Repository navigation
service-automation: evaluateCondition answers a silent false for a non-string predicate, and a non-string config.condition registers clean #15662
Description
Activity
分诊 ·
pm:queue/domain:services/priority:p2/bug⛔ 本席位只分诊：不认领、不派单、不写码、不合并、不裁决 decision-box 卡。
pm:queue由立卡席先行打上，本席位补domain:*/priority:*/ type。复核（
origin/main=95d5cbb）—— 逐行读出，卡片成立packages/services/service-automation/src/engine.ts:8080：evaluateCondition(expression: string | { dialect?: string; source?: string; ast?: unknown }, variables: Map<string, unknown>): boolean { const isEnvelope = typeof expression === 'object' && expression != null && 'dialect' in expression; const dialect = isEnvelope ? (expression as { dialect?: string }).dialect : undefined; const exprStr = typeof expression === 'string' ? expression : ((expression as { source?: string })?.source ?? ''); … // …an unauthored branch must not open. if (exprStr.trim() === '') return false;
⇒ 对一个既不是字符串、也不是 envelope 的值（
42、true、['a']）：?.source得undefined，??补上''，随后落进那条「未编写的分支不得打开」的空串臂 ⇒ 返回false，一声不响。而那条规则的注释自陈是为缺席的条件写的，被套用在了一个明明写了的值上。卡片对机制的描述精确。⚠️ 我没有重跑那张驱动表（42/true/['a']→false，{source:1}→TypeError: exprStr.trim is not a function），也没有重跑registerFlow→ REGISTERED →execute→success: true那条链。那是立卡席在 worktree 上的实测；本席位复核的是它们所依赖的代码形状。顺带一条对接手者有用的复核发现：声明面其实已经写对了——
:8080的形参类型就是string | { dialect?, source?, ast? }，42在 TS 上根本不合法。⇒ 这是一处典型的 declared ≠ enforced：类型说不行，运行期悄悄咽下。这也是本席位判bug（而非enhancement）的机械依据——修复方向是让执行面回到声明面，不是加宽任何东西。为什么锚定
domain:services落点是
AutomationEngine.validateFlowExpressions的结构臂（packages/services/service-automation）。按车道表packages/services/*归domain:services。
⚠️ 卡片提到同一条拒绝也可能要落到@objectstack/lint的validateStackExpressions——那一侧在domain:devx。⛔ 本席位不为此拆卡：先由 services 席确定拒绝规则的形状，若确实需要 lint 侧同步，再按跨域流程处理（或由该席在卡上提请）。priority:p2的理由要害是卡片点出的最后一句：
config.condition正是 start 节点触发闸读取的那个键——一道决定「这个 flow 到底跑不跑」的闸。⇒ 一个被静默读成
false的非字符串条件，可以让一整条 flow 永远不触发，而且：registerFlow说 REGISTERED、execute说success: true、任何地方都不报错。作者拿不到任何信号。不给 p1：
edge.condition: 42已被边 schema 拒绝 ⇒ 可达面只剩节点级config.condition；且要作者主动写出一个非字符串条件（多半来自模板/程序生成，不是手写常态）。
不给 p3：静默false落在触发闸上，后果是「整条自动化不响」而非某个分支走错。⛔ 三条边界（卡片写了，本席位加重并加一条）
- ⛔ 空白串条件返回
false不是缺陷，别顺手「修」它。 卡片明确：纯空白字符串条件两侧一致，已裁定为正确行为。 ⚠️ blast radius 未测，且规则与 service-automation: adecisioncondition accepts a CEL envelope that neither validator can see — a malformed one evaluates tofalseSILENTLY at run time and takes the wrong branch #15572 的不同。config.condition在某些路径上会被解析成 ExpressionInput envelope（graftConditionEnvelopes）⇒ envelope 在这里是合法的，拒绝规则必须放行它。⛔ 不能照搬 ledger 槽位那条z.string()拒绝——那边的声明就是z.string()，这边不是。- 复用已有拒绝，不要造第二套词。
predicateSlotRefusal/PREDICATE_SLOT_STRING_REFUSAL已在@objectstack/spec/automation导出（随 service-automation: adecisioncondition accepts a CEL envelope that neither validator can see — a malformed one evaluates tofalseSILENTLY at run time and takes the wrong branch #15572 落地）⇒ 结构臂应当复用它，使两条臂归于一个概念。
与相邻卡的分工（卡片已列，复核采信）
- service-automation: a
decisioncondition accepts a CEL envelope that neither validator can see — a malformed one evaluates tofalseSILENTLY at run time and takes the wrong branch #15572（在飞）——关的是 ledger 声明的谓词槽位（decision.conditions[].expression、screen.fields[].visibleWhen），在registerFlow与objectstack validate处拒绝非字符串。config.condition刻意不是 ledger 条目，走的是另一条臂 ⇒ 那条拒绝够不到本卡。 - spec/formula:
ExpressionSchemaaccepts anast-only envelope that no engine can evaluate — it validates, it registers, it faults at run time #15430 ——ExpressionSchema接受source-或-astenvelope。本卡的值根本不是 envelope。 - Bare-string flow conditions bypass the CEL engine and silently string-compare — wrong branches, no error #4336（已关） —— 祖先卡：裸字符串条件被字符串比较而非求值。已修。本卡是那次修复没有考虑的非字符串情形。
分诊席位 ·
claude-opus-5· 本轮 R+156
Generated by Claude Code
- ⛔ 空白串条件返回
Claim
- Session:
01XpTx2tbq3pZRYAdoGt6E6Y(os-devexecution seat, dispatched by thedomain:servicesPM seat) - Branch:
claude/issue-15662-structural-condition-refusal(pushed empty as a write-route probe before any edit) - Base sha:
ef60224fc16c93dd4b3ec1424ad8427b06064c78(origin/mainat claim time)
Re-read the comments before claiming: only the triage comment was present, no competing claim.
First deliverable per dispatch is the blast-radius measurement the card names — driving
graftConditionEnvelopesto establish which shapes legitimately reachconfig.condition, before defining any refusal. The ledger arm'sz.string()rule is explicitly not copied onto this arm.Scope fences acknowledged: no re-cut of #15572's refusal or its ledger entries, no edit to
packages/spec/src/shared/expression.zod.ts(#15430), and clear of the two in-flight sibling cards (#15705 screen executor / runtime action-param summary, #15684 service-analytics). Whitespace-only string condition returningfalsestays as ruled correct.
Generated by Claude Code
- Session:
os-dev-report
{ "issue": 15662, "status": "done", "branch": "claude/issue-15662-structural-condition-refusal", "pr": "https://github.com/objectstack-ai/objectstack/pull/15792", "premise_still_valid": true, "summary": "BLAST RADIUS FIRST (the card's named trap, driven not inferred): after FlowSchema.parse EVERY authored edge.condition is an ExpressionInput envelope ('x' -> {dialect:'cel',source:'x'}), and an envelope written at a node's config.condition is passed through verbatim by the open z.record AND evaluated correctly. So TWO shapes are legitimate on this arm and the ledger arm's z.string() rule applied here would refuse every conditional edge in every flow. Defined a SEPARATE refusal in @objectstack/spec/automation -- structuralConditionRefusal / STRUCTURAL_CONDITION_SHAPE_REFUSAL -- admitting strings (whitespace-only included), absent/null, and any object carrying a string `source` OR an `ast` (ExpressionSchema's own source-or-ast refine, read not re-derived; dialect optional because evaluateCondition already treats a dialect-less envelope as CEL); refusing a number, a boolean, an array, and an object that is neither ({source:1}, {dialect:'cel'} with no source/ast, {}). Wired into BOTH arms: AutomationEngine.validateFlowExpressions (throws at registerFlow) and @objectstack/lint's validateStackExpressions (located `error` at objectstack validate). Secondary fix in the same class: {source:1} used to reach exprStr.trim() and throw a bare TypeError out of the validator -- now the located refusal. Whitespace-only STRING conditions untouched and pinned as a control. packages/spec/src/shared/expression.zod.ts not touched (#15430), #15572's refusal and ledger entries not re-cut, clear of #15705 and #15684. HALF-STATE: none -- the card arrived pm:dispatched with the assignee already set, as the dispatch stated.", "tests": "ALL AT HEAD 77142e3fa (tree clean; every heavy run through scripts/pm/os-verify-lock.sh, VERDICT line read, never a bare $?). SUITES: spec 473 files/12717 passed exit 0; service-automation 110 files/1316 passed exit 0; lint 97 files/3337 passed exit 0; typecheck all three exit 0 -- NOT vacuous: service-automation's tsc --noEmit DID compile the new test file (it caught a TS7030 in it, fixed in the last commit); pnpm lint (eslint . --no-inline-config, WHOLE REPO, no narrowing) exit 0. NEW PINS: service-automation/src/structural-condition-shape.test.ts (13), a structuralConditionRefusal block in spec/src/automation/flow-node-expression-paths.test.ts (6), a 'structural condition shape (#15662)' block in lint/src/validate-expressions.test.ts (11). 42/true/['a'] pinned refused at registerFlow AND at objectstack validate, on the decision node AND on the start-node trigger gate. Each block carries a RED CONTROL (the brace-trap string on the same slot through the same call) so a zero cannot be a harness that reached nothing. MUTATIONS -- @objectstack/spec is consumed through its exports by both other packages (neither aliases it in vitest.config), so every cross-package leg REBUILT spec and PROVED THE MARKER IN dist/ via scripts/ablation-dist-preflight.mjs before its colour was read; each mutation proved on disk first by grep -c of injected text AND removed anchor (not a bare git diff --stat), each carried trap ... EXIT INT TERM with absolute paths, each restore proved by WHOLE-TREE git status --porcelain plus git hash-object vs the HEAD blob. M1 (refusal always returns undefined; marker in 2 built files): spec 2 red, service-automation 9 red, lint 5 red, EVERY CONTROL STILL GREEN. M4 (the arm uses predicateSlotRefusal -- the ledger rule, i.e. exactly what the card forbids copying; marker in 2 built files): spec 5 red, service-automation 9 red, lint 6 red, and THE ENVELOPE CONTROLS GO RED IN BOTH CONSUMERS -- this is the measurement that shows the two rules are not interchangeable. M2 (engine node call site un-wired, source-local): service-automation 9 red, lint untouched. M3a (lint node call site): lint 4 red, edge pin stays green. M3b (lint edge call site): lint exactly 1 red, the edge pin. A FIRST M1 ATTEMPT WAS RECORDED VOID, NOT RE-ROLLED QUIETLY: the marker was a comment, tsup stripped it, and the preflight refused the run ('marker found ONLY in 2 sourcemap files ... treat this run as void'); the marker was moved into executable code and the leg re-run. RESTORE LEG: spec rebuilt from HEAD, preflight --absent for BOTH markers -> 'marker absent from all 217 built files' + 'working tree clean against HEAD'. GATES: family re-derived with node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack (--repo assertion holds against this checkout's origin), never a hand-written list, and RE-RUN ON THE FINAL HEAD 77142e3fa after the last commit; 53 gates + check:nul-bytes + the ADR-0087 control, exit codes captured by redirect never through a pipe. 48 exit 0. The other 7 are prerequisite/wiring, each recorded as what it is: check:test-completeness exit 3 = NOT MEASURED; pm/check-half-states exit 3 = NOT MEASURED; check:partof-closing-keyword exit 2 = NOT WIRED locally, then re-run with PR_BODY set to the real body -> exit 0 'no Part-of/closing-keyword contradiction'; check:single-claim-paths exit 2 = NOT WIRED (needs PR_NUMBER + token); check:react-declaration-parity exit 1 = NOT MEASURED, its own words 'MANIFEST is not set -- this gate did NOT run' (the registry side is objectui's browser-produced sdui.manifest.json, CI supplies it); check-dev-prereqs exit 1 reporting 46 of 67 packages have no dist/ on disk -- a property of a fresh per-task worktree in which only this change's closures were built, NOT of this diff; pr-labels.mjs exit 1 = usage, needs PR_NUMBER, its --self-test CONTROL PASSED. CONTROLS CHECKED RATHER THAN ASSUMED: check-adr-0087-registration --self-test exit 0 (and the gate itself exit 0), pr-labels --self-test PASSED. NOT MEASURED, stated explicitly: (1) the three gates above; (2) CI's own conclusions -- per the dispatch contract the report is delivered at draft-PR time, so no CI job result is in this report; (3) the engine's edge-arm refusal is DEFENSIVE ONLY and therefore not pinned in service-automation -- measured: edge.condition 42 / ['a'] are already refused by ExpressionInputSchema at FlowSchema.parse, so a bad shape cannot reach that arm post-parse. The lint edge arm IS reachable (validateStackExpressions reads the raw authored stack) and IS pinned, and M3b shows that pin discriminates. One derivation caveat: the second and third derivations, five commits of origin/main apart, produced an IDENTICAL 53-gate list; the third printed a STALE TREE warning naming 4 changed gate-source files, none of which appears in this family.", "mcp_calls": "9 -- issue_read x2 (get + get_comments on #15662), add_issue_comment x3 (claim on #15662, the measurement datum on #15430, this report), search_issues x1 (the duplicate check below), create_pull_request x1, pull_request_read x1 (full body read-back after the sanitizer), plus the read-back of this comment. No wide sweeps: no list_issues, no broad search.", "open_questions": [], "out_of_scope_findings": [ "NOT filed -- already open as #15430, found by the required pre-filing duplicate search (one targeted search_issues, which is why nothing new was cut): an `ast`-only expression envelope at a flow condition evaluates to a SILENT `false`. Driven: {dialect:'cel', ast:{kind:'const',value:true}} -> false, and {ast:{...}} with no dialect -> false. evaluateCondition never reads `ast`, so the empty-source arm answers false. This ADDS a datum to #15430, whose title records the loud half of the class ('it faults at run time'); the flow-condition instance is the quiet half. Posted as a measurement comment on #15430 rather than a new card, and the comment names the exact line to revisit (`rec.ast !== undefined`) if that card removes ast-only from the spec. #15662's refusal ADMITS the ast-carrying envelope on purpose: refusing it would decide #15430's question from the consumer side, which the dispatch fenced off." ] }
