activeadmin-graphql 0.2.1 → 0.3.1

data/docs/dependencies/20260907141000_sqlite3-ghsa-mwm8-39rw-8826.md

@@ -0,0 +1,62 @@
+## Dependency
+
+- sqlite3 (was at or below 2.9.5, now 2.9.6)
+- Development gemspec floor now >= 2.9.6 where this gemspec declared sqlite3
+- Dummy-app and test graph only. The published gem does not require sqlite3 at runtime.
+
+## Symptom
+
+bundler-audit matches sqlite3 <= 2.9.5 against GHSA-mwm8-39rw-8826. CI security jobs fail while that pin remains.
+
+## Evidence
+
+- Advisory: use-after-free in custom aggregate arguments when Database#create_aggregate, #create_aggregate_handler, or #define_aggregator takes two or more arguments over TEXT or BLOB values. Affected >= 1.4.0, <= 2.9.5. Patched 2.9.6.
+- This repository has no create_aggregate, create_aggregate_handler, or define_aggregator callers.
+
+## Suggested fix
+
+Upgrade lockfiles to sqlite3 2.9.6 and raise the development gemspec floor so later resolves stay on the patched line.
+
+## Trigger
+
+- bundler-audit scanner match during the 2026-09-07 CI failure review.
+
+## Assessment target
+
+- CI and test graphs: dummy SQLite used by specs and appraisal.
+- Published gem runtime: sqlite3 is a development dependency only.
+
+## Advisory
+
+- GHSA-mwm8-39rw-8826
+- Maintainers: Medium, CVSS 4.0 score 6.3
+- CISA KEV: not listed at the time of this record.
+
+## Status
+
+- CI and test graphs: fixed after lockfiles pin sqlite3 2.9.6.
+- Published gem runtime: not_affected. Component not present in the published gem runtime.
+
+## Applicability
+
+- Vulnerable component present in the pre-fix development lockfiles at or below 2.9.5.
+- Exploit conditions require custom multi-arg aggregates. Those APIs are absent from this tree.
+
+## Priority
+
+- CI graph: medium because bundler-audit fails the security job on version match.
+- Published gem runtime: none. sqlite3 is not shipped to consumers of the gem.
+
+## Disposition
+
+- Upgrade. Prefer bundle lock --update=sqlite3 --conservative. Raise the development gemspec floor to >= 2.9.6 when sqlite3 is declared there.
+
+## Next
+
+- Keep sqlite3 as a development dependency.
+
+## Source
+
+- https://github.com/sparklemotion/sqlite3-ruby/security/advisories/GHSA-mwm8-39rw-8826
+- https://github.com/sparklemotion/sqlite3-ruby/releases/tag/v2.9.6
+- usr/docs/issues/20260907141000_engineering-and-dependency-audit.md

data/docs/dependencies/20260921114000_rails-json-parse-kwargs.md

@@ -0,0 +1,61 @@
+## Dependency
+
+- activesupport / rails (locked 8.1.3.1 on Rails 8 appraisals and the root Gemfile.lock; 7.2.3.2 on rails72)
+- json 3.0.2 (RubyGems latest as of 2026-09-09) versus development pin json >= 2.21.2, < 3
+- Constraint in this repo: development gemspec only. json is not a runtime gemspec dependency.
+
+## Symptom
+
+With json 3.0.2, dummy GraphQL request specs that POST application/json fail with HTTP 400 and body errors message Invalid JSON. Rails raises ActionDispatch::Http::Parameters::ParseError. The cause is ArgumentError: wrong number of arguments (given 2, expected 1) from JSON.parse.
+
+## Evidence
+
+- json 3.0.0.rc1 (2026-08-11): JSON methods take keyword options, or options checked like keywords. A positional second Hash is no longer accepted by JSON.parse.
+- ActiveSupport::JSON.decode in Rails 8.1.3.1 and 7.2.3.2 still calls JSON.parse(json, options) with a positional Hash. ActionDispatch JSON parameter parsing uses that decoder.
+- This library's controller uses JSON.parse(body) with one argument. That call works on json 3. The dummy app fails before execute because Rails parses the request first.
+- rails/rails#58601 merged 2026-08-28 (commit 0ca2c2c4cfbe7f0a709bca0589d2d74c1853ef27). It is not in 8.1.3.1 or 7.2.3.2.
+
+## Suggested fix
+
+Keep json on 2.21.2 in this repo's lockfiles until a Rails release includes the decode kwargs change. Then drop the development json < 3 pin and bundle update json.
+
+Do not monkeypatch JSON.parse or ActiveSupport::JSON.decode in this library.
+
+## Trigger
+
+- bundle exec rspec after dropping the standard gem and resolving json 3.0.2. 71 request examples failed with Invalid JSON.
+
+## Assessment target
+
+- CI and test graphs: dummy Rails app used by spec/requests.
+- Published gem execute path: JSON.parse of the request body with one argument.
+
+## Status
+
+- CI and test graphs: affected on json 3 with Rails 8.1.3.1 and 7.2.3.2. fixed after the development pin json < 3 and lockfiles at 2.21.2.
+- Published gem execute path: not_affected for this ArgumentError. The one-argument JSON.parse path does not pass a positional options hash.
+
+## Applicability
+
+- Vulnerable component present: json 3 plus unreleased Rails decode.
+- Exploit conditions: not a security advisory. Dummy JSON POST cannot complete parameter parsing.
+
+## Priority
+
+- CI graph: high because request specs fail on every GraphQL POST.
+- Published gem execute path: low until a host on json 3 and unpatched Rails hits the same decoder.
+
+## Disposition
+
+- Pin. development gemspec json >= 2.21.2, < 3. Wait for a Rails patch release that includes rails/rails#58601.
+
+## Next
+
+- Watch Rails 8.1 / 7.2 patch notes for the json 3 decode kwargs fix. Then drop the json < 3 development pin and lock json 3.0.2 or newer.
+
+## Source
+
+- https://github.com/rails/rails/pull/58601
+- https://github.com/ruby/json/blob/v3.0.2/CHANGES.md
+- usr/docs/dependencies/20260907141000_json-cve-2026-71847.md
+- usr/docs/issues/20260921114500_dependency-audit.md

