Skip to content

schema_check introspection query caps type nesting at 4 ofType levels; deeper wrapper types silently render as Unknown and report false mismatches #222

Description

@thedavidmeister

Unit

CLI schema-check subcommand (crates/cli/src/cli/schema_check.rs) — AMT group g5-interpretercallermeta-v1.

Intent oracle

fetch_live_entities_as_sdl doc: reduce a live introspection response to "a synthetic SDL document containing only entity Object types and their fields", used as the source of truth for drift detection against a consumer snapshot.

Observed behaviour

INTROSPECTION_QUERY hardcodes 4 levels of ofType nesting:

type { kind name ofType { kind name ofType { kind name ofType { kind name } } } }

render_type falls back to "Unknown" when the terminal named type is truncated away. Any field whose type uses more than 4 wrapper levels (e.g. [[Bytes!]!]! = NON_NULL LIST NON_NULL LIST NON_NULL SCALAR = 6 levels) renders as [Unknown...]-shaped SDL, producing a false "type mismatch" against a correct consumer snapshot.

Violated property

The introspection-derived SDL must faithfully reproduce every legal entity field type, or drift checking reports false positives.

Refutation evidence (recorded, not adjudicated)

The Graph's entity schema model does not allow nested lists; the deepest legal wrapper stack for a graph-node entity field is [X!]! = exactly 4 levels, which the query covers. Under that model the truncation is unreachable. However this subcommand is also pointed at Goldsky endpoints, and nothing in the code asserts the backend's type depth; standard introspection clients use 7–9 levels precisely to avoid this class of silent truncation.

Triage framing (neutral)

Either the 4-level assumption is a deliberate, safe reliance on graph-node's type model (in which case a comment pinning that assumption would make it auditable), or the query should nest to the conventional 7+ levels. Flagging; not adjudicating.

Metadata

Metadata

Assignees

No one assigned

    Labels

    adversarialFound by adversarial review/mutation testingauditAudit finding; counted by the org health scan

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions