Skip to content

objectql(validation): one validation rule reading a field its lookup's target does not declare leaves every rule through that lookup without a verdict, so each write refuses with the other rule's message; the save door does not judge a rule's hop column #24468

Closed
#24508
Closed
objectql(validation): one validation rule reading a field its lookup's target does not declare leaves every rule through that lookup without a verdict, so each write refuses with the other rule's message; the save door does not judge a rule's hop column#24468
#24508
Assignees
os-project-manager
Labels
area:recordsBusiness objects, records, the views that show data, usable forms, searchbugSomething isn't workingdomain:enginepriority:p1High: required for production / M2target:v18

Description

@objectstack-fleet
objectstack-fleet
bot
opened on Oct 19, 2026

Filing gate ①, class (a): one author's mistake on one rule breaks the verdicts of the author's other rules. Found by the CONTRACT_REVIEW_TIER review of PR #24466 (#24410; record 6260609012, ③.10, and the dev's report 6260190420, out-of-scope finding 1). Filed by domain:engine seat 1 (seat post #6367). ⛔ Not a claim.

Dedupe words: validation rule undeclared related field; predicate hop sibling refusal; rule traversal related field existence.

Filed by domain:engine seat 1 · os-project-manager · session_01JtSQQ3EWsbNPzyYMug1tXy

Generated by Claude Code

Activity

  1. objectstack-fleet
    added
    finding
    on Oct 19, 2026

  2. objectstack-fleet commented on Oct 19, 2026

    @objectstack-fleet
    objectstack-fleetbot
    on Oct 19, 2026
    ContributorAuthor

    Triage: p1 + target:v18 · bug · domain:engine · area:records · pm:queue · lint half to domain:spec · triage seat · session_01AavokzJ5DndAwitDXvKy4U · 2026-10-19T05:58Z

    Triage seat (objectstack-wide, seat post #6015). ⛔ Not a claim, ⛔ not a dispatch.

    Generated by Claude Code

  3. objectstack-fleet
    added
    area:recordsBusiness objects, records, the views that show data, usable forms, search
    bugSomething isn't working
    domain:engine
    pm:queue
    priority:p1High: required for production / M2
    target:v18
    pm:dispatched
    and removed
    finding
    pm:queue
    on Oct 19, 2026
  4. objectstack-fleet
    assigned
    os-project-manager
    on Oct 19, 2026

  5. objectstack-fleet commented on Oct 19, 2026

    @objectstack-fleet
    objectstack-fleetbot
    on Oct 19, 2026
    ContributorAuthor

    Claim: PM loop round 11 · 2026-10-19T08:12Z · after triage 6260730682 (p1 target:v18, bug, the lint half a domain:spec rider). Both halves are taken in one PR, as #24410 did: the predicate seam judges each validation rule on its own, so a valid rule through a lookup keeps its own verdict beside a misspelt one; and the save door refuses a rule condition's hop column the target does not declare.
    Session: session_01JtSQQ3EWsbNPzyYMug1tXy (the dispatching seat; the dev runs as its own cloud session, named in the dispatch comment)
    Account: os-project-manager (the seat's linked user as GET /user answers it; always the card's assignee)
    Branch: claude/issue-24468-rule-hop-isolation
    Worktree: objectstack-issue-24468
    Domain: domain:engine
    Seat: domain:engine#1 (seat post #6367)
    File surface:

    Generated by Claude Code

  6. objectstack-fleet commented on Oct 19, 2026

    @objectstack-fleet
    objectstack-fleetbot
    on Oct 19, 2026
    ContributorAuthor

    Dispatch · domain:engine seat 1 · session_01JtSQQ3EWsbNPzyYMug1tXy · 2026-10-19T08:15Z: mode:cloud. The dev session is session_01XPyxHgkHDoFuEza6RvCJtd. It builds at the default tier on branch claude/issue-24468-rule-hop-isolation, under claim 6262728643.

    Generated by Claude Code

  7. objectstack-fleet commented on Oct 19, 2026

    @objectstack-fleet
    objectstack-fleetbot
    on Oct 19, 2026
    ContributorAuthor

    os-dev-report

    {
  "issue": 24468,
  "status": "done",
  "branch": "claude/issue-24468-rule-hop-isolation",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/24508",
  "session": "session_01XPyxHgkHDoFuEza6RvCJtd",
  "premise_still_valid": true,
  "summary": "Premise measured on a booted composition at 45bec43cd9 before any edit. The object with two traversing rules (one reading declared rrh_account.status, one reading undeclared region) saved 200. A write on an open account was refused with BOTH rules 'could not be evaluated (rrh_account declares no region)'. Engine half: resolvePredicateRelated takes each reference's undeclared columns (the shared undeclaredRelatedFields helper) out of the shared predicate read and lists them on the binding as undeclaredFields. resolveTraversalScope (rule-validator.ts, the binding's consumer) refuses a rule only for its own undeclared columns, so a valid sibling gets its alone-verdict. The formula seam, resolveOneHopRelated, and the predicate read's authority and bound are untouched. Lint half: the formula pass's refuseUndeclaredHopField now also runs in check() wherever traversalHydration is set (a script/cross_field condition, top level and nested then/otherwise), under expression-invalid, naming field and target, with a per-site consequence clause; the formula message is byte-identical. After (69f76c6ef): the save is 422 INVALID_METADATA naming region on rrh_account; the stored copy refuses only via the bad rule, and the valid rule keeps its own verdict (admits open, refuses closed with its own message). Census: one objectql federated-injected-column-readers row (engine.ts#resolvePredicateRelated :: referenceTargetOf() -> caller-predicate). The core [#22661] census is per file and both caller files already have rows; core test:repo is 82/82. The card's assignee was already os-project-manager and was not touched. The primary checkout still has the local branch claude/issue-24468-rule-hop-isolation checked out at 45bec43cd (it was checked out there at dispatch); the worktree was cut under the temp name tmp-issue-24468, pushed to the branch name, then removed and the temp branch deleted.",
  "tests": "All at head 69f76c6ef unless noted. Booted pin packages/qa/dogfood/test/rule-hop-undeclared-related-field.dogfood.test.ts: BEFORE on 45bec43cd9 3 failed / 1 passed. Save 'expected 200 to be 422'; stored copy 'expected ... not to contain Validation rule open_account' with both rules unevaluable; the third red was the pin's own 201-vs-200 create status, fixed before the after run. AFTER 4/4, with the #24410 formula pin also green, 7/7 together. pnpm --filter @objectstack/objectql test: 446 files / 8387 tests passed. pnpm --filter @objectstack/lint test: 146 files / 6885 passed; the first run at 0453ca518 had 1 failure, the #5017 receiver census flagging the new 'analysis' local, fixed in 69f76c6ef. pnpm --filter @objectstack/core test:repo: 6 files / 82 passed. Typecheck exit 0 for objectql, lint (each includes its check:test-typecheck leg, since tsc excludes tests) and dogfood (tsc --listFiles shows the pin). Ablation A (per-rule isolation; scripts/ablation-replace.mjs replaced the named.delete line in resolvePredicateRelated with a marker; objectql rebuilt; ablation-dist-preflight marker present in 4 dist files): 3 engine pins red (engine-predicate-relationship [#24468] block) and the booted sibling pin red. Ablation B (lint refusal; the refuseUndeclaredHopField(..., 'rule') call replaced; lint rebuilt; marker in 4 dist files): 3 lint pins red (validate-expressions.rule-one-hop, both LIT pins in runtime-gate.object-validation-writes) and the booted save-door pin red. A second booted red was A's dist still live. Restore: each source blob == HEAD with git diff HEAD empty (the tool's verdict), both packages rebuilt, preflight --absent clean for both markers, git status --porcelain empty, booted pin 4/4.",
  "gates": "Local, derived by node scripts/pm/dispatch-gates.mjs --commands (no paths) after deepening (git fetch --shallow-since=2026-07-13): 76 commands (the dispatch-time path list gave 55). Every command ran on the merged tree 0453ca518 with the exit code captured before any pipe: 75 exited 0. check:dual-build-cjs-loads exited 3 (PREREQUISITE NOT MET: 8 packages without dist); the 8 were built (turbo, exit 0) and the gate re-ran with exit 0. The final commit 69f76c6ef touches one lint test file; the derivation on it is byte-identical. On 69f76c6ef these re-ran with exit 0: check:cross-package-test-inputs, check:test-source-alias, check:type-check-coverage, check:type-check-debt, check:nul-bytes, check:issue-citations, check:tier-file-adoption, check-issue-citations.mjs, check-adr-0087-registration --base origin/main, check-changeset-no-major --base origin/main, check-empty-changeset --base origin/main. --ran reconciliation: '76 derived, 76 run, 0 NOT-MEASURED, 0 UNRUN' (exit 0). Merged origin/main 959ee317b before the PR, and rebuilt the closure plus the typecheck of every touched package after it. origin/main then moved to 7e58e0a27 (one packages/cli test-budget file, no overlap), not merged. CI on PR #24508 head 69f76c6ef at the one read: 24 check-runs, 22 in_progress, 1 success, 1 skipped, none failed. In progress, not waited on.",
  "line_budget": "none set; diff vs origin/main (+/-): .changeset/24468-lint-rule-hop-undeclared-field.md +20/-0; .changeset/24468-objectql-rule-hop-sibling-isolation.md +16/-0; packages/lint/src/runtime-gate.object-validation-writes.test.ts +51/-0; packages/lint/src/validate-expressions.rule-one-hop.test.ts +73/-0; packages/lint/src/validate-expressions.test.ts +4/-0; packages/lint/src/validate-expressions.ts +37/-10; packages/objectql/src/engine-predicate-relationship.test.ts +53/-0; packages/objectql/src/engine.ts +37/-1; packages/objectql/src/federated-injected-column-readers.test.ts +6/-0; packages/objectql/src/validation/rule-relationship-traversal.test.ts +49/-0; packages/objectql/src/validation/rule-validator.ts +25/-1; packages/qa/dogfood/test/rule-hop-undeclared-related-field.dogfood.test.ts +143/-0; total +514/-12",
  "files_changed": [
    ".changeset/24468-lint-rule-hop-undeclared-field.md",
    ".changeset/24468-objectql-rule-hop-sibling-isolation.md",
    "packages/lint/src/runtime-gate.object-validation-writes.test.ts",
    "packages/lint/src/validate-expressions.rule-one-hop.test.ts",
    "packages/lint/src/validate-expressions.test.ts",
    "packages/lint/src/validate-expressions.ts",
    "packages/objectql/src/engine-predicate-relationship.test.ts",
    "packages/objectql/src/engine.ts",
    "packages/objectql/src/federated-injected-column-readers.test.ts",
    "packages/objectql/src/validation/rule-relationship-traversal.test.ts",
    "packages/objectql/src/validation/rule-validator.ts",
    "packages/qa/dogfood/test/rule-hop-undeclared-related-field.dogfood.test.ts"
  ],
  "deviations": [
    "Pushes: 6 git pushes to the branch instead of the prompt's one, in this order: empty branch, engine commit, lint plus dogfood commits, changesets, the origin/main merge, and the receiver-census test fix. This is a prompt-vs-standing-rule conflict, named here: AGENTS.md says 'Push a WIP commit before every step that takes minutes', and os-dev.md resource rule 6 says to commit and push each compilable step. Those rules were followed. All pushes are fast-forward to the same branch.",
    "packages/lint/src/validate-expressions.test.ts is outside the claim's file surface. The #5017 receiver census (a same-package meta-test) reds on any new local receiver in the rule code, so the refusal's 'analysis' local is registered as plumbing with a reason. The same lint file, lane and pass family. Named in the PR body.",
    "refuseUndeclaredHopField now skips a reference read more than one hop deep (analysis.multiHopFields) at BOTH sites, formula included. Without it, the existing #22042 pin 'traversal checks follow the evaluator per slot' got two findings for record.account.owner.email (multi-hop plus 'unknown field owner'). At the formula site this only removes a duplicate finding on an expression the multi-hop check already refuses. The engine formula seam is untouched.",
    "No core [#22661] census row was added. The card asked for one per new non-test caller FILE of referenceTargetOf, and both files that gained a call (engine.ts, validate-expressions.ts) already carry rows. core test:repo is 82/82 at the head.",
    "The objectql changeset carries no ADR-0087 marker (it is not breaking). The #24410 contract review called the surplus marker inert and its removal tidier. The lint changeset carries 'adr-0087: not-required (no-migration-prescription)'. check-adr-0087-registration exit 0."
  ],
  "mcp_calls": "0 — no MCP GitHub tool was called (reads went through unauthenticated public REST GETs; writes through git push and the fleet-write relay)",
  "api_writes": "3 relay/REST writes plus 6 git pushes. (1) git push x6 to refs/heads/claude/issue-24468-rule-hop-isolation, see deviations. (2) pr_create through scripts/pm/fleet-write/dispatch.mjs: POST /repos/objectstack-ai/objectstack/dispatches (HTTP 204), executed by relay run 39227699222 as POST /repos/objectstack-ai/objectstack/pulls (draft, #24508) and POST /repos/objectstack-ai/objectstack/issues/24508/assignees (os-project-manager). The read-back reported 10434 bytes sent, 10434 stored, identical. (3) comment through the relay: POST /repos/objectstack-ai/objectstack/issues/24468/comments, this os-dev-report.",
  "open_questions": [
    {
      "question": "Where is the per-rule undeclared judgment carried from the engine to the rule evaluator? (settled: A)",
      "options": [
        "A: the existing RelatedFieldBinding carries undeclaredFields beside row/unavailable, and resolveTraversalScope intersects it with the rule's own columns before hydrating. This mirrors formulaHopScope.",
        "B: a separate per-reference undeclared map threaded through EvaluateRulesOptions.",
        "C: split the undeclared columns inside resolveOneHopRelated for both authorities. This moves the formula seam, which is fenced."
      ],
      "recommendation": "A. Business need: it fixes the measured booted refusal with no new option surface. Long term: one binding contract, read at one consumer site. AI-error axis: no tolerant fallback, the bad rule still refuses loudly, naming its own field. Startup no-spread: no new type, option or export (undeclaredFields already existed)."
    },
    {
      "question": "Does the lint's multi-hop skip apply to the formula site as well as the rule site? (settled: A)",
      "options": [
        "A: both sites, one body.",
        "B: the rule site only, with the formula site byte-for-byte as before."
      ],
      "recommendation": "A. One body for three doors is the card's instruction. It removes only a duplicate finding on an expression the multi-hop check already refuses, so no accept-set change at the formula site. AI-error axis: one finding per fault is clearer than two."
    },
    {
      "question": "Merge origin/main 7e58e0a27, which landed after the pre-PR merge? (settled: no)",
      "options": [
        "A: no; it is one packages/cli test-budget file with no overlap.",
        "B: merge, and re-run the build and typecheck again."
      ],
      "recommendation": "A, per AGENTS.md section 10: after the pre-PR merge, merge main only on a conflict, a main-caused red, or a queue removal."
    }
  ],
  "out_of_scope_findings": [
    "class: none (read-only inference, not run) · A conditional rule's 'when' that reads through a lookup is evaluated unhydrated (checkConditional) and opted out of the lint's traversal checks, so it saves clean and meets the bare id at evaluation. Read from the walk's own comment in validate-expressions.ts and from collectPredicateRelationships' docblock; not run as a probe. carrier: none · noted in the PR's Acceptance notes, not filed · dedupe words: conditional when traversal lookup unhydrated; checkConditional relationship hop",
    "class: none (known, carried) · At os build / os validate the hop-column check does not see a target field that an objectExtensions entry contributes; the save door judges the merged object. The same window as the formula site. carrier: the #24410 contract review record 6262025060, its open lint-lane note on folding objectExtensions into buildFieldIndex · noted, not filed"
  ]
}

    Generated by Claude Code

  8. objectstack-fleet
    closed this as completedin #24508on Oct 19, 2026
  9. objectstack-fleet
    removed
    pm:dispatched
    on Oct 19, 2026

  10. objectstack-fleet commented on Oct 19, 2026

    @objectstack-fleet
    objectstack-fleetbot
    on Oct 19, 2026
    ContributorAuthor

    Landed · domain:engine seat 1 · session_01JtSQQ3EWsbNPzyYMug1tXy · 2026-10-19T10:12Z

    Probe Reading
    Review CONTRACT_REVIEW_TIER record 6264118179 PASS on 69f76c6ef1, narrowing face. ACCEPT 6264204668. Not governed.
    Queue It entered the merge queue at 2026-10-19T09:39Z and left it merged at 2026-10-19T10:10Z. No gh-readonly-queue/main/pr-24508-* branch remains.
    origin/main 913fd6df8a is on origin/main. It carries PR #24508's 12 files, +514 / −12.
    Card Closed completed through Fixes #24468; pm:dispatched is cleared.

    What main now holds:

    • The save door refuses the misspelt hop. A validation rule condition (script / cross_field, top-level or nested in a conditional's then / otherwise) is judged against the target's field index: declared fields, injected system columns and id. A one-hop read of a column the target does not declare is refused under the existing expression-invalid rule, naming the field and the target. One body serves os validate, os build and the object save door (422 INVALID_METADATA), the same as the formula site.
    • One misspelt rule no longer blinds its siblings.
      • resolvePredicateRelated leaves each reference's undeclared columns out of the shared predicate read and lists them on the binding.
      • resolveTraversalScope refuses a rule only for its own undeclared columns.
      • So a valid sibling gets the verdict it gets alone. The predicate read's authority and bound, and the formula seam, are untouched.
    • objectql's injected-column census carries the new resolvePredicateRelated row (caller-predicate).

    Downstream:

    The dev session session_01XPyxHgkHDoFuEza6RvCJtd is archived.

    Generated by Claude Code

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

area:recordsBusiness objects, records, the views that show data, usable forms, searchbugSomething isn't workingdomain:enginepriority:p1High: required for production / M2target:v18

Type

No type

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions