Issues

governance(AGENTS.md PD15): carve the fleet relay's closed Version-PR refresh stroke (release.yml with refresh_version_pr: true alone) out of the reserved release act, per ruling A on #23193

objectstack-ai/objectstack#23393 · opened

on Oct 14, 2026

chore(objectui): move the console pin from 1fb1ced36243 to objectui main once objectui#11773 and objectui#12270 land (the hop carries objectui's v18 dependency move)

objectstack-ai/objectstack#23392 · opened

on Oct 14, 2026

cli: `os migrate meta --stored` tells the operator a failed row "keeps reading canonically, so nothing is broken", but a flow the engine refuses is not registered at boot

objectstack-ai/objectstack#23391 · opened

on Oct 14, 2026

[Decision] After a PR is open, merge main only on a conflict, a main-caused CI red or a queue removal, and re-check only the overlap; or keep merging main before every push

objectstack-ai/objectstack#23390 · opened

on Oct 14, 2026

1

[Decision] Pages saved through Studio, REST or MCP skip the component-props rule that `os validate` refuses: cross it to the runtime door, and on what evidence

objectstack-ai/objectstack#23388 · opened

on Oct 14, 2026

1

spec: the two-master `controlled_by_parent` refusal names no release, while its no-master sibling says "since @objectstack/spec 18"

objectstack-ai/objectstack#23387 · opened

on Oct 14, 2026

plugin-security: under the walled posture, deployment-level audience-binding acceptance is host configuration (ADR-0131 D5) — the sync stops warning once declared; the refusal names that path, not "create the Default Organization" (cloud#2872 A′)

objectstack-ai/objectstack#23385 · opened

on Oct 14, 2026

pm-dispatch: one review record per PR — ACCEPT and 速读终稿 merge into one PR comment, the card keeps a pointer; the landing record stays the probe table; the ledger block only at summon end (方案 6, 「同意」 2026-10-14)

objectstack-ai/objectstack#23381 · opened

on Oct 14, 2026

director: one analysis per decision card — the filing seat's six items are the card; the director's 席位意见 is a delta (premises, 推荐/回退/口径), full 四维 only on dissent; the chat batch keeps six items (方案 2, 「同意」 2026-10-14)

objectstack-ai/objectstack#23380 · opened

on Oct 14, 2026

pm-dispatch: a card blocked on an unruled decision, or dispatched measure-then-decide, gets no building dev — it waits, or a reading-only dev (no build, no tests) posts the reading on the decision card (方案 3, 「同意」 2026-10-14)

objectstack-ai/objectstack#23379 · opened

on Oct 14, 2026

os-dev verification: local = the changed packages' typecheck and tests plus the gate families reading changed files; the derived sweep is CI's, read from check-runs; ablations only where a tested behaviour changes (方案 4, 「同意」 2026-10-14)

objectstack-ai/objectstack#23378 · opened

on Oct 14, 2026

references/platform-readings: the tenancy census's `reach: in` is not ADR-0131 D9 admission — the #13491 ledger (PLATFORM_OBJECT_TENANCY) decides whether a system write is stamped

objectstack-ai/objectstack#23377 · opened

on Oct 14, 2026

1

skills(objectstack-automation references): examples-flows.md and state-machines-and-approvals.md still teach the single-brace `{…}` filter spelling the platform refuses; write the CEL envelope and the `{today}` placeholder (sub-issue of #22585)

objectstack-ai/objectstack#23374 · opened

on Oct 14, 2026

2

docs/docblocks: ADR-0090 D9, `validate-security-posture.ts` and `position.zod.ts` still say a package suggests, or an operator binds, a `guest` set; after ruling C on #23267 no door binds `guest` until ADR-0138 D3 item 5's door is built

objectstack-ai/objectstack#23373 · opened

on Oct 14, 2026

1

plugin-sharing: a share link with a password and an email audience answers an anonymous caller who sends the correct password with the wrong-password code; reordering needs a decision (allowlist-membership oracle)

