duly_task.source carries the same catalog-default bug as duly_duty.source, and a member can hand-create a duly_task #55

Closed
#54
Closed
duly_task.source carries the same catalog-default bug as duly_duty.source, and a member can hand-create a duly_task#55
#54
Assignees
os-warren
Labels
M1area:dispatchpm:dispatched

Description

@os-warren
os-warren
opened on Sep 1, 2026

Found while implementing #50 (flip duly_duty.source's default to self), whose
file surface was src/objects/duty.object.ts only. Filed rather than fixed —
src/objects/task.object.ts is a different object with its own claim risk,
and the PM adjudication comment on #50 scoped only the duty object.

What

duly_task.source (src/objects/task.object.ts) declares the identical
three-option select, with the identical comment calling it the caliber field
metrics are allowed to read — and the identical default: true sitting on
catalog:

source: Field.select({label: 'Source',required: true,options: [{label: 'Role catalog',value: 'catalog',color: '#16515F',default: true},{label: 'Assigned by manager',value: 'assigned',color: '#8C6512'},{label: 'Self-declared',value: 'self',color: '#576B73'},],}),

Unlike the assignment fan-out (which writes duly_task.source explicitly —
see below), the dispatcher (src/jobs/dispatch.plan.ts:382,
source: duty.source ?? '') also always writes it explicitly, copied from the
parent duty. So the dispatched-task path is not exposed.

But src/security/permission-sets.ts grants the duly_member position
duly_task: { allowCreate: true, allowRead: true, allowEdit: true, readScope: 'own', writeScope: 'own' } — a member can create their own duly_task
directly, not just via dispatch. src/views/task.view.ts puts source on
several columns/tooltips but defines no create form that stamps it, so a
hand-created task falls back to the field default: catalog. That is the
same inversion #50 just fixed on the duty side — a self-declared task would be
born into the governed, scoreable set.

Why filed separately rather than fixed alongside #50

Correction to #50's stated premise, surfaced along the way

#50 and its adjudication comment describe "the assignment fan-out" as a
producer of a governed duty with source: 'assigned'. It isn't: the
fan-out (src/flows/assignment.flow.ts) never creates a duly_duty row at
all — both its create_record nodes target objectName: 'duly_task'
directly. It writes source: 'assigned' on the task, unconditionally,
so it is unaffected by either this finding or #50. Doesn't change either
fix; noted because the premise as stated is imprecise and this is the
object where it actually applies.

Suggested acceptance sketch

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

M1area:dispatchpm:dispatched

Type

No type

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions

    , 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Add copy buttons to all 
     blocks\n(function() {\n function addCopyButtons() {\n document.querySelectorAll('pre code').forEach(function(codeBlock) {\n if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;\n codeBlock.parentElement.setAttribute('data-copy-added', 'true');\n \n var btn = document.createElement('button');\n btn.textContent = 'Copy';\n btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';\n btn.onmouseover = function() { this.style.opacity = '1'; };\n btn.onmouseout = function() { this.style.opacity = '0.7'; };\n btn.onclick = function() {\n navigator.clipboard.writeText(codeBlock.textContent).then(function() {\n btn.textContent = 'Copied!';\n setTimeout(function() { btn.textContent = 'Copy'; }, 1500);\n });\n };\n codeBlock.parentElement.style.position = 'relative';\n codeBlock.parentElement.appendChild(btn);\n });\n }\n \n addCopyButtons();\n \n // Re-run on dynamic content\n var observer = new MutationObserver(addCopyButtons);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Add Copy Buttons to Code Blocks");
}
} catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
})();
(function(){
try {
var __m = "github.com";
var __re = new RegExp('^' + "github\\.com" + '

