object-validation-engine.ts @see points at SECURITY_FIX_SUMMARY.md, deleted in ea72f1886

[yinlianghui-tw]

Found while removing packages/vscode-extension/SUMMARY.md for #5965. Out of that card's file surface (SUMMARY.md only), so filed separately rather than fixed there.

Measured

packages/core/src/validation/validators/object-validation-engine.ts:221, in the doc block for SimpleExpressionEvaluator:

 * @see https://github.com/objectstack-ai/objectui/blob/main/SECURITY_FIX_SUMMARY.md

That file does not exist. It was removed in ea72f1886 ("Delete obsolete files and documentation related to PR #300 and v0.4.0 release; remove security fix summary and CRM app fix scripts"), with no successor at any path:

$ find . -name 'SECURITY_FIX_SUMMARY.md' -not -path './node_modules/*' | wc -l
0

So the link 404s. The @see is the only pointer the doc block offers for the security rationale behind this evaluator's fail-open polarity (TRUE ⇒ violated, un-parseable expressions yielding a falsy value) — the reader is sent to nothing.

Why no gate caught it

check-doc-links.mjs scans markdown surfaces (SCAN_ROOTS), not @see URLs inside .ts source, so an absolute github.com/.../blob/main/... link in a TypeScript doc comment is outside every link gate's population. Note this is a self-repo URL — the same selfRepoPath() shape check-doc-links.mjs already knows how to decide for markdown, so the resolvable-in-principle case exists.

Suggested disposition (triage decides)

Either restore the rationale inline in the doc block (it is security-relevant reasoning and currently lives nowhere), or drop the dead @see. Widening a link gate to cover self-repo URLs in source doc comments is a larger, separate call.

Note packages/core is published, so this dead link ships in the released package's type declarations.

Generated by Claude Code

[yinlianghui-tw]

Triage: finding → pm:queue + domain:ui, Task, S — the dead pointer ships in a published package's type declarations, and it is the doc block's only pointer for security-relevant reasoning (the evaluator's fail-open polarity), so the repair direction is recovery, not deletion: read the deleted SECURITY_FIX_SUMMARY.md out of git history (git show ea72f1886^:SECURITY_FIX_SUMMARY.md) and inline the load-bearing sentences of the rationale into the doc block, dropping the dead @see. Only if the historical file genuinely carries no rationale worth keeping, drop the @see and state the polarity rationale directly in one sentence — the doc block must not end this card still pointing at nothing and explaining nothing. ⛔ Widening a link gate to cover @see URLs in TS source is explicitly out of scope here (separate call, not minted this round).

---

Generated by Claude Code

[os-support-ai]

Claim — domain:ui @ objectui execution seat

PM session session_011SfZeFWrhGLHmfq61xbz4q (os-support-ai). Branch claude/issue-6275-validation-engine-dangling-see. Labels pm:queue → pm:dispatched in the same stroke as the assign.

Premise verified on origin/main @ c38162d7c before dispatch:

premise	reading
the dangling @see exists	✅ packages/core/src/validation/validators/object-validation-engine.ts:221 — @see https://github.com/objectstack-ai/objectui/blob/main/SECURITY_FIX_SUMMARY.md
the target is gone	✅ git ls-tree -r origin/main finds no SECURITY_FIX_SUMMARY.md anywhere in the tree
the reference is a single site	✅ exactly one hit across packages/ and apps/

Note the package: this is packages/core, not app-shell — disjoint from the in-flight #5034 (packages/plugin-form) and from #5977 (packages/plugin-map), so all three run concurrently without a file-surface collision.

Type Task; dispatched under the lane's Bug-first order with the reason logged: the graded pm:queue Bug tier is drained (#5034 is in flight, #6262 is pm:retriage, and the rest are pm:blocked, on hold, or ungraded), so non-Bug work is next in the total order rather than jumping it.

---

Generated by Claude Code

[claude]