data/docs/dependencies/20260921114500_graphql-ghsa-rmxg-5p3r-j6hh.md

@@ -0,0 +1,69 @@
+## Dependency
+
+- graphql (was 2.6.7, now 2.6.10 in Gemfile.lock and gemfiles/*.gemfile.lock; latest on RubyGems 2.6.10, published 2026-08-27)
+- Constraint in this repo: gemspec add_runtime_dependency graphql >= 2.6.9
+- Lockfiles: Gemfile.lock, gemfiles/rails72.gemfile.lock, gemfiles/rails8ruby34.gemfile.lock, gemfiles/rails8ruby4.gemfile.lock
+
+## Symptom
+
+bundle-audit matches graphql 2.6.7 against GHSA-rmxg-5p3r-j6hh on every lockfile. Solution text: update to >= 2.6.9.
+
+## Evidence
+
+- Advisory: GraphQL::Language::Cache#fetch reads parser cache files and passes contents to Marshal.load without authenticating payloads. If an attacker can place a crafted file on the expected path and the process calls GraphQL::Language::Parser.parse_file, attacker-controlled marshal_load or _load runs in the process.
+- Affected versions: >= 1.12.6. Patched: 2.6.9. Latest registry version 2.6.10 is a later 2.6 patch (dataloader, parser, Execution::Next fixes). No CVE id on the GitHub advisory page as of 2026-09-21.
+- This tree has no parse_file, parser_cache, or GraphQL::Language::Cache callers. Schema cache in ActiveAdmin::GraphQL is an in-process class cache, not the parser cache.
+- Related older advisory GHSA-j7xr-4g94-r9h3 (Execution::Next authorization bypass) is patched in >= 2.6.6. Lockfiles already sit above that floor. The gemspec floor >= 2.3 still allows those versions for downstream resolvers.
+
+## Suggested fix
+
+Upgrade every lockfile to graphql 2.6.10. Raise the gemspec runtime floor to >= 2.6.9 so consumers cannot resolve the Marshal cache versions. Stay on 2.6; 2.6.10 changelog has no breaking-change heading.
+
+## Trigger
+
+- bundle-audit check against ruby-advisory-db commit 44784c295391577f25d198a9205eae4ba73ec4da (last updated 2026-09-16) during the 2026-09-21 dependency audit.
+
+## Assessment target
+
+- CI and test graphs: Gemfile.lock and appraisal locks.
+- Published gem execute path: graphql is a direct runtime dependency. Exploit conditions require Parser.parse_file plus a writable parser cache path.
+- Downstream products that resolve this gemspec: unassessed as unnamed consumers.
+
+## Advisory
+
+- GHSA-rmxg-5p3r-j6hh
+- CWE-502
+- Vendor severity High. bundler-audit criticality Unknown. No CVE. CISA KEV: not listed (no CVE id).
+- Related: GHSA-j7xr-4g94-r9h3, patched >= 2.6.6, lockfiles already 2.6.7.
+
+## Status
+
+- CI and test graphs: fixed after lockfiles pin graphql 2.6.10 and the gemspec floor is >= 2.6.9.
+- Published gem execute path: not_affected. Vulnerable code not in the execute path of this library or dummy app.
+
+## Applicability
+
+- Vulnerable component present: graphql 2.6.7 is a direct runtime gem.
+- Exploit conditions: attacker-controlled parser cache file plus Parser.parse_file. Those APIs are absent from lib/ and spec/.
+
+## Priority
+
+- CI graph: high because bundle-audit fails on every lockfile.
+- Published gem execute path: low. This library does not enable the parser cache.
+- Downstream resolvers: medium until the gemspec floor moves. Consumers who set config.graphql.parser_cache = true on graphql < 2.6.9 meet the advisory conditions.
+
+## Disposition
+
+- Upgrade. bundle lock --update=graphql on the root Gemfile and each appraisal gemfile. Raise spec.add_runtime_dependency graphql to >= 2.6.9.
+
+## Next
+
+- Keep the gemspec floor at graphql >= 2.6.9. Do not drop it back to 2.3.
+
+## Source
+
+- https://github.com/rmosolgo/graphql-ruby/security/advisories/GHSA-rmxg-5p3r-j6hh
+- https://rubysec.com/advisories/GHSA-rmxg-5p3r-j6hh/
+- https://github.com/rmosolgo/graphql-ruby/blob/master/CHANGELOG.md (2.6.9 security note, 2.6.10 patch notes)
+- https://rubysec.com/advisories/GHSA-j7xr-4g94-r9h3/
+- usr/docs/issues/20260921114500_dependency-audit.md

