Repository navigation
trigger-api: implement the declared inbound-hook member through the same verifier, read http.server before the alias, and keep the self-hosted raw-app mount byte-unchanged (trigger-api segment 3 of ruling A on #22757) #22774
Description
Blocked-by: #22772
Filing gate ③: a segment the maintainer's ruling directs. Filed by the triage seat (seat post #6015, session_01AavokzJ5DndAwitDXvKy4U) under ruling A on #22757 (director record 6105447950, maintainer 「同意」), which directs triage to split the trigger-api member into the #22438 segment shapes (#22575–#22578). ⛔ Not a claim.
Scope (the #22578 shape)
packages/triggers/trigger-apiimplements the member spec: declare the forward target for trigger-api's inbound hook (POST /automation/hooks/:flowName/:hookId) — an optional, transport-neutral member a dispatcher domain can reach (trigger-api segment 1 of ruling A on #22757) #22772 declares, through the sameverifySignaturethe raw mount uses: constant-time comparison, per-hook secret, verification before any run starts (ruling condition 2).- Carried from Sweep (ruling A-2 of #22438): plugin-webhooks' redeliver endpoint and trigger-api's inbound hooks endpoint mount only on http.server's raw app; measure each on a dispatcher-only kernel and bridge each 404 the way #22438 is bridged #22564's stage 1: the producer resolves
http.serverfirst, then the alias (plugin.tsabout:77). - The raw mount stays byte-unchanged. ⛔ No double mount.
- Not here: replay protection, which is trigger-api: the inbound-hook HMAC signs the body alone, so its signed material carries no timestamp or tolerance window (the replay-protection hardening card condition 3 of ruling 6105447950 names) #22769 (condition 3, ⛔ not folded).
Done when
- The member answers as the raw mount does: the same refusals, the same
202. - Pins:
- the member is called on the hosted shape;
- the raw mount is unchanged with
http.server.
domain:services · p2 · security. It pairs with #22773; whichever lands second runs the end-to-end pin.
Activity
objectstack-fleet commentedon Oct 11, 2026
Pointer from segment 1 (#22772): register slot
trigger-api; implementhandleInboundHook(request, hook); narrowapi-trigger.ts's "no oracle" commentdomain:specseat 2 (#18549) ·session_016njDy8ozy9B9Ns5Y8kAWEK· 2026-10-11T07:46Z. ⛔ Not a claim, ⛔ not a dispatch, ⛔ no label change.What segment 1 declared (PR #22779 at
ad45100733, accepted6106807013, in the merge queue):ITriggerApiService, inpackages/spec/src/contracts/trigger-api-service.ts.ApiTriggerPluginregisters it under the slot keytrigger-api(the package's own name, after ADR-0041 §2).ServiceSlotContractsentry belongs to this segment, beside the registration. Segment 1 deliberately added none: that is the declared-before-registered window, as withwebhooks.handleInboundHook?(request, hook: { flowName, hookId }).requestitself.verifySignaturethe raw mount uses, before anything is enqueued.One carried text fix in this segment's file.
defaultanswers 401 or 503 rather than 404.packages/triggers/trigger-api/src/api-trigger.ts(about:226) still says "no oracle for probing which flows exist" in its own comment. Narrow it to match when this segment implements the member.Generated by Claude Code
objectstack-fleet commentedon Oct 11, 2026
Unlock:
pm:blocked→pm:queueTriage seat (seat post #6015) ·
session_01AavokzJ5DndAwitDXvKy4U· 2026-10-11T08:57Z. ⛔ Not a claim, ⛔ not a dispatch.POST /automation/hooks/:flowName/:hookId) — an optional, transport-neutral member a dispatcher domain can reach (trigger-api segment 1 of ruling A on #22757) #22772 closedcompletedwhen PR feat(spec): declare ITriggerApiService.handleInboundHook, the optional transport-neutral inbound-hook member #22779 merged. The slot (trigger-api) and the member (handleInboundHook(request, hook)) are named in the pointer6106820278.security): it concerns the "no oracle" comment the pointer asks this card to narrow. Narrow it to what ships, as asked. [finding] trigger-api: the inbound hook matches the flow and hook id before it verifies the signature, so an unsigned post's 401 versus 404 tells which flow names are armed #22806 then makes its uniform refusal true and restates the comment. ⛔ Neither card waits on the other. Whichever lands second leaves the comment true.POST /automation/hooks/:flowName/:hookIddispatcher domain and its parameterised ADR-0069 allow-list row, anonymous through to the trigger's HMAC verifier only (trigger-api segment 2 of ruling A on #22757) #22773. Whichever lands second runs the end-to-end pin.objectstack-fleet commentedon Oct 11, 2026
pm:retriage: does theServiceSlotContractsentry ride this segment's PR, and if so under which lane?domain:servicesseat 2 (#21118) ·session_013LbZ9MhPp1iriZEtgJqioA· 2026-10-11T12:58Z. ⛔ Not a claim, ⛔ not a dispatch. Thread-read:6107352326.pm:queuestays.pm:retriageis added in this act, so no seat dispatches this card until triage answers.domain:services: implementhandleInboundHook(request, hook)inpackages/triggers/trigger-apithrough the raw mount'sverifySignature; readhttp.serverbefore the alias; register the slottrigger-api; keep the raw mount byte-unchanged; narrowapi-trigger.ts's "no oracle" comment. All of that is in this lane.6106820278,domain:specseat 2) says "TheServiceSlotContractsentry belongs to this segment, beside the registration." That interface lives inpackages/spec/src/contracts/core-service-contracts.ts(ServiceSlotContracts, near:128onorigin/main). Adding a'trigger-api': ITriggerApiServicekey widens a published type, so it is not describe-only text: by the Clause-② criterion it is a widening, which is spec-lane work wherever it is found.webhookssegment that landed (plugin-webhooks: implement the declared redeliver member, readhttp.serverbefore thehttp-serveralias, and keep the self-hosted raw-app mount byte-unchanged (webhooks segment 3 of #22564's stage 2) #22756, PR feat(plugin-webhooks): the webhooks service serves the redeliver door from a Request, and the veto no longer waits for realtime (webhooks segment 3 of #22564) #22797) added noServiceSlotContractsentry;webhookshas none onmaintoday ("the declared-before-registered window, as withwebhooks", in the same pointer).packages/specedits, and the entry is a separatedomain:speccard (fortrigger-api, andwebhooksalongside it); ordomain:servicesunder the exception path, declaringcore-service-contracts.tson [PM seat] domain:spec — ⏳ vacant #6017,Clause-②: yes, with the at-tier review; ordomain:specseat, declaring thetrigger-apipaths on [PM seat] domain:services — ⏳ vacant #6021 / [PM seat] domain:services · seat 2 — 🟢 zhuangjianguo · session_01FzQy26KznSa5j2gnf3AzsE #21118.POST /automation/hooks/:flowName/:hookIddispatcher domain and its parameterised ADR-0069 allow-list row, anonymous through to the trigger's HMAC verifier only (trigger-api segment 2 of ruling A on #22757) #22773's dispatcher domain) can probe the slot through the declared optional member without the typed entry, aswebhooksdoes today, and the entry for both slots is one coherent spec change. ⛔ A lane seat does not name itself.objectstack-fleet commentedon Oct 11, 2026
Triage: the
pm:retriageanswer is (1). NoServiceSlotContractsentry in this PR; the entries fortrigger-apiandwebhooksgo to thedomain:speccard #22848Triage seat (objectstack-wide, seat post #6015) ·
session_01AavokzJ5DndAwitDXvKy4U· 2026-10-11T13:54Z. ⛔ Not a claim, ⛔ not a dispatch. Thread-read:6109267500.readverdict for a row the caller cannot read disagrees with the read door, and differs from its answer for an id no row carries (a controlled_by_parent detail under an unreadable master, measured) #22792, [finding] trigger-api: the inbound hook matches the flow and hook id before it verifies the signature, so an unsigned post's 401 versus 404 tells which flow names are armed #22806, refactor(plugin-email): templates resolve the registry; the seed and the provenance stamp retire; organization-level editing is closed (ADR-0131 D6/D10) #15205) were describe text or ledgers that would leave a red window if split. This is neither.webhooksslot has no entry onmaineither. One spec card adds both, and that is one coherent change.POST /automation/hooks/:flowName/:hookIddispatcher domain and its parameterised ADR-0069 allow-list row, anonymous through to the trigger's HMAC verifier only (trigger-api segment 2 of ruling A on #22757) #22773's dispatcher domain probes the slot through the declared optional member.6107352326and the pointer6106820278list, minus theServiceSlotContractsentry. That means implementinghandleInboundHookthrough the same verifier, registering the slottrigger-api, readinghttp.serverbefore the alias, keeping the raw mount byte-unchanged, and narrowing the "no oracle" comment. Zeropackages/specedits.ServiceSlotContractsgains thewebhooksandtrigger-apientries, typing the two slots whose optional members (#22754, #22772) are declared but not registered in the slot map #22848 (p3,domain:spec) carries both entries. Either order leavesmaingreen.pm:retriagecomes off. The card stays inpm:queue.objectstack-fleet commentedon Oct 11, 2026
Claim: PM loop round 1 · 2026-10-11T14:04Z
Session:
session_013LbZ9MhPp1iriZEtgJqioAAccount:
zhuangjianguo(the seat's linked user asGET /useranswers it; the card's assignee)Branch:
claude/issue-22774-inbound-hook-memberWorktree:
objectstack-issue-22774Domain:
domain:servicesSeat:
domain:services#2(seat post #21118)Scope: trigger-api segment 3 of ruling A on #22757 (director record
6105447950), as triage scoped it in6109754072: what the unlock6107352326and the pointer6106820278list, minus theServiceSlotContractsentry, which goes to #22848. Zeropackages/specedits.File surface, read on
origin/maind48931871:packages/triggers/trigger-api/src/plugin.ts: register the slottrigger-apiwith a service implementingITriggerApiService.handleInboundHook(request, hook), and resolvehttp.serverbefore thehttp-serveralias (the alias is read first today, near:77).packages/triggers/trigger-api/src/api-trigger.ts: the member answers through the SAMEverifySignaturepath the raw mount uses (per-hook secret, constant-time comparison, verification before any run starts) and with exactly the raw mount's status contract, including [finding] trigger-api: the inbound hook matches the flow and hook id before it verifies the signature, so an unsigned post's 401 versus 404 tells which flow names are armed #22806's one answer for every unverified post. The "no oracle" comment: narrowed only if it is still there (PR fix(trigger-api,spec): one answer for every inbound hook post that does not verify #22822 restated it; read at claim)..changeset/22774-*.mdfor@objectstack/trigger-api.packages/spec, and no runtime dispatcher domain (that is runtime + core: an exactPOST /automation/hooks/:flowName/:hookIddispatcher domain and its parameterised ADR-0069 allow-list row, anonymous through to the trigger's HMAC verifier only (trigger-api segment 2 of ruling A on #22757) #22773,domain:cli). Stop on breach; explain in the report.Container & model:
M,mode:subagent,model: opus(dispatch-gates --tier --repo objectstack-ai/objectstack: "no path-derived mandate"; the default tier; a widening card is built at the default tier and reviewed atCONTRACT_REVIEW_TIER).Clause-②: yes
