activeadmin-graphql 0.3.0 → 0.3.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 3347160c32fcf8dea19214ff0bdac83b9c9650855dd58de9035b153c37e0b708
-  data.tar.gz: 757c6bcf6d659569aee20ec9a54f094795c4c0cee4700db967a294a26779ea1b
+  metadata.gz: 5fc45489403fdf5c4d16bd66966cc4c7c5641440663d3f5b229b0d627a0d0978
+  data.tar.gz: '04786131baffbec749af13c347660836c1ca31efa074c73eddfc49c5fbfb588e'
 SHA512:
-  metadata.gz: 383ff1b8d22b9ee6e6f70aa60284ac9c832d69436bf5ee10bfa9b25ce17089aad965481f0ca7149b3742e26aef24e0b2f1b24bb9b84ab26b1076b6c4d39e855a
-  data.tar.gz: 8f6b647f0201d15d2dfe4e23befad9b9c05a22b226cd9d6257678eeb36d4ef39a53de4372961e6b765fe2acc2e4bc0475f835015f24bb867a0564e58b17b4824
+  metadata.gz: 1c93c24f91a208c8eb00076d1fd3d8b398c99d155a8ce92f4aaa075b6615ea321a3303b2186e85fa32178a4e8ad158fb4ab1f081752993c6a44e5466fad1ac83
+  data.tar.gz: f5c1acc62e5f1aa0cd925234c4df76d9870dd592cb97aeae7927df578340d70936e02bcf727635a8f07d7caacfb84316e037383c7666b35cb472d11b8776240e

data/CHANGELOG.md

@@ -2,6 +2,10 @@
 
 ## Unreleased
 
+## 0.3.1 (2026-10-10)
+
+- Fix GraphQL identity handling for database views and nonconventional primary keys: keep one `id` field, support inferred `id` lookups, reject ambiguous identifiers, and honor attribute filters.
+
 ## 0.3.0 (2026-09-21)
 
 - BREAKING: omit `created_at` and `updated_at` from default create and update inputs. List them on `permit_params` to keep them writable.

data/docs/changelogs/20260818111600_rfc-0002-problems.md

@@ -0,0 +1,25 @@
+# RFC 0002 problems and process motivation
+
+## Participants
+
+Andrei Makarov
+
+## Decisions
+
+RFC 0002 is the as-built problem statement: concrete operator or implementer failures, the shipped solution, rejected alternatives, and which surfaces still need a later Standards Track RFC.
+
+RFC 0001 Motivation names those same surfaces as the reason a numbered process exists here.
+
+## Effects
+
+rfcs/0002-problem-and-positioning.md rewritten. rfcs/0001-rfc-process.md Motivation updated. Unreleased changelog line expanded.
+
+## Next
+
+Discuss RFC 0001 until 2026-08-31. Commit when asked.
+
+## Source
+
+Upstream: README, CHANGELOG, and (where present) SPEC.md or docs/graphql-api.md in this tree.
+
+Downstream: rfcs/0001-rfc-process.md, rfcs/0002-problem-and-positioning.md.

data/docs/changelogs/20260818114000_rfc-as-built-coverage.md

@@ -0,0 +1,27 @@
+# As-built RFC coverage
+
+## Participants
+
+Andrei Makarov
+
+## Decisions
+
+Starter pack RFC 0001 and RFC 0002 is not enough. Each public contract named in RFC 0002 gets its own Informational Stable RFC with Describes pinned to the current version.
+
+As-built Informational RFCs are Stable. A later change to those contracts is a new Standards Track RFC.
+
+## Effects
+
+Wrote RFC 0003 HTTP endpoint, RFC 0004 schema and DSL, RFC 0005 authorization and filters. Claimed ids/0003 through ids/0005. Updated rfcs/README.md Current set, RFC 0002 Relates and Unresolved, and CHANGELOG Unreleased.
+
+Later pass 2026-08-18: RFC 0003 and later rewritten as Standards Track design specifications. Describes dropped. Version numbers belong in changelogs. The Informational Describes dump from this file is reversed.
+
+## Next
+
+Discuss RFC 0001 until 2026-08-31. Commit when asked. Schema layout and cap registrar remain later Standards Track candidates.
+
+## Source
+
+Upstream: docs/graphql-api.md, CHANGELOG 0.2.1, lib/active_admin/graphql/integration.rb.
+
+Downstream: rfcs/0003-http-endpoint.md, rfcs/0004-schema-and-dsl.md, rfcs/0005-authorization-and-filters.md.

data/docs/changelogs/20260818114700_rfc-design-not-version.md

@@ -0,0 +1,27 @@
+# RFCs specify design
+
+## Participants
+
+Andrei Makarov
+
+## Decisions
+
+An RFC proposes a design: suggestion, motivation, specification, effects, alternatives, and prior art. Version numbers belong in changelogs. Implementation notes stay optional evidence.
+
+RFC 0002 stays Informational positioning. RFC 0003 and later are Standards Track. Shipped design specified after the fact is Stable.
+
+## Effects
+
+Rewrote product RFCs 0002 and later, RFC 0001 process text, rfcs/README.md, and the template. Dropped Describes. Updated CHANGELOG Unreleased.
+
+Later pass 2026-08-18: dropped fence tags that only blocked a misreading in process text. Contract negation stayed.
+
+## Next
+
+Discuss RFC 0001 until 2026-08-31. Commit when asked.
+
+## Source
+
+Upstream: conversation on RFC shape for product libraries.
+
+Downstream: rfcs/.

data/docs/changelogs/20260907141000_advisory-lockfile-refresh.md

@@ -0,0 +1,21 @@
+## Participants
+
+- amkisko
+
+## Decisions
+
+- Relock json to 2.21.2 in Gemfile.lock and appraisal lockfiles that still carried a vulnerable pin.
+- Relock sqlite3 to 2.9.6 where the test graph still pinned an affected line, and raise the development gemspec floor to >= 2.9.6 when this gemspec declared sqlite3.
+- Keep json on the 2.x line in library and appraisal locks because rubocop declares json ~> 2.3.
+- Leave Dependabot bundler at directory /. Appraisal lockfiles stay on the CI security matrix.
+
+## Effects
+
+- CI bundler-audit jobs that failed on CVE-2026-71847 and GHSA-mwm8-39rw-8826 now have patched pins in the lockfiles touched this pass.
+- CHANGELOG.md was not given an Unreleased bullet. This is a lockfile and development-graph refresh, not a public gem contract change.
+
+## Source
+
+- usr/docs/issues/20260907141000_engineering-and-dependency-audit.md
+- usr/docs/dependencies/20260907141000_json-cve-2026-71847.md
+- usr/docs/dependencies/20260907141000_sqlite3-ghsa-mwm8-39rw-8826.md

data/docs/changelogs/20260921103000_mutation-attribute-allowlists.md

@@ -0,0 +1,24 @@
+# Mutation attribute allowlists
+
+## Participants
+
+Andrei Makarov
+
+## Decisions
+
+Ship RFC 0006 as Proposed with running request specs. CHANGELOG Unreleased names the four graphql DSL methods and the RFC number.
+
+## Effects
+
+Consumers can keep query fields such as timestamps and derived columns while listing authored keys on create and update inputs. Default schema is unchanged.
+
+Later pass 2026-09-21: CHANGELOG Unreleased names permit_params and nested create / update, not create_only.
+
+## Next
+
+0.3.0 metadata includes the graphql 2.6.9 floor and ActiveAdmin 4 Rails 8 matrix. Downstream apps replace initializer patches with graphql permit_params and keep their introspection regression spec after the gem is tagged.
+
+## Source
+
+usr/docs/issues/20260921103000_mutation-attribute-allowlists.md
+rfcs/0006-mutation-permit-params.md

data/docs/changelogs/20260921111000_release-0-3-0.md

@@ -0,0 +1,42 @@
+# Release 0.3.0 metadata
+
+## Participants
+
+Andrei Makarov
+
+## Decisions
+
+Cut 0.3.0, not 0.2.2. Default create and update inputs omit created_at and updated_at unless listed on permit_params. That is a GraphQL schema break for clients that sent those fields on 0.2.1.
+
+CHANGELOG 0.3.0 dated 2026-09-21. Version constant is 0.3.0. Path gem pins in Gemfile.lock and appraisal lockfiles match.
+
+RFC 0006 stays Proposed until 2026-10-05 lazy consensus. Shipping the implementation does not close that window.
+
+make release (usr/bin/release.rb) still owns gem build, gem push, git tag, and GitHub release. This pass only prepares metadata.
+
+## Effects
+
+lib/active_admin/graphql/version.rb VERSION is 0.3.0.
+
+CHANGELOG Unreleased bullets moved under 0.3.0. BREAKING line names the timestamp omission.
+
+PATH specs for activeadmin-graphql in Gemfile.lock, gemfiles/rails72.gemfile.lock, gemfiles/rails8ruby4.gemfile.lock, and gemfiles/rails8ruby34.gemfile.lock are 0.3.0.
+
+## Next
+
+Run make release from a clean tree when ready to push the gem and tag 0.3.0.
+
+## Later pass 2026-09-21
+
+0.3.0 is still unpublished. RubyGems latest is 0.2.1. Git tags stop at 0.2.1. Fold the post-cut Unreleased work into 0.3.0 instead of cutting 0.3.1.
+
+CHANGELOG 0.3.0 now also names BREAKING graphql-ruby 2.6.9 and the ActiveAdmin 4.0.0.beta23 Rails 8 test matrix. Lockfile graphql is 2.6.10. Gemspec floor is graphql >= 2.6.9. Development lint (drop standard, Metrics/FileLength) stays out of CHANGELOG.md.
+
+## Source
+
+usr/docs/issues/20260921103000_mutation-attribute-allowlists.md
+usr/docs/issues/20260921104400_convention-alignment-audit.md
+usr/docs/changelogs/20260921103000_mutation-attribute-allowlists.md
+usr/docs/changelogs/20260921120000_graphql-floor-and-activeadmin-4.md
+rfcs/0006-mutation-permit-params.md
+usr/bin/release.rb