data/docs/dependencies/20261007161308_association-list-combobox.md

@@ -0,0 +1,23 @@
+## Dependency
+
+activeadmin-graphql (this gem). List queries already expose paginated Ransack q, order, and first or last.
+
+## Symptom
+
+The gem has no Formtastic or Stimulus association picker that queries those lists as the person types. Hosts that need searchable associations either embed full catalogs in select or datalist, or keep a local combobox.
+
+## Evidence
+
+Schema and docs describe list fields with the same filter contract as the JSON index. There is no shipped input or controller that posts first and q, keeps a label plus hidden id, and replaces a bounded page on further typing.
+
+## Suggested fix
+
+When a second host needs the same control, or when packaging is requested, ship a Formtastic input and Stimulus controller that take GraphQL field name, node selection fields, search key, order, first, and optional extra q. Do not bake product model names into the gem. Keep host field maps and labels in the host. Until then, leave pickers host-local. Do not publish a third gem only for this picker.
+
+## Next
+
+Open an issue or pull request for the generic picker when packaging is requested. Index filter sidebars and multi-select include or exclude catalogs are out of scope for that first slice. Loading and error states, multi-select, and filter-sidebar wiring remain open after a first single-select page.
+
+## Source
+
+- docs/graphql-api.md list query contract

data/docs/graphql-api.md

@@ -10,10 +10,12 @@ Add the extension to your application (it pulls in `activeadmin` and `graphql` a
 
 ```ruby
 # Gemfile
-gem "activeadmin"
+gem "activeadmin" # 3.5, or pin 4.0.0.beta23
 gem "activeadmin-graphql"
 ```
 
+ActiveAdmin 4.0 is still a prerelease. Pin it in the host Gemfile (`gem "activeadmin", "4.0.0.beta23"`). Bundler will not pick a prerelease from this gem's `>= 3.2` floor. graphql-ruby must be 2.6.9 or newer.
+
 Bundling loads `activeadmin/graphql`, which installs the Router/Resource integration and calls `ActiveAdmin::GraphQL.load!`, so graphql-ruby is loaded at boot whenever the gem is in your bundle. The schema class for a namespace is built on demand (first request or introspection) via `ActiveAdmin::GraphQL.schema_for(namespace)`.
 
 If `graphql = true` is set for a namespace but Bundler cannot satisfy the `graphql` gem, boot fails with an ActiveAdmin dependency error until you run `bundle install`.
@@ -214,9 +216,25 @@ The `Mutation` type is present when at least one operation exists: per-resource
 resource defines the corresponding batch, member, or collection actions.
 
 Object type names default to the model name (for example `Post`). Typed input
-objects mirror `attributes_for_graphql` (see the per-resource section below):
+objects use assignable columns (see the per-resource section below):
 `PostCreateInput`, `PostUpdateInput`, `PostListFilterInput`, and `PostWhereInput`
-when the GraphQL name is `Post`.
+when the GraphQL name is `Post`. `only` / `except` cap both object fields and
+mutation keys. `permit_params` and nested `create` / `update` blocks narrow
+create and update inputs without hiding query fields. Default mutation inputs
+omit `created_at` and `updated_at`.
+
+### Nonconventional primary keys
+
+GraphQL `id` always comes from `ActiveAdminResource` (`ID!`). An ActiveRecord
+`id` column is never added as a second field. When `self.primary_key` is blank
+but the model still has an `id` column (common for database views that project
+`… AS id`), that column supplies the GraphQL `id` value. When the model has
+neither a primary key nor an `id` column, schema build raises until you set
+`self.primary_key` on the model (for example a view keyed by `row_key`). A
+single-column primary key named something other than `id` is also exposed as
+its own readable field beside `id`, unless `only` or `exclude` omits it. An
+inferred `id` column must contain a unique, non-null value for every row;
+ambiguous member and batched lookups fail instead of selecting one row.
 
 ### Composite primary keys (Rails 7.1+)
 
@@ -270,9 +288,11 @@ These align with REST index parameters where possible:
 Typical names for a `Post` resource:
 
 * `create_post(input: PostCreateInput!)` — attribute fields match assignable
-  columns (and the nested parent param when `belongs_to` is configured).
+  columns minus `created_at` / `updated_at` unless listed in `permit_params`
+  (and the nested parent param when `belongs_to` is configured).
 * `update_post(where: PostWhereInput!, input: PostUpdateInput!)`
-* `delete_post(where: PostWhereInput!)`
+* `delete_post(where: PostWhereInput!)` — kept for existing clients.
+* `destroy_post(where: PostWhereInput!)` — Rails / ActiveAdmin action name; same resolver as `delete_post`.
 
