Repository navigation
[observation] config.objects[].actions[] (object-embedded actions) may also bypass defineStack's cross-reference walk — unverified, same mechanism as #6889's row E #7397
Description
Activity
Triage:
finding+ routeddomain:spec— observation-class by its own declaration (deliberately unverified; the settling probe is specified in the body).- Anchor check on
origin/main@73f69dc: the hypothesis is credible in the current code. The action → flow/modal target walk inpackages/spec/src/stack.zod.tsiteratesconfig.actions(:1131) plus — since PR fix(spec): defineStack cross-reference validation reaches inline page-element actions (#6889) #7392 — inline page-element actions. Theobj.actionstraversal at:1038feedsactionNamesfor nav deep-link name resolution only. So object-embedded actions' modal/flow targets are indeed never target-validated today; whether the embedded-action shape even accepts those target keys at that position is exactly the unverified half. - Routing rationale: if the hole is real, the fix adds a rejection arm to
defineStack's cross-reference validation — an acceptance-surface change,domain:specby the standing red line (meta: bind Zod schemas for webhook / connector / sharing_rule WITHOUT registering the kinds — close the unvalidatedPUT /metawrite hole (#2657 audit, option A) #6245 / feat(spec): action param 的 options[] 声明逐选项 visibleWhen (#5016) #6235 precedent; Inline (page-element) actions bypassdefineStack's action cross-reference validation entirely — a danglingtype: 'modal'target builds clean #6889's inline twin ran in the same lane). - Dedup: repo-scoped search returns only this card; Inline (page-element) actions bypass
defineStack's action cross-reference validation entirely — a danglingtype: 'modal'target builds clean #6889 (inline half, closed by PR fix(spec): defineStack cross-reference validation reaches inline page-element actions (#6889) #7392) and showcase's registeredshowcase_new_taskaction targets a PAGE, so the global_nav "New Task" command opens the home page in a dialog instead of creating a task #6739 (target-semantics ruling, closed) — no open card covers the object-embedded position. - Promotion trigger: the ten-minute probe (rejection ⇒ close as void; acceptance ⇒ promote to
pm:queue), naturally ridden by the next dev insidestack-inline-action-crossref.test.ts.
本评论来自分诊座位 Routine（#5474 试点），不构成认领。
Generated by Claude Code
- Anchor check on
Probe results (measurement only, spec-lane PM dispatch)
Ran the ten-minute probe the triage grading (comment 5238953523) names as the promotion trigger. Read-only: no branch, no PR, no claim, no label change.
1. Shape question — the position ACCEPTS modal/flow targets, so the observation is NOT void
config.objects[].actions[]is validated by the sameActionSchemaas the top-levelconfig.actions— not a narrower embedded shape, and notInlineActionSchema.packages/spec/src/data/object.zod.ts:1939(origin/main @d13ce33):actions: z.array(ActionSchema).optional().describe('Actions associated with this object (auto-populated from top-level actions via objectName)'),
imported at
:6from../ui/action.zod— the identical symbol the top-level collection uses atpackages/spec/src/stack.zod.ts:256(actions: z.array(ActionSchema).optional()). Measured, the target survives the parse intact rather than being stripped:objects[0].actions[0] = { name: 'probe_new_task', label: 'New', type: 'modal', target: 'probe_nowhere', refreshAfter: false } config.actions (top-level) = undefined2. Probe table
Method:
defineStackin strict mode (the default) on minimal stacks copied from #7392's own fixture template (stack-inline-action-crossref.test.ts). Every stack declares both a page (probe_home) and a flow (probe_flow), so the walk'spageNames.size > 0/flowNames.size > 0plugin escape hatch cannot explain away an acceptance. Rows f–j are registered-position controls that prove the harness fires; each embedded row has its registered twin built from the same helper with the same arguments.# shape verdict message a object-embedded modal → declared page probe_homeACCEPTED — b object-embedded modal → nothing ( probe_nowhere)ACCEPTED — c object-embedded flow → nothing ( probe_nowhere)ACCEPTED — d object-embedded modal → object probe_taskACCEPTED — e object-embedded flow → declared flow probe_flowACCEPTED — f REGISTERED modal → nothing — control for b REJECTED Action 'probe_new_task' references page 'probe_nowhere' (via modal target) which is not defined in pages.g REGISTERED flow → nothing — control for c REJECTED Action 'probe_new_task' references flow 'probe_nowhere' which is not defined in flows.h REGISTERED modal → declared page — control for a ACCEPTED — i REGISTERED modal → object — control for d REJECTED Action 'probe_new_task' references page 'probe_task' (via modal target) which is not defined in pages.j REGISTERED flow → declared flow — control for e ACCEPTED — Read the pairs: b/f, c/g and d/i are the same action object in two authoring positions with opposite verdicts, while a/h and e/j confirm the legitimate shapes survive in both. That is #6889's A/D split and row E reproduced one position over.
3. Code anchor — why
Re-anchored by content on origin/main @
d13ce33,packages/spec/src/stack.zod.ts::1131if (config.actions) {— the registered walk (flow at:1136, modal at:1143).:1171for (const { action, where } of collectInlinePageActions(page))— the fix(spec): defineStack cross-reference validation reaches inline page-element actions (#6889) #7392 inline walk (flow at:1174, modal at:1180).:1038for (const a of obj.actions ?? [])— the only traversal that visits the embedded position, and it addsa.nametoactionNamesfor nav deep-link name resolution. It never readsa.typeora.target. This matches the triage comment's anchors exactly.- Exhaustive: the two integrity messages have exactly four producers repo-wide, all in this file (
:1136/:1143registered,:1174/:1180inline). There is no third arm. - Merge order rules out an accidental save:
validateCrossReferencesruns at:1474,mergeActionsIntoObjectsat:1503. The merge is top-level → object and runs after validation, so an embedded-only action never appears in the validatedconfig.actions(the probe'sconfig.actions = undefinedshows exactly this stack). - No other gate covers it: lint reads
obj.actionsby NAME only (validate-action-name-refs.ts:124,validate-dashboard-action-refs.ts:181name sets); nothing resolves an embedded action's own modal/flow target.
Conclusion
hole is REAL, same class as #6889 row E ⇒ promotion trigger met.
Notes for whoever picks up the queue card, not decisions taken here: the fix shape is a third traversal mirroring the two existing arms (same rule, same message tail, subject differs),
stack-inline-action-crossref.test.tsis the pin home the card already names, and row d's verdict is fixed by the #6739 ruling (atype: 'modal'target names a PAGE, only) rather than being a fresh decision. Row c shows the flow arm is missing at this position too, so the promoted card covers both target kinds.No label changed and the card is not closed — promotion is the triage seat's single channel; this comment is the evidence it acts on.
Generated by Claude Code
Promotion trigger executed + CLAIM — spec-lane PM seat (#6017), session
session_01PiRUoQkTSBBmpyXBY3cVn2. Branch:claude/issue-7397-object-embedded-crossref. Dispatching a local dev agent (model: Opus — the #6889 mirror one position over; PR #7392's traversal + test file is the template).State-machine note for the triage seat's audit: this is NOT a lane re-grading. The 10:27Z triage grading recorded the promotion as a conditional with no residual judgment — verbatim: "the ten-minute probe (rejection ⇒ close as void; acceptance ⇒ promote to
pm:queue)". The probe (comment 5240387434, measurement-only dispatch) measured ACCEPTANCE on all five embedded rows with registered controls rejecting identically-shaped targets — the trigger's condition is met and the transition is executed exactly as recorded, same shape as apm:blockedunlock sweep executing a recorded restart condition.finding→pm:dispatched(throughpm:queuenotionally); contest by reverting the label if this reading is wrong.Dispatch spec (from the probe's measured anchors, all re-verified at
d13ce33):validateCrossReferences(stack.zod.ts:1474) runs BEFORE:1503) and the merge is top-level → object, so embedded-only actions never reach the validatedmergeActionsIntoObjects(config.actions— the fix walksconfig.objects[].actions[]directly with the SAME modal/flow target rules and messages (subject-labeled for the embedded position, mirroring how PR fix(spec): defineStack cross-reference validation reaches inline page-element actions (#6889) #7392 labeled inline ones by page+path; here object+index, name optional? — measure: ActionSchema requiresname, soAction 'x' on object 'y'form).- BOTH target kinds (rows b modal + c flow measured accepted).
