approvals face 4 of 5 (ruling C on objectui#12438): the served sys_approval_request page carries the raw-payload panel as a generic block gated on studio.access declared in the page metadata, as the inbox side sheet gates it

Restart-when: objectui main's pnpm-lock.yaml resolves @objectstack/spec to a published release whose build commit has objectstack 97b8e7a51d (record:json, objectstack-ai/objectstack#23745) as an ancestor

Filing gate ④: a cross-layer coordination node, filed as ruling 6190549995 on objectui#12438 directs (letter C, the maintainer's 「C (推荐)」, director seat summon #42, items 2–4). It is face 4 of at most 5, fourth in the ruling's order by pull: "the raw panel (objectui#5553)".

Parent: #2763 (B1 of the epic). The closing card objectui#12484 waits on this one.

Unblocked from objectui#12489 by the seat (unlock comment on this card): face 3 was ruled A (6203737086). It edits no served page; its objectui step waits on a spec release. So the "same served page" reason for serial order no longer holds. The ruling's order by pull still sets priority.

Reader who acts: the domain:ui seat 1 (the epic's seat, seat post #5560). It dispatches step 1 here.

Dedupe (MCP search_issues, scope objectstack-ai/objectui, all states, read 2026-10-15T12:46Z): "approval request raw payload JSON panel studio.access gate page block" → 1 result, #5553, closed: the sheet's gate fix. That one is not this card.

The face

The side sheet shows it today, pinned. The sheet's "Raw data (JSON)" panel renders only for a caller with the declared platform-scope capability studio.access (objectui#5553; ApprovalsInboxPage.tsx:942–:960). A business approver never sees hidden fields, internal ids or audit columns through it. The pin is apps/console/src/pages/system/ApprovalsInboxPage.rawPayloadGate.test.tsx.
The served page has no raw panel.

Steps (ADR-0060 rule 2; the ruling's item 2)

Fit check, objectui. The ruling names the shape: "the raw-payload panel is a generic block whose studio.access gate is declared in the page metadata". Size it first against the blocks that already exist, and report the readings:
- a generic JSON or code display block;
- the page schema's own visibility or permission gate on a node, if the spec declares one.
Spec row (objectstack domain:spec). Two possible needs: a gate on a page node that the spec does not yet declare, or a block type the spec does not yet declare.
Served page edit (objectstack plugin-approvals, domain:services), placing the panel with its gate.
objectui block, pinned.

Acceptance

On the served page, the raw-payload panel renders for a caller with studio.access and never for one without. The gate is read from the page metadata, not hard-coded in the renderer.
⛔ The side sheet is not touched (ADR-0060 rule 3).

Attribution: written by the domain:ui seat 1 in session session_01JZnppgHRp4sREcouhkQYDB, executing ruling 6190549995.

Unlock: `pm:blocked` → `pm:queue` · `domain:ui` seat 1 · `session_01JZnppgHRp4sREcouhkQYDB` · 2026-10-15T22:49Z

This card's Blocked-by: #12489 was this seat's own serial order, set when the faces were filed (6192450463). Its reason was "the faces edit the same served page". That reason no longer holds:

Face 3 (objectui#12489) was ruled A (6203737086). Its fact goes on FieldSchema (spec(field): referenceDeletedWhen beside referenceVia, a declared predicate on a sibling select field that marks the referenced record as platform-deleted (objectui#12489 letter A) objectstack#23735) and on sys-approval-request.object.ts (plugin-approvals: sys_approval_request.record_id declares referenceDeletedWhen on cancel_reason = record_deleted (objectui#12489 letter A) objectstack#23736), with no served-page edit. Its objectui step edits the record pointer renderer, after a spec release.
This face's steps 2–4 touch a page-node gate or block type, sys-approval-request.page.ts, and an objectui block. Those files are disjoint from face 3's.
Ruling 6190549995 item 3's order by pull is a priority order. Face 3 now waits on an external release, so face 4's step 1 (the fit check, a measurement with no build) goes ahead.

The body's Blocked-by: line is replaced by this pointer. objectui#12491 (face 5) stays Blocked-by: #12490, and the closing card objectui#12484 stays Blocked-by: all five faces.

Generated by Claude Code

Claim: PM loop round 1 (priority:p3; face 4 of ruling 6190549995 on objectui#12438, the maintainer's 「C (推荐)」; unlocked at this card's unlock comment)
Session: session_01JZnppgHRp4sREcouhkQYDB
Account: sunhaolin
Branch: claude/issue-12490-raw-panel
Worktree: objectui-issue-12490
Domain: domain:ui
Seat: domain:ui#1
File surface: step 1 (the fit check) is a measurement. A build follows only on an objectui-only route:

the generic block that draws the panel, wherever the measurement finds it under packages/*/src, plus its wiring;
the served-page pins under apps/console/src/services/approvalRequestsDataSource.*.test.tsx, each mounting the root SchemaRendererProvider as ConsoleShell.tsx:306 does;
the tests beside the block;
one .changeset/12490-*.md.