    Skip to content
    duly_task.source carries the same catalog-default bug as duly_duty.source, and a member can hand-create a duly_task #55
    Closed
    #54
    Closed
    duly_task.source carries the same catalog-default bug as duly_duty.source, and a member can hand-create a duly_task#55
    #54
    Assignees
    os-warren
    Labels
    M1area:dispatchpm:dispatched
    Description
    @os-warren
    os-warren
    opened on Sep 1, 2026
    Found while implementing #50 (flip duly_duty.source's default to self), whose
    
file surface was src/objects/duty.object.ts only. Filed rather than fixed —
    src/objects/task.object.ts is a different object with its own claim risk,
    
and the PM adjudication comment on #50 scoped only the duty object.
    What
    duly_task.source (src/objects/task.object.ts) declares the identical
    
three-option select, with the identical comment calling it the caliber field
    
metrics are allowed to read — and the identical default: true sitting on
    catalog:
    source: Field.select({label: 'Source',required: true,options: [{label: 'Role catalog',value: 'catalog',color: '#16515F',default: true},{label: 'Assigned by manager',value: 'assigned',color: '#8C6512'},{label: 'Self-declared',value: 'self',color: '#576B73'},],}),
    Unlike the assignment fan-out (which writes duly_task.source explicitly —
    
see below), the dispatcher (src/jobs/dispatch.plan.ts:382,
    source: duty.source ?? '') also always writes it explicitly, copied from the
    
parent duty. So the dispatched-task path is not exposed.
    But src/security/permission-sets.ts grants the duly_member position
    duly_task: { allowCreate: true, allowRead: true, allowEdit: true, readScope: 'own', writeScope: 'own' } — a member can create their own duly_task
    
directly, not just via dispatch. src/views/task.view.ts puts source on
    
several columns/tooltips but defines no create form that stamps it, so a
    
hand-created task falls back to the field default: catalog. That is the
    
same inversion #50 just fixed on the duty side — a self-declared task would be
    
born into the governed, scoreable set.
    Why filed separately rather than fixed alongside #50
    Correction to #50's stated premise, surfaced along the way
    #50 and its adjudication comment describe "the assignment fan-out" as a
    
producer of a governed duty with source: 'assigned'. It isn't: the
    
fan-out (src/flows/assignment.flow.ts) never creates a duly_duty row at
    
all — both its create_record nodes target objectName: 'duly_task'
    
directly. It writes source: 'assigned' on the task, unconditionally,
    
so it is unaffected by either this finding or #50. Doesn't change either
    
fix; noted because the premise as stated is imprecise and this is the
    
object where it actually applies.
    Suggested acceptance sketch
    Activity
    Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
    Metadata
    Metadata
    Assignees
    Labels
    M1area:dispatchpm:dispatched
    Type
    No type
    Projects
    No projects
      Milestone
      No milestone
      Relationships
      None yet
      Development
      No branches or pull requests
      Issue actions
      
, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Force GitHub README to respect dark mode\n(function() {\n var style = document.createElement('style');\n style.textContent = '\n .markdown-body {\n color-scheme: dark light;\n }\n .markdown-body pre { background: #161b22 !important; }\n .markdown-body code { background: rgba(110, 118, 129, 0.4) !important; }\n .markdown-body table th, .markdown-body table td { border-color: #30363d !important; }\n .markdown-body img { background: #0d1117; }\n .markdown-body blockquote { border-left-color: #8b949e; }\n .markdown-body hr { border-color: #30363d; }\n ';\n document.head.appendChild(style);\n})();", "GitHub Dark Mode README Fix");
}
} catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