objectstack-ai/objectstack#23372 · opened

on Oct 14, 2026

1

plugin-sharing: the two mounts of the share-link messages door disagree for a signed-in caller of a signed_in conversation link — the plugin mount answers 404, the dispatcher 200 — because the plugin mount passes no signed-in user to resolveToken

objectstack-ai/objectstack#23371 · opened

on Oct 14, 2026

1

[Decision] API key 的生命周期与存放：到期上限与不活动失效取多长，key 继续放自有 sys_api_key 还是迁到 @better-auth/api-key（#23287 裁决 C′ 的留项）

objectstack-ai/objectstack#23367 · opened

on Oct 14, 2026

1

hono adapter: `createHonoApp`'s catch-all renders an error thrown out of `dispatch()` from `statusCode` alone, so a declared `status`/`code` (a missing record's `404 RECORD_NOT_FOUND`, an outage's `503`) answers `500 INTERNAL_ERROR`

objectstack-ai/objectstack#23365 · opened

on Oct 14, 2026

1

gates: `check-issue-citations` reads one transient HTTP 500 from the board as PREREQUISITE NOT MET with no retry, so a GitHub blip turns the lint lane red and drops a PR from the merge queue

objectstack-ai/objectstack#23361 · opened

on Oct 14, 2026

1

os migrate organization-ownership --apply, run where the security plugin is not composed (no auth secret), blocks its rewrite on the platform's own shipped permission sets and prescribes removing the admin's grants, without naming the cause

objectstack-ai/objectstack#23359 · opened

on Oct 14, 2026

1

page: a stored page component's `data` can still carry the retired view `api` source — the props gate runs at the CLI doors only, so the runtime save door and boot accept it, and the renderer still sends it with its stored headers

objectstack-ai/objectstack#23357 · opened

on Oct 14, 2026

2

plugin-security: the seed-ownership claim hands every unowned row to the platform admin on each app:seeded — guest-written and public-form rows included — contradicting ADR-0138 D1's "the owner stays unset"

objectstack-ai/objectstack#23354 · opened

on Oct 14, 2026

2

decision: which model serves the clause-② contract review — fable on every lane (ruling 5771798588), or fable only for the spec / skills lanes and governed surfaces with opus elsewhere?

objectstack-ai/objectstack#23352 · opened

on Oct 14, 2026

5

verify: `dashboard-window.test.ts`'s NEGATIVE CONTROL cases read the real clock, so a run that crosses UTC midnight gets the probe's day-turn `not-run` and fails them (merge-queue red, run 38486827994)

objectstack-ai/objectstack#23351 · opened

on Oct 14, 2026

1

cli: `os meta delete` declares no `--package`, so the reset door's `409 RESOURCE_CONFLICT` remedy (name one package) cannot be sent from the CLI, and `os meta register` cannot name the package a save writes into

objectstack-ai/objectstack#23350 · opened

on Oct 13, 2026

2

Navigation Menu

Repository navigation

Issues

governance(AGENTS.md PD15): carve the fleet relay's closed Version-PR refresh stroke (release.yml with refresh_version_pr: true alone) out of the reserved release act, per ruling A on #23193

chore(objectui): move the console pin from 1fb1ced36243 to objectui main once objectui#11773 and objectui#12270 land (the hop carries objectui's v18 dependency move)

cli: `os migrate meta --stored` tells the operator a failed row "keeps reading canonically, so nothing is broken", but a flow the engine refuses is not registered at boot

[Decision] After a PR is open, merge main only on a conflict, a main-caused CI red or a queue removal, and re-check only the overlap; or keep merging main before every push

