skills: data-hooks.md still teaches the deprecated handler first and an unguarded hook condition; formula SKILL has an unguarded example #31131

Activity

1. objectstack-fleet

   added

   findingRecorded observation — held, not dispatchable until the findings triage round grades itRecorded observation — held, not dispatchable until the findings triage round grades it

   documentationImprovements or additions to documentationImprovements or additions to documentation

   domain:skillsDomain lane — seat card indexed by label:pm:seatDomain lane — seat card indexed by label:pm:seat

   pm:queueReady for the PM dispatch loopReady for the PM dispatch loop

   priority:p2Medium: important, M3Medium: important, M3

   and removed

   findingRecorded observation — held, not dispatchable until the findings triage round grades itRecorded observation — held, not dispatchable until the findings triage round grades it

   on Nov 7, 2026
2. objectstack-fleet commented on Nov 7, 2026

   

   objectstack-fleetBot

   on Nov 7, 2026

   ContributorAuthor

   More actions

   triage#1 · os-zhuang · session_01AavokzJ5DndAwitDXvKy4U

   Path: none

   Triage: audit · p2 · domain:skills · 2026-11-07T13:54Z

   ⛔ Not a claim.

   • From PR docs(skills): guard nullable validation operands, teach hook body, list mailbox / package-registry, drop os generate agent #31127's review (skills: four teaching errors copied into refused or retired metadata — validation.md nullable comparisons, requires: table misses package-registry/mailbox, os generate agent still listed, deprecated handler taught first #31113). data-hooks.md still teaches the deprecated handler before body. Its L219 hook condition compares a nullable field unguarded, and the formula skill has an unguarded example; both are refused at publish.
   • p2, the same class and grade as skills: four teaching errors copied into refused or retired metadata — validation.md nullable comparisons, requires: table misses package-registry/mailbox, os generate agent still listed, deprecated handler taught first #31113. Lane domain:skills. finding removed, pm:queue.

   ---

   Generated by Claude Code
3. objectstack-fleet commented on Nov 7, 2026

   

   objectstack-fleetBot

   on Nov 7, 2026

   ContributorAuthor

   More actions

   domain:skills#3 · huangyiirene · session_01J8VVAj7CvjkGXvgXzd6RZ7

   Claim: PM loop round 19 · 2026-11-07T16:51Z
   Session: session_01J8VVAj7CvjkGXvgXzd6RZ7
   Account: huangyiirene
   Branch: claude/project-thread-midtvb (the card thread's designated branch; dev session session_01J8VVAnzH4vvvJVUf6zdYe9)
   Worktree: objectstack-issue-31131
   Domain: domain:skills
   Seat: domain:skills#3
   File surface: skills/objectstack-data/references/data-hooks.md (body-first rewrite of the handler examples, the L219 condition guard, the Connector recipes link, and same-file deletions that pay its budget); skills/objectstack-formula/SKILL.md (the one unguarded os:check example); skills/objectstack-data/evals/*.json and skills/objectstack-formula/evals/*.json (one case per site group, plus any case still rewarding handler or an unguarded nullable comparison); .changeset/*.md; scripts/check-skills-token-ratchet.mjs only by standing ruling 6513306068 for a measured remainder (stop on breach)
   Container & model: M, mode:thread, project-default model, effort: high. dispatch-gates --tier is run by the thread and reported; any mandate above this thread's is waived by the maintainer's standing order in this project (2026-11-03) and said so in the PR body; this seat runs the contract review.
   Clause-②: no
   Metadata-protocol: none
   Responsibility: n/a — not a defect card (published teaching of a deprecated door and of comparisons the publish gate refuses; PR #31127 fixed the same errors elsewhere)
   Thread-read: 6707819308
   Premise: holds on main 620b6e6d per the card's re-read on 5f003744; PR #31152 since cut one line of data-hooks.md, so the thread re-measures every site and the budget before editing.
   Serial constraints: none open (PR #31127 and PR #31152, which touched these files, are merged). The seat runs serially (one card) by the maintainer's word of 2026-11-07.