      Skip to content
      duly_task.source carries the same catalog-default bug as duly_duty.source, and a member can hand-create a duly_task #55
      Closed
      #54
      Closed
      duly_task.source carries the same catalog-default bug as duly_duty.source, and a member can hand-create a duly_task#55
      #54
      Assignees
      os-warren
      Labels
      M1area:dispatchpm:dispatched
      Description
      @os-warren
      os-warren
      opened on Sep 1, 2026
      Found while implementing #50 (flip duly_duty.source's default to self), whose
      
file surface was src/objects/duty.object.ts only. Filed rather than fixed —
      src/objects/task.object.ts is a different object with its own claim risk,
      
and the PM adjudication comment on #50 scoped only the duty object.
      What
      duly_task.source (src/objects/task.object.ts) declares the identical
      
three-option select, with the identical comment calling it the caliber field
      
metrics are allowed to read — and the identical default: true sitting on
      catalog:
      source: Field.select({label: 'Source',required: true,options: [{label: 'Role catalog',value: 'catalog',color: '#16515F',default: true},{label: 'Assigned by manager',value: 'assigned',color: '#8C6512'},{label: 'Self-declared',value: 'self',color: '#576B73'},],}),
      Unlike the assignment fan-out (which writes duly_task.source explicitly —
      
see below), the dispatcher (src/jobs/dispatch.plan.ts:382,
      source: duty.source ?? '') also always writes it explicitly, copied from the
      
parent duty. So the dispatched-task path is not exposed.
      But src/security/permission-sets.ts grants the duly_member position
      duly_task: { allowCreate: true, allowRead: true, allowEdit: true, readScope: 'own', writeScope: 'own' } — a member can create their own duly_task
      
directly, not just via dispatch. src/views/task.view.ts puts source on
      
several columns/tooltips but defines no create form that stamps it, so a
      
hand-created task falls back to the field default: catalog. That is the
      
same inversion #50 just fixed on the duty side — a self-declared task would be
      
born into the governed, scoreable set.
      Why filed separately rather than fixed alongside #50
      Correction to #50's stated premise, surfaced along the way
      #50 and its adjudication comment describe "the assignment fan-out" as a
      
producer of a governed duty with source: 'assigned'. It isn't: the
      
fan-out (src/flows/assignment.flow.ts) never creates a duly_duty row at
      
all — both its create_record nodes target objectName: 'duly_task'
      
directly. It writes source: 'assigned' on the task, unconditionally,
      
so it is unaffected by either this finding or #50. Doesn't change either
      
fix; noted because the premise as stated is imprecise and this is the
      
object where it actually applies.
      Suggested acceptance sketch
      Activity
      Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
      Metadata
      Metadata
      Assignees
      Labels
      M1area:dispatchpm:dispatched
      Type
      No type
      Projects
      No projects
        Milestone
        No milestone
        Relationships
        None yet
        Development
        No branches or pull requests
        Issue actions
        
, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Highlight search terms from Google/DuckDuckGo/Bing referrer\n(function() {\n var ref = document.referrer;\n var terms = [];\n \n if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) {\n var url = new URL(ref);\n var q = url.searchParams.get('q') || url.searchParams.get('p');\n if (q) {\n terms = q.split(/\\s+/).filter(function(t) { return t.length > 2; });\n }\n }\n \n if (terms.length === 0) return;\n \n var style = document.createElement('style');\n style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }';\n document.head.appendChild(style);\n \n function highlight(node) {\n if (node.nodeType === 3) { // text node\n var text = node.textContent;\n var found = false;\n terms.forEach(function(term) {\n var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\') + ')', 'gi');\n if (regex.test(text)) {\n found = true;\n var frag = document.createDocumentFragment();\n var parts = text.split(regex);\n parts.forEach(function(part, i) {\n if (i % 2 === 0) {\n frag.appendChild(document.createTextNode(part));\n } else {\n var span = document.createElement('span');\n span.className = 'userscript-highlight';\n span.textContent = part;\n frag.appendChild(span);\n }\n });\n node.parentNode.replaceChild(frag, node);\n }\n });\n } else if (node.nodeType === 1 && node.childNodes) { // element\n var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT'];\n if (!skipTags.includes(node.tagName)) {\n Array.from(node.childNodes).forEach(highlight);\n }\n }\n }\n \n highlight(document.body);\n \n // Re-highlight on dynamic content\n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1 || node.nodeType === 3) highlight(node);\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Highlight Search Terms");
}
} catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

