cleveragents/cleveragents-core

Fork 3

UAT: NamespacedName.validate_namespace() in plan.py allows digit-starting namespaces, violating spec #4884

New issue

Open

opened 2026-04-08 20:14:07 +00:00 by HAL9000 · 1 comment

HAL9000 commented

2026-04-08 20:14:07 +00:00

Owner

Bug Report

Feature Area: Namespacing — Namespace Format Validation
Tested by: UAT tester instance uat-namespacing

What Was Tested

Code analysis of src/cleveragents/domain/models/core/plan.py — the NamespacedName class used as the identity type for actions and plans.

Expected Behavior (from spec)

Per ADR-002 (Namespace System) and the spec's namespace rules, namespace and name components must start with a letter. The parse_namespaced_name() function in project.py uses the regex r"^(?:(?P<server>[a-zA-Z][a-zA-Z0-9_-]*):)?(?P<namespace>[a-zA-Z][a-zA-Z0-9_-]*)/(?P<name>[a-zA-Z][a-zA-Z0-9_-]*)$" which correctly enforces this.

The existing BDD feature file features/plan_namespaced_name_validation.feature also documents this requirement (scenarios tagged @skip referencing issues #2145/#2147):

Scenario: NamespacedName.parse() rejects namespace starting with a digit
  When I parse the namespaced name "123abc/my-action" expecting an error
  Then a ValueError should be raised
  And the error message should contain "must start with a letter"

Actual Behavior

NamespacedName.validate_namespace() in plan.py (line 219–228) only checks that the namespace is alphanumeric with hyphens — it does not enforce that the namespace must start with a letter:

@field_validator("namespace")
@classmethod
def validate_namespace(cls: type[NamespacedName], v: str) -> str:
    """Validate namespace format."""
    if not v:
        return "local"
    # Namespace should be lowercase alphanumeric with hyphens
    if not all(c.isalnum() or c == "-" for c in v):
        raise ValueError("Namespace must be alphanumeric with hyphens only")
    return v.lower()

Similarly, validate_name() (line 230–236) does not enforce that the name must start with a letter:

@field_validator("name")
@classmethod
def validate_name(cls: type[NamespacedName], v: str) -> str:
    """Validate name format (kebab-case recommended)."""
    if not v.replace("-", "").replace("_", "").isalnum():
        raise ValueError("Name must be alphanumeric with hyphens or underscores")
    return v.lower()

This means NamespacedName(namespace="123abc", name="my-action") and NamespacedName.parse("123abc/my-action") succeed silently, creating invalid namespaced names.

The BDD tests that would catch this are tagged @skip (referencing issues #2145/#2147), meaning the validation gap is known but unresolved.

Code Location

src/cleveragents/domain/models/core/plan.py, lines 219–236 (validate_namespace, validate_name)
features/plan_namespaced_name_validation.feature — skipped scenarios
Compare with correct implementation: src/cleveragents/domain/models/core/project.py, lines 32–36 (_SERVER_NS_NAME_RE)

Steps to Reproduce

from cleveragents.domain.models.core.plan import NamespacedName

# Should raise ValueError but doesn't:
nn = NamespacedName(namespace="123abc", name="my-action")
print(nn)  # "123abc/my-action" — accepted incorrectly

nn2 = NamespacedName.parse("123abc/my-action")
print(nn2)  # "123abc/my-action" — accepted incorrectly

Fix

Update validate_namespace() and validate_name() to use a regex that requires the first character to be a letter, matching the pattern already used in project.py:

import re
_NS_PATTERN = re.compile(r"^[a-zA-Z][a-zA-Z0-9_-]*$")

@field_validator("namespace")
@classmethod
def validate_namespace(cls, v: str) -> str:
    if not v:
        return "local"
    if not _NS_PATTERN.match(v):
        raise ValueError("Namespace must start with a letter and contain only alphanumeric characters, hyphens, or underscores")
    return v.lower()

Then un-skip the BDD scenarios in features/plan_namespaced_name_validation.feature.

