Repository navigation
pm-stack(aggregator): /today render 500s on a lined-up task with a non-GitHub ref — objectives call refUrl unguarded and the section gate never checks linedUp ref #6174
Description
Summary
pm-stack/aggregator — the /today render crashes (throws, served as the error-boundary 500) when an orchestration-section lined-up task carries a ref that is not a GitHub owner/repo#N ref. This is the same failure class PR #6149 fixed today for tierItemCard on the Needs-you page, left unguarded on the Today page's objectives path — and the section validator that is supposed to be the only gate never checks the lined-up ref field at all, not even its type.
Chain of the defect (all on current main 1a069c3ff2):
src/feed.ts:223isLinedUpElement— the per-element gate for goallinedUparrays — checkstitle,horizon,status, andhorizonWhy, but notref: a string likegoal_b647ff5c92f5, or even a non-string (12345), passesisOrchestrationSection.src/work-items.ts:191assembleWorkItemscopiesref: task.refonto the canonical work item with no validity check; a tier merge can also supply it (if (!match.ref && t.ref) match.ref = t.ref), and tier refs are known to legitimately carry tracked-goal ids (that is exactly the live data that broke Needs-you in fix(aggregator): Needs-you render no longer 500s on a tier item with a non-GitHub ref #6149).src/derive.ts:724todayFromSectioncopiesref: item.refonto today's objectives (items withhorizon === "today"and a goal).src/render.ts:3368the objectives render callsrefUrl(o.ref)unguarded:refUrl→parseRefthrowsError: not a repo-qualified ref: …. The sibling sites fixed in fix(aggregator): Needs-you render no longer 500s on a tier item with a non-GitHub ref #6149 guard withisValidRef(src/render.ts:2489,:2524), andsessionRecordLinewrapsrefUrlin try/catch — the objectives site does neither.
Evidence (verified this run, laptop probe against the real aggregator sources)
Probe: ~/git/fleet/probe-today-ref/probe.ts on the laptop (bun, imports the real src/feed.ts, src/derive.ts, src/render.ts at 1a069c3ff2; section built in the shape of test/orchestration.test.ts's SECTION fixture, one goal with a horizon: "today" lined-up task):
ref: "goal_b647ff5c92f5"→isOrchestrationSectiontrue;todayFromSectionobjective carries the goal-id ref;renderTodayBodyTHREWError: not a repo-qualified ref: goal_b647ff5c92f5ref: 12345(non-string) → validator true;renderTodayBodyTHREW the same error- Control
ref: "developing-today/code#812"→ validator true; renders OK (len 1311) with the GitHub link
So one publisher-supplied lined-up task — a goal id copied into ref is a realistic shape, since the same publisher puts goal ids in tier refs in live data (#6149) — takes down the whole /today page and its /frag/today fragment, instead of taking the designed invalid-section fallback or rendering the ref as plain text.
Why it matters
/today is the dashboard's daily front page. The orchestration section is republished by an external job every run; its refs are publisher data, not aggregator-controlled constants. #6149 showed this exact input class occurs in live data and 500s a whole page render; the objectives path has the identical unguarded call, one page over. The validator's silence on ref also breaks the boundary contract the rest of the section gate is built on (#949/#2417/#3897: fields consumers dereference are validated at the gate, or consumers guard) — here neither side holds.
Acceptance criteria
- A validator-passing section whose lined-up task carries a non-GitHub ref (goal id, slug, or non-string) no longer throws in
renderTodayBody/ the/todayand/frag/todayrenders; the objective renders with the ref as plain text/code (the fix(aggregator): Needs-you render no longer 500s on a tier item with a non-GitHub ref #6149tierItemCardtreatment), or the ref is dropped at a named boundary — the chosen layer is stated in the PR - A valid
owner/repo#Nlined-up ref still renders as a GitHub link on the objective (control case) - Pinning tests cover both cases end-to-end (section →
todayFromSection→ render), mirroring the fix(aggregator): Needs-you render no longer 500s on a tier item with a non-GitHub ref #6149 regression tests intest/dashboard-overhaul.test.ts - The
bun testaggregator suite passes
Related
- PR fix(aggregator): Needs-you render no longer 500s on a tier item with a non-GitHub ref #6149 (merged today, commit
d634b9b1a3) — the tier-card fix for the same class on Needs-you; this issue is its Today-page sibling, not a duplicate: different render site, different input field (linedUp[].ref, which the section gate shapes), different page. - pm-stack(aggregator): validateNewComment/validateNewAction accept ref keys parseRef rejects (GH_REF number unbounded) #4952 — the shared
isValidRefrule the guarded sites route through. - aggregator(orchestration): section gate never checks tier/goal array elements — a [null] tier item or goal task passes validation and crashes buildAttention/todayFromSection #2417 / aggregator(feed): isGoalMeasurement passes goals todayFromSection crashes or falsifies on — elements and goal/momentum/summary never checked #3897 — the section-gate element-validation line this gap continues.
Activity
developing-today commentedon Nov 5, 2026
CODE-1790
dezren39 commentedon Nov 5, 2026
🤖 Agent note · filed
dezren39 commentedon Nov 5, 2026
🤖 Agent note · handed off
123 remaining items
dezren39 commentedon Nov 6, 2026
🤖 Agent note · done (triage)
1a180ae5-384f-4e71-8d77-08f7b1652c75ses_e5e4fe9e3bbffe8g6yfK5boh3j· task 9964dezren39 commentedon Nov 6, 2026
🤖 Agent note · picked up
isLinedUpElementin src/feed.ts now type-checksref(string-or-absent) like the other dereferenced fields, so a non-string ref takes the designed invalid-section fallback; (2) the render — the objectives site in src/render.ts now mirrors the fix(aggregator): Needs-you render no longer 500s on a tier item with a non-GitHub ref #6149 tierItemCard treatment:isValidRefrefs link, other string refs (goal ids) render as plain code instead of throwing inrefUrl.dezren39 commentedon Nov 6, 2026
🤖 Agent note · parked
refinisLinedUpElement; objectives render mirrors the fix(aggregator): Needs-you render no longer 500s on a tier item with a non-GitHub ref #6149 tierItemCard guard (valid refs link, other string refs render as plain code). Verified on the laptop: orchestration tests 41/41 (new tests fail 2/3 pre-fix), full aggregator suite failure count identical to clean main (22 pre-existing), tsc clean. PR fix(pm-stack/aggregator): gate lined-up ref type + guard Today objectives refUrl (#6174) #6481's Actions checks had not been created after ~5 min (runner backlog); no Codex comments yet at park time.Merge pull request #6481 from developing-today/queue/10943-6174-today…
dezren39 commentedon Nov 6, 2026
agent-note:v1
task: 10943
state: done
lane: code-l
summary: PR #6481 merged (merge commit e16e649). Fix landed: invalid linedUp[].ref dropped at the orchestration-section consumption boundary, task retained; valid owner/repo#N refs still link; renderer safe for non-linkable refs. Codex review on head 4a2089f: no findings. Laptop verification (prior shift): orchestration tests 41/41, full aggregator suite failure count identical to clean main (22 pre-existing), tsc clean. Issue auto-closed by the merge.