data/docs/changelogs/20260921112800_drop-standard-rubocop-direct.md

@@ -0,0 +1,35 @@
+## Participants
+
+Andrei Makarov
+
+## Decisions
+
+Drop the standard gem. Lint stays on rubocop with a snapshot of standard 1.56.0 config/base.yml plus standard-custom, standard-performance, and standard-rails.
+
+Raise the development rubocop floor to ~> 1.91. That gem allows json >= 2.3.
+
+Keep json on 2.21.2. Rails 8.1.3.1 and 7.2.3.2 ActiveSupport::JSON.decode still pass a positional options hash to JSON.parse, which json 3 rejects. Pin development json >= 2.21.2, < 3 until a Rails release includes rails/rails#58601.
+
+## Effects
+
+make lint: bundle exec rubocop, 86 files inspected, 5 Metrics/FileLength info offenses, no failing offenses. bundle exec rbs validate succeeded.
+
+bundle exec rspec: 106 examples, 0 failures on json 2.21.2.
+
+bundle-audit check --gemfile-lock on Gemfile.lock, gemfiles/rails72.gemfile.lock, gemfiles/rails8ruby34.gemfile.lock, and gemfiles/rails8ruby4.gemfile.lock: No vulnerabilities found.
+
+json 3.0.2 in the same graphs made GraphQL request specs fail with Invalid JSON (ParseError wrapping ArgumentError given 2, expected 1). Relocked 2.21.2.
+
+CHANGELOG.md Unreleased was not given a bullet. This is development lint and lockfile work.
+
+## Next
+
+Drop the json < 3 development pin after a Rails release that includes rails/rails#58601, then bundle update json.
+
+## Source
+
+usr/docs/dependencies/20260907141000_json-cve-2026-71847.md
+usr/docs/dependencies/20260921114000_rails-json-parse-kwargs.md
+usr/docs/issues/20260921114500_dependency-audit.md
+https://github.com/standardrb/standard/blob/v1.56.0/config/base.yml
+https://github.com/rails/rails/pull/58601

data/docs/changelogs/20260921120000_graphql-floor-and-activeadmin-4.md

@@ -0,0 +1,41 @@
+## Participants
+
+Andrei Makarov
+
+## Decisions
+
+Raise the published graphql-ruby floor from >= 2.3 to >= 2.6.9 so consumers cannot resolve GHSA-rmxg-5p3r-j6hh. Lock graphql 2.6.10.
+
+Pin ActiveAdmin 4.0.0.beta23 on the Rails 8 appraisal gemfiles. Keep ActiveAdmin 3.5.2 on Rails 7.2 and on the root Gemfile.lock. Hosts must pin the ActiveAdmin 4 prerelease themselves.
+
+Apply patch-level lockfile updates: rack 3.2.7, zeitwerk 2.8.3, responders 3.2.1, net-imap 0.6.7, net-protocol 0.4.0 (with net-imap), bigdecimal 4.1.3, erb 6.0.7, unicode-display_width 3.3.0, unicode-emoji 4.3.0, polyrun 2.2.4, parallel_tests 5.8.0, sprockets 4.4.1, rbs 4.2.0, parallel 2.2.0, io-console 0.9.4, reline 0.7.0.
+
+Leave json 2.21.2. Standard 1.56.0 still pins rubocop ~> 1.88.0, which pins json ~> 2.3.
+
+## Effects
+
+bundle-audit check --gemfile-lock on Gemfile.lock, gemfiles/rails72.gemfile.lock, gemfiles/rails8ruby34.gemfile.lock, and gemfiles/rails8ruby4.gemfile.lock: No vulnerabilities found.
+
+make lint: bundle exec rubocop, 84 files inspected, no offenses detected. bundle exec rbs validate succeeded.
+
+bundle exec rspec: 102 examples, 0 failures (ActiveAdmin 3.5.2). BUNDLE_GEMFILE=gemfiles/rails72.gemfile bundle exec rspec: 102 examples, 0 failures. BUNDLE_GEMFILE=gemfiles/rails8ruby34.gemfile bundle exec rspec: 102 examples, 0 failures (ActiveAdmin 4.0.0.beta23). BUNDLE_GEMFILE=gemfiles/rails8ruby4.gemfile bundle exec rspec: 102 examples, 0 failures (ActiveAdmin 4.0.0.beta23).
+
+CHANGELOG Unreleased names the graphql floor and the ActiveAdmin 4 test matrix. Lockfile-only patches stay out of CHANGELOG.md.
+
+## Next
+
+Wait for a Rails release that includes rails/rails#58601 before json 3. The standard gem is no longer in the graph.
+
+Folded into unpublished 0.3.0. Tag and gem push wait on make release.
+
+## Later pass 2026-09-21
+
+Dropped standard. Locked rubocop 1.91.0. json stayed 2.21.2 because Rails decode still uses positional JSON.parse options. See usr/docs/changelogs/20260921112800_drop-standard-rubocop-direct.md.
+
+## Source
+
+usr/docs/issues/20260921114500_dependency-audit.md
+usr/docs/dependencies/20260921114500_graphql-ghsa-rmxg-5p3r-j6hh.md
+https://github.com/rmosolgo/graphql-ruby/security/advisories/GHSA-rmxg-5p3r-j6hh
+https://github.com/activeadmin/activeadmin/blob/master/UPGRADING.md
+https://github.com/standardrb/standard/blob/main/standard.gemspec

data/docs/changelogs/20261010101500_nonconventional-id-fields.md

@@ -0,0 +1,34 @@
+# Nonconventional id fields
+
+## Effects
+
+Schema build no longer raises `GraphQL::Schema::DuplicateNamesError` when a
+registered model has an `id` column that is not the ActiveRecord primary key
+(`self.primary_key = nil`) or uses a non-`id` primary key.
+
+`ActiveAdmin::PrimaryKey` falls back to an `id` column when the declared
+primary key is blank. Object types skip emitting a column field named `id`
+(interface owns GraphQL `id`) and expose a single non-`id` primary-key column
+as a readable scalar unless the resource's attribute configuration omits it.
+Models with neither a primary key nor an `id` column fail schema build with an
+`ArgumentError` that asks for `self.primary_key`. Inferred `id` values must be
+unique and non-null; ambiguous member and batched lookups fail closed.
+
+Member lookup uses the inferred column while preserving an explicitly
+configured ActiveAdmin finder. Request-local policy caching keeps separate
+entries for distinct records when ActiveRecord has no declared primary key.
+
+Dummy coverage includes SQLite views that project `code AS id` and
+`id AS row_key`, plus a table with an `id` column and no primary key.
+
+## Next
+
+Folded into 0.3.1 release metadata. Tag and gem push wait on make release.
+
+## Source
+
+- Specs: `spec/requests/graphql_identity_columns_spec.rb`,
+  `spec/unit/primary_key_identity_spec.rb`,
+  `spec/unit/resource_query_proxy_identity_spec.rb`,
+  `spec/unit/policy_set_cache_spec.rb`
+- Views: `spec/dummy/db/schema.rb` (`string_id_records`, `alternate_key_records`)

data/docs/changelogs/20261010103800_release-0-3-1.md

@@ -0,0 +1,32 @@
+# Release 0.3.1 metadata
+
+## Participants
+
+Andrei Makarov
+
+## Decisions
+
+Cut 0.3.1 after published 0.3.0. One user-visible fix: GraphQL identity for database views and nonconventional primary keys.
+
+CHANGELOG 0.3.1 dated 2026-10-10. Version constant is 0.3.1. Path gem pins in Gemfile.lock and appraisal lockfiles match.
+
+Docs-only and pray-tooling commits since 0.3.0 stay out of CHANGELOG.md.
+
+make release (usr/bin/release.rb) still owns gem build, gem push, git tag, and GitHub release. This pass only prepares metadata.
+
+## Effects
+
+lib/active_admin/graphql/version.rb VERSION is 0.3.1.
+
+CHANGELOG Unreleased bullet moved under 0.3.1.
+
+PATH specs for activeadmin-graphql in Gemfile.lock, gemfiles/rails72.gemfile.lock, gemfiles/rails8ruby4.gemfile.lock, and gemfiles/rails8ruby34.gemfile.lock are 0.3.1.
+
+## Next
+
+Run make release from a clean tree when ready to push the gem and tag 0.3.1.
+
+## Source
+
+docs/changelogs/20261010101500_nonconventional-id-fields.md
+usr/bin/release.rb