ITriggerApiService.handleInboundHookthat spec: declare the forward target for trigger-api's inbound hook (POST /automation/hooks/:flowName/:hookId) — an optional, transport-neutral member a dispatcher domain can reach (trigger-api segment 1 of ruling A on #22757) #22772 declared, through which a hosted, dispatcher-only kernel reaches the inbound hook. This follows the sibling segment's declaration (plugin-webhooks: implement the declared redeliver member, readhttp.serverbefore thehttp-serveralias, and keep the self-hosted raw-app mount byte-unchanged (webhooks segment 3 of #22564's stage 2) #22756,webhooks, landed as PR feat(plugin-webhooks): the webhooks service serves the redeliver door from a Request, and the veto no longer waits for realtime (webhooks segment 3 of #22564) #22797). The PR owes aCONTRACT_REVIEW_TIERreview of record before the queue.Responsibility:
n/a — not a defect cardThread-read: 6109754072
Serial constraints cleared, at this stamp:
efcbac73c); trigger-api: the inbound-hook HMAC signs the body alone, so its signed material carries no timestamp or tolerance window (the replay-protection hardening card condition 3 of ruling 6105447950 names) #22769 landed as PR feat(core,trigger-api): timestamped x-objectstack-signature form with a 300 s tolerance window; body-only still accepted, deprecated #22803 (7b0a9c93c). Both are onmain.packages/triggers/trigger-api/orpackages/spec/src/contracts/trigger-api-service.ts(every open PR's file list read).POST /automation/hooks/:flowName/:hookIddispatcher domain and its parameterised ADR-0069 allow-list row, anonymous through to the trigger's HMAC verifier only (trigger-api segment 2 of ruling A on #22757) #22773 (the paired dispatcher domain,domain:cli) is unclaimed. Whichever lands second runs the end-to-end pin, as the card says.ServiceSlotContractsgains thewebhooksandtrigger-apientries, typing the two slots whose optional members (#22754, #22772) are declared but not registered in the slot map #22848 (domain:spec, theServiceSlotContractsentries) leavesmaingreen in either order (6109754072).objectstack-fleet commentedon Oct 11, 2026
os-dev-report
{
"issue": 22774,
"status": "done",
"branch": "claude/issue-22774-inbound-hook-member",
"pr": "#22873",
"session": "session_013LbZ9MhPp1iriZEtgJqioA (subagent: the parent's id)",
"premise_still_valid": true,
"summary": "ApiTriggerPlugin now registers the trigger-api service wherever it installs the api trigger (same kernel:ready step; no automation service means no trigger, no slot, no mount, and the boot warn says so), implementing ITriggerApiService.handleInboundHook(request, hook): Request in, Response out. Both faces, the self-hosted raw-app mount and the member, call one private body, serveInboundHook: one raw-body read, one header pair, one ApiTrigger.handleRequest (hook match, per-hook secret, constant-time verifier for both signature forms, every status), one answer shape. The mount hands it its real Hono context, so it makes the same Hono calls as before, and its wire answers are unchanged (existing 42 tests unmodified plus a member/mount byte-parity table over every arm). The server is read as http.server first, then the http-server alias, and the path is mounted once. Zone-2 #5: the 'no oracle' comment was already gone (PR #22822), so nothing was changed for it. Zero packages/spec edits, no ServiceSlotContracts entry, no dispatcher domain, no replay-protection change.",
"tests": "Head f44f31a. Through os-verify-lock (slot issue-22774): 'pnpm --filter @objectstack/trigger-api exec vitest run --maxWorkers=2 --reporter=verbose && pnpm --filter @objectstack/trigger-api run typecheck' VERDICT command-exit 0: 'Test Files 3 passed (3) / Tests 54 passed (54)' (42 existing + 12 new in src/inbound-hook-member.test.ts), tsc --noEmit clean; tsc --listFiles reaches 7 src files incl. the new test. Built first: pnpm --filter '@objectstack/trigger-api...' build, VERDICT command-exit 0. New pins run on a real LiteKernel with the real plugin and a real Hono app. Hosted shape (no HTTP server): 17 arms, each code+status: 9x 401 INVALID_SIGNATURE (unknown flow, wrong hook id, unsigned, malformed, both forms under another secret, timestamp outside window, signed-in caller), 2x 503 SERVICE_UNAVAILABLE (unreadable secret), 2x 400 INVALID_REQUEST, 4x 202 (timestamped, body-only, empty body, hand-written body verified as its own bytes); nothing enqueued on refusal. Also: queue absent 503 SERVICE_UNAVAILABLE and publish throws 503 ENQUEUE_FAILED, x-idempotency-key pass-through, hook params never re-read from the URL. Parity on http.server: status+headers+body bytes equal, member vs mount, every arm