Correct the AGENTS.md predicate rule and add a stopgap flow-predicate guard

[os-warren]

Fixes#29

Three deliverables: the AGENTS.md rule 4 correction, the metadata-first rule, and the stopgap walk.

Rework round 2 (head d03dcea). My first rule 4 rewrite claimed validate does not flag a bare identifier "on any surface". That was false and is corrected below — scope decides, not surface name. Details in the "What changed in rework" section at the bottom.

1. AGENTS.md rule 4 — corrected, split by expression scope

The governing fact is scope, not surface name. An expression is evaluated either with the record bound as the record namespace and nothing at top level (record scope), or with the record's fields additionally flattened into top-level variables (flattened scope). validate judges a bare identifier only in the first.

Record-scoped surfaces — enforced, and there the failure really is null. Object validation rules, field conditional rules, action visible/disabled, sharing rules and hook conditions bind the record as a namespace only, so a bare name binds nothing, the expression evaluates to null, and the rule or action silently never fires. Measured on this branch, duly_task's skip_needs_reason rule mutated to a bare status:

✗ Author-time rules failed (1 issue)
• object 'duly_task' · validation 'skip_needs_reason': bare reference `status` —
a formula/validation expression binds the record as the `record` namespace,
not at top level, so `status` resolves to nothing and the expression silently
evaluates to null. Write `record.status`.

Exit 1, located, corrective — and the platform's own message states the mechanism, which is what makes the rewrite principled rather than patched.

Flow node and edge conditions are the single exception. They run in flattened scope, where a bare name may genuinely be a flow variable, so collectBoundRecordReads deliberately never judges one. status == "dispatched" in a flow start condition passes validate with exit 0.

And in a flow the failure is not null either — the paragraph that survives from the first rewrite, now correctly scoped to the flow half. A bare status resolves: to the flattened field, or to a same-named flow variable seeded first that shadows it (the subtler bug — the predicate reads correctly and silently means something else). When a name resolves to nothing the engine throws (ADR-0032 §1c). So on this one surface the outcomes are "silently means something else" and "loud runtime fault", never the quiet null of the record-scoped surfaces.

Links #14089 and points at the stopgap as deletable when it lands.

A premise divergence, recorded and since confirmed by the PM. The card quotes a rule 4 containing "(pnpm validate now rejects it)". That text is not in duly's AGENTS.md — on main rule 4 was a one-liner. The PM has confirmed they were quoting the objectstack monorepo's file. The other half of the card was verbatim true (lines 44–46 claimed a bare reference "evaluates to null and hides the action on every record"), and that sentence turned out to be correct for record-scoped surfaces — it is restored under that half rather than deleted.

2. AGENTS.md rule 9 — metadata first

New rule carrying all three required parts: declarative metadata over handler code (objects, views, flows, jobs, datasets, permission sets, actions are primary; a handler is the last resort); check the platform for a declarative way before writing a handler; and if the platform cannot express it, file an issue against objectstack-ai/objectstack and say so on the card rather than quietly working around the gap.

Appended as rule 9 rather than inserted as rule 1, deliberately. Inserting at the top renumbers rules 4–8, and rule 4 is referenced by number in this card and in the dispatch prompts for #2, #7 and #11 — all in flight. Position does not encode importance in this list anyway. Happy to absorb the renumber on request.

3. test/flow-predicates.test.ts — the stopgap

Labelled at the top as a stopgap pending #14089 and written to be deleted when that lands. Its header now opens with the scope framing: it covers the only predicate surfaces the platform leaves open, which is what makes walking just dulyFlows/dulyJobs the right scope rather than a narrowing.

The bar — a bare identifier is a finding when it (1) names a declared field of the bound object and (2) names no variable the flow declares. Deliberately the same bar #14089 proposes upstream, so the two cannot disagree about what a defect is.

Region recursion is the platform's, not hand-rolled.collectFlowGraphs yields the flow's own graph plus every nested region — loop.body, parallel.branches[], try_catch.try/.catch, nested — with readable scope labels. FLOW_REGION_CONFIG_KEYS gives the "container config without its regions" view so nested findings are not reported twice; FLOW_NODE_EXPRESSION_PATHS supplies the declared predicate slots. The scoped walk this repo already had reads config.body.edges directly, which covers loop and silently misses parallel and try_catch.

The false-positive case the exemption exists for is handled, and three structural guards keep the exemption sound rather than a hole:

• Declared variables come from flow.variables[].name plus every binder the spec declares — iteratorVariable / indexVariable / outputVariable / idVariable / errorVariable, plus an assignment node's top-level config keys, which are the author's variable names. A *Variable-shaped key the walk does not know fails a dedicated test rather than silently producing a false positive.
• No declared flow variable may shadow a field of the bound object — this is what makes the exemption airtight.
• Every record_change flow must bind an object this repo declares, so a flow with nothing to anchor on cannot pass by having nothing to check.

Narrowings, declared rather than hidden: the anchor is Object.keys(object.fields), so system columns (id, created_at, …) are not flagged — the spec exports no list of them and hand-copying one here would drift. A bare name that is neither a field nor a variable is never flagged.

dulyJobs is a tripwire, not a live check, and says so. Measured against JobSchema at @objectstack/spec 17.2.0, a job declares name / label / description / schedule / handler / retryPolicy / timeout / enabled and no predicate slot — its schedule is a cron envelope, not CEL, and its logic is a named handler function. Two assertions fail loudly if JobSchema grows a predicate slot, or if any job ever carries a CEL expression.

Proof it can fail — three ablation legs

Each on real metadata, each with the mutation confirmed on disk before measuring (injected and removed literals grepped, non-empty diffstat, abort otherwise — an anchor miss reads exactly like a passing ablation), each restored by an EXIT/INT/TERM trap, and the work committed first so the trap's git checkout -- restores from a real index. All three re-run on the final head d03dcea.

Leg	Surface / scope	Mutation	pnpm validate	Flow guard
1	flow start-node condition (flattened)	record.status == → bare status ==	exit 0 · ✓ Validation passed (260ms)	exit 1
2	flow nested loop-body edge (flattened)	isBlank(vars.existing_task) → … && needs_collection	exit 0 · ✓ Validation passed (327ms)	exit 1
3	duly_task validation rule (record)	record.status == → bare status ==	exit 1, located + corrective	exit 0 — correctly claims no credit

Findings from legs 1 and 2, verbatim:

duly_assignment_fanout · node 'start' config.condition:
reads 'status' bare — write record.status [status == "dispatched"]
duly_assignment_fanout · loop 'fan_out' body · edge 'fanout_e_missing' condition:
reads 'needs_collection' bare — write record.needs_collection
[isBlank(vars.existing_task) && needs_collection]

Leg 2 answers the card's region-recursion requirement on real metadata: the finding is located insideloop 'fan_out' body. Leg 3 is the rework's own check — it proves both halves of the corrected rule 4 in one run: validatedoes enforce the record-scoped surface, and the flow guard does not overclaim it. Restoration verified after each leg by absent-marker greps and git status --porcelain empty.

Six of the file's thirteen tests are a permanent in-file self-test over synthetic fixtures — the guard firing on a bare reference nested in a loop body, on the bare-string shorthand as well as the P envelope, on each field of a compound predicate; and not firing on a correctly qualified read, on a bare name that is a declared loop iterator, or on CEL builtins and string literals.

Gates

All four green on head d03dcea, working tree clean against it:

VALIDATE_EXIT=0 ✓ Validation passed (308ms)
TYPECHECK_EXIT=0
TEST_EXIT=0 Test Files 6 passed (6) Tests 188 passed (188)
BUILD_EXIT=0 ✓ Build complete (562ms)

Exit codes captured before any pipe. No changeset (this repo has none) and no objectstack.config.ts edit.

What changed in rework (6752ca7 → d03dcea)

Only AGENTS.md rule 4 and the test file's header comment. Rule 9 untouched; the walk itself untouched.

• Rule 4 restructured around scope rather than surface name, with the record-scoped half enforced and flow node/edge conditions as the stated single exception.
• The null failure model restored — it was correct for record-scoped surfaces, and the platform's own diagnostic uses the same words. My previous text implied null is never the failure model, which misled in the other direction.
• The shadowing paragraph and the ADR-0032 §1c throw kept, moved under the flow half where they belong.
• Test header opens with the scope framing so the file's narrow surface reads as precision, not omission.

Out of scope, filed

• The scoped bare-reference walk in test/assignment-fanout.test.ts passes on a real bare reference #37 — the older scoped walk in test/assignment-fanout.test.ts asks whether the source containsrecord.<field>, so a compound predicate with one qualified and one bare clause passes it. No shipped metadata is affected and the new file covers that case. Left alone here: that file is outside this card's declared surface and belongs to another card's PR.

One upstream issue considered and deliberately not filed.FLOW_NODE_EXPRESSION_PATHS does not list config.condition or edge.condition, which looked like an incomplete predicate-slot table. Its docstring says the omission is deliberate — they are structural surfaces on every node and edge rather than declared configSchema slots, and both validators already walk them. Commit 6752ca7 corrects a comment of mine that had implied the gap.

---

Generated by Claude Code

[os-warren]

Fixes#29

Three deliverables: the AGENTS.md rule 4 correction, the metadata-first rule, and the stopgap walk.

Rework round 2 (head d03dcea). My first rule 4 rewrite claimed validate does not flag a bare identifier "on any surface". That was false and is corrected below — scope decides, not surface name. Details in the "What changed in rework" section at the bottom.

1. AGENTS.md rule 4 — corrected, split by expression scope

The governing fact is scope, not surface name. An expression is evaluated either with the record bound as the record namespace and nothing at top level (record scope), or with the record's fields additionally flattened into top-level variables (flattened scope). validate judges a bare identifier only in the first.

Record-scoped surfaces — enforced, and there the failure really is null. Object validation rules, field conditional rules, action visible/disabled, sharing rules and hook conditions bind the record as a namespace only, so a bare name binds nothing, the expression evaluates to null, and the rule or action silently never fires. Measured on this branch, duly_task's skip_needs_reason rule mutated to a bare status:

✗ Author-time rules failed (1 issue)
• object 'duly_task' · validation 'skip_needs_reason': bare reference `status` —
a formula/validation expression binds the record as the `record` namespace,
not at top level, so `status` resolves to nothing and the expression silently
evaluates to null. Write `record.status`.

Exit 1, located, corrective — and the platform's own message states the mechanism, which is what makes the rewrite principled rather than patched.

Flow node and edge conditions are the single exception. They run in flattened scope, where a bare name may genuinely be a flow variable, so collectBoundRecordReads deliberately never judges one. status == "dispatched" in a flow start condition passes validate with exit 0.

And in a flow the failure is not null either — the paragraph that survives from the first rewrite, now correctly scoped to the flow half. A bare status resolves: to the flattened field, or to a same-named flow variable seeded first that shadows it (the subtler bug — the predicate reads correctly and silently means something else). When a name resolves to nothing the engine throws (ADR-0032 §1c). So on this one surface the outcomes are "silently means something else" and "loud runtime fault", never the quiet null of the record-scoped surfaces.

Links #14089 and points at the stopgap as deletable when it lands.

A premise divergence, recorded and since confirmed by the PM. The card quotes a rule 4 containing "(pnpm validate now rejects it)". That text is not in duly's AGENTS.md — on main rule 4 was a one-liner. The PM has confirmed they were quoting the objectstack monorepo's file. The other half of the card was verbatim true (lines 44–46 claimed a bare reference "evaluates to null and hides the action on every record"), and that sentence turned out to be correct for record-scoped surfaces — it is restored under that half rather than deleted.

2. AGENTS.md rule 9 — metadata first

New rule carrying all three required parts: declarative metadata over handler code (objects, views, flows, jobs, datasets, permission sets, actions are primary; a handler is the last resort); check the platform for a declarative way before writing a handler; and if the platform cannot express it, file an issue against objectstack-ai/objectstack and say so on the card rather than quietly working around the gap.

Appended as rule 9 rather than inserted as rule 1, deliberately. Inserting at the top renumbers rules 4–8, and rule 4 is referenced by number in this card and in the dispatch prompts for #2, #7 and #11 — all in flight. Position does not encode importance in this list anyway. Happy to absorb the renumber on request.

3. test/flow-predicates.test.ts — the stopgap

Labelled at the top as a stopgap pending #14089 and written to be deleted when that lands. Its header now opens with the scope framing: it covers the only predicate surfaces the platform leaves open, which is what makes walking just dulyFlows/dulyJobs the right scope rather than a narrowing.

The bar — a bare identifier is a finding when it (1) names a declared field of the bound object and (2) names no variable the flow declares. Deliberately the same bar #14089 proposes upstream, so the two cannot disagree about what a defect is.

Region recursion is the platform's, not hand-rolled.collectFlowGraphs yields the flow's own graph plus every nested region — loop.body, parallel.branches[], try_catch.try/.catch, nested — with readable scope labels. FLOW_REGION_CONFIG_KEYS gives the "container config without its regions" view so nested findings are not reported twice; FLOW_NODE_EXPRESSION_PATHS supplies the declared predicate slots. The scoped walk this repo already had reads config.body.edges directly, which covers loop and silently misses parallel and try_catch.

The false-positive case the exemption exists for is handled, and three structural guards keep the exemption sound rather than a hole:

• Declared variables come from flow.variables[].name plus every binder the spec declares — iteratorVariable / indexVariable / outputVariable / idVariable / errorVariable, plus an assignment node's top-level config keys, which are the author's variable names. A *Variable-shaped key the walk does not know fails a dedicated test rather than silently producing a false positive.
• No declared flow variable may shadow a field of the bound object — this is what makes the exemption airtight.
• Every record_change flow must bind an object this repo declares, so a flow with nothing to anchor on cannot pass by having nothing to check.

Narrowings, declared rather than hidden: the anchor is Object.keys(object.fields), so system columns (id, created_at, …) are not flagged — the spec exports no list of them and hand-copying one here would drift. A bare name that is neither a field nor a variable is never flagged.

dulyJobs is a tripwire, not a live check, and says so. Measured against JobSchema at @objectstack/spec 17.2.0, a job declares name / label / description / schedule / handler / retryPolicy / timeout / enabled and no predicate slot — its schedule is a cron envelope, not CEL, and its logic is a named handler function. Two assertions fail loudly if JobSchema grows a predicate slot, or if any job ever carries a CEL expression.

Proof it can fail — three ablation legs

Each on real metadata, each with the mutation confirmed on disk before measuring (injected and removed literals grepped, non-empty diffstat, abort otherwise — an anchor miss reads exactly like a passing ablation), each restored by an EXIT/INT/TERM trap, and the work committed first so the trap's git checkout -- restores from a real index. All three re-run on the final head d03dcea.

Leg	Surface / scope	Mutation	pnpm validate	Flow guard
1	flow start-node condition (flattened)	record.status == → bare status ==	exit 0 · ✓ Validation passed (260ms)	exit 1
2	flow nested loop-body edge (flattened)	isBlank(vars.existing_task) → … && needs_collection	exit 0 · ✓ Validation passed (327ms)	exit 1
3	duly_task validation rule (record)	record.status == → bare status ==	exit 1, located + corrective	exit 0 — correctly claims no credit

Findings from legs 1 and 2, verbatim:

duly_assignment_fanout · node 'start' config.condition:
reads 'status' bare — write record.status [status == "dispatched"]
duly_assignment_fanout · loop 'fan_out' body · edge 'fanout_e_missing' condition:
reads 'needs_collection' bare — write record.needs_collection
[isBlank(vars.existing_task) && needs_collection]

Leg 2 answers the card's region-recursion requirement on real metadata: the finding is located insideloop 'fan_out' body. Leg 3 is the rework's own check — it proves both halves of the corrected rule 4 in one run: validatedoes enforce the record-scoped surface, and the flow guard does not overclaim it. Restoration verified after each leg by absent-marker greps and git status --porcelain empty.

Six of the file's thirteen tests are a permanent in-file self-test over synthetic fixtures — the guard firing on a bare reference nested in a loop body, on the bare-string shorthand as well as the P envelope, on each field of a compound predicate; and not firing on a correctly qualified read, on a bare name that is a declared loop iterator, or on CEL builtins and string literals.

Gates

All four green on head d03dcea, working tree clean against it:

VALIDATE_EXIT=0 ✓ Validation passed (308ms)
TYPECHECK_EXIT=0
TEST_EXIT=0 Test Files 6 passed (6) Tests 188 passed (188)
BUILD_EXIT=0 ✓ Build complete (562ms)

Exit codes captured before any pipe. No changeset (this repo has none) and no objectstack.config.ts edit.

What changed in rework (6752ca7 → d03dcea)

Only AGENTS.md rule 4 and the test file's header comment. Rule 9 untouched; the walk itself untouched.

• Rule 4 restructured around scope rather than surface name, with the record-scoped half enforced and flow node/edge conditions as the stated single exception.
• The null failure model restored — it was correct for record-scoped surfaces, and the platform's own diagnostic uses the same words. My previous text implied null is never the failure model, which misled in the other direction.
• The shadowing paragraph and the ADR-0032 §1c throw kept, moved under the flow half where they belong.
• Test header opens with the scope framing so the file's narrow surface reads as precision, not omission.

Out of scope, filed

• The scoped bare-reference walk in test/assignment-fanout.test.ts passes on a real bare reference #37 — the older scoped walk in test/assignment-fanout.test.ts asks whether the source containsrecord.<field>, so a compound predicate with one qualified and one bare clause passes it. No shipped metadata is affected and the new file covers that case. Left alone here: that file is outside this card's declared surface and belongs to another card's PR.

One upstream issue considered and deliberately not filed.FLOW_NODE_EXPRESSION_PATHS does not list config.condition or edge.condition, which looked like an incomplete predicate-slot table. Its docstring says the omission is deliberate — they are structural surfaces on every node and edge rather than declared configSchema slots, and both validators already walk them. Commit 6752ca7 corrects a comment of mine that had implied the gap.

