You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Split out of #6362 (PR #6900). Recording only — not claimed, not queued.
The observation
metadata-type-schemas.test.ts holds the ADR-0010 invariant that every metadata
type either declares ...MetadataProtectionFields or is named on an explicit
debt list. UNDECLARED_ENVELOPE is currently empty, and its own comment
calls that "the end state", so the gate reads as total coverage.
It is not. The gate iterates listMetadataTypeSchemaTypes(), which returns Object.keys(BUILTIN_METADATA_TYPE_SCHEMAS) plus runtime extras — and
deliberately notUNREGISTERED_KIND_SCHEMAS. That exclusion is documented
and intentional (the trailing comment in metadata-type-schemas.ts explains
that enrolling webhook / connector / sharing_rule there would claim a KIND
status #6245 was careful not to grant, leaving #2657's B/C decision open).
The side effect was not intended, though: those three names are bound as real
parse doors — #6245 wired them to PUT /api/v1/meta/:type/:name — while the
invariant that exists to catch "declares no envelope" never runs over them.
Evidence that this is the actual cause, not a theory
connector sat in exactly that gap and the gate stayed green throughout:
So all three were judged one at a time, by hand, for a property the repo already
has an automated structural walker for.
Why this is observation-class, not a defect
Nothing a user hits today: as of PR #6900 all three bound kinds declare the
envelope, so the gap is currently empty of bugs. The exposure is prospective —
a fourth entry added to UNREGISTERED_KIND_SCHEMAS inherits the same
silence, and the next one may be non-strict too, in which case the failure is
again a silent strip rather than a 422.
Possible directions (deliberately not chosen here)
Give the existing suite a second it.each over Object.keys(UNREGISTERED_KIND_SCHEMAS)
asserting only the envelope-declaration property — without enrolling them
in listMetadataTypeSchemaTypes(), so none of the other KIND obligations
(create seeds, MetadataTypeSchema membership, the campaign count) attach and Studio metadata coverage gaps: surface remaining types + promote un-typed concepts #2657 stays unprejudged.
Export the bound-kind names so the walk derives the set rather than
hand-listing it.
Leave as-is and rely on review, if the set is expected to stay at three.
Direction 1 looks like the cheap one and appears to preserve every boundary #6245 drew, but it is a decision about a contract surface's coverage rules, so
it should be triaged rather than assumed.
Refs: #6362 / PR #6900 (connector, the silent-strip case), #6245 (bound the three
doors; fixed sharing_rule's 422 case), #4001 batch 11 (webhook's spread), #2657 (the open B/C kind-promotion decision), ADR-0010.
Split out of #6362 (PR #6900). Recording only — not claimed, not queued.
The observation
metadata-type-schemas.test.tsholds the ADR-0010 invariant that every metadatatype either declares
...MetadataProtectionFieldsor is named on an explicitdebt list.
UNDECLARED_ENVELOPEis currently empty, and its own commentcalls that "the end state", so the gate reads as total coverage.
It is not. The gate iterates
listMetadataTypeSchemaTypes(), which returnsObject.keys(BUILTIN_METADATA_TYPE_SCHEMAS)plus runtime extras — anddeliberately not
UNREGISTERED_KIND_SCHEMAS. That exclusion is documentedand intentional (the trailing comment in
metadata-type-schemas.tsexplainsthat enrolling
webhook/connector/sharing_rulethere would claim a KINDstatus #6245 was careful not to grant, leaving #2657's B/C decision open).
The side effect was not intended, though: those three names are bound as real
parse doors — #6245 wired them to
PUT /api/v1/meta/:type/:name— while theinvariant that exists to catch "declares no envelope" never runs over them.
Evidence that this is the actual cause, not a theory
connectorsat in exactly that gap and the gate stayed green throughout:sharing_rulewas.strict(), so its undeclared envelope produced a hard 422and meta: bind Zod schemas for webhook / connector / sharing_rule WITHOUT registering the kinds — close the unvalidated
PUT /metawrite hole (#2657 audit, option A) #6245 caught it by hitting the failure, not by the gate reporting it.connectoris a plainz.object, so it silently stripped all seven keys —no 422, no gate finding, nothing. It needed a separate hand-written card
(finding:
ConnectorSchema容忍但不保留 ADR-0010 保护信封 —— package-load 的 connector 每次 round-trip 静默丢_packageId一族 #6362) and a hand-written probe to surface, roughly a day later.webhookhappened to be fine, but only because 未知键静默剥离仍是全仓默认:把 #3405 的 strict 收紧从一个 schema 推广到整个可授权面(ADR-0078 完整性闸门) #4001 batch 11 had given itthe spread for unrelated reasons. Nothing verified that; finding:
ConnectorSchema容忍但不保留 ADR-0010 保护信封 —— package-load 的 connector 每次 round-trip 静默丢_packageId一族 #6362 had to measureit by hand to find out, which is precisely what a gate is for.
So all three were judged one at a time, by hand, for a property the repo already
has an automated structural walker for.
Why this is observation-class, not a defect
Nothing a user hits today: as of PR #6900 all three bound kinds declare the
envelope, so the gap is currently empty of bugs. The exposure is prospective —
a fourth entry added to
UNREGISTERED_KIND_SCHEMASinherits the samesilence, and the next one may be non-strict too, in which case the failure is
again a silent strip rather than a 422.
Possible directions (deliberately not chosen here)
it.eachoverObject.keys(UNREGISTERED_KIND_SCHEMAS)asserting only the envelope-declaration property — without enrolling them
in
listMetadataTypeSchemaTypes(), so none of the other KIND obligations(create seeds,
MetadataTypeSchemamembership, the campaign count) attach andStudio metadata coverage gaps: surface remaining types + promote un-typed concepts #2657 stays unprejudged.
hand-listing it.
Direction 1 looks like the cheap one and appears to preserve every boundary
#6245 drew, but it is a decision about a contract surface's coverage rules, so
it should be triaged rather than assumed.
Refs: #6362 / PR #6900 (connector, the silent-strip case), #6245 (bound the three
doors; fixed sharing_rule's 422 case), #4001 batch 11 (webhook's spread),
#2657 (the open B/C kind-promotion decision), ADR-0010.