Issues · objectstack-ai/objectstack

lint: `os validate` never judges a translation bundle's `_actions.ACTION.outcomeMessages.OUTCOME` keys against the outcomes the action declares — an undeclared outcome's copy passes clean and is never read

objectstack-ai/objectstack#21216 · opened

on Oct 1, 2026

1

skills(objectstack-ui): the dashboards rule tells authors to override a compareTo series with `series.dashArray` / `series.opacity` — a dashboard widget's `chartConfig.series` is a tombstone the schema refuses by name

objectstack-ai/objectstack#21211 · opened

on Oct 1, 2026

1

docs(spec): DashboardWidgetOptionsSchema's doc comment says a typo in widget `options` (`sortDirection`, `granularity`) is an author-time type error — it compiles clean, because the bag is `.passthrough()`

objectstack-ai/objectstack#21210 · opened

on Oct 1, 2026

1

[security] Stored-metadata-body family: two exits #21120 did not reach. An engine-only door serves an administrator credential material in cleartext, and the data door serves a content hash computed over the withheld credentials

objectstack-ai/objectstack#21207 · opened

on Oct 1, 2026

2

ci: the core path filter skips Build Core for build-input-only PRs (scripts/**, root tsup.config.ts, turbo.json) — a broken build first surfaces in the merge queue

objectstack-ai/objectstack#21202 · opened

on Oct 1, 2026

1

Queue-flake anchor: src/tests/field-read-admission-gate.test.ts

objectstack-ai/objectstack#21201 · opened

on Oct 1, 2026

1

Queue-flake anchor: src/tests/caller-content-admission-door.test.ts

objectstack-ai/objectstack#21200 · opened

on Oct 1, 2026

1

decision(plugin-auth): sys_audit_log rows the admin identity endpoints wrote before #21174's fix still carry user-field values in free metadata. Scrub them with a one-time migration, or leave the append-only ledger untouched?

objectstack-ai/objectstack#21198 · opened

on Oct 1, 2026

1

[security] The compliance ledger stores a JWT signing-key row's key material in its create snapshot, and an admin is served it through the ledger's by-id door while the key object itself declares no API door

objectstack-ai/objectstack#21197 · opened

on Oct 1, 2026

5

[finding] spec migration entry filter-text-operator-declared-type-refused: its control sentence says multiselect / tags / lookup-id filters "must keep answering exactly as before", but since #21009 a text operator other than $contains on them answers 400

objectstack-ai/objectstack#21189 · opened

on Oct 1, 2026

1

ci: wire the Vercel turbo remote cache (team object-stack) into ci.yml — trusted events write, PRs read, signed — so cloud's pinned framework build can replay what this repo's main already built

objectstack-ai/objectstack#21186 · opened

on Oct 1, 2026

4

[security] driver upsert: a tenant-scoped upsert keyed on a globally-unique business column can merge into, and re-parent, another tenant's row

objectstack-ai/objectstack#21185 · opened

on Oct 1, 2026

5

spec(data): `field-scale.ts` states that a server `sum` / `avg` over a no-fixed-width `number` does not yet carry its width, and the ruled end-state — ruling A (deferred) on objectui#11254

objectstack-ai/objectstack#21183 · opened

on Oct 1, 2026

spec(data): an object declares which image field is the record's picture (`imageField`, beside `nameField`), refused at publish unless it names an image or avatar field — ruling A on hotcrm#1199

objectstack-ai/objectstack#21182 · opened

on Oct 1, 2026

1

[finding] fleet-write `issue_create` read-back reports UNVERIFIED ("no issue created") for issues that were created: 2 of this shift's 4 card filings, so every such miss costs a manual board read

objectstack-ai/objectstack#21181 · opened

on Oct 1, 2026

2

spec(forms): retire `publicPicker` — anonymous public forms stop taking lookup / master_detail / user fields, and the anonymous picker route goes (ruling E on #21079)

objectstack-ai/objectstack#21180 · opened

on Oct 1, 2026

2

[security] An analytics query surface evaluates caller-supplied content outside the object- and field-level read admission, so a non-admin member can read data they are refused everywhere else — detail withheld pending maintainer

objectstack-ai/objectstack#21177 · opened

on Oct 1, 2026

8

security(plugin-audit): sys_audit_log has no parent-record read gate, so a ledger reader is served the rows about a record the data plane answers 404 to (the ledger's #20833)

objectstack-ai/objectstack#21175 · opened

on Oct 1, 2026

7

[finding] SQLite: an autonumber format whose prefix contains `_` or `%` seeds its counter from 0 — scanMaxNumericTail escapes the prefix but Knex emits no ESCAPE clause, so the bootstrap and #5495 re-seed scans match nothing

objectstack-ai/objectstack#21163 · opened

on Oct 1, 2026

5

security(core, plugin-security): an unauthenticated principal never resolves the permission sets bound to the `guest` anchor; ADR-0090 D9 is declared and seeded but not enforced

objectstack-ai/objectstack#21158 · opened

on Oct 1, 2026

2

security(plugin-audit): a filter over the stored activity text answers by row presence: the generic list door evaluates the predicate at rest, before #21081's read-time redaction, so a reader can probe a field value it is not served

objectstack-ai/objectstack#21154 · opened

on Oct 1, 2026

8

docs(spec): the released 17.5.0 CHANGELOG entry still says the `object-kanban` quick-add control "stays on the `kanban-ui` block", a block objectui does not register (docs-only amendment after #21017)

objectstack-ai/objectstack#21143 · opened

on Oct 1, 2026

2

finding(showcase): project-detail's `record:line_items` block keys its five columns as `field`, while the line-items grid binds `name` — the Tasks grid renders empty cells

objectstack-ai/objectstack#21142 · opened

on Oct 1, 2026

1

[finding] `packages/spec/liveness/README.md` "Author warnings" still says warnings are opt-in per `authorWarn` row; since #21092 a `dead` or `live-elsewhere` verdict warns on its own

objectstack-ai/objectstack#21135 · opened

on Oct 1, 2026

1

analytics: a config cube min / max whose sql is a relationship path is neither judged by the aggregate field-type table nor presented by its declared type on the native face (#21044's family, the dotted half)

objectstack-ai/objectstack#21129 · opened

on Oct 1, 2026

1