Phase 3 (audit) of #3068 — closing inventory audit for the parsed-shape contract + contract statement

Phase 3 (closing audit) of design #3068 — "parsed is not validated: one shape contract at every JSON trust boundary" (design doc: files/designs/code-parsed-is-not-validated.md in the keep-the-four-repos-healthy goal workspace). Filed by design-architect pass 26 (2026-10-31); gated on Phases 1–2 of #3068 landing (Phase 1: #2938, #2816, #2821, #2974; Phase 2: #2832, #2738, #2800, #2827, #2618). The adopted frame origins of this phase — #2824 and #2802 (id web collab/world frame shape) — are NOT gated on Phases 1–2 and proceed on their own triage; this issue is only the audit + contract statement.

Scope

Inventory every parse-then-dereference boundary in the surfaces #3068 covers — bin/, scripts/, pkgs/ tools (incl. cold-store-reaper and t3code-seed-providers), pm-stack's non-aggregator handlers, and pkgs/id/web — i.e. every JSON.parse, response.json(), json.loads, and MessagePack decode whose result is dereferenced. For each hit, disposition it in the closing evidence:

(a) covered by Design: parsed is not validated — one shape contract at every JSON trust boundary #3068 Phases 1–3 (name the origin issue), or
(b) a boundary the phases missed and the same rule covers — fix it under this issue if small and same-rule, otherwise file it as a named follow-up and link it here, or
(c) not a trust boundary (code-constructed input, or shape already validated at the deref level) — named, with the one-line reason.

Explicit dispositions required

cloudflare-export: GraphQL errors assumed to be an array of {message: string} — other shapes throw TypeErrors misclassified as fetch-failed, and a single-object errors is silently ignored #2608 (cloudflare-export: GraphQL errors assumed to be an array of {message: string}): decide its ownership once — it sits in a pm-stack exporter that design(aggregator): ingest, fail-closed — one validation contract for every document the PM stack consumes #2576's Phase 3 also touches. Record here (and on cloudflare-export: GraphQL errors assumed to be an array of {message: string} — other shapes throw TypeErrors misclassified as fetch-failed, and a single-object errors is silently ignored #2608) whether it is fixed under design(aggregator): ingest, fail-closed — one validation contract for every document the PM stack consumes #2576's Phase 3 as-built scope or under this design's rule; do not double-file it.
Every ?? [] / || {} / ?? {} default at a parse boundary in the inventory: disposition as optional-by-design (the deref site treats absence and emptiness identically on purpose) or absence-as-emptiness (corollary 3 of Design: parsed is not validated — one shape contract at every JSON trust boundary #3068 — a bug; fix or follow-up per (b)).

Contract statement

Write the #3068 rule where this repo already states such contracts (bin header docs; the aggregator README's contract section by reference, without reopening #2576's document scope), in the terms the design doc records: validate the shape you deref, at the boundary, before any side effect; exact plain-object vocabulary; failure is the surface's own error; absence is not emptiness; the shared probe matrix (null, array, scalar, {}, each relied-on field wrong-typed).

Acceptance

Inventory evidence posted on this issue (or a linked PR): every parse-then-deref boundary in the scoped surfaces with a disposition (a)/(b)/(c)
cloudflare-export: GraphQL errors assumed to be an array of {message: string} — other shapes throw TypeErrors misclassified as fetch-failed, and a single-object errors is silently ignored #2608's ownership decided and recorded on both this issue and cloudflare-export: GraphQL errors assumed to be an array of {message: string} — other shapes throw TypeErrors misclassified as fetch-failed, and a single-object errors is silently ignored #2608
Any (b) follow-ups filed and linked; any small same-rule fixes landed
Contract statement landed; design issue Design: parsed is not validated — one shape contract at every JSON trust boundary #3068 closed with a link to this evidence
This phase did not start before Design: parsed is not validated — one shape contract at every JSON trust boundary #3068 Phases 1–2 landed (record their closing state in the evidence)

🤖 Design-architect pass 26 (2026-10-31) — agent note: this issue was filed this pass as the closing piece of Phase 3 of design #3068. It is gated on Phases 1–2 (#2938/#2816/#2821/#2974; #2832/#2738/#2800/#2827/#2618) landing and is labelled status/blocked accordingly; the phase's frame origins #2824/#2802 are NOT gated and proceed on their own triage. A triage packet has been enqueued to the pilot queue (repo-health-code-pilot) in this same pass: triage records the gating and enqueues the implementation follow-up once it clears; the audit itself does not start before the phases land. Its closing evidence must explicitly disposition #2608 against #2576's Phase 3 scope.

🤖 Agent note · picked up

Agent: queue worker (repo-worker-code), lane A
Session / ID: queue task 4463, repo-queue-worker-shift 2026-10-31 08:24 CDT
Found via: queue claim
Task: Triage of Phase 3 (closing audit) of design Design: parsed is not validated — one shape contract at every JSON trust boundary #3068 — confirm scope against current main + design doc, record the Phases 1–2 gating, enqueue the gated implementation follow-up. No implementation in this task.
Expectation: s — verdict + follow-up packet; the audit itself waits for Phases 1–2.
Links: task 4463; design Design: parsed is not validated — one shape contract at every JSON trust boundary #3068

🤖 Agent note · parked

Agent: queue worker (repo-worker-code), lane code-o
Session / ID: task 4465
Found via: queue claim
Task: Gate check for the Phase 3 closing inventory audit on issue Phase 3 (audit) of #3068 — closing inventory audit for the parsed-shape contract + contract statement #3069 (design issue Design: parsed is not validated — one shape contract at every JSON trust boundary #3068), per task 4465's hard gate.
Gate evidence (verified fresh this shift, 2026-11-05, each open/closed state double-checked via gh issue view + gh api): Phase 1 — issue clef-proxy: a JSON array body passes the #2816 'oracle' guard and fabricates an upstream Clef call — typeof [] is 'object', so [] and [1,2] run with the default model and empty state/questions instead of a 400 #2938 CLOSED, issue bin proxies: a JSON null body crashes seven chat proxies — parse succeeds, first deref throws, process exits 1 (clef and opencode-route already 400) #2816 CLOSED, issue antigravity-direct: a non-object JSON body is never a 400 — 'null' 500s at body.model, and scalar/array bodies fabricate an empty upstream request for model '-medium' and return 200 #2821 OPEN, issue projector: POST /links validates only subject/ref — a non-string note/createdBy throws out of the handler, relation is String()-coerced and stored as 'a,b' / '[object Object]', and an empty subject is stored #2974 CLOSED. Phase 2 — issue sync-models: parseable-but-wrong-shaped opencode.jsonc crashes raw — non-object provider/models values throw unnamed TypeErrors in run() and in the JSONC tree editor #2832 OPEN, issue t3code-seed-providers: seed script crashes on parseable-but-wrong-shaped settings.json — one bad shape disables all seeding and the OpenCode-1.x safety disable #2738 CLOSED, issue sync_research_workflow: parseable-but-wrong-shaped manifest/profile JSON crashes with a raw traceback (or a misleading 'missing directory: .agents/skills/r') instead of the tool's clean diagnostic #2800 CLOSED, issue provider-catalog-sync: enumerateProxy trusts the /v1/models shape — a missing data field silently flags every model as a live vanishing, and an id-less entry crashes --apply #2827 CLOSED, issue cold-store-reaper: D1 response handling assumes object shapes throughout — array/string bodies and non-object errors/result entries raise AttributeError instead of ColdStoreError #2618 CLOSED. Seven of nine gate issues closed; gate NOT cleared while issue antigravity-direct: a non-object JSON body is never a 400 — 'null' 500s at body.model, and scalar/array bodies fabricate an empty upstream request for model '-medium' and return 200 #2821 and issue sync-models: parseable-but-wrong-shaped opencode.jsonc crashes raw — non-object provider/models values throw unnamed TypeErrors in run() and in the JSONC tree editor #2832 remain open, so the audit must not start.
Expectation: task 4465 parked; resume when issue antigravity-direct: a non-object JSON body is never a 400 — 'null' 500s at body.model, and scalar/array bodies fabricate an empty upstream request for model '-medium' and return 200 #2821 and issue sync-models: parseable-but-wrong-shaped opencode.jsonc crashes raw — non-object provider/models values throw unnamed TypeErrors in run() and in the JSONC tree editor #2832 are both CLOSED, then freshly verify all nine gates before starting the inventory audit per the packet (including the issue cloudflare-export: GraphQL errors assumed to be an array of {message: string} — other shapes throw TypeErrors misclassified as fetch-failed, and a single-object errors is silently ignored #2608 ownership disposition).

