[high, unverified] addDependency overwrites an existing single-name depends_on #511

Unverified: the bug-hunt's skeptic check did not reach a verdict on this finding. Verify it before fixing.

Location: src/screens/workflows/graph-editor/yaml-model.ts:569

Severity: high · Confidence: high

When

A user draws a new connection into a step whose prerequisite is written as a single name rather than a list.

Effect

The step's original prerequisite link is silently dropped on save, so the step runs in a different order than the user expects.

Evidence

addDependency: const dep = raw.get('depends_on', true); if (isSeq(dep)) {...} else { raw.set('depends_on', [depId]) }. When depends_on is a plain scalar (e.g. depends_on: resolve-input), isSeq is false, so the existing scalar is replaced by a one-item list containing only the new dependency. readGraph/depsOf explicitly supports the scalar form (lines 131-135), so the editor shows that edge, and the graph editor's handleConnect calls addDependency(draft, target, source) (graph-editor.tsx:251).

Skeptic note

no usable skeptic answer

Bug-hunt id: bh:16440b53 · run: sweep:screens / slice screens · source: ~/.bughunt-data/repos/hermes-switchui/reports/2026-10-27-screens.json (local path on the owner's Mac)

Filed from the 2026-10-27 bug-hunt sweep (unverified, not triaged).