Sync ako/mxcli: mxcli git merge (#1674) with --plan over the engine's result, Concord dropped for Studio Pro's MCP, SEC011, MPR012

.claude/commands/mendix/lint.md

@@ -44,12 +44,13 @@ mxcli lint -p app.mpr --baseline lint-baseline.json
 | MPR005 | quality | ImageSource - IMAGE widgets with no source configured |
 | MPR006 | quality | EmptyContainer - Empty layout containers |
 | MPR007 | security | PageNavigationSecurity - Navigation pages need allowed roles (CE0557); every user role must be able to open its home page (at Production security, else CE2729 per widget) |
-| MPR012 | correctness | LegacyImageWidget - staticimage/dynamicimage are unsupported by the React client (CE0582; info on the classic client) |
+| MPR012 | correctness | ReactUnsupportedWidget - static/dynamic image, drop-down, legacy data grid and reference selector are unsupported by the React client (CE0582; info on the classic client) |
 | MPR013 | correctness | SnippetCallAppearance - Class/Style/DynamicClasses/design properties on a snippet call never reach the page (it renders no element) |
 | SEC001 | security | NoEntityAccessRules - Persistent entities need access rules |
 | SEC002 | security | WeakPasswordPolicy - Password minimum length should be 8+ |
 | SEC003 | security | DemoUsersActive - Demo users should be off at Production security |
 | SEC010 | security | PageEntityNotReadable - A page data widget lists an entity the user roles that open the page cannot read; at Production it renders empty, silently (info when only row-scoped) |
+| SEC011 | security | XPathAssociationNotReadable - A page data source's XPath crosses an association a role that opens the page may not read; at Production the page fails to open ("No access rights for …") |
 | CONV011 | performance | NoCommitInLoop - Commits inside loops (commit actions, or create/change with commit) cause N+1 issues |
 | CONV012 | quality | ExclusiveSplitCaption - Exclusive splits need meaningful captions |
 | CONV013 | quality | ErrorHandlingOnCalls - External calls (REST/WS/Java) need custom error handling |

.claude/skills/fix-issue/findings/cmd-mxcli/2026-11-01-git-merge-fixtures-depend-on-the-hosts-identity.json

@@ -0,0 +1 @@
+{"area": "cmd/mxcli", "date": "2026-11-01", "symptom": "Every `TestGitMerge_*` fixture and both real-mx `TestGitMergeIntegration_*` tests fail on a host named `vm` with `Committer identity unknown … unable to auto-detect email address (got 'root@vm.(none)')`, before the command under test runs; they pass on CI runners and developer machines", "cause": "The fixtures drop the global git config (GIT_CONFIG_GLOBAL=/dev/null) for hermeticity, but `gitInE` and the command's own in-process `git merge`/`git commit` in the integration fixture ran without the fixed identity `gitIn` sets, so git fell back to guessing one from the hostname — which works wherever the hostname has a domain", "file": "`cmd/mxcli/gitdoctor_test.go` (`gitInE` sets GIT_AUTHOR_*/GIT_COMMITTER_*), `cmd/mxcli/gitmerge_integration_test.go` (`mergeIntegrationRepo` sets them in the process environment)", "insight": "**Removing the global config is half of hermetic**: git still guesses an identity from the hostname, so a fixture that never sets one passes exactly where the hostname has a domain — every runner image and laptop — and fails in a bare container. `git merge` needs the identity even when it stops on a conflict. Pattern: docs-wiki/bug-patterns/the-platform-ci-does-not-run.md", "refs": ["mendixlabs/mxcli#1674"]}

.claude/skills/fix-issue/findings/cmd-mxcli/2026-11-01-git-merge-plan-drops-what-the-engine-merged.json

