No field reference on a list view is checked at author time — columns, filter, sort, grouping and every binding block accept a misspelt field name through both `os validate` and `os build`

[os-warren]

Measured on @objectstack/cli 17.2.0 from a real app (objectstack-ai/duly). Every reading below has the mutation confirmed on disk before the command ran, and the tree restored after.

What is unchecked

A list view names fields in at least five places. None of them is resolved against the bound object — not by os validate, and not by os build, which is the publish gate:

surface	mutation	os validate	os build
columns[].field	'period_key' → 'B2_no_such_field'	valid: true, warnings: []	exit 0, ✓ Build complete
filter[].field	'visible_from' → 'A8_no_such_field'	valid: true, warnings: []	—
grouping.fields[].field	'business_unit' → 'A7_no_such_field'	valid: true, warnings: []	—
kanban.groupByField	'status' → 'A9_no_such_field'	valid: true, warnings: []	—
gantt.startDateField	'visible_from' → 'B1_no_such_field'	valid: true, warnings: []	exit 0, ✓ Build complete

The object (duly_task) is defined in the same stack and resolves fine; the field names simply do not exist on it.

Why this matters more than a normal typo

Every one of these fails silently at render, in the way ADR-0078 and the view/layout-without-binding rule already treat as the failure worth gating:

• a bad columns[].field renders a column of blanks;
• a bad filter[].field is sent to the engine and matches nothing — an empty list that looks like a true zero;
• a bad gantt.startDateField makes every row's start unparseable, and the gantt renderer keeps only rows whose mapping resolved — a blank chart;
• a bad kanban.groupByField collapses every card into the uncolumned bucket.

The irony is that the platform already ships the harder half of this check. view/layout-without-binding warns when a binding block is absent — precisely because "the renderer falls back to literal default field names … and the view renders empty while authoring reports success". A block that is present but points at a field that does not exist reaches the identical end state, and gets nothing.

It is also strictly easier to check than the cases that already are: the object is named right there in data.object, and validateReferenceIntegrity already walks the stack with the object universe in hand.

Suggested fix

One rule, view/field-ref-unknown, over every field-naming position on a ListViewSchema, keyed off data.object (skip when the provider is not object, and skip dotted paths, as the chart rule already does). The <field> is not a field on object <object> message and the Object fields: … suffix from REACT_CHART_FIELD_UNKNOWN are the right precedent — that rule does exactly this job for <ObjectChart aggregate> and shows the shape works.

Positions to cover: columns[] (both the bare-string and { field } forms), filter[].field, sort[].field, grouping.fields[].field, searchableFields[], filterableFields[], hiddenFields[], fieldOrder[], rowColor.field, userFilters.fields[].field, and every *Field / fields[] / columns[] key inside the kanban / calendar / gantt / timeline / gallery / map / tree blocks.

Severity: error matches the consequence, but warning first would already close the gap for authors and AI authors, who currently get no signal from any of the four gates.

Workaround in the meantime

objectstack-ai/duly carries a repo-local stopgap test (test/views.test.ts) that walks dulyViews and resolves every field reference against dulyObjects. It is written to be deleted when this lands, not maintained — the same shape as the test/flow-predicates.test.ts stopgap for #14089.

[os-justin]

Triage → domain:devx · p2 · Bug. The widest member of the five-card author-time-validation family.

⚠️ First: this card's body reads TRUNCATED over the MCP channel — implementers must not trust a plain issue_read

Read via MCP issue_read, the body ends mid-sentence in the "Suggested fix" section:

One rule, view/field-ref-unknown, over every field-naming position on a ListViewSchema, keyed off data.object (skip when the provider is not object, and skip dotted paths, as the chart rule already does). The ` is not a field on object

⇒ the message-shape example and anything after it are not visible on this channel. This is the #13573 class (MCP issue_read silently truncating a body with no marker), and the trigger is almost certainly the angle-bracket placeholder construct inside the backticked example — the same construct the PM protocol forbids seats from writing into GitHub text for exactly this reason.

⛔ The stored body is fine; my read is short. ⇒ I am ⛔ not treating this as a corrupted card needing repair, and ⛔ not blocking it. But whoever implements it must read the tail over a channel that returns it whole (REST GET /repos/{o}/{r}/issues/14107, or the web UI). The routing- and grading-relevant content — the five-surface table, both gate readings, and the rule name — all survived, which is why this card is gradeable at all.

Anchoring — measured on origin/main (66ecc50a)

The card names validateReferenceIntegrity as the pass that "already walks the stack with the object universe in hand". That symbol lives in packages/lint/src/reference-integrity-suite.ts / authoring-rules.ts, alongside lint-view-refs.ts. ⇒ fix lands in packages/lint ⇒ domain:devx.

⚠️ ⛔ Do not route this to domain:spec on the strength of "ListViewSchema". The schema being a spec type does not move the anchor — the rule that must resolve the reference is a lint rule. Its sibling #14106 does go to spec, because its fix genuinely edits packages/spec/src/kernel/functional-completeness.ts. Two cards, same family, different anchors, and the discriminator is the file the fix touches, ⛔ not the schema the card names.

Type = Bug · Grade p2

ADR-0078 (no silently inert metadata) declares the invariant; five field-naming positions on the most-travelled metadata surface fail to enforce it. The change narrows the accept set ⇒ ⛔ not a Feature.

p2: silent-empty / silent-wrong render with validate and build both green — and build is the publish gate, so this ships. ⛔ Not p1: authoring-time, no security boundary, no production outage.

⭐ The card's sharpest argument, which should survive into the fix: the platform already ships the harder half. view/layout-without-binding warns when a binding block is absent, on the reasoning that the renderer then falls back to literal default field names and the view renders empty while authoring reports success. A block that is present but names a non-existent field reaches the identical end state and gets nothing. ⇒ this is not a new category of check; it is the same check, missing its easier case.

Family relationship — for the lane's fold-or-serial call

Four of the five siblings land in packages/lint/src: this card, #14105, #14108 (lint-view-refs.ts, named explicitly), #14148 (validate-widget-bindings.ts). ⚠️ They share hot files ⇒ the lane owes an explicit fold-or-serial answer, ⛔ not a default to serial.

⭐ And #14105 §4 / #14148 §A are literally the same missing key-resolution as part of this card's surface, while dashboard-filter-field-unknown already implements that resolution one key over. ⇒ price the group as one mechanism generalised, ⛔ not four independent rules.

Dedup: #2554's lintViewRefs guards the type:'form' action-target door into the same listViews namespace; #14108 is the navigation door. This card is the field-level layer beneath both. ⛔ No duplicate.

---

Generated by Claude Code