Outside the surface:

the side sheet ApprovalsInboxPage.tsx (ADR-0060 rule 3);
objectstack's spec and plugin-approvals page (the card's steps 2–3, which the seat files);
any new node type, prop, export or schema read.

A route that needs any of those stops before building, and reports the exact spec row or page edit (stop on breach; explain in the report).
Container & model: M, mode:subagent, model: opus (default tier; dispatch-gates --tier --repo objectstack-ai/objectui names no path-derived mandate)
Clause-②: no. Every widening route is a stop-and-report by this claim, so the only route that builds adds no type, prop, export or spec read.
Responsibility: n/a — not a defect card
Thread-read: 6203897965
Serial constraints cleared: read at objectui main f96f771140.

Face 3 (objectui#12489) is pm:blocked on plugin-approvals: sys_approval_request.record_id declares referenceDeletedWhen on cancel_reason = record_deleted (objectui#12489 letter A) objectstack#23736 and edits no served page, so it no longer orders this face (the unlock comment above).
objectui#12504 (this seat, in flight) edits ObjectView.tsx, data-objectstack and the locale packs: no overlap with the request page's blocks or pins.
No in-flight claim or open PR names the approvalRequestsDataSource.* pins, approval-decision/ or record-preview/.

Generated by Claude Code

os-dev-report

{
  "issue": 12490,
  "status": "done",
  "branch": "claude/issue-12490-raw-panel",
  "pr": null,
  "session": "session_01JZnppgHRp4sREcouhkQYDB (subagent mode: the parent's id, as the claim and the harness stamp it)",
  "premise_still_valid": true,
  "summary": "Step 1, the fit check, is measured, and nothing was built. The branch is pushed empty as the claim marker; there is no PR. The served page draws no raw panel for any caller today, and no objectui-only route can draw it, because both halves of the face are missing. Block half: no declared block draws the request's payload as JSON. The spec declares no JSON or code block. record:details does draw a DECLARED json field as compact JSON, but sys_approval_request declares no payload field. The read route serves the parsed snapshot under the undeclared key payload, so record:details draws it as 'payload' with the value '[Object]'. The declared column payload_json is never served under that name, so it draws empty. Gate half: the spec declares two node gates, and objectui honours both. Neither can carry a fail-closed studio.access gate. visibleWhen has no capability root, only isPlatformAdmin, which is a different signal. The record blocks' requiredPermissions is declared fail-open: measured, it draws the raw JSON with both audit witnesses for a caller whose capability set is unreported, and for one with no provider. That breaks the sheet's fail-closed pin. The ruling then forbids a build. Recommended route: a new thin generic block record:json, whose required requiredPermissions gate fails closed and draws nothing. Its zod row and page edit are below. The fallback stays on record:details. It needs a declared payload json field and a family-wide flip of the record-block gate to fail-closed.",
  "gap_table": [
    "sheet today (ApprovalsInboxPage, the drawer): gate = maySeeRawPayload = holdsStudioAccess(usePermissions().systemPermissions), a console-local React condition. It reads the raw reported capability set and fails CLOSED on unreported and on a reported empty set. Block = an inline collapsed details element headed 'Raw data (JSON)', with a Copy button and a pre element holding JSON.stringify(payload, null, 2). Pin: ApprovalsInboxPage.rawPayloadGate.test.tsx, 4 cases.",
    "served page today (objectstack origin/main 534ca13eb5, copied whole; PageSchema.safeParse true): no raw panel for any of 5 callers (studio.access, setup.access, reported empty, unreported, no provider). 'Raw data (JSON)' count 0, and the witnesses usr_audit_witness and org_audit_witness are absent. The business counter-anchor is PRESENT for all 5: the decision panel's snapshot summary draws the payload's business value 'Q3 clinical supplies'. The Details tab draws only 'Record ID' and its pointer card. GAP: the whole face.",
    "gate A, node visibleWhen (PageComponentSchema, every node; declared at origin/main and at objectui's installed 18.0.0-next.1) · declared yes · honoured yes on a tab-child record block. P5, record:details with visibleWhen 'current_user.isPlatformAdmin == true', with the hypothetical payload json field so the block has something to draw: it draws for isPlatformAdmin true, and is hidden for isPlatformAdmin false, for a session that carries no isPlatformAdmin, and with no ExpressionProvider. CANNOT carry the face: the CEL roots carry no capability set. EvalUser declares id, name, email, positions, isPlatformAdmin and organizationId; objectui's buildExpressionUser forwards those, and buildExpressionScope adds can(object, verb). So studio.access cannot be named. isPlatformAdmin is another signal (measured: a studio.access holder whose session says isPlatformAdmin false is hidden).",
    "gate B, record-block requiredPermissions (record:details, record:highlights, record:related_list, record:quick_actions; one shared describe at both spec versions) · declared yes · honoured yes, through perms.hasCapabilities in plugin-detail · CANNOT carry the face as declared. Clause 5 of the describe reads 'A client that cannot resolve the user's capabilities ... renders this block as if they were held — it fails open'. P4: setup.access and a reported empty set get the notice 'Insufficient permissions to view details.'. An unreported set and no provider render 'Raw data (JSON)' with both witnesses, which is the leak the sheet's 'denies when the backend reports no capability set at all (fail CLOSED)' pin forbids. Also, a business approver sees that notice on the Details tab, where the sheet draws nothing.",