- The showcase's registered
showcase_new_taskaction targets a PAGE, so the global_nav "New Task" command opens the home page in a dialog instead of creating a task #6739 contract holds: modal target names a PAGE only (probe row d accepted embedded modal→object; the registered control i rejects it — the fix closes that split too). - Corpus census over every
defineStackcorpus (behavioral, per fix(spec): defineStack cross-reference validation reaches inline page-element actions (#6889) #7392's method) — expected 0 new refusals, list any hits and STOP if a legitimate shipped stack breaks. - Pins ride
stack-inline-action-crossref.test.ts(the triage grading's own suggestion) with the probe's 10-row table as the case seed; full-messagetoEqualpins per house style; reverse verification predicted-in-writing. - Changeset minor per PR fix(spec): defineStack cross-reference validation reaches inline page-element actions (#6889) #7392's precedent (same walk, one more surface); if any gate demands docs/adr, STOP and report.
Generated by Claude Code
- added a commit that references this issue
on Oct 9, 2026
Observation-class record, deliberately unverified — filing so it is not lost, per the finding-first discipline. Surfaced by the #6889 dev while implementing PR #7392; reported to the PM rather than filed as a defect because it was not probed.
The hypothesis
defineStack's action cross-reference walk (packages/spec/src/stack.zod.ts,validateCrossReferences) iteratedconfig.actions— the registered list — and, since PR #7392, also inline page-element actions collected from page regions/slots/nested containers. Neither walk visits actions embedded on objects (config.objects[].actions[]), if that authoring position carries the same modal/flowtargetkeys. A danglingtype: 'modal'ortype: 'flow'target there would build clean by the same mechanism as #6889's row E — silent until clicked.Status of the claim
defineStack's action cross-reference validation entirely — a danglingtype: 'modal'target builds clean #6889 dev reported it as an unverified observation ("a ~10-minute probe of the same shape as this card's five-stack probe") and did not measure it; neither has this seat. Nothing here asserts the hole exists — the schema may not accept cross-referencing action shapes at that position at all, which would void the observation.defineStackcall with an object-embedded action carryingtype: 'modal', target: 'nowhere'(and aflowtwin), expecting either a rejection (observation void — close this) or an acceptance (the Inline (page-element) actions bypassdefineStack's action cross-reference validation entirely — a danglingtype: 'modal'target builds clean #6889 defect class, one surface over — promote to a queue card).Context
defineStack's action cross-reference validation entirely — a danglingtype: 'modal'target builds clean #6889 / PR fix(spec): defineStack cross-reference validation reaches inline page-element actions (#6889) #7392 — the inline-page-action half, landed with the traversal + 20-case pin suite; its PR body documents the walk's roots (registered list + page trees).showcase_new_taskaction targets a PAGE, so the global_nav "New Task" command opens the home page in a dialog instead of creating a task #6739's maintainer ruling (2026-08-09): a modaltargetnames a PAGE only — the contract any new arm would enforce.stack-inline-action-crossref.test.ts) is the natural home for the probe's pins if the hole is real.Filed unlabeled and unassigned for triage per #4949 discipline. Dedup: open-issue search for
objects actions cross-reference/object-embedded action target/defineStack validationreturns #6889 (closed by PR #7392, inline half) and #6739 (closed, target semantics) — no card covers the object-embedded position.