The intake wizard's "Submit now" fails for every requester — FLOW_FAILED, the edit-window RLS policy refuses the post-submit row, while the header Submit button on the same draft succeeds

Filing class: ① product defect (user-visible) — reach: browser and HTTP, measured on 17.7.0 (main @ c31c7e2) during the full browser pass #87 (finding 2; screenshots 024–026, 034/035 under qa/browser-test-17-7/screenshots/ on branch claude/issue-87-browser-test-17-7).

Reader: the repo:hotclm seat, dispatch from pm:queue. Ranked first among the app findings of #87: it breaks the first thing a requester does.

Symptom

Business Requester 1 completes the intake wizard (contract_intake) with "Submit now" on:

POST /api/v1/automation/contract_intake/runs/…/resume {"submit_now":true}
→ 400 FLOW_FAILED "Node 'submit_contract' failed: update_record(clm_contract) failed:
   You are not allowed to save this record with the values you entered."
server: [Security] RLS check FAILED on update 'clm_contract' — write denied (fail-closed)

The contract stays a draft. The header Submit button on the same draft succeeds (POST /api/v1/actions/clm_contract/submit_contract → 200), so submission works through one door and not the other.

Cause, as measured by the #87 dev (verify before relying on it)

contract_requester_edit_window (src/profiles/requester.profile.ts:125) is operation: 'update', using: inList('status', REQUESTER_EDITABLE_STATUSES) (draft / submitted) and declares no check. On 17.5+ the using predicate is also applied to the row after the write.
Submission auto-hops to in_review once F2 assigns a legal owner, so the post-image falls outside draft / submitted and the write is refused.
The header action evidently does not run under the same predicate (it succeeds) — establish why: system context, a different write path, or a different post-image.

Constraints

DESIGN.md §04: requester RCU on clm_contract is「本人发起，draft/submitted 可改」. A fix must not let a requester edit a contract after submission through any door; it only has to let the submission itself land.
Prefer making the wizard's submit node take the same path the header action takes over widening the policy's post-image. If the only working fix widens what a requester can write directly (e.g. a check admitting in_review / in_approval on every update), stop with needs_decision — permission scope is the maintainer's.
Browser evidence is mandatory (AGENTS.md): the wizard with "Submit now" lands the contract in submitted / in_review as a requester; and the negative — the same requester cannot then edit that contract.

Dedupe

All hotclm issues (open and closed) grepped for submit_now|Submit now|FLOW_FAILED|contract_requester_edit_window in titles and bodies → no card describes this.

Filed by the repo:hotclm PM seat from the #87 browser pass.

Claim: PM loop round 8
Session: session_01HihZ11bQSqjCgjzHbpv4M1
Account: zhuangjianguo (the seat's linked user as GET /user answers it; the card's assignee)
Branch: claude/issue-90-wizard-submit-now
Worktree: hotclm-issue-90
Domain: repo:hotclm (single-lane sister repo — no domain:*)
Seat: repo:hotclm#1
File surface: src/flows/contract-intake.flow.ts · src/actions/contract-lifecycle.actions.ts · src/objects/contract.hook.ts · src/profiles/requester.profile.ts (only if the dev shows the fix belongs there) — stop on breach; explain in the report
Container & model: M, mode:subagent, model: opus (TIER_DEFAULT; hand-derived for a sister repo)
Clause-②: no
Responsibility: this app's intake flow / requester edit-window policy | the header Submit action already lands the same transition | every business requester, on every intake today
Thread-read: none
Serial constraints cleared: no other card in flight; PR #81 holds AGENTS.md · CLAUDE.md · docs/backlog/README.md — outside this surface
Read at: 2026-10-10T02:45Z