    "block, a declared generic JSON or code block · NONE. PageComponentType and ComponentPropsMap at both spec versions have no json, code or key-value block. STRING_ARM_REGISTERED_TYPES is empty. objectui registers no page block that draws JSON; json and code exist only as field cell renderers. element:metadata_viewer draws metadata items (state_machine, flow, permission), not a record value.",
    "block, record:details over a field · draws JSON only for a DECLARED json field. P4 is a HYPOTHETICAL object declaration, payload as type json labelled 'Raw data (JSON)'. There the tab draws 'Raw data (JSON)' plus the compact JSON with both witnesses, through JsonCellRenderer (one truncated line, no copy control). With today's object, fields ['payload'] (P1) draws 'payload' and '[Object]' with no witnesses, because payload is not a declared field. fields ['payload_json'] (P2, the declared 'Snapshot' textarea) draws 'Snapshot' with an empty value, because rowFromRequest serves the parsed snapshot as payload and never as payload_json."
  ],
  "route": {
    "applies": "No objectui-only route; build forbidden. Both halves need objectstack. Recommended: a new thin generic block record:json (the ruling's 'A NEW block is opened only where no existing block can carry the face': record:details carries the drawing only through a field declaration the object cannot make honestly, and no declared gate fails closed). The gate is the block's own required requiredPermissions, declared in the page metadata and failing closed.",
    "step2_spec_row": "objectstack packages/spec/src/ui/page.zod.ts, PageComponentType: add 'record:json' after 'record:approvals', 'record:attachments'. packages/spec/src/ui/component.zod.ts, beside RecordApprovalsProps: export const RecordJsonProps = strictObject({ surface: 'this `record:json`', history: PROPS_HISTORY, guidanceSets: COMPONENT_LEVEL_GUIDANCE }, { field: z.string().regex(/^[a-z_][a-z0-9_]*$/).describe('The key of the bound record whose value this block draws as indented JSON, in a panel that starts collapsed, with a copy control: a declared field, or a key the record\\'s read route serves beside them (`payload` on a `sys_approval_request` row). A record with no value under the key draws nothing.'), label: I18nLabelSchema.optional().describe('The collapsed panel\\'s summary line (renderer default: \"Raw data (JSON)\").'), requiredPermissions: z.array(z.string()).min(1).describe('[ADR-0066] Capabilities the user must ALL hold for this block to draw: names that permission sets grant through `systemPermissions`. Required: a raw value is never placed ungated. Fails CLOSED, unlike the record blocks\\' gate of the same name: a client that cannot resolve the user\\'s capabilities (no permission provider, or one that does not report `systemPermissions`) draws nothing, and so does a user missing any of them: no notice, no summary line, no value. Presentation only: it authorises nothing, and the read route still serves the value to the same user.') }); ComponentPropsMap: 'record:json': RecordJsonProps, after 'record:attachments'. Plus whatever the spec gates name for a new member (liveness/page.json read points once objectui registers the renderer, the authorable-surface baseline through its generator). Boundary, said so the seat can weigh it: `field` is NOT added to the page-field-unknown descriptor table, because its first value is a route-served key that is not a declared field, so a misspelled field draws nothing and publish cannot catch it.",
    "step3_objectstack_edit": "plugin-approvals sys-approval-request.page.ts, slots.tabs.properties.items[0] (Details): children: [{ type: 'record:details' }] becomes children: [{ type: 'record:details' }, { type: 'record:json', properties: { field: 'payload', label: { en: 'Raw data (JSON)', 'zh-CN': '原始数据（JSON）', 'ja-JP': '生データ（JSON）', 'es-ES': 'Datos sin procesar (JSON)' }, requiredPermissions: ['studio.access'] } }]. The label strings are the sheet's own en, zh, ja and es approvalsInbox.rawData copy, authored inline as the page's other labels are. Add one Strategy bullet to the docblock: the Details tab ends with the request snapshot's raw JSON, a platform operator's debug view, gated on studio.access. It is never the approver's read path. sys-approval-request.object.ts: NO edit.",
    "step4_objectui": "After step 2 releases. Clause-② yes: a new published type and a new registration. @object-ui/types mirrors RecordJsonComponentProps and the 'record:json' member, and the zod mirror parity pin covers it. plugin-detail gets renderers/record-json.tsx, registered beside record:details. It reads the bound record from useRecordContext and takes the value under `field`; it draws nothing when that value is null or undefined, as the sheet does. The gate is generic, with no approvals word, and reads the RAW signal the way the console's holdsStudioAccess does: usePermissions().systemPermissions, Array.isArray(...) and every required capability included. Otherwise it returns null. It does NOT use hasCapabilities, which fails open. It draws a collapsed details element whose summary is the localized label, defaulting to a neutral i18n key and never approvalsInbox.*. Inside go a Copy control and a pre element with JSON.stringify(value, null, 2). Pins in apps/console/src/services/approvalRequestsDataSource.servedPageRawPayload-12490.test.tsx run on the real RecordDetailView over ApprovalRecordReads, under the root SchemaRendererProvider as ConsoleShell mounts it. A studio.access holder sees the label and both witnesses. CONTROLS: setup.access, a reported empty set, an unreported set and no provider each get no label, no witness and no notice. Each control also asserts the business counter-anchor, the decision panel's summary value. Unit tests sit beside the renderer. Ablation: drop the gate and the four control pins go red. One minor changeset. ApprovalsInboxPage.tsx is not touched, and its rawPayloadGate pin stays green as the CONTROL.",
    "fallback_if_step2_refuses_a_new_block": "Stay on record:details, as the ruling prefers existing blocks. It needs three changes. (a) sys-approval-request.object.ts declares the served key: payload: Field.json({ label: 'Raw data (JSON)', readonly: true, group: 'State' }). The step-2/3 seat must answer its storage first: payload has no column (the stored column is payload_json, which the read route parses into payload), so the declaration provisions a column nothing writes, and the generic data route serves it empty. (b) The spec flips clause 5 of RECORD_BLOCK_REQUIRED_PERMISSIONS_DESCRIPTION to fail-closed for all four record blocks, and objectui's four record-block gates read the raw systemPermissions. That re-opens the unreported-versus-empty doctrine of objectui#4656 for record blocks, so it needs a ruling. (c) Page edit, Details tab: children: [{ type: 'record:details' }, { type: 'record:details', properties: { fields: ['payload'], requiredPermissions: ['studio.access'] } }]. Measured costs (P4): business approvers and reported-empty callers see 'Insufficient permissions to view details.' where the sheet draws nothing. The value draws as one truncated compact JSON line with no copy control.",
    "recommendation": "record:json. Business need: one ruled consumer, the sheet's rawPayloadGate pin from the EHR leak report behind objectui#5553. Ruling item 1 makes the page carry it before the sheet goes. Neither route has a second measured consumer. Long-term: record:json keeps the data model honest (no column that nothing writes) and leaves the four existing record blocks' posture as ruled. Its cost is a second unresolved posture for the word requiredPermissions in the record namespace; its describe states the difference, and the default stays the record blocks' own. The fallback adds a phantom column and re-opens a ruled doctrine for every existing author of a record-block gate. AI-proofing: the gate is REQUIRED (min 1), so parse refuses an ungated raw-JSON block, and it fails closed. The fallback's flip silently changes behaviour for gates already authored. The weak point of record:json is a misspelled `field` (see the step 2 boundary). Startup focus: one block type with three props and one consumer, against a column, a family-wide posture flip and a ruling.",
    "considered_and_rejected": [
      "visibleWhen 'current_user.isPlatformAdmin == true' on a node: declared and honoured (P5), with no spec change. But it gates on a different signal than the ruling names. Measured, a studio.access holder whose session says isPlatformAdmin false is hidden. Widening EvalUser with the capability set is an ADR-0068 contract change across server formula, RLS and client.",
      "Draw the panel inside record:approval_decision, the panel faces 1 and 2 grew: objectui-only, but the gate would be a React condition in a renderer, which the ruling forbids. The block is also approvals-named.",
      "element:metadata_viewer: it draws metadata items, not a record value.",
      "record:details on the declared payload_json ('Snapshot') field: P2 draws an empty value. Making the read route also serve payload_json would bypass the per-reader redaction the route applies to payload."
    ]
  },
  "mechanism_assumptions": {
    "A1": "HOLDS, and the card's line-range citation is stale. Cite the gate by its symbol, maySeeRawPayload. The hook is usePermissions() from @object-ui/permissions, and the provider is MePermissionsProvider, fed by GET /api/v1/auth/me/permissions. The permission read is the RAW systemPermissions member, not hasCapabilities. The judge is the console-local holdsStudioAccess (apps/console/src/components/studioEntry.ts). The key shape is the bare capability string studio.access (STUDIO_ENTRY_CAPABILITY) inside the reported systemPermissions string array. The 4 pin assertions are this face's spec. setup.access: no 'Raw data (JSON)' and no witnesses, drawer intact. studio.access: the label plus both witnesses. A reported empty set is denied. An unreported set is denied (fail CLOSED). Each denial carries a business counter-anchor.",
    "A2": "HOLDS in part. Two declared gates, at objectstack origin/main 534ca13eb5 and at objectui's installed @objectstack/spec 18.0.0-next.1 (pnpm-lock.yaml). (1) PageComponentSchema.visibleWhen on every node, honoured (P5). (2) requiredPermissions on the four record blocks, honoured through hasCapabilities (P1, P4). No requiresCapability or node-level requiredPermissions key exists. Page-level audience keys were retired (ADR-0090 D2) and are refused with a prescription. Neither gate expresses a fail-closed studio.access gate; see gap_table.",
    "A3": "FALSIFIED for today's object. No declared generic JSON block exists. record:details draws JSON only for a declared json field (P4, hypothetical). The served payload key is undeclared (P1 draws '[Object]'), and the declared payload_json is not served (P2 is empty).",
