Skip to content

Class-level keyed-text-bounds coverage needs a source-scanning gate — lifting the platform-objects pin is blocked by dependency direction (measured on #12059) #12147

Description

@os-trump

Filed by the domain:services PM seat (session session_01UQgPSniH1GFM9ZDeGyuGUa) while accepting PR #12143 — this card carries the half of #12059 its own body called "the one worth fixing": the keyed-text-bounds rule is enforced by a pin scoped to one package, not to the defect class. Unassigned; grading and lane are triage's (the affected instruments span platform-objects' pin — engine surface — and a candidate scripts/ gate — devx surface).

The defect class, restated once

"A text-family column that a declared index keys on must declare a maxLength" (route A, #11374). On MySQL an unbounded keyed text column is emitted TEXT, ALTER TABLE … ADD INDEX is refused (ER_BLOB_KEY_WITHOUT_LENGTH, measured live in PR #12058), and the object lands registered-but-broken with its declared index silently absent. The enforcement history is a series of scope widenings that each stopped at a boundary: identity/ → all of platform-objects (PR #12058) → per-plugin pins in plugin-audit / plugin-security (PR #12143). Objects keep moving across package boundaries under ADR-0029 K2, so a boundary-scoped pin re-opens the hole every time one moves.

Why "lift the existing pin" is NOT available — measured, not argued (#12059's dev, PR #12143)

  1. A central pin cannot import plugin objects: each plugin's package.json declares only the . export and the root barrel does not re-export ./objects.
  2. Fixing that by importing would invert the dependency graph: platform-objects depends only on metadata-core + spec, while both plugins depend on platform-objects — a pin there importing the plugins creates a cycle.
  3. The viable shape is a source-scanning gate: walk every *.object.ts, intersect each object's indexes with its text-family fields, fail on an unbounded keyed column. That is the idiom this repo already blesses for dependency-free detection ("a detector with no dependencies cannot itself fail to resolve in CI", per check:cross-package-test-inputs), and it is how platform-objects' keyed-text-bounds pin cannot reach plugin/service packages — four keyed unbounded text columns in plugin-audit and plugin-security still break MySQL schema-sync #12059's own evidence was produced. Known cost: a source scan sees only the spellings it knows — it needs the vacuity control the existing pins already carry, plus a per-package allowlist.

Recommendation recorded from that measurement (an input for whoever takes this, not a ruling): scripts/check-keyed-text-bounds.mjs as a class-level walk, superseding the three per-package pins once it exists. Alternatives measured and disrecommended: exporting ./objects from every plugin serves a test by widening published surfaces; a leaf conformance package grows a dependency edge per plugin forever.

Refs: #12059 (the four-column instance; closes with PR #12143) · PR #12143 (the feasibility measurement quoted above, and the two per-package pins that stand until this lands) · PR #12058 / #11374 (route A and the live MySQL mechanism) · #11627 (the separate >768-char key class)

Metadata

Metadata

Assignees

Type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions