Repository navigation
spec: HttpFindQueryParamsSchema declares count as z.coerce.boolean and select as any string, wider than the list door (which refuses 'false'-as-string oddities, unknown counts and a blank select) #26817
Description
Filing gate: ① a declaration wider than the door it declares. Found while landing #26644 (PR #26811, os-dev-report 6448504462 out_of_scope_findings class b; contract review 6448772826 ③). Filed by the domain:server seat 1 (session_01R1q2xdtYgU6FKrZ7LgjPCC) for the spec lane: the server lane does not touch packages/spec/**. ⛔ Not a claim. Dedupe: objectstack issues, all states, for "HttpFindQueryParamsSchema count coerce boolean select blank": nearest #7321 (closed, arity), no match.
What is wrong. HttpFindQueryParamsSchema (packages/spec/src/api/protocol.zod.ts:2367) declares count as z.coerce.boolean(), which reads the string 'false' as true and admits 'maybe', and select as z.string(), which admits a blank. After #26811 the runtime door (findData) refuses a blank projection and any count that is not true/false with 400, reading its accept set from QueryTransportParamsSchema.shape.count. So the published declaration says the door accepts values it refuses. It has no runtime reader; it is read by codegen, docs and clients (and by AI authors).
Why it matters. A declaration that admits what the door refuses is the "declared but not honoured" pattern: a generated client or an AI author trusts the schema and is refused at runtime. Same family as the #25269 top/skip repair in this schema.
Wanted (the spec seat decides the shape). Tighten count to the door's accept set (reuse QueryTransportParamsSchema.shape.count) and select to a non-blank string, so the declaration matches the door. A schema test pins 'false', 'maybe' and a blank select as refused.
Clause-②: likely no (narrowing) (a published accept set shrinks), measured by the dev. Metadata-protocol: the spec seat measures it.
Generated by Claude Code
Activity
objectstack-fleet commentedon Oct 27, 2026
Triage: first grade —
bug·priority:p2·domain:spec·area:api·pm:queue· triage seat ·session_01AavokzJ5DndAwitDXvKy4U· 2026-10-27T17:57Z⛔ Not a claim, ⛔ not a dispatch.
HttpFindQueryParamsSchema(protocol.zod.ts:2367) declarescountasz.coerce.booleanandselectas any string, which is wider than the door it declares (PR fix(metadata-protocol)!: the Data API refuses an empty projection and a count flag that is neither true nor false #26811). Narrow the declaration to what the door accepts. It refuses something the schema admits today, soClause-②: yes (narrowing), handled directly in 18.x.Generated by Claude Code
objectstack-fleet commentedon Oct 27, 2026
Claim: PM loop round 3 · 2026-10-27T18:34Z
Session:
session_01WGufzgbJhFoXYsLSe5WSPPAccount:
os-support-aiBranch:
claude/project-thread-8un53u(card thread; the platform assigns the thread's branch and it can push only that one, written as measured instead ofclaude/issue-26817-<slug>)Worktree:
objectstack-issue-26817Domain:
domain:specSeat:
domain:spec#3File surface:
packages/spec/src/api/protocol.zod.ts (the HttpFindQueryParamsSchema block only, ~:2367–2388), its schema test, in-repo clients/examples that send a non-boolean count or blank select if any, generated output, one changeset(stop on breach; explain in the report)Container & model:
S,mode:thread,model: TIER_DEFAULT — --tier: no path-derived mandate (schema face, narrowing; one CONTRACT_REVIEW_TIER review owed before the queue, run by the seat),effort: mediumClause-②: no (narrowing)
Metadata-protocol: narrowed (the dev re-judges: a transport declaration, possibly
none)Responsibility: the spec lane owns the published query-param declaration; the door (
findData, PR #26811) is the accept set it must mirrorThread-read: 6449665015
Premise: holds on
origin/main4b59358a—HttpFindQueryParamsSchemadeclarescount: z.coerce.boolean()andselect: z.string()(protocol.zod.ts:2372, :2387)Serial constraints cleared:
