Skip to content

Parked after 0.2.0: follow-up proposal for Object-member requirement paths, and two documented known gaps #8

Open

Description

@lzrscg

Parked at the 0.2.0 release (IP 0001, #7). Nothing here is scheduled: the follow-up proposal is approved but not started, and enters the process later through its normal intake; the two documented gaps have no follow-up planned.

1. Follow-up proposal (approved draft, not started)

0002-object-member-paths: Improvement Proposal; Stage: Proposed

  • Motivation. SPEC 4.1 makes a missing requirement path a TypeScript type error against the generated module, and 14.7 repeats this for spellings without escape sequences. TypeScript cannot honour this when the path reaches a member of its global Object interface (constructor, toString, toLocaleString, valueOf, hasOwnProperty, isPrototypeOf, propertyIsEnumerable) and no section of that name exists. Every object type inherits Object's members, so TypeScript resolves the access to the inherited member, and it keeps resolving through that member's own type (SPEC.toString.call). In bracket form (SPEC.a["toString"]) no generated typing can make TypeScript report it at all. This was accepted as a known residual of IP 0001 (Developer, 2026-10-22). xspec's own unknown-TypeScript-reference finding (14.7) already reports every such path, so build and check still catch the reference.
  • Proposed SPEC.md change. One sentence in 4.1 that covers both 4.1's type-error rule and 14.7's type-error clause: neither requires a type error for a path whose first segment that names no section is one of those seven names, in dot or bracket form, whatever follows it. The 14.7 finding stays required for every such path.
  • Non-goals. No rejecting or blacklisting of these names (1.4 already rules out constructor as a segment; the other six remain valid segments). No new finding and no exit-code change. No change to which paths resolve.
  • Archival. Developer, 2026-10-22, verbatim: "to be clear, dont implement the blacklist or tests for the blacklist now. just accept the error as is and we will add the sentence to the spec and implement later through the official process"

Paths that continue past one of the seven names

The residual as first recorded covered paths whose last segment is such a member. TypeScript also accepts paths that continue past one. Checked with TypeScript 5.9.3 (tsc --noEmit --strict) against a module the product built at 6caa3ba:

  • No type error: SPEC.toString.call;, SPEC.constructor.name;, SPEC.a.valueOf.length;, SPEC.a.hasOwnProperty.bind;
  • Still an error: SPEC.nope;, SPEC.toString.nope;, text(SPEC.toString.call), text(SPEC.a.toString)
  • xspec's own 14.7 finding reports all four of the first group: build --json exits 1 with four unknown-ts-reference findings.

The cause is the same, and the draft's exemption ("whatever follows it") covers these paths. For the 0.2.0 release they count as part of this accepted residual (Developer), not as a new gap.

2. Documented known gaps (no follow-up planned)

Both are recorded in AGENTS.md and were accepted for IP 0001's run.

  • 14.20 syntax-failure locations. For a few constructed MDX shapes, the location xspec reports for a 14.20 syntax failure differs from the offset that SPEC 14's location rule fixes. The failure itself is still reported; only its position is off. These were found only by constructed probes, batteries and fuzzing. The recorded shapes are:
    • a run past a probe's 256-character reach;
    • an end of file inside a text tag at a paragraph's end;
    • a spread attribute beginning a line inside a text tag;
    • a brace line below a paragraph line holding an open text expression;
    • a text expression open at an ATX heading's end.
  • SPEC 6.5: import removals joined by automatic semicolon insertion. SPEC 6.5 deletes a TypeScript import declaration in place and drops the line it leaves empty. It names no refusal reason for a removal that joins two top-level statements through automatic semicolon insertion. That happens when the import stands between a statement lacking a terminating ; and a line opening with /, (, [, `, + or -, in a file needing no import addition, such as one already importing the target module. The joined text then either:
    • fails to parse, so the product refuses the move through its post-move re-validation (14.20) and modifies nothing, although 6.5 says a successful move's finishing regeneration cannot fail; or
    • parses with a changed meaning that nothing detects (a joined line opening with ( or [ continues the previous expression).

