Issues

dispatch-gates: check:published-readme-exports is never derived by --commands for a package-source diff (the one family #31257 left)

objectstack-ai/objectstack#31292 · opened

on Nov 7, 2026

Queue-flake anchor: test/runner/external-driver.test.ts

objectstack-ai/objectstack#31285 · opened

on Nov 7, 2026

1

cloud-connection: install-local's own uninstall door (DELETE /marketplace/install-local/:id) bypasses the uninstall verb, so it asks no uninstall guard and writes no package audit row

objectstack-ai/objectstack#31283 · opened

on Nov 7, 2026

1

scenarios: external-driver.test.ts's full crm run hits vitest's 5 s default timeout on loaded Test Core shards and merge-queue runs

objectstack-ai/objectstack#31281 · opened

on Nov 7, 2026

3

skills evals: 15 cases forbid (must_not_contain) a string their own expected_output uses, so a careful answer that names the trap fails

objectstack-ai/objectstack#31278 · opened

on Nov 7, 2026

1

mcp: the record data tools answer a driver string code (SQLITE_BUSY) with the driver's text and no status, where /data answers 500 DATABASE_ERROR

objectstack-ai/objectstack#31273 · opened

on Nov 7, 2026

1

mcp: the metadata tools and list_actions answer a fault with its raw text (or a driver code), where the /meta door answers 500 INTERNAL_ERROR

objectstack-ai/objectstack#31272 · opened

on Nov 7, 2026

1

mcp: run_action and resume_run answer a code-less sandboxed action-body throw with the wrapper naming the body, where /actions answers 400 HOOK_ABORTED with the sentence

objectstack-ai/objectstack#31271 · opened

on Nov 7, 2026

1

mcp: the record resource answers a code-less sandboxed hook abort with the wrapper naming the hook, where GET /data answers 400 HOOK_ABORTED with the sentence

objectstack-ai/objectstack#31270 · opened

on Nov 7, 2026

1

mcp: a CODED sandboxed hook CRASH answers the sandbox wrapper (hook name and native error text) at a business status, where /data answers 500

objectstack-ai/objectstack#31269 · opened

on Nov 7, 2026

3

console marketplace: filter and page the catalog through the server's four facets

objectstack-ai/objectstack#31267 · opened

on Nov 7, 2026

3

cli: os build carries devPlugins into the artifact, so a restriction profile must treat dev-only plugins as code

objectstack-ai/objectstack#31264 · opened

on Nov 7, 2026

2

lint.yml: the ADR index step's comment and name still say --report never reds on a record; since #31252 a dropped header field exits 1

objectstack-ai/objectstack#31261 · opened

on Nov 7, 2026

3

console: Settings → Access policy does not show the administrator the client address the server judges (GET /api/v1/auth/client-address)

objectstack-ai/objectstack#31260 · opened

on Nov 7, 2026

1

plugin-auth: GET /api/v1/auth/client-address answers a revoked or expired API key with 500 INTERNAL_ERROR instead of its own refusal

objectstack-ai/objectstack#31259 · opened

on Nov 7, 2026

1

dispatch-gates: 18 whole-root lint families are never derived by --commands for a diff outside their home package

objectstack-ai/objectstack#31257 · opened

on Nov 7, 2026

3

fleet-write dispatch: apply the PR-vs-issue state-label rule to labels_add / issue_create / pr_create, and match pm labels case-insensitively

objectstack-ai/objectstack#31253 · opened

on Nov 7, 2026

1

settings: a `json` setting saved from the console is stored as a string, so retention overrides and row quotas silently do nothing

objectstack-ai/objectstack#31241 · opened

on Nov 7, 2026

3

cli: os validate --target accepts only a profile file — add the URL form once an environment publishes its restriction profile at a defined route (cloud#3713)

objectstack-ai/objectstack#31240 · opened

on Nov 7, 2026

1

spec: a restriction profile cannot list the ADR-0031 containers (parallel, try_catch), devPlugins counts as code under allowCode, and the allowedFlowNodeTypes docblock omits the reader rules

