Issues

[finding] the runtime dispatcher's /meta item reads apply NO per-caller read gate: through a catch-all host, GET /meta/doc/:name serves a permission-set-gated doc body to a non-holder, and /meta/app/:name serves requiredPermissions-gated entries

#20193

· objectstack-fleet opened

on Sep 27, 2026

ADR-0087 still defines each step's D3 `semantic` list as "the residue D2 cannot express losslessly", contradicting ruling B on #17152 (one D3 entry per retirement family, even when a lossless D2 conversion exists)

#20188

· objectstack-fleet opened

on Sep 27, 2026

spec(ui): a flattened `viewKind: 'list'` view overlay with no `columns` is refused by the list overlay member, then ACCEPTED by the form overlay member, so its list keys are stripped unjudged and a wrong 200 stores it

#20186

· objectstack-fleet opened

on Sep 27, 2026

finding(service-automation,lint): the resume door evaluates a screen field's `visibleWhen` over the run's variables, wider than the declared scope (the screen's own field names), and nothing refuses an undeclared name at authoring

#20178

· objectstack-fleet opened

on Sep 27, 2026

objectql + REST: a per-aggregation `filter` (and `having`) compares a temporal comparand type-blind, not by the column's storage rule — an ISO instant on a `date` field counts 1 where the `where` twin counts 3

#20176

· objectstack-fleet opened

on Sep 27, 2026

skills(objectstack-ui): pages.md and its eval teach full Action objects in `page:header.properties.actions`; the contract is action ids (ruling B on #11592) and `os validate` flags the taught shape

#20173

· objectstack-fleet opened

on Sep 27, 2026

[Decision] A decision node that declares both a conditions list and `mode`: refuse it at authoring, give it a meaning, or leave it inert

needs-user-decision

#20168

· objectstack-fleet opened

on Sep 27, 2026

[finding] the JSX page gate looks for the project's sdui.manifest.json in the invoker's cwd, not beside the config the command was given: `os validate path/to/objectstack.config.ts` from elsewhere never reads that project's manifest

#20166

· objectstack-fleet opened

on Sep 27, 2026

[PM seat] domain:devx · seat 2 — 🟢 os-litant · session_018mA64scZ8fmpiPkrHVAwXj

pm:seat

#20163

· objectstack-fleet opened

on Sep 27, 2026

[finding] a joined report's `chart` — container and `blocks[].chart` — parses and is never drawn, while the liveness ledger names the joined branch as its reader

#20161

· objectstack-fleet opened

on Sep 27, 2026

RLS policies are admitted when they are authored: policy save and `objectstack validate` / compile judge the lowered read-scope filter with the engine's judge-only method (objectstack#19995 ruling C, second consumer)

#20158

· objectstack-fleet opened

on Sep 27, 2026

Seam: `IObjectQLEngine` gains an optional judge-only filter-admission method, run by the engine's own admission pipeline without executing (objectstack#19995 ruling C)

#20157

· objectstack-fleet opened

on Sep 27, 2026

Navigation Menu

All issues

[finding] the runtime dispatcher's /meta item reads apply NO per-caller read gate: through a catch-all host, GET /meta/doc/:name serves a permission-set-gated doc body to a non-holder, and /meta/app/:name serves requiredPermissions-gated entries

ADR-0087 still defines each step's D3 `semantic` list as "the residue D2 cannot express losslessly", contradicting ruling B on #17152 (one D3 entry per retirement family, even when a lossless D2 conversion exists)

spec(ui): a flattened `viewKind: 'list'` view overlay with no `columns` is refused by the list overlay member, then ACCEPTED by the form overlay member, so its list keys are stripped unjudged and a wrong 200 stores it

finding(service-automation,lint): the resume door evaluates a screen field's `visibleWhen` over the run's variables, wider than the declared scope (the screen's own field names), and nothing refuses an undeclared name at authoring

objectql + REST: a per-aggregation `filter` (and `having`) compares a temporal comparand type-blind, not by the column's storage rule — an ISO instant on a `date` field counts 1 where the `where` twin counts 3

skills(objectstack-ui): pages.md and its eval teach full Action objects in `page:header.properties.actions`; the contract is action ids (ruling B on #11592) and `os validate` flags the taught shape

[Decision] A decision node that declares both a conditions list and `mode`: refuse it at authoring, give it a meaning, or leave it inert

[finding] the JSX page gate looks for the project's sdui.manifest.json in the invoker's cwd, not beside the config the command was given: `os validate path/to/objectstack.config.ts` from elsewhere never reads that project's manifest

[PM seat] domain:devx · seat 2 — 🟢 os-litant · session_018mA64scZ8fmpiPkrHVAwXj

[finding] a joined report's `chart` — container and `blocks[].chart` — parses and is never drawn, while the liveness ledger names the joined branch as its reader

RLS policies are admitted when they are authored: policy save and `objectstack validate` / compile judge the lowered read-scope filter with the engine's judge-only method (objectstack#19995 ruling C, second consumer)

Seam: `IObjectQLEngine` gains an optional judge-only filter-admission method, run by the engine's own admission pipeline without executing (objectstack#19995 ruling C)

Search results