Issues

lint 19.0: `page-predicate-over-budget` becomes an error, refusing a page component props CEL slot over the platform parse bounds (the deferred half of #24953)

objectstack-ai/objectstack#25002 · opened

on Oct 20, 2026

objectql 19.0: under `strictReadonlyWrites`, refuse a write whose value a stored expression replaces (`stored_expression`), the deferred half of #24690

objectstack-ai/objectstack#25000 · opened

on Oct 20, 2026

spec: refuse a declared webhook whose `requires` cannot dispatch it — `STACK_WEBHOOK_CAPABILITY_REQUIRED` in `defineStack`, the third declared-capability refusal (ruling A on #24910; ships in 18.x by the maintainer's re-timing)

objectstack-ai/objectstack#24997 · opened

on Oct 20, 2026

spec: `FLOW_FAILED` carries the refused write's inner refusal — an optional `userMessage` on `AutomationResult` and one declared details member `{ code, message }` on the trigger, resume, /actions and endpoint doors (ruling B′ on #24914)

objectstack-ai/objectstack#24996 · opened

on Oct 20, 2026

spec: a built-in `webhook` metadata-type redactor — `secret` and the whole `headers` map are withheld on every meta read door, with or without plugin-webhooks mounted (ruling B on #24966)

objectstack-ai/objectstack#24994 · opened

on Oct 20, 2026

cli/i18n: translation coverage never expects a contributed navigation item's label — deleting its zh-CN key leaves os lint --strict green, though translation-target-unknown accepts that key

objectstack-ai/objectstack#24993 · opened

on Oct 20, 2026

lint: a nested page component whose properties is null or an array escapes component-props under --strict — validateComponentProps skips a non-record bag that the schema never parses

objectstack-ai/objectstack#24991 · opened

on Oct 20, 2026

service-settings: Company → Legal name help points to "the organization name set under Branding", a page that sets the product name and is not offered under a walled posture

objectstack-ai/objectstack#24987 · opened

on Oct 20, 2026

plugin-security: the controlled_by_parent detail write gate's master-edit check may not ask the same question as the master's own write door (reach not measured; detail withheld under the disclosure ruling)

objectstack-ai/objectstack#24986 · opened

on Oct 20, 2026

2

service-messaging: refuse sys_notification_template rows for a channel other than email or sms (the 19.0 half of ruling D)

objectstack-ai/objectstack#24983 · opened

on Oct 20, 2026

1

import: a lookup cell that names the record by the target object's title field answers reference_not_found — resolveRef never reads nameField, and a formula title is not matchable

objectstack-ai/objectstack#24981 · opened

on Oct 20, 2026

3

spec: the translation liveness row flows.approvals still reads planned and ApprovalRequestRow's label docblocks still name the authored label, although PR #24977 is the reader that serves them in the reader's locale

objectstack-ai/objectstack#24979 · opened

on Oct 20, 2026

plugin-approvals: the approval notifications (approval.requested, reminder, sla_breached, approved/rejected, out-of-office) reach every approver as literal English sentences built at emit; no catalog holds them, so no recipient locale can apply

objectstack-ai/objectstack#24978 · opened

on Oct 20, 2026

2

skills: the published `@objectstack/skills` README and two `skills/**` pages still print `npm install --save-dev "@objectstack/skills@…"` as the only install line, which exits 1 in a pnpm-installed project (#24926's governed and published rows)

objectstack-ai/objectstack#24974 · opened

on Oct 20, 2026

rest/spec: a public form's title has no translation key, and GET /forms/:slug serves it untranslated, so a localized form can only be titled in one language

objectstack-ai/objectstack#24969 · opened

on Oct 20, 2026

1

spec/i18n: a page:tabs item label has no translation key, and translatePage never translates it, so a localized page keeps its tab labels in the authoring language

objectstack-ai/objectstack#24968 · opened

on Oct 20, 2026

2

meta: the `webhook` metadata type has no redactor, so its secret-bearing fields are not masked on the meta read doors (detail withheld under the disclosure ruling)

objectstack-ai/objectstack#24966 · opened

on Oct 20, 2026

5

spec: the script.config.template tombstone points authors at sys_notification_template, which notify's own `template` key superseded (ruling D on #24770)

objectstack-ai/objectstack#24965 · opened

on Oct 20, 2026

objectql: a master-detail row whose master is missing can be neither read nor removed through any door — the admin answers 404 by id, queries omit it, and the integrity audit only reports it

objectstack-ai/objectstack#24964 · opened

on Oct 20, 2026

2

driver-sql: the read-only probe's absent-file test (existsSync) reads an unopenable SQLite path as absent, so os migrate plan opens an empty in-memory database, reports the datasource connected, and plans DDL into a file that cannot exist

objectstack-ai/objectstack#24961 · opened

on Oct 20, 2026

1

driver-sql: a declared SQLite file that is not a database (SQLITE_NOTADB) is accepted by connect(); on a development boot the wasm rung then renames it to FILE.corrupt-TIMESTAMP, writes an empty database in its place, and reads connected

objectstack-ai/objectstack#24960 · opened

on Oct 20, 2026

1

`os migrate apply` and `os migrate plan` still name `--allow-destructive` as the remedy for drops that `apply` itself refuses (the pre-prompt listing and skip lines before the ownership ceremony, and `sys_comment.reactions` in the plan)

