lint: `validate-visibility-predicates` passes unknown CEL functions clean (the `validateExpression` premise is falsified) — ruled: extend to function-existence ERROR, scoped supersession of the parse-only ruling

[claude]

Summary

validateExpression (@objectstack/formula) reports ok: true, zero errors and zero warnings for a CEL source that calls a function the engine does not have. The same source then fails at runtime with found no matching overload. Authoring-time validation — the publish gate — does not check that the functions a predicate calls exist.

Measured

@objectstack/formula@17.2.0 (@marcbachmann/cel-js@8.0.0), node, one process:

"totallyBogusFn(1,2)"            validate.ok= true  warnings= 0  | runtime.ok= false - found no matching overload for 'totallyBogusFn(int, int)'
"record.x.nosuchmethod('a')"     validate.ok= true  warnings= 0  | runtime.ok= false - found no matching overload for 'dyn.nosuchmethod(string)'
"upper('a')"                     validate.ok= true  warnings= 0  | runtime.ok= true

Both the global-call form and the receiver/member-call form are affected. validateExpression catches parse errors and unbound roots today (SCOPE_ROOTS is enforced), so the function name is the one part of a call that nothing checks.

Why it matters

The runtime fault is not loud where it lands. On the ObjectUI action surfaces a faulting visible predicate is fail-CLOSED — ActionEngine.getActionsForLocation and DeclaredActionsBar both evaluate with throwOnError: true and hide the action on a throw. So a single mistyped or non-existent function name in an authored predicate produces:

• publish: clean, no error, no warning;
• runtime: the action is invisible for every user, including ones who hold the grant;
• the only signal is one deduped console.warn in the browser.

That is the failure mode metadata validation exists to prevent, and it is the one an AI-authored app is most likely to hit — a plausible-looking function name that does not exist is exactly what a generator invents. Measured on this while investigating objectui#4421, where an authored current_user.can(object, verb) predicate validated clean and then faulted at runtime on every surface.

Suggested direction (not a decision)

The engine already knows its own function registry — CEL_STDLIB_FUNCTIONS is exported, and cel-js Environment exposes getDefinitions(). Resolving each call node in the parsed AST against that set inside validateExpression would turn this into a publish-time error with a nearestName suggestion (the helper already exists in this package for identifiers). Whether an unknown function should be an ERROR or a WARNING is a contract call — an error is the enforce-or-remove-consistent answer, but it can reject predicates that a host registers extra functions for, if any host does that.

Filed unassigned from an objectui dev seat; no fix attempted here.

---

Generated by Claude Code

[os-warren]

Triage: lands in packages/formula(validateExpression)⇒ domain:engine, pm:queue, type Bug, priority:p1。

Bug 判据:发布门声称校验表达式(它已经在管 parse 错误与未绑定根,SCOPE_ROOTS 是强制的)⇒ 函数名是这条调用链上唯一没人检查的部分。declared ≠ enforced。

为什么 p1 —— 这张卡命中平台的北极星风险

失败链条是本仓最不愿意有的那一种,而且卡把三段都测了:

阶段	表现
发布	干净,零 error 零 warning(validate.ok = true)
运行	found no matching overload,而 ObjectUI 动作面 visible 谓词是 fail-CLOSED(getActionsForLocation 与 DeclaredActionsBar 都以 throwOnError: true 求值,抛出即隐藏)
后果	动作对所有用户不可见,包括持有授权的用户;唯一信号是浏览器里一条去重后的 console.warn

⭐ 而卡点出了最要紧的一句,分诊背书并升为定级依据:

"a plausible-looking function name that does not exist is exactly what a generator invents"

⇒ 这正是「防 AI 写代码犯错」棱上的核心形状:AI 编造一个看起来合理的函数名,发布门放行,权限正常的用户看不到按钮,而没有任何地方会说为什么。

以「带前提的裁决」入队

① 裁决:未知函数判 ERROR,不是 WARNING。依据是 ADR-0049 enforce-or-remove 的一致答案(卡自己也这么标),以及「契约收紧优于消费端宽容、声明即强制」。⛔ WARNING 会把一个静默失败换成一个没人读的提示,收益接近零。

② 前提(dev 先验):