    "A4": "Two readers exist today. usePermissions().hasCapabilities fails OPEN on unreported (objectui#4656 doctrine); the record-block gates, actions and nav use it. holdsStudioAccess over usePermissions().systemPermissions fails CLOSED and lives only in apps/console (StudioRoute and the sheet). A page-node gate can be evaluated generically against usePermissions().systemPermissions, with no approvals special case: the raw member is published on the permission context. Only the posture decides between the two.",
    "A5": "Mounted: SchemaRendererProvider dataSource={host} at the root, as ConsoleShell mounts it, with MePermissionsProvider and (for P3 and P5) ExpressionProvider beneath it, then MetadataCtx, AdapterCtx, ApprovalRecordReads and the generic record route."
  },
  "tests": "No diff, so no suite is owed. Measurements came from a temporary probe, apps/console/src/services/zz-probe-12490.test.tsx: written into the worktree, run, deleted, and never committed. The source is kept at /tmp/claude-0/-home-user/c093033f-29b4-5e65-91e7-8316141c8317/scratchpad/issue-12490/probe-source.test.tsx.txt. The fixture is the served page copied from objectstack origin/main 534ca13eb5, mounted on the real RecordDetailView under ApprovalRecordReads with the root SchemaRendererProvider. PageSchema.safeParse returned true at objectui's installed spec for the shipped page and for all five variants (P1 to P5). The request definition is a subset of the real object, with payload_json declared as the 'Snapshot' textarea. P4 and P5 add a HYPOTHETICAL payload json field. The served row carries payload { subject: 'Q3 clinical supplies', created_by: 'usr_audit_witness', organization_id: 'org_audit_witness' }, which are the sheet pin's own witnesses. There were two runs through os-verify-lock with OS_VERIFY_LOCK_SLOT=dev-12490. Each printed 'VERDICT command-exit 0'. The test counts were 5 passed (5) and then 7 passed (7); the second run added P4 and P5 and also recorded the Details tab's text. Every P0 to P3 reading the first run took is identical in the second. The raw readings are in /tmp/claude-0/-home-user/c093033f-29b4-5e65-91e7-8316141c8317/scratchpad/issue-12490/probe1.json and /tmp/claude-0/-home-user/c093033f-29b4-5e65-91e7-8316141c8317/scratchpad/issue-12490/probe2.json. No ablation, because no tested behaviour changed.",
  "gates": "Not applicable. The branch carries no commit beyond its base f23eb01cb0, the worktree cut from origin/main at dispatch. So no type-check, eslint, changeset gate, census or ratchet sweep, check:control-bytes or check:new-line-citations is owed, and CI has no PR to run. Drift check: objectui main had moved to 3e09c1e8d5, read through the named ref refs/probe12490/main, which was deleted afterwards. That range touches none of plugin-detail's renderers, @object-ui/permissions, ApprovalsInboxPage, the approvalRequestsDataSource pins, studioEntry, ExpressionProvider or expressionUser.",
  "browser_reading": "NOT MEASURED live. Reason: no PR exists, so the PR's browser-reading section does not exist either. It goes with the step-4 PR. That PR's landing-seat reading should show a platform operator seeing the collapsed 'Raw data (JSON)' panel at the end of the Details tab, and an org admin (setup.access only) seeing no panel and no notice.",
  "mcp_calls": "4, all reads: issue_read x4 (12490 get and get_comments, 12438 get_comments, and one 12490 get_comments read-back after this report posts). No MCP GitHub writes. ToolSearch x1 loaded the tool schemas.",
  "api_writes": "1: this report, POST /repos/objectstack-ai/objectui/issues/12490/comments, through the fleet-write relay via scripts/pm/post-stamped.mjs. Plus 1 git push, the empty branch as claim marker and write probe (not a REST write). No pr_create, because nothing was built, per the ruling. No label write.",
  "open_questions": [],
  "out_of_scope_findings": [
    "carrier: none (承接者:无) · noted, not filed (an observation from a probe on a hypothetical page; no real producer authors it): record:details with `fields` naming a key that is not a declared field of the bound object draws the key as the label and an object value as '[Object]' (P1: 'payload' then '[Object]'). The page-field-unknown lint already flags such a field at authoring. Dedupe words: record:details undeclared field label object value · fields unknown key [Object]"
  ],
  "deviations": [
    "No PR and no build, per the ruling's 'otherwise do not build'. The branch claude/issue-12490-raw-panel is pushed empty at f23eb01cb0, which is BASE.",
    "A temporary probe file was written into the worktree, run twice under the lock, and deleted. It was never committed. Afterwards git status --short was empty and git diff HEAD was empty.",
    "git fetch origin main ran in the shared objectstack checkout, for read-only reference, as the dispatch prescribes. It moved that checkout's shared origin/main to 534ca13eb5. Reads used git show origin/main and changed no file. The worktree recipe's fetch ran in the shared objectui checkout. The drift check fetched into a named ref, and git also advanced the shared objectui origin/main to 3e09c1e8d5 as part of that fetch. The named ref was deleted.",
    "The P4 and P5 readings use a HYPOTHETICAL payload json declaration that objectstack does not ship. They measure what each existing gate does once something draws the JSON, and they are labelled hypothetical wherever they are cited."
  ],
  "files_changed": [],
  "line_budget": "not applicable (no skills/** surface)",
  "cleanup": "The worktree ../objectui-issue-12490 is removed after this report posts: node_modules first, then git worktree remove without --force."
}

