Issues

verify: `dashboard-window.test.ts`'s NEGATIVE CONTROL cases read the real clock, so a run that crosses UTC midnight gets the probe's day-turn `not-run` and fails them (merge-queue red, run 38486827994)

objectstack-ai/objectstack#23351 · opened

on Oct 14, 2026

cli: `os meta delete` declares no `--package`, so the reset door's `409 RESOURCE_CONFLICT` remedy (name one package) cannot be sent from the CLI, and `os meta register` cannot name the package a save writes into

objectstack-ai/objectstack#23350 · opened

on Oct 13, 2026

1

runtime/service-i18n: the i18n paths have two owners, and the likely live one (the dispatcher) relays an undeclared 5xx's caught text unless it reads like SQL, so #23174's plugin-mount withholding may be shadowed (read from source, not yet measured)

objectstack-ai/objectstack#23347 · opened

on Oct 13, 2026

1

plugin-auth/plugin-email: an imported user is invited with the password-reset email ("If you didn't request this, ignore this email"), not invitation copy

objectstack-ai/objectstack#23343 · opened

on Oct 13, 2026

1

spec(migrations): two step-18 D3 entries still tell authors to rename "a single-brace token in a value position" — no value position reads one since #19939 S6, and the text ships in the upgrade guide and `spec-changes.json`

objectstack-ai/objectstack#23338 · opened

on Oct 13, 2026

1

auth-gate parity: the remediation allow-list exempts the whole auth namespace, and the platform-admin mounts under it judge the caller without the ADR-0069 posture, so a held platform admin may reach user administration (read from source, not yet measured)

objectstack-ai/objectstack#23335 · opened

on Oct 13, 2026

1

spec(ui): a page action row with `operation: 'update'` and `onSuccess` parses, while `ActionSchema` refuses the same shape — the rows type `operation` as `z.unknown()` and never carried the rule

objectstack-ai/objectstack#23332 · opened

on Oct 13, 2026

2

plugin-sharing: a share link with both a password and audience 'signed_in', opened anonymously with the CORRECT password, is answered 401 WRONG_PASSWORD, so the landing page says 'Wrong password.' and never offers sign-in

objectstack-ai/objectstack#23328 · opened

on Oct 13, 2026

plugin-sharing: the record-share grant refuses a `group` recipient by naming sharing rules as its route, and the rule vocabulary has no `group`

objectstack-ai/objectstack#23325 · opened

on Oct 13, 2026

2

spec(automation): a `{token}` at a flow value slot or text slot passes `FlowSchema.parse` and `defineStack`, while `registerFlow` and every run refuse it — the slot judges never run at the parse

objectstack-ai/objectstack#23320 · opened

on Oct 13, 2026

2

v18 stored preview: `os migrate meta --stored` still leaves out two families the v18 doors refuse — page components binding the retired API data source, and `registerFlow`'s other refusals

objectstack-ai/objectstack#23317 · opened

on Oct 13, 2026

4

automation: a stored flow the engine refuses at cold boot is withdrawn with a warn, while the metadata read keeps serving it as `status: 'active'` — after the v18 upgrade, every refused flow reads as running

objectstack-ai/objectstack#23316 · opened

on Oct 13, 2026

4

permission sets: the body `packageId`'s remaining sites after #23259 — the install and registration door overrides a disagreeing value silently, and two consumer readers still fall back to it

objectstack-ai/objectstack#23312 · opened

on Oct 13, 2026

2

cli/plugin-dev: an app under `os serve` cannot leave out plugin-auth's `sys_organization` default record page, and `DEFAULT_RECORD_PAGE_CONFLICT`'s remedy names a step that holder cannot take

objectstack-ai/objectstack#23310 · opened

on Oct 13, 2026

1

service-mailbox: store an ingested message's attachments, and each forwarded message part as an `.eml` attachment, through the server-side writer: the attachment item of #22871, chained

objectstack-ai/objectstack#23307 · opened

on Oct 13, 2026

1

service-storage: a server-side verb that stores bytes and attaches them to a record (`sys_file` + `sys_attachment`), under the parent's organization, quota and access hooks: the prerequisite for inbound-mail attachments

objectstack-ai/objectstack#23306 · opened

on Oct 13, 2026

1

Uninstalling a package after a kernel reboot leaves its permission set's sys_permission_set row behind (managed_by admin, package_id null)

objectstack-ai/objectstack#23299 · opened

on Oct 13, 2026

1

Security: on an environment kernel, a permission set saved through the metadata door keeps granting its old body until the kernel is rebuilt (applyRegistryWriteThrough skips environment-scoped writes; the security catalog reads the registry first)

objectstack-ai/objectstack#23298 · opened

on Oct 13, 2026

6

metadata-protocol: three package-axis gaps PR #23290's review leaves open — the registry heal after a per-package delete, the draft save's storage-order bind with two packages, and the delete `_lock` gate that takes no package

objectstack-ai/objectstack#23297 · opened

on Oct 13, 2026

2

client: `meta.deleteItem` cannot name a package — after #23165 a delete of a name two packages hold answers 409, and the SDK has no way to pass the `?package=` remedy

objectstack-ai/objectstack#23293 · opened

on Oct 13, 2026

6

plugin-security: the permission-set projection and the position write-through delete metadata by name with no package — after #23165 a name two packages hold answers 409, and `storedRowPackageArg` (#21861) is redundant

objectstack-ai/objectstack#23292 · opened

on Oct 13, 2026

3

metadata-protocol: a save naming a package beside an existing package-less row of the item mints a second row, and the read naming no package keeps serving the unbound one (S6, reachable through today's doors)

objectstack-ai/objectstack#23291 · opened

on Oct 13, 2026

2

auth-gate parity: a request carrying an API key beside a session cookie held by ADR-0069 is refused at REST but admitted by the five raw-host route families — one cross-seam answer is owed (session versus user)

objectstack-ai/objectstack#23287 · opened

on Oct 13, 2026

2

release(next): the Version PR refresh fails with ENOENT `.changeset/pre/changes.md` since the 18.0.0-next.0 cut moved consumed changesets into `.changeset/pre/`, so no next.1 Version Packages PR can open

objectstack-ai/objectstack#23282 · opened

on Oct 13, 2026

4

v18 upgrade ceremony refuses every cloud database: the inventory gives cloud-provided tables no fate on the premise that cloud stays on v17 — a host needs to declare fates for its own objects

objectstack-ai/objectstack#23280 · opened

on Oct 13, 2026

7

Navigation Menu

Repository navigation

Issues

verify: `dashboard-window.test.ts`'s NEGATIVE CONTROL cases read the real clock, so a run that crosses UTC midnight gets the probe's day-turn `not-run` and fails them (merge-queue red, run 38486827994)

cli: `os meta delete` declares no `--package`, so the reset door's `409 RESOURCE_CONFLICT` remedy (name one package) cannot be sent from the CLI, and `os meta register` cannot name the package a save writes into

runtime/service-i18n: the i18n paths have two owners, and the likely live one (the dispatcher) relays an undeclared 5xx's caught text unless it reads like SQL, so #23174's plugin-mount withholding may be shadowed (read from source, not yet measured)

plugin-auth/plugin-email: an imported user is invited with the password-reset email ("If you didn't request this, ignore this email"), not invitation copy

spec(migrations): two step-18 D3 entries still tell authors to rename "a single-brace token in a value position" — no value position reads one since #19939 S6, and the text ships in the upgrade guide and `spec-changes.json`

auth-gate parity: the remediation allow-list exempts the whole auth namespace, and the platform-admin mounts under it judge the caller without the ADR-0069 posture, so a held platform admin may reach user administration (read from source, not yet measured)

spec(ui): a page action row with `operation: 'update'` and `onSuccess` parses, while `ActionSchema` refuses the same shape — the rows type `operation` as `z.unknown()` and never carried the rule

plugin-sharing: a share link with both a password and audience 'signed_in', opened anonymously with the CORRECT password, is answered 401 WRONG_PASSWORD, so the landing page says 'Wrong password.' and never offers sign-in

plugin-sharing: the record-share grant refuses a `group` recipient by naming sharing rules as its route, and the rule vocabulary has no `group`

spec(automation): a `{token}` at a flow value slot or text slot passes `FlowSchema.parse` and `defineStack`, while `registerFlow` and every run refuse it — the slot judges never run at the parse

v18 stored preview: `os migrate meta --stored` still leaves out two families the v18 doors refuse — page components binding the retired API data source, and `registerFlow`'s other refusals

automation: a stored flow the engine refuses at cold boot is withdrawn with a warn, while the metadata read keeps serving it as `status: 'active'` — after the v18 upgrade, every refused flow reads as running

permission sets: the body `packageId`'s remaining sites after #23259 — the install and registration door overrides a disagreeing value silently, and two consumer readers still fall back to it

cli/plugin-dev: an app under `os serve` cannot leave out plugin-auth's `sys_organization` default record page, and `DEFAULT_RECORD_PAGE_CONFLICT`'s remedy names a step that holder cannot take

service-mailbox: store an ingested message's attachments, and each forwarded message part as an `.eml` attachment, through the server-side writer: the attachment item of #22871, chained

service-storage: a server-side verb that stores bytes and attaches them to a record (`sys_file` + `sys_attachment`), under the parent's organization, quota and access hooks: the prerequisite for inbound-mail attachments

Uninstalling a package after a kernel reboot leaves its permission set's sys_permission_set row behind (managed_by admin, package_id null)

Security: on an environment kernel, a permission set saved through the metadata door keeps granting its old body until the kernel is rebuilt (applyRegistryWriteThrough skips environment-scoped writes; the security catalog reads the registry first)

metadata-protocol: three package-axis gaps PR #23290's review leaves open — the registry heal after a per-package delete, the draft save's storage-order bind with two packages, and the delete `_lock` gate that takes no package

client: `meta.deleteItem` cannot name a package — after #23165 a delete of a name two packages hold answers 409, and the SDK has no way to pass the `?package=` remedy

plugin-security: the permission-set projection and the position write-through delete metadata by name with no package — after #23165 a name two packages hold answers 409, and `storedRowPackageArg` (#21861) is redundant

metadata-protocol: a save naming a package beside an existing package-less row of the item mints a second row, and the read naming no package keeps serving the unbound one (S6, reachable through today's doors)

auth-gate parity: a request carrying an API key beside a session cookie held by ADR-0069 is refused at REST but admitted by the five raw-host route families — one cross-seam answer is owed (session versus user)

release(next): the Version PR refresh fails with ENOENT `.changeset/pre/changes.md` since the 18.0.0-next.0 cut moved consumed changesets into `.changeset/pre/`, so no next.1 Version Packages PR can open

v18 upgrade ceremony refuses every cloud database: the inventory gives cloud-provided tables no fate on the premise that cloud stays on v17 — a host needs to declare fates for its own objects