Repository navigation
[finding] The record.* (object-bound form) predicate layer has no path-resolution gate — and cannot soundly get an error-level one until the traversable path set is a closed oracle #7219
Description
Activity
Findings disposition — held; deliberately left unrouted. No ownership taken.
- Grade basis: the card records a measured design boundary, not a defect — the
record.*layer fails open (the Conditional-visibility predicates (visibleWhen/visibleOn) fail OPEN and silently — a broken predicate is indistinguishable from no predicate #5149 family shape), but the sound fix (disposition C: close the traversable path set as a contract, then gate aterror) is a contract decision, and B is measured to be noise-with-extra-steps. - Unrouted by design: the face genuinely spans
domain:engine-core(the ObjectQL path oracle C would close) anddomain:spec-tooling(the gate that would consume it). Routing before the A-vs-C fork resolves would be a guess; named in this round's close-out brief per the two-domain rule. - Not escalated: same family as decision-box entry objectui: metadata-admin 谓词求值器对「无法解析的路径」静默判假(fail-CLOSED),与文件自述的 fail-open 承诺相反 #6936 — C's contract question should ride that ruling rather than open a second slot.
- Restart conditions: ① objectui: metadata-admin 谓词求值器对「无法解析的路径」静默判假(fail-CLOSED),与文件自述的 fail-open 承诺相反 #6936 ruled; ② anyone measures a real authored
record.*predicate failing open in production metadata; ③ the oracle-closing contract work is proposed anywhere (this card is its first consumer).
本评论来自分诊座位 Routine（#5474 试点），不构成认领。
Generated by Claude Code
- Grade basis: the card records a measured design boundary, not a defect — the
Findings triage — route repair only:
domain:specappended. Thefindinggrade is unchanged and no ownership is taken.- Routing rationale: the card's own disposition analysis (recommendation A-then-C) puts the load-bearing half in the contract — disposition C is "declare the traversable path set as a contract", which lands in
packages/specand changes what authored metadata is refusable ⇒ acceptance face ⇒domain:spec, contract-first. The eventual lint gate (thepackages/linthalf, precedentvisibility-predicate-syntaxcalls an over-budget predicate "not valid CEL" and prescribes the dialect — the #7073 defect at the visibility gate #7217 ⇒ spec-tooling) is downstream of that declaration and would ride its own card once the contract exists. - Premise check @
origin/main1da1f32: thedata.*gate feat(lint): publish-time resolution of metadata-form predicate paths (#7010) #7214 landed is live inpackages/lint/src/validate-visibility-predicates.ts(27 record-path references), and norecord.*path-resolution gate exists — the gap is as recorded. - Escalation deliberately NOT filed today: the card itself says C is a contract decision, but it is design-appetite-shaped with no user-visible victim (fail-open parity with the pre-feat(lint): publish-time resolution of metadata-form predicate paths (#7010) #7214 state of the
data.layer, which did get fixed only after Publish-time validation of predicate path references — a spec-delivered predicate naming a nonexistent path should fail at authoring, not evaluate to a guess at render (#6936 companion) #7010 demonstrated the class). Restart: promote toneeds-user-decisionwhen a measuredrecord.<typo>fail-open victim shows up, or when the objectui: metadata-admin 谓词求值器对「无法解析的路径」静默判假(fail-CLOSED),与文件自述的 fail-open 承诺相反 #6936 family forces the oracle question anyway.
本评论来自分诊座位 Routine（#5474 试点），不构成认领。
Generated by Claude Code
- Routing rationale: the card's own disposition analysis (recommendation A-then-C) puts the load-bearing half in the contract — disposition C is "declare the traversable path set as a contract", which lands in
Findings triage (re-verify @
origin/mainc6a4eeb): HOLD —validate-predicate-path-refs.tsstill deliberately excludes therecord.*layer (module note :59, :567), so the recorded gap and the A-then-C recommendation stand unchanged. Exit for disposition C is a contract ruling (close the traversable-path oracle) — decision box when taken up, not dispatchable as-is.findingstands.本评论来自分诊座位 Routine（#5474 试点），不构成认领。
Generated by Claude Code
Findings triage (re-verify @
origin/mainafdc6ea): HOLD —validate-predicate-path-refs.tsstill excludes therecord.*layer by design: the module note at:59("Not closed today, and not closable by this rule") and the skip rationale at:567("see the module note for why therecord.*layer is out") are both verbatim. The recorded gap and the A-then-C recommendation are unchanged, and disposition C still exits through a contract ruling (closing the traversable-path oracle), not through dispatch.findingstands.本评论来自分诊座位 Routine（#5474 试点），不构成认领。
Generated by Claude Code
Maintainer ruling — 2026-08-11. From the four-lens decision review (platform long-term coherence / measured business pull / AI-agent error-resistance / startup scope discipline); the maintainer accepted the recommendation set in full.
Ruling: deliberate defer — this enters the spec seat's strictness-ledger cadence rather than being ruled ad hoc. The ungated
record.*root is intentional and loudly annotated; nothing burns today.findingstays; the strictness cadence is the exit.Recorded by the triage seat Routine (#5474 pilot) on the maintainer's direct instruction — ruling record, not a claim.
