Issues

approvals: an empty slate under `onEmptyApprovers: 'admin_rescue'` opens on the tenant's administrators as named approvers, not as a nameless rescue request (retires the #22725 `unstaffed` arm)

objectstack-ai/objectstack#22824 · opened

on Oct 11, 2026

security(runtime): `callData`'s engine fallback hands a caller's `where` to `ql.find` after judging only the addressed object, so a nested-relation condition skips the target's exposure ask (census row 10 of #22661)

objectstack-ai/objectstack#22823 · opened

on Oct 11, 2026

platform-objects: `create_user` / `set_user_password`: the "Generate Temporary Password" box does nothing once a password is typed, yet is sent ticked by default — the dialog offers a choice the server ignores

objectstack-ai/objectstack#22821 · opened

on Oct 11, 2026

Action activation door refuses an action no package ships, though its docblock says it does not require one (503, code and status mismatched)

objectstack-ai/objectstack#22817 · opened

on Oct 11, 2026

finding: `objectstack build` lowers a hook handler that writes `ctx.dispatch.scope` (or reads `ctx.submitted`) at exit 0, although the sandbox marshals neither — every lowered write TypeErrors, and REST answers 500 where the source boot answers 2xx

objectstack-ai/objectstack#22810 · opened

on Oct 11, 2026

2

[finding] trigger-api: the inbound hook matches the flow and hook id before it verifies the signature, so an unsigned post's 401 versus 404 tells which flow names are armed

objectstack-ai/objectstack#22806 · opened

on Oct 11, 2026

4

[Decision] 入站 webhook 签名：要不要在入站门拒收不带时间戳的旧签名（`sha256=` 正文签名）？发送方指引何时改为推荐带时间戳的新签名？

objectstack-ai/objectstack#22805 · opened

on Oct 11, 2026

1

[finding] plugin-webhooks: the redeliver veto allows replaying a delivery whose `sys_webhook` subscription is inactive, while the field declares "Inactive webhooks are skipped by the dispatcher"

objectstack-ai/objectstack#22804 · opened

on Oct 11, 2026

1

[Decision] 装包时包里声明的「默认权限集」怎么生效：管理员整部署接受一次、装包即自动生效，还是取消这条路（安全边界）

objectstack-ai/objectstack#22801 · opened

on Oct 11, 2026

security(auth): the identity import hands `runImport` a protocol without `getMetaItem`, so its reference cells skip the target's exposure ask (census row 9 of #22661)

objectstack-ai/objectstack#22800 · opened

on Oct 11, 2026

security(explain): explain's `read` verdict for a row the caller cannot read disagrees with the read door, and differs from its answer for an id no row carries (a controlled_by_parent detail under an unreadable master, measured)

objectstack-ai/objectstack#22792 · opened

on Oct 11, 2026

7

data: under a search, a paged list's `total` is a page-local estimate (offset + page + 1), and the console shows it as the record count ("26 records" for 300 matches)

objectstack-ai/objectstack#22790 · opened

on Oct 11, 2026

1

ADR-0139 execution: the engine-internal semi-join leaf across spec, engine, drivers and consumers (E0–E7 coordination)

objectstack-ai/objectstack#22788 · opened

on Oct 11, 2026

1

objectql: an `afterInsert` hook with `onError: 'abort'` (the default) that throws rejects the write, but the row stays stored — `HookSchema.onError` says abort rolls the transaction back, and a plain write opens none

objectstack-ai/objectstack#22782 · opened

on Oct 11, 2026

3

spec: `bulk-action.zod.ts` says the bulk surface has no field-backed param route, but since objectui#12119 a promoted bulk action's field-backed param resolves

objectstack-ai/objectstack#22780 · opened

on Oct 11, 2026

1

security(mcp): a nested-relation filter condition through the MCP stdio data bridge is evaluated without asking the target's exposure (census row 8 of #22661)

objectstack-ai/objectstack#22777 · opened

on Oct 11, 2026

3

trigger-api: implement the declared inbound-hook member through the same verifier, read `http.server` before the alias, and keep the self-hosted raw-app mount byte-unchanged (trigger-api segment 3 of ruling A on #22757)

objectstack-ai/objectstack#22774 · opened

on Oct 11, 2026

2

runtime + core: an exact `POST /automation/hooks/:flowName/:hookId` dispatcher domain and its parameterised ADR-0069 allow-list row, anonymous through to the trigger's HMAC verifier only (trigger-api segment 2 of ruling A on #22757)

objectstack-ai/objectstack#22773 · opened

on Oct 11, 2026

2

[finding] rest: the 20 write routes #22719 repaired still answer a crashed hook body with its native fault text, and a declared-5xx refusal unwithheld, where the data doors answer `Internal server error`

objectstack-ai/objectstack#22764 · opened

on Oct 11, 2026

3

[Decision] 托管环境上 trigger-api 的入站 webhook（HMAC 签名）要不要在 `/automation` 匿名门槛上开一个精确到路由的口子，与自托管一致？

objectstack-ai/objectstack#22757 · opened

on Oct 11, 2026

3

runtime: an exact `/webhooks/redeliver` dispatcher domain that forwards to the declared redeliver member, with a typed refusal for an absent slot (webhooks segment 2 of #22564's stage 2)

objectstack-ai/objectstack#22755 · opened

on Oct 11, 2026

3

[finding] import: a sandbox's own fault (CPU budget, wall-clock ceiling) reaches an import row as its debug wrapper, where the data doors answer `Internal server error`

objectstack-ai/objectstack#22741 · opened

on Oct 10, 2026

1

[Decision] fleet relay: should the auto-merge row spend `workflows: write` so seats can enqueue pulls that change `.github/workflows/**`, or stay a human-queue item?

objectstack-ai/objectstack#22708 · opened

on Oct 10, 2026

6

spec: catalog references in authoring surfaces become names (approver position binding, decision-output positions, the position form's permissionSets widget), ADR-0131 D4, from #15204

objectstack-ai/objectstack#22682 · opened

on Oct 10, 2026

10

[Ruling A on #22649] docs: the skills install command reads the catalog from the installed @objectstack/skills package; the GitHub path is documented as the next (unreleased main) channel only

objectstack-ai/objectstack#22668 · opened

on Oct 10, 2026

1

Navigation Menu

Repository navigation

Issues

approvals: an empty slate under `onEmptyApprovers: 'admin_rescue'` opens on the tenant's administrators as named approvers, not as a nameless rescue request (retires the #22725 `unstaffed` arm)

security(runtime): `callData`'s engine fallback hands a caller's `where` to `ql.find` after judging only the addressed object, so a nested-relation condition skips the target's exposure ask (census row 10 of #22661)

platform-objects: `create_user` / `set_user_password`: the "Generate Temporary Password" box does nothing once a password is typed, yet is sent ticked by default — the dialog offers a choice the server ignores

Action activation door refuses an action no package ships, though its docblock says it does not require one (503, code and status mismatched)

finding: `objectstack build` lowers a hook handler that writes `ctx.dispatch.scope` (or reads `ctx.submitted`) at exit 0, although the sandbox marshals neither — every lowered write TypeErrors, and REST answers 500 where the source boot answers 2xx

[finding] trigger-api: the inbound hook matches the flow and hook id before it verifies the signature, so an unsigned post's 401 versus 404 tells which flow names are armed

[Decision] 入站 webhook 签名：要不要在入站门拒收不带时间戳的旧签名（`sha256=` 正文签名）？发送方指引何时改为推荐带时间戳的新签名？

[finding] plugin-webhooks: the redeliver veto allows replaying a delivery whose `sys_webhook` subscription is inactive, while the field declares "Inactive webhooks are skipped by the dispatcher"

[Decision] 装包时包里声明的「默认权限集」怎么生效：管理员整部署接受一次、装包即自动生效，还是取消这条路（安全边界）

security(auth): the identity import hands `runImport` a protocol without `getMetaItem`, so its reference cells skip the target's exposure ask (census row 9 of #22661)

security(explain): explain's `read` verdict for a row the caller cannot read disagrees with the read door, and differs from its answer for an id no row carries (a controlled_by_parent detail under an unreadable master, measured)

data: under a search, a paged list's `total` is a page-local estimate (offset + page + 1), and the console shows it as the record count ("26 records" for 300 matches)

ADR-0139 execution: the engine-internal semi-join leaf across spec, engine, drivers and consumers (E0–E7 coordination)

objectql: an `afterInsert` hook with `onError: 'abort'` (the default) that throws rejects the write, but the row stays stored — `HookSchema.onError` says abort rolls the transaction back, and a plain write opens none

spec: `bulk-action.zod.ts` says the bulk surface has no field-backed param route, but since objectui#12119 a promoted bulk action's field-backed param resolves

security(mcp): a nested-relation filter condition through the MCP stdio data bridge is evaluated without asking the target's exposure (census row 8 of #22661)

trigger-api: implement the declared inbound-hook member through the same verifier, read `http.server` before the alias, and keep the self-hosted raw-app mount byte-unchanged (trigger-api segment 3 of ruling A on #22757)

runtime + core: an exact `POST /automation/hooks/:flowName/:hookId` dispatcher domain and its parameterised ADR-0069 allow-list row, anonymous through to the trigger's HMAC verifier only (trigger-api segment 2 of ruling A on #22757)

[finding] rest: the 20 write routes #22719 repaired still answer a crashed hook body with its native fault text, and a declared-5xx refusal unwithheld, where the data doors answer `Internal server error`

[Decision] 托管环境上 trigger-api 的入站 webhook（HMAC 签名）要不要在 `/automation` 匿名门槛上开一个精确到路由的口子，与自托管一致？

runtime: an exact `/webhooks/redeliver` dispatcher domain that forwards to the declared redeliver member, with a typed refusal for an absent slot (webhooks segment 2 of #22564's stage 2)

[finding] import: a sandbox's own fault (CPU budget, wall-clock ceiling) reaches an import row as its debug wrapper, where the data doors answer `Internal server error`

[Decision] fleet relay: should the auto-merge row spend `workflows: write` so seats can enqueue pulls that change `.github/workflows/**`, or stay a human-queue item?

spec: catalog references in authoring surfaces become names (approver position binding, decision-output positions, the position form's permissionSets widget), ADR-0131 D4, from #15204

[Ruling A on #22649] docs: the skills install command reads the catalog from the installed @objectstack/skills package; the GitHub path is documented as the next (unreleased main) channel only