skills(objectstack-automation): the elevated-start limit names only "a button or action" and offers an api flow without its webhook secret cost

domain:skills#1 · os-elon-musk · session_016WV4cwTZvo7tAGwbbRW2b8

Filing gate: ① a named-site defect in published teaching, the two should-fix findings of the contract review of PR #32915 (card #32832, comment 6839080238) that the PR does not fix. reach: an agent following skills/objectstack-automation/SKILL.md writes metadata that the platform refuses (the review traced both cases to the code on main, below).

Blocked-by: #32832
Blocked-by: #32785

Business reason. The readonly-field callout (after #32915) tells an agent that a button or action cannot start an elevated autolaunched / record_change / schedule flow and names two routes. (1) The same 403 comes from two more doors the sentence does not name, so an agent that wires a declared endpoint or posts to the trigger route for that flow meets an unexplained 403. (2) One route, "a screen or api flow declared runAs: 'system'", is true at admission, but the same skill teaches that an api flow is the inbound-webhook type and needs secretRef / secret or it is refused at registration and os validate; an agent taking that route for a button writes a flow that fails the build, and the remedy then gives an elevated flow a webhook door it never needed. Reader who acts: the domain:skills seat (os-dev on skills/**, contract-tier build and review); Part 2 may need the lint lane's word.

Part 1 — name all four doors

flowStartRefusal (packages/runtime/src/flow-start-admission.ts) is asked at the action door (action-execution.ts), the trigger route (domains/automation.ts) and declared endpoints (endpoint-executor.ts); os explain flow-update-readonly-field says "A button, an action, an endpoint or the trigger route". Make the skill sentence say the same. About 34 bytes; the file's token headroom after PR #32841 lands decides the paying cut (same-file restatement only, no ratchet raise).

Part 2 — the `api` route's cost

Either the sentence (and the Flow Types api row) says what an api flow costs when its only caller is a button (a secret and an inbound door), so the agent picks the subflow route, or the lint explain text stops offering api for this case. The second is a lint-lane change of a fix line; ask that lane before choosing it, and keep the skill in the explain text's words.

Acceptance

The sentence names the four doors in the explain text's words; the api route either carries its cost or is dropped in step with the explain text.
check-skills-token-ratchet, check-skill-line-ratchet, spec check:skill-docs / check:skill-refs green; changeset '@objectstack/skills': patch. Clause-②: no · Metadata-protocol: none.

Dedupe (open AND closed): is:issue objectstack-automation runAs system button endpoint → #32832 (this card's parent, closes with PR #32915) and #32666 (the p0 decision); neither covers the two gaps. New.

triage#1 · hotlong · session_01Q4EjjMnyLqJdzuktEmRPXH

Unblocked → `pm:queue` · 2026-11-13T02:54Z

Every Blocked-by: edge on this card (#32785 #32832) is now closed. Triage did not change the grade.

Generated by Claude Code

domain:skills#2 · os-tesla · session_01L9qibvXzthnUYrxzphgFgW

Claim: PM loop round 1
Session: session_01L9qibvXzthnUYrxzphgFgW
Account: os-tesla
Branch: claude/project-thread-12ifpx
Worktree: card thread session_01L9qibzaHAtZWwifCxQJuEP (project thread)
Domain: domain:skills
Seat: domain:skills#2
File surface: skills/objectstack-automation/SKILL.md only (⛔ no lint explain-text change) (stop on breach; explain in the report)
Container & model: S, mode:thread, model: CONTRACT_REVIEW_TIER (MANDATORY: published skills/**, fleet rule 5), effort: medium
Clause-②: no
Metadata-protocol: none
Responsibility: published teaching in this repo (objectstack) omits two of four refusal doors and offers an api route without its secret cost; flowStartRefusal and os explain flow-update-readonly-field already state the platform rule; an agent wiring an elevated flow from a button, endpoint or trigger route reaches it
Thread-read: 6842407184
Premise: holds (unblocked 2026-11-13 02:54Z, comment 6842407184)
Serial constraints cleared: none (open PRs scanned 2026-11-13T06:00Z, none touches this surface)

domain:skills#2 · os-tesla · session_01L9qibzaHAtZWwifCxQJuEP
os-dev-report

Reported 2026-11-13T06:17Z · #32923 · draft PR #33045 at head fcff03d.

{
  "issue": 32923,
  "status": "done",
  "branch": "claude/project-thread-12ifpx",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/33045",
  "session": "session_01L9qibzaHAtZWwifCxQJuEP",
  "premise_still_valid": true,
  "summary": "skills/objectstack-automation/SKILL.md readonly-field callout now names the four doors in the words of os explain flow-update-readonly-field ('A button, an action, an endpoint or the trigger route'), verified against flowStartRefusal on main c54a23d2 (callers: action-execution.ts, domains/automation.ts trigger routes, endpoint-executor.ts). Part 2 took the skill-side arm: 'Elevate the write, not the flow' adds that an api flow brings a webhook secret and an inbound door a button never uses (flow-registration-checks.ts refuses an api flow without secretRef/secret), so subflow is the pick; routes sentence keeps the explain text's words; lint explain text untouched; Flow Types api row unchanged. Growth paid by two same-file restatement cuts (Who-may-START parenthetical door list; Inbound webhook section's 'An api flow is bound to an inbound HTTP endpoint'); token row 6858 -> 6861 = ceiling, no raise. Changeset '@objectstack/skills': patch. PR is draft, Tier H (skills/**).",
  "tests": "Teaching text only; no tested behaviour changed, no ablation. Readings: SKILL.md lines 475 -> 474, tokens 6858 -> 6861 (ceiling 6861); bundle SKILL.md sum lines 4597 -> 4596, tokens 58697 -> 58700.",
  "gates": "head fcff03d4 (main c54a23d2 merged, no-op). Derived 46 families via dispatch-gates --commands; --ran reconciliation: 46 derived, 42 run exit 0, 4 NOT-MEASURED (exit 3 prerequisite, whole-workspace dts dists: check:dts-closure, check:dual-build-cjs-loads, check:lean-entry-closure, check:sourcemap-no-sources-content; diff is markdown + changeset only, CI Lint & Repo Gates runs them), 0 UNRUN. Re-run on final head, each exit 0: check-skills-token-ratchet (6861/6861), spec check:skill-docs, spec check:skill-refs, check:skill-identifier-liveness, check:skill-links, check:nul-bytes, check:pm-skill-id-lint, check:skill-compatibility, check:skill-frame-sync, lint check:doc-formula-expressions (after @objectstack/lint... build, lock VERDICT command-exit 0, 86s). List: /mnt/project-files/skills-seat-2/r2026-11-13/out/32923-gates-ran-fcff03d4.list. PR check-runs: in_progress at report time.",
  "dogfood_battery": "n/a — no `!` in the PR title and no (narrowing) arm",
  "mcp_calls": "0",
  "api_writes": "2 — relay pr_create (fleet-write run 43377492438, PR #33045, body 4800/4800 bytes identical, assignee os-tesla from the Claim's Account); os-dev-report comment on #32923 via post-stamped",
  "open_questions": [],
  "security_findings": "none",
  "out_of_scope_findings": []
}

domain:skills#2 · os-tesla · session_01L9qibvXzthnUYrxzphgFgW

ACCEPT → PR #33045 comment 6846365669 (head 7cc4d8f8, contract review PASS 6846152320). Tier H: draft, pm:awaiting-merge, review requested from os-zhuang 2026-11-13T06:55Z.

domain:skills#2 · os-tesla · session_01L9qibvXzthnUYrxzphgFgW

Landed 2026-11-13T08:10Z.

Reading	Value
PR #33045	MERGED `0a50357576` (readied and armed by os-zhuang)
#32923	closed

State: pm:dispatched removed.

Navigation Menu

Repository navigation

skills(objectstack-automation): the elevated-start limit names only "a button or action" and offers an api flow without its webhook secret cost #32923

Part 1 — name all four doors

Part 2 — the `api` route's cost

Acceptance

Unblocked → `pm:queue` · 2026-11-13T02:54Z

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

skills(objectstack-automation): the elevated-start limit names only "a button or action" and offers an api flow without its webhook secret cost #32923

Description

Part 1 — name all four doors

Part 2 — the api route's cost

Acceptance

Activity

objectstack-fleet commented on Nov 13, 2026

Unblocked → pm:queue · 2026-11-13T02:54Z

objectstack-fleet commented on Nov 13, 2026

objectstack-fleet commented on Nov 13, 2026

objectstack-fleet commented on Nov 13, 2026

objectstack-fleet commented on Nov 13, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

Part 2 — the `api` route's cost

Unblocked → `pm:queue` · 2026-11-13T02:54Z