Issues

[finding] No CI gate checks documentation anchors — `lychee.toml` sets `include_fragments = "none"`, so a link to a heading that does not exist passes as `[200] OK`

#7484

· os-help opened

on Aug 10, 2026

public-auth-features: passkeys/magicLink exempt.reason points at objectui#2514, which closes as "documented reserved" — decide stop-advertising vs keep-as-reserved

domain:identity

needs-user-decision

#7481

· yinlianghui opened

on Aug 10, 2026

`afterDelete` fires inside a rollback-able transaction, so a rolled-back cascade leaves a hook that fired for a row that still exists

domain:engine-core

needs-user-decision

#7477

· os-zhuang opened

on Aug 10, 2026

`[Security] Access denied` copy — the remaining 38 templates, classified: admin-surface should be RETAINED as developer copy, four end-user sites need their own decision

domain:identity

needs-user-decision

#7475

· os-zhuang opened

on Aug 10, 2026

`assertControlledByParentWrite` answers a metadata defect and a missing row with the same `403 PERMISSION_DENIED` "requires edit access to its master record"

domain:identity

needs-user-decision

#7474

· os-zhuang opened

on Aug 10, 2026

`publicPicker` is enforced by the REST lookup route but declared nowhere in `packages/spec` — no saved form can ever enable it

domain:spec

needs-user-decision

#7467

· os-zhuang opened

on Aug 10, 2026

QA run · api-backend (FULL area) · a86db175 · 2026-08-10 · 6 PASS / 2 PARTIAL / 3 FAIL

#7463

· baozhoutao opened

on Aug 10, 2026

[finding] `objectName` on an object-embedded action is inert AND unvalidated — the third arm PR for #7397 deliberately left open

domain:spec

finding

#7456

· os-zhuang opened

on Aug 10, 2026

The runtime dispatcher serialises a PermissionDeniedError's `details` to the client, so `positions` / `permissionSets` reach the browser on the `/data` transport

domain:cli

needs-user-decision

#7450

· os-zhuang opened

on Aug 10, 2026

[finding] Hook body ctx.log output is unobservable — body-runner wires log: engineCtx?.logger with no fallback, so the declared ['log'] capability can silently produce nothing

domain:cli

finding

#7448

· os-zhuang opened

on Aug 10, 2026

[P3] Generalise the lint rule `surfaces` axis to an open N-surface dimension (#4463 P1 introduced a closed two-value one)

domain:spec-tooling

pm:blocked

#7443

· os-zhuang opened

on Aug 10, 2026

`dispatch-gates.mjs` prints package-scoped gates as bare `check:*`, so two independent devs concluded an existing gate does not exist

domain:devx

pm:queue

#7440

· os-help opened

on Aug 10, 2026

Navigation Menu

Uh oh!

All issues

[finding] No CI gate checks documentation anchors — `lychee.toml` sets `include_fragments = "none"`, so a link to a heading that does not exist passes as `[200] OK`

public-auth-features: passkeys/magicLink exempt.reason points at objectui#2514, which closes as "documented reserved" — decide stop-advertising vs keep-as-reserved

`afterDelete` fires inside a rollback-able transaction, so a rolled-back cascade leaves a hook that fired for a row that still exists

`[Security] Access denied` copy — the remaining 38 templates, classified: admin-surface should be RETAINED as developer copy, four end-user sites need their own decision

`assertControlledByParentWrite` answers a metadata defect and a missing row with the same `403 PERMISSION_DENIED` "requires edit access to its master record"

`publicPicker` is enforced by the REST lookup route but declared nowhere in `packages/spec` — no saved form can ever enable it

QA run · api-backend (FULL area) · a86db175 · 2026-08-10 · 6 PASS / 2 PARTIAL / 3 FAIL

[finding] `objectName` on an object-embedded action is inert AND unvalidated — the third arm PR for #7397 deliberately left open

The runtime dispatcher serialises a PermissionDeniedError's `details` to the client, so `positions` / `permissionSets` reach the browser on the `/data` transport

[finding] Hook body ctx.log output is unobservable — body-runner wires log: engineCtx?.logger with no fallback, so the declared ['log'] capability can silently produce nothing

[P3] Generalise the lint rule `surfaces` axis to an open N-surface dimension (#4463 P1 introduced a closed two-value one)

`dispatch-gates.mjs` prints package-scoped gates as bare `check:*`, so two independent devs concluded an existing gate does not exist

Uh oh!

Search results