@@ -0,0 +1 @@
+{"area": "cmd/mxcli", "date": "2026-11-01", "symptom": "`mxcli git merge <ref> --plan <file>` commits a valid two-parent merge that has silently lost one side's change to a unit the plan never names: ours adds `MyFirstModule.OursOnly`, theirs adds `MyFirstModule.TheirsOnly`, both edit `FeedbackModule.Feedback`'s documentation; the engine exits 2, the template lists only FeedbackModule's domain model, and after `--plan` with take theirs `TheirsOnly` is gone — the hash gate passes and nothing in the output mentions the unit", "cause": "applyPlan resolved from git's two sides — ours for every model file git conflicted, theirs for the planned units — and never ran the engine. Once the template listed only the engine's ManualResolutionRequired units, a unit the engine merges by itself (MergeContents/AutoResolved: an entity added on each side of one domain model) was taken from ours wholesale", "file": "`cmd/mxcli/cmd_git_merge.go` (`applyPlan` re-runs the engine over `checkoutRevisions` worktrees, checks the plan against `engineDecisions`, copies the result back with `copyEngineResult`, takes each planned unit with `git checkout <sha> -- <unit>`, `clearDecidedMarkers`, then refuses anything `conflictMarkers` still lists); `modelsdk/mpr/merge_conflicts.go` (`Reader.UnitConflicts`, `Writer.ClearContentsConflicts`); tests `TestGitMerge_PlanKeepsWhatTheEngineMerged`, `TestGitMerge_PlanMustMatchTheEnginesDecisions` in `cmd/mxcli/gitmerge_test.go`, `TestGitMergeIntegration_PlanKeepsWhatTheEngineMerged` (real mx) in `cmd/mxcli/gitmerge_integration_test.go`", "insight": "**\"AutoResolved\" means merged in the engine's result, not merged in yours**: a step that rebuilds from the sides instead of the result has to re-decide every unit, and listing fewer units to it hides the ones it gets wrong. Change the review list and the resolution source together. **The engine's exit-2 result is usable**: MINE holds every auto-resolved unit merged and marks only the undecided ones, in `Unit.ContentsConflicts` (a JSON list where every other row holds '' — not NULL); `mx check` reports CE0137 while a marker is left, which makes it the headless oracle for 'did the clear read as resolved'. Take a planned unit from its side's commit, not from MINE: MINE's copy of an undecided unit is not byte-identical to ours'. Measured with mx 11.13 on the PedApp fixture and an `mx create-project` scaffold. Pattern: docs-wiki/bug-patterns/rewrite-drops-unauthored-state.md", "refs": ["mendixlabs/mxcli#1674"]}

.claude/skills/fix-issue/findings/cmd-mxcli/2026-11-01-git-merge-refusal-reason-read-from-stdout.json

@@ -0,0 +1 @@
+{"area": "cmd/mxcli", "date": "2026-11-01", "symptom": "`mxcli git merge side -p App.mpr` on a working tree with an uncommitted change the merge would overwrite fails with `git merge side: Updating 5d6b73c..2c3fd47`, and without a git identity with `git merge side: ` and nothing after it; the same with `--plan`", "cause": "When git merge stopped before any conflict existed (no MERGE_HEAD), the error was built from `firstLineOf(mergeOut)` — git's stdout, which holds at most the fast-forward 'Updating a..b' line — while git's reason is on stderr, which gitOutIn already returns as the error", "file": "`cmd/mxcli/cmd_git_merge.go` (`mergeRun` and `applyPlan` report `mergeErr`); test `TestGitMerge_RefusedMergeSaysWhy` in `cmd/mxcli/gitmerge_test.go`", "insight": "**A wrapper that splits stdout from stderr has to pick the stream per outcome**: git writes progress to stdout and refusals to stderr, so the line that is right on success is the wrong one on failure. Found only because a fixture ran on a host where git could not guess an identity — the empty message was the first clue. Pattern: docs-wiki/bug-patterns/misleading-diagnostics.md", "refs": ["mendixlabs/mxcli#1674"]}

.claude/skills/fix-issue/findings/mdl-backend/2026-11-01-mcp-drop-ignores-ped-delete-document.json