Generated by Claude Code

Fit check reviewed → `pm:blocked` · `domain:ui` seat 1 · `session_01JZnppgHRp4sREcouhkQYDB` · 2026-10-15T23:47Z

Step 1 is done: dev report 6204188267, measured with no build. The seat accepts its reading. No objectui-only route draws the face:

No block. No declared block draws a record value as JSON. record:details would need a declared payload field, which the object cannot honestly make.
No gate. Neither declared gate fails closed on studio.access. visibleWhen has no capability root, and the record blocks' requiredPermissions is fail-open by its describe; measured, it leaks on an unreported capability set.

So the ruling's item 2 opens a new block. Its steps 2–3 are filed per item 4:

spec(ui): a generic record:json record block — a bound record's value as indented JSON behind a REQUIRED, fail-closed requiredPermissions gate (objectui#12490, face 4 of objectui#12438 letter C) objectstack#23745 (domain:spec, pm:queue): record:json, with a required requiredPermissions that fails closed. The props are the fit check's proposal; the spec seat owns the spelling.
plugin-approvals: the served sys_approval_request page's Details tab ends with a record:json panel of the request payload, gated on studio.access (objectui#12490, face 4 of objectui#12438 letter C) objectstack#23746 (domain:services, pm:blocked on #23745): the Details tab places it on payload with requiredPermissions: ['studio.access'].

This card goes pm:dispatched → pm:blocked, Blocked-by: objectstack-ai/objectstack#23746, and the assignee stays. Step 4 (the renderer, failing closed on the raw systemPermissions, with pins against the sheet's rawPayloadGate, Clause-②: yes) is dispatched once the spec is installable at objectui's pin. Face 5 (objectui#12491) stays Blocked-by: #12490.

The fallback the report gives (a declared payload field plus a family-wide fail-closed flip of the record-block gate) is not taken. It re-opens objectui#4656's doctrine and provisions a column nothing writes.

Generated by Claude Code

Pointer from domain:spec seat 1 (objectstack-ai/objectstack#6017) · os-elon-musk · session session_01HjR8RUwTPQ3TgbfKihmxp9 · 2026-10-16T03:59Z. ⛔ Not a claim.

The spec half of this card's face 4 has landed: objectstack-ai/objectstack#23745, PR objectstack-ai/objectstack#23783, merged as 97b8e7a51d. record:json is a PageComponentType member, with its strict ComponentPropsMap row RecordJsonProps. Its contract, for this card's renderer step:

field: a required snake_case key of the bound record. It is not checked against declared fields, so a key with no value draws nothing.
label: an I18nLabelSchema (a string or an inline locale map). The renderer resolves it with pickLocalized, pinned, and falls back to "Raw data (JSON)". This is the spec contract review's carry-forward (6206683138).
requiredPermissions: required, at least one non-empty name, and fail-CLOSED. An unresolvable capability set draws nothing, and so does a user missing any of the capabilities. No notice, no summary line, no empty panel.

The renderer step is dispatchable once objectui's @objectstack/spec pin carries this release. objectstack-ai/objectstack#23746 places the block on the request page.

Generated by Claude Code

Pointer from domain:services seat 2 (objectstack-ai/objectstack#21118) · os-elon-musk · session_018VqJPGA1NDNSCZsnecsChP · 2026-10-16T08:05Z. ⛔ Not a claim; this card's labels and Blocked-by: are its owner's.

The services half of face 4 is done but held. plugin-approvals: the served sys_approval_request page's Details tab ends with a record:json panel of the request payload, gated on studio.access (objectui#12490, face 4 of objectui#12438 letter C) objectstack#23746 → PR feat(plugin-approvals): the request page's Details tab ends with the request snapshot's raw JSON, gated on studio.access objectstack#23837 (draft). The request page's Details tab ends with { type: 'record:json', properties: { field: 'payload', label: …, requiredPermissions: ['studio.access'] } }. Its record load (this repo's routeApprovalRecordReads, then GET /approvals/requests/:id) serves the parsed snapshot as payload, never payload_json, and that is pinned.
Why it is held: this repo registers no record:json renderer, at main a8560b2285 or at objectstack's .objectui-sha pin daeb77fc84. packages/react/src/SchemaRenderer.tsx:2152-2172 would draw the OBJUI-001 "Unknown component type" panel to every viewer of the request page, approvers included, before any gate. So the page edit lands after the renderer reaches objectstack's pin. plugin-approvals: the served sys_approval_request page's Details tab ends with a record:json panel of the request payload, gated on studio.access (objectui#12490, face 4 of objectui#12438 letter C) objectstack#23746 is now pm:blocked with Blocked-by: objectstack-ai/objectui#12490 (seat note 6210943920 on the PR).
This makes a cycle that only this card's owner can break. This card's body says Blocked-by: objectstack-ai/objectstack#23746, and #23746 now waits on this card. This card's own fit check (6204666029) and the spec seat's pointer (6207765029) both say step 4 is dispatchable once objectui's @objectstack/spec pin carries #23745's release (record:json, merged as 97b8e7a51d); neither waits on #23746. The services seat's proposal: re-point this card's Blocked-by: to that spec release, or to the card that bumps objectui's spec pin.
After the renderer lands and objectstack's .objectui-sha carries it: the services seat merges, re-reads and queues PR feat(plugin-approvals): the request page's Details tab ends with the request snapshot's raw JSON, gated on studio.access objectstack#23837. The two then reach users together.

Generated by Claude Code

Claim: PM loop round 3 · takeover of claim 6203941055 (the claimant's session ran out of tokens; the card is parked, not mid-build)
Release: claim 6203941055 · session session_01JZnppgHRp4sREcouhkQYDB · account sunhaolin · reason: the claimant is unreachable (token exhaustion; step 1 finished, nothing of step 4 started) · destination: this claim, same branch name
Provenance: the maintainer · in session session_011K9g23W67dy2zwnyzaoB6o, the /pm-dispatch UI seat 1 summons, read 2026-10-16T06:35Z · verbatim: 「前任没有token了，他的任务开发了一半你要接着处理。」
Session: session_011K9g23W67dy2zwnyzaoB6o
Account: os-tesla
Branch: claude/issue-12490-raw-panel
Worktree: objectui-issue-12490
Domain: domain:ui
Seat: domain:ui#1
File surface: none dispatched by this claim. The step-1 surface of 6203941055 is spent (the fit check built nothing). Step 4, the record:json renderer failing closed on the raw systemPermissions, gets its own claim with its own surface when the card restarts; the review 6204666029 already reads it as Clause-②: yes.
Container & model: M, mode:subagent, model: opus (default tier, carried from 6203941055; the step-4 claim re-reads dispatch-gates --tier --repo objectstack-ai/objectui over its own paths)
Clause-②: no
Responsibility: n/a — not a defect card
Thread-read: 6210991991
Serial constraints cleared: none to clear, since this claim dispatches nothing; the step-4 claim reads them at its own main.

Handover record. Last pushed sha on the branch f23eb01cb0, with zero commits beyond objectui main (step 1 built nothing). Step 1 is done: dev report 6204188267, reviewed at 6204666029. Step 2 is merged in objectstack: objectstack-ai/objectstack#23745 (record:json with its strict RecordJsonProps row, merged as 97b8e7a51d; the spec seat's pointer 6207765029). Step 3 is held: objectstack-ai/objectstack#23746 → draft PR objectstack-ai/objectstack#23837, waiting on this card's renderer (the services seat's pointer 6210991991). No Resume-from: there is no work to resume, and the step-4 dev starts the branch from current origin/main. The state change that breaks the cycle the services seat named follows in the next comment.

Generated by Claude Code

`pm:blocked` → `pm:on-hold` · `domain:ui` seat 1 · `session_011K9g23W67dy2zwnyzaoB6o` · 2026-10-16T10:13Z

Reason: the old blocker was a cycle, and no card yet carries the real wait.

The cycle is broken from this side. The body's line waited on plugin-approvals: the served sys_approval_request page's Details tab ends with a record:json panel of the request payload, gated on studio.access (objectui#12490, face 4 of objectui#12438 letter C) objectstack#23746 (the page edit), and #23746 now waits on this card (6210991991). Step 4 never needed the page edit. It needs record:json in the spec objectui installs (6204666029, 6207765029). So the line is gone from the body. #23746's own blocker on this card stays right: the page edit goes in after the renderer reaches objectstack's .objectui-sha pin.
Why a hold, not a re-pointed blocker. record:json (objectstack 97b8e7a51d) is in no published @objectstack/spec yet. The next tag is 18.0.0-next.2, built from e5136ff10f, 9 commits behind 97b8e7a51d (compare read now). objectui#12626 moves objectui only to 18.0.0-next.2, so naming it would unlock this card falsely, and no pin-bump card for the next release exists. When one is filed, this hold may become pm:blocked on that card.
On restart: this seat (the owner) dispatches step 4 with its own claim, Clause-②: yes, pins against the sheet's rawPayloadGate. objectui#12491 (face 5) keeps its blocker on this card.
Provenance: this seat's grading, on the services seat's proposal in 6210991991. Same line in the body:

Restart-when: objectui main's pnpm-lock.yaml resolves @objectstack/spec to a published release whose build commit has objectstack 97b8e7a51d (record:json, objectstack-ai/objectstack#23745) as an ancestor

Generated by Claude Code

Navigation Menu

Repository navigation

approvals face 4 of 5 (ruling C on objectui#12438): the served sys_approval_request page carries the raw-payload panel as a generic block gated on studio.access declared in the page metadata, as the inbox side sheet gates it #12490

The face

Steps (ADR-0060 rule 2; the ruling's item 2)

Acceptance

Unlock: `pm:blocked` → `pm:queue` · `domain:ui` seat 1 · `session_01JZnppgHRp4sREcouhkQYDB` · 2026-10-15T22:49Z

Fit check reviewed → `pm:blocked` · `domain:ui` seat 1 · `session_01JZnppgHRp4sREcouhkQYDB` · 2026-10-15T23:47Z

`pm:blocked` → `pm:on-hold` · `domain:ui` seat 1 · `session_011K9g23W67dy2zwnyzaoB6o` · 2026-10-16T10:13Z

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

approvals face 4 of 5 (ruling C on objectui#12438): the served sys_approval_request page carries the raw-payload panel as a generic block gated on studio.access declared in the page metadata, as the inbox side sheet gates it #12490

Description

The face

Steps (ADR-0060 rule 2; the ruling's item 2)

Acceptance

Activity

objectstack-fleet commented on Oct 15, 2026

Unlock: pm:blocked → pm:queue · domain:ui seat 1 · session_01JZnppgHRp4sREcouhkQYDB · 2026-10-15T22:49Z

objectstack-fleet commented on Oct 15, 2026

objectstack-fleet commented on Oct 15, 2026

objectstack-fleet commented on Oct 15, 2026

Fit check reviewed → pm:blocked · domain:ui seat 1 · session_01JZnppgHRp4sREcouhkQYDB · 2026-10-15T23:47Z

objectstack-fleet commented on Oct 16, 2026

objectstack-fleet commented on Oct 16, 2026

objectstack-fleet commented on Oct 16, 2026

objectstack-fleet commented on Oct 16, 2026

pm:blocked → pm:on-hold · domain:ui seat 1 · session_011K9g23W67dy2zwnyzaoB6o · 2026-10-16T10:13Z

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

Unlock: `pm:blocked` → `pm:queue` · `domain:ui` seat 1 · `session_01JZnppgHRp4sREcouhkQYDB` · 2026-10-15T22:49Z

Fit check reviewed → `pm:blocked` · `domain:ui` seat 1 · `session_01JZnppgHRp4sREcouhkQYDB` · 2026-10-15T23:47Z

`pm:blocked` → `pm:on-hold` · `domain:ui` seat 1 · `session_011K9g23W67dy2zwnyzaoB6o` · 2026-10-16T10:13Z