Issues

import: a lookup cell that names the record by the target object's title field answers reference_not_found — resolveRef never reads nameField, and a formula title is not matchable

objectstack-ai/objectstack#24981 · opened

on Oct 20, 2026

spec: the translation liveness row flows.approvals still reads planned and ApprovalRequestRow's label docblocks still name the authored label, although PR #24977 is the reader that serves them in the reader's locale

objectstack-ai/objectstack#24979 · opened

on Oct 20, 2026

plugin-approvals: the approval notifications (approval.requested, reminder, sla_breached, approved/rejected, out-of-office) reach every approver as literal English sentences built at emit; no catalog holds them, so no recipient locale can apply

objectstack-ai/objectstack#24978 · opened

on Oct 20, 2026

skills: the published `@objectstack/skills` README and two `skills/**` pages still print `npm install --save-dev "@objectstack/skills@…"` as the only install line, which exits 1 in a pnpm-installed project (#24926's governed and published rows)

objectstack-ai/objectstack#24974 · opened

on Oct 20, 2026

rest/spec: a public form's title has no translation key, and GET /forms/:slug serves it untranslated, so a localized form can only be titled in one language

objectstack-ai/objectstack#24969 · opened

on Oct 20, 2026

spec/i18n: a page:tabs item label has no translation key, and translatePage never translates it, so a localized page keeps its tab labels in the authoring language

objectstack-ai/objectstack#24968 · opened

on Oct 20, 2026

2

meta: the `webhook` metadata type has no redactor, so its secret-bearing fields are not masked on the meta read doors (detail withheld under the disclosure ruling)

objectstack-ai/objectstack#24966 · opened

on Oct 20, 2026

4

spec: the script.config.template tombstone points authors at sys_notification_template, which notify's own `template` key superseded (ruling D on #24770)

objectstack-ai/objectstack#24965 · opened

on Oct 20, 2026

objectql: a master-detail row whose master is missing can be neither read nor removed through any door — the admin answers 404 by id, queries omit it, and the integrity audit only reports it

objectstack-ai/objectstack#24964 · opened

on Oct 20, 2026

plugin-security: a controlled_by_parent detail is readable by a caller with no read on its master object, where ADR-0055 refuses it (detail withheld under the disclosure ruling)

objectstack-ai/objectstack#24962 · opened

on Oct 20, 2026

2

driver-sql: the read-only probe's absent-file test (existsSync) reads an unopenable SQLite path as absent, so os migrate plan opens an empty in-memory database, reports the datasource connected, and plans DDL into a file that cannot exist

objectstack-ai/objectstack#24961 · opened

on Oct 20, 2026

driver-sql: a declared SQLite file that is not a database (SQLITE_NOTADB) is accepted by connect(); on a development boot the wasm rung then renames it to FILE.corrupt-TIMESTAMP, writes an empty database in its place, and reads connected

objectstack-ai/objectstack#24960 · opened

on Oct 20, 2026

`os migrate apply` and `os migrate plan` still name `--allow-destructive` as the remedy for drops that `apply` itself refuses (the pre-prompt listing and skip lines before the ownership ceremony, and `sys_comment.reactions` in the plan)

objectstack-ai/objectstack#24958 · opened

on Oct 20, 2026

lint 19.0: `validationRuleParentIssue` moves from `warning` to `error`, so a `validations[]` rule that reads `parent` is refused at `os build` and the object save door (the deferred half of #24720)

objectstack-ai/objectstack#24957 · opened

on Oct 20, 2026

1

Boot drift lines on a 17.x database before the ownership ceremony prescribe `os migrate apply --allow-destructive` for each `organization_id` column, a run the drop gate refuses

objectstack-ai/objectstack#24956 · opened

on Oct 20, 2026

spec: a page visibleWhen over the CEL engine's maxAstNodes (256) passes PageSchema at publish, then faults on every evaluation in the console and fails open, so the page gate it declares is never enforced

objectstack-ai/objectstack#24953 · opened

on Oct 20, 2026

2

spec(data) 19.0: refuse a `user` field whose `reference` names an object other than `sys_user`, and resolve every `user` field to `sys_user` (the deferred half of #24808)

objectstack-ai/objectstack#24952 · opened

on Oct 20, 2026

1

objectql: a unique refusal's user-facing sentence names the object by its API name ("Duplicate record refused on 'crm_account': …"), which a screen-flow user and a record-save user both read verbatim

objectstack-ai/objectstack#24951 · opened

on Oct 20, 2026

`os migrate apply --allow-destructive` in a non-interactive shell without `--yes` applies nothing, prints "Confirmation required", and exits 0 — a script reads success, while `os migrate comment-reactions --apply` without `--yes` exits 1

objectstack-ai/objectstack#24949 · opened

on Oct 20, 2026

[Decision] Deleting an organization once organization_id is NOT NULL: refuse while it still owns records, or delete them with it