data/docs/dependencies/20260907141000_json-cve-2026-71847.md

@@ -0,0 +1,68 @@
+## Dependency
+
+- json (was below 2.21.2 on the 2.x line, now 2.21.2 in library and appraisal locks)
+- Constraint in this repo: development gemspec json >= 2.21.2, < 3. Transitive via activesupport. rubocop 1.91 allows json >= 2.3.
+- Lockfiles: Gemfile.lock and gemfiles/*.gemfile.lock where present
+
+## Symptom
+
+bundler-audit matches json 2.20.0 through 2.21.1 against CVE-2026-71847 / GHSA-9hj4-r449-hfvc. CI security jobs fail while that pin remains.
+
+## Evidence
+
+- Advisory: JSON::ResumableParser#partial_value use-after-free on truncated duplicate-key streams. Affected 2.20.0 through 2.21.1. Patched >= 2.21.2.
+- This library does not call JSON::ResumableParser or partial_value.
+
+## Suggested fix
+
+Upgrade lockfiles to json 2.21.2. Stay on 2.x while Rails ActiveSupport::JSON.decode still calls JSON.parse with a positional options hash.
+
+## Trigger
+
+- bundler-audit scanner match during the 2026-09-07 CI failure review.
+
+## Assessment target
+
+- CI and test graphs: Gemfile.lock and appraisal locks.
+- Published gem runtime: json is not a runtime gemspec dependency.
+
+## Advisory
+
+- CVE-2026-71847
+- GHSA-9hj4-r449-hfvc
+- CVSS 8.7 availability (CVSS:4.0). CISA KEV: not listed at the time of this record.
+
+## Status
+
+- CI and test graphs: fixed after lockfiles pin json 2.21.2.
+- Published gem execute path: not_affected. The advisory names ResumableParser#partial_value.
+
+## Applicability
+
+- Vulnerable component present in the pre-fix lockfiles below 2.21.2.
+- Exploit conditions require streaming parse through ResumableParser#partial_value on truncated duplicate-key input.
+
+## Priority
+
+- CI graph: high because bundler-audit fails the security job on version match.
+- Published gem execute path: low. Exploit conditions do not hold on JSON.parse paths.
+
+## Disposition
+
+- Upgrade to 2.21.2. Pin development json < 3 until Rails decode accepts json 3 keyword options.
+
+## Next
+
+- Keep the runtime gemspec free of json unless a later feature streams JSON through ResumableParser.
+- json 3.0.2 is blocked by Rails 8.1.3.1 and 7.2.3.2 ActiveSupport::JSON.decode (positional JSON.parse options). Drop the development json < 3 pin after a Rails release that includes rails/rails#58601, then bundle update json.
+
+## Later pass 2026-09-21
+
+Dropped the standard gem so rubocop 1.91 can resolve. That unblocked json 3 at the Bundler level. Dummy GraphQL request specs then failed: ActionDispatch::Http::Parameters::ParseError wrapping ArgumentError wrong number of arguments (given 2, expected 1). Relocked json 2.21.2 and added development gemspec json >= 2.21.2, < 3. See usr/docs/dependencies/20260921114000_rails-json-parse-kwargs.md.
+
+## Source
+
+- https://github.com/ruby/json/security/advisories/GHSA-9hj4-r449-hfvc
+- https://www.cve.org/CVERecord?id=CVE-2026-71847
+- usr/docs/issues/20260907141000_engineering-and-dependency-audit.md
+- usr/docs/dependencies/20260921114000_rails-json-parse-kwargs.md

data/docs/dependencies/20260907141000_sqlite3-ghsa-mwm8-39rw-8826.md

@@ -0,0 +1,62 @@
+## Dependency
+
+- sqlite3 (was at or below 2.9.5, now 2.9.6)
+- Development gemspec floor now >= 2.9.6 where this gemspec declared sqlite3
+- Dummy-app and test graph only. The published gem does not require sqlite3 at runtime.
+
+## Symptom
+
+bundler-audit matches sqlite3 <= 2.9.5 against GHSA-mwm8-39rw-8826. CI security jobs fail while that pin remains.
+
+## Evidence
+
+- Advisory: use-after-free in custom aggregate arguments when Database#create_aggregate, #create_aggregate_handler, or #define_aggregator takes two or more arguments over TEXT or BLOB values. Affected >= 1.4.0, <= 2.9.5. Patched 2.9.6.
+- This repository has no create_aggregate, create_aggregate_handler, or define_aggregator callers.
+
+## Suggested fix
+
+Upgrade lockfiles to sqlite3 2.9.6 and raise the development gemspec floor so later resolves stay on the patched line.
+
+## Trigger
+
+- bundler-audit scanner match during the 2026-09-07 CI failure review.
+
+## Assessment target
+
+- CI and test graphs: dummy SQLite used by specs and appraisal.
+- Published gem runtime: sqlite3 is a development dependency only.
+
+## Advisory
+
+- GHSA-mwm8-39rw-8826
+- Maintainers: Medium, CVSS 4.0 score 6.3
+- CISA KEV: not listed at the time of this record.
+
+## Status
+
+- CI and test graphs: fixed after lockfiles pin sqlite3 2.9.6.
+- Published gem runtime: not_affected. Component not present in the published gem runtime.
+
+## Applicability
+
+- Vulnerable component present in the pre-fix development lockfiles at or below 2.9.5.
+- Exploit conditions require custom multi-arg aggregates. Those APIs are absent from this tree.
+
+## Priority
+
+- CI graph: medium because bundler-audit fails the security job on version match.
+- Published gem runtime: none. sqlite3 is not shipped to consumers of the gem.
+
+## Disposition
+
+- Upgrade. Prefer bundle lock --update=sqlite3 --conservative. Raise the development gemspec floor to >= 2.9.6 when sqlite3 is declared there.
+
+## Next
+
+- Keep sqlite3 as a development dependency.
+
+## Source
+
+- https://github.com/sparklemotion/sqlite3-ruby/security/advisories/GHSA-mwm8-39rw-8826
+- https://github.com/sparklemotion/sqlite3-ruby/releases/tag/v2.9.6
+- usr/docs/issues/20260907141000_engineering-and-dependency-audit.md

data/docs/dependencies/20260921114000_rails-json-parse-kwargs.md

@@ -0,0 +1,61 @@
+## Dependency
+
+- activesupport / rails (locked 8.1.3.1 on Rails 8 appraisals and the root Gemfile.lock; 7.2.3.2 on rails72)
+- json 3.0.2 (RubyGems latest as of 2026-09-09) versus development pin json >= 2.21.2, < 3
+- Constraint in this repo: development gemspec only. json is not a runtime gemspec dependency.
+
+## Symptom
+
+With json 3.0.2, dummy GraphQL request specs that POST application/json fail with HTTP 400 and body errors message Invalid JSON. Rails raises ActionDispatch::Http::Parameters::ParseError. The cause is ArgumentError: wrong number of arguments (given 2, expected 1) from JSON.parse.
+
+## Evidence
+
+- json 3.0.0.rc1 (2026-08-11): JSON methods take keyword options, or options checked like keywords. A positional second Hash is no longer accepted by JSON.parse.
+- ActiveSupport::JSON.decode in Rails 8.1.3.1 and 7.2.3.2 still calls JSON.parse(json, options) with a positional Hash. ActionDispatch JSON parameter parsing uses that decoder.
+- This library's controller uses JSON.parse(body) with one argument. That call works on json 3. The dummy app fails before execute because Rails parses the request first.
+- rails/rails#58601 merged 2026-08-28 (commit 0ca2c2c4cfbe7f0a709bca0589d2d74c1853ef27). It is not in 8.1.3.1 or 7.2.3.2.
+
+## Suggested fix
+
+Keep json on 2.21.2 in this repo's lockfiles until a Rails release includes the decode kwargs change. Then drop the development json < 3 pin and bundle update json.
+
+Do not monkeypatch JSON.parse or ActiveSupport::JSON.decode in this library.
+
+## Trigger
+
+- bundle exec rspec after dropping the standard gem and resolving json 3.0.2. 71 request examples failed with Invalid JSON.
+
+## Assessment target
+
+- CI and test graphs: dummy Rails app used by spec/requests.
+- Published gem execute path: JSON.parse of the request body with one argument.
+
+## Status
+
+- CI and test graphs: affected on json 3 with Rails 8.1.3.1 and 7.2.3.2. fixed after the development pin json < 3 and lockfiles at 2.21.2.
+- Published gem execute path: not_affected for this ArgumentError. The one-argument JSON.parse path does not pass a positional options hash.
+
+## Applicability
+
+- Vulnerable component present: json 3 plus unreleased Rails decode.
+- Exploit conditions: not a security advisory. Dummy JSON POST cannot complete parameter parsing.
+
+## Priority
+
+- CI graph: high because request specs fail on every GraphQL POST.
+- Published gem execute path: low until a host on json 3 and unpatched Rails hits the same decoder.
+
+## Disposition
+
+- Pin. development gemspec json >= 2.21.2, < 3. Wait for a Rails patch release that includes rails/rails#58601.
+
+## Next
+
+- Watch Rails 8.1 / 7.2 patch notes for the json 3 decode kwargs fix. Then drop the json < 3 development pin and lock json 3.0.2 or newer.
+
+## Source
+
+- https://github.com/rails/rails/pull/58601
+- https://github.com/ruby/json/blob/v3.0.2/CHANGES.md
+- usr/docs/dependencies/20260907141000_json-cve-2026-71847.md
+- usr/docs/issues/20260921114500_dependency-audit.md

