Admin copy tells the admin to call the REST API (SMS Send test: pass "to" in the request body; the flow clone notice: PUT /api/v1/automation/<name>) — keep endpoints out of admin copy (hotcrm#2194 R2-T2-U07) #25345

Activity

1. objectstack-fleet

   added

   area:workflowApprovals and automation — the work that runs without a person driving itApprovals and automation — the work that runs without a person driving it

   bugSomething isn't workingSomething isn't working

   domain:servicesRetired 2026-10-22, alias of domain:server (services surface); in-flight cards keep it until landedRetired 2026-10-22, alias of domain:server (services surface); in-flight cards keep it until landed

   pm:queueReady for the PM dispatch loopReady for the PM dispatch loop

   priority:p2Medium: important, M3Medium: important, M3

   pm:dispatchedDispatched to a dev agent by /pm-dispatchDispatched to a dev agent by /pm-dispatch

   and removed

   pm:queueReady for the PM dispatch loopReady for the PM dispatch loop

   on Oct 23, 2026
2. objectstack-fleet

   assigned

   os-sales

   on Oct 23, 2026
3. objectstack-fleet commented on Oct 23, 2026

   

   objectstack-fleetBot

   on Oct 23, 2026

   ContributorAuthor

   More actions

   Claim: PM loop round 1 · domain:services seat 1 (seat post #6021, project run by the Sales account) · S mechanical card, in-seat subagent · 2026-10-23T11:40Z
   Session: session_016g7nYP9wdNx1GDa5XDr7Uy
   Account: os-sales (the seat's linked user as GET /user answers it; the card's assignee)
   Branch: claude/issue-25345-admin-copy-endpoints
   Worktree: objectstack-issue-25345
   Domain: domain:services
   Seat: domain:services#1
   File surface: packages/services/service-sms/src/ (the Send test answers, ~:102/:115/:124) and packages/runtime/src/flow-clone.ts (the clone notice, ~:183–185), plus their tests and a changeset. packages/client/src/index.ts TSDoc stays (developer copy). Stop on breach; explain in the report.
   Container & model: S 级机械卡, mode:subagent (general-purpose subagent loading .claude/agents/os-dev.md as its role file; this thread has no os-dev agent type), model: default tier (dispatch-gates.mjs --tier: "no path-derived mandate"), effort: medium
   Clause-②: no
   Metadata-protocol: none
   Responsibility: n/a — not a defect card (adopted suggestion, filing gate ③ on hotcrm#2194's ruling)
   Thread-read: none
   Serial constraints cleared: no open claim or PR declares service-sms/src or runtime/src/flow-clone.ts; no same-day merge on either path (git log origin/main --since=2026-10-23 empty).
   Resume-from: none
4. objectstack-fleet commented on Oct 23, 2026

   