objectstack-ai/objectstack#24948 · opened

on Oct 20, 2026

1

rest: list export writes every boolean cell as the literal 是 / 否, whatever the caller's language

objectstack-ai/objectstack#24945 · opened

on Oct 20, 2026

rest: list export writes a lookup cell from a fixed key list on the expanded record and never reads the target's nameField — HotCRM contacts export as their job title

objectstack-ai/objectstack#24944 · opened

on Oct 20, 2026

3

platform-objects: deleting a business unit that has children silently turns them into tenant roots — parent_business_unit_id declares no deleteBehavior and takes set_null

objectstack-ai/objectstack#24939 · opened

on Oct 20, 2026

2

platform-objects: the sys_user page's Security tab shows the viewer's own "your account" sections, empty, on every other user's record

objectstack-ai/objectstack#24938 · opened

on Oct 20, 2026

platform-objects: Create User's result dialog always says "Copy the temporary password now", though a typed password returns none to copy

objectstack-ai/objectstack#24936 · opened

on Oct 20, 2026

Navigation Menu

Repository navigation

Issues

import: a lookup cell that names the record by the target object's title field answers reference_not_found — resolveRef never reads nameField, and a formula title is not matchable

spec: the translation liveness row flows.approvals still reads planned and ApprovalRequestRow's label docblocks still name the authored label, although PR #24977 is the reader that serves them in the reader's locale

plugin-approvals: the approval notifications (approval.requested, reminder, sla_breached, approved/rejected, out-of-office) reach every approver as literal English sentences built at emit; no catalog holds them, so no recipient locale can apply

skills: the published `@objectstack/skills` README and two `skills/**` pages still print `npm install --save-dev "@objectstack/skills@…"` as the only install line, which exits 1 in a pnpm-installed project (#24926's governed and published rows)

rest/spec: a public form's title has no translation key, and GET /forms/:slug serves it untranslated, so a localized form can only be titled in one language

spec/i18n: a page:tabs item label has no translation key, and translatePage never translates it, so a localized page keeps its tab labels in the authoring language

meta: the `webhook` metadata type has no redactor, so its secret-bearing fields are not masked on the meta read doors (detail withheld under the disclosure ruling)

spec: the script.config.template tombstone points authors at sys_notification_template, which notify's own `template` key superseded (ruling D on #24770)

objectql: a master-detail row whose master is missing can be neither read nor removed through any door — the admin answers 404 by id, queries omit it, and the integrity audit only reports it

plugin-security: a controlled_by_parent detail is readable by a caller with no read on its master object, where ADR-0055 refuses it (detail withheld under the disclosure ruling)

driver-sql: the read-only probe's absent-file test (existsSync) reads an unopenable SQLite path as absent, so os migrate plan opens an empty in-memory database, reports the datasource connected, and plans DDL into a file that cannot exist

driver-sql: a declared SQLite file that is not a database (SQLITE_NOTADB) is accepted by connect(); on a development boot the wasm rung then renames it to FILE.corrupt-TIMESTAMP, writes an empty database in its place, and reads connected

`os migrate apply` and `os migrate plan` still name `--allow-destructive` as the remedy for drops that `apply` itself refuses (the pre-prompt listing and skip lines before the ownership ceremony, and `sys_comment.reactions` in the plan)

lint 19.0: `validationRuleParentIssue` moves from `warning` to `error`, so a `validations[]` rule that reads `parent` is refused at `os build` and the object save door (the deferred half of #24720)

Boot drift lines on a 17.x database before the ownership ceremony prescribe `os migrate apply --allow-destructive` for each `organization_id` column, a run the drop gate refuses

spec: a page visibleWhen over the CEL engine's maxAstNodes (256) passes PageSchema at publish, then faults on every evaluation in the console and fails open, so the page gate it declares is never enforced

spec(data) 19.0: refuse a `user` field whose `reference` names an object other than `sys_user`, and resolve every `user` field to `sys_user` (the deferred half of #24808)

objectql: a unique refusal's user-facing sentence names the object by its API name ("Duplicate record refused on 'crm_account': …"), which a screen-flow user and a record-save user both read verbatim

`os migrate apply --allow-destructive` in a non-interactive shell without `--yes` applies nothing, prints "Confirmation required", and exits 0 — a script reads success, while `os migrate comment-reactions --apply` without `--yes` exits 1

[Decision] Deleting an organization once organization_id is NOT NULL: refuse while it still owns records, or delete them with it

rest: list export writes every boolean cell as the literal 是 / 否, whatever the caller's language

rest: list export writes a lookup cell from a fixed key list on the expanded record and never reads the target's nameField — HotCRM contacts export as their job title

platform-objects: deleting a business unit that has children silently turns them into tenant roots — parent_business_unit_id declares no deleteBehavior and takes set_null

platform-objects: the sys_user page's Security tab shows the viewer's own "your account" sections, empty, on every other user's record

platform-objects: Create User's result dialog always says "Copy the temporary password now", though a typed password returns none to copy