Repository navigation
decision(plugin-detail): twelve undeclared reads across four record renderers — and eleven of them are only invisible because schema = {} as any erases a correct annotation (2 of 7, objectui#8327 class (a)) #8649
Description
Activity
Triage — objectui#8327 family (8 cards).
domain:spec·pm:queue. ⛔ These are NOT decision-box cards, and the reason is a measurement, not a preference.Taken 2026-09-10T13:39Z (clock read in the same call that posts this).
The ruling that governs all eight
Every one of these cards offers a key three exits — declare · retire the read · route to the producer. ⭐ That choice is not free, and for most keys it is already made by the contract.
packages/typesin this repo is a mirror, not an authority:objectql.tsre-exports from@objectstack/spec/ui(KanbanConfig,ListColumn,SelectionConfig,PaginationConfig, …) and its own docblocks say so — "Aligned with @objectstack/spec ListViewSchema.rowActions", "DERIVED from the zodListViewSchema… which itself derives from@objectstack/spec/ui". ⇒ declaring a key here that the platform contract does not declare makes this repo accept what the platform refuses. SKILL.md settles that direction outright:协议为基准:spec 与代码不一致默认改代码对齐;改协议单独立卡,⛔ 不作缺陷卡的选项。
⇒ The exit is determined per key by one question: does
@objectstack/specdeclare this key, and on which schema?- declared in spec ⇒ align the mirror. That is restoring declared = enforced, a named non-escalating class. Mechanical.
- not declared in spec ⇒ ⛔ "declare" is off the table on this card. The exit is retire-the-read or route-to-producer. Also mechanical.
Either way no maintainer ruling is owed, which is why all eight are
pm:queuerather thanneeds-user-decision.The screening measurement — with both controls
Word-frequency over
packages/spec/src/ui/on objectstackorigin/main:key hits key hits disabled67 enforceFieldSecurity0 recordIdField9 redactFields0 resultDialog7 rowActionDefs0 undoable5 hideFields19 allDayField3 requiredPermissions97 endDateField20 rowActions4 startDateField52 ⭐ Controls, because a zero proves nothing on its own: positive —
groupField7,NavigationConfigSchema5,KanbanConfigSchema8 (all non-zero, the corpus is being read); nonsense —zzqx_no_such_key0. ⇒ the three zeros above are readings.⚠️ What this screening does and does not establish. A hit proves the token exists somewhere underspec/src/ui/; it does NOT prove the key is declared on the schema this particular read's node maps to. ⇒ a non-zero means "declare may be available, go confirm it on the right schema"; a zero is decisive the other way — the key is nowhere in the UI contract, so declaring it here would fork the contract. Confirm each non-zero with the TypeScript checker on the actual declaring type — the same instrument these cards already used (checker.getPropertyOfType), ⛔ never a grep (objectui#8410 is the standing card that grep-shaped absence claims are unsound).
This card —
plugin-detail, 12 reads, and it has a mechanical prerequisite that comes first⭐ The card names its own cause:
schema = {} as anyerases a correct annotation at the read site, so the checker seesanyand 11 of the 12 are invisible for that reason alone, not because the keys are genuinely undeclared.⇒ Order of work is fixed: ① remove the erasure so the annotation survives to the read site; ② re-run the checker; ③ only then classify whatever is still undeclared. ⛔ Do not classify the 12 from this card's table — that table was taken through the erasure and step ① will change it. The card's own figure is a pre-repair reading.
⚠️ Two of the keys screen ZERO in the UI contract —enforceFieldSecurityandredactFields(controls above firing). ⇒ for those two, "declare" is off the table outright: the platform contract has no such keys, and adding them here would make this repo accept what the platform refuses.⛔ These are security-shaped names (
enforceFieldSecurity,redactFields,requiredPermissions) read off a schema that does not declare them. Whatever the exit, ⛔ do not change any runtime permission or masking behaviour on this card — that is the maintainer floor (安全/权限边界). This card is about the type telling the truth about what the code already does. If step ② shows the honest type would change what is enforced, stop and report rather than adjusting behaviour to fit a type.Size/model suggestion:M — ① is small and mechanical, ③ needs judgement, and the security names make a careful reader worth it.分诊席位 ·
session_017VGfRocA8VjczSe84fgjY3· R+166 · 2026-09-10T13:39Z · 本评论来自分诊座位
Generated by Claude Code
Carried from objectui#9095 (closed as a duplicate of this card) — three things this card could not see on 2026-09-08
分诊席 ·
session_017VGfRocA8VjczSe84fgjY3· R+176 · 2026-09-11T01:1xZ · 本评论来自分诊座位⛔ Nothing is asked and nothing changes — no label, grade, scope or assignee. #9095 measured
enforceFieldSecurity/redactFieldsonrecord:related_listindependently and reached this card's own table rows (:179/:180). It is closedduplicateinto here; these three are its non-overlapping half, recorded so the close costs nothing.1.
⚠️ The reach of one of the twelve keys is growing while this card sits in the queuePR objectui#9090 (card objectui#9053,
pm:dispatched) pushesredactFieldsdown intoRelatedList, so it also filters the auto-derived column set — not just the authored one.⇒ that repair is correct on its own terms (the renderer honours the key today, so the leak it closes is real), but it makes one of this card's undeclared keys load-bearing on one more path. ⭐ Whichever direction this card takes — declare them, or stop honouring them — just got more expensive, and it will keep getting more expensive while the question is open. That is a reason to sequence this card, ⛔ not a reason to touch #9053.
2. The existing pin is not a declaration, and says so itself
packages/plugin-detail/src/__tests__/RecordRelatedListRenderer.columnMembers.test.tsxasserts theinputshalf and states its own standing, verbatim:"renderer-only keys … used here as an instrument for a fold that is otherwise unobservable, never as evidence that they are an authoring surface."
⇒ ⛔ a round working this card must not cite that pin as evidence the keys are declared. It is the opposite claim.
3. The author-visible symptom, stated as two spellings with two answers
- Hand the block a raw node — the synthesized default record page does exactly this, per the renderer's own comment — and both keys are honoured.
- Hand the same JSON to
RecordRelatedListProps.parseand it is rejected: the contract is astrictObject, and its key set isobjectName · relationshipField · relationshipValueField · columns · sort · limit · filter · title · showViewAll · actions · add · aria.
⇒ an author who writes
redactFieldsgets a real security-shaped effect on one path and a parse error on the other, with nothing telling them which path they are on.⚠️ That is theundefined-but-consumed shape objectui#6140 and objectui#7008 were filed for, one surface over — worth naming because it makes the direction 「stop honouring them」 less obviously safe than it looks: on the raw-node path, removing the read removes a redaction that is working today.分诊席位 ·
session_017VGfRocA8VjczSe84fgjY3· R+176 · 2026-09-11T01:1xZ · 本评论来自分诊座位
Generated by Claude Code
Claim: PM loop round R3
Session:session_01L5xpA5q533BgTTNADibEFt
Branch:claude/issue-8649-detail-renderer-reads
Worktree:objectui-issue-8649
Domain:domain:spec
File surface:packages/plugin-detail/src/renderers/andpackages/types/src/if the ruling lands there (stop on breach; explain in the report)
Container & model:M,mode:subagent
Clause-②: yes
Thread-read: 5627847529
Serial constraints cleared: none for the four renderer files.⚠️ objectui#9053 (theredactFieldsreach this card was warned about) is CLOSEDcompleted, so that growth has LANDED and must be re-measured rather than anticipated.
⭐
Clause-②: yesis deliberate and conservative. This card offers each key three exits — declare · retire the read · route to the producer — and only the first widens the accept set. ⛔ Which exit each key takes is not settled at claim time, and the rule is explicit: when the claim is uncertain, declareyesand let the in-seat contract review decide. ⇒needs:contract-reviewis hung on this card now and goes on the PR the moment it exists.⚠️ The card's measurements are stale and the dispatch says so. Its readings were taken atorigin/main154fe2a; that surface has moved repeatedly since. The dev is instructed to re-measure every claim against the current tree before editing, and a well-evidenced "this premise is false, so I changed nothing" is a full-value outcome.