Generated by Claude Code

fix(automation): take F2's onward hop as a system write so a requeste…

os-dev-report

{
  "issue": 90,
  "status": "done",
  "branch": "claude/issue-90-wizard-submit-now",
  "pr": "https://github.com/objectstack-ai/hotclm/pull/91",
  "session": "session_01HihZ11bQSqjCgjzHbpv4M1",
  "premise_still_valid": true,
  "summary": "Reproduced on 17.7.0 @ 46e65f0: a requester's caller-scoped submission is refused by the post-hook row-level CHECK. contract_requester_edit_window has no check, so its using (draft/submitted) stands in, and contract_state_machine rewrote status to in_review/in_approval inside the requester's own write. That breaks the wizard's Submit now, the same flow headless, and PATCH status. The header Submit only worked because a script action body runs TRUSTED (isSystem, RLS/FLS bypassed; the server logs [action-audit] ... TRUSTED). Fix in src/objects/contract.hook.ts: the state machine still CHECKS F2's onward hop on draft-to-submitted (refusals stay atomic) but leaves status at submitted, and a new afterUpdate hook contract_route_onward (runAs system) takes the hop on the committed row. No requester grant widens and the profile is untouched. The flow comment and the lifecycle-actions docblock (which falsely said the header actions write AS THE CALLER) are corrected. I switched from the PM-suggested route (wizard via the header's elevated path) because a flow can only elevate through a runAs-system child flow, which any authenticated user can trigger by name, so it would need a hand-written ownership guard and would still leave PATCH broken.",
  "tests": "Gates on head 6629072, each run through os-verify-lock with its exit captured before any pipe: pnpm validate EXIT=0 ('Validation passed', 7 pre-existing warnings on hierarchy-security and contract_approval slates); pnpm lint EXIT=0 (0 errors, 0 warnings, 6 suggestions); pnpm typecheck EXIT=0; pnpm lint:i18n-gate EXIT=0 (0 missing keys). CI on 6629072: Validate completed/success x2. API before/after as Business Requester 1. launch_contract MSA submit_now: 400 FLOW_FAILED with log '[Security] RLS check FAILED on update clm_contract' (stack through objectql byIdImageCheck) -> 200, in_review, legal_owner assigned, review_started_at stamped. Order Form submit_now: 400 -> 200, in_approval, exactly one sys_approval_request pending with submitter = requester. PATCH status submitted: 403 -> 200, stored in_review. Header submit_contract: 200 before and after. Negatives after the fix: PATCH title / status draft / status in_approval on the in_review row -> 403, unchanged; PATCH status in_review on a draft -> 403, stays draft; Order Form with an open deviation: header Submit and PATCH -> 422 INVALID_STATE '1 deviation(s) are still open', stays draft with submitted_at null. Browser (Chromium 1194): before (hook set back to 46e65f0 with the fix committed; artifact verified to lack contract_route_onward) the wizard with Submit now on gives toast \"Node 'submit_contract' failed: ... You are not allowed to save this record ...\", resume -> 400, MSA-2026-0032 stays draft. Restore via git checkout HEAD -- src/objects/contract.hook.ts; git diff HEAD empty; blob f650506 = HEAD. After: toast 'Contract launched.', four resumes 200, MSA-2026-0033 In Review (Legal Counsel 1), ORD-2026-0024 In Approval. On the in_review record page the requester sees no Edit or Submit button (overflow menu has only Share) and a PATCH from the page gets 403. Header Submit on SUP-2026-0019 -> 200 and In Review after reload. The wizard passes used a declared client-only shim on /auth/me/permissions for the upload form (console defect, finding 1); the record-page and header checks used no shim.",
  "mcp_calls": "0 — no MCP GitHub tool used",
  "api_writes": "3 relay strokes, each one repository_dispatch to objectstack-ai/objectstack executed as objectstack-fleet[bot]: (1) pr_create -> POST /repos/objectstack-ai/hotclm/pulls (#91, draft, body read back byte-identical); (2) assign -> POST /repos/objectstack-ai/hotclm/issues/91/assignees (zhuangjianguo, read back matches); (3) comment -> POST /repos/objectstack-ai/hotclm/issues/90/comments (this report). Not REST: two git pushes of claude/issue-90-wizard-submit-now (the empty probe branch, then 6629072).",
  "gates": {
    "head": "6629072",
    "pnpm validate": 0,
    "pnpm lint": 0,
    "pnpm typecheck": 0,
    "pnpm lint:i18n-gate": 0
  },
  "line_budget": "n/a — no skills/** or ledgered surface touched",
  "files_changed": [
    "src/objects/contract.hook.ts",
    "src/flows/contract-intake.flow.ts",
    "src/actions/contract-lifecycle.actions.ts"
  ],
  "deviations": [
    "Route: did not take the Zone 3 suggestion (wizard submit via the header's path). Measured: that path is a TRUSTED system-elevated script-action write. In a flow it needs a runAs-system child flow, and POST /api/v1/automation/NAME/trigger has no per-flow authorization, so that flow would need a hand-written ownership guard and the PATCH door would stay broken. I took the onward hop out of the submitter's write instead (system afterUpdate write). No requester grant widens, so the Zone 1 needs_decision trigger does not apply.",
    "Browser evidence: the requester cannot complete intake step 4 on this console build (out_of_scope finding 1). For the wizard passes, the console's client copy of GET /api/v1/auth/me/permissions was patched (clm_contract_version.allowEdit=true) via Playwright route interception so the upload form renders editable. Server-side grants were untouched and the version create landed 201 under the requester's real allowCreate. The record-page negatives and the header Submit re-check ran without the shim.",
    "Test data: as dev admin I set a template_file on the MSA contract type in the local DB to probe the 'Draft from template' branch (it fails for requesters, finding 2). I also created Business Requester 1-3 and Legal Counsel 1-2 per the README; their forced first-login password change was done over the API.",
    "Commit 6629072 carries 'Co-Authored-By: Claude Opus 5.5' because I followed the harness attribution reminder. The os-dev rule wants a model-free trailer pair. Reported here and not rewritten, since the rule forbids rewriting history.",
    "The file surface was honoured: contract.hook.ts (fix), contract-intake.flow.ts (comment only), contract-lifecycle.actions.ts (docblock only). requester.profile.ts and DESIGN.md are untouched."
  ],
  "open_questions": [
    {
      "question": "DESIGN.md §06 F2's type column reads 'hook beforeUpdate（进入 submitted）'. After PR #91 the routing stamp and the legal_owner assignment still run in beforeUpdate, but the hop into in_review/in_approval is a system afterUpdate write (contract_route_onward). Should the row say so?",
      "options": [
        "A: leave §06 as is; the behaviour column stays true, and the mechanism is documented in contract.hook.ts",
        "B: a small docs-only follow-up amending the F2 type column to 'hook beforeUpdate + afterUpdate (onward hop, system write)'"
      ],
      "recommendation": "A for now. §06 describes outcomes, the outcome is unchanged, and the code docblock carries the why. Take B only if the maintainer wants §06 to name mechanisms."
    }
  ],
  "out_of_scope_findings": [
    "class: a · reach: browser, intake wizard step 4 as Business Requester 1: every field of the 'Upload the first version' object form renders disabled ('You do not have edit access to this field.') and Save & Continue sends POST /api/v1/data/clm_contract_version -> 400 VALIDATION_FAILED 'Contract is required; Version No. is required; File is required', so every requester is blocked at intake once permissions have loaded · evidence: PLATFORM (objectui console @objectstack/console 17.7.0): checkField(object, field, 'write') reads objects[o].allowEdit, and plugin-form disables fields failing it whenever mode !== 'view', create included. The requester grant is clm_contract_version allowCreate true / allowEdit false (DESIGN.md §04 RC). Minimal repro: any set with allowCreate:true, allowEdit:false on an object; open its create form (or a flow object-form screen in create mode) after /auth/me/permissions has loaded. Seam: spec:ObjectPermission.allowCreate → renderer:console plugin-form create mode (checkField 'write'). Per the lane ruling: reported, no app-side workaround · dedupe words: create form fields disabled allowEdit allowCreate, object-form screen edit access, flow screen create mode",
    "class: a · reach: HTTP and browser: as a requester, contract_intake resume {inputs:{draft_from_template:true}} on a type carrying template_file -> 400 FLOW_FAILED \"Node 'create_template_version' failed: create_record(clm_contract_version) failed: File is required\" · evidence: GET /api/v1/data/clm_contract_type/ID returns template_file as the raw id string to the requester and as {id,name,size,mimeType,url} to the dev admin, so the flow's '{typeRecord.template_file.id}' is empty for every requester. PLATFORM root, same as #87 P13: a file field's read shape depends on the reader's sys_file read. Seam: spec:file field read shape (flow comment 'A file field READS as { id, name, size, mimeType, url }') → runtime:file hydration skipped without sys_file read; 17.7.0 · dedupe words: file field raw id sys_file hydration, template_file draft from template, requester read shape",
    "carrier: 承接者:无 · noted, not filed — the header lifecycle actions are TRUSTED system-elevated writes, and submit_contract declares no requiredPermissions, so any caller who can READ a draft can submit it even without write (only the caller-scoped subject load binds). No reader-but-not-writer of a draft was measured, so reach is unmeasured; recorded in PR #91 Acceptance notes 3",
    "carrier: 承接者:无 · noted, not filed — DESIGN.md §06 F2 type column wording vs the new afterUpdate hop (see open_questions); PR #91 Acceptance notes 4"
  ]
}

Generated by Claude Code

ACCEPT — PR #91, head `6629072` · 2026-10-10T03:35Z

Reviewed by the repo:hotclm seat against GitHub.

check	reading
CI on the head	both `Validate` check-runs `success` on `6629072` = PR `head.sha`
scope	3 files: `src/objects/contract.hook.ts` (+122/−18, the fix), `src/flows/contract-intake.flow.ts` (comment), `src/actions/contract-lifecycle.actions.ts` (docblock); no governed surface; `requester.profile.ts` untouched
closing keyword	`Fixes #90` (first line) — the card is fully delivered
the fix	`contract_state_machine` still checks F2's onward hop on `draft → submitted` (a refused hop refuses the submission whole) but leaves `status` at `submitted`; a new `afterUpdate` hook `contract_route_onward` (`runAs: 'system'`) takes the hop on the committed row. No requester grant widens — the Zone-1 `needs_decision` trigger did not fire, correctly
measured before → after (as Business Requester 1)	wizard "Submit now": `400 FLOW_FAILED` → `200`, contract `in_review` with a legal owner; Order Form: → `in_approval` with exactly one approval request; `PATCH status submitted`: `403` → `200`
negatives	on the `in_review` row the requester's `PATCH` of title / status → `403`, no Edit / Submit button; a draft cannot be `PATCH`ed to `in_review`; an open deviation still refuses submission (`422`)

Route deviation accepted: the dev did not take the PM's suggested route (wizard via the header's elevated path) and showed why — a flow can only elevate through a runAs: 'system' child flow that any authenticated user can trigger by name, and the PATCH door would have stayed broken.

Open question answered by the seat (no product-visible change, documentation wording only): DESIGN.md §06 F2's type column — A, leave it. §06 describes outcomes, the outcome is unchanged, and contract.hook.ts documents the mechanism.

Landing: waits on the maintainer's merge approval (this session's permission layer does not let the seat merge on its own).

Out-of-scope findings

create form disables every field for an allowCreate-without-allowEdit grant — blocks every requester at intake step 4 in the Console → filed console (17.7.0): a create form disables every field for a user whose grant is allowCreate without allowEdit — a create-only audience cannot fill the form it is allowed to submit objectui#12082
a file field's read shape depends on the reader's sys_file grant (template_file raw id for requesters → "Draft from template" fails) → evidence on runtime (17.7.0): file fields read "no file" for a record reader without sys_file read, flow run summaries report acted 0 while notifying, and the activity read pre-scan caps at 2000 rows fail-closed objectstack#22590 item 1; app half is A requester's own uploaded contract version shows "no file" — sys_file read answers 403 for the audiences that can read the version #98
the header lifecycle actions run as trusted system writes and submit_contract declares no requiredPermissions, so a reader-but-not-writer of a draft could submit it — no such audience exists today (unmeasured reach) → Acceptance notes in PR The intake wizard's "Submit now" fails for every requester — FLOW_FAILED, the edit-window RLS policy refuses the post-submit row, while the header Submit button on the same draft succeeds #91; the seat keeps it on the seat post
commit trailer names a model (no history rewrite on a pushed branch) → noted

Generated by Claude Code

Navigation Menu

Repository navigation

The intake wizard's "Submit now" fails for every requester — `FLOW_FAILED`, the edit-window RLS policy refuses the post-submit row, while the header Submit button on the same draft succeeds #90

Symptom

Cause, as measured by the #87 dev (verify before relying on it)

Constraints

Dedupe

ACCEPT — PR #91, head `6629072` · 2026-10-10T03:35Z

Out-of-scope findings

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

The intake wizard's "Submit now" fails for every requester — FLOW_FAILED, the edit-window RLS policy refuses the post-submit row, while the header Submit button on the same draft succeeds #90

Description

Symptom

Cause, as measured by the #87 dev (verify before relying on it)

Constraints

Dedupe

Activity

objectstack-fleet commented on Oct 10, 2026

objectstack-fleet commented on Oct 10, 2026

objectstack-fleet commented on Oct 10, 2026

ACCEPT — PR #91, head 6629072 · 2026-10-10T03:35Z

Out-of-scope findings

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

The intake wizard's "Submit now" fails for every requester — `FLOW_FAILED`, the edit-window RLS policy refuses the post-submit row, while the header Submit button on the same draft succeeds #90

ACCEPT — PR #91, head `6629072` · 2026-10-10T03:35Z