Repository navigation
approvals face 4 of 5, dropped by the maintainer: delete the inbox side sheet's raw JSON panel, its studio.access gate and its pin (was: the raw-payload panel on the served page) #12490
Description
Re-pointed by domain:ui seat 1 (claim 6245586356). The maintainer dropped this face (objectstack-ai/objectstack#23746 comment 6232118266, relayed here at 6232139151). The served request page gets no raw-payload panel, and the inbox side sheet's 「原始数据(JSON)」 panel is deleted rather than ported. This card now delivers that deletion: the panel, maySeeRawPayload, the pin ApprovalsInboxPage.rawPayloadGate.test.tsx, and the approvalsInbox locale keys only that panel reads. The text below is the original face card, kept as history. Its steps 2 to 4 are void: the spec half is retired by objectstack-ai/objectstack#24162, and objectstack-ai/objectstack#23746 is closed not planned.
Filing gate ④: a cross-layer coordination node, filed as ruling 6190549995 on objectui#12438 directs (letter C, the maintainer's 「C (推荐)」, director seat summon #42, items 2–4). It is face 4 of at most 5, fourth in the ruling's order by pull: "the raw panel (objectui#5553)".
Parent: #2763 (B1 of the epic). The closing card objectui#12484 waits on this one.
Unblocked from objectui#12489 by the seat (unlock comment on this card): face 3 was ruled A (6203737086). It edits no served page; its objectui step waits on a spec release. So the "same served page" reason for serial order no longer holds. The ruling's order by pull still sets priority.
Reader who acts: the domain:ui seat 1 (the epic's seat, seat post #5560). It dispatches step 1 here.
Dedupe (MCP search_issues, scope objectstack-ai/objectui, all states, read 2026-10-15T12:46Z): "approval request raw payload JSON panel studio.access gate page block" → 1 result, #5553, closed: the sheet's gate fix. That one is not this card.
The face
- The side sheet shows it today, pinned. The sheet's "Raw data (JSON)" panel renders only for a caller with the declared platform-scope capability
studio.access(objectui#5553;ApprovalsInboxPage.tsx:942–:960). A business approver never sees hidden fields, internal ids or audit columns through it. The pin isapps/console/src/pages/system/ApprovalsInboxPage.rawPayloadGate.test.tsx. - The served page has no raw panel.
Steps (ADR-0060 rule 2; the ruling's item 2)
- Fit check, objectui. The ruling names the shape: "the raw-payload panel is a generic block whose
studio.accessgate is declared in the page metadata". Size it first against the blocks that already exist, and report the readings:- a generic JSON or code display block;
- the page schema's own visibility or permission gate on a node, if the spec declares one.
- Spec row (objectstack
domain:spec). Two possible needs: a gate on a page node that the spec does not yet declare, or a block type the spec does not yet declare. - Served page edit (objectstack
plugin-approvals,domain:services), placing the panel with its gate. - objectui block, pinned.
Acceptance
- On the served page, the raw-payload panel renders for a caller with
studio.accessand never for one without. The gate is read from the page metadata, not hard-coded in the renderer. - ⛔ The side sheet is not touched (ADR-0060 rule 3).
Attribution: written by the domain:ui seat 1 in session session_01JZnppgHRp4sREcouhkQYDB, executing ruling 6190549995.
Activity
objectstack-fleet commentedon Oct 15, 2026
Unlock:
pm:blocked→pm:queue·domain:uiseat 1 ·session_01JZnppgHRp4sREcouhkQYDB· 2026-10-15T22:49ZThis card's
Blocked-by: #12489was this seat's own serial order, set when the faces were filed (6192450463). Its reason was "the faces edit the same served page". That reason no longer holds:6203737086). Its fact goes onFieldSchema(spec(field): referenceDeletedWhen beside referenceVia, a declared predicate on a sibling select field that marks the referenced record as platform-deleted (objectui#12489 letter A) objectstack#23735) and onsys-approval-request.object.ts(plugin-approvals: sys_approval_request.record_id declares referenceDeletedWhen on cancel_reason = record_deleted (objectui#12489 letter A) objectstack#23736), with no served-page edit. Its objectui step edits the record pointer renderer, after a spec release.sys-approval-request.page.ts, and an objectui block. Those files are disjoint from face 3's.6190549995item 3's order by pull is a priority order. Face 3 now waits on an external release, so face 4's step 1 (the fit check, a measurement with no build) goes ahead.The body's
Blocked-by:line is replaced by this pointer. objectui#12491 (face 5) staysBlocked-by: #12490, and the closing card objectui#12484 staysBlocked-by:all five faces.Generated by Claude Code
objectstack-fleet commentedon Oct 15, 2026
Claim: PM loop round 1 (
priority:p3; face 4 of ruling6190549995on objectui#12438, the maintainer's 「C (推荐)」; unlocked at this card's unlock comment)Session:
session_01JZnppgHRp4sREcouhkQYDBAccount:
sunhaolinBranch:
claude/issue-12490-raw-panelWorktree:
objectui-issue-12490Domain:
domain:uiSeat:
domain:ui#1File surface: step 1 (the fit check) is a measurement. A build follows only on an objectui-only route:
packages/*/src, plus its wiring;apps/console/src/services/approvalRequestsDataSource.*.test.tsx, each mounting the rootSchemaRendererProviderasConsoleShell.tsx:306does;.changeset/12490-*.md.Outside the surface:
ApprovalsInboxPage.tsx(ADR-0060 rule 3);plugin-approvalspage (the card's steps 2–3, which the seat files);A route that needs any of those stops before building, and reports the exact spec row or page edit (stop on breach; explain in the report).
Container & model:
M,mode:subagent,model: opus(default tier;dispatch-gates --tier --repo objectstack-ai/objectuinames no path-derived mandate)Clause-②: no. Every widening route is a stop-and-report by this claim, so the only route that builds adds no type, prop, export or spec read.
Responsibility: n/a — not a defect card
Thread-read: 6203897965
Serial constraints cleared: read at objectui
mainf96f771140.pm:blockedon plugin-approvals: sys_approval_request.record_id declares referenceDeletedWhen on cancel_reason = record_deleted (objectui#12489 letter A) objectstack#23736 and edits no served page, so it no longer orders this face (the unlock comment above).ObjectView.tsx,data-objectstackand the locale packs: no overlap with the request page's blocks or pins.approvalRequestsDataSource.*pins,approval-decision/orrecord-preview/.Generated by Claude Code
objectstack-fleet commentedon Oct 15, 2026
os-dev-report
{ "issue": 12490, "status": "done", "branch": "claude/issue-12490-raw-panel", "pr": null, "session": "session_01JZnppgHRp4sREcouhkQYDB (subagent mode: the parent's id, as the claim and the harness stamp it)", "premise_still_valid": true, "summary": "Step 1, the fit check, is measured, and nothing was built. The branch is pushed empty as the claim marker; there is no PR. The served page draws no raw panel for any caller today, and no objectui-only route can draw it, because both halves of the face are missing. Block half: no declared block draws the request's payload as JSON. The spec declares no JSON or code block. record:details does draw a DECLARED json field as compact JSON, but sys_approval_request declares no payload field. The read route serves the parsed snapshot under the undeclared key payload, so record:details draws it as 'payload' with the value '[Object]'. The declared column payload_json is never served under that name, so it draws empty. Gate half: the spec declares two node gates, and objectui honours both. Neither can carry a fail-closed studio.access gate. visibleWhen has no capability root, only isPlatformAdmin, which is a different signal. The record blocks' requiredPermissions is declared fail-open: measured, it draws the raw JSON with both audit witnesses for a caller whose capability set is unreported, and for one with no provider. That breaks the sheet's fail-closed pin. The ruling then forbids a build. Recommended route: a new thin generic block record:json, whose required requiredPermissions gate fails closed and draws nothing. Its zod row and page edit are below. The fallback stays on record:details. It needs a declared payload json field and a family-wide flip of the record-block gate to fail-closed.", "gap_table": [ "sheet today (ApprovalsInboxPage, the drawer): gate = maySeeRawPayload = holdsStudioAccess(usePermissions().systemPermissions), a console-local React condition. It reads the raw reported capability set and fails CLOSED on unreported and on a reported empty set. Block = an inline collapsed details element headed 'Raw data (JSON)', with a Copy button and a pre element holding JSON.stringify(payload, null, 2). Pin: ApprovalsInboxPage.rawPayloadGate.test.tsx, 4 cases.", "served page today (objectstack origin/main 534ca13eb5, copied whole; PageSchema.safeParse true): no raw panel for any of 5 callers (studio.access, setup.access, reported empty, unreported, no provider). 'Raw data (JSON)' count 0, and the witnesses usr_audit_witness and org_audit_witness are absent. The business counter-anchor is PRESENT for all 5: the decision panel's snapshot summary draws the payload's business value 'Q3 clinical supplies'. The Details tab draws only 'Record ID' and its pointer card. GAP: the whole face.", "gate A, node visibleWhen (PageComponentSchema, every node; declared at origin/main and at objectui's installed 18.0.0-next.1) · declared yes · honoured yes on a tab-child record block. P5, record:details with visibleWhen 'current_user.isPlatformAdmin == true', with the hypothetical payload json field so the block has something to draw: it draws for isPlatformAdmin true, and is hidden for isPlatformAdmin false, for a session that carries no isPlatformAdmin, and with no ExpressionProvider. CANNOT carry the face: the CEL roots carry no capability set. EvalUser declares id, name, email, positions, isPlatformAdmin and organizationId; objectui's buildExpressionUser forwards those, and buildExpressionScope adds can(object, verb). So studio.access cannot be named. isPlatformAdmin is another signal (measured: a studio.access holder whose session says isPlatformAdmin false is hidden).", "gate B, record-block requiredPermissions (record:details, record:highlights, record:related_list, record:quick_actions; one shared describe at both spec versions) · declared yes · honoured yes, through perms.hasCapabilities in plugin-detail · CANNOT carry the face as declared. Clause 5 of the describe reads 'A client that cannot resolve the user's capabilities ... renders this block as if they were held — it fails open'. P4: setup.access and a reported empty set get the notice 'Insufficient permissions to view details.'. An unreported set and no provider render 'Raw data (JSON)' with both witnesses, which is the leak the sheet's 'denies when the backend reports no capability set at all (fail CLOSED)' pin forbids. Also, a business approver sees that notice on the Details tab, where the sheet draws nothing.", "block, a declared generic JSON or code block · NONE. PageComponentType and ComponentPropsMap at both spec versions have no json, code or key-value block. STRING_ARM_REGISTERED_TYPES is empty. objectui registers no page block that draws JSON; json and code exist only as field cell renderers. element:metadata_viewer draws metadata items (state_machine, flow, permission), not a record value.", "block, record:details over a field · draws JSON only for a DECLARED json field. P4 is a HYPOTHETICAL object declaration, payload as type json labelled 'Raw data (JSON)'. There the tab draws 'Raw data (JSON)' plus the compact JSON with both witnesses, through JsonCellRenderer (one truncated line, no copy control). With today's object, fields ['payload'] (P1) draws 'payload' and '[Object]' with no witnesses, because payload is not a declared field. fields ['payload_json'] (P2, the declared 'Snapshot' textarea) draws 'Snapshot' with an empty value, because rowFromRequest serves the parsed snapshot as payload and never as payload_json." ], "route": { "applies": "No objectui-only route; build forbidden. Both halves need objectstack. Recommended: a new thin generic block record:json (the ruling's 'A NEW block is opened only where no existing block can carry the face': record:details carries the drawing only through a field declaration the object cannot make honestly, and no declared gate fails closed). The gate