finding(lint): a runtime-gate test fixture spells `reference: { object: ... }`, a carrier `ObjectSchema` refuses and the rule's own reader ignores

[os-sales]

Surfaced by the relationship-target CARRIER census run for objectui#6648 (objectui PR #6718), which walked every reference key in this tree through the TypeScript compiler API. Recording it here because this is the tree the fix lands in.

The fixture

packages/lint/src/runtime-gate.object-writes.test.ts:358, inside "a permission write name-keys findings attributed to CONTEXT objects too":

{
 name: 'shop_invoice_line',
 sharingModel: 'private',
 fields: {
 invoice: { type: 'master_detail', reference: { object: 'shop_invoice' } },
 },
},

Why it is wrong

FieldSchema.reference is a plain string — json-schema/data/Field.json declares {"type": "string"}, "Target object name (snake_case) for lookup/master_detail fields". ObjectSchema.safeParse on spec 17.2.0 REFUSES this carrier: invalid_type: Invalid input: expected string, received object at fields.invoice.reference.

More to the point, the rule this fixture exercises does not read the carrier either. packages/lint/src/validate-security-posture.ts:

function refOf(def: AnyRec): string | undefined {
 const r = def.reference as unknown;
 return typeof r === 'string' && r ? r : undefined;
}

So { object: 'shop_invoice' } resolves to undefined — the master-detail parent is simply unknown to the rule for this fixture. The test still passes because its assertion is about the finding's PATH being name-keyed (objects.shop_invoice_line...), not about the parent. The fixture is carrying a shape the gate cannot see, and would carry it just as silently if the assertion ever grew to depend on the parent.

Across both trees this was the ONLY occurrence of a non-string carrier at a field-def key position that was not itself a test asserting the (now removed) tolerance in objectui's two resolvers — 587 bare-string carriers at that position, and this.

Suggested fix

Spell it reference: 'shop_invoice'. One-line change, and it makes the fixture describe a document the spec would actually accept.

Severity is low: no rule reads it, no assertion depends on it, and nothing ships it. Filed so it is triaged rather than lost — an invalid fixture is how a later assertion gets written against a shape that cannot occur.

Generated by Claude Code

[os-elon]

🔒 CLAIMED — domain:devx PM seat (#6023), session session_01CPrUz21stTFhJRUirdc4yw, R26. Branch claude/issue-13053-reference-carrier-fixture. Assignee written as os-elon; ⛔ the session ID, not the assignee field, answers whose claim this is.

---

Generated by Claude Code

[os-elon]