🤖 Agent note · handed off

Agent: queue worker (repo-worker-code), lane code-k
Session / ID: task 10674
Found via: queue claim
Task: Handed off to the opencode execution lane; the laptop claimant launches a session bound to task 10674, which drives it to its terminal state. Kind: triage.
Expectation: Claimant session works the packet at current main and reaches a verified terminal state.
Links: issue mcpx: the sources the reference would be generated from are incomplete, and several docs say what the code does not #1883

🤖 Agent note · parked

Agent: repo queue worker, lane code-z (repo-worker-code)
Session / ID: task 4465
Found via: queue claim (direct execution lane)
Task: Gate check for the Phase 3 closing inventory audit on issue Phase 3 (audit) of #3068 — closing inventory audit for the parsed-shape contract + contract statement #3069 (design Design: parsed is not validated — one shape contract at every JSON trust boundary #3068), per task 4465's hard gate.
Gate evidence (verified fresh this shift, 2026-11-05T20:33:42Z, via gh issue view per issue): Phase 1 — issue clef-proxy: a JSON array body passes the #2816 'oracle' guard and fabricates an upstream Clef call — typeof [] is 'object', so [] and [1,2] run with the default model and empty state/questions instead of a 400 #2938 CLOSED, issue bin proxies: a JSON null body crashes seven chat proxies — parse succeeds, first deref throws, process exits 1 (clef and opencode-route already 400) #2816 CLOSED, issue antigravity-direct: a non-object JSON body is never a 400 — 'null' 500s at body.model, and scalar/array bodies fabricate an empty upstream request for model '-medium' and return 200 #2821 OPEN, issue projector: POST /links validates only subject/ref — a non-string note/createdBy throws out of the handler, relation is String()-coerced and stored as 'a,b' / '[object Object]', and an empty subject is stored #2974 CLOSED. Phase 2 — issue sync-models: parseable-but-wrong-shaped opencode.jsonc crashes raw — non-object provider/models values throw unnamed TypeErrors in run() and in the JSONC tree editor #2832 OPEN, issue t3code-seed-providers: seed script crashes on parseable-but-wrong-shaped settings.json — one bad shape disables all seeding and the OpenCode-1.x safety disable #2738 CLOSED, issue sync_research_workflow: parseable-but-wrong-shaped manifest/profile JSON crashes with a raw traceback (or a misleading 'missing directory: .agents/skills/r') instead of the tool's clean diagnostic #2800 CLOSED, issue provider-catalog-sync: enumerateProxy trusts the /v1/models shape — a missing data field silently flags every model as a live vanishing, and an id-less entry crashes --apply #2827 CLOSED, issue cold-store-reaper: D1 response handling assumes object shapes throughout — array/string bodies and non-object errors/result entries raise AttributeError instead of ColdStoreError #2618 CLOSED. Seven of nine gate issues closed; gate NOT cleared while issue antigravity-direct: a non-object JSON body is never a 400 — 'null' 500s at body.model, and scalar/array bodies fabricate an empty upstream request for model '-medium' and return 200 #2821 and issue sync-models: parseable-but-wrong-shaped opencode.jsonc crashes raw — non-object provider/models values throw unnamed TypeErrors in run() and in the JSONC tree editor #2832 remain open, so the audit must not start. No files touched.
Expectation: task 4465 parked 2h (longer gate park to reduce re-claim churn); resume when issue antigravity-direct: a non-object JSON body is never a 400 — 'null' 500s at body.model, and scalar/array bodies fabricate an empty upstream request for model '-medium' and return 200 #2821 and issue sync-models: parseable-but-wrong-shaped opencode.jsonc crashes raw — non-object provider/models values throw unnamed TypeErrors in run() and in the JSONC tree editor #2832 are both CLOSED, then freshly verify all nine gates before starting the inventory audit (including the issue cloudflare-export: GraphQL errors assumed to be an array of {message: string} — other shapes throw TypeErrors misclassified as fetch-failed, and a single-object errors is silently ignored #2608 ownership disposition).
Links: task 4465 · issue Phase 3 (audit) of #3068 — closing inventory audit for the parsed-shape contract + contract statement #3069 · issue Design: parsed is not validated — one shape contract at every JSON trust boundary #3068 · issue antigravity-direct: a non-object JSON body is never a 400 — 'null' 500s at body.model, and scalar/array bodies fabricate an empty upstream request for model '-medium' and return 200 #2821 · issue sync-models: parseable-but-wrong-shaped opencode.jsonc crashes raw — non-object provider/models values throw unnamed TypeErrors in run() and in the JSONC tree editor #2832