        Skip to content
        duly_task.source carries the same catalog-default bug as duly_duty.source, and a member can hand-create a duly_task #55
        Closed
        #54
        Closed
        duly_task.source carries the same catalog-default bug as duly_duty.source, and a member can hand-create a duly_task#55
        #54
        Assignees
        os-warren
        Labels
        M1area:dispatchpm:dispatched
        Description
        @os-warren
        os-warren
        opened on Sep 1, 2026
        Found while implementing #50 (flip duly_duty.source's default to self), whose
        
file surface was src/objects/duty.object.ts only. Filed rather than fixed —
        src/objects/task.object.ts is a different object with its own claim risk,
        
and the PM adjudication comment on #50 scoped only the duty object.
        What
        duly_task.source (src/objects/task.object.ts) declares the identical
        
three-option select, with the identical comment calling it the caliber field
        
metrics are allowed to read — and the identical default: true sitting on
        catalog:
        source: Field.select({label: 'Source',required: true,options: [{label: 'Role catalog',value: 'catalog',color: '#16515F',default: true},{label: 'Assigned by manager',value: 'assigned',color: '#8C6512'},{label: 'Self-declared',value: 'self',color: '#576B73'},],}),
        Unlike the assignment fan-out (which writes duly_task.source explicitly —
        
see below), the dispatcher (src/jobs/dispatch.plan.ts:382,
        source: duty.source ?? '') also always writes it explicitly, copied from the
        
parent duty. So the dispatched-task path is not exposed.
        But src/security/permission-sets.ts grants the duly_member position
        duly_task: { allowCreate: true, allowRead: true, allowEdit: true, readScope: 'own', writeScope: 'own' } — a member can create their own duly_task
        
directly, not just via dispatch. src/views/task.view.ts puts source on
        
several columns/tooltips but defines no create form that stamps it, so a
        
hand-created task falls back to the field default: catalog. That is the
        
same inversion #50 just fixed on the duty side — a self-declared task would be
        
born into the governed, scoreable set.
        Why filed separately rather than fixed alongside #50
        Correction to #50's stated premise, surfaced along the way
        #50 and its adjudication comment describe "the assignment fan-out" as a
        
producer of a governed duty with source: 'assigned'. It isn't: the
        
fan-out (src/flows/assignment.flow.ts) never creates a duly_duty row at
        
all — both its create_record nodes target objectName: 'duly_task'
        
directly. It writes source: 'assigned' on the task, unconditionally,
        
so it is unaffected by either this finding or #50. Doesn't change either
        
fix; noted because the premise as stated is imprecise and this is the
        
object where it actually applies.
        Suggested acceptance sketch
        Activity
        Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
        Metadata
        Metadata
        Assignees
        Labels
        M1area:dispatchpm:dispatched
        Type
        No type
        Projects
        No projects
          Milestone
          No milestone
          Relationships
          None yet
          Development
          No branches or pull requests
          Issue actions
          
, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Strip utm_, fbclid, gclid, etc. from all links on page\n(function() {\n var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content',\n 'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid',\n 'ref', 'ref_src', 'source', 'medium', 'campaign'];\n \n function cleanUrl(url) {\n try {\n var u = new URL(url, window.location.origin);\n var changed = false;\n trackingParams.forEach(function(p) {\n if (u.searchParams.has(p)) {\n u.searchParams.delete(p);\n changed = true;\n }\n });\n return changed ? u.toString() : url;\n } catch (e) {\n return url;\n }\n }\n \n function cleanLinks() {\n document.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n \n cleanLinks();\n \n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1) {\n if (node.tagName === 'A') cleanLinks();\n node.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Remove Tracking Parameters from Links");
}
} catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); }
})();
(function(){
try {
var __m = "youtube.com";
var __re = new RegExp('^' + "youtube\\.com" + '