objectstack-ai/objectstack#31239 · opened

on Nov 7, 2026

4

spec: declare ISecurityService.describeEffectiveAccess? and the EffectiveAccess answer types (spec half of #31215)

objectstack-ai/objectstack#31238 · opened

on Nov 7, 2026

3

Docs and skill still type the MCP connect line by hand and describe os deploy as cloud-only

objectstack-ai/objectstack#31235 · opened

on Nov 7, 2026

1

packages: the in-process uninstall verb (deletePackage) withdraws extension fields a dependent active validation rule reads, with no refusal — only the HTTP door asks

objectstack-ai/objectstack#31232 · opened

on Nov 7, 2026

3

Enforce-or-remove: four metadata shapes cloud's authoring rules warn about still parse clean (boolean required, open flow start config, orphan action nodes, roll-up filter keys)

objectstack-ai/objectstack#31224 · opened

on Nov 7, 2026

6

console: the sharing-rule object picker lists only shareable objects, business objects first

objectstack-ai/objectstack#31217 · opened

on Nov 7, 2026

5

Navigation Menu

Repository navigation

Issues

dispatch-gates: check:published-readme-exports is never derived by --commands for a package-source diff (the one family #31257 left)

Queue-flake anchor: test/runner/external-driver.test.ts

cloud-connection: install-local's own uninstall door (DELETE /marketplace/install-local/:id) bypasses the uninstall verb, so it asks no uninstall guard and writes no package audit row

scenarios: external-driver.test.ts's full crm run hits vitest's 5 s default timeout on loaded Test Core shards and merge-queue runs

skills evals: 15 cases forbid (must_not_contain) a string their own expected_output uses, so a careful answer that names the trap fails

mcp: the record data tools answer a driver string code (SQLITE_BUSY) with the driver's text and no status, where /data answers 500 DATABASE_ERROR

mcp: the metadata tools and list_actions answer a fault with its raw text (or a driver code), where the /meta door answers 500 INTERNAL_ERROR

mcp: run_action and resume_run answer a code-less sandboxed action-body throw with the wrapper naming the body, where /actions answers 400 HOOK_ABORTED with the sentence

mcp: the record resource answers a code-less sandboxed hook abort with the wrapper naming the hook, where GET /data answers 400 HOOK_ABORTED with the sentence

mcp: a CODED sandboxed hook CRASH answers the sandbox wrapper (hook name and native error text) at a business status, where /data answers 500

console marketplace: filter and page the catalog through the server's four facets

cli: os build carries devPlugins into the artifact, so a restriction profile must treat dev-only plugins as code

lint.yml: the ADR index step's comment and name still say --report never reds on a record; since #31252 a dropped header field exits 1

console: Settings → Access policy does not show the administrator the client address the server judges (GET /api/v1/auth/client-address)

plugin-auth: GET /api/v1/auth/client-address answers a revoked or expired API key with 500 INTERNAL_ERROR instead of its own refusal

dispatch-gates: 18 whole-root lint families are never derived by --commands for a diff outside their home package

fleet-write dispatch: apply the PR-vs-issue state-label rule to labels_add / issue_create / pr_create, and match pm labels case-insensitively

settings: a `json` setting saved from the console is stored as a string, so retention overrides and row quotas silently do nothing

cli: os validate --target accepts only a profile file — add the URL form once an environment publishes its restriction profile at a defined route (cloud#3713)

spec: a restriction profile cannot list the ADR-0031 containers (parallel, try_catch), devPlugins counts as code under allowCode, and the allowedFlowNodeTypes docblock omits the reader rules

spec: declare ISecurityService.describeEffectiveAccess? and the EffectiveAccess answer types (spec half of #31215)

Docs and skill still type the MCP connect line by hand and describe os deploy as cloud-only

packages: the in-process uninstall verb (deletePackage) withdraws extension fields a dependent active validation rule reads, with no refusal — only the HTTP door asks

Enforce-or-remove: four metadata shapes cloud's authoring rules warn about still parse clean (boolean required, open flow start config, orphan action nodes, roll-up filter keys)

console: the sharing-rule object picker lists only shareable objects, business objects first