Dispatcher Build Gate Summary (local)

• rubocop (diff-only): PASS (0 offenses)
• brakeman: skipped (per repo build gate config; disabled)
• tests (affected engines): PASS
  • core: PASS
  • admin: PASS
  • storefront: PASS

Note: test output still prints BSON Symbol deprecation warning (expected to be addressed by WA-NEW-010 / PR #635).

Security Review

Verdict: APPROVE (low risk)

Summary

This PR removes use_dis_max: true from ES query_string queries for ES7 compatibility. No new data flows or input handling changes introduced.

Notes

• The primary security-sensitive surface remains the existing use of query_string (Lucene syntax). This PR does not materially worsen that risk, but keep in mind potential expensive/wildcard query abuse if sanitization/limits are insufficient.
• Brakeman is skipped in this repo’s build gate; if feasible, consider running it in CI for PRs touching query construction.

Architecture Review

Verdict: APPROVE (high confidence)

Summary

Minimal, correct ES7 compatibility change: query_string.use_dis_max was removed in ES 7.x, so removing it avoids runtime query parsing errors without altering the rest of the query DSL.

Notes

• Behavioral impact should be effectively none: the PR previously forced use_dis_max: true and that was historically the default for query_string.
• tie_breaker remains in place; no configuration/extension surface changed.

Optional test ideas

• Assert generated DSL for ProductSearch/HelpSearch no longer includes use_dis_max.
• If feasible, run an ES7-backed integration/spec to catch any remaining deprecated query_string options.

Simplicity Review

Verdict: APPROVE (high confidence)

Summary

Smallest, clearest ES7 compatibility fix: remove unsupported use_dis_max from query_string queries in HelpSearch/ProductSearch. No additional behavioral complexity introduced.

Note (optional)

• Consider a quick repo-wide grep for use_dis_max to ensure there are no remaining ES7-breaking occurrences.
• Optional: a query-building spec asserting deprecated query_string params are absent under ES7.

Rails / Workarea Conventions Review

Verdict: APPROVE

Summary

Conventions-friendly, minimal change confined to query building: removes ES7-unsupported use_dis_max from query_string clauses in HelpSearch/ProductSearch.

Notes / watch-outs (non-blocking)

• Possible subtle relevance/ranking shifts since use_dis_max previously forced dis_max semantics for multi-field query_string.
• tie_breaker remains in ProductSearch; worth confirming ES7 still accepts/uses it for query_string (or that it is safely ignored).
• If this code must support ES < 7 in some configs, consider version-conditional inclusion; otherwise this is fine.

Suggested follow-ups

• Spec asserting ES7 query JSON does not include deprecated use_dis_max.
• Light relevance spot-check on a few representative multi-field queries to catch ranking regressions.

✅ Wave 1 Passed — Merge Ready

Wave 1 reviewers all returned APPROVE:

• architecture: ✅
• simplicity: ✅
• security: ✅
• rails-conventions: ✅

Build gate: gate:build-passed ✅

Labeling this PR merge:ready.