Codebase review fix plan — specification-mapper (2026-07-16, execution map) #204

此內容由 AI 產生（specification-mapper 全庫審查 2026-07-16．執行圖）。

Whole-codebase thorough review of branch jakarta (snapshot 7de4a33; modules mapper/ + starter/; site/ and target/ out of scope). Build gate green (make test, 214 tests). 43 findings CONFIRMED under adversarial verification (2 REFUTED and dropped). This is an execution map: the sub-issues below are the work packages — every one born workable or honestly pending, hard dependencies wired as native blocked-by edges. Ask "what's next" against this issue using GitHub-native state alone (see How to work this plan).

Rerun note. A prior 2026-07-16 static fix plan already exists in this repo (issue 172, sub-issues 173–186) and is left untouched. Since that plan was filed, two of its packages shipped on jakarta: the reflective-construction-masking fix (COR-09/TEST-07, PR #189) and the concurrency/nested-AND test hardening (TEST-05/TEST-06, PR #187). This map is reconciled against jakarta HEAD: those shipped findings are excluded, so it carries 13 packages (the review's WP5 is fully resolved; WP10 is trimmed to its one surviving finding).

Summary

Top risks. (1) COR-01 — the starter unconditionally overrides every JPA repository's base class, so a consumer's soft-delete delete() can silently become a hard delete → data loss. (2) PERF-01 — @JoinFetch on a paged query forces Hibernate in-memory pagination → OOM on large tables. (3) COR-05/06/07/10/11 — join resolvers silently return wrong results on realistic misconfigurations, incl. page totals disagreeing with content. (4) COR-15/16 — first-position field-level @Or/@And silently ignored; the same annotation yields opposite SQL by declaration order. (5) SEC-01 — LIKE-family specs don't escape %/_ → scoping-filter bypass + cheap DoS. COR-01 and PERF-01 carry the most risk, and both need a design decision before anyone can act on them.

Report

Full review report (findings appendix, work-package rationale, verification log):
https://github.com/softleader/specification-mapper/blob/codebase-review-2026-07-16/codebase-review-2026-07-16.md

How to work this plan

• Next up: any open sub-issue wearing status: ready-for-agent with no open blocker, no assignee, and no linked open PR. Working alone, take the oldest; if you can genuinely run several workers at once, take as many of them as you can staff — the blocked-by edges already keep that set free of conflicts.
• Claim before starting: assign yourself; one worker, one package, one PR.
• Finish: open a PR whose description says Closes #<package>.
• Empty-handed? Name every group the open children fall into — a map in flight is normally a mixture, never one state: all closed → done, comment the merged-PR list here and ask a maintainer to close this issue (never close it yourself) · wearing status: pending-design-work → waiting on a plan · blocked → waiting on a merge · carrying an open PR → in review · assigned with no open PR → claimed, in progress, unless its previous PR closed unmerged, which makes it a stale claim: name it so a human can unassign it back onto the map · anything else → say what it is and what it wears.

Pending plans

Packages awaiting a design decision wear status: pending-design-work and carry no plan yet — whoever completes the plan swaps that label for status: ready-for-agent. List them here:
https://github.com/softleader/specification-mapper/issues?q=is%3Aissue+is%3Aopen+label%3A%22status%3A+pending-design-work%22