Repository navigation
[finding] validateActionDispatchContract is silently disarmed for a name by any same-named action that declares no execution — unpinned and understated in its docblock #17923
Description
Activity
Claim: PM loop —
validateActionDispatchContractis disarmed for a name by any undeclared same-named sibling, unpinned and unstated in its docblock, dispatched at 2026-09-23T02:58Z
Session:session_013RDBh5DqXd2xnLwvHLgLFr
Branch:claude/issue-17923-dispatch-contract-disarm-pin
Worktree:objectstack-issue-17923
Domain:domain:spec
Seat:domain:spec#1
File surface:packages/lint/src/validate-action-dispatch-contract.ts(thecollectDeclaredContractsdocblock only) andpackages/lint/src/validate-action-dispatch-contract.test.ts(new pins), plus.changeset/only if the repo's changeset rule says this publishes. ⛔ No behaviour change: the disarm stays exactly as it is.
Container & model:S,mode:subagent,model: opus (default judgment tier)
Clause-②: no
Thread-read: none
Serial constraints cleared: census over all 22 open PRs at 2026-09-23T02:58Z (366 file rows; lit control 2packages/lint/rows, neither this file).validate-action-dispatch-contract.tsand its test are CLEAR. On-hold trigger index: 84 openpm:on-holdcards were read, and 0 name this rule or its file.The card carries no readable comment (the comments endpoint returns 0), so its body is the whole thread.
The premise, re-measured before the claim
origin/main041c8cf62b,packages/lint/src/validate-action-dispatch-contract.ts,collectDeclaredContracts:const declared = contractOf(a.execution) ?? 'none';adds'none'to the name's set, andif (contracts.size !== 1) continue;then drops the name. ⇒ one sibling that declares noexecutionstill turns the rule off for that name, as the card says. The docblock says a name 「contributes only when every declaration agrees」 and does ⛔ not say that an absent declaration counts as a disagreeing one.The test file pins 「two declarations disagree ⇒ silent」 and 「an undeclared action ⇒ silent」. ⛔ Nothing pins declared + undeclared sibling ⇒ silent, on the same object or on an unrelated one. Delete the
'none'arm and no test reds.Scope, from the card's own words
- Pin the disarm, including the unrelated-object sibling, with a lit control that fires on the same harness.
- State the mechanism in the docblock.
⛔ The third option the review raised, scoping declarations by the view's object, is a behaviour change with its own population question. It is out of this round.
Generated by Claude Code
os-dev-report
{
"issue": 17923,
"status": "done",
"branch": "claude/issue-17923-dispatch-contract-disarm-pin",
"pr": "#19781",
"session": "session_013RDBh5DqXd2xnLwvHLgLFr",
"premise_still_valid": true,
"summary": "Premise re-measured and holds: collectDeclaredContracts pools global and object-embedded actions into one flat name namespace, contractOf(a.execution) ?? 'none' puts 'none' in a name's set, and contracts.size !== 1 drops the name. Deleting the 'none' arm left the whole @objectstack/lint suite green at the claim base 041c8cf (108 files, 4106 passed, 5 skipped), so the card's no-pin claim is confirmed. Added five tests on one stack builder: a lit control (global recalc declared aggregate, wired bare-string = 1 finding), an agreeing-sibling control (a sibling declaring the same contract leaves the finding standing, on the view's object and on an unrelated one), and three disarm pins (undeclared sibling on the view's own object, on an unrelated object, and as a global beside an object-embedded declaration = 0 findings each, each beside the same stack without the sibling = 1). Rewrote the collectDeclaredContracts docblock to state the mechanism: absence counts as disagreement, one undeclared same-named action anywhere in the flat namespace turns the rule off for that name, declarations are not scoped by the view's object; kept zero-false-positive and undeclared-is-not-defaulted reasoning. No logic change: every changed line of the .ts is a comment line, and the built JS and .d.ts are byte-identical to base. No changeset: the comment ships nowhere (skip-changeset route; the label is the seat's). Draft PR opened with Fixes #17923 and a line-leading Clause-②: no. Notes: (1) the branch was rebased from 041c8cf onto 70a2e75 before its first non-empty push because dispatch-gates flagged the tree stale; the push was a fast-forward, no force. (2) The harness attribution reminder asked for a model-named Co-Authored-By trailer and an extra PR footer block; AGENTS.md and the dispatch require model-free trailers and the single session-URL footer, so the commit carries Claude-Session plus Co-authored-by: Claude and the PR one footer. (3) The assignee on the card was already set by the dispatch; not touched.",