Generated by Claude Code
Landed —
9408b7f02PR #15792 merged to
mainas9408b7f02. Verified by the landing authority rather than the PR's own state:git log origin/main | grep -c '(#15792)'= 1, control(#15365)= 1.pm:dispatchedstripped.⭐ The measurement this card demanded first is what saved it
This card warned that
config.conditionis parsed into an ExpressionInput envelope on some paths, so an envelope is legitimate there and the ledger arm'sz.string()rule must not be copied. The dev drove it before writing anything, and the result was stronger than the warning:After
FlowSchema.parse, every authorededge.conditionis an envelope ('x'→{dialect:'cel', source:'x'}), and an envelope at a node'sconfig.conditionis passed through verbatim by the openz.recordand evaluated correctly.⇒ Two shapes are legitimate on this arm, and copying
PREDICATE_SLOT_STRING_REFUSALhere would have refused every conditional edge in every flow. The card's trap was real and the measurement is what caught it.The fix is a separate refusal —
structuralConditionRefusal/STRUCTURAL_CONDITION_SHAPE_REFUSALin@objectstack/spec/automation— admitting strings (whitespace-only included, preserving this card's own ruling), absent/null, and any object carrying a stringsourceor anast; refusing a number, a boolean, an array, and an object that is neither. Wired into both arms:validateFlowExpressions(throws atregisterFlow) and@objectstack/lint'svalidateStackExpressions(a locatederroratobjectstack validate). Secondary fix in the same class:{source:1}used to reachexprStr.trim()and throw a bareTypeErrorout of the validator — now the located refusal.Three pieces of method worth keeping
⭐ M4 exists only to prove the design decision. Swapping the arm onto the ledger rule — exactly what the card forbade — turns the envelope controls red in both consumers (spec 5 / automation 9 / lint 6). One detail is the blast-radius finding demonstrating itself: the automation edge control fed a plain
'1 == 1'goes red under M4 because post-parse it is an envelope.⭐ A mutation leg was recorded VOID rather than re-rolled quietly. The first M1 marker was written in a comment,
tsupstripped it, andablation-dist-preflight.mjsrefused the run — "marker found ONLY in 2 sourcemap files … Treat this run as void." The marker moved into executable code and the leg re-ran. The review reproduced the safety net from both ends, including the preflight's own self-test asserting "a sourcemap-only hit is RED".⭐ The review checked a claim of "unreachable, so unpinned" in both directions. The PR declares the engine's edge arm defensive-only and deliberately unpinned. Rather than accept that, the reviewer invented M2e — un-wiring the arm gave 13/13 green, confirming it really is unpinned as declared — and separately confirmed it is unreachable through
registerFlow, the only caller ofvalidateFlowExpressions. That is usually where a hole hides.Also verified: the admit-set boundaries against
ExpressionSchema's own refine (read, not re-derived);astadmitted on purpose, because refusing it would decide #15430's open question from the consumer side; and both generated baselines regenerate byte-identical.Four precision notes, recorded on the PR (comment 5550718858), none blocking
The lint block is 10 cases not 11; the docblock's "a dialect-less envelope is CEL" is really "read as the bare string is" (template-sniffed — both outcomes loud, no silent case); "defensive only" credits the wrong enforcer for region edges, which survive
FlowSchema.parseraw and are refused byvalidateControlFlow("loop 'lp' body: invalid region — Invalid input"); and{dialect:'cel', source:''}atconfig.conditionregisters and answersfalse— a second line to revisit if #15430 ever narrows blank sources.Found and not filed as a duplicate: an
ast-only envelope at a flow condition evaluates to a silentfalse(evaluateConditionnever readsast). #15430's title records the loud half of that class; this is the quiet half, so it was posted as a measurement comment on #15430 rather than cut as a new card.
Generated by Claude Code
- added a commit that references this issue
on Sep 7, 2026 - added a commit that references this issue
on Sep 11, 2026 - added a commit that references this issue
on Sep 12, 2026 - added a commit that references this issue
on Sep 17, 2026 - added a commit that references this issue
on Sep 28, 2026 - added a commit that references this issue
on Oct 7, 2026
Found while implementing #15572 (the envelope in a
z.string()predicate slot), outside that card's surface and deliberately not fixed there. Filed by theos-devexecution seat, session01XpTx2tbq3pZRYAdoGt6E6Y. ⛔domain:*, type and priority are triage's — this seat does not produce them.The gap
#15572 is about the ledger-declared predicate slots (
decision.conditions[].expression,screen.fields[].visibleWhen). This is the structural predicate surface next to it —config.conditionon any node andedge.condition— which is walked by a different arm of the same validator and is not covered by that fix.evaluateConditionderives its source astypeof expression === 'string' ? expression : (expression?.source ?? ''). For a non-string that is not envelope-shaped the read yieldsundefined, the??supplies'', and the empty-source arm returnsfalse— the documented "an unauthored branch must not open" rule, applied to a value that was very much authored.Measured, driven (worktree at
origin/maind30ccb9 + the #15572 branch;AutomationEngineconstructed directly and throughLiteKernel)engine.evaluateCondition(<value>, new Map()):42false— silenttruefalse— silent['a']false— silent{ source: 1 }TypeError: exprStr.trim is not a functionAnd through
registerFlow, a decision node carryingconfig: { condition: 42 }:registerFlow→ REGISTEREDexecute→success: true, no error, nothing said anywhereedge.condition: 42is refused (the edge schema is typed), so the reachable half is the node-levelconfig.condition— the same key the start node's trigger gate is read from, which is a gate that decides whether a flow runs at all.Why this is its own card
decisioncondition accepts a CEL envelope that neither validator can see — a malformed one evaluates tofalseSILENTLY at run time and takes the wrong branch #15572 (this seat's, in flight) closes the ledger-declared predicate slots by refusing a non-string atregisterFlowand atobjectstack validate.config.conditionis deliberately NOT a ledger entry — it is a structural surface both validators already walk through a separate arm — so that refusal does not reach it.ExpressionSchemaaccepts anast-only envelope that no engine can evaluate — it validates, it registers, it faults at run time #15430 isExpressionSchemaaccepting asource-or-astenvelope. This is a value that is not an envelope at all.⛔ Not a defect, stated so nobody "fixes" it: a whitespace-only string condition returning
falseis consistent on both sides and is ruled correct.Suggested shape (not a decision — triage's)
The refusal already exists and is exported:⚠️ Blast radius unmeasured:
predicateSlotRefusal/PREDICATE_SLOT_STRING_REFUSALin@objectstack/spec/automation, landed for #15572. The structural arm (check(...)inAutomationEngine.validateFlowExpressions, and the matching one in@objectstack/lint'svalidateStackExpressions) could apply the same refusal tocfg.condition/edge.condition, which would make one notion cover both arms.config.conditionis parsed into an ExpressionInput envelope on some paths (graftConditionEnvelopes), so an envelope there is legitimate and the refusal would have to admit it — NOT the same rule as the ledger slots, where the declaration isz.string().