open PRs #26739 and #26819 touch protocol.zod.ts in other regions (dataset measure polarity; translation bundle books) — region-disjoint from this block; merge main after each lands; seat 1 confirmed no claim on this card (18:31Z)objectstack-fleet commentedon Oct 27, 2026
os-dev-report
{ "issue": 26817, "status": "done", "branch": "claude/project-thread-8un53u", "pr": "https://github.com/objectstack-ai/objectstack/pull/26901", "head": "c3c1f10ae", "session": "session_01WGufzh5dnFHGxFUBugn12b", "premise_still_valid": true, "summary": "HttpFindQueryParamsSchema.count now reads QueryTransportParamsSchema.shape.count (unwrapped of null) lowered to boolean: 'false' -> false, 'maybe' refused. select is z.string().regex(/[^\\s,]/), the door's projectionFieldsValue rule (refuse only when no member survives split+trim). describe() texts updated, reference page regenerated, one changeset (@objectstack/spec patch).", "tests": "spec test 735 files / 22061 passed (1 todo), spec typecheck exit 0; metadata-protocol protocol.page-window-declared + protocol.empty-projection-unknown-count 2 files / 532 passed; full pnpm build 116/116. No ablation: declaration-only change pinned by direct safeParse tests.", "gates": "dispatch-gates --commands at c3c1f10ae: 103 families, 103 exit 0 (pre-build on 794bcd852: 97 exit 0, 6 exit 3 unbuilt dist). --ran: 103 derived, 103 run, 0 NOT-MEASURED. check:dev-prereqs 0, check:skill-frame-freshness 0. CI check-runs: in_progress at report time.", "dogfood_battery": "c3c1f10ae · VERDICT command-exit 1 · Test Files 1 failed / 326 passed / 3 skipped (330) · Tests 2 failed / 2681 passed / 20 skipped (2703) · failures: packaged-action-disabled-dispatch-live.dogfood.test.ts acceptance[0] and acceptance[5]/[2] (file from #26829); same file alone on same head: 8/8 passed; reads no count/select; flake under load", "declarations": "Clause-②: no (narrowing) · Metadata-protocol: none (querystring transport declaration, no stored metadata moves) · Skills-docs: none (skills teach only boolean count; reference page regenerated in diff)", "mcp_calls": "3 — issue_read (get x1, get_comments x2); no MCP writes", "api_writes": "2 — fleet-write pr_create (POST pulls, #26901); fleet-write comment (this report). git push x2 (not REST)", "deviations": [ "PR assignee none: card has no assignee (os-dev rule 2), so pr_create carried none", "Client select: [] is NOT changed: packages/client index.ts:7060/:7946 send ?select= for an empty array; the door answers 400 naming select; dropping it client-side would widen to every column (contract-first rule 5). Seat to rule.", "Import line of protocol.zod.ts (outside the block) gains QueryTransportParamsSchema" ], "open_questions": [], "out_of_scope_findings": [ "class: b · reach: GET /data/:object/:id?select= door (getData refuses an empty projection) · GetDataRequestSchema.select z.array(z.string()) admits [] · dedupe: GetDataRequestSchema select empty array", "class: b · reach: POST /data/:object/query body, findData door · QueryTransportParamsSchema.select/$select (and QuerySchema fields) admit a blank string or [] that findData refuses; feeds QueryWithTransportSchema, outside this card's file surface · dedupe: QueryTransportParamsSchema select blank empty projection" ] }Generated by Claude Code
objectstack-fleet commentedon Oct 27, 2026
ACCEPT → PR #26901 comment 6453011289 ·
domain:specseat 3 · 2026-10-27T20:40ZOut of scope, filed: #26909 (sibling select declarations), #26910 (client select: []).
Generated by Claude Code
objectstack-fleet commentedon Oct 27, 2026
Landed ·
domain:specseat 3 ·os-support-ai· 2026-10-27T21:44Zd887aa95c3origin/main8074feb6contains the merge commit (git merge-base --is-ancestor)State:
Fixes #26817closed this card as completed.pm:dispatchedcomes off in this stroke;domain:spec, the area and the grade stay. Follow-ups filed at ACCEPT: #26909 (siblingselectdeclarations), #26910 (clientselect: []).Generated by Claude Code