os-dev-report

{
 "issue": 6275,
 "status": "done",
 "branch": "claude/issue-6275-validation-engine-dangling-see",
 "pr": "https://github.com/objectstack-ai/objectui/pull/6339",
 "head_sha": "ad39293c937cd783bd2cb4e299d403f47c67f5d1",
 "premise_still_valid": true,
 "files_changed": [
 "packages/core/src/validation/validators/object-validation-engine.ts",
 ".changeset/issue-6275-validation-engine-dangling-see.md"
 ],
 "assumptions": {
 "M1_see_at_line_221": "HELD - line number RE-DERIVED, not trusted. grep -n on origin/main @ 79ebf30d1 gives '221: * @see https://github.com/objectstack-ai/objectui/blob/main/SECURITY_FIX_SUMMARY.md'. Note the base moved: the card was measured at c38162d7c, my worktree branched from 79ebf30d1.",
 "M2_target_absent": "HELD - git ls-tree -r --name-only HEAD | grep -i SECURITY_FIX_SUMMARY -> 0 hits.",
 "M3_single_site": "HELD - grep -rn over packages/ and apps/ (excluding node_modules and dist) -> count 1; git grep over all tracked files agrees.",
 "false_subsidiary_claims": [
 "CARD BODY WRONG (does not change the disposition): the card calls the @see 'the only pointer the doc block offers for the security rationale behind this evaluator's fail-open polarity'. The deleted file contains ZERO mention of polarity or fail-open - its entire subject is the injection fix. The polarity rationale was already inline in the doc block (the NOT CEL paragraph) and is untouched by this PR.",
 "CARD BODY WRONG (decides the changeset form): the card says the dead link 'ships in the released package's type declarations'. Measured by building the package with tsc and reading the emitted output: SimpleExpressionEvaluator is NOT exported, so no declaration is emitted for it and the doc block does NOT reach dist/**/*.d.ts (grep for CodeQL / SECURITY: / NOT CEL in the .d.ts -> 0 each). It DOES ship in dist/**/*.js (tsc preserves comments; package.json files: ['dist', ...]). So the link reached consumers, in the JavaScript, not the type declarations."
 ]
 },
 "fix_choice": {
 "chosen": "Option 2 of the three - fold the load-bearing sentence into the doc block, then drop the dead @see. Not 'repoint' (no successor exists) and not 'just delete' (the reference was not redundant).",
 "evidence_from_ea72f1886": {
 "content_was_dropped_not_moved": "git show --shortstat --format='' ea72f1886 -> '20 files changed, 6742 deletions(-)'. ZERO insertions. The commit is a bulk removal of 20 root-level PR#300 / v0.4.0 summary docs, so nothing was written anywhere in the same commit and there is no successor path to repoint at. Independently: git grep -il codeql -- content/ docs/ -> empty, so no ADR or docs page covers it either.",
 "reference_was_not_redundant": "git show ea72f1886^:SECURITY_FIX_SUMMARY.md shows the doc block already repeats most of what the file carried (the operator list; the LIMITATIONS list VERBATIM). The one thing it carried that the doc block never stated is the reason the parser exists at all: 'Alert: Unsafe code constructed from library input / Issue: Use of new Function() constructor with user-provided expressions, enabling potential code injection attacks'. The doc block said WHAT the code does ('without using eval() or new Function()') but never WHY it must stay that way - so the ban read as taste, and a maintainer wanting chained comparisons or speed had no in-file reason not to reach for new Function(). That is the sentence now inlined.",
 "provenance": "The replacement points at `git show ea72f1886^:SECURITY_FIX_SUMMARY.md` - an immutable git object - rather than another main blob path that can rot the same way."
 }
 },
 "changeset": {
 "gate_verdict_line": "OK - '1 source file(s) of 1 released package(s) changed, and this change declares 1 changeset(s): .changeset/issue-6275-validation-engine-dangling-see.md. Every one of them has an EMPTY frontmatter - declared as releasing nothing, which is the explicit exemption and a complete answer to this gate.' (exit 0)",
 "form": "EMPTY frontmatter, deliberately. Comment-only change on a non-exported class: no behaviour, no type surface, no API. Counterweight measured: .changeset/config.json puts all 43 packages in ONE fixed group, so any non-empty bump versions the entire monorepo for a comment. Never major (check-changeset-no-major.mjs exit 0).",
 "reviewer_flippable": "If a reviewer reads the published-.js comment as user-visible enough to warrant a release line, this flips to patch with a one-line edit. The .d.ts-vs-.js measurement above is the fact that decides it, and it is stated in the PR body."
 },
 "gates": {
 "derivation": "Gate set derived by READING the CI job step lists under .github/workflows/ - every workflow's on: block parsed for a pull_request trigger and its path filter, then each firing job's run: steps read. Not from memory.",
