Codebase review fix plan — 2026-07-16

[shihyuho]

Codebase review fix plan — specification-mapper (2026-07-16)

Whole-codebase thorough review of branch jakarta (modules mapper/ + starter/; site/ and target/ out of scope). Build gate green (mvn test, 214 tests). 43 findings CONFIRMED under adversarial verification (2 REFUTED and dropped), packaged into 14 work packages below.

Scorecard

Category	Grade
correctness	🟡 (1 high + 15 medium)
security	🟢 (1 medium)
performance	🟡 (1 high + 3)
testing	🟡 (8 medium)
dependencies	🟡 (4 medium)
maintainability	🟢 (2 medium + 7 low)

Top risks

1. COR-01 (high) — starter silently overrides every repository's base class → possible hard-delete data loss.
2. PERF-01 (high) — @JoinFetch + pagination forces Hibernate in-memory paging → OOM on large tables.
3. COR-05/06/07/10/11 (medium) — join resolvers silently return wrong results on realistic misconfigurations.
4. COR-15/16 (medium) — first-position field-level @Or/@And silently ignored; same annotation, opposite SQL by declaration order.
5. SEC-01 (medium) — LIKE-family specs don't escape %/_ wildcards → scoping-filter bypass + cheap DoS.

Work packages (recommended order)

Ordered: quick wins & high-severity first. Same-area packages (WP1/WP6 touch SpecMapperAutoConfiguration; WP13/WP14 touch domain/) run sequentially to avoid conflicts. Not flagged ready-for-agent — triage before build.

1. [WP1] Starter silently overrides every repository base class (data-loss risk) #173 — [WP1] Starter silently overrides every repository base class (data-loss risk)
2. [WP2] @JoinFetch on paged queries forces Hibernate in-memory pagination #174 — [WP2] @JoinFetch on paged queries forces Hibernate in-memory pagination
3. [WP13] Compound composition: first-position @Or/@And silently ignored (order-dependent boolean semantics) #175 — [WP13] Compound composition: first-position @Or/@and silently ignored (order-dependent boolean semantics)
4. [WP4] LIKE-family wildcard injection + unbounded IN expansion #176 — [WP4] LIKE-family wildcard injection + unbounded IN expansion
5. [WP5] Reflective spec construction masks TypeMismatchException + hidden context invariant #177 — [WP5] Reflective spec construction masks TypeMismatchException + hidden context invariant
6. [WP6] Starter auto-configuration robustness (fluent null-spec, BPP early-init, ordering, API parity) #178 — [WP6] Starter auto-configuration robustness (fluent null-spec, BPP early-init, ordering, API parity)
7. [WP14] Leaf-spec constructor validation & one-shot Iterable consumption #179 — [WP14] Leaf-spec constructor validation & one-shot Iterable consumption
8. [WP12] CI/CD supply-chain & gating: unpinned actions, auto-merge without in-repo build gate, dead branch guard #180 — [WP12] CI/CD supply-chain & gating: unpinned actions, auto-merge without in-repo build gate, dead branch guard
9. [WP3] Join machinery: silent-wrong-result edge cases + missing edge/error tests #181 — [WP3] Join machinery: silent-wrong-result edge cases + missing edge/error tests
10. [WP10] Mapper test-coverage gaps: concurrency, nested-AND typo, inherited fields #182 — [WP10] Mapper test-coverage gaps: concurrency, nested-AND typo, inherited fields
11. [WP11] Build config & dependency hygiene: unpinned plugins, no Maven update lane, EOL Boot line, jar build-info pollution #183 — [WP11] Build config & dependency hygiene: unpinned plugins, no Maven update lane, EOL Boot line, jar build-info pollution
12. [WP7] Mapper hot-path allocation: eager AST build + always-on DISTINCT #184 — [WP7] Mapper hot-path allocation: eager AST build + always-on DISTINCT
13. [WP8] Native-image / AOT: user-POJO hints uncovered + nativeTest never run in CI #185 — [WP8] Native-image / AOT: user-POJO hints uncovered + nativeTest never run in CI
14. [WP9] Dead Ordered/getOrder contract on custom resolvers #186 — [WP9] Dead Ordered/getOrder contract on custom resolvers

Report

Full review report: https://github.com/softleader/specification-mapper/blob/codebase-review-2026-07-16/codebase-review-2026-07-16.md