Issues

Scenario scorer: score the seven capability tags the mid-tier cards declare but the closed tag table leaves unscored

objectstack-ai/objectstack#30984 · opened

on Nov 6, 2026

1

Scenario runner: the seed cannot load a reference cycle (department ↔ employee) in every mid-tier card, and a failed build author turn leaves no trace

objectstack-ai/objectstack#30982 · opened

on Nov 6, 2026

2

plugin-audit: a comment written while impersonating writes no audit or activity row, so it can't be told from the employee's own (#30213 comments fork, ruling A)

objectstack-ai/objectstack#30979 · opened

on Nov 6, 2026

1

Queue-flake anchor: src/apps/translations/app-nav-translation-parity.test.ts

objectstack-ai/objectstack#30978 · opened

on Nov 6, 2026

1

spec: the cbp-master-detail-required-defaulted conversion still says the parse refuses an explicit `required: false` master, which is no longer true after #30905

objectstack-ai/objectstack#30977 · opened

on Nov 6, 2026

1

os db orphans: a detail whose controlled-by-parent master is optional is never swept for dangling master references

objectstack-ai/objectstack#30976 · opened

on Nov 6, 2026

1

objectql engine.ts: retire the four facade-gate exception rows #30147 hands over

objectstack-ai/objectstack#30975 · opened

on Nov 6, 2026

1

Studio: a controlled-by-parent object's optional master can be neither authored nor shown, after #30905 made `required: false` on its master valid

objectstack-ai/objectstack#30974 · opened

on Nov 6, 2026

1

Scenario cards carry a tier (control | starter | delivery); control cards are internal checks and are never exported

objectstack-ai/objectstack#30970 · opened

on Nov 6, 2026

1

skills(objectstack-platform): teach `os deploy`, the managed-package dev loop (when to deploy, the command, reading a refusal or a failed build)

objectstack-ai/objectstack#30968 · opened

on Nov 6, 2026

1

plugin-auth SSO: expose the operator knobs Enterprise SSO needs — IdP-initiated sign-in, IdP group to role / permission set, and refusing unknown users instead of JIT

objectstack-ai/objectstack#30967 · opened

on Nov 6, 2026

1

plugin-auth SSO: a SAML account_not_linked refusal redirects to the success callbackURL and ignores errorCallbackURL (OIDC honours it)

objectstack-ai/objectstack#30966 · opened

on Nov 6, 2026

1

plugin-auth SSO: every OIDC and SAML refusal answers one opaque error (token_not_verified / Invalid SAML response), so an admin cannot tell expiry, audience, issuer or key apart

objectstack-ai/objectstack#30965 · opened

on Nov 6, 2026

2

CloudConnectionPlugin: forward installMode and the installing user to the control plane, run importUnmanagedPackage on an unmanaged grant, and audit the copy's result in the environment (cloud#3624)

objectstack-ai/objectstack#30964 · opened

on Nov 6, 2026

1

Console marketplace: the hosted (cloud) install path sends installMode and shows the managed/unmanaged picker; today only the install-local page offers it (cloud#3624)

objectstack-ai/objectstack#30963 · opened

on Nov 6, 2026

3

Package state store: let the host supply where module enable/disable state lives; today it is a file under OS_HOME, which a hosted container loses on replacement (cloud#3636 F2)

objectstack-ai/objectstack#30962 · opened

on Nov 6, 2026

2

plugin-auth: SCIM-driven writes leave sys_audit_log rows with actor, user_id and metadata null, so no audit row names the SCIM connection that acted

objectstack-ai/objectstack#30960 · opened

on Nov 6, 2026

4

plugin-auth: a SCIM group push grants nothing — no projection maps a group to a role or permission set, though last-admin-guard counts it a live write shape

objectstack-ai/objectstack#30959 · opened

on Nov 6, 2026

4

plugin-auth: no door mints a SCIM connection bearer (`mintScimConnectionCredential` has no caller and the object refuses create), so no IdP can connect

objectstack-ai/objectstack#30958 · opened

on Nov 6, 2026

4

service-automation test: the sealed-envelope pin fails when random ciphertext happens to contain the fixture connector name `crm`

objectstack-ai/objectstack#30957 · opened

on Nov 6, 2026

2

Data export writes no sys_audit_log row and the `export` action value is retired, so no export of any object (the audit ledger included) can be audited