Generated by Claude Code

Activity

  1. lzrscg commented on Oct 31, 2026

    @lzrscg
    ContributorAuthor

    Parked at the 0.3.0 release (IP 0002, #9)

    IP 0002 made the configuration's defineConfig import independent of a package name and added the defineConfig module to the interface (SPEC 7, 7.6). These items were set aside during its run. None of them is scheduled: each enters the process later through its normal intake, if at all. The three accepted residuals recorded above stay as they are.

    1. Limits on checking that xspec never resolves the configuration's import

    Two limits on how the harness checks this promise were accepted for this patch (Liaison, 2026-10-29). No follow-up is scheduled.

    • Nothing verifies that the read traps of T7-9(c), T7-9(d) and T7-10(d) (FIFOs, refused files, the trap package) sit where reading or resolving the specifier would land.
    • T7-9(a)'s four fixed spellings (a hexadecimal escape, a line continuation, 'xspec', and a raw U+FFFD) are checked only through P-19's certified draws.

    Cheap closing route: TEST-SPEC.md self-tests that run a stand-in reader against those stagings, as S-10 does for 7.6's observations, and that confirm the four spellings reach the staged configuration byte for byte.

    Three optional items from the certification review (its iteration 3), left unapplied when that refinement closed, go with them:

    • O1. CERTIFICATIONS.md says T7-9(a)'s four arms ride CONF-IMPORT's certification. State the residual outright instead.
    • O2. A dangling participle in VIOL-IMPORT-SINGLE's expected failures.
    • O3. The two violators' error path should follow SPEC 14's anchoring form, not a literal xspec.config.ts.

    2. Harness coverage gaps found while the product was built

    The product's behavior was checked by hand both times. No follow-up is scheduled.

    • No test installs the package under the name node_modules, though SPEC 7.6 covers any name.
    • No test checks that a non-literal specifier (an identifier, a template literal, a parenthesized string) is a configuration error.

    3. Test-plan improvements judged sound and left for later

    A reviewer judged these two sound during the TEST-SPEC.md refinement (O2 and O3 of its iteration-6 review), and they were left for later rather than applied. No follow-up is scheduled.

    • The Node.js environment for consumer programs (H-1, H-2). For Node.js, H-1 names only "no NODE_PATH and a fresh HOME". A preload, hook, loader or user condition inherited through NODE_OPTIONS could make the product's package resolvable by name, and a runtime dependency that SPEC 13.1 forbids would then pass T13.1-2. The fix is to apply T7.6-6's run rule to consumer programs and have H-1 verify it: no option, no NODE_OPTIONS or NODE_PATH, no user condition, and no loader or customization hook.
    • S-3's grounding for "unopened". The FIFOs in T7.6-7(b) and (e) rest on 7.6's runtime clause (no filesystem read outside the package), which S-3's citation "(7, 13.4, 13.5)" leaves out. An edit should not extend S-3's "never examining it" to 7.6, because 7.6's "filesystem read" may also cover checking a file's kind.

    4. Proposal: keep E-1's pinned Node.js releases current

    TEST-SPEC E-1 lists the Node.js releases the harness loads the defineConfig module on, by exact version under the Developer's rule of 2026-10-29: test/node-releases.json holds 22.0.0, 22.11.0, 22.12.0, 22.23.4, 24.22.2 and 26.13.0. Proposal: keep that list current through the normal change process as Node.js ships new releases. No follow-up is scheduled.

    5. Proposal (security-relevant, unverified): the compile cache's location

    This predates IP 0002. xspec enables Node's compile cache, which lives in the shared OS temp directory. On a multi-user machine, another user who controls that directory might plant cache entries. Proposal: investigate, and if it is confirmed, keep the cache in a per-user location or turn it off. No follow-up is scheduled.


    Generated by Claude Code

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions