finding(types): `MarkdownSchema.sanitize` and `.components` are declared and mirrored but read by no renderer — and `sanitize` implies a switch that does not exist

[claude]

Measured on main = 8f1d995ef447 while converging MarkdownSchema for #6172.

The fact

MarkdownSchema declares two members that no renderer reads:

member	declared at	read by
sanitize?: boolean (@default true)	packages/types/src/data-display.ts	nothing
components?: Record<string, any>	same	nothing

The Zod mirror carries both as well (packages/types/src/zod/data-display.zod.ts).

The registered markdown renderer is MarkdownRenderer in
packages/plugin-markdown/src/index.tsx. It forwards exactly two values to the
implementation — content and className:

LazyMarkdown content={schema.content || ''} className={schema.className}

MarkdownImplProps accepts only those two. Nothing anywhere destructures or
indexes schema.sanitize or schema.components.

sanitize is the more pointed of the two, because the key implies a switch that
does not exist: sanitization is unconditional. rehypeSanitize is a fixed
link in the rehype chain in MarkdownImpl.tsx, documented there as "the final
gate". Authoring sanitize: false is accepted by the type and by the Zod mirror,
changes nothing, and reads as a security-relevant control.

Why it is worth a card

ADR-0049 enforce-or-remove: declared = enforced. This is the same class as #6942
(TextSchema.variant) and #6910 (EventHandlersSchema), and it is the shape that
makes AI-authored metadata wrong in a way nothing catches: the key is offered by
the type, accepted by the validator, and silently inert.

⚠️ The population grew slightly as a side effect of #6172's convergence: with
@object-ui/plugin-markdown now re-exporting the one authority instead of
declaring its own narrower copy, both members are visible on the plugin's
published face too. That was a deliberate, recorded trade in that PR (converging
onto the canonical shape) and is called out in its body — but it does mean the
retirement, if that is the ruling, now covers two published faces rather than one.

Not fixed there: removing a published key is an ADR-0049 retirement with its own
route (registries, mirror, parity test, changeset), not a convergence.

Reproduce

grep -rn "sanitize\|components" packages/plugin-markdown/src/index.tsx packages/plugin-markdown/src/MarkdownImpl.tsx
grep -rn "schema.sanitize\|schema.components" packages/ apps/ --include=*.ts --include=*.tsx

Refs: #6172 (where this was measured), #6942 / #6910 (same class).

---

Generated by Claude Code

[huangyiirene]

Triage — first touch. Graded bug·pm:queue·priority:p2·domain:spec. Re-verified on e30ed155cb71, 03:44Z (card measured 8f1d995ef447).

Every claim reproduces

claim	today
sanitize?: boolean declared	✅ packages/types/src/data-display.ts:1167
components?: Record<string, any> declared	✅ :1171
zod mirror carries both	✅ zod/data-display.zod.ts:292 / :293
renderer forwards only two values	✅ MarkdownImpl({ content, className }: MarkdownImplProps) @ MarkdownImpl.tsx:196
zero readers	✅ 0, against a control of 27 files reading schema.content in the same query shape

⭐ "Sanitization is unconditional" — checked as control flow, not as a grep hit

A single grep line naming rehypeSanitize would not have settled this; a plugin can be conditionally included. It is not. rehypePlugins is a module-level const array (:99–:107), built once with [rehypeSanitize, sanitizeSchema] as its last link, and handed straight to ReactMarkdown at :226. No ternary, no if, no runtime assembly.

⇒ There is no code path on which sanitize: false could disable anything. The key type-checks, passes zod validation, and is inert.

Why p2 rather than the usual p3 for an inert key

⚠️ The failure is fail-safe — nothing is currently exploitable, since the un-disableable behaviour is the safe one. That is why this is not p1.

But it is a declared, validated, security-shaped control that does not exist, on a surface whose whole point is AI-authored metadata. Both readings of it mislead: an author writing sanitize: false believes they turned XSS filtering off, and an author writing sanitize: true believes they turned it on. Neither is true. A key that lies about a security gate is worth more than the ordinary inert-key p3.

⭐ The two keys do NOT have the same disposition — and that is the useful output

The card treats them as one population. Under ADR-0049 enforce-or-remove they diverge:

• sanitize — the enforce arm means building a real switch that disables XSS sanitization. ⛔ That is not an acceptable outcome. So for this key enforce-or-remove collapses to remove, which makes it dispatchable rather than decision-shaped.
• components — a conventional renderer-override extension point that simply was never wired. Both arms are genuinely open here, and wiring it is a plausible feature rather than a hazard.

⛔ Not splitting the card. Same file, same mirror, same retirement route, same lane — two cards would cost more than the shared context is worth. Recording the asymmetry is enough for whoever takes it.

Lane

domain:spec, not ui: the declaration and its mirror both live in packages/types, which the objectui three-stream split assigns to the contract face, and removing a key changes accept/reject behaviour ⇒ Clause ② at dispatch. Same routing as its siblings #6910 and #6942.

⚠️ Carried forward from the card and ⛔ not re-measured by me: #6172's convergence means the retirement now covers two published faces, since @object-ui/plugin-markdown re-exports the canonical shape rather than declaring a narrower copy.

---

Generated by Claude Code

[os-justin]

Claim: PM loop round R1
Session: session_01BAZFhALsQsGqxui8sNqM8s
Branch: claude/issue-6972-markdown-inert-keys-retire
Worktree: objectui-issue-6972
Domain: domain:spec
File surface (region level): packages/types/src/data-display.ts — the MarkdownSchema interface only (sanitize / components at :1164–1171) · packages/types/src/zod/data-display.zod.ts — the MarkdownSchema mirror only (:292–293) · packages/types/src/zod/tombstone.zod.ts — read only (reuse retirementTombstone / handlerKeyRefusal; a new helper, if one is truly needed, goes below retirementTombstone, ⛔ never inside the handlerKeyRefusal region, which #6854 owns this batch) · packages/types/src/__tests__/ — one new refusal pin; zod-mirror-parity.test.ts only if the ledger needs a row · packages/plugin-markdown/src/types.ts — the re-exported authority (expected read-only; measure) · the markdown docs page under content/docs/components/** · .changeset/* (stop on breach; explain in the report)
Container & model: M, mode:subagent, model: fable = CONTRACT_REVIEW_TIER — two declared keys become refusals on two published faces (@object-ui/types and @object-ui/plugin-markdown's re-export); objectui has no dispatch-gates.mjs, tier judged from card content
Clause-②: yes
Serial constraints cleared (file granularity per the maintainer ruling recorded at #5734 comment 5551274423): the #7122 chain holds packages/types/src/{field-types,form,objectql,select-option,index}.ts, zod/{form,index}.zod.ts and the __tests__ files named on its claim — none of this card's regions; #7701 already landed the DrillDownConfig mirror in data-display.zod.ts, a different region · #6854 (dispatched this batch) owns zod/app.zod.ts and the handlerKeyRefusal region of tombstone.zod.ts plus packages/runner/** — this card reads tombstone.zod.ts and does not edit that region · #6939 (domain:ui) has all eight groups on main, nothing in flight · the dev merges origin/main before opening the PR and again after any sibling lands; conflicts go to the merge queue

---

Disposition executed, and where each half's authority comes from

• sanitize — remove. Triage (5535325734) collapsed enforce-or-remove for this key: the enforce arm is a switch that disables XSS sanitisation, which is not an acceptable outcome. Verified at claim on origin/main 4ce14f1: rehypePlugins is a module-level const with rehypeSanitize as its last link, no conditional path; zero readers of schema.sanitize against a control of 19 files reading schema.content. Retire as an ADR-0049 tombstone on both faces (type member removed; zod face refuses the key by name with guidance that sanitisation is unconditional).
• components — remove, by this seat's discretion under a declared veto window. Triage left both arms open. This seat's reading: a Record<string, any> of React component overrides is not a JSON-authorable value — it is the same shape as the handler keys objectui#6124 retired ("JSON has no function value"), so it folds into that already-ruled refusal class rather than needing a fresh decision (zero readers, zero pull, a permanent obligation if kept). Four axes: long-term — one fewer declared-but-inert member on a published schema; pull — none measured; AI-error — a declared key that does nothing is the silent failure ADR-0049 exists to end; startup focus — remove over declare-and-maintain. Falsifiable premise for the dev: if any host path (props, plugin API, a MarkdownImpl prop) actually consumes a components map, or if a runtime-slot disposition (TS twin stays callable for hosts) is the honest shape, stop on that half and report the fork — do not silently pick. The maintainer may veto this half on the card; the PR stays draft until in-seat contract review.

Route: both faces of @object-ui/types; @object-ui/plugin-markdown re-exports MarkdownSchema from ./types (measure whether that is a local declaration or a re-export of the authority — #6172 converged it); docs rows removed; a refusal pin asserting the refusal and the guidance text; changeset per the repo's tombstone precedents (feat(types)!: retirements #7639 / #7669 today, minor under the launch-window convention — the dev reads those PRs' changesets rather than inferring).

---

Generated by Claude Code