 "union_run_at": "ad39293c9 (the final commit)",
 "exit_code_discipline": "Every exit code captured before any pipe (cmd > file 2>&1; EXIT=$?), never read through tail. Verdict lines below are the gates' own output.",
 "results": [
 "check-changeset-presence (changeset-presence.yml) exit 0 - '1 source file(s) ... declares 1 changeset(s) ... EMPTY frontmatter ... a complete answer to this gate.'",
 "check-changeset-no-major (changeset-guard.yml) exit 0 - 'No changeset declares a `major` bump.'",
 "check-changeset-fixed (ci.yml) exit 0 - 'All workspace packages are in the changeset fixed group.'",
 "check-control-bytes (control-bytes.yml) exit 0 - 'OK (scanned 5225 tracked text file(s); skipped 85 binary).'",
 "check-doc-component-types (doc-component-types.yml) exit 0 - 'Every documented component type is registered.'",
 "check-doc-fence-languages (doc-fence-languages.yml) exit 0 - 'every TypeScript block in 223 document(s) is fenced ts/tsx/typescript ...' (plus --self-test, 26 cases, exit 0)",
 "check-doc-links (docs-links.yml) exit 0 - 'Links are valid across 17 scan roots.' -- BLIND, see gates_blind",
 "check-shell-escape-residue (shell-escape-residue.yml) exit 0 - 'OK (4/4 root(s) resolved ...)'",
 "check-skills-paths (skills-paths.yml) exit 0 - 'OK (93/94 stated path(s) resolve across 18 guide file(s); 1 baselined).'",
 "check-vi-mock-specifiers (vi-mock-specifiers.yml) exit 0 - 'OK (3748 tracked source file(s) ...)'",
 "check-lint-coverage (lint.yml) exit 0 - 'lint coverage: 46/46 packages linted, 0 with outstanding errors (0 total).'",
 "check-entry-guard (lint.yml) exit 0 - '47 scripts/ file(s) - no entry guard outside the baseline ...' (plus --self-test, 63 cases, exit 0)",
 "check-cross-repo-closer-outcome (lint.yml) exit 0 - 'OK (105 assertions over 18 scenarios ...)' (plus --self-test, 77 assertions / 14 mutations, exit 0)",
 "check-pre-install-import-graph (pre-install-import-graph.yml) exit 0 - 'OK - 16 pre-install step(s) in 15 job(s) run 16 scripts/ gate(s) ...' (plus --self-test, 16 cases, exit 0)",
 "check-type-check-coverage (ci.yml) exit 0 - 'test type-check coverage: 41/41 packages compile their tests, 0 declared debt ...'",
 "turbo run lint --filter=@object-ui/core (lint.yml) exit 0 - '515 problems (0 errors, 515 warnings)'; all warnings pre-existing, none on the changed lines",
 "turbo run type-check --filter=@object-ui/core (ci.yml) exit 0 - 'Tasks: 5 successful, 5 total'; core's type-check is 'tsc --noEmit && tsc -p tsconfig.test.json', so test files are inside the population, not excluded",
 "vitest run packages/core/ (ci.yml test shards) exit 0 - 'Test Files 100 passed (100) / Tests 2023 passed (2023)'"
 ],
 "gates_blind": [
 "check-doc-links.mjs is STRUCTURALLY BLIND and its green run is NOT evidence for this PR. Not a judgement call: scripts/check-doc-links.mjs:650 reads `if (!/\\.(md|mdx)$/.test(entry.name)) continue;`, so a .ts file cannot enter the population at all. Near-miss worth recording: the gate ALREADY knows how to decide this exact URL shape - https://github.com/objectstack-ai/objectui/(blob|tree)/main/<path> is a case it handles for markdown (check-doc-links.mjs:154). The link was undecidable because of WHERE it was written, not WHAT it was. Widening the population was left alone per triage ('separate call, not minted this round').",
 "Every test gate is blind: a comment-only diff cannot move any assertion. The 2023 passing tests are a regression guard, not evidence the link is fixed.",
 "readme-exports, performance-budget and doc-snippet-types fire on these paths but none can observe a comment; left to CI.",
 "The ONLY evidence the defect is fixed is direct measurement: blob/main/SECURITY_FIX_SUMMARY.md occurrences across packages/ + apps/ went 1 -> 0, and the injected text (CodeQL / 'Unsafe code constructed from library input' / ea72f1886) is present exactly once each on disk."
 ],
 "narrowing_declared": "lint / type-check / test were run filtered to @object-ui/core rather than across all 46 packages. Three pieces of evidence the narrowing excludes nothing: (1) population read from the tool's own config - `pnpm exec eslint . --format json` inside packages/core reports 195 files linted and the changed file is in that set, checked by path not assumed; (2) counts read from --format json - 0 errors, 515 warnings, 17 of them on the changed file and all pre-dating this PR; (3) invariance - NO eslint config in the repo enables type-aware linting (no project: / projectService in the single root eslint.config.js), so this diff cannot move any untouched file's verdict, and independently the diff changes only comment bytes in a non-exported class so no type, value or module-graph fact crosses a package boundary. check-lint-coverage (46/46) and check-type-check-coverage (41/41) still ran repo-wide."
 },
 "summary": "The dangling @see in SimpleExpressionEvaluator's doc block is replaced by the load-bearing rationale it pointed at, rather than deleted. ea72f1886 dropped SECURITY_FIX_SUMMARY.md outright (20 files, 6742 deletions, zero insertions, no successor anywhere in the tree), and reading the file out of history shows the doc block already duplicated most of it - but never stated WHY dynamic code execution is banned here: CodeQL had flagged the previous new Function(...) as 'Unsafe code constructed from library input'. That constraint is now inline, with provenance pointing at the immutable git object instead of a main blob path that can rot again. Two subsidiary claims in the card measured FALSE and are recorded in the PR body: the deleted file never discussed fail-open polarity (that rationale was already inline), and the dead link shipped in the published .js, not in the .d.ts (the class is not exported). Scope held to packages/core; no other dangling reference was repaired or swept for.",
 "tests": "All at head ad39293c9, union re-run AFTER the final commit. `pnpm exec vitest run packages/core/` -> exit 0, 'Test Files 100 passed (100) / Tests 2023 passed (2023)' - the 100-file count also rules out the repo's documented false-green trap, where a cwd-in-package run reports 22 console files instead. `pnpm exec vitest run packages/core/src/validation/` -> exit 0, 'Test Files 6 passed (6) / Tests 96 passed (96)'. `turbo run lint type-check --filter=@object-ui/core` -> exit 0. 15 repo gates run individually, each exit 0, verdict lines listed under gates.results. No ablation was performed and none is claimed: the diff is comment-only, so there is no behavioural nail a mutation could turn red. The one build performed was `turbo run build --filter=@object-ui/core` (exit 0), used ONLY to measure whether the doc block reaches the emitted .d.ts; that measurement was confirmed on disk by grepping the built artifacts - 'CodeQL' appears 1x in dist/**/object-validation-engine.js and 0x in the matching .d.ts. The source edit itself was confirmed on disk in both directions before committing: dead-link occurrences 1 -> 0, injected markers (CodeQL / 'Unsafe code constructed from library input' / ea72f1886) 0 -> 1 each, and grep -naP for control bytes on the edited file -> none.",
 "open_questions": [
 {
 "question": "Changeset form: empty frontmatter (declares nothing released) or a patch bump? I chose empty and it is reviewer-flippable in one line - flagging it rather than burying it, because the card asserted a user-visible surface that measurement contradicted.",
 "options": [
 "A - EMPTY frontmatter (what I shipped): the class is not exported, the doc block reaches no .d.ts, and no behaviour/type/API moves. All 43 packages sit in one changeset fixed group, so any non-empty bump versions the whole monorepo for a comment.",
 "B - patch bump: the comment DOES ship in dist/**/*.js (tsc preserves comments, files: ['dist']), so consumers did receive the dead link and the repair is arguably a user-facing docs fix worth a CHANGELOG line."
 ],
 "recommendation": "A. Nothing a consumer can import, call, type against or depend on changes; the only observable delta is a comment inside a file describing a class they cannot reach. Weighed against versioning 43 packages, A is proportionate, and AGENTS.md names empty frontmatter an explicit first-class pass for internal-only changes. Flipping to B costs one line if the maintainer weighs the shipped .js comment differently."
 }
 ],
 "out_of_scope_findings": [],
 "notes": [
 "T1 honoured: no widening. The repo-wide grep confirmed this was the only SECURITY_FIX_SUMMARY reference; I did NOT sweep for other dangling @see or doc links, so nothing is filed and nothing is withheld - the sweep simply was not run.",
 "T3 honoured: every edit inside packages/core. No overlap with #5034 (packages/plugin-form) or #5977 (packages/plugin-map).",
 "Footer form: the dispatch specified the bare _Generated by [Claude Code](https://claude.ai/code)_ spelling while the standing contract requires the session-URL form for PR bodies. No action was needed - the platform silently rewrote the bare form into the session-URL form when the PR was created, so the durable spelling is what is stored. Recorded per the conflict-reporting clause rather than acted on.",
 "The card's :221 line reference happened to still be correct, but it was re-derived by grep rather than trusted; the base had moved from c38162d7c to 79ebf30d1.",
 "Card relation lives in the PR body only (Fixes #6275). The single branch commit deliberately carries no card-relation trailer, so a squash cannot produce a self-contradicting message.",
 "Worktree cleaned up after the PR was opened: node_modules removed, then git worktree remove without --force."
 ]
}

---

Generated by Claude Code