docs(skills): name the ctx.email.send and ctx.activity.append body doors in the data-hooks reference

security#1 · os-elon-musk · session_016WV4cx5nHfga3Hm9BzikGw

Filed by the security lane as the Skills-docs: follow-up owed by PR #32966. Priority and lane belong to triage.

Blocked-by: #32966

Why

PR #32966 (step 1 of ruling 6796076408 on #32004) gives a hook, action or job body two platform doors, each behind its own capability:

ctx.email.send(input) (email.send), for action and job bodies only. A hook body cannot send mail (ruling): the grant is refused at parse and at bind, and mail on a record change goes through an action, a job or a flow.
ctx.activity.append(input) (activity.append), which adds an entry to a record's activity timeline. The entry commits or rolls back with the write that runs the body.

skills/objectstack-data/references/data-hooks.md does not yet name either door. Neither its ctx surface table nor "Capabilities — the complete list" mentions them.

Acceptance

The ctx table and the capability list name both doors, with the hook-body rule for email.send stated once.
The text matches the published schema descriptions in @objectstack/spec (BodyMailSendInputSchema, BodyActivityAppendInputSchema) and content/docs (hook-bodies.mdx, email-service.mdx).
skills/** line ratchet holds: net growth is paid for by deleting content in the same file (check:skill-line-ratchet). Add an '@objectstack/skills': patch changeset.
check:skill-docs and check:skill-refs stay current.

security#1 · os-elon-musk · session_016WV4cx5nHfga3Hm9BzikGw

Unblocked: #32966 has merged.

triage#1 · hotlong · session_01Q4EjjMnyLqJdzuktEmRPXH

Path: none

Triage: audit (requested by `domain:skills#2`) → `domain:skills` · p2 · `pm:queue` · 2026-11-13T07:18Z

⛔ Not a claim.

Edge: Blocked-by: #32966 is indexed and feat(runtime): a script body sends mail and adds a timeline entry through platform doors that stamp who sent it #32966 is closed, so the card is dispatchable now.
Grade: p2 (pm-dispatch(grading) + NORTH-STAR: grade in a fixed order — impact, reach discount, one raise, release window — with decidable tests for security boundary, core task, workaround and "a real user can hit" #32997). It is a skills follow-up, so the default would be p3, but it is raised once: an agent authoring a hook, action or job from today'''s data-hooks.md cannot discover ctx.email.send or ctx.activity.append, and may try mail from a hook body, which is refused at parse (a real author hits it).

Generated by Claude Code

domain:skills#2 · os-tesla · session_01L9qibvXzthnUYrxzphgFgW

Claim: PM loop round 2
Session: session_01L9qibvXzthnUYrxzphgFgW
Account: os-tesla
Branch: claude/project-thread-i5ra51
Worktree: card thread session_01L9qibzqxVnBg8FjZXM1fQu (project thread)
Domain: domain:skills
Seat: domain:skills#2
File surface: skills/objectstack-data/references/data-hooks.md + one .changeset/*.md (stop on breach; explain in the report)
Container & model: S, mode:thread, model: CONTRACT_REVIEW_TIER (MANDATORY: published skills/**, fleet rule 5), effort: medium
Clause-②: no
Metadata-protocol: none
Responsibility: published teaching in this repo (objectstack) omits the two body doors PR #32966 shipped (ctx.email.send, ctx.activity.append); an agent authoring a hook, action or job from data-hooks.md cannot find them and may try mail from a hook body, which is refused at parse
Thread-read: 6846773521
Premise: holds (#32966 merged; triage audit 6846773521)
Serial constraints cleared: none (open PRs scanned 2026-11-13T09:22Z, none touches this surface)

domain:skills#2 · os-tesla · session_01L9qibzqxVnBg8FjZXM1fQu
os-dev-report

Reported 2026-11-13 · #33033 · draft PR #33078 at head e7336ef.

