GOV-ONT-003 — Make proposal impact authoritative
| Field | Value |
|---|---|
| Status | Open finding; source-verified; representative proposal pending |
| Severity | High |
| Components | sparqd/ontology, sparqd/oqullus |
| Associated issues | Not opened pending finding review |
Concrete observed case
For a destructive proposal, Oqullus reads the first page of main objects,
requests each returned definition, then reads every workbook and its tabs. It
calculates relationship and saved-query impact in the browser. Any failed read
sets impact to null, but merge remains enabled. Objects outside the first 50,
concurrent edits, and failed calls can therefore be absent without a visible
completeness guarantee.
Merge does block incoming Ontology relationships. Rename merge also scans and rewrites related objects and workbook tabs in one transaction. Those indirect changes are not represented as the original proposal's explicit change set, making complete review and version audit difficult.
Expected condition
The backend computes impact for the exact proposal revision, reports totals and completeness, validates again in the merge transaction, and records every direct and indirect mutation in the review/audit result. Product policy either blocks unresolved impact or requires an explicit audited override.
Why it matters
A reviewer can approve or merge without seeing affected relationships or workbooks, while downstream saved analysis changes as a side effect.
Existing controls and workarounds
Incoming relationship deletion is checked server-side and rename rewrites are transactional. There is no equivalent authoritative workbook-impact gate or proof that the browser preview is complete.
Alternatives considered
- Recommended: a revision-bound server impact endpoint reused by merge.
- Materialize dependency indexes for faster impact lookup while keeping the definitions authoritative.
- Improve only the browser scan — still stale, bypassable, and unsuitable as a governance control.
Component involvement
- Ontology backend computes, revalidates, and audits impact and side effects.
- Oqullus presents completeness, drift, overrides, and attributable failures.
Reproduction and verification
Follow ONT-S013.
Resolution conditions
Close when impact is complete beyond 50 objects, tied to the reviewed revision, fails closed or requires audited override, and every merge side effect appears in retained audit/version evidence.
Validation and blockers
The client-only computation and merge behavior are source-confirmed. A representative proposal/workbook fixture is absent from the deployed database.