2.0 — the live-e2e lane has been smoke-testing an unmatched pair for two minor versions #7689

Description

@os-sam

Measured by the dev implementing #7122 (PR #7685) and handed to the PM to file, because that session's dedup channel was unreadable from its container (REST /search/* refused by the egress proxy; the MCP fallback returned total_count 0 for a control built from #7122's own verbatim title). Filed here after the PM re-ran dedup on a demonstrably non-blind instrument: a control query on this exact subject returned 14 cards, the nearest being #6925 (closed — repo comments naming a stale pinned version) and #4709 (closed — declared package.json ranges left at rc.6). Neither is this file or this mechanism; this is the e2e backend env pin, and it is open.

The finding

e2e/live/ci/backend.env    OBJECTSTACK_VERSION=17.0.0-rc.2
pnpm-lock.yaml             @objectstack/spec  17.2.0   (before PR #7685)
                                              17.3.0   (after)

The file's own header and content/docs/guide/ci-cd-pipeline.md both state the pin MUST stay aligned with the spec version resolved in the lockfile, and that a mismatched pair "proves nothing".

⭐ Why this matters more than a stale constant

Live E2E (informational) reports green. It reported green on PR #7679 earlier today. What it has actually been exercising is a 17.0.0-rc.2 backend against a frontend built for 17.2.0 — so for two minor versions the lane has been producing a green signal that its own documentation says carries no information.

That is the failure mode worth the card: not "a constant drifted", but a green check whose own contract declares it meaningless, in the one lane whose job is to catch cross-version breakage. It is exactly the class of breakage #7122's chain is about to introduce deliberately.

Not this card's to ride

The drift predates PR #7685 by two minor versions, so realigning it is not a rider on a lockfile bump — it needs its own change and its own verification that the live lane still passes against a matched pair (which, per #7122's measurement, it may well not).

⚠️ Worth deciding as part of any fix: whether informational is the right tier for a lane that can silently go meaningless, or whether the alignment itself should be gated.

Related

#7122 (the 17.3.0 pin chain, now in the decision box) · PR #7685 (the measurement branch) · #6925, #4709 (the same family of stale-version drift, both closed, neither this file).

⛔ Deliberately unassigned and unlabelled, for triage.

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't workingdomain:devxobjectui devx stream: fix lands on .github/, scripts/ or release pipeline — devx lane cross-repofindingpm:queuepriority:p2

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions