Codebase review fix plan — specification-mapper (2026-07-16)

Whole-codebase thorough review of branch jakarta (modules mapper/ + starter/; site/ and target/ out of scope). Build gate green (mvn test, 214 tests). 43 findings CONFIRMED under adversarial verification (2 REFUTED and dropped), packaged into 14 work packages below.

Scorecard

Top risks

1. COR-01 (high) — starter silently overrides every repository's base class → possible hard-delete data loss.
2. PERF-01 (high) — @JoinFetch + pagination forces Hibernate in-memory paging → OOM on large tables.
3. COR-05/06/07/10/11 (medium) — join resolvers silently return wrong results on realistic misconfigurations.
4. COR-15/16 (medium) — first-position field-level @Or/@And silently ignored; same annotation, opposite SQL by declaration order.
5. SEC-01 (medium) — LIKE-family specs don't escape %/_ wildcards → scoping-filter bypass + cheap DoS.

Work packages (recommended order)

Ordered: quick wins & high-severity first. Same-area packages (WP1/WP6 touch SpecMapperAutoConfiguration; WP13/WP14 touch domain/) run sequentially to avoid conflicts. Not flagged ready-for-agent — triage before build.

1. [WP1] Starter silently overrides every repository base class (data-loss risk) #173 — [WP1] Starter silently overrides every repository base class (data-loss risk)
2. [WP2] @JoinFetch on paged queries forces Hibernate in-memory pagination #174 — [WP2] @JoinFetch on paged queries forces Hibernate in-memory pagination
3. [WP13] Compound composition: first-position @Or/@And silently ignored (order-dependent boolean semantics) #175 — [WP13] Compound composition: first-position @Or/@and silently ignored (order-dependent boolean semantics)
4. [WP4] LIKE-family wildcard injection + unbounded IN expansion #176 — [WP4] LIKE-family wildcard injection + unbounded IN expansion
5. [WP5] Reflective spec construction masks TypeMismatchException + hidden context invariant #177 — [WP5] Reflective spec construction masks TypeMismatchException + hidden context invariant
6. [WP6] Starter auto-configuration robustness (fluent null-spec, BPP early-init, ordering, API parity) #178 — [WP6] Starter auto-configuration robustness (fluent null-spec, BPP early-init, ordering, API parity)
7. [WP14] Leaf-spec constructor validation & one-shot Iterable consumption #179 — [WP14] Leaf-spec constructor validation & one-shot Iterable consumption
8. [WP12] CI/CD supply-chain & gating: unpinned actions, auto-merge without in-repo build gate, dead branch guard #180 — [WP12] CI/CD supply-chain & gating: unpinned actions, auto-merge without in-repo build gate, dead branch guard
9. [WP3] Join machinery: silent-wrong-result edge cases + missing edge/error tests #181 — [WP3] Join machinery: silent-wrong-result edge cases + missing edge/error tests
10. [WP10] Mapper test-coverage gaps: concurrency, nested-AND typo, inherited fields #182 — [WP10] Mapper test-coverage gaps: concurrency, nested-AND typo, inherited fields
11. [WP11] Build config & dependency hygiene: unpinned plugins, no Maven update lane, EOL Boot line, jar build-info pollution #183 — [WP11] Build config & dependency hygiene: unpinned plugins, no Maven update lane, EOL Boot line, jar build-info pollution
12. [WP7] Mapper hot-path allocation: eager AST build + always-on DISTINCT #184 — [WP7] Mapper hot-path allocation: eager AST build + always-on DISTINCT
13. [WP8] Native-image / AOT: user-POJO hints uncovered + nativeTest never run in CI #185 — [WP8] Native-image / AOT: user-POJO hints uncovered + nativeTest never run in CI
14. [WP9] Dead Ordered/getOrder contract on custom resolvers #186 — [WP9] Dead Ordered/getOrder contract on custom resolvers

Report

Full review report: https://github.com/softleader/specification-mapper/blob/codebase-review-2026-07-16/codebase-review-2026-07-16.md