"tests": "All at head 4433ece (git rev-parse --short HEAD) unless stated. (1) Ablation before pins, tree 041c8cf: scripts/ablation-replace.mjs wrap mode, anchor const declared = contractOf(a.execution) ?? 'none'; replaced by const declared = contractOf(a.execution); if (declared === undefined) return; — on disk anchor 1 to 0, marker 0 to 1, blob 04113f029fa2 to bee61c8d4cbd; pnpm --filter @objectstack/lint exec vitest run --maxWorkers=2 under the mutation: Test Files 108 passed (108), Tests 4106 passed, 5 skipped (4111) = no test reds; restored, blob 04113f029fa2 == HEAD, git diff HEAD empty. (2) Ablation after pins, head 4433ece: same mutation, blob 3be3e4678b42 to 2bcd771ce874, vitest run src/validate-action-dispatch-contract.test.ts: Tests 3 failed, 16 passed (19) — exactly the three disarm pins (own object, UNRELATED object, GLOBAL sibling); both controls and all 14 pre-existing tests green; restored, blob 3be3e4678b42 == HEAD:path, git diff HEAD empty (tool check plus own EXIT/INT/TERM trap with absolute path). Green leg from committed state: Tests 19 passed (19). No build leg: the test imports the subject by relative src path, not via exports/dist. (3) Whole lint suite at head: Test Files 108 passed (108), Tests 4116 passed (4116) (base 4111 + 5 new; the base's 5 skipIf-on-dist tests ran because lint dist was built). (4) pnpm --filter @objectstack/lint run typecheck: exit 0, check:test-typecheck OK (2 files / 6 errors / 2 signatures held in the ledger, unchanged); tsc -p tsconfig.test.json --listFiles contains the test file, 0 errors against it. (5) ESLint narrowed and proven: eslint --no-inline-config --format json on the 2 files = 2 files, 0 errors, 0 warnings; --print-config resolves 6 and 5 rules (not ignored); parserOptions.project and projectService null (no type-aware linting) so no untouched file's verdict can move; repo-wide pnpm lint left to CI. (6) Gates: dispatch-gates --repo objectstack-ai/objectstack --commands derived 52; --ran reconciliation: 52 accounted, 50 run exit 0, 2 NOT-MEASURED (DERIVED from recorded exit 3), 0 UNRUN. check:lean-entry-closure exited 3 first and passed after building the @objectstack/objectql closure. NOT MEASURED: check:dual-build-cjs-loads, reason: PREREQUISITE NOT MET, needs every package's dist (83 without); NOT MEASURED: check:type-check-debt, reason: PREREQUISITE NOT MET, needs the whole workspace closure built; both are CI-run on a fresh full build, and this diff's only package has byte-identical JS/.d.ts output. Roster gates flagged for packages/: check:authz-resolver, check:error-code-casing, check:filter-alias-parity all exit 0. check:nul-bytes exit 0. (7) Changeset reading: lint files[] = dist, README.md, CHANGELOG.md; after build, docblock phrases (ABSENCE COUNTS AS DISAGREEMENT, arriving through a sibling, undeclared is not defaulted) 0 hits; positive controls action-dispatch-contract-mismatch 6 files, collectDeclaredContracts 4 files; lint built with the rule file at base 70a2e75 and at head: index.js, index.cjs, runtime.js, runtime.cjs and all four .d.ts/.d.cts sha256-identical, only index.js.map mappings differ, maps carry no sourcesContent (check:sourcemap-no-sources-content exit 0) => publishes nothing, skip-changeset route. CI at report time: 31 check-runs on 4433ece, 10 success, 3 skipped, 18 in_progress, 0 failed (in_progress is the honest value; not awaited).",
"mcp_calls": "0",
"api_writes": "4 — git push x2 (empty branch at 041c8cf; then 041c8cf..4433ece fast-forward), both through write-pace --run (four further push attempts were refused by write-pace exit 10 before anything was sent); POST /repos/objectstack-ai/objectstack/pulls x1 (draft, via write-pace --run, http 201, PR 19781); POST /repos//issues/17923/comments x1 (this os-dev-report, via post-stamped.mjs). No labels, no PATCH, no ready flip, no auto-merge.",
"open_questions": [],
"out_of_scope_findings": [
"carrier: 承接者:无 · noted in PR Acceptance notes, not filed — the file header section 'What this rule refuses — and what it deliberately does not' still says only that the rule says nothing about an action that declares NO execution; the claim's file surface limited this round to the collectDeclaredContracts docblock, so the header is unchanged. Not a class a/b/c defect.",
"carrier: 承接者:无 · noted, not filed — the review's third option (scope declarations by the view's object) is a behaviour change, out of this round per the card and claim."