data/docs/dependencies/20260921114500_graphql-ghsa-rmxg-5p3r-j6hh.md

@@ -0,0 +1,69 @@
+## Dependency
+
+- graphql (was 2.6.7, now 2.6.10 in Gemfile.lock and gemfiles/*.gemfile.lock; latest on RubyGems 2.6.10, published 2026-08-27)
+- Constraint in this repo: gemspec add_runtime_dependency graphql >= 2.6.9
+- Lockfiles: Gemfile.lock, gemfiles/rails72.gemfile.lock, gemfiles/rails8ruby34.gemfile.lock, gemfiles/rails8ruby4.gemfile.lock
+
+## Symptom
+
+bundle-audit matches graphql 2.6.7 against GHSA-rmxg-5p3r-j6hh on every lockfile. Solution text: update to >= 2.6.9.
+
+## Evidence
+
+- Advisory: GraphQL::Language::Cache#fetch reads parser cache files and passes contents to Marshal.load without authenticating payloads. If an attacker can place a crafted file on the expected path and the process calls GraphQL::Language::Parser.parse_file, attacker-controlled marshal_load or _load runs in the process.
+- Affected versions: >= 1.12.6. Patched: 2.6.9. Latest registry version 2.6.10 is a later 2.6 patch (dataloader, parser, Execution::Next fixes). No CVE id on the GitHub advisory page as of 2026-09-21.
+- This tree has no parse_file, parser_cache, or GraphQL::Language::Cache callers. Schema cache in ActiveAdmin::GraphQL is an in-process class cache, not the parser cache.
+- Related older advisory GHSA-j7xr-4g94-r9h3 (Execution::Next authorization bypass) is patched in >= 2.6.6. Lockfiles already sit above that floor. The gemspec floor >= 2.3 still allows those versions for downstream resolvers.
+
+## Suggested fix
+
+Upgrade every lockfile to graphql 2.6.10. Raise the gemspec runtime floor to >= 2.6.9 so consumers cannot resolve the Marshal cache versions. Stay on 2.6; 2.6.10 changelog has no breaking-change heading.
+
+## Trigger
+
+- bundle-audit check against ruby-advisory-db commit 44784c295391577f25d198a9205eae4ba73ec4da (last updated 2026-09-16) during the 2026-09-21 dependency audit.
+
+## Assessment target
+
+- CI and test graphs: Gemfile.lock and appraisal locks.
+- Published gem execute path: graphql is a direct runtime dependency. Exploit conditions require Parser.parse_file plus a writable parser cache path.
+- Downstream products that resolve this gemspec: unassessed as unnamed consumers.
+
+## Advisory
+
+- GHSA-rmxg-5p3r-j6hh
+- CWE-502
+- Vendor severity High. bundler-audit criticality Unknown. No CVE. CISA KEV: not listed (no CVE id).
+- Related: GHSA-j7xr-4g94-r9h3, patched >= 2.6.6, lockfiles already 2.6.7.
+
+## Status
+
+- CI and test graphs: fixed after lockfiles pin graphql 2.6.10 and the gemspec floor is >= 2.6.9.
+- Published gem execute path: not_affected. Vulnerable code not in the execute path of this library or dummy app.
+
+## Applicability
+
+- Vulnerable component present: graphql 2.6.7 is a direct runtime gem.
+- Exploit conditions: attacker-controlled parser cache file plus Parser.parse_file. Those APIs are absent from lib/ and spec/.
+
+## Priority
+
+- CI graph: high because bundle-audit fails on every lockfile.
+- Published gem execute path: low. This library does not enable the parser cache.
+- Downstream resolvers: medium until the gemspec floor moves. Consumers who set config.graphql.parser_cache = true on graphql < 2.6.9 meet the advisory conditions.
+
+## Disposition
+
+- Upgrade. bundle lock --update=graphql on the root Gemfile and each appraisal gemfile. Raise spec.add_runtime_dependency graphql to >= 2.6.9.
+
+## Next
+
+- Keep the gemspec floor at graphql >= 2.6.9. Do not drop it back to 2.3.
+
+## Source
+
+- https://github.com/rmosolgo/graphql-ruby/security/advisories/GHSA-rmxg-5p3r-j6hh
+- https://rubysec.com/advisories/GHSA-rmxg-5p3r-j6hh/
+- https://github.com/rmosolgo/graphql-ruby/blob/master/CHANGELOG.md (2.6.9 security note, 2.6.10 patch notes)
+- https://rubysec.com/advisories/GHSA-j7xr-4g94-r9h3/
+- usr/docs/issues/20260921114500_dependency-audit.md

data/docs/dependencies/20261007161308_association-list-combobox.md

@@ -0,0 +1,23 @@
+## Dependency
+
+activeadmin-graphql (this gem). List queries already expose paginated Ransack q, order, and first or last.
+
+## Symptom
+
+The gem has no Formtastic or Stimulus association picker that queries those lists as the person types. Hosts that need searchable associations either embed full catalogs in select or datalist, or keep a local combobox.
+
+## Evidence
+
+Schema and docs describe list fields with the same filter contract as the JSON index. There is no shipped input or controller that posts first and q, keeps a label plus hidden id, and replaces a bounded page on further typing.
+
+## Suggested fix
+
+When a second host needs the same control, or when packaging is requested, ship a Formtastic input and Stimulus controller that take GraphQL field name, node selection fields, search key, order, first, and optional extra q. Do not bake product model names into the gem. Keep host field maps and labels in the host. Until then, leave pickers host-local. Do not publish a third gem only for this picker.
+
+## Next
+
+Open an issue or pull request for the generic picker when packaging is requested. Index filter sidebars and multi-select include or exclude catalogs are out of scope for that first slice. Loading and error states, multi-select, and filter-sidebar wiring remain open after a first single-select page.
+
+## Source
+
+- docs/graphql-api.md list query contract

data/docs/graphql-api.md

@@ -223,6 +223,19 @@ mutation keys. `permit_params` and nested `create` / `update` blocks narrow
 create and update inputs without hiding query fields. Default mutation inputs
 omit `created_at` and `updated_at`.
 
+### Nonconventional primary keys
+
+GraphQL `id` always comes from `ActiveAdminResource` (`ID!`). An ActiveRecord
+`id` column is never added as a second field. When `self.primary_key` is blank
+but the model still has an `id` column (common for database views that project
+`… AS id`), that column supplies the GraphQL `id` value. When the model has
+neither a primary key nor an `id` column, schema build raises until you set
+`self.primary_key` on the model (for example a view keyed by `row_key`). A
+single-column primary key named something other than `id` is also exposed as
+its own readable field beside `id`, unless `only` or `exclude` omits it. An
+inferred `id` column must contain a unique, non-null value for every row;
+ambiguous member and batched lookups fail instead of selecting one row.
+
 ### Composite primary keys (Rails 7.1+)
 
