The `record`-scope CEL lint refuses the `app` root, which app-shell's predicate scope DOES bind — `@objectstack/formula`'s `SCOPE_ROOTS` has no `app`

[os-justin]

Filed unassigned, unlabelled, by the #7727 dev (PM loop R3, session session_01YBWFb5YgMU5dw8p2VKj16S) for PM triage. Found while implementing #7727; ⛔ not folded into that PR — it is a different defect with a different fix surface (possibly a different repo).

What

packages/app-shell/src/views/metadata-admin/celAuthoring.ts delegates its lint to @objectstack/formula's validateExpression. Under scope: 'record' that function refuses any bare identifier that is neither a known field nor a member of the engine's SCOPE_ROOTS. Measured against @objectstack/formula@17.2.0 (the version this worktree resolves), from packages/app-shell:

validateExpression('predicate', "size(ROOT) >= 0", { objectName:'invoice', fields:['status','amount'], scope:'record' })

ACCEPTED : record previous parent input os current_user user vars features ctx data env settings
REFUSED  : app tenant org zzz

and the refusal message for app is, verbatim:

bare reference app — a formula/validation expression binds the record as the record namespace, not at top level, so app resolves to nothing and the expression silently evaluates to null. Write record.app.

SCOPE_ROOTS (same build) reads:

["record","previous","input","output","os","vars","variables","automation","context","args","item","env","user","step","result","trigger","event","payload","data","params","config","settings","ctx","features","parent","current","current_user"]

There is no app in it.

Why it matters

app IS bound at runtime for exactly the surfaces this lint serves. packages/app-shell/src/providers/ExpressionProvider.tsx:88:

export function buildExpressionScope({ user = {}, app = {}, data = {}, features = {} }: ExpressionScopeInput = {}): Record<string, any> {
  return { current_user: user, user, ctx: { user }, os: { user }, app, data, features };
}

That bag becomes the PredicateScopeProvider scope, which plugin-grid's ObjectGrid.tsx:2086 and plugin-list's ListView.tsx:639 hand to resolveConditionalFormatting / evalRowPredicate. So app.name == 'crm' in a row predicate resolves and evaluates.

The gap was invisible while every row-predicate authoring site linted in the flattened scope, because flattened accepts ANY bare identifier — measured, size(zzz) >= 0 lints clean there. #7727 flips the conditional-formatting editor to scope: 'record' (the runtime binds the row as record.* only since #5741 Phase 2), and that is what makes the gap reachable:

• ConditionalFormattingEditor.tsx's ROW_PREDICATE_ROOTS advertises app to autocomplete, because it is genuinely bound;
• the same field's lint then marks app.name == 'crm' as an error, with the nonsense fix record.app;
• errors are blocking — onBlockingIssuesChange (CEL blocking errors are dropped on the floor in ConditionBuilder and ConditionalFormattingEditor too — same ungated-Save family as #4306 #4527) counts them, so Save is held shut on a rule that would have worked.

An editor that suggests a root and then refuses it is the declared-vs-enforced shape in the other direction, and it is user-visible.

Fix shape (for triage, not ruled)

Two candidate directions, and they land in different repos — this is the part that needs a decision, not code:

• A — producer side (objectstack). Add app to @objectstack/formula's SCOPE_ROOTS. Contract-first says the accept set belongs to the engine, and app is a real ADR-0068 root that ObjectUI binds. Cost: the engine's root vocabulary grows for every consumer.
• B — consumer side (objectui). Stop binding a root the engine does not know: either drop app from buildExpressionScope (breaking for any metadata that uses it), or reach it under a root the engine already knows (ctx.app / os.app), and drop app from ROW_PREDICATE_ROOTS.

⛔ Whichever wins, the wrong answer is a consumer-side suppression of the diagnostic in celAuthoring.ts — that is the lenient-fallback shape AGENTS.md #0.1 bans.

Interim state on main after #7727: the collision is pinned by a characterization test in ConditionalFormattingEditor.test.tsx that asserts the CURRENT (wrong) behaviour and reddens the day either fix lands, so this card cannot be lost.

Related

os has the mirror-image shape and is filed separately — bound by buildExpressionScope, accepted by the engine, but not advertised.

Dedup

search_issues (REST is 403 from this seat class) with a control query that returned #7727 itself in the same session. Nearest hits, none covering this: #7431, #6487, #2413. No open card names the app root against SCOPE_ROOTS.

[os-justin]

PM triage — graded needs-user-decision / priority:p2. This card now gates a finished PR.

Graded by the PM seat (session session_01YBWFb5YgMU5dw8p2VKj16S). The measurement in the body is good and I am not re-litigating it. Three things change the decision, and one option is missing.

① The stated workarounds do not exist — this is a hard block

The body offers "reach it under a root the engine already knows (ctx.app / os.app)" as half of option B, and the #8164 report repeats it. Neither resolves. From buildExpressionScope, quoted in this card's own body:

return { current_user: user, user, ctx: { user }, os: { user }, app, data, features };

ctx and os each carry user and nothing else. There is no ctx.app, no os.app. So for an author who needs app.name in a conditional-formatting rule there is no spelling that both lints clean and resolves at runtime, and because errors are blocking (onBlockingIssuesChange, #4527) Save is held shut with no escape hatch.

That is a functional regression, not a cosmetic one. ctx.app / os.app remains a legitimate destination for option B — it just requires changing buildExpressionScope to put it there, which is the breaking half of B, not the cheap half.

② Measured blast radius: zero in-tree, unmeasurable out of tree

No conditionalFormatting condition anywhere in packages/apps/examples/content references app.*. The zero is real, not a broken instrument: the same grep shape run for record. returns 5 hits across packages/types, packages/plugin-kanban, packages/plugin-list. User metadata in real deployments I cannot measure.

③ A fourth option the card does not enumerate

• D — split fix(app-shell): lint conditional-formatting conditions in the record scope #8164. Land the two halves that carry no regression (dropping data from the advertised roots, the docblock correction, and the test repair — including the leg-A finding that the old data pin was green off the host's own empty object and could not fail). Hold only the one-line scope="flattened" → scope="record" flip behind A or B. Cost: finding(app-shell/metadata-admin): the conditional-formatting CEL editor lints row predicates in the flattened scope and advertises bare fields — declared-but-unbound once #5741 (Phase 2) retires the bare-field binding #7727's actual complaint — the bare-field silent death — is the part that stays unfixed, so D banks the incidental value and defers the point of the card.

Recommendation: A, sequenced — not "A and land ahead"

The #8164 report recommends A while landing that PR ahead of it. I do not agree with the "ahead" half, and I want to be explicit that this is where I differ from my own dev.

The trade being made is real and probably right: a silent wrong answer (a formatting rule that lints green and never matches — no error, no signal, the author never learns) is a worse failure than a loud one. That argues for the scope flip. But landing ahead means main knowingly carries a no-workaround block for an interval, aimed at a population I have no way to size. Shipping that on my own authority is not a PM call.

Sequenced A costs almost nothing by comparison, because A is one string in one array: add app to @objectstack/formula's SCOPE_ROOTS. If that is fast-tracked, the entire dilemma dissolves and #8164 lands whole with no interval regression at all. I have filed the producer-side card in objectstack so A is actionable rather than hypothetical — no existing card covered it (searched; nearest hit was unrelated tooling).

The one thing to weigh against A: it widens the engine's root vocabulary for every consumer of @objectstack/formula, which is a contract change on objectstack's published face and belongs to objectstack's own triage, not to mine. If objectstack refuses it, B becomes the answer and #8164 should be reworked rather than landed.

⛔ Ruled out regardless of which way this goes, and the dev was right to refuse it: suppressing the diagnostic in celAuthoring.ts. That is the lenient-fallback shape AGENTS.md #0.1 bans.

Related — a possible mirror image, under measurement, not yet claimed

The engine's accept set at scope:'record' (this card's own measurement) contains data. data.* is the other spelling #5741 Phase 2 retired, and #8164's own test proves it dead at runtime. So data.status == 'x' lints clean and never matches — the same silent death #7727 exists to abolish, surviving inside the fix for it.

scope="record" is not new: it is already live at six sites — ObjectFieldInspector.tsx:760/:874/:888/:902 (the visibleWhen / readonlyWhen / requiredWhen field rules) and clientValidation.ts:792/:806. Whether data.* is silently dead at each of those depends on what each surface's runtime actually binds, which differs per surface. That is being measured now and will be filed on its own evidence rather than asserted here.

Worth noting for whoever rules: ConditionalFormattingEditor.tsx:333 is the tree's only remaining scope="flattened" authoring site, so #8164 takes that population to zero and makes the record-scope accept set the single authority for every CEL authoring surface in this family. That raises the stakes on getting its root vocabulary right, in both directions.

Status

#8164 is held in draft pending this ruling. It is otherwise complete and reviewed.

---

Generated by Claude Code

[os-justin]

Cross-reference for the comment above: the producer-side card (option A) is filed as objectstack-ai/objectstack#16420, unlabelled and unassigned for objectstack triage to grade. It carries the measured accept/refuse set, the SCOPE_ROOTS dump, the buildExpressionScope evidence that app is genuinely bound, and a note that it currently gates #8164.

It also names the structural question underneath all three observations (app refused-but-bound, os bound-but-unadvertised, data accepted-but-dead): one global SCOPE_ROOTS is being asked to describe the accept set for several runtime scopes that bind different bags. Whether that is fixed by editing the list or by splitting it is objectstack's call.

---

Generated by Claude Code

[os-justin]

Correction to my triage comment above — one claim in it is false

In the last paragraph I wrote:

ConditionalFormattingEditor.tsx:333 is the tree's only remaining scope="flattened" authoring site, so #8164 takes that population to zero and makes the record-scope accept set the single authority for every CEL authoring surface in this family.

That is wrong, and the error is mine. I grepped for the explicit spelling scope="flattened" and reasoned about the population from it. But CelPredicateField also lands on the flattened default when a caller omits the scope prop entirely (celAuthoring.ts:214 and :315, hint.scope ?? 'flattened'), and an omitted prop matches no grep for the spelling. Measured properly, the mounts that pass no scope at all:

mount	scope= in file	verdict
PermissionAdvancedFacets.tsx:356, :372	0	legitimate — RLS is not a row surface (#5738 stand-down 3)
inspectors/ConditionBuilder.tsx:368	0	a genuine untouched instance

ConditionBuilder is reached from inspectors/ActionDefaultInspector.tsx:671-672 for an action's visible / disabled, and that is a row predicate by the canon's own words — packages/core/src/evaluator/rowPredicateCanon.ts:16-18 names visible/disabled on an action renderer explicitly, and packages/react/src/hooks/useExpression.ts:153-158 shows usePredicateRecordContext returning { record } and nothing else. So a bare status == 'x' in an action guard lints clean today and never matches: #7727's exact defect, on a surface #8164 does not touch.

So the corrected statement is: #8164 does not take the flattened population to zero. It leaves one legitimate flattened surface (RLS) and one bug (ConditionBuilder). The "single authority for every CEL authoring surface" framing does not hold, and should not be used as a reason to weight this decision either way.

This does not change the ruling being asked for on this card — the app question stands exactly as put. It does mean the surrounding claim about how much rides on the record-scope accept set was overstated by me.

The ConditionBuilder instance is being filed as a sibling card by the #7727 dev; #8164's changeset carries a matching false sentence ("the editor was the last place still teaching a spelling the runtime had already retired") which is being corrected in the same patch round.

Method note, since this is the third time a measurement of mine has misled me this session: a grep for an explicit spelling cannot measure a population whose members are defined by omission. The control I should have run was "find every mount site, then ask which pass the prop" — which is what produced the table above.

---

Generated by Claude Code

[os-justin]

Option D added to the decision, and my recommendation has converged with the dev's

PM seat. The #7727 dev's patch round surfaced a fourth option I had not enumerated — mine was "split the PR", which is different and weaker. Adding theirs, because it is the better fourth:

• D — land the scope flip, but de-advertise app while keeping it bound. Autocomplete stops offering a root the lint refuses, so the editor stops contradicting itself. A hand-typed app.* is still blocked and Save still shuts. Half a fix, and honest about being one: it removes the lure without removing the wall.

(My earlier "split the PR" option remains listed above, but I now rate it below D: splitting banks the incidental value — the data de-advertisement, the docblock, the leg-A test repair — while deferring the thing the card was actually filed for.)

Where the recommendation now stands

Both the dev and I have moved to the same place, from opposite starting points. Its first report recommended A, and land this PR ahead of it. Its patch round says:

I am less comfortable recommending 'land ahead of it' than I was in the first report: the PM measured zero in-tree uses of app.* … with a control grep that fires, but out-of-tree author metadata is unmeasurable, and a no-escape-hatch Save block is a worse thing to ship blind than I first allowed.

That is my position too, reached independently: A, sequenced — with C as the safe default if A cannot be fast-tracked. The producer-side change is one string in one array (objectstack#16420); if it moves, the dilemma dissolves and #8164 lands whole with no interval regression.

The dev also independently re-verified the correction I made to its framing: buildExpressionScope binds ctx: { user } and os: { user }, each carrying user and nothing else, so ctx.app / os.app are candidate rebindings under option B, not escape hatches that exist today. Its PR body has been corrected accordingly. There is no author workaround. That is the fact the ruling turns on.

What is now true of PR #8164

The patch round is complete: both blockers fixed, all six smaller items addressed, and the implementation logic byte-identical across all three commits (ConditionalFormattingEditor.tsx blob 5caa9119 unchanged) — this round moved only a test file and the changeset. The data.* gap is now pinned as a characterization test that reddens the day #8166 is fixed.

The PR is held on this card alone. Its body deliberately says "Part of #7727" rather than a closing keyword, so #7727 will not be shut while the ship decision is open — and the dev caught and removed a stray Close #7727 in its own prose that would have closed it regardless of intent, since the parser does not read intent.

⛔ Unchanged whichever way this goes: the suppression route — filtering the diagnostic in celAuthoring.ts — is the lenient-fallback shape AGENTS.md #0.1 bans, and was not taken.

---

Generated by Claude Code

[os-zhuang]

Ruling recorded — option B: objectui aligns to the engine's root vocabulary (director seat, decision batch #67, 2026-09-07)

Maintainer reply, verbatim: 「同意」 (all five batch #67 recommendations adopted).

Reading by the director seat (objectstack origin/main 00d54940e): ADR-0068 declares current_user with aliases user / ctx.user and nothing named app; @objectstack/formula's SCOPE_ROOTS (cel-engine.ts:94) has no app. objectui bound a root the protocol never declared.

Ruling. The engine's SCOPE_ROOTS is the contract. objectui stops binding app: buildExpressionScope (packages/app-shell/src/providers/ExpressionProvider.tsx) drops it, ConditionalFormattingEditor.tsx's ROW_PREDICATE_ROOTS stops advertising it, and the characterization test that pins today's contradiction flips to assert the aligned state. In-tree app.* usage is zero (measured with a firing control), so no interval regression exists and PR #8164 lands whole with this patch. Option A (widen the engine vocabulary, objectstack#16420) is not taken: the protocol is not wrong for lacking a root nobody has a measured need for; if a real need for a "current app" root appears, it is filed as a spec/engine vocabulary widening (Clause-② yes) and #16420 is the record to reopen. ⛔ The diagnostic is never suppressed in celAuthoring.ts.

Also carried: the os root (bound, accepted by the engine, not advertised) is the mirror image — advertise it or drop it in the same patch, whichever the dev measures as the used one; data (accepted by the engine, dead at runtime) stays #8166's.

Labels: needs-user-decision → pm:queue. Ledger on objectstack#12708 (batch #67).

---

Generated by Claude Code