🤖 Agent note · parked — hard gate unmet

Agent: repo queue worker, lane code-v (repo-worker-code)
Session / ID: cron repo-queue-worker-shift-v run 2026-11-05 16:29 CST; task 4465
Found via: claimed task 4465 this shift (direct lane); resumed from the prior verified checkpoint
Task: task 4465 for issue Phase 3 (audit) of #3068 — closing inventory audit for the parsed-shape contract + contract statement #3069 (small_fix) — Phase 3 closing inventory audit for design Design: parsed is not validated — one shape contract at every JSON trust boundary #3068, gated on Phases 1–2 landing.
Fresh check (2026-11-05T22:36Z, gh): issue Phase 3 (audit) of #3068 — closing inventory audit for the parsed-shape contract + contract statement #3069 is OPEN, no hard-stop labels (held / user/owned / do-not-merge / do-not-auto-edit). Gate: antigravity-direct: a non-object JSON body is never a 400 — 'null' 500s at body.model, and scalar/array bodies fabricate an empty upstream request for model '-medium' and return 200 #2821 OPEN and sync-models: parseable-but-wrong-shaped opencode.jsonc crashes raw — non-object provider/models values throw unnamed TypeErrors in run() and in the JSONC tree editor #2832 OPEN; the other seven gates are CLOSED (clef-proxy: a JSON array body passes the #2816 'oracle' guard and fabricates an upstream Clef call — typeof [] is 'object', so [] and [1,2] run with the default model and empty state/questions instead of a 400 #2938, bin proxies: a JSON null body crashes seven chat proxies — parse succeeds, first deref throws, process exits 1 (clef and opencode-route already 400) #2816, projector: POST /links validates only subject/ref — a non-string note/createdBy throws out of the handler, relation is String()-coerced and stored as 'a,b' / '[object Object]', and an empty subject is stored #2974, t3code-seed-providers: seed script crashes on parseable-but-wrong-shaped settings.json — one bad shape disables all seeding and the OpenCode-1.x safety disable #2738, sync_research_workflow: parseable-but-wrong-shaped manifest/profile JSON crashes with a raw traceback (or a misleading 'missing directory: .agents/skills/r') instead of the tool's clean diagnostic #2800, provider-catalog-sync: enumerateProxy trusts the /v1/models shape — a missing data field silently flags every model as a live vanishing, and an id-less entry crashes --apply #2827, cold-store-reaper: D1 response handling assumes object shapes throughout — array/string bodies and non-object errors/result entries raise AttributeError instead of ColdStoreError #2618). Per the packet's hard gate, the audit must not start.
Expectation: task 4465 resumes once antigravity-direct: a non-object JSON body is never a 400 — 'null' 500s at body.model, and scalar/array bodies fabricate an empty upstream request for model '-medium' and return 200 #2821 and sync-models: parseable-but-wrong-shaped opencode.jsonc crashes raw — non-object provider/models values throw unnamed TypeErrors in run() and in the JSONC tree editor #2832 both close/land, with all nine gates re-verified fresh.
Links: task 4465 · issue Phase 3 (audit) of #3068 — closing inventory audit for the parsed-shape contract + contract statement #3069 · gates antigravity-direct: a non-object JSON body is never a 400 — 'null' 500s at body.model, and scalar/array bodies fabricate an empty upstream request for model '-medium' and return 200 #2821, sync-models: parseable-but-wrong-shaped opencode.jsonc crashes raw — non-object provider/models values throw unnamed TypeErrors in run() and in the JSONC tree editor #2832

🤖 Agent note · parked — hard gate unmet

Agent: queue worker (repo-worker-code), lane code-r
Session / ID: task 4465
Found via: queue claim (direct execution lane)
Task: small_fix for issue Phase 3 (audit) of #3068 — closing inventory audit for the parsed-shape contract + contract statement #3069 — Phase 3 closing inventory audit for design Design: parsed is not validated — one shape contract at every JSON trust boundary #3068, explicitly HARD-GATED on Phases 1–2 landing
Gate re-verified fresh (2026-11-05T22:57Z, gh): CLOSED — clef-proxy: a JSON array body passes the #2816 'oracle' guard and fabricates an upstream Clef call — typeof [] is 'object', so [] and [1,2] run with the default model and empty state/questions instead of a 400 #2938, bin proxies: a JSON null body crashes seven chat proxies — parse succeeds, first deref throws, process exits 1 (clef and opencode-route already 400) #2816, projector: POST /links validates only subject/ref — a non-string note/createdBy throws out of the handler, relation is String()-coerced and stored as 'a,b' / '[object Object]', and an empty subject is stored #2974, t3code-seed-providers: seed script crashes on parseable-but-wrong-shaped settings.json — one bad shape disables all seeding and the OpenCode-1.x safety disable #2738, sync_research_workflow: parseable-but-wrong-shaped manifest/profile JSON crashes with a raw traceback (or a misleading 'missing directory: .agents/skills/r') instead of the tool's clean diagnostic #2800, provider-catalog-sync: enumerateProxy trusts the /v1/models shape — a missing data field silently flags every model as a live vanishing, and an id-less entry crashes --apply #2827, cold-store-reaper: D1 response handling assumes object shapes throughout — array/string bodies and non-object errors/result entries raise AttributeError instead of ColdStoreError #2618 (7 of 9). Still OPEN — antigravity-direct: a non-object JSON body is never a 400 — 'null' 500s at body.model, and scalar/array bodies fabricate an empty upstream request for model '-medium' and return 200 #2821 (Phase 1), sync-models: parseable-but-wrong-shaped opencode.jsonc crashes raw — non-object provider/models values throw unnamed TypeErrors in run() and in the JSONC tree editor #2832 (Phase 2)
Action: parked task 4465 (1800s) naming the open gates; audit not started, no source/docs touched, per the packet's gate rule
Resume: when antigravity-direct: a non-object JSON body is never a 400 — 'null' 500s at body.model, and scalar/array bodies fabricate an empty upstream request for model '-medium' and return 200 #2821 and sync-models: parseable-but-wrong-shaped opencode.jsonc crashes raw — non-object provider/models values throw unnamed TypeErrors in run() and in the JSONC tree editor #2832 both close, freshly verify all nine gates, then run the audit
Links: issue Phase 3 (audit) of #3068 — closing inventory audit for the parsed-shape contract + contract statement #3069; gate issues antigravity-direct: a non-object JSON body is never a 400 — 'null' 500s at body.model, and scalar/array bodies fabricate an empty upstream request for model '-medium' and return 200 #2821, sync-models: parseable-but-wrong-shaped opencode.jsonc crashes raw — non-object provider/models values throw unnamed TypeErrors in run() and in the JSONC tree editor #2832

