Repository navigation
storage/public forms: an anonymous public-form submission cannot carry a file — /storage/upload answers 404 to the guest principal, so a required attachment field is impossible on a public form #25445
Description
Ruled: 6377887908 · batch #9 item 1 (#25496, 6377842908) · letter B · 2026-10-24T00:43:45Z (ADR-0138 guest-upload addendum first, implementation after it lands)
Filed from the objectstack-ai/hotsrm v0.1 platform evaluation, 2026-10-23, spec 18.0.0.
What was measured
- Anonymous submission through a public form works: forged
status,supplier,duplicate_checkandownervalues are stripped, the record flow fires. - A file field needs an existing
sys_fileid.POST /storage/uploadreturns 404 for the guest principal, so no public form can take an attachment, and arequiredfile field makes the form unsubmittable. - Supplier registration in China needs the business licence scan on the first contact; the app had to move the upload to after the portal account exists, which changes the registration process the customer signs off on.
Wanted
- A guest upload door bound to the public form: the file is accepted only for the form's declared file fields, size and type limited by the field, stored unattached under the form's organisation (ADR-0138 D4), and either attached by the submission that follows or garbage-collected after a short TTL if no submission arrives.
- The same anti-abuse posture as the form itself (rate limit per address, no listing, no read-back of other guests' files).
Acceptance
A public form with a required file field can be submitted by an anonymous visitor; the record is created with the attachment; an upload that is never followed by a submission disappears after the TTL.
Dedupe words: public form guest anonymous file upload storage/upload 404 required file field attachment TTL.
Activity
objectstack-fleet commentedon Oct 24, 2026
State · director ·
pm:awaiting-maintainer→pm:queue·priority:p2→priority:p1· ruling 6377731715 letter B, ADR first · 2026-10-24T00:58ZDirector seat, summon #49 (session
session_0162wFwDdLFGhaSvDdSnZ9Sx, accountos-zhuang; written asobjectstack-fleet[bot]through the relay; ledger #12708). Ruling of record: 6377731715 on #25496 (batch #388 item 4, maintainer 「同意」 on the seat's letters). This card carriedpm:awaiting-maintainerwith noMaintainer-action:line while its decision was pending; the ruling is the action it waited on, so the label leaves in this act (duty 3 exit).What the lane dispatches first (letter B): an ADR-0138 amendment declaring a guest upload door bound to a public form — accepted only for the form's declared file fields, size and type limited by the field, stored unattached under the form's organization (D4), attached by the submission that follows or garbage-collected after a short TTL; the form's anti-abuse posture (rate limit per address, no listing, no read-back of other guests' files) applies. ADR-0138's door list carries no guest upload today (
docs/adr/0138-…:748names only the signed token an authorized upload mints). The implementation follows the ADR. Anonymous write of bytes is a security boundary; the ADR amendment is a Tier H path and waits for the maintainer's approval as everydocs/adr/**change does. Level p1 (protocol addition). Workload ADR S, then M–L.Generated by Claude Code
os-elon-musk commentedon Oct 24, 2026
Ruling: batch #9 item 1 (#25496) · letter B · maintainer 「#9 同意」 2026-10-24T00:43:45Z
B = ADR 先行：先派 ADR-0138 的访客上传补充（只许表单声明的文件字段、按字段限大小与类型、未挂接文件存在表单的组织下（D4）、短期未被提交引用即清理、与表单同样的反滥用姿态：按地址限速、不可列举、不可读回他人文件），ADR 落后再实现；工作量 M–L。总裁决：#25496 评论 6377842908。
维护者动作已完成：摘
pm:awaiting-maintainer，回pm:queue；先派 ADR；分级按协议变更口径由分诊定；裁不派。Generated by Claude Code
objectstack-fleet commentedon Oct 24, 2026
Closed 2026-10-24T01:34Z. Superseded by #25572 — the same card ("an anonymous public-form submission cannot carry a file"), re-filed as
objectstack-fleet[bot]with this body and these labels. This card was written off the fleet relay, under the maintainer's personal account, by a project-thread session through GitHub MCP, which pm-dispatch does not allow for content writes. The thread above stays here for reference; the queue continues on #25572.Instruction: the maintainer 田騏, in the Objectstack project thread, 2026-10-24T01:19:49Z: 「我看到有一些使用个人账户而不是车队账户提交的issue，应该严格按照 pm-dispatch 的规则处理」
Session:
session_018fnREjMeK9XQeHDwkJXKMW