   Changeset '@objectstack/skills': patch. Fixes #31131. Tier read by check-governed-merges at the PR.
4. objectstack-fleet

   added

   pm:dispatchedDispatched to a dev agent by /pm-dispatchDispatched to a dev agent by /pm-dispatch

   and removed

   pm:queueReady for the PM dispatch loopReady for the PM dispatch loop

   on Nov 7, 2026
5. objectstack-fleet

   assigned

   huangyiirene

   on Nov 7, 2026
6. objectstack-fleet commented on Nov 7, 2026

   

   objectstack-fleetBot

   on Nov 7, 2026

   ContributorAuthor

   More actions

   domain:skills#3 · huangyiirene · session_01J8VVAj7CvjkGXvgXzd6RZ7

   Claim widened (card thread's measurement, confirmed by the seat on main) · 2026-11-07T16:56Z

   Same file, skills/objectstack-data/references/data-hooks.md, adds three corrections. Nothing is added outside that file and the evals already claimed.

   • The ctx.api.object(name) method table and the api.write capability row (≈L390, L392, L442) list upsert, updateMany and deleteMany as callable from a hook body. They are not. The sandbox's ctx.api.object(n) dispatches to the engine's ObjectRepository (packages/objectql/src/engine.ts ≈L10079), whose members are find, findOne, insert, create, update, updateById, delete, deleteById, count and aggregate. Any other name throws ctx.api.object('…').<method> not implemented (packages/runtime/src/sandbox/quickjs-runner.ts ≈L1368). Drop the three names from both tables, and teach the bulk form the repository has (update(data, { where, multi: true }), checked in the engine).
   • Pattern 3's comment that only the sandbox ctx.api adds updateMany goes too, with the rewrite to a body.
   • The schema example's hook condition record.amount > 1000 (≈L105) is guarded with the L219 site, as one site group.

   Seat rulings on the thread's two questions:

   • Pattern 4 (Data Masking on Read, afterFind) stays an inline handler, retitled to say it is the deprecated form and why: a body writes back only ctx.input, and its ctx.result is a snapshot.
   • The Cross-Object API handler snippet (≈L739) is deleted. Its facts live in § ctx.api.object(name) and in Pattern 2, and the body table names those homes.
7. objectstack-fleet commented on Nov 7, 2026

   

   objectstack-fleetBot

   on Nov 7, 2026

   ContributorAuthor

   More actions

   domain:skills#3 · huangyiirene · session_01J8VVAj7CvjkGXvgXzd6RZ7

   Claim widened again (contract review 6710673767 on PR #31201, should-fix S3) · 2026-11-07T17:29Z

   This stays in the same file, skills/objectstack-data/references/data-hooks.md. It covers the same defect as the review's must-fix M1, already on main:

   • Pattern 1 (≈L752) and Pattern 2 (≈L775). In a delete-hook body, ctx.input is {} (the sandbox's flat input exposes only the payload's own keys), so ctx.input.id is undefined. Pattern 1 then counts across every account, and Pattern 2 records an empty id. Key both on ctx.previous.id, as perrow-dispatch-signal.integration.test.ts teaches for the bulk path.
   • The prose that says input.id names the row (≈L54, L252, L266). Scope it to the inline handler context, and give ctx.previous.id as the body's key on bulk, by-where and delete paths. One clause each, paid by same-file deletion.

   Nothing is added outside this file and the claimed evals.

   Out of claim, to a follow-up card:

   • the unguarded approval-edge conditions in skills/objectstack-automation/references/state-machines-and-approvals.md (≈L90, L128, L133, L135);
   • the unguarded record.amount > 1000 example in packages/spec/src/data/hook.zod.ts (≈L524-526), published to hook.mdx.
8. objectstack-fleet commented on Nov 7, 2026

   

   objectstack-fleetBot

   on Nov 7, 2026

   ContributorAuthor

   More actions

   domain:skills#3 · huangyiirene · session_01J8VVAj7CvjkGXvgXzd6RZ7

   ACCEPT → PR #31201 comment 6711029880, head 9b1e9264. Tier H: pm:awaiting-merge, approval requested from os-zhuang and hotlong. Widened twice (6710259290: the body ctx.api table listed methods that throw; 6710683947: body examples keyed on ctx.input.id). Follow-up: #31206 (unguarded approval-edge conditions in the automation skill and the HookSchema.condition example).