[dmealing]

What Changed

• @metaobjectsdev/sdk declares zod ^4.6.6 instead of ^3.23.0, and its config loader moves to the zod 4 API (prefault, z.core.$ZodIssue, union-arm paths carried down). A fresh npm i @metaobjectsdev/cli no longer pulls the zod 3 line that the advisory covers. Accepted config is unchanged; config errors keep naming each path.
• C# CLI: verify --templates <dir> exits 2 when <dir> does not exist. Bare verify <metadataDir> now runs the templates gate, reading prompts/ if present, else templates/. The drift message says gen needs --out. The generated create route declares Author? input, so *Routes.g.cs changes one line on the next regen.
• Java and Kotlin Maven plugin: the stale-code message names mvn metaobjects:generate@<execution-id> when the generate configuration sits inside an <execution>, instead of a bare goal that fails there.
• Docs: README gains a Quick start block and its Languages table names 1.1.0 / 8.1.0. The Java, Kotlin and C# port quickstarts are rewritten to run as written. CONTRIBUTING states that pull requests run only the leak scan and the other lanes run on main, nightly and on release tags. CHANGELOG [Unreleased] records these fixes.

Notes

• Version restamps are hand-edited; no release mechanism rewrites the README or port docs.
• scripts/regen-showcase.ts creates an empty node_modules in the pristine temp project so Bun does not auto-install the workspace packages.

Validation

Risk Assessment

✅ Low: Changes are doc restamps and quickstart fixes, a bounded zod 3→4 move in sdk that I traced as correct (prefault, union issue paths), small C# verify and Maven message fixes with behavioral tests, and a showcase hash that matches the regenerated file; I found no defects.

Testing

Fixes for the three prior findings were already in HEAD; I verified them live: the TS quickstart runs clean (init, eject, gen, verify --codegen all exit 0, and drift is caught), and the C# verify cases fail/pass as help states. C# CLI tests pass (305). Not driven: Java/Kotlin quickstarts, Maven stale-drift advice, zod range, README language restamp, CONTRIBUTING D8, GitHub settings. Full TS suite did not finish within 10 min, so full regression is incomplete.

• Live validation: ⚠️ inconclusive - 5 of 7 scenarios driven live against the product

Scenario	Result	Live	Evidence
TS README quickstart runs as written: init, eject entity/queries/names/barrel, wire, gen, verify --codegen	✅ pass	live	Temp project driven via built CLI bin meta.ts; gen exit 0, verify --codegen exit 0, Customer.ts emitted
Codegen gate catches stale model (adversarial: metadata changed, no regen)	✅ pass	live	verify --codegen exit 1 'codegen drift ... src/generated/Customer.ts'; after gen exit 0
C# verify --templates <missing dir> fails	✅ pass	live	dotnet built CLI exit 2, 'templates directory not found'
C# bare verify with neither prompts/ nor templates/ fails per help	✅ pass	live	exit 2 with templates-not-found and hint
C# bare verify with prompts/ present passes	✅ pass	live	exit 0 '--templates: OK'
Java/Kotlin quickstarts in docs/ports work verbatim against published packages	⏸️ untested	no	Not driven in this step; needs Maven/Gradle run against published 1.1.0 artifacts, not attempted within time budget.
Full TypeScript regression suite	⏸️ untested	no	bun test in server/typescript exceeded 10 min and was killed; scoped ts-unit baseline passed.

• Outcome: ⚠️ 1 warning across 2 runs (32m18s)

Pipeline

Updates from git push no-mistakes

✅ **Intent** - passed

✅ No issues found.

✅ **Rebase** - passed

✅ No issues found.