 For models with `self.primary_key = [:book_code, :seq]` (and no separate `id`

data/docs/issues/20260907141000_engineering-and-dependency-audit.md

@@ -0,0 +1,30 @@
+Recorded 2026-09-07. Library gem. Scheduled CI bundler-audit failed on json CVE-2026-71847 and, where present, sqlite3 GHSA-mwm8-39rw-8826.
+
+## Participants
+
+- amkisko
+
+## Decisions
+
+- Bump json to 2.21.2 in Gemfile.lock and appraisal lockfiles. Keep json on 2.x because rubocop declares json ~> 2.3.
+- Bump sqlite3 to 2.9.6 in the test graph where the pin was still affected. Raise the development gemspec floor to >= 2.9.6 when this gemspec declared sqlite3.
+- Treat CVE-2026-71847 as not_affected for this gem execute path. The advisory names JSON::ResumableParser#partial_value.
+- Treat GHSA-mwm8-39rw-8826 as not_affected for the published gem runtime when sqlite3 is development-only. Still bump the test graph so bundler-audit can pass.
+- Leave Dependabot bundler at directory /. Appraisal *.gemfile names are not a working Dependabot directory.
+
+## Effects
+
+- Root and appraisal lockfiles pin json 2.21.2. sqlite3 pins 2.9.6 where that gem was in the graph.
+- Dependency records live under usr/docs/dependencies.
+
+## Next
+
+- Appraisal lockfiles stay outside Dependabot directory /. Keep CI bundler-audit as the gate unless a later pass finds a supported Dependabot layout for those files.
+
+## Source
+
+- usr/docs/changelogs/20260907141000_advisory-lockfile-refresh.md
+- usr/docs/dependencies/20260907141000_json-cve-2026-71847.md
+- usr/docs/dependencies/20260907141000_sqlite3-ghsa-mwm8-39rw-8826.md
+- https://github.com/ruby/json/security/advisories/GHSA-9hj4-r449-hfvc
+- https://github.com/sparklemotion/sqlite3-ruby/security/advisories/GHSA-mwm8-39rw-8826

data/docs/issues/20260917123253_ci-drop-automatic-dependency-audit.md

@@ -0,0 +1,29 @@
+CI quality failed on a trailing blank line in spec/support/junit_formatter.rb. Test CI also ran bundler-audit or osv-scanner, which fail whenever an advisory lands even when a separate dependency audit already exists.
+
+## Participants
+
+- amkisko
+
+## Decisions
+
+- Drop bundler-audit and security jobs from test.yml so tests no longer wait on advisory freshness.
+- Drop the advisory osv-scanner job from test.yml.
+- Add dependency-audit.yml with workflow_dispatch only. Do not run it on push, pull request, or schedule.
+- Disable osv-scanner in Trunk Check.
+- Disable markdownlint MD013 in .markdownlint.yaml. Keep AGENTS.md in Trunk so other markdownlint rules still run.
+- Keep lockfile and spec fixes that were already blocking quality or tests.
+
+## Effects
+
+- Test CI runs lint and specs without an advisory gate.
+- Trunk Check no longer treats dependency CVEs as a required check.
+- On-demand bundler-audit of every Gemfile.lock is available through workflow_dispatch.
+
+## Next
+
+- Run dependency audit on demand when a release or a known advisory needs it.
+- Do not reintroduce advisory scanners into test.yml.
+
+## Source
+
+- GitHub Actions test and Trunk Check failures on 2026-09-17

data/docs/issues/20260921103000_mutation-attribute-allowlists.md

@@ -0,0 +1,40 @@
+# Mutation attribute allowlists
+
+## Participants
+
+Andrei Makarov
+
+## Decisions
+
+RFC 0006 Proposed adds assignable, create_only, update_only, and except_assignable (alias unassignable) on the per-resource graphql block.
+
+only and except stay the readable ceiling. Mutation lists intersect that set and cannot widen it.
+
+Default create and update inputs stay the current assignable column set, including timestamps. Changing that default would break clients.
+
+ResourceQueryProxy#build_new still permits graphql_assignable_attribute_names so a resolve_create hook can set server-owned readable columns. The GraphQL input type and the mutation resolver slice use the mutation lists.
+
+## Effects
+
+Request spec spec/requests/graphql_mutation_allowlists_spec.rb failed first: six examples raised NoMethodError on the new DSL. Default examples passed and showed PostCreateInput includes created_at, updated_at, and starred, and that create_post persists a client-supplied created_at of 2020-01-02T03:04:05Z.
+
+After the implementation that spec file: 8 examples, 0 failures (bundle exec rspec spec/requests/graphql_mutation_allowlists_spec.rb).
+
+Claims from the downstream dependency note, checked in this tree at version 0.2.1:
+
+1. Gem version is 0.2.1. Source: lib/active_admin/graphql/version.rb VERSION = "0.2.1". Outcome: supported.
+2. Generated create and update inputs expose every assignable database column. Source: ActiveAdmin::Resource#default_attributes walks resource_class.columns minus primary key, STI, counter cache, and application filter_attributes (encrypted_password, password, password_confirmation). SchemaBuilder TypesInputs used graphql_assignable_attribute_names for both input types. Dummy PostCreateInput in the new spec includes title, body, starred, created_at, updated_at. Outcome: supported for ActiveAdmin resource_attributes, not every SQL column in the abstract (filtered password columns stay out).
+3. The package mutations therefore accepted calculated values and internal timestamps that the server owns. Source: the same spec persisted created_at on create. Package column names (budget status, velocity, usage totals) are not in this repository. Outcome: supported for timestamps on Post; unverifiable for named Package columns.
+4. only limits output fields, so it cannot express a mutation-only allowlist without hiding fields from queries. Source: attributes_for_graphql applies only_attributes and exclude_attributes; types_object and graphql_assignable_attribute_names both use that list. Outcome: supported.
+5. The schema builder derives both mutation inputs from graphql_assignable_attribute_names and provides no separate create or update configuration. Source: types_inputs.rb before this change; ResourceConfig had only_attributes and exclude_attributes only. Outcome: supported for 0.2.1; outdated after RFC 0006 ships.
+6. The application resolves the gem from its published package and records it in Gemfile.lock. Source: not this repository. Outcome: unverifiable here.
+
+## Next
+
+Keep RFC 0006 Proposed until 2026-10-05 lazy consensus. 0.3.0 metadata includes the graphql 2.6.9 floor and ActiveAdmin 4 Rails 8 matrix; tag and gem push wait on make release.
+
+Later pass 2026-09-21: DSL renamed to ActiveAdmin permit_params with nested create and update blocks. create_only, update_only, assignable, and except_assignable were dropped before release. Spec path is spec/requests/graphql_mutation_permit_params_spec.rb. RFC file is rfcs/0006-mutation-permit-params.md. Default mutation inputs omit created_at and updated_at.
+
+## Source
+
+Downstream dependency note that described PackageCreateInput. RFC 0004. lib/active_admin/graphql/integration.rb. lib/active_admin/graphql/schema_builder/types_inputs.rb. vendor activeadmin-3.5.2 lib/active_admin/resource/attributes.rb and application_settings.rb filter_attributes. spec/requests/graphql_mutation_allowlists_spec.rb.

data/docs/issues/20260921104400_convention-alignment-audit.md

@@ -0,0 +1,60 @@
+# Convention alignment engineering audit
+
+## Participants
+
+Andrei Makarov
+
+## Decisions
+
+Mutation write lists use ActiveAdmin permit_params. Per-operation lists live in nested create and update blocks with graphql-ruby resolve pairing, matching member_action_mutation. create_only, update_only, assignable, except_assignable, and unassignable are not in the public DSL.
+
+Empty GraphQL input objects call has_no_arguments(true) so graphql-ruby 2.6 does not warn toward a future raise.
+
+HTML permit_params is copied when the HTML call is a static argument list. A request-time block is not copied.
+
+Default mutation inputs omit created_at and updated_at unless listed on permit_params.
+
+destroy_post is registered as an alias of delete_post. graphql_name is an alias of type_name.
+
+Failed save and update raise GraphQL::ExecutionError with extensions.errors. CRUD fields still return the resource object.
+
+GraphqlController logs namespace, operation name, and error_count without the query body or current user.
+
+ResourceMethods lives in lib/active_admin/graphql/resource_methods.rb.
+
+## Effects
+
+First pass used create_only. Second pass replaced it after a convention check against graphql-ruby 2.6.7, Rails 8.1 nested_attributes update_only, upsert_all update_only, and ActiveAdmin 3.5.2 permit_params.
+
+bundle exec rspec spec/requests/graphql_mutation_permit_params_spec.rb: 8 examples, 0 failures after the rename.
+
+## Findings
+
+Severity high. Confidence high. Location SchemaBuilder TypesInputs default create and update inputs. Why it matters: extra-field write of created_at on create, observed in spec/requests/graphql_mutation_permit_params_spec.rb. Evidence kind observed. Security disposition confirmed. Smallest credible fix: graphql { permit_params :title, :body } in the host app. Deeper fix: omit created_at and updated_at from default mutation inputs in a later RFC, matching ActiveAdmin generators/boilerplate.rb assignable_attributes.
+
+Severity medium. Confidence high. Location ResourceDefinitionDSL versus ActiveAdmin::ResourceDSL#permit_params. Why it matters: HTML and GraphQL write lists can drift. Evidence kind observed that GraphQL never calls HTML permit_params. Inference that a static argument list could be copied; confirming check is to parse the controller permitted_params method or store the original args on the resource. Smallest credible fix: document that graphql permit_params should match HTML. Deeper fix: seed GraphQL from a static HTML list when graphql permit_params is unset.
+
+Severity medium. Confidence high. Location mutation_update_destroy.rb delete_ prefix versus actions.include?(:destroy). Why it matters: Rails and ActiveAdmin name the action destroy; GraphQL field is delete_post. Evidence kind observed. Smallest credible fix: none in this RFC; shipped client contract. Deeper fix: RFC to add destroy_* alias or rename.
+
+Severity medium. Confidence high. Location mutation_create.rb returning the record and raising GraphQL::ExecutionError. Why it matters: graphql-ruby Schema::Mutation example returns hash with errors array. Evidence kind observed in graphql-2.6.7 lib/graphql/schema/mutation.rb. Smallest credible fix: none in this RFC. Deeper fix: payload type RFC.
+
+Severity low. Confidence high. Location ResourceDefinitionDSL#type_name versus graphql-ruby graphql_name. Why it matters: two names for the same idea. Evidence kind observed. Smallest credible fix: alias graphql_name. Deeper fix: deprecate type_name after a release.
+
+Severity low. Confidence high. Location ResourceDefinitionDSL#only versus ActiveAdmin action_item only: for controller actions. Why it matters: only already means attribute list in this gem since 0.2.1. Evidence kind observed. Smallest credible fix: keep only; document the split from ActiveAdmin action only.
+
+Severity low. Confidence high. Location GraphqlController, no request correlation log. Why it matters: host logs may not show which GraphQL operation failed. Evidence kind observed absence of log calls in graphql_controller.rb. Smallest credible fix: none required of a library; host can log. Deeper fix: optional around_action.
+
+Severity low. Confidence high. Location lib/active_admin/graphql/integration.rb line count 176. Why it matters: file is above the 150 line preference. Evidence kind observed. Smallest credible fix: extract ResourceMethods. Not done this pass.
+
+## Next
+
+Findings from the 2026-09-21 audit pass are addressed except replacing CRUD return types with graphql-ruby payload objects, which would break RFC 0004 field types. Keep RFC 0006 Proposed. 0.3.0 metadata includes the graphql 2.6.9 floor and ActiveAdmin 4 Rails 8 matrix; tag and gem push wait on make release.
+
+## Source
+
+rfcs/0006-mutation-permit-params.md
+spec/requests/graphql_mutation_permit_params_spec.rb
+vendor activeadmin-3.5.2 lib/active_admin/resource_dsl.rb permit_params
+vendor activerecord-8.1.3.1 lib/active_record/nested_attributes.rb update_only
+vendor graphql-2.6.7 lib/graphql/schema/mutation.rb
+usr/docs/issues/20260921103000_mutation-attribute-allowlists.md

data/docs/issues/20260921114500_dependency-audit.md

@@ -0,0 +1,90 @@
+# Dependency audit 2026-09-21
+
+Full audit: recon, security, freshness, ecosystem. Depth reached: full for hot-path direct packages; GitHub REST rate-limited after activeadmin, graphql-ruby, and ransack so remaining repo strain counts use registry dates, release pages, and fetched repo summaries.
+
+## Participants
+
+Andrei Makarov
+
+## Decisions
+
+Do not bump the whole graph to every registry latest. Hot-path and advisory matches first. Skip ActiveAdmin 4.0.0.beta23, json 3, arbre 2, inherited_resources 2, marcel 2, diff-lcs 2, and net-protocol 0.4. Those majors are either prerelease, pinned by ActiveAdmin 3.5.2, or required by rubocop json ~> 2.3.
+
+Upgrade graphql to 2.6.10 and raise the gemspec floor to >= 2.6.9. That is the only security-driven change from this pass.
+
+Optional same-pass lockfile patches with no major jump: rack 3.2.7, zeitwerk 2.8.3, responders 3.2.1, net-imap 0.6.7, bigdecimal 4.1.3, erb 6.0.7, unicode-display_width 3.3.0, unicode-emoji 4.3.0, polyrun 2.2.4, parallel_tests 5.8.0. rbs 4.2.0, io-console 0.9.4, reline 0.7.0, parallel 2.2.0, sprockets 4.4.1, and rubocop 1.91 sit behind Standard and Rails pins; bump only if those parents allow it.
+
+Keep sqlite3 2.9.6 and json 2.21.2. Those pins already match the 2026-09-07 advisory records.
+
+Stay on ActiveAdmin 3.5.2. It is the latest stable on RubyGems. 4.0.0.beta23 (2026-09-20) is prerelease and pulls arbre ~> 2.0 and inherited_resources ~> 2.0.
+
+Do not reverse the 2026-09-17 choice to keep bundle-audit off test.yml. The on-demand workflow remains the gate. Makefile still has no audit target that mirrors that workflow.
+
+## Effects
+
+ruby-advisory-db update: 1245 advisories, last updated 2026-09-16 10:35:37 -0400, commit 44784c295391577f25d198a9205eae4ba73ec4da.
+
+bundle-audit check failed on all four lockfiles with GHSA-rmxg-5p3r-j6hh (graphql 2.6.7, solution >= 2.6.9). No other scanner matches.
+
+bundle outdated --strict on the root Gemfile listed 16 outdated specs. graphql 2.6.7 vs 2.6.10 is the only outdated hot-path direct runtime gem.
+
+Libyears from Gemfile.lock vs RubyGems stable (compact-graph band: about 10 low, about 100 medium): 124 locked packages, 27 outdated, total lag 17.94 years, average 0.145 years per package, 6 packages one major behind (arbre, inherited_resources, json, marcel, diff-lcs, rubocop-capybara). Coverage floor in config/polyrun_coverage.yml is 85 percent line. No upgrade spike was run this pass.
+
+No person-facing surface in this pass.
+
+## Findings
+
+Tier hot path direct. Kind security. Severity high. Confidence high. Package graphql 2.6.7. Why it matters: Marshal.load of unauthenticated parser cache files is RCE when parse_file runs. Evidence kind observed (bundle-audit, GHSA text, repo grep with no parse_file). Sources: GHSA-rmxg-5p3r-j6hh, ruby-advisory-db. Smallest fix: lock 2.6.10 and gemspec >= 2.6.9. Deeper fix: none. Status: CI graphs affected; this library execute path not_affected. Disposition: upgrade. Next: apply when confirmed.
+
+Tier hot path direct. Kind freshness. Severity low. Confidence high. Package activeadmin 3.5.2 equals RubyGems stable latest (2026-07-13). Why it matters: 4.0.0.beta23 is a different major with arbre 2 and inherited_resources 2. Evidence kind observed (rubygems.org/gems/activeadmin). Watch: stay on 3.5.2 until a stable 4.0. Recon: github.com/activeadmin/activeadmin last push 2026-09-21, 9709 stars, 30 open issues, MIT, not archived.
+
+Tier hot path direct. Kind recon. Severity low. Confidence high. Package graphql locked 2.6.7, latest 2.6.10. Upstream rmosolgo/graphql-ruby last push 2026-09-17, 5445 stars, 63 open issues, MIT. Maintainer cluster: rmosolgo, protocol family graphql-ruby, already the runtime schema engine. Classification healthy. 2.6.10 changelog is patch-level after the 2.6.9 security fix.
+
+Tier hot path transitive. Kind ecosystem. Severity low. Confidence medium. Package kaminari 1.2.2. Why it matters: latest gem is still 1.2.2 from 2021-12-25 while GitHub last push is 2026-02-20 and several June 2026 PRs sit open. ActiveAdmin 3.5.2 and 4.0.0.beta23 still depend on kaminari >= 1.2.1. Evidence kind observed (rubygems version date, github.com/kaminari/kaminari). Watch, not a CVE. Cannot upgrade independently of ActiveAdmin.
+
+Tier hot path transitive. Kind freshness. Severity low. Confidence high. Packages arbre 1.7.0 (latest 2.2.1) and inherited_resources 1.14.0 (latest 2.1.0). Why it matters: ActiveAdmin 3.5.2 pins arbre ~> 1.2 and inherited_resources ~> 1.7. Evidence kind observed (Gemfile.lock activeadmin 3.5.2 dependencies). Do not force majors.
+
+Tier hot path transitive. Kind recon. Severity low. Confidence medium. Package ransack 4.4.1 equals latest (2025-09-29). github.com/activerecord-hackery/ransack last push 2026-05-31, 5860 stars, 156 open issues (about 2.7 percent). Classification healthy. formtastic 6.0.0 equals latest (2026-02-20). has_scope 0.9.0 and jquery-rails 4.6.1 equal latest.
+
+Tier hot path transitive. Kind security. Severity low. Confidence high. Package rack 3.2.6 vs latest 3.2.7. Why it matters: April 2026 Rack CVEs (including GHSA-g2pf-xv49-m2h5 / CVE-2026-34835 and GHSA-h2jq-g4cq-5ppq / CVE-2026-34785) are patched in 3.2.6. 3.2.7 restores Ruby 2.4/2.5 compatibility only. Evidence kind observed (rack changelog 3.2.6 security section, 3.2.7 note). Status: not_affected for those CVEs at 3.2.6. Optional patch bump.
+
+Tier dev/test. Kind freshness. Severity low. Confidence high. json 2.21.2 vs 3.0.2 blocked by rubocop json ~> 2.3. sqlite3 2.9.6 is latest and matches GHSA-mwm8-39rw-8826. rails 8.1.3.1 and 7.2.3.2 match appraisal floors and are current on those lines. appraisal 2.5.0 equals latest (2023-07-14); stale but current.
+
+Tier automation. Kind automation gap. Severity low. Confidence high. Why it matters: Dependabot bundler directory / does not refresh gemfiles/*.gemfile.lock. scorecard.yml still pins actions/checkout 9c091bb (v7.0.0) while test.yml uses 3d3c42e5 (v7.0.1). ossf/scorecard-action 4eaacf05 is v2.4.3; v2.4.4 exists. mschilde/auto-label-merge-conflicts is commented as master. Makefile has no audit target. Evidence kind observed (workflow files, dependabot.yml). Smallest fix: optional action SHA refresh via Dependabot; keep appraisal locks in the on-demand audit. Do not put advisory scanners back on test.yml.
+
+## Next
+
+Wait for a Rails release that includes rails/rails#58601. Then drop the development json < 3 pin and bundle update json. Leave marcel 2 and diff-lcs 2 alone until those parents move.
+
+The standard gem is gone. Lint uses rubocop plus a snapshot of standard 1.56.0 rules.
+
+Optional: align scorecard.yml checkout SHA with v7.0.1.
+
+## Later pass 2026-09-21
+
+This gem is supposed to support ActiveAdmin 4. The first pass skipped the beta. That decision is reversed for the Rails 8 appraisals only.
+
+Decisions: pin ActiveAdmin 4.0.0.beta23 in gemfiles/rails8ruby34.gemfile and gemfiles/rails8ruby4.gemfile. Keep ActiveAdmin ~> 3.5, >= 3.5.2 on rails72. Raise graphql gemspec floor to >= 2.6.9 and lock 2.6.10. Apply the optional patch set. net-protocol 0.4.0 came in with net-imap 0.6.7. json stays 2.21.2.
+
+Rubocop and json 3 path: Standard 1.56.0 (latest, 2026-07-15) depends on rubocop ~> 1.88.0. Locked rubocop 1.88.2 depends on json ~> 2.3, which rejects json 3. RuboCop 1.91.0 depends on json >= 2.3, which allows json 3.0.2. graphql 2.6.8 already dropped quirks_mode for JSON 3. This library uses JSON.parse, JSON.generate, and JSON.dump(hash, buffer). json 3.0.1 restored the dump positional limit argument. Do not add a Gemfile rubocop override that fights Standard.
+
+Effects: bundle-audit check on all four lockfiles: No vulnerabilities found. make lint: 84 files, no offenses, rbs validate ok. bundle exec rspec: 102 examples, 0 failures on the root ActiveAdmin 3.5.2 bundle. BUNDLE_GEMFILE=gemfiles/rails72.gemfile bundle exec rspec: 102 examples, 0 failures. BUNDLE_GEMFILE=gemfiles/rails8ruby34.gemfile and gemfiles/rails8ruby4.gemfile: 102 examples, 0 failures each on ActiveAdmin 4.0.0.beta23. Dummy GraphQL request specs did not need cssbundling-rails or importmap-rails. AA4 HTML asset install is still a host-app concern.
+
+## Later pass 2026-09-21 drop standard
+
+Dropped the standard gem. Locked rubocop 1.91.0. json 3.0.2 failed dummy GraphQL POSTs through Rails JSON.decode. Kept json 2.21.2 with development gemspec json >= 2.21.2, < 3. See usr/docs/changelogs/20260921112800_drop-standard-rubocop-direct.md and usr/docs/dependencies/20260921114000_rails-json-parse-kwargs.md.
+
+## Source
+
+Commands: bundle-audit update; bundle-audit check --gemfile-lock on Gemfile.lock and gemfiles/*.gemfile.lock; bundle outdated --strict; RubyGems /api/v1/gems and /api/v1/versions for locked-vs-latest lag; GitHub REST /repos for activeadmin/activeadmin, rmosolgo/graphql-ruby, activerecord-hackery/ransack.
+
+https://github.com/rmosolgo/graphql-ruby/security/advisories/GHSA-rmxg-5p3r-j6hh
+https://rubygems.org/gems/activeadmin
+https://rubygems.org/gems/graphql
+usr/docs/dependencies/20260921114500_graphql-ghsa-rmxg-5p3r-j6hh.md
+usr/docs/dependencies/20260907141000_json-cve-2026-71847.md
+usr/docs/dependencies/20260907141000_sqlite3-ghsa-mwm8-39rw-8826.md
+usr/docs/dependencies/20260921114000_rails-json-parse-kwargs.md
+https://github.com/rails/rails/pull/58601
+usr/docs/issues/20260917123253_ci-drop-automatic-dependency-audit.md
+usr/docs/issues/20260907141000_engineering-and-dependency-audit.md