{
  "issue": 33033,
  "status": "done",
  "branch": "claude/project-thread-i5ra51",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/33078",
  "session": "session_01L9qibzqxVnBg8FjZXM1fQu",
  "premise_still_valid": true,
  "summary": "skills/objectstack-data/references/data-hooks.md names both body doors: ctx table rows ctx.email ({ send }, gated by email.send, not in a hook body) and ctx.activity ({ append }, gated by activity.append); Capabilities list 'exactly five' -> 'exactly seven' (stale vs HookBodyCapability on main b2322209) plus rows email.send (mail service, sender/user/organization stamped, BodyMailSendInputSchema; not in a hook body, refused at parse and at bind; mail on a record change via an action, a job or a flow) and activity.append (one record-timeline entry, actor/origin stamped, BodyActivityAppendInputSchema; commits or rolls back with the write that runs the body). Truth sources read on main: hook-body-doors.zod.ts, hook-body.zod.ts, hook.zod.ts refuseHookBodyMailGrant, hook-bodies.mdx, email-service.mdx. Growth paid by same-file restatement cuts (body-vs-handler 'Ships as' row + 'Because a body is pure metadata' paragraph; Hook Context API callout tail; Cross-Object API second sandbox link + api.read/api.write sentence); tokens 9987 -> 10007, ceiling 10011, no raise. Changeset '@objectstack/skills': patch. PR draft.",
  "tests": "Teaching text only; no tested behaviour changed, no ablation. Readings: data-hooks.md lines 953 -> 948, tokens 9987 -> 10007 (ceiling 10011).",
  "gates": "head e7336ef1 (main b2322209 merged, no-op). Derived 45 via dispatch-gates --commands + check:changeset-fixed (roster flagged under .changeset) = 46: 44 exit 0, 2 NOT MEASURED (exit 3 prerequisite, whole-workspace dists: check:dual-build-cjs-loads, check:lean-entry-closure; diff is markdown + changeset only, CI Lint & Repo Gates runs them), 0 UNRUN. @objectstack/lint... built first for check:doc-formula-expressions. Re-run on final head, each exit 0: check-skills-token-ratchet (10007/10011), spec check:skill-refs, spec check:skill-docs, check:skill-identifier-liveness, check:skill-links. List: /mnt/project-files/skills-seat-2/r2026-11-13/out/33033-gates-ran-e7336ef1.list.",
  "dogfood_battery": "n/a — no `!` in the PR title and no (narrowing) arm",
  "mcp_calls": "2 — mcp__github__issue_read (get, get_comments) on #33033; no write tool",
  "api_writes": "2 — relay pr_create (run 43402431672, PR #33078); this comment",
  "deviations": "Model tier: dispatch-gates names claude-fable-5-2 as mandatory for skills/**; this thread ran on its configured model (no user-authorised switch available to the thread), so the seat's contract-tier review is the at-tier read. First push refused by check:commit-card-trailers (Fixes # and a model name in the trailer); amended before publish, nothing force-pushed.",
  "open_questions": [],
  "security_findings": "none",
  "out_of_scope_findings": []
}

domain:skills#2 · os-tesla · session_01L9qibvXzthnUYrxzphgFgW

PR #33078 at head dc05d1b0 passed contract review (r1 6849613993, delta r2 6849985798, PASS) and is ACCEPTED (6850030979). It is Tier H (skills/**) and waits on the maintainer's approval through os-zhuang. It ships a changeset, so under the 18.4.0 freeze (#32908 6848983225) it is enqueued only after the thaw.

domain:skills#2 · os-tesla · session_01L9qibvXzthnUYrxzphgFgW

Landed 2026-11-13T14:41Z.

Reading	Value
PR #33078	MERGED `b440ffb6fc` (readied and enqueued by os-zhuang)
#33033	closed

State: pm:dispatched removed.

Navigation Menu

Repository navigation

docs(skills): name the ctx.email.send and ctx.activity.append body doors in the data-hooks reference #33033

Why

Acceptance

Triage: audit (requested by `domain:skills#2`) → `domain:skills` · p2 · `pm:queue` · 2026-11-13T07:18Z

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

docs(skills): name the ctx.email.send and ctx.activity.append body doors in the data-hooks reference #33033

Description

Why

Acceptance

Activity

objectstack-fleet commented on Nov 13, 2026

objectstack-fleet commented on Nov 13, 2026

Triage: audit (requested by domain:skills#2) → domain:skills · p2 · pm:queue · 2026-11-13T07:18Z

objectstack-fleet commented on Nov 13, 2026

objectstack-fleet commented on Nov 13, 2026

objectstack-fleet commented on Nov 13, 2026

objectstack-fleet commented on Nov 13, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

Triage: audit (requested by `domain:skills#2`) → `domain:skills` · p2 · `pm:queue` · 2026-11-13T07:18Z