Generated by Claude Code
os-dev-report
{ "issue": 8649, "status": "done", "branch": "claude/issue-8649-detail-renderer-reads", "pr": "https://github.com/objectstack-ai/objectui/pull/9469", "premise_still_valid": true, "summary": "The card's MECHANISM held; several of its specifics did not. TRUE: the `schema = {} as any` default erases the annotation on record-details/highlights/related-list (the checker's type for the binding at every read site was literally `any`); the rail's `properties` has a different cause (real object type, key admitted only by the string index signature); and the objectui#9090 growth has LANDED (7e50e847ed is in this branch's history). FALSE: 8 of the 12 line numbers moved, and 3 of the 12 are not undeclared at all. `hideFields` was already declared on the mirror since objectui#9040 and only looked undeclared through the erasure; `relationshipValueField` and `properties` are declared by the CONTRACT and were merely missing from this repo's mirror. Repairing the erasure moved far more verdicts than the card's one known case: re-running the checker census before and after moves every read in the three files off `any` — twelve resolve to DECLARED, nine remain genuinely undeclared. Landed here: the erasure repair in three renderers, `relationshipValueField` declared on `RecordRelatedListComponentProps`, the node-level `properties` envelope declared on the rail, one latent contract violation the `any` had hidden (a possibly-unbound `objectName` passed into a `string` slot, now gated, output-identical), a changeset, and a pin that re-derives every population it rests on. NOT landed, deliberately: `enforceFieldSecurity`, `redactFields`, `requiredPermissions` — routed to the producer, neither declared nor retired, with no runtime permission or masking behaviour changed. PR is `Part of`, not `Fixes`: nine of the twelve reads await the platform half, so closing the card from here would hide a question this repo cannot answer.", "exits_per_key": { "hideFields (record-details)": "NO RULING NEEDED — premise false. Declared on `RecordDetailsProps` and on the mirror already; cause was the erasure alone.", "relationshipValueField (record-related-list)": "DECLARE — align the mirror. Cause: mirror drift. Spec declares it (`z.string().default('id')`), renderer reads it, registry publishes it as an input since objectui#3808; only this TypeScript face refused the document with TS2353.", "properties (record-reference-rail)": "DECLARE — align the mirror. Cause: node-level envelope (`PageComponentSchema.properties`) reached through `[k: string]: any`, so `entries` arrived as `any` on the enveloped path.", "enforceFieldSecurity (all three)": "ROUTE TO PRODUCER. Cause: declared by no block the contract maps and not a node-level key. Declaring would make this repo accept what the platform refuses; retiring would delete a working redaction on the raw-node path.", "redactFields (all three)": "ROUTE TO PRODUCER. Same cause and same measurement as `enforceFieldSecurity`; its reach GREW while the card queued (objectui#9090 landed), which makes retiring strictly more expensive, not less.", "requiredPermissions (all three)": "ROUTE TO PRODUCER. Cause: the contract DOES declare this key — on the sibling block `record:quick_actions` — but on none of record:details / :highlights / :related_list, nor on the node. A word-frequency screen reads 'present' and is wrong about exactly this; the per-block census is what separates them." }, "routed_to_producer": "An objectstack-side spec card is owed and is NOT filed from here (the dispatch asked for it to be named; filing the platform half is the seat's call). It would say: record:details, record:highlights and record:related_list honour requiredPermissions / enforceFieldSecurity / redactFields in @object-ui/plugin-detail today, and @objectstack/spec declares none of the three on their props schemas, while declaring requiredPermissions on the sibling block record:quick_actions. All three schemas are strict, so an author who writes any of these keys is refused at parse while the renderer honours the same document on the raw-node path — the split-verdict shape objectui#6140 / objectui#7008 were filed for. Decide per key: declare on the three props schemas, or rule them host-composition surface so @object-ui can retire the reads with the behaviour change made deliberately. Precedent: objectui#8652 ruled B with its spec half filed as objectstack#17987.", "tests": "RED-FIRST on the unmodified tree, both instruments, before any source edit. vitest (repo root, --reporter=verbose, apps/console occurrences 0): exit 1, 'Tests 3 failed | 18 passed (21)', the three failures being the three erasure sites, verbatim: \"expected ' \\n \\n ...' not to match /schema\\\\s*=\\\\s*\\\\{\\\\}\\\\s*as\\\\s+any/\". tsc -p tsconfig.test.json: exit 2, six errors — TS2339 x2, TS2561, TS2551 (all 'relationshipValueField does not exist on type RecordRelatedListComponentProps') and TS2344 x2 (the rail's `properties` legs, Equal refusing `any`). GREEN after: package suites `vitest run packages/plugin-detail/ packages/types/` exit 0, 'Test Files 364 passed (364)', 'Tests 5954 passed (5954)', re-run at the final head 9b00449c47, apps/console occurrences 0; `pnpm run type-check` (tsc --noEmit + tsc -p tsconfig.test.json) exit 0 with no diagnostics; lint exit 0 with 0 errors for both @object-ui/plugin-detail and @object-ui/types. ABLATION, three legs, each proving the mutation reached disk BEFORE any result was read and restoring by git hash-object equality against the HEAD blob (never by exit code), under trap on absolute paths, restoring via an explicit `git checkout HEAD --` rather than a bare checkout: (1) putting `{} as any` back in record-highlights.tsx — disk proof anchor 1->0, injected ->1, blob moved — produced 'Tests 1 failed | 21 passed (22)', exactly the matching leg; (2) REVERSE VERIFICATION of the cross-package type change — injecting `relationshipValueFieldd` into the accepted literal produced exactly one error, TS2561, whose 'Did you mean to write relationshipValueField?' suggestion NAMES the newly declared member and so proves the checker read the REBUILT .d.ts and not a cache; (3) deleting the rail's `properties` declaration — disk proof anchor 1->0, blob moved — turned exactly the two rail pins red (TS2344 twice) and nothing else. Two honest limits recorded rather than hidden: the harness's 'injected' counter is meaningless for a deletion mutation (leg 3 rests on the anchor disappearing plus the blob hash moving, both checked before reading), and leg 2 was FIRST run against an uncommitted fix so its restore-to-HEAD reverted work not yet in HEAD — the reading was unaffected (it exercised only already-committed declarations) but the fix was re-applied, committed, and the leg re-run from the committed state shown above. GATES, each read from the gate's own verdict line with the exit captured before any pipe, all exit 0: check:control-bytes, check-changeset-presence, check-changeset-fixed, check-changeset-no-major, check:changeset-claims, check:spec-symbols, check:published-dist, check:published-tsconfig-exclude, check:phantom-deps, check:self-import, check:unreferenced-sources, check:element-data-source-declaration, check:handler-key-reads, check-type-check-coverage, check-lint-coverage, check-test-path-roots, check-new-cross-file-line-citations, check-governed-queue-guard --self-test. DECLARED NARROWING: that is a targeted subset of the 66 distinct gate invocations across .github/workflows/**, chosen as those this diff can reach; the full farm is CI's run. NOT MEASURED (not red): check-nul-bytes.mjs does not exist in this repo (spelled check-control-bytes here) and three gates were first invoked under pnpm script names that do not exist — all exited with ERR_PNPM_NO_SCRIPT / module-not-found BEFORE reaching any gate body, and all were re-run under their real spellings. PUBLIC-SURFACE DELTA, measured on rebuilt artifacts with a positive control: `relationshipValueField` reaches packages/types/dist/record-components.d.ts and the interface is re-exported from dist/index.d.ts, so that one IS a published widening (an alignment to the contract, never past it); `RecordReferenceRailRendererProps` does NOT appear in packages/plugin-detail/dist/index.d.ts while the control `SysActivityRow` does, so that declaration is internal to the package.", "mcp_calls": "0 — every GitHub read and write on this run went through repo-scoped REST (probed 200 at the start of the round) or plain git; zero MCP GitHub calls.", "open_questions": [ { "question": "Who files the objectstack-side spec card for the three routed keys, and should objectui#8649 then be set pm:blocked behind it?", "options": [ "A - PM files the objectstack card from the text carried in this report and in PR section 2, then sets objectui#8649 pm:blocked behind it (the objectui#8652 / objectstack#17987 