data/docs/issues/20260921115500_file-length-metrics.md

@@ -0,0 +1,31 @@
+# File length metrics
+
+## Participants
+
+Andrei Makarov
+
+## Decisions
+
+Per-file line count is Metrics/FileLength. RuboCop core does not ship that cop. The local cop counts physical source lines, including blanks and comments.
+
+WarnMax is 150 and reports as info. Max is 300 and reports as error. RuboCop fail-level is refactor, so a warning offense would fail make lint the same as an error. Info is the non-failing warning band. Error is the alert that fails the run.
+
+Class and module length stay at 200 with CountAsOne for array, hash, heredoc, and method_call. That sits between the preferred file size and the file alert. Complexity cops stay at cyclomatic 18, perceived 18, and AbcSize 35.
+
+spec/requests/graphql_spec.rb is over 300 lines. It has a file-level disable until that request matrix is split.
+
+## Effects
+
+bundle exec rspec spec/unit/file_length_cop_spec.rb: 4 examples, 0 failures.
+
+make lint: bundle exec rubocop, 86 files inspected, 5 info Metrics/FileLength offenses, exit 0. bundle exec rbs validate succeeded.
+
+## Next
+
+Split spec/requests/graphql_spec.rb so the disable can drop. Files in the info band at this pass: app/controllers/active_admin/graphql_controller.rb, lib/active_admin/graphql/integration.rb, lib/active_admin/graphql/resource_query_proxy/controller.rb, lib/active_admin/graphql/schema_builder/query_type_policies.rb, spec/requests/graphql_mutation_permit_params_spec.rb.
+
+## Source
+
+.rubocop.yml Metrics/FileLength, Metrics/ClassLength, Metrics/ModuleLength
+rubocop/cop/metrics/file_length.rb
+spec/unit/file_length_cop_spec.rb

data/docs/plan/20260817201500_rfc-starter.md

@@ -0,0 +1,31 @@
+# RFC starter pack
+
+## Participants
+
+Andrei Makarov
+
+## Decisions
+
+Pilot the portable RFC form: README, template, RFC 0001 Proposed, RFC 0002 Informational positioning, ids/0001 and ids/0002, CONTRIBUTING and GOVERNANCE pointers.
+
+Isolation is off. Sequential numbering. An RFC specifies a design. Version numbers belong in changelogs. Shipped design specified after the fact is Stable.
+
+## Effects
+
+Starter files written on plan/rfc-process. Process RFC remains Proposed until 2026-08-31.
+
+Later pass 2026-08-18: RFC 0002 marked as positioning. Types and statuses cite rfcs/README.md. Relates dropped from RFC 0002. Process text stays aligned with kiskolabs/pray RFC 0001 until that RFC is Stable.
+
+Later pass 2026-08-18: RFC 0002 rewritten with concrete problems, shipped solutions, and which surfaces need a later Standards Track RFC. RFC 0001 Motivation names those surfaces.
+
+Later pass 2026-08-18: as-built Informational RFCs added for each public contract named in RFC 0002. Describes stays on the current version. Status is Stable. RFC 0002 Relates those documents.
+
+Later pass 2026-08-18: product RFCs specify a design. Suggestion, motivation, specification, effects, alternatives, and prior art. Version numbers belong in changelogs. RFC 0002 stays Informational. RFC 0003 and later are Standards Track Stable. Describes dropped.
+
+## Next
+
+Discuss RFC 0001. Extract amkisko/rfc-process after kiskolabs/pray RFC 0001 is Stable. Replace this hand-copied pack if the prayer differs.
+
+## Source
+
+Upstream: kiskolabs/pray rfcs/0001-rfc-process.md and usr/docs/plan/20260817200400_library-rfc-adoption.md.

data/lib/active_admin/graphql/policy_set_cache.rb

@@ -53,7 +53,9 @@ module ActiveAdmin
           elsif subject.is_a?(ActiveAdmin::Page)
             "page:#{subject.name}"
           elsif subject.is_a?(ActiveRecord::Base)
-            "record:#{subject.class.name}:#{PrimaryKey.graphql_id_value(subject)}"
+            identity = PrimaryKey.graphql_id_value(subject)
+            identity = "#{identity}:object:#{subject.object_id}" if subject.class.primary_key.blank?
+            "record:#{subject.class.name}:#{identity}"
           else
             "object:#{subject.object_id}"
           end

data/lib/active_admin/graphql/record_source.rb

@@ -6,13 +6,14 @@ module ActiveAdmin
     class RecordSource < ::GraphQL::Dataloader::Source
       def initialize(model_class)
         @model_class = model_class
-        @pk = model_class.primary_key
+        @pk_columns = ActiveAdmin::PrimaryKey.columns(model_class)
+        @pk = ActiveAdmin::PrimaryKey.composite?(model_class) ? model_class.primary_key : @pk_columns.first
       end
 
       def fetch(ids)
         keys = normalized_keys(ids)
         uniq = keys.compact.uniq
-        return Array.new(ids.size) { nil } if uniq.empty?
+        return Array.new(ids.size) { nil } if uniq.empty? || @pk.nil?
 
         indexed = load_records(uniq)
         keys.map { |key| key.nil? ? nil : indexed[key] }

data/lib/active_admin/graphql/resource_query_proxy/identity.rb

@@ -0,0 +1,38 @@
+# frozen_string_literal: true
+
+module ActiveAdmin
+  module GraphQL
+    class ResourceQueryProxy
+      module Identity
+        private
+
+        def find_inferred_member(controller, model, id)
+          primary_key = ActiveAdmin::PrimaryKey.columns(model).first
+          raise ActiveRecord::RecordNotFound unless primary_key
+
+          records = controller.send(:scoped_collection).where(primary_key => id).limit(2).to_a
+          raise_ambiguous_id!(model) if records.size > 1
+
+          records.first || raise(ActiveRecord::RecordNotFound)
+        end
+
+        def index_records_by_id(relation, model, primary_key)
+          if model.primary_key.present?
+            return relation.index_by { |record| record.public_send(primary_key).to_s }
+          end
+
+          grouped = relation.to_a.group_by { |record| record.public_send(primary_key).to_s }
+          if grouped.any? { |_id, matches| matches.size > 1 }
+            raise_ambiguous_id!(model)
+          end
+
+          grouped.transform_values(&:first)
+        end
+
+        def raise_ambiguous_id!(model)
+          raise ::GraphQL::ExecutionError, "ambiguous GraphQL id for #{model.name}"
+        end
+      end
+    end
+  end
+end

data/lib/active_admin/graphql/resource_query_proxy.rb

@@ -4,14 +4,14 @@ require "rack/mock"
 require "stringio"
 
 require_relative "resource_query_proxy/controller"
+require_relative "resource_query_proxy/identity"
 
 module ActiveAdmin
   module GraphQL
-    # Reuses {ResourceController} data-access behaviour (+scoped_collection+, +find_collection+,
-    # +find_resource+, authorization scoping, Ransack, menu scopes, +sorting+, +includes+)
-    # so GraphQL list/detail mutations align with the HTML/JSON list and member REST endpoints.
+    # Reuses ResourceController data access so GraphQL operations align with the REST endpoints.
     class ResourceQueryProxy
       include Controller
+      include Identity
 
       def initialize(aa_resource:, user:, namespace:, graph_params: {})
         @aa_resource = aa_resource
@@ -26,7 +26,12 @@ module ActiveAdmin
 
       def find_member(id)
         extra = member_route_params_for_find(id)
-        controller_for("show", extra).send(:find_resource)
+        controller = controller_for("show", extra)
+        model = @aa_resource.resource_class
+        finder = controller.send(:method_for_find)
+        return controller.send(:find_resource) if model.primary_key.present? || finder != :find
+
+        find_inferred_member(controller, model, extra.fetch("id"))
       rescue ActiveRecord::RecordNotFound
         nil
       end
@@ -42,10 +47,10 @@ module ActiveAdmin
 
         controller = controller_for("index")
         relation = controller.send(:apply_authorization_scope, controller.send(:scoped_collection))
-        primary_key = model.primary_key.to_sym
-        indexed = relation.where(primary_key => string_ids).index_by do |record|
-          record.public_send(primary_key).to_s
-        end
+        primary_key = ActiveAdmin::PrimaryKey.columns(model).first&.to_sym
+        return string_ids.index_with { nil } if primary_key.nil?
+
+        indexed = index_records_by_id(relation.where(primary_key => string_ids), model, primary_key)
         string_ids.index_with { |identifier| indexed[identifier] }
       end
 

data/lib/active_admin/graphql/schema_builder/types_object.rb

@@ -83,12 +83,25 @@ module ActiveAdmin
           end
 
           pk_cols = ActiveAdmin::PrimaryKey.columns(model)
+          if pk_cols.empty?
+            raise ArgumentError,
+              "#{model.name} has no primary key for GraphQL `id`; set self.primary_key on the model"
+          end
 
           type_class.field :id, ::GraphQL::Types::ID, null: false, authorize: false
           type_class.define_method(:id) { ActiveAdmin::PrimaryKey.graphql_id_value(object) }
 
-          attr_names.each do |name|
-            next if pk_cols.include?(name) && pk_cols.size == 1
+          # ActiveAdmin omits a single-column primary key from resource_attributes; still expose
+          # non-id key columns as scalars (composite keys already remain in attributes).
+          # ActiveAdminResource owns GraphQL `id`; never emit a second field from an `id` column.
+          configured_pk_cols = pk_cols
+          if (only = aa_res.graphql_config.only_attributes)
+            configured_pk_cols &= only.map(&:to_s)
+          end
+          configured_pk_cols -= aa_res.graphql_config.exclude_attributes.map(&:to_s)
+          readable_names = (attr_names + configured_pk_cols).uniq
+          readable_names.each do |name|
+            next if name == "id"
 
             col = cols_by_name[name]
             next unless col

data/lib/active_admin/graphql/version.rb

@@ -2,6 +2,6 @@
 
 module ActiveAdmin
   module GraphQL
-    VERSION = "0.3.0"
+    VERSION = "0.3.1"
   end
 end

data/lib/active_admin/primary_key.rb

@@ -14,13 +14,22 @@ unless defined?(ActiveAdmin::PrimaryKey)
       end
 
       def ordered_columns(model)
-        Array(model.primary_key).map(&:to_s)
-      end
+        cols = case (pk = model.primary_key)
+        when nil, false then []
+        when Array then pk.map(&:to_s).reject(&:empty?)
+        else
+          (name = pk.to_s).empty? ? [] : [name]
+        end
+        return cols if cols.any?
+        return %w[id] if model.respond_to?(:columns_hash) && model.columns_hash.key?("id")
 
-      def columns(model)
-        ordered_columns(model)
+        []
+      rescue ActiveRecord::StatementInvalid, ActiveRecord::ConnectionNotEstablished
+        []
       end
 
+      def columns(model) = ordered_columns(model)
+
       def composite_attribute_hash(model, id_param)
         cols = ordered_columns(model)
         hash = normalize_composite_input(cols, id_param)

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: activeadmin-graphql
 version: !ruby/object:Gem::Version
-  version: 0.3.0
+  version: 0.3.1
 platform: ruby
 authors:
 - Andrei Makarov
@@ -366,7 +366,29 @@ files:
 - README.md
 - activeadmin-graphql.gemspec
 - app/controllers/active_admin/graphql_controller.rb
+- docs/changelogs/20260818111600_rfc-0002-problems.md
+- docs/changelogs/20260818114000_rfc-as-built-coverage.md
+- docs/changelogs/20260818114700_rfc-design-not-version.md
+- docs/changelogs/20260907141000_advisory-lockfile-refresh.md
+- docs/changelogs/20260921103000_mutation-attribute-allowlists.md
+- docs/changelogs/20260921111000_release-0-3-0.md
+- docs/changelogs/20260921112800_drop-standard-rubocop-direct.md
+- docs/changelogs/20260921120000_graphql-floor-and-activeadmin-4.md
+- docs/changelogs/20261010101500_nonconventional-id-fields.md
+- docs/changelogs/20261010103800_release-0-3-1.md
+- docs/dependencies/20260907141000_json-cve-2026-71847.md
+- docs/dependencies/20260907141000_sqlite3-ghsa-mwm8-39rw-8826.md
+- docs/dependencies/20260921114000_rails-json-parse-kwargs.md
+- docs/dependencies/20260921114500_graphql-ghsa-rmxg-5p3r-j6hh.md
+- docs/dependencies/20261007161308_association-list-combobox.md
 - docs/graphql-api.md
+- docs/issues/20260907141000_engineering-and-dependency-audit.md
+- docs/issues/20260917123253_ci-drop-automatic-dependency-audit.md
+- docs/issues/20260921103000_mutation-attribute-allowlists.md
+- docs/issues/20260921104400_convention-alignment-audit.md
+- docs/issues/20260921114500_dependency-audit.md
+- docs/issues/20260921115500_file-length-metrics.md
+- docs/plan/20260817201500_rfc-starter.md
 - lib/active_admin/graphql.rb
 - lib/active_admin/graphql/auth_context.rb
 - lib/active_admin/graphql/engine.rb
@@ -384,6 +406,7 @@ files:
 - lib/active_admin/graphql/resource_methods.rb
 - lib/active_admin/graphql/resource_query_proxy.rb
 - lib/active_admin/graphql/resource_query_proxy/controller.rb
+- lib/active_admin/graphql/resource_query_proxy/identity.rb
 - lib/active_admin/graphql/run_action_mutation_config.rb
 - lib/active_admin/graphql/run_action_mutation_dsl.rb
 - lib/active_admin/graphql/run_action_payload.rb