objectstack-ai/objectstack#24958 · opened

on Oct 20, 2026

lint 19.0: `validationRuleParentIssue` moves from `warning` to `error`, so a `validations[]` rule that reads `parent` is refused at `os build` and the object save door (the deferred half of #24720)

objectstack-ai/objectstack#24957 · opened

on Oct 20, 2026

1

Boot drift lines on a 17.x database before the ownership ceremony prescribe `os migrate apply --allow-destructive` for each `organization_id` column, a run the drop gate refuses

objectstack-ai/objectstack#24956 · opened

on Oct 20, 2026

1

spec: a page visibleWhen over the CEL engine's maxAstNodes (256) passes PageSchema at publish, then faults on every evaluation in the console and fails open, so the page gate it declares is never enforced

objectstack-ai/objectstack#24953 · opened

on Oct 20, 2026

3

Navigation Menu

Repository navigation

Issues

lint 19.0: `page-predicate-over-budget` becomes an error, refusing a page component props CEL slot over the platform parse bounds (the deferred half of #24953)

objectql 19.0: under `strictReadonlyWrites`, refuse a write whose value a stored expression replaces (`stored_expression`), the deferred half of #24690

spec: refuse a declared webhook whose `requires` cannot dispatch it — `STACK_WEBHOOK_CAPABILITY_REQUIRED` in `defineStack`, the third declared-capability refusal (ruling A on #24910; ships in 18.x by the maintainer's re-timing)

spec: `FLOW_FAILED` carries the refused write's inner refusal — an optional `userMessage` on `AutomationResult` and one declared details member `{ code, message }` on the trigger, resume, /actions and endpoint doors (ruling B′ on #24914)

spec: a built-in `webhook` metadata-type redactor — `secret` and the whole `headers` map are withheld on every meta read door, with or without plugin-webhooks mounted (ruling B on #24966)

cli/i18n: translation coverage never expects a contributed navigation item's label — deleting its zh-CN key leaves os lint --strict green, though translation-target-unknown accepts that key

lint: a nested page component whose properties is null or an array escapes component-props under --strict — validateComponentProps skips a non-record bag that the schema never parses

service-settings: Company → Legal name help points to "the organization name set under Branding", a page that sets the product name and is not offered under a walled posture

plugin-security: the controlled_by_parent detail write gate's master-edit check may not ask the same question as the master's own write door (reach not measured; detail withheld under the disclosure ruling)

service-messaging: refuse sys_notification_template rows for a channel other than email or sms (the 19.0 half of ruling D)

import: a lookup cell that names the record by the target object's title field answers reference_not_found — resolveRef never reads nameField, and a formula title is not matchable

spec: the translation liveness row flows.approvals still reads planned and ApprovalRequestRow's label docblocks still name the authored label, although PR #24977 is the reader that serves them in the reader's locale

plugin-approvals: the approval notifications (approval.requested, reminder, sla_breached, approved/rejected, out-of-office) reach every approver as literal English sentences built at emit; no catalog holds them, so no recipient locale can apply

skills: the published `@objectstack/skills` README and two `skills/**` pages still print `npm install --save-dev "@objectstack/skills@…"` as the only install line, which exits 1 in a pnpm-installed project (#24926's governed and published rows)

rest/spec: a public form's title has no translation key, and GET /forms/:slug serves it untranslated, so a localized form can only be titled in one language

spec/i18n: a page:tabs item label has no translation key, and translatePage never translates it, so a localized page keeps its tab labels in the authoring language

meta: the `webhook` metadata type has no redactor, so its secret-bearing fields are not masked on the meta read doors (detail withheld under the disclosure ruling)

spec: the script.config.template tombstone points authors at sys_notification_template, which notify's own `template` key superseded (ruling D on #24770)

objectql: a master-detail row whose master is missing can be neither read nor removed through any door — the admin answers 404 by id, queries omit it, and the integrity audit only reports it

driver-sql: the read-only probe's absent-file test (existsSync) reads an unopenable SQLite path as absent, so os migrate plan opens an empty in-memory database, reports the datasource connected, and plans DDL into a file that cannot exist

driver-sql: a declared SQLite file that is not a database (SQLITE_NOTADB) is accepted by connect(); on a development boot the wasm rung then renames it to FILE.corrupt-TIMESTAMP, writes an empty database in its place, and reads connected

`os migrate apply` and `os migrate plan` still name `--allow-destructive` as the remedy for drops that `apply` itself refuses (the pre-prompt listing and skip lines before the ownership ceremony, and `sys_comment.reactions` in the plan)

lint 19.0: `validationRuleParentIssue` moves from `warning` to `error`, so a `validations[]` rule that reads `parent` is refused at `os build` and the object save door (the deferred half of #24720)

Boot drift lines on a 17.x database before the ownership ceremony prescribe `os migrate apply --allow-destructive` for each `organization_id` column, a run the drop gate refuses

spec: a page visibleWhen over the CEL engine's maxAstNodes (256) passes PageSchema at publish, then faults on every evaluation in the console and fails open, so the page gate it declares is never enforced