@@ -1 +1 @@
-{"area": "mdl/backend/mcp", "date": "2026-11-01", "symptom": "Over `--mcp` on Studio Pro 11.16, every DROP of a standalone document (constant, enumeration, microflow, nanoflow, page, workflow, business-event service) demanded `--mcp-concord`, though 11.16 ships `ped_delete_document`. Separately, a PED tool whose handler throws answers `Error executing tool handler: …` with `isError:false`, which any caller trusting the flag reads as success", "cause": "`concordDeleteDocument` was the only DROP path, written when PED had no delete tool. `Client.CallTool` passed `isError` through verbatim, and only the create/update callers (`pedOpError`'s `SUCCESS` prefix) noticed failures reported in the text", "file": "`mdl/backend/mcp/delete.go` (new `deleteDocument`: native when `HasTool(\"ped_delete_document\")`, Concord fallback), `client.go` (`HasTool`, `handlerFailed` sets `IsError`), the seven `Delete*` call sites, `capabilities.yaml`/`.go` report text", "insight": "**Probe tool presence, never the version**: `serverInfo.version` was 1.0.0 on 11.12.0 and 11.16.0 reports itself, but the delete tool is the fact that matters. **On 11.16.0 the native delete fails for every caller outside Studio Pro's own agent session** (`Session 'mcp-server' not found`, measured from a devcontainer through four clientInfo names), so the success reply has never been seen. The code therefore settles an unrecognised reply by `ped_find_document` instead of guessing the text, and keeps Concord as a fallback. **Revert check**: stubbing `handlerFailed` fails `TestCallTool_HandlerErrorIsAnError`, and forcing the Concord path fails three `TestDeleteDocument_*`. Live runs are in mx-test-projects/runs/native-delete/"}
+{"area": "mdl/backend/mcp", "date": "2026-11-01", "symptom": "Over `--mcp` on Studio Pro 11.16, every DROP of a standalone document (constant, enumeration, microflow, nanoflow, page, workflow, business-event service) demanded `--mcp-concord`, though 11.16 ships `ped_delete_document`. Separately, a PED tool whose handler throws answers `Error executing tool handler: …` with `isError:false`, which any caller trusting the flag reads as success", "cause": "`concordDeleteDocument` was the only DROP path, written when PED had no delete tool. `Client.CallTool` passed `isError` through verbatim, and only the create/update callers (`pedOpError`'s `SUCCESS` prefix) noticed failures reported in the text", "file": "`mdl/backend/mcp/delete.go` (new `deleteDocument`: native when `HasTool(\"ped_delete_document\")`, else an error naming 11.16+; Concord support removed in the same change), `client.go` (`HasTool`, `handlerFailed` sets `IsError`), the seven `Delete*` call sites, `capabilities.yaml`/`.go` report text", "insight": "**Probe tool presence, never the version**: `serverInfo.version` was 1.0.0 on 11.12.0 and 11.16.0 reports itself, but the delete tool is the fact that matters. **On 11.16.0 the native delete fails for every caller outside Studio Pro's own agent session** (`Session 'mcp-server' not found`, measured from a devcontainer through four clientInfo names), so the success reply has never been seen. The code therefore settles an unrecognised reply by `ped_find_document` instead of guessing the text. **Revert check**: stubbing `handlerFailed` fails `TestCallTool_HandlerErrorIsAnError`, and removing the `HasTool` gate fails `TestDeleteDocument_NoNativeToolNeeds1116`. Live runs are in mx-test-projects/runs/native-delete/"}

.claude/skills/fix-issue/findings/mdl-executor/2026-11-01-custom-content-column-header-shows-name.json

