From 95ccaa639f5d522f1733dfc8bd8b5bae5f56c5d9 Mon Sep 17 00:00:00 2001
From: Rudy Celekli <rudy@gradiahq.com>
Date: Tue, 29 Sep 2026 20:55:04 -0400
Subject: [PATCH] Validate YAML reorder pointers before mutating a sequence

---
 ...engineering-universal-document-compiler.md | 24 ++++++++++++++++---
 1 file changed, 21 insertions(+), 3 deletions(-)

diff --git a/engineering/engineering-universal-document-compiler.md b/engineering/engineering-universal-document-compiler.md
index c1ee32d9..01f2bb6c 100644
--- a/engineering/engineering-universal-document-compiler.md
+++ b/engineering/engineering-universal-document-compiler.md
@@ -254,14 +254,32 @@ export function executeReorderTransaction(
 ): { updatedYaml: string; changedRange: [number, number] } {
   const doc = parseDocument(yamlSource, { keepSourceTokens: true });
   
-  const seqPath = intent.targetSequencePointer.split('/').filter(Boolean);
-  const targetSeq = doc.getIn(seqPath);
+  if (doc.errors.length) throw new Error('Cannot reorder invalid YAML.');
+  const decodePointer = (pointer: string): string[] => {
+    if (pointer === '') return [];
+    if (!pointer.startsWith('/') || /~(?![01])/.test(pointer)) {
+      throw new Error('Invalid JSON pointer.');
+    }
+    return pointer.slice(1).split('/').map(part => part.replace(/~1/g, '/').replace(/~0/g, '~'));
+  };
+  const seqPath = decodePointer(intent.targetSequencePointer);
+  const sourcePath = decodePointer(intent.sourcePointer);
+  const indexToken = sourcePath.pop();
+  if (JSON.stringify(sourcePath) !== JSON.stringify(seqPath) || !/^(0|[1-9]\d*)$/.test(indexToken ?? '')) {
+    throw new Error('Source must be an item in the target sequence.');
+  }
+  const targetSeq = seqPath.length ? doc.getIn(seqPath) : doc.contents;
 
   if (!isSeq(targetSeq)) {
     throw new Error(`Target at pointer ${intent.targetSequencePointer} is not a valid sequence.`);
   }
 
-  const sourceIndex = parseInt(intent.sourcePointer.split('/').pop() || '0', 10);
+  const sourceIndex = Number(indexToken);
+  if (!Number.isSafeInteger(sourceIndex) || sourceIndex >= targetSeq.items.length ||
+      !Number.isInteger(intent.targetIndex) || intent.targetIndex < 0 ||
+      intent.targetIndex >= targetSeq.items.length) {
+    throw new Error('Reorder indices must identify valid final sequence positions.');
+  }
   const [movedNode] = targetSeq.items.splice(sourceIndex, 1);
   targetSeq.items.splice(intent.targetIndex, 0, movedNode);