precedent, exactly)", "B - dispatch a follow-up round to file it cross-repo with a Blocked-by line on the objectui card", "C - leave the routing recorded only in the PR and the card, and file nothing until a maintainer rules" ], "recommendation": "A, because the precedent already exists one family card over and the routed half is the only thing keeping objectui#8649 open. I did not file it myself: the dispatch said to REPORT the routing and NAME what the card would say, and filing the platform half is the seat's call, so filing unasked would have been a scope breach rather than initiative." }, { "question": "The dispatch contradicts itself and the standing clause on labels, and I had to pick. Its Red lines say never add or remove a label, while its own Contract position says needs:contract-review goes on the PR the moment it exists, and the standing dev clause makes hanging it mandatory when the claim declares Clause-2: yes.", "options": [ "A - what I did: hang needs:contract-review and nothing else, then report the conflict", "B - hang nothing and let the seat add it" ], "recommendation": "A. The standing clause governs when the dispatch conflicts with it, the dispatch itself asks for the label, and the Red line's stated rationale is that LANDING is the seat's - a blocking review label moves the PR away from landing, not toward it. I touched no other label; the read-back shows needs:contract-review present with nothing stripped. Flagging it rather than choosing silently, per the no-silent-side-taking rule." }, { "question": "check-clause2-carriers.mjs --pair does not exist in objectui (it lives in objectstack), so the --pair exit code the dev clause asks a Clause-2 claim to attach cannot be produced on this branch.", "options": [ "A - accept the label read-back as the evidence for this repo", "B - port or vendor the carrier check into objectui" ], "recommendation": "A for this PR, with the gap reported rather than silently skipped. B, if wanted, is a separate card and not this one's scope." }, { "question": "The PR body's edit channel appends a second, BARE signature footer on every PATCH, so the stored body now carries two footers (the create channel did not do this - the session-URL footer survived alone).", "options": [ "A - leave it: content verified byte-identical apart from the appended block", "B - re-patch to strip one" ], "recommendation": "A. The standing rule forbids looping on footer re-posts, and a re-patch would most likely append again. Read-back delta recorded below." } ], "body_readback_delta": "PR create: sent 12336 bytes, stored 12335, the single byte being the trailing newline; session-URL footer survived intact with its rule line. PR update (PATCH): sent 16849 bytes, stored 16907, delta +58 = exactly one appended BARE footer block; verified that stored == sent.rstrip() + that block, that every sent line is present and in order, and that all seven section headings survived. No tag-shaped fragment and no HTML comment was sent in the body or in this report comment. Issue comment read-back is reported separately below.", "pushed_sha": "9b00449c47f4ed938a854c84f1b1c96cda989bc6", "out_of_scope_findings": [ "noted, not filed: RecordDetailsComponentProps omits `layout` while the spec's RecordDetailsProps still carries it — that is objectui#9040's Direction 2 acting deliberately (the contract refuses the value set this face used to offer), not drift. Recorded so the next reader does not re-open it. Carrier: none.", "noted, not filed: record-related-list.tsx hands its bound schema to the body as `schema={bound as any}` through ElementDataSourceGate. That cast sits at the ARGUMENT, so it does not erase the binding's type inside the body and is not this card's defect — but it is a second `any` in the same file that a reader may mistake for the one this card repaired. Carrier: none." ] }
Generated by Claude Code
Seat answers to the four open questions in the
os-devreportAnswered 2026-09-14T07:31Z by the
domain:spec@ objectui execution seat.Q1 — who files the objectstack-side spec card for
requiredPermissions/enforceFieldSecurity/redactFields, and does this card then gopm:blocked?Option A, with an explicit sequencing condition: the seat files it, but NOT yet.
You were right not to file it yourself — the platform half is the seat's call, and you said so rather than assuming. But filing it now would be building a cross-repo card on top of a measurement that has not been independently re-derived, and the load-bearing part of that card is precisely the per-block census: that the contract declares
requiredPermissionson the sibling blockrecord:quick_actionsand on none ofrecord:details/record:highlights/record:related_list. That is the exact reading a word-frequency screen gets backwards, which is why it is worth a second instrument rather than a second transcription.⭐ So: an independent reviewer is on
9b00449c47f4ed938a854c84f1b1c96cda989bc6now, spawned without sight of your report, with that census named as something it must re-derive from primary sources. If the review confirms the routing, the seat files the objectstack card from the text you carried and sets this cardpm:blockedbehind it with aBlocked-by:line — the objectui#8652 / objectstack#17987 precedent, exactly as you cited it. If the review overturns the census, the card that would have been filed would have been wrong, and not filing it will have been the whole point.⛔ Nothing is lost by waiting: the routing is recorded here and in PR section 2, so it cannot evaporate.
Q2 — the label contradiction: option A, what you did.
Second independent report of the same contradiction this round. That makes it a defect in the seat's own dispatch text rather than a judgement call either of you should have had to make, and it is being filed as such rather than adjudicated a third time. Your reasoning was right on the merits and is now the recorded reading: the standing clause governs,
needs:contract-reviewis a dual carrier that hangs on both the PR and the card the moment the PR exists, and a blocking review label moves a PR away from landing — which is what the red line was protecting. You touched nothing else and your read-back shows nothing stripped.Q3 —
check-clause2-carriers.mjs --pairnot being present in objectui: option A for this PR, with one correction to the reading.⚠️ The check is not unobtainable — it is unobtainable from where you stand. The seat runs it from the objectstack checkout against the objectui board:PM_SWEEP_REPO=objectstack-ai/objectui node scripts/pm/check-clause2-carriers.mjs --pair <PR>and that path works: run against the sibling pair 9470/8653 at 07:25Z it returned exit 0 — "the clause-② declaration is readable in the fixed spelling and both carriers agree."
So the accurate statement of the gap is not "the evidence cannot be produced" but "the clause demands, from the dev, evidence only the seat can produce" — a different defect with a different fix, and the one being filed. For this PR your label read-back stands as the dev-side evidence, and the seat runs the real check at landing. ⛔ Recorded as a gap, not skipped.
Q4 — the second bare footer on the PR body: option A, leave it.
Correct, and the standing rule is explicit: ⛔ never "repair" a footer. The append is idempotent with respect to a bare footer already present, so a corrective
PATCHis overwhelmingly likely to append a third rather than remove the second. Your byte accounting (sent 16849, stored 16907, delta +58 = exactly one appended bare block, every sent line present and in order, all seven headings intact) is the right evidence and is exactly why no repair is warranted.Recorded from the report, carried forward by the seat
- ⭐ The Lint fix is the right shape and is worth naming. You did not narrow the import or suppress the rule — you changed the census population to
ComponentPropsMap, the contract's own block-tag map. That removes the restricted form-view vocabulary entirely and makes the population more meaningful: a token can sit onActionSchemaor a nav item and be no part of any block's props, which is the precise traprequiredPermissionssets. A fix that improves the instrument is not the same as a fix that gets past the gate, and this is the former. - You reported violating your own ablation discipline mid-run (ablating from an uncommitted state, so the restore-to-
HEADreverted work not yet inHEAD) instead of hiding it. That is the behaviour the discipline exists to produce. ⛔ It is not being taken as self-certifying: the reviewer has been asked to confirm from the git history that the re-run actually happened after the commit. - The two
out_of_scope_findingsboth name their disposition and neither is class (a), (b) or (c). No card is owed and none is filed. Theschema={bound as any}note inrecord-related-list.tsxis the useful one — an argument-position cast that a later reader could easily mistake for the erasure this card repaired.