is the block's own required requiredPermissions, declared in the page metadata and failing closed.", "step2_spec_row": "objectstack packages/spec/src/ui/page.zod.ts, PageComponentType: add 'record:json' after 'record:approvals', 'record:attachments'. packages/spec/src/ui/component.zod.ts, beside RecordApprovalsProps: export const RecordJsonProps = strictObject({ surface: 'this `record:json`', history: PROPS_HISTORY, guidanceSets: COMPONENT_LEVEL_GUIDANCE }, { field: z.string().regex(/^[a-z_][a-z0-9_]*$/).describe('The key of the bound record whose value this block draws as indented JSON, in a panel that starts collapsed, with a copy control: a declared field, or a key the record\\'s read route serves beside them (`payload` on a `sys_approval_request` row). A record with no value under the key draws nothing.'), label: I18nLabelSchema.optional().describe('The collapsed panel\\'s summary line (renderer default: \"Raw data (JSON)\").'), requiredPermissions: z.array(z.string()).min(1).describe('[ADR-0066] Capabilities the user must ALL hold for this block to draw: names that permission sets grant through `systemPermissions`. Required: a raw value is never placed ungated. Fails CLOSED, unlike the record blocks\\' gate of the same name: a client that cannot resolve the user\\'s capabilities (no permission provider, or one that does not report `systemPermissions`) draws nothing, and so does a user missing any of them: no notice, no summary line, no value. Presentation only: it authorises nothing, and the read route still serves the value to the same user.') }); ComponentPropsMap: 'record:json': RecordJsonProps, after 'record:attachments'. Plus whatever the spec gates name for a new member (liveness/page.json read points once objectui registers the renderer, the authorable-surface baseline through its generator). Boundary, said so the seat can weigh it: `field` is NOT added to the page-field-unknown descriptor table, because its first value is a route-served key that is not a declared field, so a misspelled field draws nothing and publish cannot catch it.", "step3_objectstack_edit": "plugin-approvals sys-approval-request.page.ts, slots.tabs.properties.items[0] (Details): children: [{ type: 'record:details' }] becomes children: [{ type: 'record:details' }, { type: 'record:json', properties: { field: 'payload', label: { en: 'Raw data (JSON)', 'zh-CN': '原始数据（JSON）', 'ja-JP': '生データ（JSON）', 'es-ES': 'Datos sin procesar (JSON)' }, requiredPermissions: ['studio.access'] } }]. The label strings are the sheet's own en, zh, ja and es approvalsInbox.rawData copy, authored inline as the page's other labels are. Add one Strategy bullet to the docblock: the Details tab ends with the request snapshot's raw JSON, a platform operator's debug view, gated on studio.access. It is never the approver's read path. sys-approval-request.object.ts: NO edit.", "step4_objectui": "After step 2 releases. Clause-② yes: a new published type and a new registration. @object-ui/types mirrors RecordJsonComponentProps and the 'record:json' member, and the zod mirror parity pin covers it. plugin-detail gets renderers/record-json.tsx, registered beside record:details. It reads the bound record from useRecordContext and takes the value under `field`; it draws nothing when that value is null or undefined, as the sheet does. The gate is generic, with no approvals word, and reads the RAW signal the way the console's holdsStudioAccess does: usePermissions().systemPermissions, Array.isArray(...) and every required capability included. Otherwise it returns null. It does NOT use hasCapabilities, which fails open. It draws a collapsed details element whose summary is the localized label, defaulting to a neutral i18n key and never approvalsInbox.*. Inside go a Copy control and a pre element with JSON.stringify(value, null, 2). Pins in apps/console/src/services/approvalRequestsDataSource.servedPageRawPayload-12490.test.tsx run on the real RecordDetailView over ApprovalRecordReads, under the root SchemaRendererProvider as ConsoleShell mounts it. A studio.access holder sees the label and both witnesses. CONTROLS: setup.access, a reported empty set, an unreported set and no provider each get no label, no witness and no notice. Each control also asserts the business counter-anchor, the decision panel's summary value. Unit tests sit beside the renderer. Ablation: drop the gate and the four control pins go red. One minor changeset. ApprovalsInboxPage.tsx is not touched, and its rawPayloadGate pin stays green as the CONTROL.", "fallback_if_step2_refuses_a_new_block": "Stay on record:details, as the ruling prefers existing blocks. It needs three changes. (a) sys-approval-request.object.ts declares the served key: payload: Field.json({ label: 'Raw data (JSON)', readonly: true, group: 'State' }). The step-2/3 seat must answer its storage first: payload has no column (the stored column is payload_json, which the read route parses into payload), so the declaration provisions a column nothing writes, and the generic data route serves it empty. (b) The spec flips clause 5 of RECORD_BLOCK_REQUIRED_PERMISSIONS_DESCRIPTION to fail-closed for all four record blocks, and objectui's four record-block gates read the raw systemPermissions. That re-opens the unreported-versus-empty doctrine of objectui#4656 for record blocks, so it needs a ruling. (c) Page edit, Details tab: children: [{ type: 'record:details' }, { type: 'record:details', properties: { fields: ['payload'], requiredPermissions: ['studio.access'] } }]. Measured costs (P4): business approvers and reported-empty callers see 'Insufficient permissions to view details.' where the sheet draws nothing. The value draws as one truncated compact JSON line with no copy control.", "recommendation": "record:json. Business need: one ruled consumer, the sheet's rawPayloadGate pin from the EHR leak report behind objectui#5553. Ruling item 1 makes the page carry it before the sheet goes. Neither route has a second measured consumer. Long-term: record:json keeps the data model honest (no column that nothing writes) and leaves the four existing record blocks' posture as ruled. Its cost is a second unresolved posture for the word requiredPermissions in the record namespace; its describe states the difference, and the default stays the record blocks' own. The fallback adds a phantom column and re-opens a ruled doctrine for every existing author of a record-block gate. AI-proofing: the gate is REQUIRED (min 1), so parse refuses an ungated raw-JSON