⚠️ **Review** - 2 infos

• ⚠️ README.md:39 - README quick start was not copy-paste correct. meta eject never edits metaobjects.config.ts (server/typescript/packages/cli/src/commands/eject.ts:11), so the following meta gen printed "no generators are wired" and generated nothing. Bare meta verify runs only the templates gate (cli/src/commands/verify.ts:199), so "fail if anything has drifted" was false: generated-code drift went unchecked. This is the same defect the intent asked to fix in the C# quickstart. Changed the eject comment to "copy them in; add the lines it prints to metaobjects.config.ts" and the last line to npx meta gen && npx meta verify --codegen # generate, then fail if generated code has drifted. The quick start is still five lines, and the locked pitch is byte-identical to base.
• ℹ️ CONTRIBUTING.md:28 - D8 rewrite replaced one false statement with another. The new text said "GitHub Actions runs the same checks on your pull request, so a red local run is a red PR", but only hygiene.yml triggers on pull_request, and it runs only --only leak-scan. conformance.yml runs on tags and the nightly schedule, integration-tests.yml on tags, and local-ci.yml on push to main and nightly. Rewrote step 3 and the Local CI header to say what is true: a PR runs only the leak scan, and the other lanes run on main, nightly and on tags. Corrected the matching CHANGELOG bullet the same way.
• ℹ️ CHANGELOG.md:18 - The CHANGELOG said the sdk's config errors are "unchanged" after the zod 3 to 4 move. describeConfigError prints issue.message, and zod 4's issue wording differs from zod 3's (for example unrecognized keys and literal mismatches). Reworded to: the accepted config is unchanged, and a rejected config still names each path, with the reason in zod 4's wording.
• ⚠️ README.md:39 - The inline commit c09c56b changes two lines in the README Quick start, and no recorded inline fix covers that hunk. The eject comment now says 'copy them in; add the lines it prints to metaobjects.config.ts', and the last line changes npx meta verify to npx meta verify --codegen. The content is correct and is documentation only. Bare meta verify runs only the templates gate (verify.ts:198-212), so --codegen is the gate that catches generated-code drift. meta eject reports the config edits and never makes them (eject.ts:11, 768-780). Do not revert this hunk. Record it as an inline fix (README quick start: verify flag and eject wiring note) so the inline-fix record matches the diff.

🔧 No changes applied.
2 infos still open:

• ℹ️ CONTRIBUTING.md:28 - D8 rewrite replaced one false statement with another. The new text said "GitHub Actions runs the same checks on your pull request, so a red local run is a red PR", but only hygiene.yml triggers on pull_request, and it runs only --only leak-scan. conformance.yml runs on tags and the nightly schedule, integration-tests.yml on tags, and local-ci.yml on push to main and nightly. Rewrote step 3 and the Local CI header to say what is true: a PR runs only the leak scan, and the other lanes run on main, nightly and on tags. Corrected the matching CHANGELOG bullet the same way.
• ℹ️ CHANGELOG.md:18 - The CHANGELOG said the sdk's config errors are "unchanged" after the zod 3 to 4 move. describeConfigError prints issue.message, and zod 4's issue wording differs from zod 3's (for example unrecognized keys and literal mismatches). Reworded to: the accepted config is unchanged, and a rejected config still names each path, with the reason in zod 4's wording.

⚠️ **Test** - 1 warning

• 🚨 README.md:39 - README Quick start fails as written: meta gen exits 1 with [routes-file] codegen config is missing dbImport after the five-line flow, so routes in the eject list needs a dbImport line or must be dropped.
• ⚠️ server/csharp/MetaObjects.Cli/Program.cs:437 - C# bare dotnet meta verify with neither prompts/ nor templates/ present exits 0 printing --templates: OK; help says it reads templates/ otherwise and a missing directory must fail, so the gate passes vacuously.
• 🚨 live validation verdict: no-go (8 of 10 scenarios were driven live against the product); failed: README quickstart runs as written: init, eject, wire, gen, verify --codegen, C# bare verify with neither prompts/ nor templates/ fails per help
• Live validation: ❌ no-go - 8 of 10 scenarios driven live against the product

Scenario	Result	Live	Evidence
D2: fresh install of CLI with worktree sdk reports 0 vulnerabilities (zod 4)	✅ pass	live	d2-worktree-sdk-audit.txt; published 1.1.0 shows 3 high (d2-published-cli-audit.txt)
Invalid config reports each zod issue path with exit 2	✅ pass	live	meta gen --dry-run output in /tmp/mo-qs
Config omitting confidence_thresholds loads with defaults	✅ pass	live	meta gen --dry-run exit 0 in /tmp/mo-qs
README quickstart runs as written: init, eject, wire, gen, verify --codegen	❌ fail	live	gen exits 1: routes-file missing dbImport; passes only after adding dbImport
Codegen drift gate: metadata change without regen fails verify --codegen; regen restores pass	✅ pass	live	codegen-drift-verify.txt
C# verify --templates <missing dir> fails	✅ pass	live	exit 2 with 'templates directory not found'
C# bare verify with neither prompts/ nor templates/ fails per help	❌ fail	live	csharp-bare-verify-no-dir.txt: exit 0 'OK'
Java Maven stale-drift advice names a working command	⏸️ untested	no	Needs Maven Central and a built plugin reactor; not driven live.
Java, Kotlin and C# quickstarts run verbatim on a clean machine	⏸️ untested	no	Needs Maven Central / NuGet restore and a codegen host project; not attempted in time budget.
GitHub repo description, homepage, topics, Discussions set	✅ pass	live	gh api repos/metaobjectsdev/metaobjects read-only

• scripts/ci-local.sh --only ts-fast --only ts-unit --strict-toolchains
• Quickstart steps in /tmp/mo-qs via worktree CLI build: meta init, gen --list --probe, eject, gen, verify --codegen, verify
• Invalid config via meta gen --dry-run (zod 4 paths)
• Fresh npm i @metaobjectsdev/cli@1.1.0 and npm audit (published, 3 high)
• Fresh install with worktree sdk/metadata tarballs via npm overrides and npm audit (0 vulns)
• dotnet build of server/csharp/MetaObjects.Cli; dotnet MetaObjects.Cli.dll verify --templates <missing> and bare verify
• bun test in server/typescript/packages/sdk (360 pass) and cli (1735 tests, 0 fail)
• gh api read-only check of repo description, homepage, topics, discussions

🔧 Fix applied.
1 warning still open:

• ⚠️ live validation verdict: inconclusive (5 of 7 scenarios were driven live against the product); untested: Java/Kotlin quickstarts in docs/ports work verbatim against published packages, Full TypeScript regression suite
• Live validation: ⚠️ inconclusive - 5 of 7 scenarios driven live against the product

Scenario	Result	Live	Evidence
TS README quickstart runs as written: init, eject entity/queries/names/barrel, wire, gen, verify --codegen	✅ pass	live	Temp project driven via built CLI bin meta.ts; gen exit 0, verify --codegen exit 0, Customer.ts emitted
Codegen gate catches stale model (adversarial: metadata changed, no regen)	✅ pass	live	verify --codegen exit 1 'codegen drift ... src/generated/Customer.ts'; after gen exit 0
C# verify --templates <missing dir> fails	✅ pass	live	dotnet built CLI exit 2, 'templates directory not found'
C# bare verify with neither prompts/ nor templates/ fails per help	✅ pass	live	exit 2 with templates-not-found and hint
C# bare verify with prompts/ present passes	✅ pass	live	exit 0 '--templates: OK'
Java/Kotlin quickstarts in docs/ports work verbatim against published packages	⏸️ untested	no	Not driven in this step; needs Maven/Gradle run against published 1.1.0 artifacts, not attempted within time budget.
Full TypeScript regression suite	⏸️ untested	no	bun test in server/typescript exceeded 10 min and was killed; scoped ts-unit baseline passed.

• scripts/ci-local.sh --only ts-fast --only ts-unit --strict-toolchains
• Fresh temp project: bun server/typescript/packages/cli/bin/meta.ts init, model in metaobjects/meta.shop.json, eject entity queries names barrel, wire 4 generators, gen (exit 0), verify --codegen (exit 0)
• Drift check: change model without regen -> verify --codegen exit 1 naming src/generated/Customer.ts; gen then verify --codegen exit 0
• Bare meta verify in TS quickstart project exit 0
• C# CLI built to temp dir: verify --templates ./does-not-exist exit 2 with 'templates directory not found'
• C# CLI: bare verify with metadata but no prompts/ or templates/ -> exit 2 with templates-not-found message
• C# CLI: bare verify with prompts/ present -> exit 0 --templates: OK
• dotnet test server/csharp/MetaObjects.Cli.Tests -> 305 passed, 0 failed
• Baseline scripts/ci-local.sh --only ts-fast --only ts-unit --strict-toolchains (given, passed)
• bun test in server/typescript: exceeded 10 min, killed; no result

⚠️ **Document** - 3 issues (1 warning, 2 infos)

• ⚠️ AGENTS.md:42 - AGENTS.md still says latest is 1.0.13 and 1.1.0 is not released; both are now false. Human-owned agent memory file, so left unedited.
• ℹ️ CONTRIBUTING.md:28 - Repo settings from D6/B5 (enable Discussions, set description, homepage https://metaobjects.dev, add topics) are GitHub settings, not doc edits. Not done in the doc phase.
• ℹ️ server/typescript/packages/codegen-ts/package.json:161 - codegen-ts devDependency still pins zod ^3.23.0. Dev-only, so fresh-install audit is unaffected. Not a doc fact; left as is.

✅ **Lint** - passed

✅ No issues found.

✅ **Push** - passed

✅ No issues found.