Repository navigation
finding(types): the ChartSchema axis-config object dialect is undeclared and passes through unchecked - liveness read owed before declare-or-retire #7690
Description
Ruled: 5809510046 · letter measure-then-branch (declare what is written, retire what is not) · 2026-09-24T07:11Z
Carved out of objectui#7546 by the domain:ui PM seat before PR #7684 lands. #7684 carries Fixes #7546, so the merge closes that card — and the axis-config dialect below is measured in #7546's own body and would sink with it. Filed so it keeps a carrier.
What #7546 measured, verbatim from its body
Also undeclared, though merely passed through rather than stripped, on
ChartSchemaitself:xAxis(the axis config object dialect —field,format,title,showGridLines,min,max,position,logarithmic) andyAxis, both read bynormalizeAxis/normalizeChartSchemaat lines 204-220 and 287-298. #7113 deliberately folded only the bare-stringxAxisand left the object dialect untouched, because folding it would discard its presentation keys — declaring it is the follow-up this finding covers.
And its warning, which is the reason this is a card and not a patch:
⚠️ Whether the axis-config object should be declared at all — versus retired under ADR-0049 if no authored document uses it — is a triage question, not a foregone conclusion.
Why this is a different card, not the same one
The series-key half of #7546 (#7684) is about a non-strict z.object that STRIPS an undeclared key. This half is the opposite mechanism: ChartSchema sits on BaseSchema, which is .passthrough(), so an undeclared key is KEPT and reaches the renderer — only its value goes unchecked. Same finding family, different failure mode, and the two need different liveness reads.
What is NOT decided
⛔ Do not open with "declare the eight keys". ADR-0049 is enforce-or-remove, and the retire arm is live here: if no authored document writes the object dialect, the correct outcome is retirement, not declaration. The first work on this card is the liveness read, per key, with lit controls — docs, fixtures, designer inputs, and real producers — exactly as #7684 did for the six series keys and for chartType.
Note the shape #7684 established for a key that measures dead: it was reported, not retired and not declared, because retiring it is a narrowing that needs its own card and its own changeset grade. The same discipline applies here.
Carrier note
Do not fold this into #7684. That PR's scope fence is deliberate and its review is in flight.
Generated by Claude Code
Activity
objectstack-fleet commentedon Sep 24, 2026
Ruling: UI closure batch 3 item 9 · letter measure-then-branch (liveness read decides declare vs retire; no second decision card) · maintainer 「同意」 (chat, director seat summon #29,
session_01EcrTi7s5oDYPHS4Pi7h31d) 2026-09-24T07:10ZThread re-read (no comments) in this act. Read on objectui
origin/main62597c5:plugin-chartsAdvancedChartImpl.tsxreads the axis-config object dialect (min/max,format,logarithmic,title), andpackages/types/src/zod/data-display.zod.ts:752-757still describes it as left untouched. The dialect is not declared, so its values pass through unchecked.Ruled, with both branches pre-decided so the result needs no second ruling:
inputsand real producers in the sibling repos, as fix(types): ChartDataSeriesSchema declares the six series keys the renderer reads (objectui#7546) #7684 did for the series keys.ChartSchema's axis object, with a changeset.A mixed result (some keys written, others not) applies 2 and 3 per key.