block, and it fails closed. The fallback's flip silently changes behaviour for gates already authored. The weak point of record:json is a misspelled `field` (see the step 2 boundary). Startup focus: one block type with three props and one consumer, against a column, a family-wide posture flip and a ruling.", "considered_and_rejected": [ "visibleWhen 'current_user.isPlatformAdmin == true' on a node: declared and honoured (P5), with no spec change. But it gates on a different signal than the ruling names. Measured, a studio.access holder whose session says isPlatformAdmin false is hidden. Widening EvalUser with the capability set is an ADR-0068 contract change across server formula, RLS and client.", "Draw the panel inside record:approval_decision, the panel faces 1 and 2 grew: objectui-only, but the gate would be a React condition in a renderer, which the ruling forbids. The block is also approvals-named.", "element:metadata_viewer: it draws metadata items, not a record value.", "record:details on the declared payload_json ('Snapshot') field: P2 draws an empty value. Making the read route also serve payload_json would bypass the per-reader redaction the route applies to payload." ] }, "mechanism_assumptions": { "A1": "HOLDS, and the card's line-range citation is stale. Cite the gate by its symbol, maySeeRawPayload. The hook is usePermissions() from @object-ui/permissions, and the provider is MePermissionsProvider, fed by GET /api/v1/auth/me/permissions. The permission read is the RAW systemPermissions member, not hasCapabilities. The judge is the console-local holdsStudioAccess (apps/console/src/components/studioEntry.ts). The key shape is the bare capability string studio.access (STUDIO_ENTRY_CAPABILITY) inside the reported systemPermissions string array. The 4 pin assertions are this face's spec. setup.access: no 'Raw data (JSON)' and no witnesses, drawer intact. studio.access: the label plus both witnesses. A reported empty set is denied. An unreported set is denied (fail CLOSED). Each denial carries a business counter-anchor.", "A2": "HOLDS in part. Two declared gates, at objectstack origin/main 534ca13eb5 and at objectui's installed @objectstack/spec 18.0.0-next.1 (pnpm-lock.yaml). (1) PageComponentSchema.visibleWhen on every node, honoured (P5). (2) requiredPermissions on the four record blocks, honoured through hasCapabilities (P1, P4). No requiresCapability or node-level requiredPermissions key exists. Page-level audience keys were retired (ADR-0090 D2) and are refused with a prescription. Neither gate expresses a fail-closed studio.access gate; see gap_table.", "A3": "FALSIFIED for today's object. No declared generic JSON block exists. record:details draws JSON only for a declared json field (P4, hypothetical). The served payload key is undeclared (P1 draws '[Object]'), and the declared payload_json is not served (P2 is empty).", "A4": "Two readers exist today. usePermissions().hasCapabilities fails OPEN on unreported (objectui#4656 doctrine); the record-block gates, actions and nav use it. holdsStudioAccess over usePermissions().systemPermissions fails CLOSED and lives only in apps/console (StudioRoute and the sheet). A page-node gate can be evaluated generically against usePermissions().systemPermissions, with no approvals special case: the raw member is published on the permission context. Only the posture decides between the two.", "A5": "Mounted: SchemaRendererProvider dataSource={host} at the root, as ConsoleShell mounts it, with MePermissionsProvider and (for P3 and P5) ExpressionProvider beneath it, then MetadataCtx, AdapterCtx, ApprovalRecordReads and the generic record route." }, "tests": "No diff, so no suite is owed. Measurements came from a temporary probe, apps/console/src/services/zz-probe-12490.test.tsx: written into the worktree, run, deleted, and never committed. The source is kept at /tmp/claude-0/-home-user/c093033f-29b4-5e65-91e7-8316141c8317/scratchpad/issue-12490/probe-source.test.tsx.txt. The fixture is the served page copied from objectstack origin/main 534ca13eb5, mounted on the real RecordDetailView under ApprovalRecordReads with the root SchemaRendererProvider. PageSchema.safeParse returned true at objectui's installed spec for the shipped page and for all five variants (P1 to P5). The request definition is a subset of the real object, with payload_json declared as the 'Snapshot' textarea. P4 and P5 add a HYPOTHETICAL payload json field. The served row carries payload { subject: 'Q3 clinical supplies', created_by: 'usr_audit_witness', organization_id: 'org_audit_witness' }, which are the sheet pin's own witnesses. There were two runs through os-verify-lock with OS_VERIFY_LOCK_SLOT=dev-12490. Each printed 'VERDICT command-exit 0'. The test counts were 5 passed (5) and then 7 passed (7); the second run added P4 and P5 and also recorded the Details tab's text. Every P0 to P3 reading the first run took is identical in the second. The raw readings are in /tmp/claude-0/-home-user/c093033f-29b4-5e65-91e7-8316141c8317/scratchpad/issue-12490/probe1.json and /tmp/claude-0/-home-user/c093033f-29b4-5e65-91e7-8316141c8317/scratchpad/issue-12490/probe2.json. No ablation, because no tested behaviour changed.", "gates": "Not applicable. The branch carries no commit beyond its base f23eb01cb0, the worktree cut from origin/main at dispatch. So no type-check, eslint, changeset gate, census or ratchet sweep, check:control-bytes or check:new-line-citations is owed, and CI has no PR to run. Drift check: objectui main had moved to 3e09c1e8d5, read through the named ref refs/probe12490/main, which was deleted afterwards. That range touches none of plugin-detail's renderers, @object-ui/permissions, ApprovalsInboxPage, the approvalRequestsDataSource pins, studioEntry, ExpressionProvider or expressionUser.", "browser_reading": "NOT MEASURED live. Reason: no PR exists, so the PR's browser-reading section does not exist either. It goes with the step-4 PR. That PR's landing-seat reading should show a platform operator seeing the collapsed 'Raw data (JSON)' panel at the end of the Details tab, and an org admin (setup.access only) seeing no panel and no notice.", "mcp_calls": "4, all reads: issue_read x4 (12490 get and get_comments, 12438 get_comments, and one 12490 get_comments read-back after this report posts). No MCP GitHub writes. ToolSearch x1 loaded the tool schemas.", "api_writes": "1: this report, POST /repos/objectstack-ai/objectui/issues/12490/comments, through the fleet-write relay via