---

Generated by Claude Code

[os-warren]

Fixes#29

Three deliverables: the AGENTS.md rule 4 correction, the metadata-first rule, and the stopgap walk.

Rework round 2 (head d03dcea). My first rule 4 rewrite claimed validate does not flag a bare identifier "on any surface". That was false and is corrected below — scope decides, not surface name. Details in the "What changed in rework" section at the bottom.

1. AGENTS.md rule 4 — corrected, split by expression scope

The governing fact is scope, not surface name. An expression is evaluated either with the record bound as the record namespace and nothing at top level (record scope), or with the record's fields additionally flattened into top-level variables (flattened scope). validate judges a bare identifier only in the first.

Record-scoped surfaces — enforced, and there the failure really is null. Object validation rules, field conditional rules, action visible/disabled, sharing rules and hook conditions bind the record as a namespace only, so a bare name binds nothing, the expression evaluates to null, and the rule or action silently never fires. Measured on this branch, duly_task's skip_needs_reason rule mutated to a bare status:

✗ Author-time rules failed (1 issue)
• object 'duly_task' · validation 'skip_needs_reason': bare reference `status` —
a formula/validation expression binds the record as the `record` namespace,
not at top level, so `status` resolves to nothing and the expression silently
evaluates to null. Write `record.status`.

Exit 1, located, corrective — and the platform's own message states the mechanism, which is what makes the rewrite principled rather than patched.

Flow node and edge conditions are the single exception. They run in flattened scope, where a bare name may genuinely be a flow variable, so collectBoundRecordReads deliberately never judges one. status == "dispatched" in a flow start condition passes validate with exit 0.

And in a flow the failure is not null either — the paragraph that survives from the first rewrite, now correctly scoped to the flow half. A bare status resolves: to the flattened field, or to a same-named flow variable seeded first that shadows it (the subtler bug — the predicate reads correctly and silently means something else). When a name resolves to nothing the engine throws (ADR-0032 §1c). So on this one surface the outcomes are "silently means something else" and "loud runtime fault", never the quiet null of the record-scoped surfaces.

Links #14089 and points at the stopgap as deletable when it lands.

A premise divergence, recorded and since confirmed by the PM. The card quotes a rule 4 containing "(pnpm validate now rejects it)". That text is not in duly's AGENTS.md — on main rule 4 was a one-liner. The PM has confirmed they were quoting the objectstack monorepo's file. The other half of the card was verbatim true (lines 44–46 claimed a bare reference "evaluates to null and hides the action on every record"), and that sentence turned out to be correct for record-scoped surfaces — it is restored under that half rather than deleted.

2. AGENTS.md rule 9 — metadata first

New rule carrying all three required parts: declarative metadata over handler code (objects, views, flows, jobs, datasets, permission sets, actions are primary; a handler is the last resort); check the platform for a declarative way before writing a handler; and if the platform cannot express it, file an issue against objectstack-ai/objectstack and say so on the card rather than quietly working around the gap.

Appended as rule 9 rather than inserted as rule 1, deliberately. Inserting at the top renumbers rules 4–8, and rule 4 is referenced by number in this card and in the dispatch prompts for #2, #7 and #11 — all in flight. Position does not encode importance in this list anyway. Happy to absorb the renumber on request.

3. test/flow-predicates.test.ts — the stopgap

Labelled at the top as a stopgap pending #14089 and written to be deleted when that lands. Its header now opens with the scope framing: it covers the only predicate surfaces the platform leaves open, which is what makes walking just dulyFlows/dulyJobs the right scope rather than a narrowing.

The bar — a bare identifier is a finding when it (1) names a declared field of the bound object and (2) names no variable the flow declares. Deliberately the same bar #14089 proposes upstream, so the two cannot disagree about what a defect is.

Region recursion is the platform's, not hand-rolled.collectFlowGraphs yields the flow's own graph plus every nested region — loop.body, parallel.branches[], try_catch.try/.catch, nested — with readable scope labels. FLOW_REGION_CONFIG_KEYS gives the "container config without its regions" view so nested findings are not reported twice; FLOW_NODE_EXPRESSION_PATHS supplies the declared predicate slots. The scoped walk this repo already had reads config.body.edges directly, which covers loop and silently misses parallel and try_catch.

The false-positive case the exemption exists for is handled, and three structural guards keep the exemption sound rather than a hole:

• Declared variables come from flow.variables[].name plus every binder the spec declares — iteratorVariable / indexVariable / outputVariable / idVariable / errorVariable, plus an assignment node's top-level config keys, which are the author's variable names. A *Variable-shaped key the walk does not know fails a dedicated test rather than silently producing a false positive.
• No declared flow variable may shadow a field of the bound object — this is what makes the exemption airtight.
• Every record_change flow must bind an object this repo declares, so a flow with nothing to anchor on cannot pass by having nothing to check.

Narrowings, declared rather than hidden: the anchor is Object.keys(object.fields), so system columns (id, created_at, …) are not flagged — the spec exports no list of them and hand-copying one here would drift. A bare name that is neither a field nor a variable is never flagged.

dulyJobs is a tripwire, not a live check, and says so. Measured against JobSchema at @objectstack/spec 17.2.0, a job declares name / label / description / schedule / handler / retryPolicy / timeout / enabled and no predicate slot — its schedule is a cron envelope, not CEL, and its logic is a named handler function. Two assertions fail loudly if JobSchema grows a predicate slot, or if any job ever carries a CEL expression.

Proof it can fail — three ablation legs

Each on real metadata, each with the mutation confirmed on disk before measuring (injected and removed literals grepped, non-empty diffstat, abort otherwise — an anchor miss reads exactly like a passing ablation), each restored by an EXIT/INT/TERM trap, and the work committed first so the trap's git checkout -- restores from a real index. All three re-run on the final head d03dcea.

Leg	Surface / scope	Mutation	pnpm validate	Flow guard
1	flow start-node condition (flattened)	record.status == → bare status ==	exit 0 · ✓ Validation passed (260ms)	exit 1
2	flow nested loop-body edge (flattened)	isBlank(vars.existing_task) → … && needs_collection	exit 0 · ✓ Validation passed (327ms)	exit 1
3	duly_task validation rule (record)	record.status == → bare status ==	exit 1, located + corrective	exit 0 — correctly claims no credit

Findings from legs 1 and 2, verbatim:

duly_assignment_fanout · node 'start' config.condition:
reads 'status' bare — write record.status [status == "dispatched"]
duly_assignment_fanout · loop 'fan_out' body · edge 'fanout_e_missing' condition:
reads 'needs_collection' bare — write record.needs_collection
[isBlank(vars.existing_task) && needs_collection]

Leg 2 answers the card's region-recursion requirement on real metadata: the finding is located insideloop 'fan_out' body. Leg 3 is the rework's own check — it proves both halves of the corrected rule 4 in one run: validatedoes enforce the record-scoped surface, and the flow guard does not overclaim it. Restoration verified after each leg by absent-marker greps and git status --porcelain empty.

Six of the file's thirteen tests are a permanent in-file self-test over synthetic fixtures — the guard firing on a bare reference nested in a loop body, on the bare-string shorthand as well as the P envelope, on each field of a compound predicate; and not firing on a correctly qualified read, on a bare name that is a declared loop iterator, or on CEL builtins and string literals.

Gates

All four green on head d03dcea, working tree clean against it:

VALIDATE_EXIT=0 ✓ Validation passed (308ms)
TYPECHECK_EXIT=0
TEST_EXIT=0 Test Files 6 passed (6) Tests 188 passed (188)
BUILD_EXIT=0 ✓ Build complete (562ms)

Exit codes captured before any pipe. No changeset (this repo has none) and no objectstack.config.ts edit.

What changed in rework (6752ca7 → d03dcea)

Only AGENTS.md rule 4 and the test file's header comment. Rule 9 untouched; the walk itself untouched.

• Rule 4 restructured around scope rather than surface name, with the record-scoped half enforced and flow node/edge conditions as the stated single exception.
• The null failure model restored — it was correct for record-scoped surfaces, and the platform's own diagnostic uses the same words. My previous text implied null is never the failure model, which misled in the other direction.
• The shadowing paragraph and the ADR-0032 §1c throw kept, moved under the flow half where they belong.
• Test header opens with the scope framing so the file's narrow surface reads as precision, not omission.

Out of scope, filed

• The scoped bare-reference walk in test/assignment-fanout.test.ts passes on a real bare reference #37 — the older scoped walk in test/assignment-fanout.test.ts asks whether the source containsrecord.<field>, so a compound predicate with one qualified and one bare clause passes it. No shipped metadata is affected and the new file covers that case. Left alone here: that file is outside this card's declared surface and belongs to another card's PR.

One upstream issue considered and deliberately not filed.FLOW_NODE_EXPRESSION_PATHS does not list config.condition or edge.condition, which looked like an incomplete predicate-slot table. Its docstring says the omission is deliberate — they are structural surfaces on every node and edge rather than declared configSchema slots, and both validators already walk them. Commit 6752ca7 corrects a comment of mine that had implied the gap.

---

Generated by Claude Code

[os-warren]

Fixes#29

Three deliverables: the AGENTS.md rule 4 correction, the metadata-first rule, and the stopgap walk.

Rework round 2 (head d03dcea). My first rule 4 rewrite claimed validate does not flag a bare identifier "on any surface". That was false and is corrected below — scope decides, not surface name. Details in the "What changed in rework" section at the bottom.

1. AGENTS.md rule 4 — corrected, split by expression scope

The governing fact is scope, not surface name. An expression is evaluated either with the record bound as the record namespace and nothing at top level (record scope), or with the record's fields additionally flattened into top-level variables (flattened scope). validate judges a bare identifier only in the first.

Record-scoped surfaces — enforced, and there the failure really is null. Object validation rules, field conditional rules, action visible/disabled, sharing rules and hook conditions bind the record as a namespace only, so a bare name binds nothing, the expression evaluates to null, and the rule or action silently never fires. Measured on this branch, duly_task's skip_needs_reason rule mutated to a bare status:

✗ Author-time rules failed (1 issue)
• object 'duly_task' · validation 'skip_needs_reason': bare reference `status` —
a formula/validation expression binds the record as the `record` namespace,
not at top level, so `status` resolves to nothing and the expression silently
evaluates to null. Write `record.status`.

Exit 1, located, corrective — and the platform's own message states the mechanism, which is what makes the rewrite principled rather than patched.

Flow node and edge conditions are the single exception. They run in flattened scope, where a bare name may genuinely be a flow variable, so collectBoundRecordReads deliberately never judges one. status == "dispatched" in a flow start condition passes validate with exit 0.

And in a flow the failure is not null either — the paragraph that survives from the first rewrite, now correctly scoped to the flow half. A bare status resolves: to the flattened field, or to a same-named flow variable seeded first that shadows it (the subtler bug — the predicate reads correctly and silently means something else). When a name resolves to nothing the engine throws (ADR-0032 §1c). So on this one surface the outcomes are "silently means something else" and "loud runtime fault", never the quiet null of the record-scoped surfaces.

Links #14089 and points at the stopgap as deletable when it lands.

A premise divergence, recorded and since confirmed by the PM. The card quotes a rule 4 containing "(pnpm validate now rejects it)". That text is not in duly's AGENTS.md — on main rule 4 was a one-liner. The PM has confirmed they were quoting the objectstack monorepo's file. The other half of the card was verbatim true (lines 44–46 claimed a bare reference "evaluates to null and hides the action on every record"), and that sentence turned out to be correct for record-scoped surfaces — it is restored under that half rather than deleted.

2. AGENTS.md rule 9 — metadata first

New rule carrying all three required parts: declarative metadata over handler code (objects, views, flows, jobs, datasets, permission sets, actions are primary; a handler is the last resort); check the platform for a declarative way before writing a handler; and if the platform cannot express it, file an issue against objectstack-ai/objectstack and say so on the card rather than quietly working around the gap.

Appended as rule 9 rather than inserted as rule 1, deliberately. Inserting at the top renumbers rules 4–8, and rule 4 is referenced by number in this card and in the dispatch prompts for #2, #7 and #11 — all in flight. Position does not encode importance in this list anyway. Happy to absorb the renumber on request.

3. test/flow-predicates.test.ts — the stopgap

Labelled at the top as a stopgap pending #14089 and written to be deleted when that lands. Its header now opens with the scope framing: it covers the only predicate surfaces the platform leaves open, which is what makes walking just dulyFlows/dulyJobs the right scope rather than a narrowing.

The bar — a bare identifier is a finding when it (1) names a declared field of the bound object and (2) names no variable the flow declares. Deliberately the same bar #14089 proposes upstream, so the two cannot disagree about what a defect is.

Region recursion is the platform's, not hand-rolled.collectFlowGraphs yields the flow's own graph plus every nested region — loop.body, parallel.branches[], try_catch.try/.catch, nested — with readable scope labels. FLOW_REGION_CONFIG_KEYS gives the "container config without its regions" view so nested findings are not reported twice; FLOW_NODE_EXPRESSION_PATHS supplies the declared predicate slots. The scoped walk this repo already had reads config.body.edges directly, which covers loop and silently misses parallel and try_catch.

The false-positive case the exemption exists for is handled, and three structural guards keep the exemption sound rather than a hole:

• Declared variables come from flow.variables[].name plus every binder the spec declares — iteratorVariable / indexVariable / outputVariable / idVariable / errorVariable, plus an assignment node's top-level config keys, which are the author's variable names. A *Variable-shaped key the walk does not know fails a dedicated test rather than silently producing a false positive.
• No declared flow variable may shadow a field of the bound object — this is what makes the exemption airtight.
• Every record_change flow must bind an object this repo declares, so a flow with nothing to anchor on cannot pass by having nothing to check.

Narrowings, declared rather than hidden: the anchor is Object.keys(object.fields), so system columns (id, created_at, …) are not flagged — the spec exports no list of them and hand-copying one here would drift. A bare name that is neither a field nor a variable is never flagged.

dulyJobs is a tripwire, not a live check, and says so. Measured against JobSchema at @objectstack/spec 17.2.0, a job declares name / label / description / schedule / handler / retryPolicy / timeout / enabled and no predicate slot — its schedule is a cron envelope, not CEL, and its logic is a named handler function. Two assertions fail loudly if JobSchema grows a predicate slot, or if any job ever carries a CEL expression.

Proof it can fail — three ablation legs

Each on real metadata, each with the mutation confirmed on disk before measuring (injected and removed literals grepped, non-empty diffstat, abort otherwise — an anchor miss reads exactly like a passing ablation), each restored by an EXIT/INT/TERM trap, and the work committed first so the trap's git checkout -- restores from a real index. All three re-run on the final head d03dcea.

Leg	Surface / scope	Mutation	pnpm validate	Flow guard
1	flow start-node condition (flattened)	record.status == → bare status ==	exit 0 · ✓ Validation passed (260ms)	exit 1
2	flow nested loop-body edge (flattened)	isBlank(vars.existing_task) → … && needs_collection	exit 0 · ✓ Validation passed (327ms)	exit 1
3	duly_task validation rule (record)	record.status == → bare status ==	exit 1, located + corrective	exit 0 — correctly claims no credit

Findings from legs 1 and 2, verbatim:

duly_assignment_fanout · node 'start' config.condition:
reads 'status' bare — write record.status [status == "dispatched"]
duly_assignment_fanout · loop 'fan_out' body · edge 'fanout_e_missing' condition:
reads 'needs_collection' bare — write record.needs_collection
[isBlank(vars.existing_task) && needs_collection]

Leg 2 answers the card's region-recursion requirement on real metadata: the finding is located insideloop 'fan_out' body. Leg 3 is the rework's own check — it proves both halves of the corrected rule 4 in one run: validatedoes enforce the record-scoped surface, and the flow guard does not overclaim it. Restoration verified after each leg by absent-marker greps and git status --porcelain empty.

Six of the file's thirteen tests are a permanent in-file self-test over synthetic fixtures — the guard firing on a bare reference nested in a loop body, on the bare-string shorthand as well as the P envelope, on each field of a compound predicate; and not firing on a correctly qualified read, on a bare name that is a declared loop iterator, or on CEL builtins and string literals.

Gates

All four green on head d03dcea, working tree clean against it:

VALIDATE_EXIT=0 ✓ Validation passed (308ms)
TYPECHECK_EXIT=0
TEST_EXIT=0 Test Files 6 passed (6) Tests 188 passed (188)
BUILD_EXIT=0 ✓ Build complete (562ms)

Exit codes captured before any pipe. No changeset (this repo has none) and no objectstack.config.ts edit.

What changed in rework (6752ca7 → d03dcea)

Only AGENTS.md rule 4 and the test file's header comment. Rule 9 untouched; the walk itself untouched.

• Rule 4 restructured around scope rather than surface name, with the record-scoped half enforced and flow node/edge conditions as the stated single exception.
• The null failure model restored — it was correct for record-scoped surfaces, and the platform's own diagnostic uses the same words. My previous text implied null is never the failure model, which misled in the other direction.
• The shadowing paragraph and the ADR-0032 §1c throw kept, moved under the flow half where they belong.
• Test header opens with the scope framing so the file's narrow surface reads as precision, not omission.

Out of scope, filed

• The scoped bare-reference walk in test/assignment-fanout.test.ts passes on a real bare reference #37 — the older scoped walk in test/assignment-fanout.test.ts asks whether the source containsrecord.<field>, so a compound predicate with one qualified and one bare clause passes it. No shipped metadata is affected and the new file covers that case. Left alone here: that file is outside this card's declared surface and belongs to another card's PR.

One upstream issue considered and deliberately not filed.FLOW_NODE_EXPRESSION_PATHS does not list config.condition or edge.condition, which looked like an incomplete predicate-slot table. Its docstring says the omission is deliberate — they are structural surfaces on every node and edge rather than declared configSchema slots, and both validators already walk them. Commit 6752ca7 corrects a comment of mine that had implied the gap.

---

Generated by Claude Code

[os-warren]

Fixes#29

Three deliverables: the AGENTS.md rule 4 correction, the metadata-first rule, and the stopgap walk.

Rework round 2 (head d03dcea). My first rule 4 rewrite claimed validate does not flag a bare identifier "on any surface". That was false and is corrected below — scope decides, not surface name. Details in the "What changed in rework" section at the bottom.

1. AGENTS.md rule 4 — corrected, split by expression scope

The governing fact is scope, not surface name. An expression is evaluated either with the record bound as the record namespace and nothing at top level (record scope), or with the record's fields additionally flattened into top-level variables (flattened scope). validate judges a bare identifier only in the first.

Record-scoped surfaces — enforced, and there the failure really is null. Object validation rules, field conditional rules, action visible/disabled, sharing rules and hook conditions bind the record as a namespace only, so a bare name binds nothing, the expression evaluates to null, and the rule or action silently never fires. Measured on this branch, duly_task's skip_needs_reason rule mutated to a bare status:

✗ Author-time rules failed (1 issue)
• object 'duly_task' · validation 'skip_needs_reason': bare reference `status` —
a formula/validation expression binds the record as the `record` namespace,
not at top level, so `status` resolves to nothing and the expression silently
evaluates to null. Write `record.status`.

Exit 1, located, corrective — and the platform's own message states the mechanism, which is what makes the rewrite principled rather than patched.

Flow node and edge conditions are the single exception. They run in flattened scope, where a bare name may genuinely be a flow variable, so collectBoundRecordReads deliberately never judges one. status == "dispatched" in a flow start condition passes validate with exit 0.

And in a flow the failure is not null either — the paragraph that survives from the first rewrite, now correctly scoped to the flow half. A bare status resolves: to the flattened field, or to a same-named flow variable seeded first that shadows it (the subtler bug — the predicate reads correctly and silently means something else). When a name resolves to nothing the engine throws (ADR-0032 §1c). So on this one surface the outcomes are "silently means something else" and "loud runtime fault", never the quiet null of the record-scoped surfaces.

Links #14089 and points at the stopgap as deletable when it lands.

A premise divergence, recorded and since confirmed by the PM. The card quotes a rule 4 containing "(pnpm validate now rejects it)". That text is not in duly's AGENTS.md — on main rule 4 was a one-liner. The PM has confirmed they were quoting the objectstack monorepo's file. The other half of the card was verbatim true (lines 44–46 claimed a bare reference "evaluates to null and hides the action on every record"), and that sentence turned out to be correct for record-scoped surfaces — it is restored under that half rather than deleted.

2. AGENTS.md rule 9 — metadata first

New rule carrying all three required parts: declarative metadata over handler code (objects, views, flows, jobs, datasets, permission sets, actions are primary; a handler is the last resort); check the platform for a declarative way before writing a handler; and if the platform cannot express it, file an issue against objectstack-ai/objectstack and say so on the card rather than quietly working around the gap.

Appended as rule 9 rather than inserted as rule 1, deliberately. Inserting at the top renumbers rules 4–8, and rule 4 is referenced by number in this card and in the dispatch prompts for #2, #7 and #11 — all in flight. Position does not encode importance in this list anyway. Happy to absorb the renumber on request.

3. test/flow-predicates.test.ts — the stopgap

Labelled at the top as a stopgap pending #14089 and written to be deleted when that lands. Its header now opens with the scope framing: it covers the only predicate surfaces the platform leaves open, which is what makes walking just dulyFlows/dulyJobs the right scope rather than a narrowing.

The bar — a bare identifier is a finding when it (1) names a declared field of the bound object and (2) names no variable the flow declares. Deliberately the same bar #14089 proposes upstream, so the two cannot disagree about what a defect is.

Region recursion is the platform's, not hand-rolled.collectFlowGraphs yields the flow's own graph plus every nested region — loop.body, parallel.branches[], try_catch.try/.catch, nested — with readable scope labels. FLOW_REGION_CONFIG_KEYS gives the "container config without its regions" view so nested findings are not reported twice; FLOW_NODE_EXPRESSION_PATHS supplies the declared predicate slots. The scoped walk this repo already had reads config.body.edges directly, which covers loop and silently misses parallel and try_catch.

The false-positive case the exemption exists for is handled, and three structural guards keep the exemption sound rather than a hole:

• Declared variables come from flow.variables[].name plus every binder the spec declares — iteratorVariable / indexVariable / outputVariable / idVariable / errorVariable, plus an assignment node's top-level config keys, which are the author's variable names. A *Variable-shaped key the walk does not know fails a dedicated test rather than silently producing a false positive.
• No declared flow variable may shadow a field of the bound object — this is what makes the exemption airtight.
• Every record_change flow must bind an object this repo declares, so a flow with nothing to anchor on cannot pass by having nothing to check.

Narrowings, declared rather than hidden: the anchor is Object.keys(object.fields), so system columns (id, created_at, …) are not flagged — the spec exports no list of them and hand-copying one here would drift. A bare name that is neither a field nor a variable is never flagged.

dulyJobs is a tripwire, not a live check, and says so. Measured against JobSchema at @objectstack/spec 17.2.0, a job declares name / label / description / schedule / handler / retryPolicy / timeout / enabled and no predicate slot — its schedule is a cron envelope, not CEL, and its logic is a named handler function. Two assertions fail loudly if JobSchema grows a predicate slot, or if any job ever carries a CEL expression.

Proof it can fail — three ablation legs

Each on real metadata, each with the mutation confirmed on disk before measuring (injected and removed literals grepped, non-empty diffstat, abort otherwise — an anchor miss reads exactly like a passing ablation), each restored by an EXIT/INT/TERM trap, and the work committed first so the trap's git checkout -- restores from a real index. All three re-run on the final head d03dcea.

Leg	Surface / scope	Mutation	pnpm validate	Flow guard
1	flow start-node condition (flattened)	record.status == → bare status ==	exit 0 · ✓ Validation passed (260ms)	exit 1
2	flow nested loop-body edge (flattened)	isBlank(vars.existing_task) → … && needs_collection	exit 0 · ✓ Validation passed (327ms)	exit 1
3	duly_task validation rule (record)	record.status == → bare status ==	exit 1, located + corrective	exit 0 — correctly claims no credit

Findings from legs 1 and 2, verbatim:

duly_assignment_fanout · node 'start' config.condition:
reads 'status' bare — write record.status [status == "dispatched"]
duly_assignment_fanout · loop 'fan_out' body · edge 'fanout_e_missing' condition:
reads 'needs_collection' bare — write record.needs_collection
[isBlank(vars.existing_task) && needs_collection]

Leg 2 answers the card's region-recursion requirement on real metadata: the finding is located insideloop 'fan_out' body. Leg 3 is the rework's own check — it proves both halves of the corrected rule 4 in one run: validatedoes enforce the record-scoped surface, and the flow guard does not overclaim it. Restoration verified after each leg by absent-marker greps and git status --porcelain empty.

Six of the file's thirteen tests are a permanent in-file self-test over synthetic fixtures — the guard firing on a bare reference nested in a loop body, on the bare-string shorthand as well as the P envelope, on each field of a compound predicate; and not firing on a correctly qualified read, on a bare name that is a declared loop iterator, or on CEL builtins and string literals.

Gates

All four green on head d03dcea, working tree clean against it:

VALIDATE_EXIT=0 ✓ Validation passed (308ms)
TYPECHECK_EXIT=0
TEST_EXIT=0 Test Files 6 passed (6) Tests 188 passed (188)
BUILD_EXIT=0 ✓ Build complete (562ms)

Exit codes captured before any pipe. No changeset (this repo has none) and no objectstack.config.ts edit.

What changed in rework (6752ca7 → d03dcea)

Only AGENTS.md rule 4 and the test file's header comment. Rule 9 untouched; the walk itself untouched.

• Rule 4 restructured around scope rather than surface name, with the record-scoped half enforced and flow node/edge conditions as the stated single exception.
• The null failure model restored — it was correct for record-scoped surfaces, and the platform's own diagnostic uses the same words. My previous text implied null is never the failure model, which misled in the other direction.
• The shadowing paragraph and the ADR-0032 §1c throw kept, moved under the flow half where they belong.
• Test header opens with the scope framing so the file's narrow surface reads as precision, not omission.

Out of scope, filed

• The scoped bare-reference walk in test/assignment-fanout.test.ts passes on a real bare reference #37 — the older scoped walk in test/assignment-fanout.test.ts asks whether the source containsrecord.<field>, so a compound predicate with one qualified and one bare clause passes it. No shipped metadata is affected and the new file covers that case. Left alone here: that file is outside this card's declared surface and belongs to another card's PR.

One upstream issue considered and deliberately not filed.FLOW_NODE_EXPRESSION_PATHS does not list config.condition or edge.condition, which looked like an incomplete predicate-slot table. Its docstring says the omission is deliberate — they are structural surfaces on every node and edge rather than declared configSchema slots, and both validators already walk them. Commit 6752ca7 corrects a comment of mine that had implied the gap.

---

Generated by Claude Code

[os-warren]

Fixes#29

Three deliverables: the AGENTS.md rule 4 correction, the metadata-first rule, and the stopgap walk.

Rework round 2 (head d03dcea). My first rule 4 rewrite claimed validate does not flag a bare identifier "on any surface". That was false and is corrected below — scope decides, not surface name. Details in the "What changed in rework" section at the bottom.

1. AGENTS.md rule 4 — corrected, split by expression scope

The governing fact is scope, not surface name. An expression is evaluated either with the record bound as the record namespace and nothing at top level (record scope), or with the record's fields additionally flattened into top-level variables (flattened scope). validate judges a bare identifier only in the first.

Record-scoped surfaces — enforced, and there the failure really is null. Object validation rules, field conditional rules, action visible/disabled, sharing rules and hook conditions bind the record as a namespace only, so a bare name binds nothing, the expression evaluates to null, and the rule or action silently never fires. Measured on this branch, duly_task's skip_needs_reason rule mutated to a bare status:

✗ Author-time rules failed (1 issue)
• object 'duly_task' · validation 'skip_needs_reason': bare reference `status` —
a formula/validation expression binds the record as the `record` namespace,
not at top level, so `status` resolves to nothing and the expression silently
evaluates to null. Write `record.status`.

Exit 1, located, corrective — and the platform's own message states the mechanism, which is what makes the rewrite principled rather than patched.

Flow node and edge conditions are the single exception. They run in flattened scope, where a bare name may genuinely be a flow variable, so collectBoundRecordReads deliberately never judges one. status == "dispatched" in a flow start condition passes validate with exit 0.

And in a flow the failure is not null either — the paragraph that survives from the first rewrite, now correctly scoped to the flow half. A bare status resolves: to the flattened field, or to a same-named flow variable seeded first that shadows it (the subtler bug — the predicate reads correctly and silently means something else). When a name resolves to nothing the engine throws (ADR-0032 §1c). So on this one surface the outcomes are "silently means something else" and "loud runtime fault", never the quiet null of the record-scoped surfaces.

Links #14089 and points at the stopgap as deletable when it lands.

A premise divergence, recorded and since confirmed by the PM. The card quotes a rule 4 containing "(pnpm validate now rejects it)". That text is not in duly's AGENTS.md — on main rule 4 was a one-liner. The PM has confirmed they were quoting the objectstack monorepo's file. The other half of the card was verbatim true (lines 44–46 claimed a bare reference "evaluates to null and hides the action on every record"), and that sentence turned out to be correct for record-scoped surfaces — it is restored under that half rather than deleted.

2. AGENTS.md rule 9 — metadata first

New rule carrying all three required parts: declarative metadata over handler code (objects, views, flows, jobs, datasets, permission sets, actions are primary; a handler is the last resort); check the platform for a declarative way before writing a handler; and if the platform cannot express it, file an issue against objectstack-ai/objectstack and say so on the card rather than quietly working around the gap.

Appended as rule 9 rather than inserted as rule 1, deliberately. Inserting at the top renumbers rules 4–8, and rule 4 is referenced by number in this card and in the dispatch prompts for #2, #7 and #11 — all in flight. Position does not encode importance in this list anyway. Happy to absorb the renumber on request.

3. test/flow-predicates.test.ts — the stopgap

Labelled at the top as a stopgap pending #14089 and written to be deleted when that lands. Its header now opens with the scope framing: it covers the only predicate surfaces the platform leaves open, which is what makes walking just dulyFlows/dulyJobs the right scope rather than a narrowing.

The bar — a bare identifier is a finding when it (1) names a declared field of the bound object and (2) names no variable the flow declares. Deliberately the same bar #14089 proposes upstream, so the two cannot disagree about what a defect is.

Region recursion is the platform's, not hand-rolled.collectFlowGraphs yields the flow's own graph plus every nested region — loop.body, parallel.branches[], try_catch.try/.catch, nested — with readable scope labels. FLOW_REGION_CONFIG_KEYS gives the "container config without its regions" view so nested findings are not reported twice; FLOW_NODE_EXPRESSION_PATHS supplies the declared predicate slots. The scoped walk this repo already had reads config.body.edges directly, which covers loop and silently misses parallel and try_catch.

The false-positive case the exemption exists for is handled, and three structural guards keep the exemption sound rather than a hole:

• Declared variables come from flow.variables[].name plus every binder the spec declares — iteratorVariable / indexVariable / outputVariable / idVariable / errorVariable, plus an assignment node's top-level config keys, which are the author's variable names. A *Variable-shaped key the walk does not know fails a dedicated test rather than silently producing a false positive.
• No declared flow variable may shadow a field of the bound object — this is what makes the exemption airtight.
• Every record_change flow must bind an object this repo declares, so a flow with nothing to anchor on cannot pass by having nothing to check.

Narrowings, declared rather than hidden: the anchor is Object.keys(object.fields), so system columns (id, created_at, …) are not flagged — the spec exports no list of them and hand-copying one here would drift. A bare name that is neither a field nor a variable is never flagged.

dulyJobs is a tripwire, not a live check, and says so. Measured against JobSchema at @objectstack/spec 17.2.0, a job declares name / label / description / schedule / handler / retryPolicy / timeout / enabled and no predicate slot — its schedule is a cron envelope, not CEL, and its logic is a named handler function. Two assertions fail loudly if JobSchema grows a predicate slot, or if any job ever carries a CEL expression.

Proof it can fail — three ablation legs

Each on real metadata, each with the mutation confirmed on disk before measuring (injected and removed literals grepped, non-empty diffstat, abort otherwise — an anchor miss reads exactly like a passing ablation), each restored by an EXIT/INT/TERM trap, and the work committed first so the trap's git checkout -- restores from a real index. All three re-run on the final head d03dcea.

Leg	Surface / scope	Mutation	pnpm validate	Flow guard
1	flow start-node condition (flattened)	record.status == → bare status ==	exit 0 · ✓ Validation passed (260ms)	exit 1
2	flow nested loop-body edge (flattened)	isBlank(vars.existing_task) → … && needs_collection	exit 0 · ✓ Validation passed (327ms)	exit 1
3	duly_task validation rule (record)	record.status == → bare status ==	exit 1, located + corrective	exit 0 — correctly claims no credit

Findings from legs 1 and 2, verbatim:

duly_assignment_fanout · node 'start' config.condition:
reads 'status' bare — write record.status [status == "dispatched"]
duly_assignment_fanout · loop 'fan_out' body · edge 'fanout_e_missing' condition:
reads 'needs_collection' bare — write record.needs_collection
[isBlank(vars.existing_task) && needs_collection]

Leg 2 answers the card's region-recursion requirement on real metadata: the finding is located insideloop 'fan_out' body. Leg 3 is the rework's own check — it proves both halves of the corrected rule 4 in one run: validatedoes enforce the record-scoped surface, and the flow guard does not overclaim it. Restoration verified after each leg by absent-marker greps and git status --porcelain empty.

Six of the file's thirteen tests are a permanent in-file self-test over synthetic fixtures — the guard firing on a bare reference nested in a loop body, on the bare-string shorthand as well as the P envelope, on each field of a compound predicate; and not firing on a correctly qualified read, on a bare name that is a declared loop iterator, or on CEL builtins and string literals.

Gates

All four green on head d03dcea, working tree clean against it:

VALIDATE_EXIT=0 ✓ Validation passed (308ms)
TYPECHECK_EXIT=0
TEST_EXIT=0 Test Files 6 passed (6) Tests 188 passed (188)
BUILD_EXIT=0 ✓ Build complete (562ms)

Exit codes captured before any pipe. No changeset (this repo has none) and no objectstack.config.ts edit.

What changed in rework (6752ca7 → d03dcea)

Only AGENTS.md rule 4 and the test file's header comment. Rule 9 untouched; the walk itself untouched.

• Rule 4 restructured around scope rather than surface name, with the record-scoped half enforced and flow node/edge conditions as the stated single exception.
• The null failure model restored — it was correct for record-scoped surfaces, and the platform's own diagnostic uses the same words. My previous text implied null is never the failure model, which misled in the other direction.
• The shadowing paragraph and the ADR-0032 §1c throw kept, moved under the flow half where they belong.
• Test header opens with the scope framing so the file's narrow surface reads as precision, not omission.

Out of scope, filed

• The scoped bare-reference walk in test/assignment-fanout.test.ts passes on a real bare reference #37 — the older scoped walk in test/assignment-fanout.test.ts asks whether the source containsrecord.<field>, so a compound predicate with one qualified and one bare clause passes it. No shipped metadata is affected and the new file covers that case. Left alone here: that file is outside this card's declared surface and belongs to another card's PR.

One upstream issue considered and deliberately not filed.FLOW_NODE_EXPRESSION_PATHS does not list config.condition or edge.condition, which looked like an incomplete predicate-slot table. Its docstring says the omission is deliberate — they are structural surfaces on every node and edge rather than declared configSchema slots, and both validators already walk them. Commit 6752ca7 corrects a comment of mine that had implied the gap.

---

Generated by Claude Code

[os-warren]

Fixes#29

Three deliverables: the AGENTS.md rule 4 correction, the metadata-first rule, and the stopgap walk.

Rework round 2 (head d03dcea). My first rule 4 rewrite claimed validate does not flag a bare identifier "on any surface". That was false and is corrected below — scope decides, not surface name. Details in the "What changed in rework" section at the bottom.

1. AGENTS.md rule 4 — corrected, split by expression scope

The governing fact is scope, not surface name. An expression is evaluated either with the record bound as the record namespace and nothing at top level (record scope), or with the record's fields additionally flattened into top-level variables (flattened scope). validate judges a bare identifier only in the first.

Record-scoped surfaces — enforced, and there the failure really is null. Object validation rules, field conditional rules, action visible/disabled, sharing rules and hook conditions bind the record as a namespace only, so a bare name binds nothing, the expression evaluates to null, and the rule or action silently never fires. Measured on this branch, duly_task's skip_needs_reason rule mutated to a bare status:

✗ Author-time rules failed (1 issue)
• object 'duly_task' · validation 'skip_needs_reason': bare reference `status` —
a formula/validation expression binds the record as the `record` namespace,
not at top level, so `status` resolves to nothing and the expression silently
evaluates to null. Write `record.status`.

Exit 1, located, corrective — and the platform's own message states the mechanism, which is what makes the rewrite principled rather than patched.

Flow node and edge conditions are the single exception. They run in flattened scope, where a bare name may genuinely be a flow variable, so collectBoundRecordReads deliberately never judges one. status == "dispatched" in a flow start condition passes validate with exit 0.

And in a flow the failure is not null either — the paragraph that survives from the first rewrite, now correctly scoped to the flow half. A bare status resolves: to the flattened field, or to a same-named flow variable seeded first that shadows it (the subtler bug — the predicate reads correctly and silently means something else). When a name resolves to nothing the engine throws (ADR-0032 §1c). So on this one surface the outcomes are "silently means something else" and "loud runtime fault", never the quiet null of the record-scoped surfaces.

Links #14089 and points at the stopgap as deletable when it lands.

A premise divergence, recorded and since confirmed by the PM. The card quotes a rule 4 containing "(pnpm validate now rejects it)". That text is not in duly's AGENTS.md — on main rule 4 was a one-liner. The PM has confirmed they were quoting the objectstack monorepo's file. The other half of the card was verbatim true (lines 44–46 claimed a bare reference "evaluates to null and hides the action on every record"), and that sentence turned out to be correct for record-scoped surfaces — it is restored under that half rather than deleted.

2. AGENTS.md rule 9 — metadata first

New rule carrying all three required parts: declarative metadata over handler code (objects, views, flows, jobs, datasets, permission sets, actions are primary; a handler is the last resort); check the platform for a declarative way before writing a handler; and if the platform cannot express it, file an issue against objectstack-ai/objectstack and say so on the card rather than quietly working around the gap.

Appended as rule 9 rather than inserted as rule 1, deliberately. Inserting at the top renumbers rules 4–8, and rule 4 is referenced by number in this card and in the dispatch prompts for #2, #7 and #11 — all in flight. Position does not encode importance in this list anyway. Happy to absorb the renumber on request.

3. test/flow-predicates.test.ts — the stopgap

Labelled at the top as a stopgap pending #14089 and written to be deleted when that lands. Its header now opens with the scope framing: it covers the only predicate surfaces the platform leaves open, which is what makes walking just dulyFlows/dulyJobs the right scope rather than a narrowing.

The bar — a bare identifier is a finding when it (1) names a declared field of the bound object and (2) names no variable the flow declares. Deliberately the same bar #14089 proposes upstream, so the two cannot disagree about what a defect is.

Region recursion is the platform's, not hand-rolled.collectFlowGraphs yields the flow's own graph plus every nested region — loop.body, parallel.branches[], try_catch.try/.catch, nested — with readable scope labels. FLOW_REGION_CONFIG_KEYS gives the "container config without its regions" view so nested findings are not reported twice; FLOW_NODE_EXPRESSION_PATHS supplies the declared predicate slots. The scoped walk this repo already had reads config.body.edges directly, which covers loop and silently misses parallel and try_catch.

The false-positive case the exemption exists for is handled, and three structural guards keep the exemption sound rather than a hole:

• Declared variables come from flow.variables[].name plus every binder the spec declares — iteratorVariable / indexVariable / outputVariable / idVariable / errorVariable, plus an assignment node's top-level config keys, which are the author's variable names. A *Variable-shaped key the walk does not know fails a dedicated test rather than silently producing a false positive.
• No declared flow variable may shadow a field of the bound object — this is what makes the exemption airtight.
• Every record_change flow must bind an object this repo declares, so a flow with nothing to anchor on cannot pass by having nothing to check.

Narrowings, declared rather than hidden: the anchor is Object.keys(object.fields), so system columns (id, created_at, …) are not flagged — the spec exports no list of them and hand-copying one here would drift. A bare name that is neither a field nor a variable is never flagged.

dulyJobs is a tripwire, not a live check, and says so. Measured against JobSchema at @objectstack/spec 17.2.0, a job declares name / label / description / schedule / handler / retryPolicy / timeout / enabled and no predicate slot — its schedule is a cron envelope, not CEL, and its logic is a named handler function. Two assertions fail loudly if JobSchema grows a predicate slot, or if any job ever carries a CEL expression.

Proof it can fail — three ablation legs

Each on real metadata, each with the mutation confirmed on disk before measuring (injected and removed literals grepped, non-empty diffstat, abort otherwise — an anchor miss reads exactly like a passing ablation), each restored by an EXIT/INT/TERM trap, and the work committed first so the trap's git checkout -- restores from a real index. All three re-run on the final head d03dcea.

Leg	Surface / scope	Mutation	pnpm validate	Flow guard
1	flow start-node condition (flattened)	record.status == → bare status ==	exit 0 · ✓ Validation passed (260ms)	exit 1
2	flow nested loop-body edge (flattened)	isBlank(vars.existing_task) → … && needs_collection	exit 0 · ✓ Validation passed (327ms)	exit 1
3	duly_task validation rule (record)	record.status == → bare status ==	exit 1, located + corrective	exit 0 — correctly claims no credit

Findings from legs 1 and 2, verbatim:

duly_assignment_fanout · node 'start' config.condition:
reads 'status' bare — write record.status [status == "dispatched"]
duly_assignment_fanout · loop 'fan_out' body · edge 'fanout_e_missing' condition:
reads 'needs_collection' bare — write record.needs_collection
[isBlank(vars.existing_task) && needs_collection]

Leg 2 answers the card's region-recursion requirement on real metadata: the finding is located insideloop 'fan_out' body. Leg 3 is the rework's own check — it proves both halves of the corrected rule 4 in one run: validatedoes enforce the record-scoped surface, and the flow guard does not overclaim it. Restoration verified after each leg by absent-marker greps and git status --porcelain empty.

Six of the file's thirteen tests are a permanent in-file self-test over synthetic fixtures — the guard firing on a bare reference nested in a loop body, on the bare-string shorthand as well as the P envelope, on each field of a compound predicate; and not firing on a correctly qualified read, on a bare name that is a declared loop iterator, or on CEL builtins and string literals.

Gates

All four green on head d03dcea, working tree clean against it:

VALIDATE_EXIT=0 ✓ Validation passed (308ms)
TYPECHECK_EXIT=0
TEST_EXIT=0 Test Files 6 passed (6) Tests 188 passed (188)
BUILD_EXIT=0 ✓ Build complete (562ms)

Exit codes captured before any pipe. No changeset (this repo has none) and no objectstack.config.ts edit.

What changed in rework (6752ca7 → d03dcea)

Only AGENTS.md rule 4 and the test file's header comment. Rule 9 untouched; the walk itself untouched.

• Rule 4 restructured around scope rather than surface name, with the record-scoped half enforced and flow node/edge conditions as the stated single exception.
• The null failure model restored — it was correct for record-scoped surfaces, and the platform's own diagnostic uses the same words. My previous text implied null is never the failure model, which misled in the other direction.
• The shadowing paragraph and the ADR-0032 §1c throw kept, moved under the flow half where they belong.
• Test header opens with the scope framing so the file's narrow surface reads as precision, not omission.

Out of scope, filed

• The scoped bare-reference walk in test/assignment-fanout.test.ts passes on a real bare reference #37 — the older scoped walk in test/assignment-fanout.test.ts asks whether the source containsrecord.<field>, so a compound predicate with one qualified and one bare clause passes it. No shipped metadata is affected and the new file covers that case. Left alone here: that file is outside this card's declared surface and belongs to another card's PR.

One upstream issue considered and deliberately not filed.FLOW_NODE_EXPRESSION_PATHS does not list config.condition or edge.condition, which looked like an incomplete predicate-slot table. Its docstring says the omission is deliberate — they are structural surfaces on every node and edge rather than declared configSchema slots, and both validators already walk them. Commit 6752ca7 corrects a comment of mine that had implied the gap.

---

Generated by Claude Code

[os-warren]

Fixes#29

Three deliverables: the AGENTS.md rule 4 correction, the metadata-first rule, and the stopgap walk.

Rework round 2 (head d03dcea). My first rule 4 rewrite claimed validate does not flag a bare identifier "on any surface". That was false and is corrected below — scope decides, not surface name. Details in the "What changed in rework" section at the bottom.

1. AGENTS.md rule 4 — corrected, split by expression scope

The governing fact is scope, not surface name. An expression is evaluated either with the record bound as the record namespace and nothing at top level (record scope), or with the record's fields additionally flattened into top-level variables (flattened scope). validate judges a bare identifier only in the first.

Record-scoped surfaces — enforced, and there the failure really is null. Object validation rules, field conditional rules, action visible/disabled, sharing rules and hook conditions bind the record as a namespace only, so a bare name binds nothing, the expression evaluates to null, and the rule or action silently never fires. Measured on this branch, duly_task's skip_needs_reason rule mutated to a bare status:

✗ Author-time rules failed (1 issue)
• object 'duly_task' · validation 'skip_needs_reason': bare reference `status` —
a formula/validation expression binds the record as the `record` namespace,
not at top level, so `status` resolves to nothing and the expression silently
evaluates to null. Write `record.status`.

Exit 1, located, corrective — and the platform's own message states the mechanism, which is what makes the rewrite principled rather than patched.

Flow node and edge conditions are the single exception. They run in flattened scope, where a bare name may genuinely be a flow variable, so collectBoundRecordReads deliberately never judges one. status == "dispatched" in a flow start condition passes validate with exit 0.

And in a flow the failure is not null either — the paragraph that survives from the first rewrite, now correctly scoped to the flow half. A bare status resolves: to the flattened field, or to a same-named flow variable seeded first that shadows it (the subtler bug — the predicate reads correctly and silently means something else). When a name resolves to nothing the engine throws (ADR-0032 §1c). So on this one surface the outcomes are "silently means something else" and "loud runtime fault", never the quiet null of the record-scoped surfaces.

Links #14089 and points at the stopgap as deletable when it lands.

A premise divergence, recorded and since confirmed by the PM. The card quotes a rule 4 containing "(pnpm validate now rejects it)". That text is not in duly's AGENTS.md — on main rule 4 was a one-liner. The PM has confirmed they were quoting the objectstack monorepo's file. The other half of the card was verbatim true (lines 44–46 claimed a bare reference "evaluates to null and hides the action on every record"), and that sentence turned out to be correct for record-scoped surfaces — it is restored under that half rather than deleted.

2. AGENTS.md rule 9 — metadata first

New rule carrying all three required parts: declarative metadata over handler code (objects, views, flows, jobs, datasets, permission sets, actions are primary; a handler is the last resort); check the platform for a declarative way before writing a handler; and if the platform cannot express it, file an issue against objectstack-ai/objectstack and say so on the card rather than quietly working around the gap.

Appended as rule 9 rather than inserted as rule 1, deliberately. Inserting at the top renumbers rules 4–8, and rule 4 is referenced by number in this card and in the dispatch prompts for #2, #7 and #11 — all in flight. Position does not encode importance in this list anyway. Happy to absorb the renumber on request.

3. test/flow-predicates.test.ts — the stopgap

Labelled at the top as a stopgap pending #14089 and written to be deleted when that lands. Its header now opens with the scope framing: it covers the only predicate surfaces the platform leaves open, which is what makes walking just dulyFlows/dulyJobs the right scope rather than a narrowing.

The bar — a bare identifier is a finding when it (1) names a declared field of the bound object and (2) names no variable the flow declares. Deliberately the same bar #14089 proposes upstream, so the two cannot disagree about what a defect is.

Region recursion is the platform's, not hand-rolled.collectFlowGraphs yields the flow's own graph plus every nested region — loop.body, parallel.branches[], try_catch.try/.catch, nested — with readable scope labels. FLOW_REGION_CONFIG_KEYS gives the "container config without its regions" view so nested findings are not reported twice; FLOW_NODE_EXPRESSION_PATHS supplies the declared predicate slots. The scoped walk this repo already had reads config.body.edges directly, which covers loop and silently misses parallel and try_catch.

The false-positive case the exemption exists for is handled, and three structural guards keep the exemption sound rather than a hole:

• Declared variables come from flow.variables[].name plus every binder the spec declares — iteratorVariable / indexVariable / outputVariable / idVariable / errorVariable, plus an assignment node's top-level config keys, which are the author's variable names. A *Variable-shaped key the walk does not know fails a dedicated test rather than silently producing a false positive.
• No declared flow variable may shadow a field of the bound object — this is what makes the exemption airtight.
• Every record_change flow must bind an object this repo declares, so a flow with nothing to anchor on cannot pass by having nothing to check.

Narrowings, declared rather than hidden: the anchor is Object.keys(object.fields), so system columns (id, created_at, …) are not flagged — the spec exports no list of them and hand-copying one here would drift. A bare name that is neither a field nor a variable is never flagged.

dulyJobs is a tripwire, not a live check, and says so. Measured against JobSchema at @objectstack/spec 17.2.0, a job declares name / label / description / schedule / handler / retryPolicy / timeout / enabled and no predicate slot — its schedule is a cron envelope, not CEL, and its logic is a named handler function. Two assertions fail loudly if JobSchema grows a predicate slot, or if any job ever carries a CEL expression.

Proof it can fail — three ablation legs

Each on real metadata, each with the mutation confirmed on disk before measuring (injected and removed literals grepped, non-empty diffstat, abort otherwise — an anchor miss reads exactly like a passing ablation), each restored by an EXIT/INT/TERM trap, and the work committed first so the trap's git checkout -- restores from a real index. All three re-run on the final head d03dcea.

Leg	Surface / scope	Mutation	pnpm validate	Flow guard
1	flow start-node condition (flattened)	record.status == → bare status ==	exit 0 · ✓ Validation passed (260ms)	exit 1
2	flow nested loop-body edge (flattened)	isBlank(vars.existing_task) → … && needs_collection	exit 0 · ✓ Validation passed (327ms)	exit 1
3	duly_task validation rule (record)	record.status == → bare status ==	exit 1, located + corrective	exit 0 — correctly claims no credit

Findings from legs 1 and 2, verbatim:

duly_assignment_fanout · node 'start' config.condition:
reads 'status' bare — write record.status [status == "dispatched"]
duly_assignment_fanout · loop 'fan_out' body · edge 'fanout_e_missing' condition:
reads 'needs_collection' bare — write record.needs_collection
[isBlank(vars.existing_task) && needs_collection]

Leg 2 answers the card's region-recursion requirement on real metadata: the finding is located insideloop 'fan_out' body. Leg 3 is the rework's own check — it proves both halves of the corrected rule 4 in one run: validatedoes enforce the record-scoped surface, and the flow guard does not overclaim it. Restoration verified after each leg by absent-marker greps and git status --porcelain empty.

Six of the file's thirteen tests are a permanent in-file self-test over synthetic fixtures — the guard firing on a bare reference nested in a loop body, on the bare-string shorthand as well as the P envelope, on each field of a compound predicate; and not firing on a correctly qualified read, on a bare name that is a declared loop iterator, or on CEL builtins and string literals.

Gates

All four green on head d03dcea, working tree clean against it:

VALIDATE_EXIT=0 ✓ Validation passed (308ms)
TYPECHECK_EXIT=0
TEST_EXIT=0 Test Files 6 passed (6) Tests 188 passed (188)
BUILD_EXIT=0 ✓ Build complete (562ms)

Exit codes captured before any pipe. No changeset (this repo has none) and no objectstack.config.ts edit.

What changed in rework (6752ca7 → d03dcea)

Only AGENTS.md rule 4 and the test file's header comment. Rule 9 untouched; the walk itself untouched.

• Rule 4 restructured around scope rather than surface name, with the record-scoped half enforced and flow node/edge conditions as the stated single exception.
• The null failure model restored — it was correct for record-scoped surfaces, and the platform's own diagnostic uses the same words. My previous text implied null is never the failure model, which misled in the other direction.
• The shadowing paragraph and the ADR-0032 §1c throw kept, moved under the flow half where they belong.
• Test header opens with the scope framing so the file's narrow surface reads as precision, not omission.

Out of scope, filed

• The scoped bare-reference walk in test/assignment-fanout.test.ts passes on a real bare reference #37 — the older scoped walk in test/assignment-fanout.test.ts asks whether the source containsrecord.<field>, so a compound predicate with one qualified and one bare clause passes it. No shipped metadata is affected and the new file covers that case. Left alone here: that file is outside this card's declared surface and belongs to another card's PR.

One upstream issue considered and deliberately not filed.FLOW_NODE_EXPRESSION_PATHS does not list config.condition or edge.condition, which looked like an incomplete predicate-slot table. Its docstring says the omission is deliberate — they are structural surfaces on every node and edge rather than declared configSchema slots, and both validators already walk them. Commit 6752ca7 corrects a comment of mine that had implied the gap.

---

Generated by Claude Code