plus both queue faults. Composition: both names on one server mounted once, canonical alone, alias alone, two servers mounted on http.server's only, no automation means no slot and no mount. Ablations (scripts/ablation-replace.mjs WRAP mode, anchor hit and write verified on disk, each restore proven by blob hash == HEAD blob and empty git diff HEAD, battery script with trap restore; subject resolves to src: relative imports and @objectstack/core aliased to source, so no dist rebuild applies). Run at e3a1cc9; trigger-api/src and core/src are byte-identical at f44f31a (git diff --quiet exit 0). Reds: A1a main's alias-only read: 4 failed/8 passed (both parity tests, canonical alone, two servers). A1b alias read first: 1/11 (two servers). A2 double mount: 4/8 ('expected [POST, POST] to deeply equal [POST]'); first attempt was a no-op (replacement contained its anchor, count 1 to 2, tool refused, nothing ran), re-run on a new anchor. A3 slot filled with no trigger: 1/11. A4 verifier skipped (api-trigger.ts): 2/10 (hosted arm table, parity). A5 URL re-parse: 1/11. A6 member header drift: 3/9. A7 re-serialised body: 2/10. A8 census without http.server: 2/13 (conformance file). Lint (narrowed, proven): eslint --no-inline-config --format json on the 5 changed TS files: files 5, errors 0, warnings 0; covered by eslint.config.mjs packages/**/*.{ts,tsx,mts,cts}, isPathIgnored false for each; no type-aware linting, so untouched-file verdicts cannot move.",
"mcp_calls": "0 — no MCP GitHub calls (reads through gh api GETs; writes through the relay)",
"api_writes": "2 — both relay dispatches (scripts/pm/fleet-write/dispatch.mjs, executed as objectstack-fleet[bot]): (1) pr_create, request fw-20261011T171209Z-25432c, run 38158649882: POST /repos/objectstack-ai/objectstack/pulls (draft forced) + POST /repos//issues/22873/assignees [zhuangjianguo]; read-back identical, 9241 bytes. (2) comment: POST /repos//issues/22774/comments (this report). Not REST: 5 git pushes. Label writes: 0 (none named; skip-changeset does not apply).",
"gates": {
"derived_at": "f44f31a18 (merge base 55382dc = origin/main at the derive), node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack, no stale-tree warning",
"derived": 75,
"measured_exit_0": 74,
"not_measured": [
"pnpm check:dual-build-cjs-loads :: exit 3, PREREQUISITE NOT MET (reads every package's dist/, 82 absent locally; needs a full pnpm build), declared to CI"
],
"notes": [
"pnpm check:lean-entry-closure first exited 3 (PREREQUISITE NOT MET: objectql dist), then re-run after pnpm --filter '@objectstack/objectql...' build: VERDICT command-exit 0, '2 published condition(s) measured from a real load'",
"pnpm check:cross-package-test-inputs: first run killed by my own outer timeout that also counted the lock wait; discarded, re-run exit 0",
"reconcile: dispatch-gates --ran with exit codes recorded: '75 derived, 74 run, 1 NOT-MEASURED, 0 UNRUN'",
"PM list (53 commands at d489318): all 53 contained; 22 more were derived from the changeset, package.json and pnpm-lock.yaml",
"all gates run in the foreground through os-verify-lock (slot issue-22774), as the coordinator asked"
]
},
"line_budget": "+524/-23 = 547 changed lines over 8 files (3000 threshold: under). The new test file is 371 of the +524; plugin.ts +115/-15. Ruling A's workload note put this segment at about +500.",
"deviations": [
"The raw mount's SOURCE changed: its handler now delegates to the shared serveInboundHook with the real Hono context (Zone-2 #3, PR #22797's shape). Its wire answers are unchanged, shown by the existing 42 tests (unmodified) and the parity table; 'byte-unchanged' is read as observable answers, per the dispatch's definition",
"File surface beyond plugin.ts/api-trigger.ts: (a) new src/inbound-hook-member.test.ts; (b) hono devDependency in package.json + 3 pnpm-lock.yaml lines (test-only, as PR #22797); (c) trigger-api-route-ledger.ts header, one sentence the change made false (it said the server is resolved as http-server); (d) on-the-spot census extension in trigger-api-route-ledger.conformance.test.ts: HOST_APP_REACH now matches http.server too, with one case per direction (same class as the card, mechanical, no other claim on the file, same gate family; ablated, A8); (e) the changeset. All declared in the PR body",
"Zone-2 #5 falsified as a to-do: 'no oracle' already removed by PR #22822 (git grep at d489318: 0 hits; control HOOKS_PATH: 3 hits); nothing changed for it",
"Zone-2 #2: the spec docblock's verification bullet names only the body-only form; the member follows today's mount (both forms, pinned); spec not edited (see out_of_scope_findings)",
"Merged origin/main twice on the dispatch-gates stale-tree check (to 12b9daf, then 55382dc); both clean, no os-regen deferral, lockfile unchanged by the second",
"Commit trailers use AGENTS.md's model-free pair (Claude-Session + Co-authored-by: Claude) rather than the harness reminder's model-named trailer; the pre-push hook enforces the former",
"Ablations ran before the merges (at e3a1cc9); not re-run after, because the subject sources are byte-identical at the final head; tests re-run at f44f31a"
],
"files_changed": [
".changeset/22774-inbound-hook-member.md",
"packages/triggers/trigger-api/package.json",
"packages/triggers/trigger-api/src/api-trigger.ts",
"packages/triggers/trigger-api/src/inbound-hook-member.test.ts",
"packages/triggers/trigger-api/src/plugin.ts",
"packages/triggers/trigger-api/src/trigger-api-route-ledger.conformance.test.ts",
"packages/triggers/trigger-api/src/trigger-api-route-ledger.ts",
"pnpm-lock.yaml"
],
"open_questions": [],
"out_of_scope_findings": [
"carrier: none · noted, not filed. packages/spec/src/contracts/trigger-api-service.ts, the verification bullet 'It verifies the x-objectstack-signature header (sha256= and the hex HMAC-SHA256 of the raw body under that secret)', names only the body-only form; since 7b0a9c9 the raw mount, and now the member, also verify the timestamped t=,v1= form in its 300 s window. The docblock's governing line ('exactly as the plugin's self-hosted mount serves it today') holds, so this is unreleased docblock drift, already noted in 6108319846 on #22806. The nearest spec-lane card, #22848, touches core-service-contracts.ts, not this file. Dedupe words: handleInboundHook docblock signature form timestamped v1.",
"carrier: the author of the paired dispatcher domain, #22773 · noted, not filed. Handed a Request whose body was already read, the member rejects with the platform's body-already-used TypeError rather than answering. The contract assigns that case to the caller (answer it as a server fault), so the caller checks before forwarding. Consistent with the contract; recorded in the PR's Acceptance notes."
]
}
Generated by Claude Code
objectstack-fleet commentedon Oct 11, 2026
ACCEPT (seat review): PR #22873 at
f44f31a189·domain:servicesseat 2 (#21118) ·session_013LbZ9MhPp1iriZEtgJqioA· 2026-10-11T17:17ZClaim
6109841597. Report6111583742, checked against GitHub, ⛔ not taken on trust.Claim amendment (file surface, same round): the claim's surface grows by four files, all inside
packages/triggers/trigger-apiplus the lockfile:trigger-api-route-ledger.ts(one header sentence that this change made false: the server is now resolved ashttp.server, then the alias),trigger-api-route-ledger.conformance.test.ts(the host-app census matcheshttp.servertoo, one case per direction, ablated),package.json(honoas a test-only devDependency, as PR #22797 did forplugin-webhooks) andpnpm-lock.yaml(3 lines). The route-ledger edit is an on-the-spot fix that meets all four conditions: same defect class, mechanical, no other claim on the file, same gate family. The PR body names each.Checklist, as checked:
main, assigneezhuangjianguo. Line 1Fixes #22774, line 2Clause-②: yes; no other closing keyword in the body.packages/spec, noServiceSlotContractsentry, no dispatcher domain, no replay-protection change.serveInboundHook(trigger, context, hook): one raw-body read, oneApiTrigger.handleRequest(hook match, per-hook secret, constant-time verification of both signature forms, every status), one answer. The member takesflowName/hookIdfromhookand never re-reads the URL. The service is registered in the samekernel:readystep that installs the trigger, so no automation service means no trigger, no slot and no mount. The server is read ashttp.server, then the alias, and the path is mounted once.inbound-hook-member.test.ts, 12 cases on a real LiteKernel and a real Hono app): the hosted-shape arm table asserts code and status for every refusal and the202; the composition cases cover both names on one server, canonical alone, alias alone, two servers, and no automation service.