Check item version ownership at effective paths

This commit is contained in:
2026-10-20 00:22:43 +00:00
parent 1c79ec3aa1
commit 38fb315415
3 changed files with 75 additions and 5 deletions

View File

@@ -1,6 +1,6 @@
# Import Discovery and Scheduling Review Findings
Status: in progress; issue 1 complete, five findings remain.
Status: in progress; issues 1–2 complete, four findings remain.
Reviewed implementation: `aa93aed..15943e2`, ending at
`15943e233ca3cd1286c03c0e7085871db344cd4b`, against the accepted
@@ -57,7 +57,7 @@ source contexts, repeated paths, and distinct alias admission. The regression
failed before the fix. Focused discovery/resource tests and `./scripts/check.sh`
passed with Go 1.26.9 and offline dependency selection.
## 2. [ ] P1 — Scope main-version protection to the actual effective path
## 2. [x] P1 — Scope main-version protection to the actual effective path
Owner: [composePendingItems](../../internal/engine/imports.go), around lines
694–695, and its call to `importedVersionClaim`.
@@ -85,6 +85,13 @@ the effective paths really overlap. Cover imported/nested items, item helpers,
main-item loading, underlays, and enabled source-version modes without adding
blanket exemptions or banning ordinary domain version fields.
Completed: removed the global-rule check against item-local field names; enclosing
composition checks retain effective-path protection, including the existing
main-item scoped check. New public regressions cover item bodies, helpers, nested
items, underlays, and selected main items, and failed before the change. The
full everyday check passed, including existing default/enabled source-version
and assigned-index ownership regressions.
## 3. [ ] P2 — Accept valid multi-component native filesystem roots
Owner: [resolveNativeImportPath](../../internal/engine/filesystem_links.go),