feat(lint): webhook without triggers fails at author time (ADR-0078 Phase 3) - #4565
Merged
Conversation
…hase 3)
A webhook that declares no `triggers` never fires on any path. It still
materializes into `sys_webhook` and still renders in Setup looking armed, so the
omission is invisible on every surface an author can see — the ADR-0078 shape.
## The first source argued AGAINST this rule
The runtime skip site reads:
if (triggers.size === 0) {
// No dispatchable triggers (or a manual-only webhook with none) —
// skip auto-enqueue.
return null;
That parenthetical blesses the empty case as a deliberate mode. It is
structurally identical to the `multiselect`-without-options NON-rule, where
`record-validator.ts`'s `// free-form (tags without options)` is precisely why
we do NOT flag it. On this evidence alone the candidate stays unenforced.
The mode it names does not exist. `webhook.zod.ts`'s #3196 note records that the
`api` (manual/programmatic fire) trigger was REMOVED because "no manual fire
path exists — the only webhook HTTP surface re-queues already-failed
deliveries". Nothing can fire a webhook the auto-enqueuer dropped. Inert on
every path, so: error, not a NON-rule.
The generalization is now in the module doc and pinned by a test: a runtime
comment records what its author BELIEVED, and beliefs go stale when a sibling
feature is deleted. A blessing needs corroboration that the blessed mode is
still reachable, or it is a comment about a mode that no longer exists. The test
asserts the finding carries both citations so nobody demotes the rule on the
comment alone.
`triggers: []` is flagged identically to an omitted `triggers`: unlike an
action's `locations: []` (the documented headless spelling), an empty array here
carries no "I meant it" signal, because a webhook's off switch is `isActive`.
The repo's one real webhook confirms the premise — `showcase_task_changed`
ships inactive via `isActive: false` with a full trigger list, and is clean.
## Phase 3's scope was mostly already closed
Verifying each Tier-B candidate before writing it — the discipline that caught
four false prescriptions in #4001 — found most of the audit's list already
handled or misfiled:
A2 action without `locations` already shipped (validate-action-locations,
which already exempts `locations: []`)
approval empty approvers already shipped (validate-approval-approvers)
select/multiselect options shipped in Phase 1
write-side FK integrity not an authoring-lint item (runtime gap)
`unique` on memory driver not an authoring-lint item (driver gap)
composite sub-field constraints not an authoring-lint item (runtime gap)
nav page/report/url/component genuine gap, but reference resolvability
(ADR-0072), not completeness — wrong module
dataset with zero measures UNVERIFIED, not shipped: no runtime consumer
in this repo
schedule trigger invalid cron UNVERIFIED, not shipped: normalizeSchedule
takes any non-empty string, scheduler
behaviour not traced
webhook without triggers this change
Two candidates are left unshipped rather than written on the audit's stated
confidence, and one is left to the module that owns it.
Verification: 24 predicate tests (19 -> 24) and 8 walk tests (7 -> 8); the one
real webhook in the repo produces no finding; full suite 132/132.