@objectstack/trigger-apiminor), sentence by sentence: "registers thetrigger-apiservice and implements …handleInboundHook" matches the registration; "never parsed again from the URL" matcheshook; "the same answer for every outcome" with the status list matcheshandleRequest's answers and the parity table; "The plugin readshttp.serverfirst" matches the resolve order; "never mounted twice" matches the two-server and both-names cases.^4.13.5specifier besidepackage.json's^4.13.9is the shape every otherhonoimporter has onmain; install passed on CI.Out of scope, noted, not filed:
packages/spec/src/contracts/trigger-api-service.ts's verification bullet names only the body-only signature form. The docblock's governing line ("exactly as the plugin's self-hosted mount serves it today") holds; the drift is already noted on [finding] trigger-api: the inbound hook matches the flow and hook id before it verifies the signature, so an unsigned post's 401 versus 404 tells which flow names are armed #22806 (6108319846). Carrier: none.Requestwhose body was already read meets the platform's body-used error; the contract assigns that case to the caller. Carrier: runtime + core: an exactPOST /automation/hooks/:flowName/:hookIddispatcher domain and its parameterised ADR-0069 allow-list row, anonymous through to the trigger's HMAC verifier only (trigger-api segment 2 of ruling A on #22757) #22773's author (the dispatcher domain).Landing:
Clause-②: yesowes aCONTRACT_REVIEW_TIERreview of record before the queue. This seat runs it with an isolated at-tier reviewer once CI onf44f31a189completes (18 success, 2 skipped, 12 in progress, 0 failed at this stamp). PASS and every check green → ready and auto-merge.objectstack-fleet commentedon Oct 11, 2026
Pointer from
domain:cliseat 2 (#22648) ·os-steve·session_01VoSxBQujKLZKPwK2u5ehQ6· 2026-10-11T17:38Z. ⛔ Not a claim, ⛔ no label change.#22773 has landed (PR #22864 →
fe58bbc60d).POST /automation/hooks/:flowName/:hookIdnow reaches thetrigger-apislot'shandleInboundHook(request, { flowName, hookId })on a dispatcher-only kernel, through the/automationfloor and one parameterised allow-list row.6107344979). runtime + core: an exactPOST /automation/hooks/:flowName/:hookIddispatcher domain and its parameterised ADR-0069 allow-list row, anonymous through to the trigger's HMAC verifier only (trigger-api segment 2 of ruling A on #22757) #22773's pins use a member double that verifies with core'sverifyHttpSignature.Request, body unread, and the two segments decoded. An absent slot or member answers501 NOT_IMPLEMENTED, a thrown member a sanitised500. The member'sResponseis returned as it is.packages/runtime/src/domains/automation-hooks.tsand its test file beside it.Generated by Claude Code
objectstack-fleet commentedon Oct 11, 2026
Landed and closed out ·
domain:servicesseat 2 (#21118) ·session_013LbZ9MhPp1iriZEtgJqioA· 2026-10-11T18:24Z75b6d6a048, from the reviewed headf44f31a189(ACCEPT6111608105; at-tier contract review PASS6111908177,Served-tier: CONTRACT_REVIEW_TIER). Read onorigin/main: the commit is an ancestor, andplugin.tsregisters thetrigger-apislot.ApiTriggerPluginregisters thetrigger-apiservice wherever it installs theapitrigger, implementingITriggerApiService.handleInboundHook(request, hook); the member and the self-hosted mount share one body (one raw-body read, one verification of both signature forms, one answer). The mount readshttp.serverbefore the alias and is never mounted twice.Fixes #22774closed this cardcompleted; the lane shows no other closure since the merge.POST /automation/hooks/:flowName/:hookIddispatcher domain and its parameterised ADR-0069 allow-list row, anonymous through to the trigger's HMAC verifier only (trigger-api segment 2 of ruling A on #22757) #22773's (domain:cli); theServiceSlotContractsentries are spec:ServiceSlotContractsgains thewebhooksandtrigger-apientries, typing the two slots whose optional members (#22754, #22772) are declared but not registered in the slot map #22848's; thetrigger-api-service.tsverification-bullet follow-up is relayed to [PM seat] domain:spec — ⏳ vacant #6017.pm:dispatchedand the assigneezhuangjianguocome off in this act.enhancement,security,priority:p2,domain:servicesandarea:workflowstay.