objectstack-ai/objectstack#30955 · opened

on Nov 6, 2026

2

MCP: a banned person's AI assistant is still recorded as used, because the last-use stamp (#30918) runs before the ban refusal

objectstack-ai/objectstack#30949 · opened

on Nov 6, 2026

1

serve: let a plugin supply the ICryptoProvider for secret fields; today serve installs LocalCryptoProvider after every plugin hook, so a KMS-backed provider (cloud#3573) cannot be mounted

objectstack-ai/objectstack#30948 · opened

on Nov 6, 2026

4

plugin-audit: two comments still say a config_change row holds only a digest, after #30923 made non-secret rows carry readable before and after values

objectstack-ai/objectstack#30945 · opened

on Nov 6, 2026

5

skills+spec: the taught fieldPatches example patches crm_account.industry's options, but HotCRM's industry is picklist-bound, so a copy is refused at install

objectstack-ai/objectstack#30944 · opened

on Nov 6, 2026

2

Navigation Menu

Repository navigation

Issues

Scenario scorer: score the seven capability tags the mid-tier cards declare but the closed tag table leaves unscored

Scenario runner: the seed cannot load a reference cycle (department ↔ employee) in every mid-tier card, and a failed build author turn leaves no trace

plugin-audit: a comment written while impersonating writes no audit or activity row, so it can't be told from the employee's own (#30213 comments fork, ruling A)

Queue-flake anchor: src/apps/translations/app-nav-translation-parity.test.ts

spec: the cbp-master-detail-required-defaulted conversion still says the parse refuses an explicit `required: false` master, which is no longer true after #30905

os db orphans: a detail whose controlled-by-parent master is optional is never swept for dangling master references

objectql engine.ts: retire the four facade-gate exception rows #30147 hands over

Studio: a controlled-by-parent object's optional master can be neither authored nor shown, after #30905 made `required: false` on its master valid

Scenario cards carry a tier (control | starter | delivery); control cards are internal checks and are never exported

skills(objectstack-platform): teach `os deploy`, the managed-package dev loop (when to deploy, the command, reading a refusal or a failed build)

plugin-auth SSO: expose the operator knobs Enterprise SSO needs — IdP-initiated sign-in, IdP group to role / permission set, and refusing unknown users instead of JIT

plugin-auth SSO: a SAML account_not_linked refusal redirects to the success callbackURL and ignores errorCallbackURL (OIDC honours it)

plugin-auth SSO: every OIDC and SAML refusal answers one opaque error (token_not_verified / Invalid SAML response), so an admin cannot tell expiry, audience, issuer or key apart

CloudConnectionPlugin: forward installMode and the installing user to the control plane, run importUnmanagedPackage on an unmanaged grant, and audit the copy's result in the environment (cloud#3624)

Console marketplace: the hosted (cloud) install path sends installMode and shows the managed/unmanaged picker; today only the install-local page offers it (cloud#3624)

Package state store: let the host supply where module enable/disable state lives; today it is a file under OS_HOME, which a hosted container loses on replacement (cloud#3636 F2)

plugin-auth: SCIM-driven writes leave sys_audit_log rows with actor, user_id and metadata null, so no audit row names the SCIM connection that acted

plugin-auth: a SCIM group push grants nothing — no projection maps a group to a role or permission set, though last-admin-guard counts it a live write shape

plugin-auth: no door mints a SCIM connection bearer (`mintScimConnectionCredential` has no caller and the object refuses create), so no IdP can connect

service-automation test: the sealed-envelope pin fails when random ciphertext happens to contain the fixture connector name `crm`

Data export writes no sys_audit_log row and the `export` action value is retired, so no export of any object (the audit ledger included) can be audited

MCP: a banned person's AI assistant is still recorded as used, because the last-use stamp (#30918) runs before the ban refusal

serve: let a plugin supply the ICryptoProvider for secret fields; today serve installs LocalCryptoProvider after every plugin hook, so a KMS-backed provider (cloud#3573) cannot be mounted

plugin-audit: two comments still say a config_change row holds only a digest, after #30923 made non-secret rows carry readable before and after values

skills+spec: the taught fieldPatches example patches crm_account.industry's options, but HotCRM's industry is picklist-bound, so a copy is refused at install