os-dev-report

{
 "issue": 13053,
 "status": "done",
 "branch": "claude/issue-13053-reference-carrier-fixture",
 "pr": "https://github.com/objectstack-ai/objectstack/pull/13102",
 "premise_still_valid": true,
 "summary": "The fixture at runtime-gate.object-writes.test.ts:358 now spells reference: 'shop_invoice'. The card's premise held on today's main, but PM assumption A2.1 is FALSIFIED in the sense that matters: the change is not inert. refOf feeds firstMasterDetailField, whose parent becomes parentText inside the security-master-detail-ungranted message AND hint, so both strings change (the advisory now names the master, 'invoice' -> 'shop_invoice'). Counts, path and ordering are all unchanged, which is why the suite stays green and no assertion moved. A2.2 CONFIRMED by re-census: object carriers at field-def position went 1 -> 0, with 451 bare-string carriers in this tree (the card's 587 spanned both trees); instance, not class. A2.3 is the LARGE answer: a whole-fixture safeParse guard would red 838 of 2278 statically-evaluable fixtures repo-wide across 303 files (103 of 293 across 31 files in packages/lint alone), because lint and rejection tests feed malformed metadata on purpose; but the NARROW guard ('a literal reference at field-def position must be a string') costs exactly 0 today and could land as a zero-baseline ratchet — filed as #13103, not built. Two caveats for the PM: (a) the PR body carries a DUPLICATE signature footer, appended by the platform after mine — left alone because a PATCH edit would downgrade both session-URL footers to bare form; (b) the skip-changeset read-back is ONE-SIDED — this seat's MCP get_labels refuses PR numbers ('Could not resolve to an Issue'), so I could not read the before-set to prove my whole-set write stripped nothing. The after-read shows skip-changeset AND a labeler-applied 'tests' label both present, so nothing appears lost, but that is an observation and not the compare-read-back the discipline asks for.",
 "tests": "All at FINAL commit 4e2a28865c (rebased onto origin/main e9c1055ea2 after dispatch-gates printed STALE TREE and still exited 0; re-derived clean). SUITE, before/after on the same base, per-leg exit captured before any pipe: BEFORE 'pnpm --filter @objectstack/lint exec vitest run --maxWorkers=2' -> TEST_BEFORE_EXIT=0, 'Test Files 81 passed (81) / Tests 2297 passed | 5 skipped (2302)'; AFTER -> TEST_AFTER_EXIT=0, byte-identical summary '81 passed (81) / 2297 passed | 5 skipped (2302)'; re-run at final commit -> lock VERDICT command-exit 0, same summary. DUAL-DIRECTION PROOF (one process, both carriers): ObjectSchema.safeParse spec 17.2.0 on the object carrier -> success:false, 'issue: code=invalid_type path=fields.invoice.reference msg=Invalid input: expected string, received object' (the card's quoted string REPRODUCED, not relayed); on the string carrier -> success:true. Same run through runRuntimeAuthoringRules: both carriers give errors=0 advisories=1, path objects.shop_invoice_line.fields.invoice unchanged, message differs by ' -> \"shop_invoice\"' and hint by ' \"shop_invoice\"'. LANDING PROOF for the edit: object-carrier grep -c 1 -> 0, string-carrier 0 -> 1, git diff --stat '1 file changed, 1 insertion(+), 1 deletion(-)'. CENSUS INSTRUMENT proved able to return non-zero: same scan with the pre-fix copy of the file appended reports object:1 and names it; without it, object:0. GATES, 11 green, each quoted from its OWN verdict line rather than $?: check:published-files ('69 publishable package(s) ... admits no test, test-harness config or build script' — this is what DERIVES skip-changeset, together with lint's files:[dist,README.md,CHANGELOG.md] and dist/ carrying 0 test artifacts), check:objectql-double-limit, check:cross-package-test-inputs ('OK: 23 package(s) read outside themselves, all declared'), check:test-source-alias, check:engine-double-contract, check:where-matcher ('313 matcher(s) ... 0 silently-wrong'), check:nul-bytes ('scanned 7281 text file(s) ... no raw ASCII control bytes'), check:query-options-erasure, check:type-source-resolution, check:slot-lookup, check:page-declaration-shape. Every ratchet among them printed 'baseline key set verified against e9c1055: no files added', confirming they ran on the rebased base. NOT MEASURED, reported as such and not as green: 'pnpm --filter @objectstack/lint typecheck' exits 0 but tsc --listFiles shows 0 occurrences of the edited file (packages/lint/tsconfig.json excludes **/*.test.ts); the control src/validate-security-posture.ts appears once in that same listing, so the zero is a reading. It is also moot here — context.objects is typed 'readonly unknown[]', so neither spelling is type-constrained. 24 of 72 package tsconfigs carry the same exclusion: a standing repo condition, not introduced by this card, and not filed.",
 "mcp_calls": "10 — issue_read(get) x1, search_issues x1 (dedup before filing), create_pull_request x1, pull_request_read(get) x1, issue_write(update labels) x1, issue_write(create #13103) x1, search_pull_requests x1 (label read-back), add_issue_comment x1, plus 2 FAILED issue_read(get_labels) calls that refuse PR numbers. REST was unavailable to this seat: a repo-scoped probe returned 403 while /rate_limit showed a live credential (core 15000/hr), i.e. the session gate, so the whole run used the MCP channel.",
 "open_questions": [],
 "out_of_scope_findings": [
 "filed as #13103: a whole-fixture ObjectSchema.safeParse guard would red 838 fixtures across 303 files repo-wide (they are malformed on purpose — rejection tests must be able to build off-contract input), but the narrow 'a literal reference at a field-def position must be a string' guard measures 0 violations today and could land as a zero-baseline ratchet. Labelled finding + tooling, no domain:* and no pm:queue, per the dispatch."
 ]
}

Generated by Claude Code

---

Generated by Claude Code