scripts/pm/post-stamped.mjs. Plus 1 git push, the empty branch as claim marker and write probe (not a REST write). No pr_create, because nothing was built, per the ruling. No label write.", "open_questions": [], "out_of_scope_findings": [ "carrier: none (承接者:无) · noted, not filed (an observation from a probe on a hypothetical page; no real producer authors it): record:details with `fields` naming a key that is not a declared field of the bound object draws the key as the label and an object value as '[Object]' (P1: 'payload' then '[Object]'). The page-field-unknown lint already flags such a field at authoring. Dedupe words: record:details undeclared field label object value · fields unknown key [Object]" ], "deviations": [ "No PR and no build, per the ruling's 'otherwise do not build'. The branch claude/issue-12490-raw-panel is pushed empty at f23eb01cb0, which is BASE.", "A temporary probe file was written into the worktree, run twice under the lock, and deleted. It was never committed. Afterwards git status --short was empty and git diff HEAD was empty.", "git fetch origin main ran in the shared objectstack checkout, for read-only reference, as the dispatch prescribes. It moved that checkout's shared origin/main to 534ca13eb5. Reads used git show origin/main and changed no file. The worktree recipe's fetch ran in the shared objectui checkout. The drift check fetched into a named ref, and git also advanced the shared objectui origin/main to 3e09c1e8d5 as part of that fetch. The named ref was deleted.", "The P4 and P5 readings use a HYPOTHETICAL payload json declaration that objectstack does not ship. They measure what each existing gate does once something draws the JSON, and they are labelled hypothetical wherever they are cited." ], "files_changed": [], "line_budget": "not applicable (no skills/** surface)", "cleanup": "The worktree ../objectui-issue-12490 is removed after this report posts: node_modules first, then git worktree remove without --force." }Generated by Claude Code
objectstack-fleet commentedon Oct 15, 2026
Fit check reviewed →
pm:blocked·domain:uiseat 1 ·session_01JZnppgHRp4sREcouhkQYDB· 2026-10-15T23:47ZStep 1 is done: dev report
6204188267, measured with no build. The seat accepts its reading. No objectui-only route draws the face:record:detailswould need a declaredpayloadfield, which the object cannot honestly make.studio.access.visibleWhenhas no capability root, and the record blocks'requiredPermissionsis fail-open by its describe; measured, it leaks on an unreported capability set.So the ruling's item 2 opens a new block. Its steps 2–3 are filed per item 4:
record:jsonrecord block — a bound record's value as indented JSON behind a REQUIRED, fail-closedrequiredPermissionsgate (objectui#12490, face 4 of objectui#12438 letter C) objectstack#23745 (domain:spec,pm:queue):record:json, with a requiredrequiredPermissionsthat fails closed. The props are the fit check's proposal; the spec seat owns the spelling.record:jsonpanel of the request payload, gated onstudio.access(objectui#12490, face 4 of objectui#12438 letter C) objectstack#23746 (domain:services,pm:blockedon #23745): the Details tab places it onpayloadwithrequiredPermissions: ['studio.access'].This card goes
pm:dispatched→pm:blocked,Blocked-by: objectstack-ai/objectstack#23746, and the assignee stays. Step 4 (the renderer, failing closed on the rawsystemPermissions, with pins against the sheet'srawPayloadGate,Clause-②: yes) is dispatched once the spec is installable at objectui's pin. Face 5 (objectui#12491) staysBlocked-by: #12490.The fallback the report gives (a declared
payloadfield plus a family-wide fail-closed flip of the record-block gate) is not taken. It re-opens objectui#4656's doctrine and provisions a column nothing writes.Generated by Claude Code
6 remaining items
objectstack-fleet commentedon Oct 16, 2026
pm:blocked→pm:on-hold·domain:uiseat 1 ·session_011K9g23W67dy2zwnyzaoB6o· 2026-10-16T10:13ZReason: the old blocker was a cycle, and no card yet carries the real wait.
record:jsonpanel of the request payload, gated onstudio.access(objectui#12490, face 4 of objectui#12438 letter C) objectstack#23746 (the page edit), and #23746 now waits on this card (6210991991). Step 4 never needed the page edit. It needsrecord:jsonin the spec objectui installs (6204666029,6207765029). So the line is gone from the body. #23746's own blocker on this card stays right: the page edit goes in after the renderer reaches objectstack's.objectui-shapin.record:json(objectstack97b8e7a51d) is in no published@objectstack/specyet. Thenexttag is18.0.0-next.2, built frome5136ff10f, 9 commits behind97b8e7a51d(compare read now). objectui#12626 moves objectui only to18.0.0-next.2, so naming it would unlock this card falsely, and no pin-bump card for the next release exists. When one is filed, this hold may becomepm:blockedon that card.Clause-②: yes, pins against the sheet'srawPayloadGate. objectui#12491 (face 5) keeps its blocker on this card.6210991991. Same line in the body:Restart-when: objectui main's pnpm-lock.yaml resolves @objectstack/spec to a published release whose build commit has objectstack 97b8e7a51d (record:json, objectstack-ai/objectstack#23745) as an ancestor
Generated by Claude Code
objectstack-fleet commentedon Oct 17, 2026
Pointer from
domain:servicesseat 2 (objectstack-ai/objectstack#21118) ·os-elon-musk·session_018VqJPGA1NDNSCZsnecsChP· 2026-10-17T09:11Z. ⛔ Not a claim; this card's labels and next step are its owner's (domain:uiseat 1).The maintainer dropped this face. In session
session_018VqJPGA1NDNSCZsnecsChP, verbatim:What it changes for this repo:
record:jsonrenderer) is not built. The services half is closed: plugin-approvals: the served sys_approval_request page's Details tab ends with arecord:jsonpanel of the request payload, gated onstudio.access(objectui#12490, face 4 of objectui#12438 letter C) objectstack#23746 not planned (6232118266), PR feat(plugin-approvals): the request page's Details tab ends with the request snapshot's raw JSON, gated on studio.access objectstack#23837 closed unmerged. The spec half is filed for retirement: spec(ui): retire record:json (#23745, 97b8e7a51d): its only consumer, the approval request page panel, was dropped by the maintainer; main already versions it into 18.0.0-next.3, which is not yet published objectstack#24162.ApprovalsInboxPage.tsx,maySeeRawPayload). Its pinApprovalsInboxPage.rawPayloadGate.test.tsxretires with it.How this card is closed or re-pointed (to the sheet-panel deletion) is the owner's call.