Execution:
pm:queue·priority:p3·domain:uistand; either branch changes an accept set ⇒Clause-②: yes.Generated by Claude Code
objectstack-fleet commentedon Sep 25, 2026
Claim: PM loop round 1 —
domain:uiexecution seatSession:
session_01BA3nKVUwKQJf8DBxrSVtNCBranch:
claude/issue-7690-chart-axis-config-dialectWorktree:
objectui-issue-7690Domain:
domain:uiSeat:
domain:ui#1File surface:
packages/types/src/zod/data-display.zod.ts(ChartSchema'sxAxis/yAxisobject form, about lines 747–790) and its TS twin inpackages/types/src/data-display.ts; on the retire branch only, the axis-object reads inpackages/plugin-charts/src/AdvancedChartImpl.tsxand the normaliser that folds them; tests beside each; docs that teach the object form; and changesets (stop on breach; explain in the report)Container & model:
M,mode:subagent,model: opus(default judgement tier) —priority:p3: an undeclared dialect whose values pass the mirror uncheckedClause-②: yes
Thread-read: 5809510046
Serial constraints cleared: open-PR file lists read 2026-09-25T05:10Z ⇒ none touches
data-display.zod.ts,data-display.tsorAdvancedChartImpl.tsx. Live claims read at the same time:domain:specseat) namesdata-display.zod.tsforDataTableSchema.renderCellEditorandTableColumnSchema.cellonly. That region is disjoint fromChartSchema's axis object.plugin-charts'ObjectChart.tsxfetch effect only, notAdvancedChartImpl.tsx.Scope
The ruling
5809510046(UI closure batch 3 item 9, letter measure-then-branch; maintainer 「同意」), with both branches pre-decided:inputsand real producers in the sibling repos, as objectui#7684 did for the series keys.ChartSchema's axis object, with a changeset.@objectstack/specDECLARES that object (read the installed dist), the spec declaration wins: the mirror follows it, and a retire branch that contradicts a spec declaration stops as a fork. ⛔ Never narrow at the consumer what the spec declares.⇒
Fixes #7690.domain:uiseat #1 ·session_01BA3nKVUwKQJf8DBxrSVtNC· claim · 2026-09-25T05:13Zobjectstack-fleet commentedon Sep 25, 2026
os-dev-report
{
"issue": 7690,
"status": "done",
"branch": "claude/issue-7690-chart-axis-config-dialect",
"pr": "#10511",
"session": "session_01BA3nKVUwKQJf8DBxrSVtNC — this run's harness-stamped id (subagent = parent's)",
"premise_still_valid": true,
"summary": "Protocol first: the installed @objectstack/spec 17.4.0 (lock pin) DECLARES the axis object — dist/ui ChartAxisSchema (strictObject with an alias map; field required, title I18nLabel, format, min, max, stepSize, showGridLines default true, position left/right/top/bottom, logarithmic default false), used as ChartConfigSchema.xAxis (one object) and ChartConfigSchema.yAxis (a LIST), and DashboardWidgetSchema.chartConfig is ChartConfigSchema — so the retire branch was closed and branch 2 (declare) applied; the per-key liveness read agrees (every key has a producer path: hotcrm dashboards write field/title/format/showGridLines/logarithmic in chartConfig, objectstack showcase writes yAxis [{field, stepSize}] on an object-chart, and DatasetWidget's axisPresentation lowers all eight presentation keys onto the chart node; objectui authored surfaces 0 with lit controls; cloud not reachable). ChartSchema.xAxis is now the objectui#7113 bare-string alias (fold unchanged) or stripImportedDefaults(spec ChartAxisSchema) by reference, yAxis is the spec's array; the TS twin types both with the spec's ChartAxis; the two spec-boundary ledgers register the crossing; the plugin-charts guide and schema reference teach it; changeset @object-ui/types minor. Zone-2 readings falsified: the renderer reads NINE axis keys (not the five listed), and on the declare branch plugin-charts source is untouched so no plugin-charts changeset. No renderer changed; the single-object and bare-string yAxis shapes the normalizer tolerates are not declared (no producer), and one renderer defect found on the way (x-axis numeric keys dropped by a normalizer gate) is reported below, not fixed (outside the claim's declare-branch file surface).",
"tests": "All at 235d4c7 (PR head). (1) pnpm exec vitest run packages/types/ packages/plugin-charts/ packages/plugin-dashboard/ examples/schema-catalog/test/ from the repo root via os-verify-lock: 'Test Files 465 passed (465) / Tests 9438 passed (9438)', VERDICT command-exit 0 (an earlier run at 821bd20 was 2 failed: imported-defaults-8317 IMPORTED and zod-mirror-parity SPEC_DERIVED_PAIRS lacked the new crossing — registered in ccddd97). (2) pnpm --filter @object-ui/types type-check (tsc, examples, tsconfig.test.json) and pnpm --filter @object-ui/plugin-charts type-check after building its closure (pnpm --workspace-concurrency=2 --filter '@object-ui/plugin-charts^...' build): VERDICT command-exit 0, 0 'error TS' in either log; tsc --listFilesOnly confirms both test projects include the new test files. (3) Ablation 1, committed first, via ablation-replace.mjs: deleted both new ChartSchema members — anchor 1 -> 0, blob 2d1974dffad7 -> c45e7086cc02, on-disk grep of the declaration 0; predicted 14 failed / 10 passed in chart-axis-config-7690 and 7113 all green; observed 'Tests 14 failed | 36 passed (50)'; restored blob 2d1974dffad7 == HEAD, git diff HEAD empty. Source-resolved imports (../zod/data-display.zod), no dist in the path. (4) Reverse verification of the TS twin: deleted 'yAxis?: SpecChartAxis[];' — predicted and observed tsc -p tsconfig.test.json exit 2 with TS2578 x2 (the yAxis @ts-expect-error lines) and TS2322 in zod-mirror-parity naming data-display.zod.ts#ChartSchema / yAxis; restored blob 3fb83f914242 == HEAD, diff empty. (5) check:doc-snippets after the scoped turbo build it names: '674 of 674 block(s) judged, 0 failed'; check:doc-examples, check:doc-types (first red on a series type literal in my example, fixed in 235d4c7), check:doc-fences, check:control-bytes, check:new-line-citations ('0 new citation(s)'), check:spec-symbols, check:pending-changeset-literals, check:test-path-roots, check:phantom-deps, check:vi-mock-specifiers: exit 0; node scripts/check-changeset-presence.mjs exit 0 (1 changeset, 6 source files in 2 released packages — the plugin-charts one is a test file); check:changeset-claims exit 0, its 36 flagged pending changesets read for the chart ones (6896, 7352), none falsified. (6) ESLint on the six touched source files, per rule, base 80a0ecd vs head: identical (data-display.ts no-explicit-any 30 -> 30, others 0 -> 0, new files 0); base contents swapped in and restored by blob (both hashes == HEAD, diff empty); type-aware linting not enabled in eslint.config.js. (7) check-governed-queue-guard --test over the diff: NOT GOVERNED. Liveness scan: objectui @80a0ecda9 8407 files / 47 axis-object hits (tests only) / control xAxisKey 149; objectstack @8d76c2d38 9296 / 39 / 2; hotcrm @087b7c5 847 / 18 (all dashboard chartConfig); cloud unreachable.",
"mcp_calls": "0",
"api_writes": "2 — (a) relay pr_create: POST /repos/objectstack-ai/objectstack/dispatches (HTTP 204) -> fleet-write run 36101782788 success -> POST /repos/objectstack-ai/objectui/pulls (draft PR #10511, author objectstack-fleet[bot], body read back byte-identical, 12080 bytes); (b) this os-dev-report comment, POST /repos//issues/7690/comments via post-stamped.mjs --repo=objectstack-ai/objectui. Plus git push (not REST). Zero label writes, zero PR-body PATCH.",
"open_questions": [],
"out_of_scope_findings": [
"class: a · normalizeChartSchema's x-axis presentation gate (xAxisSpec.format || xAxisSpec.title || xAxisSpec.showGridLines !== undefined) drops min / max / stepSize / logarithmic / position from an xAxis object that carries none of those three. Failing probe: normalizeChartSchema({ type: 'chart', chartType: 'scatter', xAxis: { field: 'progress', min: 0, max: 200, stepSize: 50, logarithmic: true, position: 'top' } }) returns { chartType: 'scatter', xAxisKey: 'progress' } with no xAxis; the same object plus title: 'P' keeps min/max. Reachable today: a dataset-bound scatter dashboard widget whose chartConfig.xAxis is { field, min, max } (DatasetWidget -> axisPresentation keeps min/max -> the gate drops them), and any authored chart / object-chart node; AdvancedChartImpl's scatter XAxis (numericAxisSpecProps, objectui#9675) never receives them. Seam: spec:ChartAxisSchema.min/max/stepSize/logarithmic -> runtime:normalizeChartSchema axes block x gate -> renderer:AdvancedChartImpl scatter XAxis · dedupe words: scatter xAxis min max dropped; normalizeChartSchema xAxis gate; x axis stepSize logarithmic ignored; xAxisSpec title format showGridLines",
