Issues

mcp: on an environmentId kernel, list_actions / run_action cannot see a package object's actions when the package registered during boot — collectActionDeclarations and action resolution read metadata.listObjects()

objectstack-ai/objectstack#25139 · opened

on Oct 21, 2026

mcp stdio: on an environmentId kernel, a package registered during boot is invisible to list_objects / describe_object, and the stdio exposure gate serves its apiEnabled:false object (the stdio twin of #25120)

objectstack-ai/objectstack#25138 · opened

on Oct 21, 2026

docs(objectql): "Multi-Tenant Schemas" says the injected organization_id stays NULL with no organization context, and since PR #24940 a table the driver creates carries it NOT NULL and refuses that write

objectstack-ai/objectstack#25137 · opened

on Oct 21, 2026

[Decision] ADR-0131 D1 on stores already certified (18.0.0-born or ceremonied): an advisory for the voluntary ceremony plus a documented residue, or a shape-generation bump

objectstack-ai/objectstack#25134 · opened

on Oct 21, 2026

[Decision] A production os serve that composes no organization object (no auth secret, or no auth) still writes ownerless rows under --no-server: refuse that boot too, or refuse such writes in the engine everywhere

objectstack-ai/objectstack#25133 · opened

on Oct 21, 2026

test(plugin-security,plugin-auth,plugin-approvals): narrow the blanket pre-18 tenant-column relax rigs to the residue tables they model

objectstack-ai/objectstack#25132 · opened

on Oct 21, 2026

hourly full run: red on main (CI)

objectstack-ai/objectstack#25131 · opened

on Oct 21, 2026

3

spec + skills: the titleFormat describe and the objectstack-data skill still steer a composite record title into a formula field (follow-up to #25071, ruling 6308445871)

objectstack-ai/objectstack#25129 · opened

on Oct 21, 2026

cli: after the better-auth 1.7.12 lift (#25096), five `SCAFFOLD_ALLOWED_PEER_VERSIONS` entries in `init.ts` suppress peer mismatches the family no longer has

objectstack-ai/objectstack#25123 · opened

on Oct 21, 2026

spec(api): after #25104 retires GET {base}/docs, rest-server.zod.ts still names the docs viewer (enableOpenApi's TSDoc and describe, and the documentation.enabled tombstone prescription)

objectstack-ai/objectstack#25121 · opened

on Oct 21, 2026

2

mcp: list_objects / describe_object cannot see any package-installed object (a marketplace app's whole schema) — the HTTP bridge reads the metadata service, not the SchemaRegistry REST serves

objectstack-ai/objectstack#25120 · opened

on Oct 21, 2026

3

cloud-connection: one rule for the capability (ruling 乙): the page, its record and its three doors require manage_platform_settings like its nav entry; a managed runtime also refuses bind/start and bind/poll

objectstack-ai/objectstack#25119 · opened

on Oct 21, 2026

2

plugin-auth: MCP clients cannot register over OAuth DCR — /oauth2/register defaults a missing application_type to web and refuses the http://localhost redirect every local MCP client sends

objectstack-ai/objectstack#25118 · opened

on Oct 21, 2026

4

pm-dispatch / os-dev: the claim template and the dev definition carry only the `Clause-②:` line, so a dispatched PR never writes the `Metadata-protocol:` line ruling A (#25105) adds

objectstack-ai/objectstack#25115 · opened

on Oct 21, 2026

1

cloud-connection: on a platform-managed runtime, bind/start and bind/poll still run, so a device bind persists a credential the service key shadows and can move the cloud-side connection row

objectstack-ai/objectstack#25113 · opened

on Oct 21, 2026

1

plugin-auth: the Magic Link mail says the link expires in 10 minutes, while the link it sends lives 300 seconds (measured)

objectstack-ai/objectstack#25112 · opened

on Oct 21, 2026

plugin-auth: SSO domain verification refuses the TXT record request-domain-verification tells the operator to publish (502 DOMAIN_VERIFICATION_FAILED; measured, same on better-auth 1.7.3 and 1.7.12)

objectstack-ai/objectstack#25111 · opened

on Oct 21, 2026

spec-shape-gate: all five entries in spec-shape-retirements.json name closed objectui cards and match nothing on main, so the registry's own rule says delete them

objectstack-ai/objectstack#25108 · opened

on Oct 21, 2026

plugin-security: delegation probes and diagnostics (canReadObject / canWriteObject / canExport, field mask, explain) answer for an on-behalf-of context the operation prologue now refuses (PR #25101)

objectstack-ai/objectstack#25107 · opened

on Oct 21, 2026

plugin-security: the raw-SQL read-scope provider (getReadFilter) does not apply the delegated organization-membership rule PR #25101 enforces at the operation prologue; measure reach first (detail withheld)

objectstack-ai/objectstack#25106 · opened

on Oct 21, 2026

3

[Decision] Previous-major support after 18.0 GA: correct the published N-1 promise to latest-only (A), an on-demand security line for N-1 (B), or a better-auth-style two-branch model (C)?