 Nested resources require the parent id on `where`, `input`, or list `filter`
 when the association is required.
@@ -339,9 +359,16 @@ Inside `ActiveAdmin.register` you can narrow the GraphQL surface:
 ActiveAdmin.register Post do
   graphql do
     disable!                          # omit this resource from the schema
-    type_name "BlogPost"              # GraphQL object / mutation type basename
-    only :title, :body, :published_at # expose only these attributes
+    type_name "BlogPost"              # GraphQL object / mutation type basename (`graphql_name` alias)
+    only :title, :body, :published_at # expose only these attributes on queries
     exclude :internal_score           # or `except` / `exclude`
+    permit_params :title, :body       # create and update inputs (query fields stay)
+    create do
+      permit_params :title, :body     # replace the shared list for create
+    end
+    update do
+      permit_params :title            # replace the shared list for update
+    end
     configure do
       # graphql-ruby field DSL on the object type class
       field :computed, GraphQL::Types::String, null: true
@@ -352,10 +379,21 @@ end
 ```
 
 * `disable!` — resource is not included in Query or Mutation.
-* `type_name` — overrides the default GraphQL type name derived from the model
-  (object types, mutations, and Rails enum GraphQL types use this basename).
-* `only` / `except` (or `exclude`) — restrict columns on object types and
-  assignable mutation keys (the primary key remains readable as `id`).
+* `type_name` (or `graphql_name`) — overrides the default GraphQL type name
+  derived from the model (object types, mutations, and Rails enum GraphQL
+  types use this basename).
+* `only` / `except` (or `exclude`) — restrict columns on object types. These
+  names also cap mutation inputs. This is not ActiveAdmin `only:` / `except:`
+  for controller actions (`action_item only: :show`). The primary key remains
+  readable as `id`.
+* `permit_params` (or `permit`) — restrict create and update input keys without
+  hiding query fields, same name as ActiveAdmin HTML `permit_params`. Nested
+  `create` / `update` blocks replace that shared list for one operation and
+  may set `resolve`. Names outside `only` / `except` are dropped. A static HTML
+  `permit_params :title, :body` list seeds GraphQL when the graphql list is
+  unset. A request-time HTML `permit_params` block is not copied. With no list
+  set, mutation inputs omit `created_at` and `updated_at`. Empty `permit_params`
+  yields an input with no column arguments.
 * `configure` — `field` and resolver methods are evaluated on the generated
   object type class.
 

data/docs/issues/20260907141000_engineering-and-dependency-audit.md

@@ -0,0 +1,30 @@
+Recorded 2026-09-07. Library gem. Scheduled CI bundler-audit failed on json CVE-2026-71847 and, where present, sqlite3 GHSA-mwm8-39rw-8826.
+
+## Participants
+
+- amkisko
+
+## Decisions
+
+- Bump json to 2.21.2 in Gemfile.lock and appraisal lockfiles. Keep json on 2.x because rubocop declares json ~> 2.3.
+- Bump sqlite3 to 2.9.6 in the test graph where the pin was still affected. Raise the development gemspec floor to >= 2.9.6 when this gemspec declared sqlite3.
+- Treat CVE-2026-71847 as not_affected for this gem execute path. The advisory names JSON::ResumableParser#partial_value.
+- Treat GHSA-mwm8-39rw-8826 as not_affected for the published gem runtime when sqlite3 is development-only. Still bump the test graph so bundler-audit can pass.
+- Leave Dependabot bundler at directory /. Appraisal *.gemfile names are not a working Dependabot directory.
+
+## Effects
+
+- Root and appraisal lockfiles pin json 2.21.2. sqlite3 pins 2.9.6 where that gem was in the graph.
+- Dependency records live under usr/docs/dependencies.
+
+## Next
+
+- Appraisal lockfiles stay outside Dependabot directory /. Keep CI bundler-audit as the gate unless a later pass finds a supported Dependabot layout for those files.
+
+## Source
+
+- usr/docs/changelogs/20260907141000_advisory-lockfile-refresh.md
+- usr/docs/dependencies/20260907141000_json-cve-2026-71847.md
+- usr/docs/dependencies/20260907141000_sqlite3-ghsa-mwm8-39rw-8826.md
+- https://github.com/ruby/json/security/advisories/GHSA-9hj4-r449-hfvc
+- https://github.com/sparklemotion/sqlite3-ruby/security/advisories/GHSA-mwm8-39rw-8826

data/docs/issues/20260917123253_ci-drop-automatic-dependency-audit.md

@@ -0,0 +1,29 @@
+CI quality failed on a trailing blank line in spec/support/junit_formatter.rb. Test CI also ran bundler-audit or osv-scanner, which fail whenever an advisory lands even when a separate dependency audit already exists.
+
+## Participants
+
+- amkisko
+
+## Decisions
+
+- Drop bundler-audit and security jobs from test.yml so tests no longer wait on advisory freshness.
+- Drop the advisory osv-scanner job from test.yml.
+- Add dependency-audit.yml with workflow_dispatch only. Do not run it on push, pull request, or schedule.
+- Disable osv-scanner in Trunk Check.
+- Disable markdownlint MD013 in .markdownlint.yaml. Keep AGENTS.md in Trunk so other markdownlint rules still run.
+- Keep lockfile and spec fixes that were already blocking quality or tests.
+
+## Effects
+
+- Test CI runs lint and specs without an advisory gate.
+- Trunk Check no longer treats dependency CVEs as a required check.
+- On-demand bundler-audit of every Gemfile.lock is available through workflow_dispatch.
+
+## Next
+
+- Run dependency audit on demand when a release or a known advisory needs it.
+- Do not reintroduce advisory scanners into test.yml.
