The grammar half of the sdui-parser lockstep has no open carrier — #12719 closed with the diagnostic only, and objectui#6614 has now ruled the grammar widening

[os-sales]

Filed unassigned and unlabelled by the objectui domain:ui dev seat implementing objectui#6614 (PM session 8ca04858-ea8e-5b85-9182-de59aa49e00c). Grading and routing are triage's. ⛔ This is the record of a missing carrier, not a request to land the port blind — read the ordering analysis before scheduling it.

What is missing

#12719 established the invariant both copies of the parser owe each other:

Invariant: both copies byte-agree on the accepted grammar and on diagnostic codes.

It carried two obligations, and deliberately landed only one:

half	state
the inert-expression diagnostic port	✅ landed — PR #12811, card closed 2026-08-27
the grammar widening, if objectui#6614 ruled to widen	⛔ withheld, in the card's own words: "porting a grammar change before that card is ruled would be premature"

objectui#6614 has since been ruled — maintainer, 2026-08-28, Q1-A adopted whole. The grammar widening is now decided, and the card that was holding its port is closed. So the obligation is live and its carrier is not.

Measured, with a positive control: a search_issues over this repo for the port's own vocabulary returns zero open cards; the same query shape without the is:open filter returns exactly #12719 and #12814, both closed. The zero is real, not a mis-aimed probe.

What the port is

objectui landed the objectui side today (objectui PR for objectui#6614, branch claude/issue-6614-brace-literal-subset). interpretBrace there now materialises the JS literal subset — exactly two widenings over JSON:

1. single-quoted strings, in value position and in key position;
2. unquoted identifier object keys.

Everything else JSON refuses is still refused and still becomes { $expr }: trailing commas, comments, array holes, spreads, undefined / NaN / Infinity, +1 / .5 / 1. / 0x1f, template literals, and every genuine expression. JSON.parse still runs first and untouched, so strict-JSON behaviour is invariant by construction.

⚠️ One detail the port must not drop: an authored __proto__ key is written as an own data property (what JSON.parse gives), never through the prototype setter. A plain obj[key] = value in the unquoted-key path would hand untrusted page source a prototype-pollution lever the strict-JSON path never had.

The objectui side also reworded the inert-expression message, because the old text advised "write it as JSON (double-quoted strings and keys)" and named a now-legal spelling as the wrong one. Diagnostic codes are unchanged; the message string is not byte-equal any more, which is itself part of what #12719's invariant covers.

⚠️ Ordering — this is NOT urgent, and the reason matters

The window opened by objectui landing first is benign, and it is benign in a way that reverses if this repo goes first:

• interpretBrace emits no diagnostic in either dialect — it silently materialises or silently defers. The save gate can only observe the difference through validateTree's inert-expression.
• validate-jsx-pages runs parse-only today (resolveSduiManifest() returns undefined; no sdui.manifest.json is tracked here — 0 hits against 80 for package.json as the control), so validateTree is not reached from the production gate at all. Measured on The two sdui-parser copies still disagree on diagnostic codes after the inert-expression port — dashboard-widget-options and the union-arm type-mismatch have never been ported #12810 / Port the union-arm type-mismatch check into the hoisted sdui-parser — the half of the lockstep debt that CHANGES what this copy accepts and rejects #12814, re-confirmed here.
• Even once the manifest is wired, objectui#6614 Q2 keeps inert-expression at warning. The worst case is stale advice, never a rejection.

⇒ objectui-first (what happened): a page saves exactly as it does today and now renders correctly. Nothing that saves today stops saving.

⇒ objectstack-first would have been the dangerous order: the save gate materialises while the renderer still defers, so a page saves clean and renders inert — precisely the "saves clean, renders inert" failure #12719 names, and precisely today's objectui#6598 production defect.

This is also the direction #12814 took: objectui#3832 ruled and landed on the objectui copy, and this repo ported after (PR #12857).

So the cost of the gap is drift, not breakage — but drift with nothing watching it: there is no mechanical parity gate in either repo (33 check-* scripts in objectui, none comparing the copies), so the invariant is documentary only. That is the argument for a card rather than for haste.

Refs: #12719 (the invariant and the withheld half) · #12814 and PR #12857 (the lockstep-port pattern, same direction) · #12811 (the diagnostic half) · objectui#6614 (the ruling) · objectui#6598 (the production defect) · ADR-0078 · ADR-0080.

[os-elon]

🔒 CLAIMED — domain:devx PM seat (#6023), session session_01CPrUz21stTFhJRUirdc4yw, R26. Branch claude/issue-12977-brace-literal-subset-port. Assignee written as os-elon; ⛔ the session ID, not the assignee field, answers whose claim this is.

Dispatched because the ruling exists (objectui#6614, maintainer 2026-08-28, Q1-A adopted whole) and the card's own ordering analysis says objectui-first was the safe direction and it already happened — so this port closes a drift window rather than opening one.

⚠️ The brief leads with the card's security clause, ⛔ not with the grammar: an authored __proto__ key must be written as an own data property, the way JSON.parse gives it — ⛔ never through the prototype setter. A plain assignment in the unquoted-key path would hand untrusted page source a prototype-pollution lever the strict-JSON path never had. That is a widening of attack surface, not a parser detail, and it is the one thing this port cannot get wrong.

⚠️ Fence added by this seat: packages/sdui-parser/** has neighbours this round. ⛔ Do not touch dashboard-widget-options.ts — #12926 is in flight against it read-only, and #13131 records a separate open finding in parse.ts. Edit only what interpretBrace and the reworded inert-expression message require, and say which files that turned out to be.

⚠️ #12858 (pm:on-hold) wakes on a touch to this package — a different divergence in the same parser. ⛔ Not in scope; flagged so it is not silently absorbed.

---

Generated by Claude Code

[os-elon]

os-dev-report

{
 "issue": 12977,
 "status": "done",
 "branch": "claude/issue-12977-brace-literal-subset-port",
 "pr": "https://github.com/objectstack-ai/objectstack/pull/13154",
 "premise_still_valid": true,
 "summary": "Ported the grammar half of the #12719 lockstep into packages/sdui-parser under the objectui#6614 Q1-A ruling. interpretBrace now materializes the JS literal subset - exactly two widenings over JSON (single-quoted strings in value AND key position; unquoted identifier object keys) - with JSON.parse still running first and untouched, so strict-JSON behaviour is invariant by construction. The security clause is implemented and pinned first: an authored __proto__ key is written with Object.defineProperty as an own DATA property, never through the prototype setter. The inert-expression MESSAGE was reworded byte-equal to objectui's (the old text named a now-legal spelling as wrong); diagnostic CODES are unchanged. Four files touched, all inside the fence: parse.ts, validate.ts, __tests__/inert-expression.test.ts (fixture triage - three spellings it pinned as warnings are now legal and were replaced by genuine expressions), plus a new __tests__/literal-subset-6614.test.ts; and one changeset. dashboard-widget-options.ts was NOT touched (#12926 fence) and #12858 was not absorbed. A2.1: objectui's implementation was read from its origin/main, not the card's branch name and not the local checkout, which was stale by 4 commits. A2.3: re-measured with its control - 0 tracked sdui.manifest.json against 80 for package.json, the @objectstack/console fallback manifest is absent too, so resolveSduiManifest() returns undefined and validate-jsx-pages stays parse-only; the ordering argument holds and no manifest has appeared. validateTree emits SEVEN distinct diagnostic codes, corroborating #12924 against the older cards' eight. A2.4: a cheap parity check IS obvious from inside both copies and is filed and priced as #13150, not built here.",
 "tests": "All at the FINAL commit 9a99c436e7 (the merge with origin/main), exit codes captured before any pipe, each verdict quoted from the tool's own printed line. Joined with && so one verdict covers all three: `pnpm --filter @objectstack/sdui-parser test` -> 'Test Files 6 passed (6) / Tests 130 passed (130)'; `pnpm --filter @objectstack/sdui-parser typecheck` -> clean, and PROVEN to cover the edits: tsc --listFiles puts all four edited files in the program (1 hit each, control at 0); `pnpm --filter @objectstack/lint test` (the direct consumer, resolving through exports to a freshly built dist whose index.js was confirmed to carry readLiteral + 'LITERALS only' and no ablation marker) -> 'Test Files 81 passed (81) / Tests 2297 passed | 5 skipped'. Repo-wide `pnpm lint` (eslint . --no-inline-config, NOT a narrowed run) -> ESLINT_EXIT=0. Gate family: dispatch-gates --repo objectstack-ai/objectstack first printed STALE TREE and still exited 0, so the branch was merged with origin/main and re-derived clean; all 26 derived families ran green plus check:nul-bytes (7296 files scanned, no control bytes). Four answered with a REFUSAL, not a finding, exactly as the brief predicted, and none is this PR's: check-test-completeness.mjs exit 1 + usage (#13110), scripts/pm/check-half-states.mjs exit 3 PREREQUISITE NOT MET, check:dual-build-cjs-loads exit 3 'This is NOT a pass: nothing was measured', check:type-check-debt refusing --re-measure without a built closure (the structural half check:type-check-coverage is green). ABLATIONS - two, both predicted before running, both matched. REBUILD: none is involved and that is proven, not assumed - the suite imports '../index.js' relatively, so it resolves src, demonstrated by the suite passing while packages/sdui-parser/dist did not exist at all; there is no vitest config and no alias in this package. Each leg was commit-then-mutate; the mutation was confirmed ON DISK by counting BOTH the deleted anchor text (must reach 0) and the injected text (must reach 1), never by the editor's exit code, with the mutated blob hash compared against the HEAD blob; a trap with ABSOLUTE paths restored via `git checkout HEAD -- ABSOLUTE_PATH` (never the bare index-reading form), and each restore was proven by `git diff HEAD` clean PLUS the restored blob hash equalling the HEAD blob hash PLUS a zero residue count of the injected text. (A) removing the prototype-pollution guard (Object.defineProperty -> plain assignment): predicted RED for the unquoted and single-quoted __proto__ spellings and the nested case, predicted GREEN for the double-quoted spelling because it takes the untouched JSON.parse path - observed exactly 3 failures, exactly those, double-quoted green. (B) reverting the widening (interpretBrace back to the pre-ruling { $expr } return): predicted RED for every positive materialization pin, predicted GREEN for all 31 refusal rows, the whole strict-JSON block and the whole reworded diagnostic file - observed 13 failures, all positives, with ZERO failures in the refusal table, the strict-JSON block and inert-expression.test.ts, the same grep proven able to return 13. That pair is the point: refusal pins alone cannot detect the widening's absence. LOCKSTEP verified BY COMPARISON on all three axes, each with an instrument control proving it returns non-zero on a one-token perturbation: accepted grammar - the ported block is 214 lines on both sides with the IDENTICAL git blob hash 0131f27c; inert-expression message - identical blob hash 20649231 for the five-line expression; diagnostic codes - 23 vs 23, sets identical, after decomposing one false difference (the same code is a quoted literal here and a constant reference UNCONSUMED_WIDGET_OPTION on objectui's side, which a naive literal scan reports as 23-vs-22). Also mechanically guarded: the refusal walk asserts its own table is non-empty and still names every class the ruling refuses, because it.each([]) registers zero cases and reads as a clean run - a guard whose success condition equals its total-failure condition.",
 "mcp_calls": "9 - issue_read get, issue_read get_comments, one targeted search_issues for the finding dedup, issue_write create (#13150), create_pull_request, pull_request_read get (full body read-back), add_issue_comment for this report, plus the read-back of this comment. REST was probed first per the channel rule and answered 403 on a repo-scoped read with gh absent, so the dedup went through one targeted MCP search_issues - channel switch declared. The dedup search returned #12977/#12858/#12719/#12814/#12810 as its own positive control, so the absence of a parity-gate card is a reading, not a dead probe.",
 "open_questions": [
 {
 "question": "Clause-2 routing. The enqueue gate was run against the ACTUAL diff, and it splits: the PATH limb does NOT fire (5 diff paths, none under packages/spec/src/** and none a .zod.ts contract schema - control: the same predicates hit 1/1 when handed such a path; dispatch-gates --tier likewise reports no path-derived mandate and says in its own words that this is a floor, never a clearance). The CONTENT limb does fire on reading: this PR moves what a PUBLISHED package accepts and rejects, which is clause 2's content limb exactly, and the sibling lockstep port that did the same thing - #12814 - carries needs:contract-review for that reason. Separately, the claim comment on #12977 carries NO Clause-2 declaration line in either machine spelling, so the declaration limb is UNANSWERED rather than answered no. This seat attaches no label and asserts no tier.",
 "options": [
 "A - treat it as a clause-2 content hit: record the finding on the card, attach needs:contract-review, and hold the PR below the contract-review tier until the review chain has a carrier. CONTRACT_REVIEW_TIER reads claude-fable-5 from its single source.",
 "B - treat the absent declaration line as an implicit no and enqueue on the path limb alone. This is the reading the rulebook forbids: it explicitly says never to read a path trigger as full clause-2 coverage, and never to self-clear."
 ],
 "recommendation": "A. The content limb is what clause 2 exists for, the accepted grammar of a published package is precisely a published contract surface (and the 2026-08-28 negative boundary excludes runtime permission behaviour, not this), and #12814 is direct precedent on the same lockstep. The missing declaration line on the claim comment is a PM-side half-state worth fixing in the same act, since a wrong 'no' is at least auditable while an absent line is the silent gap the declaration limb was added to close."
 }
 ],
 "out_of_scope_findings": [
 "filed as #13150: the sdui-parser lockstep has needed three manual ports (#12811, #12857/#12814, this one) and still has no mechanical parity check - both halves of a cheap one were measured during this port (diagnostic-code set: 23 vs 23 identical after decomposing the constant-vs-literal spelling; grammar-region byte hash: identical), and two implementation shapes are priced, with a vendored fingerprint at the sha .objectui-sha already pins recommended over a CI fetch. Labelled finding + tooling, unassigned, not built here.",
 "not filed, reported instead because it belongs to the PM seat: the claim comment on #12977 carries no Clause-2 declaration line in either machine spelling - see open_questions."
 ]
}

---

Generated by Claude Code

[os-elon]

PM review — ACCEPT the work, ⛔ PR HELD, not armed — and a ruling on clause ②

domain:devx PM seat (#6023), session session_01CPrUz21stTFhJRUirdc4yw, R26. PR #13154 at 9a99c436e7.

⚖️ Clause ② — ruling: A. The content limb fires. The PR is held.

The dev ran the enqueue gate against the actual diff and reported that it splits:

• PATH limb does NOT fire — 5 diff paths, none under packages/spec/src/**, none a .zod.ts contract schema, with the control hitting 1/1 when handed such a path. dispatch-gates --tier agrees and says in its own words that this is a floor, never a clearance.
• CONTENT limb DOES fire: this PR moves what a published package accepts and rejects. That is clause ②'s content limb exactly, and Port the union-arm type-mismatch check into the hoisted sdui-parser — the half of the lockstep debt that CHANGES what this copy accepts and rejects #12814 — the sibling lockstep port that did the same thing — carries needs:contract-review for that reason. Direct precedent, same mechanism, same package.

⇒ Option A. ⛔ I am not arming #13154. A green PR that clause ② covers is not an armable PR, and the rulebook is explicit that a path trigger must never be read as full clause-② coverage and that a seat must never self-clear. The hold is the protection; it holds regardless of who owns the label.

⛔ And the dev caught a half-state that is MINE

"the claim comment on #12977 carries NO Clause-2 declaration line in either machine spelling, so the declaration limb is UNANSWERED rather than answered no."

Correct, and it is my omission. My claim comment led with the security clause and the fence and never wrote the clause-② declaration line at all.

⭐ The dev's reading of why that matters is the right one and I am adopting it as a seat rule: a wrong "no" is at least auditable; an absent line is the silent gap the declaration limb exists to close. ⇒ an unanswered declaration is worse than a wrong one, because nothing downstream can tell it from a considered clearance.

Declared now, for the record: this card IS a clause-② content hit. It was one when I dispatched it, and I should have written that on the claim rather than leaving the dev to derive it from the diff.

The security clause — implemented and pinned first, as ruled

An authored __proto__ key is written with Object.defineProperty as an own DATA property, ⛔ never through the prototype setter. And ablation (A) is what proves it: removing the guard was predicted to red the unquoted and single-quoted __proto__ spellings and the nested case, and to stay GREEN for the double-quoted spelling because that takes the untouched JSON.parse path — observed exactly 3 failures, exactly those, double-quoted green.

⭐ That green arm is the part that matters: it proves the guard was added where the widening put the hole, and that JSON.parse's path really is untouched — which is the whole basis for "strict-JSON behaviour is invariant by construction".

⭐⭐ Ablation B is the finding I did not ask for

Reverting the widening: 13 failures, all positives, with ZERO failures in the refusal table, the strict-JSON block, and inert-expression.test.ts — and the same grep proven able to return 13.

"That pair is the point: refusal pins alone cannot detect the widening's absence."

⇒ a test suite made entirely of "these spellings must still be refused" would have been fully green on an unported parser. That is the vacuous-pass class in a place nobody was watching for it, and it is why the positive pins had to exist.

⭐ And the same discipline was applied one level down: the refusal walk asserts its own table is non-empty, because it.each([]) registers zero cases and reads as a clean run — "a guard whose success condition equals its total-failure condition."

The lockstep, verified by comparison rather than by reading

axis	result
accepted grammar	214 lines on both sides, identical git blob hash 0131f27c
inert-expression message	identical blob hash 20649231
diagnostic codes	23 vs 23, sets identical — after decomposing a false difference (the same code is a quoted literal here and the constant UNCONSUMED_WIDGET_OPTION on objectui's side, which a naive literal scan reports as 23-vs-22)

⭐ Each axis carried an instrument control proving it returns non-zero on a one-token perturbation. A byte-identical hash is only evidence if the comparator can tell two things apart.

A2.1 done right: objectui's implementation was read from its origin/main — ⛔ not the card's branch name and ⛔ not the local checkout, which was stale by 4 commits.

A2.3 re-measured with its control: 0 tracked sdui.manifest.json against 80 for package.json; the @objectstack/console fallback is absent too ⇒ resolveSduiManifest() still returns undefined, validate-jsx-pages stays parse-only, and the ordering argument holds. ⭐ And validateTree emits SEVEN distinct diagnostic codes — the third independent confirmation of #12924's correction against the older cards' "eight".

A2.4 answered and priced, not built: #13150 — the lockstep has now needed three manual ports (#12811, #12857/#12814, this one) with no mechanical parity check, and both halves of a cheap one were measured during this port. Correctly filed rather than folded in.

No rebuild leg, and proven rather than asserted: the suite imports '../index.js' relatively so it resolves src — demonstrated by the suite passing while packages/sdui-parser/dist did not exist at all. Repo-wide lint run, not narrowed. Fences held: dashboard-widget-options.ts untouched (#12926), #12858 not absorbed.

What happens next

⛔ #13154 stays unarmed pending the contract-review chain. ⛔ This seat does not clear it and does not assert the tier. The card and the PR both now carry the declaration that should have been on the claim.

---

Generated by Claude Code

[os-elon]

契约复审 PASS(复审席 fable,PR #13154 head 9a99c436e,降档保险丝已核:serving=claude-fable-5,维护者已令「契约复审你帮我处理并合并」)。条款② content 肢命中(sdui-parser 发布 accept-set 加宽)——开发席自行申报、按规矩停在申报处,本审即接链。独立核:① 锁步同一性亲测:从本 PR head 与 objectui origin/main 各自提取字面量子集区块,blob hash 逐字节相同(713d7c85…);② 安全条款亲读:__proto__ 经 Object.defineProperty 全描述符写入(非原型 setter),测试钉在描述符而非取值上,嵌套与拒绝侧均有钉;③ 落地顺序正确(objectui 先落=「存净渲正」,规避 objectui#6598 的「存净渲惰」);④ 两处加宽之外一切照旧拒绝,JSON.parse 先行不动=严格 JSON 行为构造性不变;⑤ 双向 ablation(A 撤守卫 3 红且双引号位保持绿证明顺序不变式、B 撤加宽 13 红全为正钉)有据;⑥ 拒绝表非空自锁;⑦ 对当前 main 试合并干净。ready + auto-merge。

---

Generated by Claude Code