Tracked in #4544.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WnqGjQFQMqd5k81LYV8SCY
|
The latest updates on your projects. Learn more about Vercel for GitHub. 1 Skipped Deployment
|
os-zhuang
marked this pull request as ready for review
August 2, 2026 03:23
os-zhuang
enabled auto-merge
August 2, 2026 03:23
Contributor
📓 Docs Drift CheckThis PR changes 2 package(s): 107 hand-written doc(s) reference the affected code and may need an implementation-accuracy re-verification:
|
github-actions
Bot
added
documentation
akarma-synetal
pushed a commit
to akarma-synetal/framework
that referenced
this pull request
Aug 4, 2026
…ectstack-ai#4919) ADR-0078 的状态行仍写着「Proposed……核心机制未建(2026-07-16 审计)」, 而它所说「未建」的机制早已合并四次:共享谓词 packages/spec/src/kernel/functional-completeness.ts、作者期闸门 packages/lint/src/validate-functional-completeness.ts(在 authoring-rules.ts 里注册为 gating 层,error 级发现会让 os build/validate/lint 直接失败),以及 packages/objectql/src/registry.ts 里的注册期孪生诊断。一份说「没建」的 ADR 本身就是误导源:后来者要么重新立项,要么绕开一道已经承重的闸门。 状态词按仓内既有已落地 ADR 的写法改为 「Accepted — framework implemented; the cloud half of §2/§3 pending (cloud)」, 并且**没有**笼统标成全做完 —— 分阶段的 ADR 标「全完成」比标「未开始」更有害, 因为它会让人不再去查。逐阶段:Phase 1 ✅(objectstack-ai#4547)、Phase 2 🟡 只落地框架侧 (objectstack-ai#4577)、Phase 3 ✅ 在验证支持的范围内(objectstack-ai#4565)、Phase 4 ✅ 已裁决(objectstack-ai#4599); §2 的 cloud graph-lint 复用共享谓词仍未落地,单独标注为唯一会悄悄腐烂的开口。 正文一并更新:§2/§3/§4 加落地说明;新增决策 §6 —— 「一条规则只有带上让它成立的 那行运行时静默跳过点才能上线」,以及「运行时注释对空值的祝福必须另有证据证明该模式 仍可达」(webhook 跳过点祝福的 manual-only 模式已被 objectstack-ai#3196 删除)。Phase 4 的 生成式规则遍历记为**否决而非推迟**。两条推论(multiselect 无 options 的 NON-rule 等)在 scripts/adr-anchors.json 里锚定回实现文件。 仅文档;不发版。 Claude-Session: https://claude.ai/code/session_018iARDqtrhQgz6fVHDeDkbQ Co-authored-by: Claude <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Phase 3 of #4544. Builds on the Phase 1 predicate (#4547).
The rule
webhook/without-triggers, error, in the shared@objectstack/spec/kernelpredicate beside the Phase 1 rules, walked byvalidate-functional-completenessoverstack.webhooksin both collection spellings.A webhook with no
triggersnever fires on any path. It still materializes intosys_webhookand still renders in Setup looking armed — the omission is invisible on every surface an author can see.The first source argued against this rule
The runtime skip site reads:
That parenthetical blesses the empty case as a deliberate mode. It is structurally identical to the
multiselect-without-options NON-rule, whererecord-validator.ts's// free-form (tags without options)is precisely why we don't flag it. On this evidence alone, the candidate stays unenforced.The mode it names does not exist.
webhook.zod.ts's #3196 note records that theapi(manual/programmatic fire) trigger was removed because "no manual fire path exists — the only webhook HTTP surface re-queues already-failed deliveries". Nothing can fire a webhook the auto-enqueuer dropped. Inert on every path →error, not a NON-rule.The test asserts the finding carries both citations, so nobody demotes this rule on the strength of the comment alone.
triggers: []is flagged identically to an omittedtriggers— unlike an action'slocations: [](the documented headless spelling), an empty array here carries no "I meant it" signal, because a webhook's off switch isisActive. The repo's one real webhook confirms the premise:showcase_task_changedships inactive viaisActive: falsewith a full trigger list, and produces no finding.Phase 3's scope was mostly already closed
Verifying each Tier-B candidate before writing it — the discipline that caught four false prescriptions in #4001 — found most of the audit's list already handled or misfiled:
locationsvalidate-action-locations.ts, which already exempts the documentedlocations: []validate-approval-approvers.tsunique: trueno-op on memory drivernormalizeScheduletakes any non-empty string; scheduler behaviour not tracedTwo candidates are deliberately left unshipped rather than written on the audit's stated confidence, and one is left to the module that owns it. The audit's own lesson stands: it produces candidates, not confirmed bugs.
Verification
Generated by Claude Code