          Skip to content
          duly_task.source carries the same catalog-default bug as duly_duty.source, and a member can hand-create a duly_task #55
          Closed
          #54
          Closed
          duly_task.source carries the same catalog-default bug as duly_duty.source, and a member can hand-create a duly_task#55
          #54
          Assignees
          os-warren
          Labels
          M1area:dispatchpm:dispatched
          Description
          @os-warren
          os-warren
          opened on Sep 1, 2026
          Found while implementing #50 (flip duly_duty.source's default to self), whose
          
file surface was src/objects/duty.object.ts only. Filed rather than fixed —
          src/objects/task.object.ts is a different object with its own claim risk,
          
and the PM adjudication comment on #50 scoped only the duty object.
          What
          duly_task.source (src/objects/task.object.ts) declares the identical
          
three-option select, with the identical comment calling it the caliber field
          
metrics are allowed to read — and the identical default: true sitting on
          catalog:
          source: Field.select({label: 'Source',required: true,options: [{label: 'Role catalog',value: 'catalog',color: '#16515F',default: true},{label: 'Assigned by manager',value: 'assigned',color: '#8C6512'},{label: 'Self-declared',value: 'self',color: '#576B73'},],}),
          Unlike the assignment fan-out (which writes duly_task.source explicitly —
          
see below), the dispatcher (src/jobs/dispatch.plan.ts:382,
          source: duty.source ?? '') also always writes it explicitly, copied from the
          
parent duty. So the dispatched-task path is not exposed.
          But src/security/permission-sets.ts grants the duly_member position
          duly_task: { allowCreate: true, allowRead: true, allowEdit: true, readScope: 'own', writeScope: 'own' } — a member can create their own duly_task
          
directly, not just via dispatch. src/views/task.view.ts puts source on
          
several columns/tooltips but defines no create form that stamps it, so a
          
hand-created task falls back to the field default: catalog. That is the
          
same inversion #50 just fixed on the duty side — a self-declared task would be
          
born into the governed, scoreable set.
          Why filed separately rather than fixed alongside #50
          Correction to #50's stated premise, surfaced along the way
          #50 and its adjudication comment describe "the assignment fan-out" as a
          
producer of a governed duty with source: 'assigned'. It isn't: the
          
fan-out (src/flows/assignment.flow.ts) never creates a duly_duty row at
          
all — both its create_record nodes target objectName: 'duly_task'
          
directly. It writes source: 'assigned' on the task, unconditionally,
          
so it is unaffected by either this finding or #50. Doesn't change either
          
fix; noted because the premise as stated is imprecise and this is the
          
object where it actually applies.
          Suggested acceptance sketch
          Activity
          Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
          Metadata
          Metadata
          Assignees
          Labels
          M1area:dispatchpm:dispatched
          Type
          No type
          Projects
          No projects
            Milestone
            No milestone
            Relationships
            None yet
            Development
            No branches or pull requests
            Issue actions
            
, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Auto-enable theater mode on YouTube\n(function() {\n function tryTheater() {\n var btn = document.querySelector('button[aria-label=\"Theater mode\"], ytd-player #player button[title=\"Theater mode\"]');\n if (btn && !btn.classList.contains('activated')) {\n btn.click();\n }\n }\n \n // Try immediately\n tryTheater();\n \n // Try after navigation (SPA)\n var lastUrl = location.href;\n setInterval(function() {\n if (location.href !== lastUrl) {\n lastUrl = location.href;\n setTimeout(tryTheater, 500);\n }\n }, 1000);\n \n // Also try on player load\n var observer = new MutationObserver(tryTheater);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "YouTube Theater Mode Default");
}
} catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