没有任何 host 会向 CEL 环境注册 stdlib 之外的额外函数。

这是卡唯一给 ERROR 留的反例("it can reject predicates that a host registers extra functions for, if any host does that")。测法:枚举仓内对 cel-js Environment 的构造/扩展点,看有没有注册额外函数的路径。零命中带阳性对照(同一遍里 stdlib 注册必须命中)。

③ 显式禁令:测到有 host 注册额外函数 ⇒ 停手报 fork,⛔ 不许自行降成 WARNING —— 那时正确形状是「ERROR + 可声明的扩展函数集」,而这是契约设计,回 needs-user-decision。

实现线索(卡已给,分诊确认其可用)

机械全在树上:CEL_STDLIB_FUNCTIONS 已导出,cel-js Environment 暴露 getDefinitions(),而 nearestName 建议助手在本包里已经为标识符实现过。⇒ 这是把已有的三件接起来,不是新建分析。两种调用形式都要覆盖:全局调用(totallyBogusFn(1,2))与接收者/成员调用(record.x.nosuchmethod('a')),卡两者都测了。

---

Generated by Claude Code

[zhuangjianguo]

CLAIMED + dispatch order — #13594

• Session: session_01F3jdziLbAPGeceVNmSox5L · Branch: claude/issue-13594-validate-unknown-cel-function · Worktree: ../objectstack-13594-cel-unknown-fn, off origin/main
• Labels: pm:queue → pm:dispatched
• ⚠️ Clause ②: CONDITIONAL, and the condition is the card's own open question. If the unknown function lands as an ERROR, this narrows what the publish gate accepts ⇒ content limb FIRES ⇒ attach needs:contract-review. If it lands as a WARNING, nothing is narrowed and it does not fire. Path limb NO either way. ⇒ Decide the ERROR/WARNING question first (Zone 2 A2.1), then declare clause ② from what you actually built. ⛔ Overrule upward only.

---

Zone 1 — binding

⛔ No maintainer ruling. What binds:

1.1 — ⛔ The ERROR-vs-WARNING choice is NOT yours to make on taste. The card states it plainly: "Whether an unknown function should be an ERROR or a WARNING is a contract call — an error is the enforce-or-remove-consistent answer, but it can reject predicates that a host registers extra functions for, if any host does that." ⇒ It is decidable by measurement (A2.1), not by preference. If the measurement does not settle it, that is STOP condition 1.

1.2 — Both call forms are in scope. Measured on @objectstack/formula@17.2.0 / @marcbachmann/cel-js@8.0.0: the global-call form (totallyBogusFn(1,2)) and the receiver/member-call form (record.x.nosuchmethod('a')) both validate clean and both fault at runtime. ⛔ A repair that catches only the global form leaves half the defect.

1.3 — ⛔ Do not weaken what already works. validateExpression already catches parse errors and unbound roots (SCOPE_ROOTS is enforced), and upper('a') must keep validating clean. The function name is the one part of a call that nothing checks — close exactly that.

---

Zone 2 — PM 机制假设 (measure; ⭐ falsification is a reportable success)

A2.1 — ⭐⭐ THE ONE THAT DECIDES THE CARD. "No host registers extra CEL functions." This is the entire objection to shipping ERROR, and it is a fact about this repo, not a matter of judgment. Census every construction of the cel-js Environment / every registration path across packages/, examples/, apps/ — with a firing positive control (the stdlib registration itself must appear in your scan, or the scan is blind).

• Zero host registrations ⇒ ERROR is safe and the objection evaporates ⇒ ship ERROR, clause ② fires.
• Any host registration ⇒ ERROR would reject working predicates ⇒ STOP condition 1; report, ⛔ do not silently downgrade to WARNING to dodge the question.

A2.2 — "The registry is already reachable from validateExpression." The card says CEL_STDLIB_FUNCTIONS is exported and cel-js Environment exposes getDefinitions(). Verify both on the pinned version rather than trusting the card — an API that does not exist in @marcbachmann/cel-js@8.0.0 changes the whole approach.

A2.3 — "Call nodes are identifiable in the parsed AST." My assumption is you can walk the AST validateExpression already parses and pick out call nodes for both forms in 1.2. Falsifiable: the member-call form may not carry a resolvable name at parse time, which is exactly why it slipped through.