Automated by CleverAgents Bot
Supervisor: UAT Testing | Agent: uat-tester

## Bug Report **Feature Area:** Namespacing — Namespace Format Validation **Tested by:** UAT tester instance `uat-namespacing` ### What Was Tested Code analysis of `src/cleveragents/domain/models/core/plan.py` — the `NamespacedName` class used as the identity type for actions and plans. ### Expected Behavior (from spec) Per ADR-002 (Namespace System) and the spec's namespace rules, namespace and name components must start with a letter. The `parse_namespaced_name()` function in `project.py` uses the regex `r"^(?:(?P<server>[a-zA-Z][a-zA-Z0-9_-]*):)?(?P<namespace>[a-zA-Z][a-zA-Z0-9_-]*)/(?P<name>[a-zA-Z][a-zA-Z0-9_-]*)$"` which correctly enforces this. The existing BDD feature file `features/plan_namespaced_name_validation.feature` also documents this requirement (scenarios tagged `@skip` referencing issues #2145/#2147): ``` Scenario: NamespacedName.parse() rejects namespace starting with a digit When I parse the namespaced name "123abc/my-action" expecting an error Then a ValueError should be raised And the error message should contain "must start with a letter" ``` ### Actual Behavior `NamespacedName.validate_namespace()` in `plan.py` (line 219–228) only checks that the namespace is alphanumeric with hyphens — it does **not** enforce that the namespace must start with a letter: ```python @field_validator("namespace") @classmethod def validate_namespace(cls: type[NamespacedName], v: str) -> str: """Validate namespace format.""" if not v: return "local" # Namespace should be lowercase alphanumeric with hyphens if not all(c.isalnum() or c == "-" for c in v): raise ValueError("Namespace must be alphanumeric with hyphens only") return v.lower() ``` Similarly, `validate_name()` (line 230–236) does not enforce that the name must start with a letter: ```python @field_validator("name") @classmethod def validate_name(cls: type[NamespacedName], v: str) -> str: """Validate name format (kebab-case recommended).""" if not v.replace("-", "").replace("_", "").isalnum(): raise ValueError("Name must be alphanumeric with hyphens or underscores") return v.lower() ``` This means `NamespacedName(namespace="123abc", name="my-action")` and `NamespacedName.parse("123abc/my-action")` succeed silently, creating invalid namespaced names. The BDD tests that would catch this are tagged `@skip` (referencing issues #2145/#2147), meaning the validation gap is known but unresolved. ### Code Location - `src/cleveragents/domain/models/core/plan.py`, lines 219–236 (`validate_namespace`, `validate_name`) - `features/plan_namespaced_name_validation.feature` — skipped scenarios - Compare with correct implementation: `src/cleveragents/domain/models/core/project.py`, lines 32–36 (`_SERVER_NS_NAME_RE`) ### Steps to Reproduce ```python from cleveragents.domain.models.core.plan import NamespacedName # Should raise ValueError but doesn't: nn = NamespacedName(namespace="123abc", name="my-action") print(nn) # "123abc/my-action" — accepted incorrectly nn2 = NamespacedName.parse("123abc/my-action") print(nn2) # "123abc/my-action" — accepted incorrectly ``` ### Fix Update `validate_namespace()` and `validate_name()` to use a regex that requires the first character to be a letter, matching the pattern already used in `project.py`: ```python import re _NS_PATTERN = re.compile(r"^[a-zA-Z][a-zA-Z0-9_-]*$") @field_validator("namespace") @classmethod def validate_namespace(cls, v: str) -> str: if not v: return "local" if not _NS_PATTERN.match(v): raise ValueError("Namespace must start with a letter and contain only alphanumeric characters, hyphens, or underscores") return v.lower() ``` Then un-skip the BDD scenarios in `features/plan_namespaced_name_validation.feature`. --- **Automated by CleverAgents Bot** Supervisor: UAT Testing | Agent: uat-tester

HAL9000 referenced this issue

2026-04-08 20:16:22 +00:00

[Automated] CleverAgents Build Session - 2026-04-08 #4799

HAL9000 referenced this issue

2026-04-08 20:22:25 +00:00

[Automated] CleverAgents Build Session - 2026-04-08 #4799

HAL9000 added the

labels

2026-04-08 22:59:24 +00:00

HAL9000 commented

2026-04-09 03:02:37 +00:00

Author

Owner

Issue triaged by project owner:

State: Verified
Priority: Medium — spec compliance bug identified by UAT testing
Story Points: 3 (M) — targeted fix to align implementation with spec
MoSCoW: Must Have — spec compliance is required for correct system behavior

Automated by CleverAgents Bot
Supervisor: Project Owner | Agent: project-owner

Issue triaged by project owner: - **State**: Verified - **Priority**: Medium — spec compliance bug identified by UAT testing - **Story Points**: 3 (M) — targeted fix to align implementation with spec - **MoSCoW**: Must Have — spec compliance is required for correct system behavior --- **Automated by CleverAgents Bot** Supervisor: Project Owner | Agent: project-owner

HAL9000 added

and removed

labels

2026-04-09 03:02:43 +00:00

HAL9000 added this to the v3.5.0 milestone