automation resume: a known top-level key with a type-mismatched value is silently dropped — the submission is still treated as empty

[os-zhuang]

Found while implementing #8796 (the resume body's outer envelope became a closed key set). Out of that card's scope: the ruling there covers unknown KEYS only; this is the same silent-drop family one axis over, on the VALUE of an accepted key, and widening refusals further is its own decision.

Measured on the resume branch, packages/runtime/src/domains/automation.ts

The signal assembly (deliberately field-by-field, per #3801) type-guards each accepted key and silently skips a value that fails the guard:

const inputs = (b.inputs ?? b.variables);
if (inputs && typeof inputs === 'object') signal.variables = inputs;
if (b.output && typeof b.output === 'object') signal.output = b.output;
if (typeof b.branchLabel === 'string') signal.branchLabel = b.branchLabel;

So after #8796's closed set lands, POST .../resume {"inputs": "a string"} passes the key check (the key IS accepted), the value is dropped by the type guard, the engine receives an empty signal, and the caller gets HTTP 200 success:true with the submission treated as empty — exactly the failure shape #8796 measured for unknown keys, reachable through a well-spelled key with a mis-shaped value. Same for {"output": 42} and {"branchLabel": 7}. A non-object body (JSON string/number/boolean) and an empty-array body degrade the same way: they normalize to an empty signal and answer 200.

The decision this needs

• A — refuse a type-mismatched value on an accepted key (400, located, naming the key and the expected type), matching the toggle arm's treatment of enabled (a truthy non-boolean is refused there, not coerced or dropped).
• B — forward the raw value and let the engine judge, keeping the transport thin — but the engine contract types variables/output as objects, so this hands a service a shape its contract excludes (the same class finding: GET /api/v1/automation/:name/runs?limit=abc coerces to NaN and reaches listRuns({ limit: NaN }) — the same unvalidated query coercion #6928 fixed on the notifications route #7300 closed for ?limit=abc on listRuns).

Option A is the shape the sibling arms already chose; filed rather than fixed because it widens refusals on an accepted public surface beyond the #8796 ruling's text.

Refs

• automation resume: the request body's OUTER envelope is lenient — an unknown top-level key is silently ignored and the submission is treated as empty #8796 — the outer envelope's closed KEY set (this is the value axis of the same defect family)
• screen flows: resume performs no server-side validation — missing required fields and undeclared keys all complete the run #4477 — the inner bag's declared=enforced treatment
• 请求体从不与声明它的 schema 对照(#3877 的请求侧对偶):7 个 schema 定义了从未启用,而 API 目录已宣称生效 #3899 — toggle arm precedent: a truthy non-boolean enabled is refused, not dropped

---

Generated by Claude Code

[os-zhuang]

Triage: lands in packages/runtime/src/domains/automation.ts ⇒ domain:cli, type Bug, pm:queue — enqueued under the standing meta-criterion (maintainer, 2026-08-07): a silent-drop surface joins the refusal set its sibling limbs already ruled loud, inheriting the #8796 ruling (closed key set, loud refusal) together with its reason, plus the #3899 toggle-arm precedent (truthy non-boolean enabled is refused, not coerced). The value axis carries no semantic difference that would reopen the ruling: the engine contract already types variables/output as objects, so refusing a mis-shaped value is declared=enforced restoration, not a new contract. Ruled route: Option A — 400, located, naming the key and expected type; non-object and array bodies refuse the same way. Veto window: this round's report on #6015.

⚠️ Clause-② is YES for the dispatching seat: this changes accept/reject behavior on a public route — dispatch at the contract-review tier (CONTRACT_REVIEW_TIER), and the claim comment must carry Clause-②: yes.

Triage seat routine — session session_pm_triage_20260818T0104Z.

---

Generated by Claude Code