docs(audit): metadata property liveness & necessity — all types#1864
Merged
Conversation
Evidence-backed cross-reference (file:line) of every core FieldSchema property against its runtime + renderer consumers. ~half are DEAD (defined in the protocol but read by neither layer → silent no-ops for authors). Surfaces three high-value classes: camelCase↔snake_case naming drift (maxLength/minLength/referenceFilters/maxRating read under a different key), nested-config-vs-flat duplication (currencyConfig/vectorConfig/ fileAttachmentConfig dead, flat siblings read), and redundant field-level flags superseded by object/dataset-level config (searchable/index/externalId/ columnName). Intended to seed a spec-hygiene ADR. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
github-actions
Bot
added
size/m
documentation
Entire enable/ObjectCapabilities block dead (apiEnabled/apiMethods NOT enforced by REST). versioning/partitioning/cdc/softDelete/search/recordTypes/ defaultDetailForm aspirational. recordName duplicated by field autonumber; tenancy only .enabled live. Core load-bearing set documented with file:line. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
chart list variant dead-on-arrival vs its own spec (renderers read removed legacy xAxisField/yAxisFields; spec exposes dataset/dimensions/values) = same ADR-0021 debt as dashboard/report seeds. Form variants wizard/split/ drawer/modal aspirational on mainstream path (RecordFormPage hardcodes simple). List family + grid/kanban/calendar/gantt/gallery/timeline fully wired. bulkActions->batchActions drift documented. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Recurring themes: ADR-0021 migration debt (dashboard renderer+Studio still on legacy object/valueField shape the spec says was removed; report chart dead), orphaned spec-bridge (page/dashboard bridges have no src caller -> their exclusive props dead), spec<->renderer naming drift (page type->pageType & label->title break layouts/headers; dashboard title vs label; app reads accentColor/badgeVariant/separator not in spec), and aspirational config (app mobileNavigation/sharing/embed; page recordReview/blankLayout required by superRefine yet unrendered; report chart/aria/performance). Evidence file:line in each doc. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Cluster of security-relevant parsed-but-UNENFORCED props: agent permissions/visibility/access (who-can-chat is a no-op), flow runAs (never switches identity), action disabled-CEL (silently ignored). Plus: flow FlowNodeAction enum out of sync with executors; http vs http_request drift; agent model.provider dead (provider comes from adapter); agent autonomy surface (memory/guardrails/structuredOutput/lifecycle) aspirational except planning.maxIterations; dataset description/certified dead + Studio under-covers live props; action type:form/shortcut/bulkEnabled half-built. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Tool metadata is WRITE-ONLY (projected one-way for Studio display; runtime uses code-built AIToolDefinition; cannot author a working tool as metadata). Skill triggerPhrases display-only (no intent matcher); permissions dead + requiredPermissions naming drift; triggerConditions not editable in designer. Hook + Validation are the healthiest schemas: near-total liveness; hook only label/description dead, memoryMb advisory; all 6 validation types enforced, only events:[delete] is a silent no-op + label/description/tags dead. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
MOST SERIOUS findings: PolicySchema 100% dead (password/session/mfa/ip/audit parsed-but-unenforced; not even registered) -> false compliance; permission allowTransfer/allowRestore/allowPurge dead (destructive ops ungated); Role parent dead (no manager rollup); SharingRuleSchema disconnected from the live sys_sharing_rule engine. System: EmailTemplateSchema registered but runtime reads differently-shaped sys_email_template; PortalSchema fully aspirational; Job retryPolicy/timeout dead; Webhook non-HMAC auth/payloadFields dead; TranslationConfig messageFormat(ICU)/supportedLocales/cache dead; Theme spacing/breakpoints/logo merged-but-never-emitted. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Ties 21 schemas into 7 cross-cutting patterns, priority-ordered: (1) parsed- but-unenforced security props (policy/permission-lifecycle/agent-access/flow- runAs/object-apiEnabled/action-disabled) = latent access-control gaps; (2) ADR-0021 analytics migration debt; (3) naming drift silent no-ops; (4) aspirational config; (5) write-only/disconnected metadata; (6) renderer reads undeclared props; (7) designer authoring gaps. Suggests 3 ADRs. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
xuyushun441-sys
changed the title
17 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
A protocol-level audit of every ObjectStack metadata type: for each schema property, cross-reference its spec definition against its actual consumers (
file:line) in the runtime + renderers, to answer (1) does it take effect? then (2) is it necessary/reasonable? Liveness = code consumption, not browser observation.17 per-type reports + a cross-type synthesis in
docs/audits/(seeREADME.mdfor the index + patterns). Types covered: field, object, view, app, page, dashboard, report, dataset, action, flow, agent, tool, skill, hook, validation, security/identity (role/permission/policy/sharing), system/integration (email/i18n/theme/job/webhook/portal).Headline cross-cutting findings (priority order)
PolicySchema100% dead (password/session/MFA/IP/audit — false compliance, not even registered); permissionallowTransfer/allowRestore/allowPurge(destructive ops ungated); agentpermissions/visibility/access(who-can-chat is a no-op); flowrunAs(never switches identity); objectapiEnabled/apiMethods(not enforced by REST); actiondisabled-CEL (silently ignored); roleparent+SharingRuleSchemadisconnected from the live engine.object/valueField/aggregateshape; reportchartdead;ReportColumn/ReportGroupingobsolete. (Same debt that invalidated the showcase dashboard/report seeds.)maxLength/minLength/referenceFilters/maxRating; pagetype→pageType/label→title/visibility; dashboardtitlevslabel; appaccentColor/badgeVariant/separator(renderer reads, not in spec); actiondisabled→enabled; flowhttpvshttp_request; skillrequiredPermissions; agentknowledge; webhookobject_name/active.enable/versioning/partitioning/cdc; agent autonomy (memory/guardrails/structuredOutput/lifecycle); job retryPolicy/timeout; portal (entire); webhook non-HMAC auth; translationmessageFormat:'icu'(no ICU engine).sys_email_template); spec-bridge page/dashboard orphaned.Healthiest: hook, validation. Worst: policy, portal, tool.
Suggests three ADRs: security enforcement, finish ADR-0021, spec hygiene. Each doc has
file:lineevidence + per-property recommendations.🤖 Generated with Claude Code