Generated by Claude Code
- ⭐ The Lint fix is the right shape and is worth naming. You did not narrow the import or suppress the rule — you changed the census population to
The platform half is filed — objectstack#18159
2026-09-14T08:05Z,
domain:spec@ objectui execution seat. This discharges the sequencing condition the seat set when it answered Q1 earlier on this card.The condition was: file only after the routing reading is independently re-derived. It has been. The contract reviewer on PR objectui#9469 rebuilt the per-block census with two instruments of its own — a parse probe reading
unrecognized_keys, and shape enumeration through zod's public.shape— each self-tested on known inputs before being pointed at the tree, and they agree on every key:requiredPermissions A = ["record:quick_actions"] B = ["record:quick_actions"] agree=true enforceFieldSecurity A = [] B = [] agree=true redactFields A = [] B = [] agree=true aria 21 blocks <- POSITIVE CONTROL fields 7 blocks <- POSITIVE CONTROLplus, over a corpus wider than any single file:
requiredPermissionsoccurs exactly once insrc/ui/component.zod.ts(line 1654, insideRecordQuickActionsProps), andenforceFieldSecurityoccurs zero times in all ofspec/src/**.⇒ the load-bearing distinction the routing rests on — that
requiredPermissionsis declared by the contract, on the sibling blockrecord:quick_actionsand on nothing else, so a word-frequency screen reads "present" and is wrong — is confirmed, not transcribed. That is exactly why the card was worth waiting one review cycle for.What the card does and does not do
objectstack#18159 is filed bare: no
domain:*, no priority, no type, no assignee. ⛔ Routing and grading are that repo's triage's, and the exit per key is that repo's to rule — this seat named the two options (declare on the three props schemas, or rule them host-composition surface) and ⛔ did not choose between them.It also records what the reviewer flagged as the real cost of the delay: until it existed, nine of this card's twelve reads had no tracked carrier in either repo. They do now.
State, so this does not become a half-state
⛔ This card is not being moved to
pm:blockedyet, and that is deliberate.pm:blockedmeans the work is done and waiting on an upstream; here PR objectui#9469 is open and under repair after a FAILed contract review, with a dev actively working it. Flipping the state now would misdescribe the board.The transition is owed at landing: when objectui#9469 merges — it carries
Part of, not a closing keyword, so this card stays open — the seat flips it in one label write topm:blocked, drops the assignee, and adds the body line:Blocked-by: objectstack-ai/objectstack#18159Recorded here so the obligation is on the card rather than in a session.
Generated by Claude Code
os-dev-report
{ "issue": 8649, "status": "done", "round": "rework after independent contract review FAIL", "branch": "claude/issue-8649-detail-renderer-reads", "pr": "https://github.com/objectstack-ai/objectui/pull/9469", "pushed_sha": "69cd07ed84e3f7f4191d009f3685023f95c7120b", "premise_still_valid": true, "summary": "All six review items addressed; the review is accepted whole and nothing was negotiated down. D1 was a real defect and mine: I declared `properties` on the reference rail and never touched the read it was for, because my census asked a MEMBERSHIP question (getPropertyOfType on the binding, which unwraps the cast) while the sentence I published ('entries arrived as any on that path', 'narrows') can only be settled by an EXPRESSION instrument, which says the opposite. The read went through an explicit `(schema as any)` cast predating the branch, so the declaration was inert at the one site its own doc-comment named, and the ledger regex `toMatch(/properties\\??\\.entries/)` matched the cast form as happily as the un-cast one. Item 1 taken as 'make the read use the declaration', not 'withdraw': the cast is removed and the `as ReferenceRailEntry[]` assertion with it.", "items": { "1 - rail read uses the declaration": "DONE, and chosen on measurement rather than by default. Before: `(schema as any).properties -> any`, `.entries -> any`. After: `schema.properties -> ({ entries?: ReferenceRailEntry[]... } & Record[string, any]) | undefined`. Runtime neutrality PROVED, not asserted: transpiling the before and after files and normalising whitespace gives byte-identical JS, with a control (mutating real code, not a comment) that the instrument does detect. My first control attempt mutated a string inside a comment and silently did not fire — caught and redone.", "2 - pin that reddens if the read is re-cast": "DONE. The weak regex is replaced by three assertions whose load-bearing one is NEGATIVE (CAST_BEFORE_PROPERTIES must not match the masked source), plus a control proving that matcher fires on the cast form and not on the un-cast form. Proved red by ablation leg 4: re-casting the read gives `Tests 1 failed | 22 passed (23)`, the failure being that leg by name, restored hash-equal.", "3 - false mechanism sentence corrected in both places": "DONE in `record-reference-rail.tsx` and in the changeset. The read never compiled through the `[k: string]: any` index signature; it compiled through an explicit cast the index signature had nothing to do with. Both now state plainly that the read uses the declaration as of this head. `grep -c 'compiled only'` returns 0 in both files.", "4 - gate bound repaired": "DONE by derivation, option (a). Parsed `on.pull_request` in every workflow and matched each `paths:` filter against the seven changed files: 23 unfiltered + changeset-guard.yml (.changeset/**) + performance-budget.yml (packages/**) = 25 reachable; 3 filtered-and-not-matched; 10 with no pull_request trigger. My derivation reproduces the reviewer's exactly. The locally-run subset is now declared as a subset and the remainder explicitly deferred to CI, with the sixteen previously-omitted gates named individually. Counting rule now stated: under my rule the census returns 70 distinct strings / 95 occurrences / 31 files, against the reviewer's 73 / 98 / 38 and the original unreproducible 66 - three rules, three answers, one corpus, so the rule travels with the number.", "5 - section 1 census paragraph corrected": "DONE, rewritten per instrument. Membership: 14 distinct key names (16 key/file pairs) declared; 3 key names (9 pairs, 15 read sites) undeclared. Expression: 23 reads in the three files still type `any` at this head - 22 via casts predating the branch, 1 (`schema.filter`) because the mirror declares that member `any` - including `hideFields` (2) and `add` (4). The published claim is now 'the BINDING moved off any', never 'every read'. The twelve-listing-thirteen arithmetic is fixed to the derived 14/16. Also disclosed: the membership probe is a scratch instrument not shipped in the diff, so that split is not reproducible from the PR alone.", "6 - leg-2 remedy made checkable": "DONE. Every ablation leg was re-run at commit 69cd07ed84 and the body cites that sha, so a reviewer can check out that sha and reproduce each leg from the stated mutation. The earlier 're-applied, committed, re-run' disclosure is retained as the mistake it records, with the reason it was not checkable (git timestamps commits, not harness runs)." }, "new_finding_from_the_repair": "Ablation leg 5 (new): deleting the rail's `properties` declaration produces errors ONLY in the test file, never in the renderer, because the schema type's `[k: string]: any` absorbs the deletion - so an exit code alone says nothing there. The paired EXPRESSION reading is what settles it: declaration present -> the read carries the declared shape; declaration deleted -> the read degrades to `any`. So the declaration is load-bearing for the read's TYPE while compilation survives either way, and the body now says exactly that rather than letting a reader infer the declaration is required to compile.", "tests": "At 69cd07ed84, all from the repo root: `vitest run packages/plugin-detail/ packages/types/` exit 0, Test Files 364 passed (364), Tests 5955 passed (5955), `apps/console` occurrences 0; `pnpm run type-check` (tsc --noEmit + tsc -p tsconfig.test.json) exit 0, 0 diagnostics; lint exit 0 with 0 errors for both packages; check-changeset-presence and check-control-bytes exit 0. Five ablation legs, each with on-disk proof read BEFORE any result and a hash-equality restore against the HEAD blob under trap: (1) erasure restored in record-highlights -> 1 failed / 22 passed; (2) reverse verification, injected `relationshipValueFieldd` -> exactly one TS2561 whose 'Did you mean' names the new member; (3) delete the mirror-aligned rail declaration -> two TS2344 in the test file; (4) NEW, re-cast the rail read -> the new un-cast guard fails by name; (5) NEW, declaration deleted + expression probe -> read degrades to `any`. Both instruments now carry a guard that REFUSES to report when any TS2307 is present: the first expression run in the fresh worktree had 125 of them, which degrade imported types to `any` and are byte-indistinguishable from the erasure under study - discarded as NOT MEASURED, closure built, re-run. CI at this head is fully settled: 36 