Issues · objectstack-ai/objectstack

finding(pm): `check-widening-tells` T2 reads identifiers in a multi-line import list as "a new member of a closed set" — a by-reference narrowing that only adds imports is forced to declare `Clause-②: yes`

objectstack-ai/objectstack#21465 · opened

on Oct 2, 2026

spec(ui): the `ComponentPropsMap` rows still type renderer-read members as `z.unknown()` — `navigation` on object-map / object-gantt / object-tree and `conditionalFormatting` on object-kanban accept `42` — the family close-out after #21445

objectstack-ai/objectstack#21464 · opened

on Oct 2, 2026

[Decision] page `requires` on the page kinds whose source is never compiled at save (`react`, `full`, `slotted`): refuse it at parse, or keep admitting a key nothing derives?

objectstack-ai/objectstack#21459 · opened

on Oct 2, 2026

spec(contracts): `ApprovalActionRow` declares the slot an approval action was taken as (an optional member), so the action log can show it once `actor_id` holds the person (#21411 ruling B)

objectstack-ai/objectstack#21458 · opened

on Oct 2, 2026

1

finding(objectql): a `system-write-organization.test.ts` case loads the whole package barrel inside vitest's default 5 s window, and timed out twice under load

objectstack-ai/objectstack#21457 · opened

on Oct 2, 2026

1

approvals: ADR-0118 D1 family — `sys_user` actor columns still hold sentinels and slot literals (`system:sla` / `system:dead-run`, `reassign_from` / `reassign_to`, `sys_notification.actor_id`)

objectstack-ai/objectstack#21455 · opened

on Oct 2, 2026

1

[finding] [security] An action/automation body's object API and an action handler's engine handle read the stored-metadata family outside its body projection and keyed serve (reach NOT MEASURED)

objectstack-ai/objectstack#21454 · opened

on Oct 2, 2026

1

analytics: a list comparand at a scalar operator (`{ amount: { $gt: [10, 99] } }`) answers 200 bound to its first member on the engine-aggregate face (and on both faces for a text column), where the spec's verdict refuses the list form

objectstack-ai/objectstack#21448 · opened

on Oct 2, 2026

2

finding(spec): `ComponentPropsMap['object-grid']` keeps `resizableColumns` as a live alias of `resizable`, and types six members `ObjectGrid` reads with fixed shapes as `z.unknown()` (`rowHeight: 42` passes every door)

objectstack-ai/objectstack#21445 · opened

on Oct 2, 2026

4

metadata-protocol: a view that a runtime view container expands is listed by GET /meta/view?object= but answers nothing by name on an environment-scoped kernel or for an org-scoped container — the by-name read expands no container

objectstack-ai/objectstack#21442 · opened

on Oct 2, 2026

1

analytics: on SQLite the ObjectQL face's echoed `sql` and `/analytics/sql` print a date-bucketed dimension as `date_trunc(…)`, which SQLite refuses (`no such function: date_trunc`); the driver buckets with `strftime`

objectstack-ai/objectstack#21441 · opened

on Oct 2, 2026

1

finding(lint): `field-no-consumers` calls a field "inert" when an analytics member reads it through a relationship path (`account.revenue` in a cube measure's `sql` or a dataset measure's `field`) — the family's next position after #21091

objectstack-ai/objectstack#21439 · opened

on Oct 2, 2026

4

analytics query: a caller-named measure with an empty prefix (`_sum`, `_avg`, …) mints the row wildcard under a non-count aggregate and answers 500 DATABASE_ERROR — the runtime position of #21409's family

objectstack-ai/objectstack#21437 · opened

on Oct 2, 2026

3

[finding] `os migrate recorded-by --apply --json` prints a second JSON document `{"error":"EEXIT: 0"}` and exits 1 after a completed run (the command's catch re-reports oclif's exit signal)

objectstack-ai/objectstack#21434 · opened

on Oct 2, 2026

1

Flaky on Test Core: `packages/rest` `import-template-route.test.ts` › "the `*` agrees with the engine … for every shape of default the engine reads" times out at 5000ms on PRs that touch no `packages/rest` file

objectstack-ai/objectstack#21428 · opened

on Oct 2, 2026

1

[security] operatorFacingErrorText hands a raw statement fault's cause message, statement and inlined values included, to its operator-facing callers: the fourth position of the #21274 / #21345 / #21385 family

objectstack-ai/objectstack#21418 · opened

on Oct 2, 2026

3

#5930 step 4 (`domain:services`): the analytics faces delete their hand-copied filter meaning — the read scope (F9), the `where` tree and its compilers (F10), the draft preview (F11) — each naming its typed column reader

objectstack-ai/objectstack#21417 · opened

on Oct 2, 2026

1

finding(skills): objectstack-ai's Common Pitfalls says "`memory` is declared only — no runtime reads it"; once PR #21413 lands, the cloud AI runtime enforces it and the spec refuses its old shapes

objectstack-ai/objectstack#21415 · opened

on Oct 2, 2026

1

finding(metadata-protocol): the runtime save door accepts a view container whose body `name` contradicts its row name and registers it under both keys; the two source registrars refuse the same document

objectstack-ai/objectstack#21412 · opened

on Oct 2, 2026

2

approvals: `sys_approval_action.actor_id` (a `sys_user` lookup) records the slot literal (`position:<p>`, or an email) instead of the deciding user, so the person who decided is on no column (ADR-0118 D1)

objectstack-ai/objectstack#21411 · opened

on Oct 2, 2026

6

approvals: retire the `role:` arm of the position-address equivalence once the pinned console sends `position:` (ADR-0090 D3; split from #21379 item 5)

objectstack-ai/objectstack#21387 · opened

on Oct 2, 2026

release.yml: the push-lane "Backfill GitHub Releases" step runs while the same version's publish job is still creating its Releases, because the #20627 gate reads only npm

objectstack-ai/objectstack#21359 · opened

on Oct 2, 2026

2

automation: a cloned packaged flow reaches no Studio surface — the clone is stored with no package, and every Studio Automations rail lists only package-scoped flows

objectstack-ai/objectstack#21332 · opened

on Oct 2, 2026

1

security(forms): access-security.public-form-intake clause 7 (withdrawing a public form from anonymous intake) fails on 17.6.0 — detail withheld pending maintainer

objectstack-ai/objectstack#21331 · opened

on Oct 2, 2026

4

QA run · priority:P0 + 17.6-risk (42/42) · 617f25f8 · 2026-10-02 · 30 PASS / 3 PARTIAL / 9 FAIL / 0 BLOCKED / 0 NOT-RUN

objectstack-ai/objectstack#21330 · opened

on Oct 2, 2026

1