[Decision] Pages saved through Studio, REST or MCP skip the component-props rule that `os validate` refuses: cross it to the runtime door, and on what evidence

spec: the two-master `controlled_by_parent` refusal names no release, while its no-master sibling says "since @objectstack/spec 18"

plugin-security: under the walled posture, deployment-level audience-binding acceptance is host configuration (ADR-0131 D5) — the sync stops warning once declared; the refusal names that path, not "create the Default Organization" (cloud#2872 A′)

pm-dispatch: one review record per PR — ACCEPT and 速读终稿 merge into one PR comment, the card keeps a pointer; the landing record stays the probe table; the ledger block only at summon end (方案 6, 「同意」 2026-10-14)

director: one analysis per decision card — the filing seat's six items are the card; the director's 席位意见 is a delta (premises, 推荐/回退/口径), full 四维 only on dissent; the chat batch keeps six items (方案 2, 「同意」 2026-10-14)

pm-dispatch: a card blocked on an unruled decision, or dispatched measure-then-decide, gets no building dev — it waits, or a reading-only dev (no build, no tests) posts the reading on the decision card (方案 3, 「同意」 2026-10-14)

os-dev verification: local = the changed packages' typecheck and tests plus the gate families reading changed files; the derived sweep is CI's, read from check-runs; ablations only where a tested behaviour changes (方案 4, 「同意」 2026-10-14)

references/platform-readings: the tenancy census's `reach: in` is not ADR-0131 D9 admission — the #13491 ledger (PLATFORM_OBJECT_TENANCY) decides whether a system write is stamped

skills(objectstack-automation references): examples-flows.md and state-machines-and-approvals.md still teach the single-brace `{…}` filter spelling the platform refuses; write the CEL envelope and the `{today}` placeholder (sub-issue of #22585)

docs/docblocks: ADR-0090 D9, `validate-security-posture.ts` and `position.zod.ts` still say a package suggests, or an operator binds, a `guest` set; after ruling C on #23267 no door binds `guest` until ADR-0138 D3 item 5's door is built

plugin-sharing: a share link with a password and an email audience answers an anonymous caller who sends the correct password with the wrong-password code; reordering needs a decision (allowlist-membership oracle)

plugin-sharing: the two mounts of the share-link messages door disagree for a signed-in caller of a signed_in conversation link — the plugin mount answers 404, the dispatcher 200 — because the plugin mount passes no signed-in user to resolveToken

[Decision] API key 的生命周期与存放：到期上限与不活动失效取多长，key 继续放自有 sys_api_key 还是迁到 @better-auth/api-key（#23287 裁决 C′ 的留项）

hono adapter: `createHonoApp`'s catch-all renders an error thrown out of `dispatch()` from `statusCode` alone, so a declared `status`/`code` (a missing record's `404 RECORD_NOT_FOUND`, an outage's `503`) answers `500 INTERNAL_ERROR`

gates: `check-issue-citations` reads one transient HTTP 500 from the board as PREREQUISITE NOT MET with no retry, so a GitHub blip turns the lint lane red and drops a PR from the merge queue

os migrate organization-ownership --apply, run where the security plugin is not composed (no auth secret), blocks its rewrite on the platform's own shipped permission sets and prescribes removing the admin's grants, without naming the cause

page: a stored page component's `data` can still carry the retired view `api` source — the props gate runs at the CLI doors only, so the runtime save door and boot accept it, and the renderer still sends it with its stored headers

plugin-security: the seed-ownership claim hands every unowned row to the platform admin on each app:seeded — guest-written and public-form rows included — contradicting ADR-0138 D1's "the owner stays unset"

decision: which model serves the clause-② contract review — fable on every lane (ruling 5771798588), or fable only for the spec / skills lanes and governed surfaces with opus elsewhere?

verify: `dashboard-window.test.ts`'s NEGATIVE CONTROL cases read the real clock, so a run that crosses UTC midnight gets the probe's day-turn `not-run` and fails them (merge-queue red, run 38486827994)

cli: `os meta delete` declares no `--package`, so the reset door's `409 RESOURCE_CONFLICT` remedy (name one package) cannot be sent from the CLI, and `os meta register` cannot name the package a save writes into