fix(ontology): keep filtered JSON-LD exports aligned with visible relations

[seonghobae]

Searching an ontology neighborhood could remove a relationship from the graph and exact-value rows while leaving its direct assertion in the downloaded JSON-LD. Filter those assertions by retained typed source/property/target triples, including accumulated arrays, while preserving node metadata and authorized Voice derivations. ADR 0184 clarifies the existing export-parity contract.

Repair and evidence lineage

Implementation b49a68a288cd7babf1d80436180521d5e0c3b31d repaired the observed JSON-LD projection mismatch. On that implementation revision, three regressions failed before the repair and passed afterward; 43 focused frontend tests, lint, TypeScript, and production build passed; 33 backend tests passed including real Keycloak/JWKS and synthetic PostgreSQL primary-Voice API coverage. Real Chromium downloads and visually inspected screenshots passed at 1440×1000 and 390×844 using the existing Storybook/tokens. Those remain implementation/predecessor observations, not exact-head hosted GREEN.

The branch then advanced non-force through evidence-only commits to predecessor 389fb4dc6198340774e2a2d1a5a16e5d8c8556b1. Current-head review 5120777025 found a second defect in the same buyer export boundary: csvCell() neutralized only ASCII =, +, -, and @, and did not quote CR-bearing fields. OWASP ASVS 5.0.0 requirement 1.2.10 and OWASP CSV Injection/WSTG guidance treat spreadsheet-formula control prefixes and locale-sensitive full-width variants as injection-relevant data. RED 1c9145998075b512732e035c05937bebd33a25d3 adds synthetic tab/CR/LF/NUL/full-width-prefix export cases. Causal repair 140c4cc7ef1ad29252b6f78247595b83fc214e80 neutralizes those prefixes before quoting and quotes CR as well as LF. ADR/TRACEABILITY convergence 7c5f9c11c2b9a4bef4aa2e6d3c7926d92b7d15d3 records that this is export encoding only: PostgreSQL values and JSON-LD semantic values are unchanged.

Compare from 389fb4dc… to current head is exactly three non-force commits, behind_by=0, touching only frontend/src/ontologyCsvSecurity.test.ts, frontend/src/ontologyLayout.ts, and ADR 0184. No unrelated product delta was overwritten.

The baseline still separates authority, implementation, live non-identifying counts, a short authenticated synthetic k6 observation, and queue/conflict evidence. Its observed k6 p95 of 6414.11 ms is not a capacity/SLO claim or an attributed bottleneck and does not satisfy the LineageWeave commercial p95 target. Full authenticated deployed additional-Voice/cutoff/paged-UI acceptance remains unavailable.

Exact live boundary

• stack: fix(voice): distinguish carrying and evidence exports #780 1d8fa267b059289e77301a09985dfac70a439814 → fix(ontology): preserve singleton relations across export pages #934 3060dd7000791160c2bcc98351af129899ff32ff → fix(ontology): keep filtered JSON-LD exports aligned with visible relations #935 7c5f9c11c2b9a4bef4aa2e6d3c7926d92b7d15d3
• PR: open / Draft / mechanically mergeable
• exact-head repository Tests 33959441183: completed skipped under Draft admission; this is not product GREEN
• no qualifying independent current-head APPROVE is claimed
• implementation/frontend/browser/backend results tied to earlier heads are not transferred to current-head GREEN
• no new API/schema/release number, numerical implementation, or model/provider integration is introduced

Keep this child Draft until #780 and then #934 merge normally through protected governance. After parent movement, converge/retarget this child non-force and recollect exact-head/base checks plus qualifying independent review. Do not auto-merge into an unprotected parent, transfer predecessor GREEN, weaken gates, or overwrite concurrent #929/#901/#847 ownership.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Current-head export-security finding: neighborhoodCsv() routes buyer-visible labels and evidence fields through csvCell(), but csvCell() neutralizes only ASCII =, +, -, and @. The current OWASP WSTG CSV Injection guidance also treats tab, CR, LF, and locale-sensitive full-width formula initiators as spreadsheet formula triggers; OWASP ASVS 5 V1.2.10 likewise requires spreadsheet-export special-character neutralization. This branch is already repairing ontology export integrity, so this is the same owned export boundary rather than a new domain. Add a realistic RED using synthetic ontology labels beginning with tab/CR/LF/full-width formula initiators, then minimally harden csvCell() while preserving RFC-style quoting (including CR) and ordinary values. Keep the PR Draft and do not transfer predecessor browser/GREEN evidence.

[seonghobae]

Re-verification on exact head 7c5f9c11c2b9a4bef4aa2e6d3c7926d92b7d15d3: the review finding is causally represented by RED 1c914599…, production repair 140c4cc7…, and ADR/TRACEABILITY 7c5f9c11…. The source now neutralizes ASCII/control/NUL/full-width formula prefixes before CSV quoting and quotes CR/LF-bearing fields; the regression covers each boundary with synthetic labels. Parent #934 remains the exact merge base (behind_by=0). This is source-level repair evidence only: the exact-head Tests run is Draft-skipped, so hosted GREEN, independent approval, parent delivery, and merge readiness are not claimed.