   objectstack-fleetBot

   on Oct 23, 2026

   ContributorAuthor

   More actions

   os-dev-report

   {
     "issue": 25345,
     "status": "done",
     "branch": "claude/issue-25345-admin-copy-endpoints",
     "pr": "https://github.com/objectstack-ai/objectstack/pull/25421",
     "session": "session_016g7nYP9wdNx1GDa5XDr7Uy",
     "premise_still_valid": true,
     "summary": "The four Send test SMS recipient refusals (service-sms resolveSmsTestRecipient) no longer say to pass \"to\" in the request body. They now name what the admin does on the page: press Send test SMS while signed in as an admin whose account has a phone number, or press it again once the account can be read. The `to` override is documented in the TSDoc only. FLOW_CLONE_NOTICE (runtime flow-clone.ts) drops the PUT and toggle endpoint recipe. It now names the Packaged automation page's Switch \"…\" off action for a packaged original (it covers packaged flows only and does not reach the clone), and Studio's Enabled switch plus a publish for the clone. The client automation.toggle TSDoc is unchanged. Mechanism assumption corrected: the dispatch named 'the SMS settings' test recipient field (#24767)', but no such field exists on origin/main 830a63a680. smsSettingsManifest declares none, and #24848 fixed #24767 by sending to the signed-in admin's own sys_user.phone_number. So the copy names the controls that do exist. Adding a field is a service-settings manifest change, outside this claim. The clone controls were read from objectui main 2c4e5f5afd (PackagedAutomationPage.tsx; the Switch \"{{label}}\" off button switches the packaged SOURCE, and the Studio flow switch writes status obsolete). Deviation: the brief's commit trailer `Co-Authored-By: Claude Opus 5.5 (1M context)` was refused by the pre-push check:commit-card-trailers hook (AGENTS.md: the pair is model-free). The unpublished commit was amended to the model-free `Co-authored-by: Claude` trailer with the noreply address plus the Claude-Session line, with no override used. The PR body ends with the brief's exact two footer lines.",
     "tests": "head f57343bda5. Build: pnpm --workspace-concurrency=2 --filter '@objectstack/service-sms^...' --filter '@objectstack/runtime^...' build, under the lock: VERDICT command-exit 0. pnpm --filter @objectstack/service-sms test: Test Files 7 passed (7), Tests 107 passed (107); pnpm --filter @objectstack/service-sms typecheck: exit 0. pnpm --filter @objectstack/runtime typecheck: exit 0 (check:test-typecheck OK). pnpm --filter @objectstack/runtime test: Test Files 438 passed (438), Tests 7023 passed | 19 skipped (7042), VERDICT command-exit 0. New pins: automation-flow-clone.test.ts (new-wording asserts, plus notice === FLOW_CLONE_NOTICE with no /api/, no 'request body', no PUT/POST) and sms-test-recipient.pin.test.ts (served route: no phone, failed read, no engine; in-process: no user; each asserts its opening sentence and remedy, 'nothing was sent', 'Send test SMS', and no /api/, 'request body' or 'pass \"to\"'). No ablation: only message text and its pins changed. test:repo was not run locally and is declared to CI.",
     "gates": "dispatch-gates.mjs --commands: 69 derived. Each was run with its exit captured before any pipe: 68 exit 0, including check:doc-authoring, check:issue-citations, check:nul-bytes, the changeset gates, check:route-ledger-census, and query-options-erasure, slot-lookup and type-check-debt re-run without the 150 s cap. check:dual-build-cjs-loads exited 3 (PREREQUISITE NOT MET, needs a full-repo dist) and is NOT MEASURED locally. --ran reconciliation: 69 accounted, 68 run, 1 NOT-MEASURED, exit 0. PR check-runs on f57343bda5 at report time: 'No other open PR may claim the same issue' success; Check Changeset, Governed Surface Queue Guard, Lint (ESLint, PM dispatch-gates, docs & code guards, repo & tooling, CI/release/engine, scoped x3), Type Check (workspace, source, consumer, debt ledger) and the claim checks all in_progress; the two opt-in jobs skipped. Test Core and Build Core had not been listed yet.",
     "dogfood_battery": "n/a — no `!` in the PR title and no (narrowing) arm",
     "mcp_calls": "0",
     "api_writes": "2 relay strokes. (1) fleet-write pr_create: POST /repos/objectstack-ai/objectstack/pulls as a draft, plus the assignee POST /issues/25421/assignees (os-sales), run 39956650773, success, the body read back byte-identical. (2) post-stamped.mjs: POST /repos/objectstack-ai/objectstack/issues/25345/comments, this report. git push is direct and was not counted.",
     "open_questions": [],
     "out_of_scope_findings": [
       "class: a (misleading admin copy, same family as this card) · reach: Setup → Email, Send test email; the plugin-email mail/test refusals at packages/plugins/plugin-email/src/email-plugin.ts around lines 196, 209 and 216 say 'pass \"to\" in the request body' / 'Add an email address to your account, or pass \"to\" in the request body', and the mail settings page has no recipient field either (same producer shape as #24848) · evidence: git grep 'in the request body' on origin/main 830a63a680 · dedupe words: send test email, request body, admin copy, mail/test recipient",
       "carrier: none · noted, not filed: the existing .changeset/24767-settings-test-send-recipient.md tells readers that on deployments without phone sign-in 'Send test SMS' still needs a `to` in the request body. That is developer-facing changeset text, release-owned once consumed, and it was left untouched."
     ]
   }
5. objectstack-fleet

   closed this as completedin #25421on Oct 23, 2026
6. objectstack-fleet commented on Oct 23, 2026

   

   objectstack-fleetBot

   on Oct 23, 2026

   ContributorAuthor

   More actions

   Landed · domain:services seat 1 (seat post #6021) · os-sales · session_016g7nYP9wdNx1GDa5XDr7Uy · 2026-10-23T14:09Z

   reading	value
   PR #25421	MERGED through the queue (ACCEPT 6365789931; one re-queue after a runner Checkout failure, stand-down note on the PR), head f57343bda5
   origin/main	carries 2b7c331537

   State: the card was closed by Fixes #25345. pm:dispatched is off and the assignee is cleared.

   ---

   Generated by Claude Code
7. objectstack-fleet

   removed

   pm:dispatchedDispatched to a dev agent by /pm-dispatchDispatched to a dev agent by /pm-dispatch

   on Oct 23, 2026
8. objectstack-fleet

   unassigned

   os-sales

   on Oct 23, 2026