A2.4 — "The nearestName helper is reusable." The card notes it already exists in this package for identifiers. Falsifiable — it may be keyed to the identifier namespace and need widening to the function set. ⚠️ If a suggestion would be wrong (nearest match across an unrelated namespace), ship no suggestion rather than a misleading one.

---

Zone 3 — advisory

• The runtime message the engine already produces (found no matching overload for 'totallyBogusFn(int, int)') is the honest vocabulary; matching it at publish time makes the two moments read as one system.
• ⚠️ Worth carrying into the message: the card's evidence that this is the AI-authoring failure mode — "a plausible-looking function name that does not exist is exactly what a generator invents."
• ⛔ Never edit content/docs/releases/.

STOP conditions

1. A2.1 finds any host registering extra functions ⇒ ERROR would reject working predicates. Report with the measurement; ⛔ do not pick WARNING on your own to avoid the escalation.
2. A2.2 falsifies — the registry is not reachable from the validator on the pinned cel-js version.
3. Closing the member-call form requires changing what the engine RESOLVES at runtime rather than what the validator checks — that is a different card.
4. Any other open PR claims your paths. Verify BEFORE your first edit. ⚠️ Three sibling seats are running: The undeclared-field door sits in FRONT of the hooks, so a key a beforeInsert hook writes has no door at all — and the drivers then disagree (memory stores it, SQL throws a raw statement error) #13657 (packages/objectql insert/update ↔ hook seam), datasource DELETE does not evict the stuck driver from the data-engine driver registry — /ready keeps naming a datasource that no longer exists, recoverable only by process restart #13578 (data-engine driver registry + datasource delete lifecycle), createFieldPresenceProbe's docstring still says organization_id is injected "only in multi-tenant mode" — applySystemFields provisions it unconditionally #13416 (packages/metadata-core/src/record-organization.ts). Yours (packages/formula) should be disjoint from all three — if it is not, STOP and report.

Verification expected

Pins for both call forms from 1.2, plus the upper('a') non-regression control; the A2.1 census with its firing positive control; full packages/formula suite and its downstream consumers; an ablation proving the new pins fail without the check; a changeset. ⭐ State the ERROR/WARNING decision and the measurement that produced it. ⛔ Report anything unmeasured as NOT MEASURED. ⛔ No test skipped, disabled, quarantined, allow-listed, deleted or re-baselined.

---

Generated by Claude Code

[zhuangjianguo]

⚠️ First seat terminated on a hard rate limit — re-dispatching, and one deviation declared

The seat dispatched against order 5478562500 terminated early: HTTP 429, CONTRACT_REVIEW_TIER model quota exhausted. ⛔ Not a failure of the work and ⛔ not a finding about this card — the run simply stopped.

The deviation, stated rather than done quietly

That seat was deliberately dispatched at CONTRACT_REVIEW_TIER because clause ② conditionally fires here (ERROR ⇒ the publish gate's accept set narrows). The tier is unavailable, so the replacement seat runs at the default tier.

⭐ What that does NOT change: the substantive protection is the contract review itself, which needs:contract-review routes and which still happens at tier when a reviewer picks it up. Dispatching the implementation at that tier was my own stricter reading of 「派发按 CONTRACT_REVIEW_TIER」, not the clause's requirement. The label requirement is unchanged and unconditional: if the fix ships ERROR, the PR carries needs:contract-review.

⛔ Recording it because a tier downgrade taken silently is exactly the kind of thing that should never be inferred from a diff later.

One partial measurement from the terminated run — ⚠️ treat as a HINT, not a result

Before it stopped it reported: A2.3 HELD — both call forms carry resolvable names (call / rcall), i.e. the member-call form is identifiable in the parsed AST, not opaque.

⚠️ The replacement seat must re-measure it rather than inherit it. A claim from a run that terminated mid-flight has not been through that run's own verification, and this lane's standing discipline is that an inherited citation presented as a reading is the failure mode, not the shortcut. It is offered only as a place to look first.

Housekeeping

The terminated run left a worktree at ../objectstack-13594-cel-unknown-fn and may have created the branch. The replacement seat reuses or recreates it — ⛔ it does not open a second branch for the same card.

The order at 5478562500 stands unchanged in every other respect, including the decisive measurement (⭐ census every cel-js Environment construction / function-registration path, with a firing positive control; any host registering extra functions ⇒ STOP, ⛔ never a silent downgrade to WARNING).

---

Generated by Claude Code