"carrier: 承接者:无 · noted, not filed — ObjectChartSchema (object-chart) carries the same undeclared xAxis / yAxis passthrough; the objectstack showcase command-center page writes yAxis: [{ field, stepSize }] there (in PR Acceptance notes)",
"carrier: 承接者:无 · noted, not filed — spec ChartAxisSchema.stepSize admits 0 and negatives; the renderer ignores a non-positive step silently (in PR Acceptance notes)"
]
}
Generated by Claude Code
objectstack-fleet commentedon Sep 25, 2026
✅ ACCEPT — PR objectui#10511 at
235d4c788· entering the merge queue once CI is greendomain:uiseat #1,session_01BA3nKVUwKQJf8DBxrSVtNC. The seat read the dev report and the diff against the ruling5809510046and the claim5827183733.Clause-②: yes: the mirror's accept set changes on a published surface. Per batch #151 item 3, the seat's review is the record indomain:ui.main·Fixes #7690·Clause-②: yesat line start@objectstack/spec17.4.0 DECLARES the axis object:dist/uiChartAxisSchema, astrictObjectwith an alias map. Its keys arefield(required),title,format,min,max,stepSize,showGridLines,positionandlogarithmic.ChartConfigSchemauses it asxAxis(one object) andyAxis(a list). ⇒ The retire branch was ruled out and the declare branch applied, as the claim's protocol-first clause requiredchartConfig), the objectstack showcase (yAxis: [{ field, stepSize }]on anobject-chart), andDatasetWidget'saxisPresentation. objectui's own authored surfaces have 0 hits, with lit controls. The cloud repo was unreachableChartSchema.xAxisis the objectui#7113 bare-string alias (fold unchanged) orstripImportedDefaults(ChartAxisSchema), BY REFERENCE.yAxisis the spec's array. The TS twin types both with the spec'sChartAxis. Named-union guidance explains a refused value. The two spec-boundary ledgers register the new dependency. The plugin-charts guide and the schema reference document it. No renderer change. The normaliser's tolerated single-object and bare-stringyAxisare not declared, because nothing writes themchart-axis-config-7690, with objectui#7113's pins all green. TS twinyAxisdeleted: TS2578 ×2 and a TS2322 inzod-mirror-parity. Both restored by blobpackages/types,plugin-charts,plugin-dashboardandexamples/schema-catalog: 465 files, 9438 passed. Both packages type-check clean.check:doc-snippets674/674, andcheck:doc-typesis clean after a series literal fix. The changeset family and spec-symbol gates pass. eslint per-rule counts are equal to base, and the governed guard reads NOT GOVERNEDminoron@object-ui/types, ⛔ nomajor. plugin-charts gains only a test, and the presence gate accepts one changesetThe claim's Zone 2 readings the dev corrected: the renderer reads nine axis keys, not five. On the declare branch, plugin-charts source is untouched.
Dev findings — each one routed
normalizeChartSchema's x-axis gate dropsmin/max/stepSize/logarithmic/positionunlessformat,titleorshowGridLinesis also present. It is reachable today on dataset-bound scatter widgets ⇒ filed finding(plugin-charts):normalizeChartSchemadrops anxAxisobject'smin/max/stepSize/logarithmic/positionunless it also carriesformat,titleorshowGridLines#10516.ObjectChartSchema(object-chart) carries the same undeclared axis passthrough, and the objectstack showcase writes it. The dev noted it; the seat files it, because the parent ruling reaches it ⇒ filed finding(types):ObjectChartSchema(object-chart) carries the same undeclaredxAxis/yAxisaxis-object passthrough objectui#7690 declared onChartSchema, and a real producer writes it #10518.ChartAxisSchema.stepSizeadmits 0 and negatives, which the renderer ignores silently ⇒ PR Acceptance notes. 承接者:无.Maintainer veto window (named in the round report; landing is not held):
chartnode'syAxismust now be the spec's list of axis objects. A single object or a bare string is refused byobjectui check/validate, with guidance. No authored producer writes those shapes.xAxisobjects are now validated strictly against the spec's axis schema.domain:uiseat #1 · review · 2026-09-25T06:24Zfeat(types): declare the spec's axis config object on ChartSchema.xAx…