@@ -0,0 +1 @@
+{"area": "mdl/executor", "date": "2026-11-01", "symptom": "A Data grid 2 custom-content column written with `Caption: ''` (or no caption) through the generic `pluggablewidget 'com.mendix.widget.web.datagrid.Datagrid'` path showed its MDL column name (`colTriage`) as the header to end users; mx check, check and lint all passed.", "cause": "applyColumnHeaderFallback filled an empty header on an attribute-less column with the column's NAME, a name Mendix does not store for a column. It was written on the belief that an empty header is CE0463; that CE0463 was a null TextTemplate, and the empty Forms$ClientTemplate (ChipCoV8 #11) builds clean. The keyword `datagrid` path already wrote the empty header.", "file": "mdl/executor/widget_engine.go", "insight": "Read the widget's own bundle before reasoning about a render: Datagrid.mjs renders `header.trim() || ' '`, so no runtime fallback exists and the text had to come from the writer. Grepping the stored unit for the name settled which path wrote it. A CE0463 'fix' that substitutes a value should be re-measured once the null-vs-empty shape is known; this one outlived the shape fix by three months. Separately: create or replace does not clear a column caption to '' on either path (Unchanged page), so an app already holding the name needs the page dropped and recreated.", "issue": "ako/mxcli#535"}

.claude/skills/mendix/assess-quality/SKILL.md

@@ -12,14 +12,14 @@ description: "Audit a Mendix project against best practices for naming, security
 |---|---|
 | 29-36 | When to Use This Skill |
 | 37-96 | Assessment Workflow |
-| 97-354 | Quality Guidelines Reference |
-| 355-365 | Assessment Report Template |
-| 366-378 | Executive Summary |
-| 379-389 | project Metrics |
-| 390-402 | Automated Findings |
-| 403-422 | Manual Review Findings |
-| 423-438 | Recommendations |
-| 439-449 | Sources |
+| 97-355 | Quality Guidelines Reference |
+| 356-366 | Assessment Report Template |
+| 367-379 | Executive Summary |
+| 380-390 | project Metrics |
+| 391-403 | Automated Findings |
+| 404-423 | Manual Review Findings |
+| 424-439 | Recommendations |
+| 440-450 | Sources |
 
 <!-- /skill-index -->
 # Assess Mendix Project Quality
@@ -152,14 +152,15 @@ After reviewing automated results, assess the following areas manually. The guid
 
 ### C. Security
 
-**Enforced by rules:** SEC001-SEC010, CONV006, CONV007, CONV008, MPR007
+**Enforced by rules:** SEC001-SEC011, CONV006, CONV007, CONV008, MPR007
 
 #### C.1 Entity Access
 
 | Guideline | Rule | Priority |
 |-----------|------|----------|
 | All persistent entities must have access rules | SEC001 | Critical |
 | Every role that opens a page can read the entities its grids, galleries and combo boxes list (else it renders empty at Production) | SEC010 | High |
+| Every association a page data source's XPath crosses is readable by the roles that open the page, on the entity the step starts from (else the page fails to open at Production) | SEC011 | High |
 | Do not grant Create or Delete rights on entity access rules | CONV006 | High |
 | All entity access rules should have XPath constraints | CONV007 | High |
 | Set default access rights to None | Manual check | High |
@@ -441,7 +442,7 @@ Overall Score: [X]/100 (from `mxcli report`)
 This skill incorporates guidelines from:
 - **Conventions.pdf** — Squad Apps internal best practices (14 categories, 80+ guidelines)
 - **CONV001-CONV017 lint rules** — Automated checks derived from Conventions.pdf
-- **MPR001-MPR007, SEC001-SEC010** — Built-in linter rules
+- **MPR001-MPR007, SEC001-SEC011** — Built-in linter rules
 - **ARCH, DESIGN, QUAL series** — Starlark architecture/quality rules
 - **Mendix Performance Best Practices** — Official Mendix documentation on performance optimization
 - **Mendix Security Best Practices** — Official Mendix documentation on security configuration

.claude/skills/mendix/live-edit-with-studio-pro/SKILL.md

@@ -14,9 +14,9 @@ description: "Change the model through mxcli while Studio Pro has the project op
 | 36-42 | How it works (hybrid: local reads, live writes) |
 | 43-61 | Connect |
 | 62-91 | What you can change via MCP — check first |
-| 92-104 | Two MCP servers — use the built-in one by default |
-| 105-114 | Caveats |
-| 115-122 | Verify your change |
+| 92-99 | The MCP server |
+| 100-112 | Caveats |
+| 113-120 | Verify your change |
 
 <!-- /skill-index -->
 # Live-Editing an Open Studio Pro Project with mxcli (MCP)
@@ -89,26 +89,24 @@ New modules and their dependents resolve within the same run, so
 document in a folder at create time (`create microflow X.MF folder 'A/B'`), since
 MOVE can't re-parent over MCP.
 