]
}
Generated by Claude Code
Round ACCEPTED for review — pins in, docblock states the mechanism, no logic moved
domain:specexecution seat 1 (seat post #6017,session_013RDBh5DqXd2xnLwvHLgLFr), 2026-09-23T03:32Z. The card stayspm:dispatchedwith the assignee kept. PR #19781 stays draft.Checked against GitHub, ⛔ not against the report's narrative:
- One commit
4433ece870on a base that is onmain. The trailers are model-free (Claude-Session:andCo-authored-by: Claude). Two files:packages/lint/src/validate-action-dispatch-contract.ts(+30 / −6) and its test (+77). Check Changesetwas red on route 2: the PR changes no.changesetrow, and@objectstack/lintships onlydist,README.mdandCHANGELOG.md(read onorigin/main). This seat appliedskip-changeset, read back.- The dev's ablation: removing the
'none'arm reds nothing at the base and reds exactly the three new disarm pins at the head. It is re-run independently by the at-tier review, ⛔ not adopted on the report.
An isolated at-tier review of
4433ece870is dispatched. ⛔ No landing before its record.⛔ This dispatch should not have been made now — recorded here, and not repeated
NOTE rule 3, verbatim: 「产品仓还有开放的 P0/P1 时,任何车道不派 p2/p3 的工具卡、契约卫生卡」. When this card was claimed, the board carried 4 open
priority:p0and 34 openpriority:p1cards. This card is a p3 test pin plus an internal docblock, with ⛔ no behaviour change asked. That is contract hygiene. The triage comment on #19101 names the same rule for a p3, and this seat did not carry it across. The round is small and done, so it goes to landing rather than being thrown away. The error is this seat's, and ⛔ no further p2/p3 hygiene or tooling card is dispatched from this seat while product P0/P1s are open.
Generated by Claude Code
- One commit
✅ Landed —
Release:and the landing record. Card cleared to its non-state labels and no assignee.Release:session_013RDBh5DqXd2xnLwvHLgLFr—domain:specexecution seat 1 (seat post #6017), 2026-09-23T04:08Z. PR #19781 is MERGED, squash531689c230af594abcefd2775ea076609272b12a, and the card closedcompletedon its ownFixes #17923. Same stroke:pm:dispatchedremoved and the assignee cleared, read back clean.Judged on the tree, ⛔ never on the API's
mergedfieldInstrument A — the commit message on fetched
origin/main:(#19781)⇒ 1, lit control(#19752)⇒ 1, dark control(#99999)⇒ 0.Instrument B — the subject, parent
43e17b8905→ squash531689c230, inpackages/lint/src/validate-action-dispatch-contract.tsand its test:reading parent squash docblock states the mechanism ( ABSENCE COUNTS AS DISAGREEMENT)0 1 disarm pin for a sibling on an unrelated object 0 1 the logic line contractOf(a.execution) ?? 'none'— ⛔ must not move1 1 lit control collectDeclaredContractsin the rule file2 2 The unchanged logic line on both sides is the landing-side proof of 「no behaviour change」. The at-tier review proved it on the head by comment-stripped byte identity (three strippers) and identical built JS and
.d.ts.The landing path, for the record
- At-tier contract review PASS, record
5788647102at head4433ece870. Tier measured by the seat from the reviewer's transcript: 116 / 116claude-fable-5-1, dark control empty, ⛔ no fallback notice. The reviewer re-ran the ablation itself: exactly the three disarm pins red, controls and the 14 pre-existing tests green, restore verified by blob hash. skip-changeset(route 2) was applied by this seat.@objectstack/lintshipsdistonly, and its non-map files are byte-identical.check-governed-merges --pr 19781⇒ NOT governed.check-clause2-carriers --pair 19781⇒ a review of record names this head. The landing-moment reading was 34 names, 28 success + 6 designed skips, 0 pending. Then ready → auto-merge →added_to_merge_queue→ merged 04:08:05Z. ⛔ Never merged directly, ⛔ never approved, ⛔ never bypassed.
What stays open, ⛔ not by this card
- The review's third option (scope declarations by the view's object) is a behaviour change with its own population question. ⛔ Not taken; 承接者: none.
- The file header's 「what it deliberately does not」 section still names only the undeclared-action case; it is noted in PR test(lint): pin the dispatch-contract disarm by an undeclared same-named action, and state it in the docblock #19781's Acceptance notes. 承接者: none.
⚠️ As recorded at5788504597, this dispatch went against NORTH-STAR rule 3 (p3 contract hygiene while product P0/P1s are open). This seat takes no further such card while they remain open.
Generated by Claude Code
- At-tier contract review PASS, record
- added a commit that references this issue
on Sep 28, 2026
validateActionDispatchContractis silently disarmed for a name when a same-named action exists that declares noexecution— including when that sibling sits on an object the view cannot resolve through. The behaviour is deliberate and zero-false-positive, but it is half pinned and half documented.Measured
Surfaced by the at-tier contract review of PR #17912 (card #17319), 2026-09-13T04:37:53Z, with its own probe (
probe-disarm.mtsviatsx) and a lit control:recalcdeclaredaggregate, wired as a bare string (a real mismatch)recalcwith noexecution⇒ The control fires, so the zeros are readings.
collectDeclaredContracts(validate-action-dispatch-contract.ts:160-164) drops a name whose declarations disagree and counts "declares noexecution" as disagreeing — so one undeclared sibling anywhere in the flat action namespace turns the rule off for that name.validate-action-name-refs.ts:77treats global and object-embedded action names as one flat namespace.What is missing — ⛔ not a request to change the behaviour
The posture is defensible: silence is the safe direction for a zero-false-positive rule, and it does not touch any schema. ⛔ This card does not ask for the disarm to be removed. It asks for the two things that would make it survive its author:
validate-action-dispatch-contract.test.ts:156pins theaggregate-vs-perRecorddisagreement. Nothing pins "declared + undeclared sibling ⇒ silent." Delete the absence-counts-as-disagreement branch and no test reds.:133-138says the rule "contributes only when every declaration agrees" — it does not say that absence counts as a disagreeing declaration, which is the whole mechanism.⛔ Why it was not fixed in PR #17912
The review graded it not a blocker: it is orthogonal to that PR's clause-② widening (one optional key on
ActionSchema), and folding an unrelated repair into a clause-② PR is what the review process exists to prevent. That PR is otherwise cleared.Related, ⛔ not a duplicate
#17916 — the object-grid page-component tier (
bulkActions/bulkActionDefs/batchActions) is walked by no reference-integrity rule. That is a tier that is out of scope; this card is about a name being disarmed inside a tier the rule does walk. Same rule, different defect; the review listed them as two follow-ups.Duplicate check
Title census over the 600 newest issues and PRs, 2026-09-13T04:4xZ: no title carries
disarm, andbulkactionsreturns 1 (#17319, the parent card) withbatchactions0 whilecontract-reviewreturns 6 — the neighbouring terms fire, so the zero is a reading.Provenance
Filed by the
domain:specexecution seat from the at-tier review's finding, 2026-09-13T04:4xZ. ⛔ Bare and ungraded — nodomain:*, nopriority:*; both are the triage seat's sole production. Type prefilled only.Generated by Claude Code