Generated by Claude Code
Findings triage round, 2026-08-11 (maintainer-directed). Graded: hold — the card itself proves a sound
error-level gate needs a closed path oracle therecord.*layer does not have; gating on an open set would refuse legitimate paths. Restart: when the addressable path set becomes enumerable (lookup traversal + system columns + formula outputs), or a measured author incident on this layer.
Generated by Claude Code
Finding-grading round: hold stands (maintainer ruled 2026-08-11, comment 5248480685: deliberate defer into the spec seat's strictness-ledger cadence — the cadence is the exit). Recording a round-efficiency note: this card is exempt from per-round re-verification — the last four passes returned identical results against an unchanged file. Re-open triggers only: #4001's strictness cadence reaching this layer, the ObjectQL traversable path set becoming enumerable, or a measured
record.<typo>fail-open incident.
Generated by Claude Code
State-machine migration, maintainer-authorized (2026-08-13, live triage session: 「我授权你先迁标签」; semantics on #8449): graded hold under the 2026-08-11 maintainer ruling (deliberate defer, strictness-cadence exit) —
finding→pm:on-hold. The re-verification exemption and re-open triggers recorded 08-12 stand unchanged.
Generated by Claude Code
关
not_planned—— 维护者逐张复核 on-hold 卡时同意关闭;原定的出口已经不存在分诊席(
session_01Tw7jnJinGHvoGSi8aFkhPJ),2026-09-23T08:00Z。维护者 2026-09-23 在分诊会话里逐张复核pm:on-hold卡,对第二组的回复原文:「8006 保留,其他同意」。本卡在那一组里的建议是关闭,维护者同意了。呈给维护者的事实
- 缺口是真的:表单视图里写成
record.<字段>的显示条件,字段名写错时,运行时会悄悄算错(Conditional-visibility predicates (visibleWhen/visibleOn) fail OPEN and silently — a broken predicate is indistinguishable from no predicate #5149 那一族的形状),作者保存时没有任何提示。 - 为什么没做检查:合法路径是一个开放集合(关联对象的字段、系统字段、公式输出),在开放集合上做
error级检查会误报,做warning级只会变成没人看的噪音。这一点在代码里已经写明:packages/lint/src/validate-predicate-path-refs.ts模块说明第 59 行。 - 原定的出口已经没了:2026-08-11T02:57Z 的裁定(
5248480685)是「刻意延后,进入 spec 座位的收紧节奏」,出口是 未知键静默剥离仍是全仓默认:把 #3405 的 strict 收紧从一个 schema 推广到整个可授权面(ADR-0078 完整性闸门) #4001 的收紧节奏走到record.*这一层。本席 2026-09-23 的全量开放卡快照里 未知键静默剥离仍是全仓默认:把 #3405 的 strict 收紧从一个 schema 推广到整个可授权面(ADR-0078 完整性闸门) #4001 已不在开放列表中(关闭或已不可读)⇒ 这条出口不会再触发。 - 挂起 6 周,没有实测到一起真实事故。
重开条件
有人实测到一起真实的
record.<拼写错误>事故(作者写错了字段,线上表单因此显示或隐藏错了);或者可遍历路径集合变成了可枚举的封闭集合。满足任一条即可重开,按正文里的 A-then-C 推荐继续。关闭理由:
not_planned,同时摘掉pm:on-hold。
Generated by Claude Code
- 缺口是真的:表单视图里写成
Restart-when: #4001 strictness cadence reaches the record.* predicate layer, or the ObjectQL traversable path set becomes enumerable (a closed oracle), or a measured record. fail-open incident
Recorded from #7010 / PR #7214's implementation report (devx PM seat filing; unassigned, ungraded — grading is triage's call). That PR gates the
data.*(metadata-form) predicate layer aterror; this card records why therecord.*layer was deliberately left out, and what the sound follow-up looks like.The gap
A
record.<typo>in a view form's predicate fails open at runtime exactly like thedata.case #7010 closed — silently, the #5149 family's shape. Nothing gates it at authoring time.Why #7214 did not gate it (measured reasoning, not omission)
getMetadataTypeSchemais a closed oracle: the key set is enumerable, so "this path does not resolve" is a fact. An ObjectQL object's addressable path set is open: lookup traversal (record.account.name), system columns the authoredfieldsmap never lists, formula/rollup outputs. Anerror-level gate over an open set manufactures false build errors; awarning-level one produces noise authors learn to ignore — which is silence with extra steps.The three dispositions (from the report, recommendation A-then-C)
warning, accepting noise on legitimate traversal.error. The report's argument: a closed, enumerable path set is also what makes AI-generated metadata refusable at authoring time — C structurally prevents the mistake while B only reports it.C is a contract decision, not an implementation detail — which is why it is a card and not a rider on #7214.
Refs: #7010, PR #7214, #5149 (fail-open family), #6254 (the
data.precedent), #6936.Generated by Claude Code