+
+## Source
+
+- GitHub Actions test and Trunk Check failures on 2026-09-17

data/docs/issues/20260921103000_mutation-attribute-allowlists.md

@@ -0,0 +1,40 @@
+# Mutation attribute allowlists
+
+## Participants
+
+Andrei Makarov
+
+## Decisions
+
+RFC 0006 Proposed adds assignable, create_only, update_only, and except_assignable (alias unassignable) on the per-resource graphql block.
+
+only and except stay the readable ceiling. Mutation lists intersect that set and cannot widen it.
+
+Default create and update inputs stay the current assignable column set, including timestamps. Changing that default would break clients.
+
+ResourceQueryProxy#build_new still permits graphql_assignable_attribute_names so a resolve_create hook can set server-owned readable columns. The GraphQL input type and the mutation resolver slice use the mutation lists.
+
+## Effects
+
+Request spec spec/requests/graphql_mutation_allowlists_spec.rb failed first: six examples raised NoMethodError on the new DSL. Default examples passed and showed PostCreateInput includes created_at, updated_at, and starred, and that create_post persists a client-supplied created_at of 2020-01-02T03:04:05Z.
+
+After the implementation that spec file: 8 examples, 0 failures (bundle exec rspec spec/requests/graphql_mutation_allowlists_spec.rb).
+
+Claims from the downstream dependency note, checked in this tree at version 0.2.1:
+
+1. Gem version is 0.2.1. Source: lib/active_admin/graphql/version.rb VERSION = "0.2.1". Outcome: supported.
+2. Generated create and update inputs expose every assignable database column. Source: ActiveAdmin::Resource#default_attributes walks resource_class.columns minus primary key, STI, counter cache, and application filter_attributes (encrypted_password, password, password_confirmation). SchemaBuilder TypesInputs used graphql_assignable_attribute_names for both input types. Dummy PostCreateInput in the new spec includes title, body, starred, created_at, updated_at. Outcome: supported for ActiveAdmin resource_attributes, not every SQL column in the abstract (filtered password columns stay out).
+3. The package mutations therefore accepted calculated values and internal timestamps that the server owns. Source: the same spec persisted created_at on create. Package column names (budget status, velocity, usage totals) are not in this repository. Outcome: supported for timestamps on Post; unverifiable for named Package columns.
+4. only limits output fields, so it cannot express a mutation-only allowlist without hiding fields from queries. Source: attributes_for_graphql applies only_attributes and exclude_attributes; types_object and graphql_assignable_attribute_names both use that list. Outcome: supported.
+5. The schema builder derives both mutation inputs from graphql_assignable_attribute_names and provides no separate create or update configuration. Source: types_inputs.rb before this change; ResourceConfig had only_attributes and exclude_attributes only. Outcome: supported for 0.2.1; outdated after RFC 0006 ships.
+6. The application resolves the gem from its published package and records it in Gemfile.lock. Source: not this repository. Outcome: unverifiable here.
+
+## Next
+
+Keep RFC 0006 Proposed until 2026-10-05 lazy consensus. 0.3.0 metadata includes the graphql 2.6.9 floor and ActiveAdmin 4 Rails 8 matrix; tag and gem push wait on make release.
+
+Later pass 2026-09-21: DSL renamed to ActiveAdmin permit_params with nested create and update blocks. create_only, update_only, assignable, and except_assignable were dropped before release. Spec path is spec/requests/graphql_mutation_permit_params_spec.rb. RFC file is rfcs/0006-mutation-permit-params.md. Default mutation inputs omit created_at and updated_at.
+
+## Source
+
+Downstream dependency note that described PackageCreateInput. RFC 0004. lib/active_admin/graphql/integration.rb. lib/active_admin/graphql/schema_builder/types_inputs.rb. vendor activeadmin-3.5.2 lib/active_admin/resource/attributes.rb and application_settings.rb filter_attributes. spec/requests/graphql_mutation_allowlists_spec.rb.

data/docs/issues/20260921104400_convention-alignment-audit.md

@@ -0,0 +1,60 @@
+# Convention alignment engineering audit
+
+## Participants
+
+Andrei Makarov
+
+## Decisions
+
+Mutation write lists use ActiveAdmin permit_params. Per-operation lists live in nested create and update blocks with graphql-ruby resolve pairing, matching member_action_mutation. create_only, update_only, assignable, except_assignable, and unassignable are not in the public DSL.
+
+Empty GraphQL input objects call has_no_arguments(true) so graphql-ruby 2.6 does not warn toward a future raise.
+
+HTML permit_params is copied when the HTML call is a static argument list. A request-time block is not copied.
+
+Default mutation inputs omit created_at and updated_at unless listed on permit_params.
+
+destroy_post is registered as an alias of delete_post. graphql_name is an alias of type_name.
+
+Failed save and update raise GraphQL::ExecutionError with extensions.errors. CRUD fields still return the resource object.
+
+GraphqlController logs namespace, operation name, and error_count without the query body or current user.
+
+ResourceMethods lives in lib/active_admin/graphql/resource_methods.rb.
+
+## Effects
+
+First pass used create_only. Second pass replaced it after a convention check against graphql-ruby 2.6.7, Rails 8.1 nested_attributes update_only, upsert_all update_only, and ActiveAdmin 3.5.2 permit_params.
+
+bundle exec rspec spec/requests/graphql_mutation_permit_params_spec.rb: 8 examples, 0 failures after the rename.
+
+## Findings
+
+Severity high. Confidence high. Location SchemaBuilder TypesInputs default create and update inputs. Why it matters: extra-field write of created_at on create, observed in spec/requests/graphql_mutation_permit_params_spec.rb. Evidence kind observed. Security disposition confirmed. Smallest credible fix: graphql { permit_params :title, :body } in the host app. Deeper fix: omit created_at and updated_at from default mutation inputs in a later RFC, matching ActiveAdmin generators/boilerplate.rb assignable_attributes.
+
+Severity medium. Confidence high. Location ResourceDefinitionDSL versus ActiveAdmin::ResourceDSL#permit_params. Why it matters: HTML and GraphQL write lists can drift. Evidence kind observed that GraphQL never calls HTML permit_params. Inference that a static argument list could be copied; confirming check is to parse the controller permitted_params method or store the original args on the resource. Smallest credible fix: document that graphql permit_params should match HTML. Deeper fix: seed GraphQL from a static HTML list when graphql permit_params is unset.
+
+Severity medium. Confidence high. Location mutation_update_destroy.rb delete_ prefix versus actions.include?(:destroy). Why it matters: Rails and ActiveAdmin name the action destroy; GraphQL field is delete_post. Evidence kind observed. Smallest credible fix: none in this RFC; shipped client contract. Deeper fix: RFC to add destroy_* alias or rename.
+
+Severity medium. Confidence high. Location mutation_create.rb returning the record and raising GraphQL::ExecutionError. Why it matters: graphql-ruby Schema::Mutation example returns hash with errors array. Evidence kind observed in graphql-2.6.7 lib/graphql/schema/mutation.rb. Smallest credible fix: none in this RFC. Deeper fix: payload type RFC.
+
+Severity low. Confidence high. Location ResourceDefinitionDSL#type_name versus graphql-ruby graphql_name. Why it matters: two names for the same idea. Evidence kind observed. Smallest credible fix: alias graphql_name. Deeper fix: deprecate type_name after a release.
+
+Severity low. Confidence high. Location ResourceDefinitionDSL#only versus ActiveAdmin action_item only: for controller actions. Why it matters: only already means attribute list in this gem since 0.2.1. Evidence kind observed. Smallest credible fix: keep only; document the split from ActiveAdmin action only.
+
+Severity low. Confidence high. Location GraphqlController, no request correlation log. Why it matters: host logs may not show which GraphQL operation failed. Evidence kind observed absence of log calls in graphql_controller.rb. Smallest credible fix: none required of a library; host can log. Deeper fix: optional around_action.
+
+Severity low. Confidence high. Location lib/active_admin/graphql/integration.rb line count 176. Why it matters: file is above the 150 line preference. Evidence kind observed. Smallest credible fix: extract ResourceMethods. Not done this pass.
+
+## Next
+
+Findings from the 2026-09-21 audit pass are addressed except replacing CRUD return types with graphql-ruby payload objects, which would break RFC 0004 field types. Keep RFC 0006 Proposed. 0.3.0 metadata includes the graphql 2.6.9 floor and ActiveAdmin 4 Rails 8 matrix; tag and gem push wait on make release.
+
+## Source
+
+rfcs/0006-mutation-permit-params.md
+spec/requests/graphql_mutation_permit_params_spec.rb
+vendor activeadmin-3.5.2 lib/active_admin/resource_dsl.rb permit_params
+vendor activerecord-8.1.3.1 lib/active_record/nested_attributes.rb update_only
+vendor graphql-2.6.7 lib/graphql/schema/mutation.rb
+usr/docs/issues/20260921103000_mutation-attribute-allowlists.md

data/docs/issues/20260921114500_dependency-audit.md

@@ -0,0 +1,90 @@
+# Dependency audit 2026-09-21
+
+Full audit: recon, security, freshness, ecosystem. Depth reached: full for hot-path direct packages; GitHub REST rate-limited after activeadmin, graphql-ruby, and ransack so remaining repo strain counts use registry dates, release pages, and fetched repo summaries.
+
+## Participants
+
+Andrei Makarov
+
+## Decisions
+
+Do not bump the whole graph to every registry latest. Hot-path and advisory matches first. Skip ActiveAdmin 4.0.0.beta23, json 3, arbre 2, inherited_resources 2, marcel 2, diff-lcs 2, and net-protocol 0.4. Those majors are either prerelease, pinned by ActiveAdmin 3.5.2, or required by rubocop json ~> 2.3.
+
+Upgrade graphql to 2.6.10 and raise the gemspec floor to >= 2.6.9. That is the only security-driven change from this pass.
+
+Optional same-pass lockfile patches with no major jump: rack 3.2.7, zeitwerk 2.8.3, responders 3.2.1, net-imap 0.6.7, bigdecimal 4.1.3, erb 6.0.7, unicode-display_width 3.3.0, unicode-emoji 4.3.0, polyrun 2.2.4, parallel_tests 5.8.0. rbs 4.2.0, io-console 0.9.4, reline 0.7.0, parallel 2.2.0, sprockets 4.4.1, and rubocop 1.91 sit behind Standard and Rails pins; bump only if those parents allow it.
+
+Keep sqlite3 2.9.6 and json 2.21.2. Those pins already match the 2026-09-07 advisory records.
+
+Stay on ActiveAdmin 3.5.2. It is the latest stable on RubyGems. 4.0.0.beta23 (2026-09-20) is prerelease and pulls arbre ~> 2.0 and inherited_resources ~> 2.0.
+
+Do not reverse the 2026-09-17 choice to keep bundle-audit off test.yml. The on-demand workflow remains the gate. Makefile still has no audit target that mirrors that workflow.
+
+## Effects
+
+ruby-advisory-db update: 1245 advisories, last updated 2026-09-16 10:35:37 -0400, commit 44784c295391577f25d198a9205eae4ba73ec4da.
+
+bundle-audit check failed on all four lockfiles with GHSA-rmxg-5p3r-j6hh (graphql 2.6.7, solution >= 2.6.9). No other scanner matches.
+
+bundle outdated --strict on the root Gemfile listed 16 outdated specs. graphql 2.6.7 vs 2.6.10 is the only outdated hot-path direct runtime gem.
+
+Libyears from Gemfile.lock vs RubyGems stable (compact-graph band: about 10 low, about 100 medium): 124 locked packages, 27 outdated, total lag 17.94 years, average 0.145 years per package, 6 packages one major behind (arbre, inherited_resources, json, marcel, diff-lcs, rubocop-capybara). Coverage floor in config/polyrun_coverage.yml is 85 percent line. No upgrade spike was run this pass.
+
+No person-facing surface in this pass.
+
+## Findings
+
+Tier hot path direct. Kind security. Severity high. Confidence high. Package graphql 2.6.7. Why it matters: Marshal.load of unauthenticated parser cache files is RCE when parse_file runs. Evidence kind observed (bundle-audit, GHSA text, repo grep with no parse_file). Sources: GHSA-rmxg-5p3r-j6hh, ruby-advisory-db. Smallest fix: lock 2.6.10 and gemspec >= 2.6.9. Deeper fix: none. Status: CI graphs affected; this library execute path not_affected. Disposition: upgrade. Next: apply when confirmed.
+
+Tier hot path direct. Kind freshness. Severity low. Confidence high. Package activeadmin 3.5.2 equals RubyGems stable latest (2026-07-13). Why it matters: 4.0.0.beta23 is a different major with arbre 2 and inherited_resources 2. Evidence kind observed (rubygems.org/gems/activeadmin). Watch: stay on 3.5.2 until a stable 4.0. Recon: github.com/activeadmin/activeadmin last push 2026-09-21, 9709 stars, 30 open issues, MIT, not archived.
+
+Tier hot path direct. Kind recon. Severity low. Confidence high. Package graphql locked 2.6.7, latest 2.6.10. Upstream rmosolgo/graphql-ruby last push 2026-09-17, 5445 stars, 63 open issues, MIT. Maintainer cluster: rmosolgo, protocol family graphql-ruby, already the runtime schema engine. Classification healthy. 2.6.10 changelog is patch-level after the 2.6.9 security fix.
+
+Tier hot path transitive. Kind ecosystem. Severity low. Confidence medium. Package kaminari 1.2.2. Why it matters: latest gem is still 1.2.2 from 2021-12-25 while GitHub last push is 2026-02-20 and several June 2026 PRs sit open. ActiveAdmin 3.5.2 and 4.0.0.beta23 still depend on kaminari >= 1.2.1. Evidence kind observed (rubygems version date, github.com/kaminari/kaminari). Watch, not a CVE. Cannot upgrade independently of ActiveAdmin.
+
+Tier hot path transitive. Kind freshness. Severity low. Confidence high. Packages arbre 1.7.0 (latest 2.2.1) and inherited_resources 1.14.0 (latest 2.1.0). Why it matters: ActiveAdmin 3.5.2 pins arbre ~> 1.2 and inherited_resources ~> 1.7. Evidence kind observed (Gemfile.lock activeadmin 3.5.2 dependencies). Do not force majors.
+
+Tier hot path transitive. Kind recon. Severity low. Confidence medium. Package ransack 4.4.1 equals latest (2025-09-29). github.com/activerecord-hackery/ransack last push 2026-05-31, 5860 stars, 156 open issues (about 2.7 percent). Classification healthy. formtastic 6.0.0 equals latest (2026-02-20). has_scope 0.9.0 and jquery-rails 4.6.1 equal latest.
+
+Tier hot path transitive. Kind security. Severity low. Confidence high. Package rack 3.2.6 vs latest 3.2.7. Why it matters: April 2026 Rack CVEs (including GHSA-g2pf-xv49-m2h5 / CVE-2026-34835 and GHSA-h2jq-g4cq-5ppq / CVE-2026-34785) are patched in 3.2.6. 3.2.7 restores Ruby 2.4/2.5 compatibility only. Evidence kind observed (rack changelog 3.2.6 security section, 3.2.7 note). Status: not_affected for those CVEs at 3.2.6. Optional patch bump.
+
+Tier dev/test. Kind freshness. Severity low. Confidence high. json 2.21.2 vs 3.0.2 blocked by rubocop json ~> 2.3. sqlite3 2.9.6 is latest and matches GHSA-mwm8-39rw-8826. rails 8.1.3.1 and 7.2.3.2 match appraisal floors and are current on those lines. appraisal 2.5.0 equals latest (2023-07-14); stale but current.
+
+Tier automation. Kind automation gap. Severity low. Confidence high. Why it matters: Dependabot bundler directory / does not refresh gemfiles/*.gemfile.lock. scorecard.yml still pins actions/checkout 9c091bb (v7.0.0) while test.yml uses 3d3c42e5 (v7.0.1). ossf/scorecard-action 4eaacf05 is v2.4.3; v2.4.4 exists. mschilde/auto-label-merge-conflicts is commented as master. Makefile has no audit target. Evidence kind observed (workflow files, dependabot.yml). Smallest fix: optional action SHA refresh via Dependabot; keep appraisal locks in the on-demand audit. Do not put advisory scanners back on test.yml.
+
+## Next
+
+Wait for a Rails release that includes rails/rails#58601. Then drop the development json < 3 pin and bundle update json. Leave marcel 2 and diff-lcs 2 alone until those parents move.
+
+The standard gem is gone. Lint uses rubocop plus a snapshot of standard 1.56.0 rules.
+
+Optional: align scorecard.yml checkout SHA with v7.0.1.
+
+## Later pass 2026-09-21
+
+This gem is supposed to support ActiveAdmin 4. The first pass skipped the beta. That decision is reversed for the Rails 8 appraisals only.
+
+Decisions: pin ActiveAdmin 4.0.0.beta23 in gemfiles/rails8ruby34.gemfile and gemfiles/rails8ruby4.gemfile. Keep ActiveAdmin ~> 3.5, >= 3.5.2 on rails72. Raise graphql gemspec floor to >= 2.6.9 and lock 2.6.10. Apply the optional patch set. net-protocol 0.4.0 came in with net-imap 0.6.7. json stays 2.21.2.
+
+Rubocop and json 3 path: Standard 1.56.0 (latest, 2026-07-15) depends on rubocop ~> 1.88.0. Locked rubocop 1.88.2 depends on json ~> 2.3, which rejects json 3. RuboCop 1.91.0 depends on json >= 2.3, which allows json 3.0.2. graphql 2.6.8 already dropped quirks_mode for JSON 3. This library uses JSON.parse, JSON.generate, and JSON.dump(hash, buffer). json 3.0.1 restored the dump positional limit argument. Do not add a Gemfile rubocop override that fights Standard.
+
+Effects: bundle-audit check on all four lockfiles: No vulnerabilities found. make lint: 84 files, no offenses, rbs validate ok. bundle exec rspec: 102 examples, 0 failures on the root ActiveAdmin 3.5.2 bundle. BUNDLE_GEMFILE=gemfiles/rails72.gemfile bundle exec rspec: 102 examples, 0 failures. BUNDLE_GEMFILE=gemfiles/rails8ruby34.gemfile and gemfiles/rails8ruby4.gemfile: 102 examples, 0 failures each on ActiveAdmin 4.0.0.beta23. Dummy GraphQL request specs did not need cssbundling-rails or importmap-rails. AA4 HTML asset install is still a host-app concern.
+
+## Later pass 2026-09-21 drop standard
+
+Dropped the standard gem. Locked rubocop 1.91.0. json 3.0.2 failed dummy GraphQL POSTs through Rails JSON.decode. Kept json 2.21.2 with development gemspec json >= 2.21.2, < 3. See usr/docs/changelogs/20260921112800_drop-standard-rubocop-direct.md and usr/docs/dependencies/20260921114000_rails-json-parse-kwargs.md.
+
+## Source
+
+Commands: bundle-audit update; bundle-audit check --gemfile-lock on Gemfile.lock and gemfiles/*.gemfile.lock; bundle outdated --strict; RubyGems /api/v1/gems and /api/v1/versions for locked-vs-latest lag; GitHub REST /repos for activeadmin/activeadmin, rmosolgo/graphql-ruby, activerecord-hackery/ransack.
+
+https://github.com/rmosolgo/graphql-ruby/security/advisories/GHSA-rmxg-5p3r-j6hh
+https://rubygems.org/gems/activeadmin
+https://rubygems.org/gems/graphql
+usr/docs/dependencies/20260921114500_graphql-ghsa-rmxg-5p3r-j6hh.md
+usr/docs/dependencies/20260907141000_json-cve-2026-71847.md
+usr/docs/dependencies/20260907141000_sqlite3-ghsa-mwm8-39rw-8826.md
+usr/docs/dependencies/20260921114000_rails-json-parse-kwargs.md
+https://github.com/rails/rails/pull/58601
+usr/docs/issues/20260917123253_ci-drop-automatic-dependency-audit.md
+usr/docs/issues/20260907141000_engineering-and-dependency-audit.md

data/docs/issues/20260921115500_file-length-metrics.md

@@ -0,0 +1,31 @@
+# File length metrics
+
+## Participants
+
+Andrei Makarov
+
+## Decisions
+
+Per-file line count is Metrics/FileLength. RuboCop core does not ship that cop. The local cop counts physical source lines, including blanks and comments.
+
+WarnMax is 150 and reports as info. Max is 300 and reports as error. RuboCop fail-level is refactor, so a warning offense would fail make lint the same as an error. Info is the non-failing warning band. Error is the alert that fails the run.
+
+Class and module length stay at 200 with CountAsOne for array, hash, heredoc, and method_call. That sits between the preferred file size and the file alert. Complexity cops stay at cyclomatic 18, perceived 18, and AbcSize 35.
+
+spec/requests/graphql_spec.rb is over 300 lines. It has a file-level disable until that request matrix is split.
+
+## Effects
+
+bundle exec rspec spec/unit/file_length_cop_spec.rb: 4 examples, 0 failures.
+
+make lint: bundle exec rubocop, 86 files inspected, 5 info Metrics/FileLength offenses, exit 0. bundle exec rbs validate succeeded.
+
+## Next
+
+Split spec/requests/graphql_spec.rb so the disable can drop. Files in the info band at this pass: app/controllers/active_admin/graphql_controller.rb, lib/active_admin/graphql/integration.rb, lib/active_admin/graphql/resource_query_proxy/controller.rb, lib/active_admin/graphql/schema_builder/query_type_policies.rb, spec/requests/graphql_mutation_permit_params_spec.rb.
+
+## Source
+
+.rubocop.yml Metrics/FileLength, Metrics/ClassLength, Metrics/ModuleLength
+rubocop/cop/metrics/file_length.rb
+spec/unit/file_length_cop_spec.rb

data/docs/plan/20260817201500_rfc-starter.md

@@ -0,0 +1,31 @@
+# RFC starter pack
+
+## Participants
+
+Andrei Makarov
+
+## Decisions
+
+Pilot the portable RFC form: README, template, RFC 0001 Proposed, RFC 0002 Informational positioning, ids/0001 and ids/0002, CONTRIBUTING and GOVERNANCE pointers.
+
+Isolation is off. Sequential numbering. An RFC specifies a design. Version numbers belong in changelogs. Shipped design specified after the fact is Stable.
+
+## Effects
+
+Starter files written on plan/rfc-process. Process RFC remains Proposed until 2026-08-31.
+
+Later pass 2026-08-18: RFC 0002 marked as positioning. Types and statuses cite rfcs/README.md. Relates dropped from RFC 0002. Process text stays aligned with kiskolabs/pray RFC 0001 until that RFC is Stable.
+
+Later pass 2026-08-18: RFC 0002 rewritten with concrete problems, shipped solutions, and which surfaces need a later Standards Track RFC. RFC 0001 Motivation names those surfaces.
+
+Later pass 2026-08-18: as-built Informational RFCs added for each public contract named in RFC 0002. Describes stays on the current version. Status is Stable. RFC 0002 Relates those documents.
+
+Later pass 2026-08-18: product RFCs specify a design. Suggestion, motivation, specification, effects, alternatives, and prior art. Version numbers belong in changelogs. RFC 0002 stays Informational. RFC 0003 and later are Standards Track Stable. Describes dropped.
+
+## Next
+
+Discuss RFC 0001. Extract amkisko/rfc-process after kiskolabs/pray RFC 0001 is Stable. Replace this hand-copied pack if the prayer differs.
+
+## Source
+
+Upstream: kiskolabs/pray rfcs/0001-rfc-process.md and usr/docs/plan/20260817200400_library-rfc-adoption.md.