-## Two MCP servers — use the built-in one by default
+## The MCP server
 
-The machine may run two MCP servers:
-
-- **Studio Pro built-in (port 7782 by default)** — model authoring. **Use this by
-  default.** From **11.13** Studio Pro **auto-selects a free port** when 7782 is
-  taken, so multiple instances can run side by side. The active port is shown in
-  Studio Pro's **status bar** (and set under Preferences > AI > MCP Server) — read
-  it there rather than assuming 7782, and pass it to `--mcp-dial`.
-- **Concord (port 7783)** — a temporary gap-filler with operational/refactor tools
-  (`delete_document`, `save_all`, `run_app`, `check_model`). **Only** reach for
-  Concord when the built-in server lacks the capability you need.
+Studio Pro's built-in MCP server (port 7782 by default) is the only one mxcli
+uses. From **11.13** Studio Pro **auto-selects a free port** when 7782 is taken, so
+multiple instances can run side by side. The active port is shown in Studio Pro's
+**status bar** (and set under Preferences > AI > MCP Server) — read it there rather
+than assuming 7782, and pass it to `--mcp-dial`.
 
 ## Caveats
 
-- **Writes are unsaved.** They land in Studio Pro's in-memory model (shown as
-  unsaved). Save in Studio Pro to persist to disk.
-- **No DROP of standalone documents** (enumeration / microflow / page) through the
-  built-in server — it has no delete tool. Remove them in Studio Pro (or via
-  Concord's `delete_document`).
+- **Writes are saved as they land.** PED writes each change to disk immediately
+  (measured on 11.12.0 and 11.16.0), so there is no save step.
+- **DROP of standalone documents needs Studio Pro 11.16+** (`ped_delete_document`).
+  On 11.16.0 that tool fails with `Session 'mcp-server' not found` for callers
+  outside Studio Pro's own agent session; delete the document in Studio Pro then.
+- **`--mcp-check`** runs Studio Pro's project-wide error check (11.15+), and
+  **`--mcp-run`** starts the app through the `mendix_app` handler and prints its URL
+  (11.16+).
 - **`-p` must match the open project.** A mismatched `-p` silently reads the wrong
   model.
 

.claude/skills/mendix/manage-security/SKILL.md

@@ -15,9 +15,9 @@ description: "Configure Mendix security in MDL — module and user roles, access
 | 44-120 | The System-module ceiling — decide the role model around this FIRST |
 | 121-560 | Syntax Reference |
 | 561-575 | Starlark Lint Rule APIs |
-| 576-628 | Common Workflow: Setting Up Module Security |
-| 629-638 | Common Mistakes |
-| 639-648 | Validation |
+| 576-637 | Common Workflow: Setting Up Module Security |
+| 638-647 | Common Mistakes |
+| 648-657 | Validation |
 
 <!-- /skill-index -->
 # Security Management Skill
@@ -626,6 +626,15 @@ Audit members are the one case where naming a member cannot change its rights:
 member access to write for it and a rule that carries one fails CE0066. Let the
 rule's default cover it, or change the default.
 
+**A page data source's XPath needs the association member too.** At Production the
+runtime checks member access on every association step of a data-source XPath, on the
+entity the step starts from: `database from M.Account where [M.Order_Account/M.Order/IsActive
+= true()]` with `M.Order_Account` at None in Account's rule (owner Both) opens to an error
+dialog, `No access rights for M$Account/M.Order_Account`, while mxbuild reports nothing.
+A step from an entity the association is not a member of (the TO side of an `OWNER
+Default` association) is not checked, and neither is an XPath inside an access rule
+(measured, 11.15). `mxcli lint` reports it as SEC011.
+
 ## Common Mistakes
 
 1. **Creating module roles before the module exists** — `create module` must come first