🤖 Agent note · parked

Agent: queue worker (repo-worker-code), lane code-m
Session / ID: task 4465
Found via: queue claim
Task: Phase 3 closing inventory audit for issue Phase 3 (audit) of #3068 — closing inventory audit for the parsed-shape contract + contract statement #3069 (design issue Design: parsed is not validated — one shape contract at every JSON trust boundary #3068) — hard-gated on Phases 1–2 landing
Expectation: gate re-verified fresh this shift: issue antigravity-direct: a non-object JSON body is never a 400 — 'null' 500s at body.model, and scalar/array bodies fabricate an empty upstream request for model '-medium' and return 200 #2821 OPEN (Phase 1) and issue sync-models: parseable-but-wrong-shaped opencode.jsonc crashes raw — non-object provider/models values throw unnamed TypeErrors in run() and in the JSONC tree editor #2832 OPEN (Phase 2); issue clef-proxy: a JSON array body passes the #2816 'oracle' guard and fabricates an upstream Clef call — typeof [] is 'object', so [] and [1,2] run with the default model and empty state/questions instead of a 400 #2938, issue bin proxies: a JSON null body crashes seven chat proxies — parse succeeds, first deref throws, process exits 1 (clef and opencode-route already 400) #2816, issue projector: POST /links validates only subject/ref — a non-string note/createdBy throws out of the handler, relation is String()-coerced and stored as 'a,b' / '[object Object]', and an empty subject is stored #2974, issue t3code-seed-providers: seed script crashes on parseable-but-wrong-shaped settings.json — one bad shape disables all seeding and the OpenCode-1.x safety disable #2738, issue sync_research_workflow: parseable-but-wrong-shaped manifest/profile JSON crashes with a raw traceback (or a misleading 'missing directory: .agents/skills/r') instead of the tool's clean diagnostic #2800, issue provider-catalog-sync: enumerateProxy trusts the /v1/models shape — a missing data field silently flags every model as a live vanishing, and an id-less entry crashes --apply #2827, issue cold-store-reaper: D1 response handling assumes object shapes throughout — array/string bodies and non-object errors/result entries raise AttributeError instead of ColdStoreError #2618 all CLOSED. Audit does not start until both open gates close/land. Also noted: issue cloudflare-export: GraphQL errors assumed to be an array of {message: string} — other shapes throw TypeErrors misclassified as fetch-failed, and a single-object errors is silently ignored #2608 is now CLOSED.
Links: task 4465 parked with resume condition: re-verify all nine gates after issue antigravity-direct: a non-object JSON body is never a 400 — 'null' 500s at body.model, and scalar/array bodies fabricate an empty upstream request for model '-medium' and return 200 #2821 and issue sync-models: parseable-but-wrong-shaped opencode.jsonc crashes raw — non-object provider/models values throw unnamed TypeErrors in run() and in the JSONC tree editor #2832 close

Navigation Menu

Repository navigation

Phase 3 (audit) of #3068 — closing inventory audit for the parsed-shape contract + contract statement #3069

Scope

Explicit dispositions required

Contract statement

Acceptance

337 remaining items

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Phase 3 (audit) of #3068 — closing inventory audit for the parsed-shape contract + contract statement #3069

Description

Scope

Explicit dispositions required

Contract statement

Acceptance

Activity

dezren39 commented on Oct 31, 2026

dezren39 commented on Oct 31, 2026

337 remaining items

developing-today commented on Nov 5, 2026

developing-today commented on Nov 5, 2026

dezren39 commented on Nov 5, 2026

dezren39 commented on Nov 5, 2026

dezren39 commented on Nov 5, 2026

dezren39 commented on Nov 5, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions