Degraded Status — Metadata is an in-memory registry framework. Database persistence for metadata storage is not yet implemented. Discovery reports this service as degraded.
Metadata API (list types, list items, get item) is fully functional
Metadata is loaded from config files at startup and held in memory
Future: metadata persistence to database for runtime modifications
Plugin-Provided Service — The kernel does NOT include an automation engine. Flow, workflow, and approval services must be provided by plugins (e.g., @objectstack/plugin-automation).
Protocol
@objectstack/spec
Kernel
Plugin Required
Status
Flow
✅
❌
✅
📋 Plugin
Workflow
✅
❌
✅
📋 Plugin
Approval
✅
❌
✅
📋 Plugin
Webhook
✅
❌
✅
📋 Plugin
ETL
✅
❌
✅
📋 Plugin
Sync
✅
❌
✅
📋 Plugin
Trigger Registry
✅
❌
✅
📋 Plugin
Notes:
Hook system is implemented in ObjectQL (beforeFind, afterInsert, etc.) — this is data-layer eventing, not workflow automation
Full workflow/automation engine will be provided by plugins
Protocols are complete and ready for plugin implementation
Discovery API reports automation service as unavailable until a plugin is registered
Plugin-Provided Service — The kernel does NOT handle authentication or authorization. Security services must be provided by plugins (e.g., @objectstack/plugin-auth). The Discovery API reports auth as unavailable until a plugin is registered.
The auth service in CoreServiceName covers both authentication (identity) and authorization (permissions). There is no separate permission service — it is part of auth.
Protocol
Area
@objectstack/spec
Kernel
Plugin Required
Status
Identity
Authentication
✅
❌
✅
📋 Plugin
Auth Config
Authentication
✅
❌
✅
📋 Plugin
Role
Authentication
✅
❌
✅
📋 Plugin
Organization
Authentication
✅
❌
✅
📋 Plugin
Policy
Authentication
✅
❌
✅
📋 Plugin
SCIM
Authentication
✅
❌
✅
📋 Plugin
Permission
Authorization
✅
❌
✅
📋 Plugin
Sharing
Authorization
✅
❌
✅
📋 Plugin
RLS
Authorization
✅
❌
✅
📋 Plugin
Territory
Authorization
✅
❌
✅
📋 Plugin
Notes:
All security protocols (identity + permission) are delivered by a single auth plugin — matching CoreServiceName
Client SDK supports bearer token header — but token validation requires the auth plugin
Auth route (/auth/*) only appears in Discovery when the auth plugin is registered
Fine-grained authorization (RLS, sharing, territory) is internal to the auth plugin