            Skip to content
            duly_task.source carries the same catalog-default bug as duly_duty.source, and a member can hand-create a duly_task #55
            Closed
            #54
            Closed
            duly_task.source carries the same catalog-default bug as duly_duty.source, and a member can hand-create a duly_task#55
            #54
            Assignees
            os-warren
            Labels
            M1area:dispatchpm:dispatched
            Description
            @os-warren
            os-warren
            opened on Sep 1, 2026
            Found while implementing #50 (flip duly_duty.source's default to self), whose
            
file surface was src/objects/duty.object.ts only. Filed rather than fixed —
            src/objects/task.object.ts is a different object with its own claim risk,
            
and the PM adjudication comment on #50 scoped only the duty object.
            What
            duly_task.source (src/objects/task.object.ts) declares the identical
            
three-option select, with the identical comment calling it the caliber field
            
metrics are allowed to read — and the identical default: true sitting on
            catalog:
            source: Field.select({label: 'Source',required: true,options: [{label: 'Role catalog',value: 'catalog',color: '#16515F',default: true},{label: 'Assigned by manager',value: 'assigned',color: '#8C6512'},{label: 'Self-declared',value: 'self',color: '#576B73'},],}),
            Unlike the assignment fan-out (which writes duly_task.source explicitly —
            
see below), the dispatcher (src/jobs/dispatch.plan.ts:382,
            source: duty.source ?? '') also always writes it explicitly, copied from the
            
parent duty. So the dispatched-task path is not exposed.
            But src/security/permission-sets.ts grants the duly_member position
            duly_task: { allowCreate: true, allowRead: true, allowEdit: true, readScope: 'own', writeScope: 'own' } — a member can create their own duly_task
            
directly, not just via dispatch. src/views/task.view.ts puts source on
            
several columns/tooltips but defines no create form that stamps it, so a
            
hand-created task falls back to the field default: catalog. That is the
            
same inversion #50 just fixed on the duty side — a self-declared task would be
            
born into the governed, scoreable set.
            Why filed separately rather than fixed alongside #50
            Correction to #50's stated premise, surfaced along the way
            #50 and its adjudication comment describe "the assignment fan-out" as a
            
producer of a governed duty with source: 'assigned'. It isn't: the
            
fan-out (src/flows/assignment.flow.ts) never creates a duly_duty row at
            
all — both its create_record nodes target objectName: 'duly_task'
            
directly. It writes source: 'assigned' on the task, unconditionally,
            
so it is unaffected by either this finding or #50. Doesn't change either
            
fix; noted because the premise as stated is imprecise and this is the
            
object where it actually applies.
            Suggested acceptance sketch
            Activity
            Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
            Metadata
            Metadata
            Assignees
            Labels
            M1area:dispatchpm:dispatched
            Type
            No type
            Projects
            No projects
              Milestone
              No milestone
              Relationships
              None yet
              Development
              No branches or pull requests
              Issue actions
              
, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Remove or un-stick sticky/fixed headers that block content\n(function() {\n function unstick() {\n document.querySelectorAll('header, nav, [role=\"banner\"], .header, .navbar, .sticky, .fixed-top, [style*=\"position: fixed\"], [style*=\"position:sticky\"]').forEach(function(el) {\n if (el.style.position === 'fixed' || el.style.position === 'sticky' || \n getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') {\n el.style.position = 'static';\n el.style.top = 'auto';\n el.style.zIndex = 'auto';\n }\n });\n }\n \n unstick();\n \n var observer = new MutationObserver(unstick);\n observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] });\n})();", "Kill Sticky Headers");
}
} catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

              Skip to content
              duly_task.source carries the same catalog-default bug as duly_duty.source, and a member can hand-create a duly_task #55
              Closed
              #54
              Closed
              duly_task.source carries the same catalog-default bug as duly_duty.source, and a member can hand-create a duly_task#55
              #54
              Assignees
              os-warren
              Labels
              M1area:dispatchpm:dispatched
              Description
              @os-warren
              os-warren
              opened on Sep 1, 2026
              Found while implementing #50 (flip duly_duty.source's default to self), whose
              
file surface was src/objects/duty.object.ts only. Filed rather than fixed —
              src/objects/task.object.ts is a different object with its own claim risk,
              
and the PM adjudication comment on #50 scoped only the duty object.
              What
              duly_task.source (src/objects/task.object.ts) declares the identical
              
three-option select, with the identical comment calling it the caliber field
              
metrics are allowed to read — and the identical default: true sitting on
              catalog:
              source: Field.select({label: 'Source',required: true,options: [{label: 'Role catalog',value: 'catalog',color: '#16515F',default: true},{label: 'Assigned by manager',value: 'assigned',color: '#8C6512'},{label: 'Self-declared',value: 'self',color: '#576B73'},],}),
              Unlike the assignment fan-out (which writes duly_task.source explicitly —
              
see below), the dispatcher (src/jobs/dispatch.plan.ts:382,
              source: duty.source ?? '') also always writes it explicitly, copied from the
              
parent duty. So the dispatched-task path is not exposed.
              But src/security/permission-sets.ts grants the duly_member position
              duly_task: { allowCreate: true, allowRead: true, allowEdit: true, readScope: 'own', writeScope: 'own' } — a member can create their own duly_task
              
directly, not just via dispatch. src/views/task.view.ts puts source on
              
several columns/tooltips but defines no create form that stamps it, so a
              
hand-created task falls back to the field default: catalog. That is the
              
same inversion #50 just fixed on the duty side — a self-declared task would be
              
born into the governed, scoreable set.
              Why filed separately rather than fixed alongside #50
              Correction to #50's stated premise, surfaced along the way
              #50 and its adjudication comment describe "the assignment fan-out" as a
              
producer of a governed duty with source: 'assigned'. It isn't: the
              
fan-out (src/flows/assignment.flow.ts) never creates a duly_duty row at
              
all — both its create_record nodes target objectName: 'duly_task'
              
directly. It writes source: 'assigned' on the task, unconditionally,
              
so it is unaffected by either this finding or #50. Doesn't change either
              
fix; noted because the premise as stated is imprecise and this is the
              
object where it actually applies.
              Suggested acceptance sketch
              Activity
              Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
              Metadata
              Metadata
              Assignees
              Labels
              M1area:dispatchpm:dispatched
              Type
              No type
              Projects
              No projects
                Milestone
                No milestone
                Relationships
                None yet
                Development
                No branches or pull requests
                Issue actions
                
, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Universal Dark Mode - works on any site\n(function() {\n var enabled = true;\n \n function applyDarkMode() {\n if (!enabled) return;\n \n // Create style element if it doesn't exist\n var style = document.getElementById('universal-dark-mode-style');\n if (!style) {\n style = document.createElement('style');\n style.id = 'universal-dark-mode-style';\n document.head.appendChild(style);\n }\n \n // Dark mode CSS - inverts colors but preserves images/video\n style.textContent = '\n /* Invert everything except media */\n html {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #1a1a2e !important;\n }\n \n /* Restore images, videos, iframes, canvas */\n img, video, iframe, canvas, svg, picture, [style*=\"background-image\"] {\n filter: invert(1) hue-rotate(180deg) !important;\n }\n \n /* Preserve specific elements that should not be inverted */\n .no-dark-mode, .no-dark-mode *,\n [data-theme=\"light\"], [data-theme=\"light\"],\n .ace_editor, .ace_editor *,\n .CodeMirror, .CodeMirror *,\n .monaco-editor, .monaco-editor *,\n .markdown-body pre, .markdown-body pre *,\n .highlight, .highlight *,\n pre code, pre code * {\n filter: none !important;\n }\n \n /* Fix common UI elements */\n .modal, .popup, .dropdown-menu, .tooltip, .popover {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #2d2d44 !important;\n border-color: #444 !important;\n }\n \n /* Scrollbars */\n ::-webkit-scrollbar { background: #1a1a2e !important; }\n ::-webkit-scrollbar-thumb { background: #444 !important; }\n ::-webkit-scrollbar-thumb:hover { background: #555 !important; }\n \n /* Selection */\n ::selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ';\n }\n \n function removeDarkMode() {\n var style = document.getElementById('universal-dark-mode-style');\n if (style) style.remove();\n }\n \n // Toggle with Alt+Shift+D\n document.addEventListener('keydown', function(e) {\n if (e.altKey && e.shiftKey && e.key === 'D') {\n e.preventDefault();\n enabled = !enabled;\n if (enabled) {\n applyDarkMode();\n console.log('[Universal Dark Mode] Enabled');\n } else {\n removeDarkMode();\n console.log('[Universal Dark Mode] Disabled');\n }\n }\n });\n \n // Apply on load\n applyDarkMode();\n \n // Re-apply on dynamic content\n var observer = new MutationObserver(function(mutations) {\n if (enabled && !document.getElementById('universal-dark-mode-style')) {\n applyDarkMode();\n }\n });\n observer.observe(document.head, { childList: true });\n \n console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle');\n})();", "Universal Dark Mode");
}
} catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); }
})();
})();

                Skip to content
                duly_task.source carries the same catalog-default bug as duly_duty.source, and a member can hand-create a duly_task #55
                Closed
                #54
                Closed
                duly_task.source carries the same catalog-default bug as duly_duty.source, and a member can hand-create a duly_task#55
                #54
                Assignees
                os-warren
                Labels
                M1area:dispatchpm:dispatched
                Description
                @os-warren
                os-warren
                opened on Sep 1, 2026
                Found while implementing #50 (flip duly_duty.source's default to self), whose
                
file surface was src/objects/duty.object.ts only. Filed rather than fixed —
                src/objects/task.object.ts is a different object with its own claim risk,
                
and the PM adjudication comment on #50 scoped only the duty object.
                What
                duly_task.source (src/objects/task.object.ts) declares the identical
                
three-option select, with the identical comment calling it the caliber field
                
metrics are allowed to read — and the identical default: true sitting on
                catalog:
                source: Field.select({label: 'Source',required: true,options: [{label: 'Role catalog',value: 'catalog',color: '#16515F',default: true},{label: 'Assigned by manager',value: 'assigned',color: '#8C6512'},{label: 'Self-declared',value: 'self',color: '#576B73'},],}),
                Unlike the assignment fan-out (which writes duly_task.source explicitly —
                
see below), the dispatcher (src/jobs/dispatch.plan.ts:382,
                source: duty.source ?? '') also always writes it explicitly, copied from the
                
parent duty. So the dispatched-task path is not exposed.
                But src/security/permission-sets.ts grants the duly_member position
                duly_task: { allowCreate: true, allowRead: true, allowEdit: true, readScope: 'own', writeScope: 'own' } — a member can create their own duly_task
                
directly, not just via dispatch. src/views/task.view.ts puts source on
                
several columns/tooltips but defines no create form that stamps it, so a
                
hand-created task falls back to the field default: catalog. That is the
                
same inversion #50 just fixed on the duty side — a self-declared task would be
                
born into the governed, scoreable set.
                Why filed separately rather than fixed alongside #50
                Correction to #50's stated premise, surfaced along the way
                #50 and its adjudication comment describe "the assignment fan-out" as a
                
producer of a governed duty with source: 'assigned'. It isn't: the
                
fan-out (src/flows/assignment.flow.ts) never creates a duly_duty row at
                
all — both its create_record nodes target objectName: 'duly_task'
                
directly. It writes source: 'assigned' on the task, unconditionally,
                
so it is unaffected by either this finding or #50. Doesn't change either
                
fix; noted because the premise as stated is imprecise and this is the
                
object where it actually applies.
                Suggested acceptance sketch
                Activity
                Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
                Metadata
                Metadata
                Assignees
                Labels
                M1area:dispatchpm:dispatched
                Type
                No type
                Projects
                No projects
                  Milestone
                  No milestone
                  Relationships
                  None yet
                  Development
                  No branches or pull requests
                  Issue actions