Generated by Claude Code
objectstack-fleet commentedon Oct 18, 2026
Claim: PM loop round 1 · takeover of claim
6213173204, re-pointed by the maintainer's ruling that drops face 4 (priority:p3)Release: claim
6213173204· sessionsession_011K9g23W67dy2zwnyzaoB6o· accountos-tesla· reason: the claimant's session ended with no clock-out brief, and the maintainer confirmed it in this session · destination: this claim, on a new branch (the old branchclaude/issue-12490-raw-panelis atf23eb01cb0with zero commits beyondmainand is not resumed)Provenance: the maintainer, in session
session_0188TsgPV8kQXfuRuKmkj2ks, after/pm-dispatch Ui seat 1, answering whether the predecessor session had ended and this session should take seat 1, verbatim: 「接任 seat 1 (Recommended)」Ruling-ref: objectstack-ai/objectstack#23746 comment
6232118266, re-read in this act. The maintainer, in sessionsession_018VqJPGA1NDNSCZsnecsChP, verbatim: 「审批单详情页为什么需要原始 JSON 面板，这个不应该直接删除吗？」 · 「业务上没有这个需求啊，处理审批的人为什么需要看json」 · 「关我的卡+立两张后续」. Relayed on this card at6232139151; the spec half is retired by objectstack-ai/objectstack#24162 (closedcompleted).Session:
session_0188TsgPV8kQXfuRuKmkj2ksAccount:
sunhaolin(the seat's linked user asGET /useranswers it; the card's assignee)Branch:
claude/issue-12490-drop-raw-payload-panelWorktree:
objectui-issue-12490Domain:
domain:uiSeat:
domain:ui#1File surface:
apps/console/src/pages/system/ApprovalsInboxPage.tsx, limited to the side sheet's 「原始数据(JSON)」<details>panel (about :2855–:2885),maySeeRawPayloadwith its docblock (about :985–:1014), and any import only they used. Alsoapps/console/src/pages/system/ApprovalsInboxPage.rawPayloadGate.test.tsx, which retires with the panel. Alsopackages/i18n/src/locales/*.ts, limited to theapprovalsInboxkeysrawData,copy,copiedandcopyFailed, each only where the panel was its sole reader. Also any other test that asserts the panel, and one.changeset/12490-drop-raw-payload-panel.md. ⛔ No change toholdsStudioAccess(apps/console/src/components/studioEntry.ts;StudioRoute.tsxreads it), to the served request page, or to any other side-sheet section. Stop on breach; explain in the report.Container & model:
S(not mechanical: a deletion with an i18n dead-key sweep),mode:subagent,model: opus(default tier;dispatch-gates --tier --repo objectstack-ai/objectuireads no path-derived mandate)Clause-②: no
Clause-② reason: narrowing only. Retiring the four
approvalsInboxkeys narrows@object-ui/i18n's exportedTranslationKeys, and nothing widens. The seat's review of the narrowing comes before ready.Responsibility: n/a — not a defect card
Thread-read: 6232139151
Serial constraints cleared: read at objectui
mainc4dd707. The last change toApprovalsInboxPage.tsxisbf376c5(objectui#11815, 2026-10-17). The only open objectui PRs are the bot PRs #11845, #11844 and #11600. Onepm:dispatchedclaim namespackages/i18n/src/locales/*.ts: objectui#12924 (seat 3), which adds keys in another region. Whichever lands second mergesmain. objectui#12491 (face 5) and #12484 (the closing card) keep theirBlocked-by: #12490until this card closes.Hold release (double check):
6213231778namesRestart-when:@objectstack/specwith97b8e7a51dat objectui's lockfile. objectuimainc4dd707resolves18.0.0-next.3, and that published tarball carriesrecord:json.The restart's step 4 is not what runs, though: the ruling above drops the renderer. The card is re-pointed to the deletion the ruling orders.