objectstack-ai/objectstack#25102 · opened

on Oct 21, 2026

Setup → Packages moves to Studio: drop Setup's nav_packages; Studio keeps the full list, Setup keeps the marketplace "Installed Apps" door (ruling 甲, amends #23892 B)

objectstack-ai/objectstack#25098 · opened

on Oct 21, 2026

plugin-security: the controlled_by_parent detail write gate may not hold one more value of a master reference to ADR-0055 §1 and §3 (reach not measured; detail withheld under the disclosure ruling)

objectstack-ai/objectstack#25095 · opened

on Oct 21, 2026

controlled_by_parent: under one authorable master-reference declaration, one write door outside the detail write gate is not held to ADR-0055 §1 (reach measured; detail withheld under the disclosure ruling)

objectstack-ai/objectstack#25092 · opened

on Oct 21, 2026

1

docs: validation-rules.mdx says a value sent for a stored-expression field is "not refused and not reported", and the data-engine strip table has no stored_expression row

objectstack-ai/objectstack#25089 · opened

on Oct 21, 2026

Navigation Menu

Repository navigation

Issues

mcp: on an environmentId kernel, list_actions / run_action cannot see a package object's actions when the package registered during boot — collectActionDeclarations and action resolution read metadata.listObjects()

mcp stdio: on an environmentId kernel, a package registered during boot is invisible to list_objects / describe_object, and the stdio exposure gate serves its apiEnabled:false object (the stdio twin of #25120)

docs(objectql): "Multi-Tenant Schemas" says the injected organization_id stays NULL with no organization context, and since PR #24940 a table the driver creates carries it NOT NULL and refuses that write

[Decision] ADR-0131 D1 on stores already certified (18.0.0-born or ceremonied): an advisory for the voluntary ceremony plus a documented residue, or a shape-generation bump

[Decision] A production os serve that composes no organization object (no auth secret, or no auth) still writes ownerless rows under --no-server: refuse that boot too, or refuse such writes in the engine everywhere

test(plugin-security,plugin-auth,plugin-approvals): narrow the blanket pre-18 tenant-column relax rigs to the residue tables they model

hourly full run: red on main (CI)

spec + skills: the titleFormat describe and the objectstack-data skill still steer a composite record title into a formula field (follow-up to #25071, ruling 6308445871)

cli: after the better-auth 1.7.12 lift (#25096), five `SCAFFOLD_ALLOWED_PEER_VERSIONS` entries in `init.ts` suppress peer mismatches the family no longer has

spec(api): after #25104 retires GET {base}/docs, rest-server.zod.ts still names the docs viewer (enableOpenApi's TSDoc and describe, and the documentation.enabled tombstone prescription)

mcp: list_objects / describe_object cannot see any package-installed object (a marketplace app's whole schema) — the HTTP bridge reads the metadata service, not the SchemaRegistry REST serves

cloud-connection: one rule for the capability (ruling 乙): the page, its record and its three doors require manage_platform_settings like its nav entry; a managed runtime also refuses bind/start and bind/poll

plugin-auth: MCP clients cannot register over OAuth DCR — /oauth2/register defaults a missing application_type to web and refuses the http://localhost redirect every local MCP client sends

pm-dispatch / os-dev: the claim template and the dev definition carry only the `Clause-②:` line, so a dispatched PR never writes the `Metadata-protocol:` line ruling A (#25105) adds

cloud-connection: on a platform-managed runtime, bind/start and bind/poll still run, so a device bind persists a credential the service key shadows and can move the cloud-side connection row

plugin-auth: the Magic Link mail says the link expires in 10 minutes, while the link it sends lives 300 seconds (measured)

plugin-auth: SSO domain verification refuses the TXT record request-domain-verification tells the operator to publish (502 DOMAIN_VERIFICATION_FAILED; measured, same on better-auth 1.7.3 and 1.7.12)

spec-shape-gate: all five entries in spec-shape-retirements.json name closed objectui cards and match nothing on main, so the registry's own rule says delete them

plugin-security: delegation probes and diagnostics (canReadObject / canWriteObject / canExport, field mask, explain) answer for an on-behalf-of context the operation prologue now refuses (PR #25101)

plugin-security: the raw-SQL read-scope provider (getReadFilter) does not apply the delegated organization-membership rule PR #25101 enforces at the operation prologue; measure reach first (detail withheld)

[Decision] Previous-major support after 18.0 GA: correct the published N-1 promise to latest-only (A), an on-demand security line for N-1 (B), or a better-auth-style two-branch model (C)?

Setup → Packages moves to Studio: drop Setup's nav_packages; Studio keeps the full list, Setup keeps the marketplace "Installed Apps" door (ruling 甲, amends #23892 B)

plugin-security: the controlled_by_parent detail write gate may not hold one more value of a master reference to ADR-0055 §1 and §3 (reach not measured; detail withheld under the disclosure ruling)

controlled_by_parent: under one authorable master-reference declaration, one write door outside the detail write gate is not held to ADR-0055 §1 (reach measured; detail withheld under the disclosure ruling)

docs: validation-rules.mdx says a value sent for a stored-expression field is "not refused and not reported", and the data-engine strip table has no stored_expression row