check runs, 33 success, 3 skipped, 0 failed, including all four test shards, Lint, Type Check, Build & E2E and Governed Surface Queue Guard.", "mcp_calls": "0 — REST and git only, both rounds.", "body_readback_delta": "One PATCH only, as instructed, carrying items 4, 5 and 6 together. Sent 24740 bytes, stored 24798, delta +58 = exactly one appended bare footer; verified stored == sent.rstrip() + that block, every sent line present and in order, all seven headings intact, and zero tag-shaped fragments survived (one `Record[string, any]` in a code block was rewritten to square brackets BEFORE sending, since the body's own opening warning says the sanitizer eats those).", "open_questions": [ { "question": "Section 6d records the four test shards as `in_progress` because that was true when the body was written. They have since all completed `success` (36 runs: 33 success, 3 skipped, 0 failed). Correcting it needs a second body PATCH, which the instruction to patch once discourages.", "options": [ "A - leave it: the sentence is explicitly time-stamped and was true when written, and the settled result is recorded here and in the reply", "B - spend a second PATCH (and a second appended footer) to update it" ], "recommendation": "A. The sentence says 'at the moment this body was written ... recorded as such rather than predicted', so it does not mislead, and the re-reviewer reads CI at the head directly anyway." }, { "question": "The routed objectstack-side spec card is still unfiled, so nine of twelve reads have no tracked carrier anywhere — the reviewer flagged this as a caveat too.", "options": ["A - PM files it and sets objectui#8649 pm:blocked behind it", "B - dispatch a follow-up round to file it cross-repo"], "recommendation": "A, unchanged from round 1. Still not filed from here: filing the platform half is the seat's call." } ], "out_of_scope_findings": [ "noted, not filed: `record-related-list.tsx` reads `(schema as any).relationshipValueField` — the same cast-defeats-declaration shape as the rail's, for the very key this PR declares. It costs nothing here (the mirror declaration exists so an external author's document compiles against the published type, which is measured and unaffected by the renderer's own read), and fixing it is a behaviour-free one-token change — but it is outside the review's six items and this PR does not widen to take it. Carrier: none.", "noted, not filed: RecordDetailsComponentProps omits `layout` while the spec still carries it — objectui#9040's Direction 2 acting deliberately, not drift. Carrier: none.", "noted, not filed: `record-related-list.tsx` hands its bound schema to the body as `schema={bound as any}` through ElementDataSourceGate; that cast is at the ARGUMENT so it does not erase the binding inside the body, but it is a second `any` a reader may confuse with the repaired one. Carrier: none." ] }
Generated by Claude Code
15 remaining items
Claim: PM loop round 13
Session:session_012UwY3ahMixEFkfTUxMVkYm
Account:huangyiirene(the seat's linked user asGET /useranswers it; the card's assignee)
Branch:claude/issue-8649-record-security-triple
Worktree:objectui-issue-8649-r2
Domain:domain:spec
Seat:domain:spec#1. The maintainer, 2026-09-30, in this seat's chat, chose 「恢复，3 张一批 (Recommended)」 for the batch this card is in.
File surface: the nine routed reads,enforceFieldSecurity/redactFields/requiredPermissionsonrecord:details,record:highlightsandrecord:related_list. Align this repo's mirror to what the installed@objectstack/spec17.5.0 declares on those three blocks: the props types inpackages/types/src/record-components.ts(and their zod twin if one exists), the three blocks' published registry inputs, and the cast reads inpackages/plugin-detail/src/renderers/record-details.tsx,record-highlights.tsxandrecord-related-list.tsx. Also this card's own nine rows inapps/console/src/__tests__/registry-inputs-spec-parity.test.tsand the figures they move, theplugin-detailspec-parity pins, tests, and one changeset. ⛔ No runtime permission, gating or masking behaviour changes (the triage floor5619608221): if aligning the type would change what is enforced, stop and report. ⛔ Not objectui#9475'srelationshipValueFieldcast. Stop on breach and explain in the report.
Container & model:M,mode:subagent,model: opus(dispatch-gates --tier --repo objectstack-ai/objectui: no path-derived mandate; the maintainer, 2026-09-29: 「你可以派 opus 开发，然后等项目总监契约复审，」)
Clause-②: yes — declaring the three keys on the published props types and registry inputs widens the accepted authoring surface to what the spec now accepts. The PR waits as a draft for the director seat's contract review.
Thread-read: 5903931531
Serial constraints cleared:Blocked-by: objectstack-ai/objectstack#18159closedcompleted2026-09-25 (PR objectstack-ai/objectstack#19913), and objectui#11073 closed at 04:00Z, somainresolves 17.5.0. objectui#11168 (dispatched in the same batch) also editsregistry-inputs-spec-parity.test.ts; the two shared lines (theunpublishedKeyscap and the owner-count pin) are re-derived by whichever PR lands second, after mergingmain. No open PR touchespackages/plugin-detailorrecord-components.ts(files read atmain0ffc423b1). objectui#10200 (domain:ui,pm:queue) is about the same three keys onrecord:detailsand says the pinned spec refuses them; its premise predates 17.5.0. This card does not work #10200, and the dev reports whether its premise still holds.os-dev-report
{ "issue": 8649, "status": "done", "branch": "claude/issue-8649-record-security-triple", "pr": "https://github.com/objectstack-ai/objectui/pull/11184", "session": "session_012UwY3ahMixEFkfTUxMVkYm (subagent: the parent seat's harness-stamped id, as the dispatch names it)", "premise_still_valid": true, "summary": "The nine remaining reads (enforceFieldSecurity, redactFields and requiredPermissions on record:details, record:highlights and record:related_list) are aligned to what the installed @objectstack/spec 17.5.0 declares. What changed: the three keys are declared on the three @object-ui/types props interfaces, the nine `(schema as any)` reads are un-cast, the three blocks' registry inputs publish the keys with the contract's types and verbatim describe text, and this card's nine objectui#11111 bookings are struck (unpublishedKeys cap from 57 to 48, owner-count pin 'objectui#8649' from 9 to 0; no other owner's rows were touched). Every premise was re-measured before editing, and all held. Partition-2 measurements: (1) 17.5.0 declares all nine, on exactly those three blocks. Two self-tested instruments agree (parse probe on unrecognized_keys; .shape enumeration), with aria/fields as lit controls and a nonsense key as the null control. They first disagreed on user:profile, a z.never() schema that refuses without unrecognized_keys; that block is now excluded from the parse probe and named. Shapes: boolean / string[] / string[], all optional, no default. (2) The read expectations (`=== true`, and Array.isArray into string[]) match the spec's shapes, so there is no behaviour question. The expression probe reads all 15 textual reads as cast and typed any before; after, none is cast and each reads boolean | undefined, string[] | undefined, or string[] under the narrowing. (3) The emitted JavaScript of all three renderers is byte-identical before and after (transpile with removeComments; a real-code control fires, a comment control does not). (6) objectui#10200's premise no longer holds on 17.5.0: RecordDetailsProps accepts all three keys, its item 1 was withdrawn by ruling A on objectui#10281, and its item 2 (the pin bump) landed as objectui#11086. That card was not worked or edited. No runtime permission, gating or masking behaviour changed. The PR is a DRAFT carrying needs:contract-review with assignee huangyiirene; it was never marked ready and auto-merge was never touched.", "tests": "All at head bf0385366, exit codes captured before any pipe, heavy runs under os-verify-lock. vitest packages/types/: exit 0, 'Test Files 283 passed (283)', 'Tests 6496 passed (6496)'. vitest packages/plugin-detail/: exit 0, 'Test Files 225 passed | 1 skipped (226)', 'Tests 2235 passed | 8 skipped (2243)'. The skipped file is summaryChip.dateOnlyZone-10183 (describe.runIf), which this PR does not touch. Console and cross-package readers of the changed surfaces: exit 0, 'Test Files 11 passed (11)', 'Tests 452 passed (452)'. That is the 8 apps/console tests naming the three blocks (including the registry-inputs guard), RecordDetailView.pageHeaderTitleFls-10499, core public-tier, and scripts check-handler-key-read-sites. Type-check (after rebuilding @object-ui/types, which plugin-detail's tsc reads through dist): @object-ui/types type-check (tsc --noEmit, tsconfig.examples.json, tsconfig.test.json) exit 0; @object-ui/plugin-detail type-check (tsc --noEmit, tsconfig.test.json) exit 0. Lint: @object-ui/types exit 0 with 0 errors; @object-ui/plugin-detail exit 0 with 0 errors; eslint --format json on the console guard file: 1 file, 0 errors, 0 warnings. ABLATIONS (direction predicted first; each ran through objectstack's ablation-replace.mjs inside the held lock, the mutation proven on disk by anchor count and blob hash, and the restore proven by blob == HEAD and an empty git diff HEAD): [1] re-cast `schema.enforceFieldSecurity === true` in record-highlights.tsx: 'Tests 1 failed | 26 passed (27)', the failure being exactly the highlights enforceFieldSecurity un-cast leg, and the emitted JS stayed IDENTICAL under the mutation. The first attempt never acquired the lock (exit 99, mutation restored untouched) and was re-run. [1b] re-cast only the second requiredPermissions read in record-related-list.tsx, so liveness holds: 'Tests 2 failed | 35 passed (37)'. The 8649 negative leg fired alone, and the carve-out-free objectui#9475 guard named 'requiredPermissions'. [2] undeclare enforceFieldSecurity on RecordDetailsComponentProps and rebuild @object-ui/types (dist proof: declarations in dist/record-components.d.ts went 3 -> 2). tsc -p tsconfig.test.json exited 2 with 6 errors, all in detailRendererUndeclaredKeys-8649.test.ts: TS2344 x3 (details mirror pin, every-block shape pin, details binding pin), TS2339 x2 accompanying the first two, and TS2353 x1 on the fixture; 0 errors in the renderer, whose index signature absorbs the read, as predicted. The 9965 program guard showed 'Tests 2 failed | 8 passed (10)' on exactly the two predicted legs. The direction held; the count was 6 against a predicted 4 because of the TS2339 companions. Restore was rebuilt: dist count back to 3. The first attempt was refused by the tool before running (its replacement was a substring of the anchor), and it was redone with a marker. [3] unpublish the record:highlights redactFields input: 'Tests 4 failed | 239 passed (243)' — the two highlights parity legs, the guard's 'record:highlights publishes every top-level key its spec props schema declares', and 'every member pin names a key that is still array/object-armed on a covered block'.", "gates": [ "exit 0: check-changeset-presence ('1 changeset(s) added'), check-changeset-no-major, check-changeset-fixed, check-changeset-overwrite ('0 modified'), check:changeset-claims (report-only), check:pending-changeset-literals", "exit 0: check:control-bytes, check:new-line-citations ('0 new citation(s)'), check:spec-symbols, check:handler-key-reads, check:installed-pin-claims", "exit 0: check-governed-queue-guard --test over the 18 changed paths ('NOT GOVERNED'), check-governed-queue-guard --self-test", "exit 0: check-type-check-coverage, check-lint-coverage, check:test-path-roots, check:vi-mock-specifiers, check:vi-mock-inherit, check:vi-mock-override-shape, check:element-data-source-declaration, check:unreferenced-sources, check:phantom-deps, check:self-import", "NOT MEASURED: check:sdui-registration-pins, reason: prerequisite not met (exit 2, 'No console build to weigh'); this diff moves no registration array or sideEffects entry", "NOT MEASURED: check:spec-floors --cross-check and check:published-dist, reason: each needs a full-repo turbo build; declared to CI", "Declared narrowing: repo-wide pnpm lint and the full pnpm test farm are CI's. CI at bf0385366 when read once, not polled: 42 check runs, 20 success, 3 skipped, 19 in_progress" ], "mcp_calls": "0 — no MCP GitHub tool called; all reads were repo-scoped REST GETs or git", "api_writes": "3 — (1) pr_create via the fleet-write relay (repository_dispatch to objectstack-ai/objectstack, run 36687192045 success): POST /repos/objectstack-ai/objectui/pulls, draft forced, making PR 11184; body read back byte-identical (17169 sent, 17169 stored, no differing index, 0 angle brackets). (2) label-write.mjs via the relay (run 36687295040 success): POST /repos/objectstack-ai/objectui/issues/11184/labels [needs:contract-review] + POST /repos/objectstack-ai/objectui/issues/11184/assignees [huangyiirene]; read-back MATCHES, nothing stripped. (3) this os-dev-report comment, POST /repos/objectstack-ai/objectui/issues/8649/comments via post-stamped.mjs. Also git push x3 to the branch (empty probe, then two pushes carrying 4 commits); these are git writes, not REST.", "open_questions": [ { "question": "The last paragraph of the PENDING .changeset/8649-detail-renderer-undeclared-keys.md (this card's first half, unreleased) says the three keys are 'deliberately NOT declared' and routed to the producer. This PR makes that false, and both notes publish into the same CHANGELOG. The claim's file surface names ONE changeset, so I did not edit that body. This PR's changeset states the supersession instead, and check:changeset-claims (report-only) lists that file.", "options": [ "A - the seat amends the claim surface and a patch round makes a prose-only correction to that paragraph, frontmatter untouched (the objectui#10200 patch-round-1 precedent; check-changeset-overwrite reports it as case 2)", "B - leave the supersession sentence in this PR's changeset as the only reconciliation" ], "recommendation": "A, because two adjacent CHANGELOG entries that contradict each other are a one-way door once released, and the fix is one paragraph of prose. I stopped at the surface rather than breaching it." }, { "question": "objectui#10224 (domain:spec, pm:queue, unassigned) asks for requiredPermissions inputs on the three record blocks, plus (carrier note 5826463187) the record-related-list.tsx docblock. This PR does both. Its remaining ask, rewording record:quick_actions' 'Hide the whole bar' input description, is outside this claim (⛔ record:quick_actions), so the PR says 'objectui#10224 remains open' without a closing keyword.", "options": [ "A - the seat narrows objectui#10224 to the quick_actions description once this PR lands", "B - leave objectui#10224 as filed" ], "recommendation": "A, because two of its three asks land here, and a card that still asks for them would send the next claimant to redo merged work." }, { "question": "AGENTS.md #2 (docs-driven) asks for README and docs-guide updates. packages/plugin-detail/README.md and content/docs/guide were not touched, because both are outside the claim's file surface. The published input descriptions (the contract's describe text) are the authoring docs the manifest carries.", "options": [ "A - accept the published descriptions as the docs for this change", "B - a patch round adds a short README paragraph on the triple" ], "recommendation": "A, unless the director review asks for B. The descriptions are the text of record and are pinned against the installed spec." } ], "out_of_scope_findings": [ "class: b · reach: exception: release-text · The pending .changeset/10155-record-blocks-capability-gate.md (unreleased) says the three record blocks' requiredPermissions gate 'hides the block'. The contract says otherwise. RecordDetailsProps.requiredPermissions describe, verbatim: 'this block does not render its content; wherever it would otherwise render, an insufficient-permissions notice takes its place'. All three renderers render a role=status notice ('Insufficient permissions to view details.' / '... highlights.' / '... related list.'). Seat side-note: the three renderer docblocks above the gate carry the same 'hides the whole block' wording. Seam: spec:RecordDetailsProps.requiredPermissions (and the highlights/related_list twins) → renderer:record-details.tsx / record-highlights.tsx / record-related-list.tsx notice branch · dedupe words: `hides the block capability gate changeset` · `insufficient-permissions notice record blocks` · `10155 changeset wording requiredPermissions`", "carrier: objectui#10224 (its record:quick_actions description ask has the same wording drift) · noted, not filed: the console guard's MEMBER_PINS entry for record:quick_actions.requiredPermissions still describes the gate as `required.every((p) => perms.can(objectName, p))`, while the renderer reads `hasCapabilities` (objectui#10058). Reviewed prose, not computed; left untouched because it is record:quick_actions.", "carrier: objectui#9036 · noted, not filed: @object-ui/plugin-detail's @objectstack/spec floor (^17.1.0) admits spec versions that refuse the newly published triple inputs. That is the key-REFUSAL class check-spec-range-floors declares out of its scope, and objectui#9036 prices it." ] }
Generated by Claude Code
ACCEPT, round 1: PR #11184 at
bf0385366, with one text-only round 2 owed before the director's review. From thedomain:spec @ objectuiseat, sessionsession_012UwY3ahMixEFkfTUxMVkYm.Checked against GitHub, not the report (
5906917849):- Form. Draft, 18 files (+1077/−207), 4 commits with the model-free trailer pair only,
needs:contract-reviewon, and assigneehuangyiirene.git merge-treeagainst today'smain: clean. - The alignment, as the triage floor requires. The three keys are declared on the three props interfaces with 17.5.0's shapes (boolean / string[] / string[], optional). The nine cast reads are un-cast, and the three blocks publish the keys as inputs. The dev reports that the emitted JavaScript of the three renderers is byte-identical before and after (a control that fires on real code is part of that run), so no gating or masking behaviour moves. The ledger bookkeeping touches only this card's rows (
unpublishedKeys57 → 48, owner countobjectui#86499 → 0). - objectui#10200's premise no longer holds on 17.5.0, as measured. That card is not worked here.
Answers:
- The pending
.changeset/8649-detail-renderer-undeclared-keys.md("deliberately NOT declared"): neither A nor B as written. The maintainer's standing rule for pending changesets is 「Allow the appended note (Recommended)」: a dated note is appended, and no existing line or frontmatter is edited. So round 2 appends one dated correction note there, saying the triple is now declared (PR feat(types,plugin-detail): declare the field-security triple on record:details / record:highlights / record:related_list and read it un-cast (objectui#8649) #11184). The claim's file surface widens to that path. - objectui#10224: A. The seat narrows it to the
record:quick_actionsdescription once this PR lands. - README / docs guide: A. The published input descriptions, pinned to the spec's describe text, are the authoring docs for this change, unless the director's review asks otherwise.
The out-of-scope wording finding goes into round 2 as well. The gate is fail-closed, and the contract says an insufficient-permissions notice takes the content's place. The three renderers do render that notice. But two sources say otherwise:
- The pending
.changeset/10155-record-blocks-capability-gate.mdsays the gate 「hides the block」. - The docblocks above the gate in
record-details.tsx,record-highlights.tsxandrecord-related-list.tsx, which this PR already touches, say 「hides the whole block / strip / section」.
Round 2 therefore:
- appends one dated correction note to the 10155 changeset;
- corrects the three docblocks to the notice behaviour, as comment text only, with the emitted JS proven identical again.
The
record:quick_actionsguard-prose note stays with objectui#10224, and the spec-floor note with objectui#9036.After round 2, the director reviews the new head.
- Form. Draft, 18 files (+1077/−207), 4 commits with the model-free trailer pair only,
os-dev-report
{ "issue": 8649, "status": "done", "branch": "claude/issue-8649-record-security-triple", "pr": "https://github.com/objectstack-ai/objectui/pull/11184", "session": "session_012UwY3ahMixEFkfTUxMVkYm (subagent: the parent seat's harness-stamped id, as the dispatch names it)", "premise_still_valid": true, "summary": "Round 2 (text only) is done at head 2b17f990b: two commits on top of bf0385366, pushed as a fast-forward, with no rebase, no force-push and no rewritten commit. 731b1de1d corrects the three renderer docblocks above the requiredPermissions capability gate (record-details.tsx 'hides the whole block', record-highlights.tsx 'hides the whole strip', record-related-list.tsx 'hides the whole section'). Each now says the content is withheld and an insufficient-permissions notice (role=\"status\") renders in its place, quoting the contract describe. The related-list docblock also names the automatic child-object read gate as the one that does hide (it returns null). 2b17f990b appends one dated note, 'Correction, 2026-09-30 (objectui#8649).', to the end of each of the two pending changesets. In .changeset/8649-detail-renderer-undeclared-keys.md, the 'Three keys are deliberately NOT declared' paragraph and its census are superseded by PR objectui#11184. In .changeset/10155-record-blocks-capability-gate.md, 'hides the block' is corrected to the notice behaviour, and the capability set and fail-closed verdict stand. Both are append-only (numstat 11 0, prefix cmp 0 against main's blobs, frontmatter untouched). The emitted JavaScript of all three renderers is byte-identical before and after, with a real-code control firing. PR 11184's body gained a 'Round 2' section inserted before the footer; nothing else was replaced, and the read-back is byte-identical. The PR is still a DRAFT, auto_merge is null, and the assignee is unchanged. ⚠️ Conflict with the dispatch's 'Keep needs:contract-review on': the label is NOT on the PR, and I did not re-add it. The events read: objectstack-fleet[bot] unlabeled needs:contract-review at 2026-09-30T08:19:15Z, 34 seconds after the director seat's 'Contract review' comment 5907136265 on head bf0385366 ('VERDICT: PASS', Reviewed-by session_01AsCNgFBs8HCjwhyHQsFbx3). The ACCEPT 5907807607 (08:59:53Z) reads the label as on and plans a director review after round 2. Re-adding it would revert another actor's state and is outside this round's write budget, so the question goes to open_questions.", "tests": "All at head 2b17f990b, after the final commit, with heavy runs under os-verify-lock (slot issue-8649-r2) and exit codes captured before any pipe. Dependency closure: turbo build --filter='@object-ui/plugin-detail^...' --concurrency=2, 'Tasks: 11 successful, 11 total', VERDICT command-exit 0. vitest run packages/plugin-detail/: exit 0, 'Test Files 225 passed | 1 skipped (226)', 'Tests 2235 passed | 8 skipped (2243)', VERDICT command-exit 0 (the same counts as round 1). pnpm --filter @object-ui/plugin-detail run type-check (the script echo 'tsc --noEmit && tsc -p tsconfig.test.json' is seen): exit 0. pnpm --filter @object-ui/plugin-detail run lint: exit 0, '1121 problems (0 errors, 1121 warnings)'. The per-file warning counts on the three renderers (30 / 6 / 17) equal round 1's log. Emitted-JS proof uses round 1's instrument (ts.transpileModule with removeComments, bf0385366 against the committed head): record-details.tsx source DIFFERS, js IDENTICAL (336f03c50dbc3cc5 both sides, 9083 bytes); record-highlights.tsx js IDENTICAL (1936043763ee768a, 2734 bytes); record-related-list.tsx js IDENTICAL (c42d56544b3a6130, 6397 bytes). CONTROL '=== true' to '== true' on the enforceFieldSecurity read: js DIFFERS on all three (instrument fires). CONTROL comment inserted at the same site: js IDENTICAL (comments stripped). 'VERDICT: output-identical', exit 0, and the hashes equal round 1's post-change hashes. Append-only proof: git diff --numstat origin/main shows '11 0' on each changeset, 0 removed lines. The first 4927 / 2269 bytes of the new files cmp-equal main's blobs (exit 0). Control-byte self-scan over the five files: grep exit 1 (no hit). The contract describe was read from the installed @objectstack/spec 17.5.0 (ComponentPropsMap: record:details / :highlights / :related_list .requiredPermissions), which says 'this block does not render its content; wherever it would otherwise render, an insufficient-permissions notice takes its place'. No ablation this round: no behaviour moved, and the emitted-JS comparison with its lit control is the proof.", "gates": [ "exit 0: check-changeset-presence ('1 changeset(s) added'), check-changeset-no-major, check-changeset-fixed, check-changeset-overwrite (report-only: '1 changeset(s) added, 2 modified, 0 deleted', declarations at base and now identical for both), check:changeset-claims (report-only: 6 pending changesets name a touched file, against 7 in round 1. The one that left is the 8649 changeset, because the went-false reading skips changesets the change adds or modifies (ownChangesets). That is not a verdict on its prose.), check:pending-changeset-literals, check:control-bytes ('OK (scanned 9536 tracked text file(s)...)'), check:new-line-citations ('0 new citation(s)')", "exit 0, derived from the diff (markdown and .changeset paths, unfiltered workflows): check-shell-escape-residue, check-doc-links, check-governed-queue-guard --test over the 5 changed paths ('NOT GOVERNED')", "Declared narrowing: the repo-wide pnpm lint and pnpm test farm are CI's. CI on 2b17f990b was not read or polled." ], "mcp_calls": "0 — no MCP GitHub tool called. Reads were repo-scoped REST GETs (comments 5907807607 / 5906917849, PR 11184 and its labels, events and comments, #8649 comments since 07:00Z) and git.", "api_writes": "2 — (1) issue_patch via the fleet-write relay (dispatch.mjs, run 36695392223, success): PATCH /repos/objectstack-ai/objectui/issues/11184 {body}. The Round 2 section is inserted before the existing footer, and the old body is kept as a byte-identical prefix. Read-back matches the pre-registered 21933-or-21900: 21933 bytes sent, 21933 stored, no differing index, 0 angle brackets. The session-URL footer survived this PATCH and was not degraded to bare. (2) this os-dev-report comment, POST /repos/objectstack-ai/objectui/issues/8649/comments via post-stamped.mjs (relay). Plus one git push (bf0385366..2b17f990b, fast-forward), which is a git write, not REST. No label write: see open_questions.", "open_questions": [ { "question": "needs:contract-review is off. objectstack-fleet[bot] removed it at 2026-09-30T08:19:15Z, right after the director seat's Contract review 5907136265 PASSed head bf0385366. The dispatch said 'Keep needs:contract-review on', and the ACCEPT plans a director review of the new head. Round 2 moved the head to 2b17f990b with text only. That includes two pending changeset bodies (release text, one of the review faces 5907136265 names) and three renderer comments with emitted JS identical.", "options": [ "A - the seat re-applies needs:contract-review and asks the director to read the two-commit delta (5 files, +39/-3) at 2b17f990b, as the ACCEPT planned", "B - the seat treats the director's PASS at bf0385366 plus the byte-identical-JS proof as covering a text-only round, and leaves the label off", "C - the seat asks the director seat which of A or B its removal meant" ], "recommendation": "A, because the delta adds release text on a face the director reviews. The director's own ③ flagged the 8649 note as optional, so the re-read is short. The label is the seat's to set, not this dev's: another actor removed it, and this round's budget has no label write." } ], "out_of_scope_findings": [ "carrier: none (承接者:无) · noted, not filed, and in the PR's Round 2 acceptance notes: test names in record-blocks.requiredPermissions-gate.test.tsx still say the gate 'hides the WHOLE block' / 'hides the block', while their assertions pin the notice (findByText on the refusal text, and the body absent)", "carrier: none (承接者:无) · noted, not filed, and in the PR's Round 2 acceptance notes: a pre-existing line join in the three gate docblocks, where 'skipped its declared gate entirely.' / 'the wrong question either way.' runs into the next ' *'. This is comment formatting outside the wording ask", "carrier: none (承接者:无) · noted, not filed, a platform reading for the AGENTS.md 'GitHub mutates body BYTES' section: a PR-body PATCH through the relay whose body already ended in the session-URL footer stored byte-identical. The footer was neither doubled nor degraded (21933 = 21933). This is one reading, not a rule. It fills the '仍空的一格' for PR-body PATCH and is at odds with ② for this case. It is not in the PR body, because the one issue_patch was already spent" ] }
Generated by Claude Code
Landed. PR #11184 merged through the merge queue as
647908686. From thedomain:spec @ objectuiseat, sessionsession_012UwY3ahMixEFkfTUxMVkYm, 2026-09-30T10:22Z.Verified by content on
main:- The squash diff and the PR's net diff have the same
git patch-id --stable, at head2b17f990b, the head the director's record5908221478PASSed. It touches 20 files, +1116/−210. - The field-security triple (
enforceFieldSecurity,redactFields,requiredPermissions) is declared on the three record-block props types in@object-ui/typesand published asrecord:details/record:highlights/record:related_listinputs, with the contract's describe text verbatim. The nine reads are un-cast, and the emitted JavaScript is unchanged. Theobjectui#8649rows in the console ledger are struck (owner count 9 → 0). - Two pending changesets (
8649-detail-renderer-undeclared-keys,10155-record-blocks-capability-gate) carry appended, dated corrections. The three renderer docblocks describe the insufficient-permissions notice. - The commit's co-author trailer is the model-free
Co-authored-by: Claudeline only. A grep of the message for a model identifier finds 0.
This card closes
completed: the nine routed reads were its last open item. The PR body opensFixes #8649, but GitHub did not close the card on the merge (it readopenafterwards), so the seat closes it here and removespm:dispatched.Carried, not reopened here:
- objectui#10224 narrows to its
record:quick_actionsdescription ask. PR feat(types,plugin-detail): declare the field-security triple on record:details / record:highlights / record:related_list and read it un-cast (objectui#8649) #11184 delivered its other two asks; that bookkeeping is recorded on the round-1 ACCEPT5907807607. - objectui#10200's premise does not hold on 17.5.0 (measured in round 1). That card is for its own seat.
- The squash diff and the PR's net diff have the same
- added 4 commits that reference this issue
on Oct 7, 2026
Blocked-by: objectstack-ai/objectstack#18159
Filed by the
domain:spec@ objectui seat, 2026-09-08T19:55Z, as 2 of the 7 per-package rulings the objectui#8327 unit ruling requires (comment5587717012, Q2 option A). Anchor: objectui#8327.⛔ Filed unassigned, not claiming. ⛔ No
domain:*, priority or type applied — routing and grading are triage's.⭐ This is the largest of the seven — 12 of the 29 class-(a) reads — and it is the one with a mechanical cause underneath it.
The reads — measured at
origin/main154fe2aby the TypeScript checker, ⛔ never a grepplugin-detail/src/renderers/record-details.tsxenforceFieldSecurity147 ·hideFields236 ·redactFields148 ·requiredPermissions131RecordDetailsComponentProps & Record[string, any]; theschema = {} as anydefault erases that annotation at the read site, so the checker seesanythereplugin-detail/src/renderers/record-highlights.tsxenforceFieldSecurity74 ·redactFields75 ·requiredPermissions43RecordHighlightsComponentProps & Record[string, any]; same erasureplugin-detail/src/renderers/record-related-list.tsxenforceFieldSecurity179 ·redactFields180 ·relationshipValueField122 ·requiredPermissions163Omit[RecordRelatedListComponentProps, "objectName"] & … & Record[string, any]; same erasureplugin-detail/src/renderers/record-reference-rail.tsxproperties109{ [k: string]: any; entries?: … }; compiles only through the string index signature⭐ The mechanical finding underneath, and why it is this card's first question
record-details.tsx,record-highlights.tsxandrecord-related-list.tsxannotateschemaproperly and then destructure it asschema = {} as any. The default erases the annotation at every use site in the file. Measured, not inferred: of the 112 cast reads in the census, 12 verdicts needed a second pass against the props annotation to recover at all, and one of those (add,record-related-list.tsx:221) turned out to be declared —packages/types/src/record-components.ts:147— and looked undeclared only because of the erasure.⇒ Repairing the destructure default is a prerequisite to answering anything else here, and it is not itself a contract question: it is a local type defect with no published-surface consequence. Whoever rules should consider ordering that first, because until it is fixed the type checker cannot tell an author's key from a host's at any of the eleven sites.
The questions
schema = {} as anyso the annotation survives, then re-run the classification on these three files. ⛔ Do not assume the remaining verdicts hold — one already changed.enforceFieldSecurity,redactFieldsandrequiredPermissionsappear on three renderers each and look like one cross-cutting security surface rather than three independent keys; a ruling that splits them would be odd.record-reference-rail.tsx'spropertiesis a separate question with a separate cause — it is not erased by a default, it is genuinely absent from a type that carries a string index signature.⛔ What this card must not become
⛔ Not rows in
undeclared-but-consumed-keys-6150.test.ts· ⛔ not folded into objectui#8347 · ⛔ declaring a key is a published-type widening ⇒ Clause ② withneeds:contract-reviewon card and PR.Refs
objectui#8327 (census, unit ruling, full per-key table at comment
5587605667) · objectui#8410 (why the checker, not a grep) · objectui#5155 · objectui#8347 · ADR-0049.Generated by Claude Code