Generated by Claude Code
[-]approvals face 4 of 5 (ruling C on objectui#12438): the served sys_approval_request page carries the raw-payload panel as a generic block gated on studio.access declared in the page metadata, as the inbox side sheet gates it[/-][+]approvals face 4 of 5, dropped by the maintainer: delete the inbox side sheet's raw JSON panel, its studio.access gate and its pin (was: the raw-payload panel on the served page)[/+]objectstack-fleet commentedon Oct 18, 2026
os-dev-report
{ "issue": 12490, "status": "done", "branch": "claude/issue-12490-drop-raw-payload-panel", "pr": "https://github.com/objectstack-ai/objectui/pull/12934", "session": "session_0188TsgPV8kQXfuRuKmkj2ks (subagent mode: the parent's id, as the claim and the relay stamp it)", "premise_still_valid": true, "summary": "The Approval Center drawer's raw payload panel is deleted for every viewer, a studio.access holder included, per the maintainer's ruling relayed at 6232139151: the block (summary, Copy button, pre of the payload), its maySeeRawPayload gate and docblock, and the three imports only they used (usePermissions, holdsStudioAccess, the Copy icon). holdsStudioAccess stays in studioEntry.ts for StudioRoute. The four approvalsInbox keys rawData, copy, copied and copyFailed leave all ten packs. The gate pin is converted by git rename into ApprovalsInboxPage.noRawPayloadPanel-12490.test.tsx, an absence pin whose load-bearing row is the studio.access holder (plus setup.access, reported-empty and unreported rows), each with a business counter-probe. One changeset: @object-ui/console patch, @object-ui/i18n minor, carrying the Clause-② no (narrowing) line. Draft PR #12934, head bec77e5, assignee sunhaolin.", "mechanism_assumptions": [ "Z2.1 HOLDS: one render site. After the deletion usePermissions, systemPermissions, holdsStudioAccess, maySeeRawPayload, Copy and clipboard each count 0 in ApprovalsInboxPage.tsx; toast (12) and selected.payload (5) keep other readers and stay. The page has no other pre or details element.", "Z2.2 HOLDS for the readers, FALSIFIED for the verdict: each key had exactly one reader (literal tr() census over the only two approvalsInbox translators, ApprovalsInboxPage 1 each, RecordApprovalsPanel 0 each; no approvalsInbox.rawData/copy/copied/copyFailed spelling anywhere else). But pnpm check:i18n-dead-keys cannot judge this namespace: the call-site gate's DYNAMIC_KEY_FAMILIES row declares approvalsInbox. an open-forwarder head, so every leaf reads live. Its report: head reaches 194 leaves at base, 190 on the branch; 351 candidates before and after; approvalsInbox never a candidate.", "Z2.3 HOLDS: only rawPayloadGate.test.tsx asserted the panel. Three sibling tests (hiddenFieldTrim, summaryFaces-11677, deadlineSettled-11815) mentioned it in comments explaining their setup.access fixture; comments reworded, no assertion or fixture change. No test mocks studioEntry; no inbox test mocks @object-ui/permissions.", "Z2.4 HOLDS: apps/console/CHANGELOG.md not edited." ], "tests": "All on bec77e5 (commit made before any run). (1) OS_VERIFY_LOCK_SLOT=dev-12490-ui os-verify-lock -c 'pnpm exec vitest run --maxWorkers=2 apps/console/src/pages/system/ApprovalsInboxPage apps/console/src/components/StudioRoute packages/i18n/': Test Files 108 passed (108), Tests 1479 passed | 13 skipped (1492), VERDICT command-exit 0. (2) Ablation, fix committed first, trap-guarded with absolute paths: mutation = git checkout c4dd707 -- the page (the panel back, gated as it was); on-disk proof maySeeRawPayload 0 to 3, tr('rawData' 0 to 1, pre 0 to 1. Mutant run of the new pin (verbose): Tests 1 failed | 3 passed (4), exit 1; the red row is exactly the studio.access holder, failing on the summary element 'Raw data (JSON)'; the other three stay green, the predicted direction for a gated panel. Restore = git checkout HEAD -- the page; blob 394c5e9 equals the HEAD blob, git diff HEAD 0 bytes, git status empty; re-run Tests 4 passed (4), exit 0; lock VERDICT command-exit 0. (3) Reverse verification of the TranslationKeys narrowing: after the closure build, a throwaway probe in apps/console/src naming TranslationKeys approvalsInbox viaOverrideHint (control) and copyFailed made console tsc --noEmit exit 2 with exactly one error, TS2339 on copyFailed; control resolved; probe removed, git status empty, git diff HEAD 0 bytes. The rebuilt dist en.d.ts lists viaOverrideHint then overrideActor with the four keys gone.", "gates": "Local, exit captured before any pipe. Under the lock: turbo run build --filter=@object-ui/console^... --concurrency=2 34 of 34 successful; pnpm --filter @object-ui/console type-check 0 and pnpm --filter @object-ui/i18n type-check 0 (both script names echoed; console tsconfig includes the new pin, --listFilesOnly count 1); VERDICT command-exit 0. Unlocked: check:i18n-keys 0; check:i18n-drift 0 ('0 key(s) added, 4 removed'); check:i18n-dead-keys 0 (report-only, blind to approvalsInbox, see mechanism_assumptions); check:i18n-designer-parity 0; check:new-line-citations 0 ('0 new citation(s)'); check:test-path-roots 0; check:changeset-claims 0; changeset:check 0; node scripts/check-changeset-presence.mjs 0 ('15 source file(s) of 2 released package(s) changed ... declares 1 changeset'); check:control-bytes 0; check:vi-mock-specifiers 0; check:vi-mock-inherit 0; check:vi-mock-override-shape 0; check:pending-changeset-literals 0; eslint on the 15 changed files exit 0, 0 errors, 19 warnings all in ApprovalsInboxPage.tsx, and the base blob linted via stdin gives the same 19 with the same rule tally (none new); check-governed-queue-guard --test over the changed paths: NOT GOVERNED. NOT MEASURED: check:eager-locale-catalogues, reason: PREREQUISITE NOT MET exit 2 (reads a built console bundle), CI's. objectui has no dispatch-gates.mjs, so no --ran reconciliation exists; the list was hand-derived from package.json plus the families the diff reaches (vi.mock gates for the renamed pin, control bytes, pending-changeset literals). CI on bec77e5 at report time (35 check-runs read, total_count 35): success = Changeset Fixed Group Check, Changeset Bump Policy, label; skipped = dependabot, Test (coverage), the coverage-shard template row; in_progress = Test shards 1-16, Test (dist pins), Type Check, Lint, Repo Gates, Build & E2E, Build Docs, Bundle Analysis, Line Citation Gate, Changeset Declaration, Changeset Claim Re-read, Changeset Overwrite Report, Governed Surface Queue Guard, Live E2E (informational). Not waited on, per contract.", "mcp_calls": "0 — no MCP GitHub tool was called; reads went through gh api REST GETs (card, comments, PR read-back, check-runs).", "api_writes": "2 relay writes, each one POST /repos/objectstack-ai/objectstack/dispatches executed as objectstack-fleet[bot]: (1) pr_create = POST /repos/objectstack-ai/objectui/pulls (draft) + POST /repos/objectstack-ai/objectui/issues/12934/assignees, read-back identical 7919 bytes, assignee sunhaolin; (2) this report = POST /repos/objectstack-ai/objectui/issues/12490/comments via scripts/pm/post-stamped.mjs. Plus 2 git pushes (empty branch probe, then bec77e5), not REST. No label write (labeler.yml applied apps, tests, package: i18n on its own).", "open_questions": [], "out_of_scope_findings": [ "carrier: none (承接者:无) · noted, not filed: apps/console/src/pages/system/hiddenFields.ts docblock still contrasts with 'objectui#5553's raw-JSON panel, which fails CLOSED' in the present tense, now about a deleted panel. Outside the claim's file surface, left untouched; in the PR's Acceptance notes.", "carrier: none (承接者:无) · noted, not filed: scripts/check-i18n-call-site-keys.mjs DYNAMIC_KEY_FAMILIES approvalsInbox. reason prose says '169 keys'; the dead-keys report measured the head at 194 leaves at base (190 now). Stale before this change; an AGENTS.md rule 9 instance. In Acceptance notes.", "carrier: none (承接者:无) · noted, not filed: packages/app-shell/src/views/__tests__/DeclaredActionsBar.test.tsx carries a cross-file line address into ApprovalsInboxPage.tsx that already pointed at unrelated lines at c4dd707 (bulk-reject dialog, empty state); this deletion shifts it again. Not swept, per AGENTS.md rule 11. In Acceptance notes." ], "deviations": [ "File surface: three sibling tests outside the literal 'any other test that asserts the panel' (they assert nothing about it) had COMMENT-only edits, because their prose justified the setup.access fixture by the panel staying shut and the deletion made that false. No assertion, fixture or import changed in them.", "Mechanism assumption 2's named verdict (check:i18n-dead-keys) is structurally blind to approvalsInbox; the one-reader proof is a hand census of literal tr() keys over both approvalsInbox translators plus a whole-tree spelling grep, recorded in the PR body.", "Ablation mutated by restoring the page's whole base blob (git checkout c4dd707 -- path) rather than objectstack's anchor tool ablation-replace.mjs: the base blob is exactly 'the panel put back', and no dist sits between the page and the test (console tests import this app's source). Landing was proven on disk by grep counts both ways and restoration by HEAD blob hash plus empty git diff HEAD.", "No negative packages/i18n pin for the four retired keys (earlier retirement batches carry one); the console absence pin holds the panel, and a key returning alone would be an unread row. Said in the PR's Acceptance notes so the seat can ask for one.", "Clause-② line written per the PM addendum as 'Clause-②: no (narrowing) — ...' naming the four keys, on its own line in both the PR body and the changeset body. Nothing measured widens a published surface.", "Commit trailers are the model-free pair from AGENTS.md (Claude-Session + Co-authored-by: Claude), not the harness reminder's model-named Co-Authored-By, per the AGENTS.md precedence clause.", "Shared state: the worktree recipe's git fetch ran in the shared objectui checkout (origin/main stayed c4dd707); the pre-PR drift check fetched into refs/probe12490/main (no movement, no overlap), deleted afterwards. The closure build plus type-checks ran under the lock via nohup and were awaited in the foreground with tail --pid in one call.", "Card and PR reads used gh api single-resource REST GETs, not the payload channel." ], "files_changed": [ ".changeset/12490-drop-raw-payload-panel.md", "apps/console/src/pages/system/ApprovalsInboxPage.tsx", "apps/console/src/pages/system/ApprovalsInboxPage.rawPayloadGate.test.tsx (renamed to the next entry)", "apps/console/src/pages/system/ApprovalsInboxPage.noRawPayloadPanel-12490.test.tsx", "apps/console/src/pages/system/ApprovalsInboxPage.hiddenFieldTrim.test.tsx (comments only)", "apps/console/src/pages/system/ApprovalsInboxPage.summaryFaces-11677.test.tsx (comment only)", "apps/console/src/pages/system/ApprovalsInboxPage.deadlineSettled-11815.test.tsx (comment only)", "packages/i18n/src/locales/en.ts", "packages/i18n/src/locales/zh.ts", "packages/i18n/src/locales/ja.ts", "packages/i18n/src/locales/ko.ts", "packages/i18n/src/locales/de.ts", "packages/i18n/src/locales/fr.ts", "packages/i18n/src/locales/es.ts", "packages/i18n/src/locales/pt.ts", "packages/i18n/src/locales/ru.ts", "packages/i18n/src/locales/ar.ts" ], "line_budget": "not applicable (no skills/** surface)", "cleanup": "Worktree /home/user/objectui-issue-12490 removed: node_modules first, then git worktree remove without --force (succeeded, clean). PR body and actions scratch files deleted. No dev server or monitor was started." }Generated by Claude Code
objectstack-fleet commentedon Oct 18, 2026
ACCEPT → PR #12934 comment
6245852099· contract reviewCONTRACT_REVIEW_TIERPASS6245842803(narrowing face) · headbec77e5·domain:uiseat 1 ·session_0188TsgPV8kQXfuRuKmkj2ks· 2026-10-18T04:55ZThe dev's report is
6245764075. The PR goes to ready and auto-merge through objectui's merge queue. The landing note follows on MERGED.Generated by Claude Code
objectstack-fleet commentedon Oct 18, 2026
Landed ·
domain:uiseat 1 ·session_0188TsgPV8kQXfuRuKmkj2ks· 2026-10-18T05:14ZPR #12934 merged through objectui's merge queue as
9b82cedada. Its one parent,c4dd7078e, is also the merge-base of the reviewed head. It is an ancestor oforigin/main.c4dd7079b82cedbec77e562a81abdafc7)maySeeRawPayloadinApprovalsInboxPage.tsxApprovalsInboxPage.rawPayloadGate.test.tsxApprovalsInboxPage.noRawPayloadPanel-12490.test.tsxrawData: 'Raw data (JSON)'inen.tsState change:
Fixes #12490closed this cardcompleted. In this actpm:dispatchedis removed.record:jsonpanel of the request payload, gated onstudio.access(objectui#12490, face 4 of objectui#12438 letter C) objectstack#23746 comment6232118266).Records: the claim
6245586356, the dev's report6245764075, the contract review6245842803(PASS,CONTRACT_REVIEW_TIER) and the ACCEPT6245852099.Generated by Claude Code