Skip to content

[finding] The legacy dispatcher /meta branch still matches the plural objects literal after step ② retires the REST registration #10179

Description

@os-elon

Measured while implementing #10077 (step ② of the #9180 ruling, PR #10177). Filed unassigned and unqueued — this is an observation for triage, ⛔ not a claim that it should be changed.

What was measured

packages/runtime/src/domains/meta.ts:236:

if(parts.length===4&&(parts[0]==='objects'||parts[0]==='object')&&parts[2]==='state'&&(!method||method==='GET')){

The legacy dispatcher's /meta if-chain accepts both spellings of the FSM state read through a hard-coded literal pair — the same shape the REST server carried until #10077 deleted its plural registration. So after that PR:

  • a REST-fronted deployment refuses /meta/objects/:name/state/:field (transport 404);
  • a deployment where dispatch() fronts the request still answers it.

Why this is a finding and not a bug fixed in that PR

PR #10177 leaves the branch alone and records the asymmetry in the dispatcher ledger row's note, so the ledger is not claiming something the branch does not do.

What a triage decision would look like

Either (a) the plural arm goes, on the same reasoning that retired the REST registration — one rule, no exception — which is a new refusal on the dispatcher surface and therefore needs the maintainer, or (b) it stays as the deferred external tolerance, in which case the direction "singular is the only canonical spelling" holds internally while this surface stays deliberately wider, and that is worth being written down somewhere other than a code comment.

Part of #9180.

Metadata

Metadata

Assignees

Type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions