App navigation: a visibility predicate that calls current_user.can() is evaluated with the permissions map, so permission-gated navigation hides what the user may not read

Source

Read on objectui main efa9cb4fa with HotCRM 4f82b815: on every console load the browser console warns, verbatim:

[ObjectUI] A visibility predicate could not be evaluated - node "app-shell:visible" · visible: "current_user.can("crm_opportunity", "read")" · Reason: [runtime] can('crm_opportunity', 'read') cannot be answered: this evaluation context carries no permission data. Pass permissions on the EvalContext — the objects map of the published /auth/me/permissions response, object name -> EffectiveObjectPermission. … The node was treated as its safe default, which on this surface means the gate did NOT bite - a predicate that cannot be evaluated reads on screen exactly like one that said yes.

HotCRM declares that predicate on a navigation item; the console shows the item to everyone. The runtime refuses loudly and the shell swallows the refusal into "show". So an app's permission-gated navigation never hides anything in the console: a declared capability that the runtime does not honour, the shape the four-axis note calls the worst one.

Target

The app-shell EvalContext for navigation and app-level visible predicates carries permissions = the objects map of /auth/me/permissions, loaded once per session with the identity and refreshed when the permission set changes (the same source the record page uses for its own gates).
While the map has not arrived, a gated item is withheld, not shown: the safe default for a navigation gate is "hidden until known". The warning stays for predicates that fail for any other reason, and those render hidden as well, with the reason once per predicate.
A test that mounts the shell with a user lacking read on an object hides that app's gated navigation item, and shows it for a user who has it.

File surface

packages/app-shell/src/ (the navigation predicate evaluation and the EvalContext builder for app-shell:visible nodes), packages/auth/src/ (the permissions fetch and its cache), tests beside each.

Acceptance

Tests per Target 3; the console warning is gone on a fresh HotCRM load.
A screenshot of HotCRM's navigation as a user without crm_opportunity read (a seeded restricted user or a permission set assigned under Setup → Users), 1280 px.
pnpm --filter @object-ui/app-shell test, pnpm --filter @object-ui/auth test green.

Constraints

No consumer-side leniency: the runtime's refusal stays loud; the shell supplies the data instead of defaulting to "show".

Evidence

No screenshot; the measurements above are the evidence.

_{Filed by the epic PM session session_cdb7a717-def7-4e71-9988-f089fbaa18ff from the 2026-10-16 fourth review: objectui main efa9cb4fa, HotCRM 4f82b815 on platform 18.0.0-next.2, the vite console on :5180 against objectstack dev on :4001, the maintainer's browser pane at 1024 × 768 (dark, en). The maintainer asked for every finding to be filed on the repository it belongs to, verbatim: 「全部立卡，平台问题到 objectui，审计日志核查到 objectstack，HotCRM 转化流程到 hotcrm。」}

Claim: PM loop round 3 (priority:p1, area:access)
Session: session_01XVp19E1MYUTFM3dnkwz8gB
Account: baozhoutao (the seat's linked user as GET /user answers it; the card's assignee)
Branch: claude/issue-12700-nav-can-permissions (part 1, merged as PR #12728 / 71243db); part 2: claude/issue-12700-home-permissions
Worktree: objectui-issue-12700 (part 2 reuses the name after part 1's worktree was removed)
Domain: domain:ui
Seat: domain:ui#2
File surface: packages/app-shell/src/providers/ExpressionProvider.tsx (the app-shell:visible evaluation and its permissions binding); the app-shell navigation consumers that evaluate app / nav-item visible (packages/app-shell/src/ sidebar / nav gate hooks, e.g. hooks/useNavMemberGates.ts, utils/navObjectReadGate.ts, measured at claim); packages/permissions/src/ and packages/auth/src/ only where the /auth/me/permissions load and its cache/refresh live; tests beside each; one .changeset/12700-*.md (stop on breach; explain in the report).
Container & model: M, mode:subagent, model: opus (default tier; dispatch-gates --tier --repo objectstack-ai/objectui over the planned paths reads no path-derived mandate)
Clause-②: no (provisional: a behaviour fix inside the shell; the dev reports yes if a published export's shape changes)
Responsibility: objectui app-shell: the nav predicate scope reaches the evaluator without the permissions map, and the unevaluable predicate defaults to shown | the platform path that covers it is the existing /auth/me/permissions payload the record page already binds (objectui#4421) | every console user of an app that gates navigation with current_user.can(), HotCRM today
Thread-read: none
Serial constraints cleared: scanned every open objectui PR's file list just now. None touches ExpressionProvider.tsx, the nav gate hooks, or packages/auth/src/. This seat's in-flight objectui#12107 (PR #12709) touches data-objectstack, writeWarningToast.ts and i18n only, so it is disjoint.
Revised 2026-10-16T16:20Z for part 2 (seat ruling 6219062609): the surface adds apps/console/src/AppContent.tsx (moving or sharing the existing MePermissionsProvider mount, ⛔ no second fetch or cache), the console route composition that wraps /home (apps/console/src/App.tsx / apps/console/src/components/ProtectedRoute.tsx, as measured), the /home frame's predicate scope (packages/app-shell/src/console/ and packages/app-shell/src/providers/ExpressionProvider.tsx), tests beside each, and one .changeset/12700-home-permissions.md. ⛔ /studio/* and apps/console/src/components/studioEntry.ts are outside the surface. Serial check for part 2: no open objectui PR touches these files (scanned 2026-10-16T16:19Z).
Claimed at: 2026-10-16T14:24Z

os-dev-report

{
  "issue": 12700,
  "status": "needs_decision",
  "branch": "claude/issue-12700-nav-can-permissions",
  "pr": "https://github.com/objectstack-ai/objectui/pull/12728",
  "session": "session_01XVp19E1MYUTFM3dnkwz8gB",
  "premise_still_valid": true,
  "summary": "Dispatch order read in full, md5 1771e8b773964fe182c25483acd1505e; claim 6217602301 names this branch. Root cause measured on main f8267df93: inside an app the can() nav gate already answers from /auth/me/permissions (MePermissionsProvider withholds the whole shell until it answers, ExpressionProvider binds the objects map; probe: denied hidden, granted shown, no warning), so A1 is false for the in-app sidebar. The warning comes from /home and the Studio frames, which mount no permission provider and no ExpressionProvider: the bell and Home activity card derive their roster from every app's navigation through useNavMemberGates, the no-provider evaluator has no permissions, the engine refuses, and evaluateVisibility answered fail-open (A1's other half holds: the app-shell:visible safe default was show). Implemented Target 2: a package-internal evaluateNavigationVisibility withholds a navigation entry on a fault (a blank gate is still drawn), reports once with a new 'withholding' consequence row in visibilityDiagnostic.ts; used by useNavMemberGates, nav:menu and the command palette nav list; evaluateVisibility (object-field gate, published export) unchanged. PR body says 'Part of #12700', not Fixes: Target 1 for /home and Studio needs a permission source over those frames. The only one is mounted in apps/console/src/AppContent.tsx, outside the file surface. So on Home the gated entry is withheld from the activity roster and the warning still fires once there. Decision below.",
  "tests": "HEAD 3e7dfc0c7. Lock-held runs, vitest --maxWorkers=1: app-shell providers+hooks+chrome 108 files/918 passed; app-shell layout 84/593 passed; app-shell console/__tests__ + react SchemaRenderer.visibleWhenRecordBinding + disabledGateFaultDiagnostic 33/277 passed; react/src/utils + concealmentGateFaultDiagnostic 7/82 passed; rest of app-shell/src/console + views/__tests__/nav-*: 676 passed 0 failed, run killed by its 560 s cap before the summary (partly NOT MEASURED); final targeted run on 3e7dfc0c7 (navigationVisibility-12700, UnifiedSidebar.navCanPermissions-12700, currentUserCan-4421 [control e], UnifiedSidebar.objectReadGate-12109, AppContent.landingMemberGates-12426) 5/35 passed. NOT MEASURED: rest of app-shell/src/views, full suite (CI). Closure build turbo --filter='@object-ui/app-shell^...' 28/28; type-check react + app-shell (tsconfig and tsconfig.test.json) green after typing the warn spy (first run: 4 TS7006 in the new tests, fixed). Ablation on committed fix: useNavMemberGates back to evaluateVisibility, on-disk markers mutant=1 fix=0, UnifiedSidebar.navCanPermissions-12700 1 failed / 4 passed (red = no-payload pin; a-d stay green, which matches the root cause); restored via git checkout HEAD --, blob hash equal to HEAD's. Neither (a) nor (c) can go red, because in-app the payload is bound before the sidebar renders. No dist/build leg is involved: the tests import app-shell src relatively and @object-ui/react through the vitest src alias. eslint --no-inline-config --format json on the 23 changed ts/tsx files: 23 files, 0 errors, 44 warnings, exit 0. Narrowing evidence: the population is the changed-file list from git diff f8267df93..HEAD; the file count comes from the JSON output; eslint.config.js enables no type-aware linting (no projectService/typeChecked), so untouched files' verdicts cannot move. Gates, all exit 0: check:phantom-deps, self-import, unreferenced-sources, doc-example-readers, handler-key-reads, side-effects-array, element-data-source-declaration, spec-symbols, action-forward-parity, designer-field-key-parity, icon-record-names, i18n-keys, i18n-drift, i18n-designer-parity, control-bytes, test-path-roots, new-line-citations, check-hand-rolled-comment-mask.mjs, check-changeset-fixed.mjs, check-changeset-presence.mjs, check-changeset-no-major.mjs. check:spec-floors not run.",
  "mcp_calls": "0",
  "api_writes": "2 — fleet-write relay dispatches (POST /repos/objectstack-ai/objectstack/dispatches): (1) pr_create objectui#12728 draft with assignee baozhoutao, byte read-back identical; (2) this os-dev-report comment on #12700. Plus 6 git pushes to the branch (not REST). Zero label writes (none named by the order; objectui has no gate reading labels).",
  "open_questions": [
    {
      "question": "Target 1 on the /home and Studio frames: they have no permission source, so a current_user.can() navigation gate can never be answered there. With this PR the gated entry is withheld from their activity roster and the refusal is still reported once. How should those frames get the map?",
      "options": [
        "A: one MePermissionsProvider above every protected frame (ProtectedRoute / ConnectedShell), removing the per-route mount in apps/console/src/AppContent.tsx, plus the predicate scope on those frames binding it (an ExpressionProvider there, or useExpressionContext's no-provider default reading useExpressionPermissions). Business need: measured, HotCRM gates a nav entry this way and the console lands on /home. Long-term: one fetch and one cache for the whole shell, no second source. AI-safety: a declared can() gate is honoured on every frame, with no gap where a refusal is the norm. Scope: about two files, one in apps/console; cost: Home waits on /auth/me/permissions as /apps does today",
        "B: keep /home and Studio permission-less (this PR's state). Business need: Home's activity roster omits objects reachable only through a can()-gated entry, for granted members too. Long-term: a known permanent gap. AI-safety: a refusal on every Home load trains readers to ignore the line. Scope: zero further work",
        "C: skip visible predicates when deriving the roster on frames without permissions. This is consumer-side leniency, refused by the ruling and by AGENTS.md #0.1"
      ],
      "recommendation": "A. On all four axes it is the producer fix: the declared gate is enforced from the single existing source on every frame, there is no new capability and no second fetch, and the remaining half of the card's acceptance (no warning on a fresh HotCRM load) needs it. It touches apps/console/src/AppContent.tsx and the shell composition, which are outside this claim's file surface, so it is a follow-up claim, not this PR."
    }
  ],
  "out_of_scope_findings": [
    "carrier: none (承接者:无) · a bare-string visible (not the served CEL envelope) takes ExpressionEvaluator's legacy path, and the probe answered false for current_user.can(...) even with a granted payload bound. Served navigation carries the envelope, and no producer serving the bare string was named. Noted in the PR's Acceptance notes, not filed. Dedupe words: bare string visible legacy path, current_user.can legacy evaluator, nav visible envelope"
  ],
  "deviations": [
    "PR body uses 'Part of #12700' instead of the closing keyword the order asked for, because Target 1 on /home and Studio is not delivered (see open_questions).",
    "Clause-② corrected to yes: @object-ui/react's published PredicateGateKind union gains 'withholding'.",
    "Surface: packages/react/src/index.ts got a comment-only edit, because the comment above the PredicateGateKind re-export stated the member count and the new row made it false. 15 layout test files that stub the ExpressionProvider module got one stub line each (tests beside the touched gate)."
  ],
  "files_changed": [
    ".changeset/12700-nav-can-permissions.md",
    "packages/app-shell/src/providers/ExpressionProvider.tsx",
    "packages/app-shell/src/hooks/useNavMemberGates.ts",
    "packages/app-shell/src/views/nav-menu-renderer.tsx",
    "packages/app-shell/src/chrome/CommandPalette.tsx",
    "packages/react/src/utils/visibilityDiagnostic.ts",
    "packages/react/src/index.ts",
    "packages/app-shell/src/providers/__tests__/navigationVisibility-12700.test.ts",
    "packages/app-shell/src/layout/__tests__/UnifiedSidebar.navCanPermissions-12700.test.tsx",
    "packages/app-shell/src/layout/__tests__/*.test.tsx (15 stub updates)"
  ]
}

Seat ruling on the dev's open question · `domain:ui` seat 2 · `session_01XVp19E1MYUTFM3dnkwz8gB` · 2026-10-16T15:40Z

Answering the needs_decision in the os-dev report 6219025238 (PR #12728). This is a technical scoping and ordering call inside the card's own Target, so the seat answers it and it does not go to the decision box. No product semantics change: the card already rules "hidden until known".

What the dev measured:

Inside an app, the can() nav gate already answers from /auth/me/permissions. MePermissionsProvider in apps/console/src/AppContent.tsx withholds the shell until the payload arrives, and ExpressionProvider binds the objects map.
The console warning comes from /home and the Studio frames. They mount no permission source, yet their bell and Home activity roster evaluate every app's navigation predicates through useNavMemberGates. The surface's safe default was "show".

Ruling:

PR fix(app-shell): a navigation visible gate withholds its entry when it cannot be evaluated (objectui#12700) #12728 is part 1 and lands on its own (Part of #12700). A navigation entry whose predicate faults is withheld instead of shown, and the diagnostic still reports it once. The new withholding row widens @object-ui/react's published PredicateGateKind, so the PR line Clause-②: yes stands, and the seat runs the contract-tier review before the queue.
Part 2 is a follow-up on this same card, after part 1 merges. It mounts the single existing permission source over /home, not over Studio, so Home's roster binds the map and the warning is gone on a fresh HotCRM load (/home or /apps).
- Premise, to verify before any code: nothing /home renders changes output for a permission holder when the context is present.
- If the premise is false: report the fork. ⛔ Do not force it, and ⛔ do not fall back silently to another shape.
- No second fetch or cache: the /apps mount in AppContent.tsx moves up, or is shared. It is not duplicated.
Studio stays permission-less, and the dev's option A is narrowed accordingly. apps/console/src/components/studioEntry.ts records why: installing that context over /studio/* would change what the builder renders for a holder, since checkField fails closed for objects the payload omits. So option A, "one provider above every frame", is narrowed to /home.
- On Studio, a gated entry stays withheld from the bell roster and is reported once, as part 1 leaves it.
Option C is refused, as the dev also found: skipping visible predicates on frames without permissions is consumer-side leniency.

Four axes:

Business need: HotCRM gates a nav entry this way, and the console lands on /home.
Long-term soundness: one fetch and one cache, with the producer fixed.
AI-error resistance: a declared gate is honoured wherever the data exists, and withheld (not shown) where it cannot be answered.
No scope spread: no new capability. Studio's documented entry posture is untouched.

The out-of-scope note about bare-string visible taking the legacy evaluator path stays in the PR's Acceptance notes. No producer serves that shape.

Generated by Claude Code

Landed (part 1 of 2) · `domain:ui` seat 2 · `session_01XVp19E1MYUTFM3dnkwz8gB` · 2026-10-16T16:17Z

PR #12728 merged through the merge queue as 71243db, which is on main. The squash commit's message names no model.

Verified by content:

22 of the 24 files on origin/main are blob-identical to the accepted head cef67cc.
The other two, visibilityDiagnostic.ts and UnifiedSidebar.favoritesMenu-12427.test.tsx, differ by blob only because main moved under them (objectui#12692 and objectui#12615). For those two, the squash commit's patch matches the PR's own patch line for line.

What landed: on every navigation surface (the sidebar, nav:menu, the command palette, and the bell / Home activity roster), an entry whose visible predicate cannot be evaluated is now withheld, not shown, and it is reported once with the new withholding row. Inside an app, the can() gate answers from the bound /auth/me/permissions map.

Still open on this card (part 2, per the seat ruling 6219062609): the /home permission source, so the warning is gone on a fresh HotCRM load. The card stays pm:dispatched, and the claim is revised in place to cover part 2's surface.

Generated by Claude Code

os-dev-report

{
  "issue": 12700,
  "status": "done",
  "branch": "claude/issue-12700-home-permissions",
  "pr": "https://github.com/objectstack-ai/objectui/pull/12740",
  "session": "session_01XVp19E1MYUTFM3dnkwz8gB",
  "premise_still_valid": true,
  "summary": "Dispatch order read in full (prompt12700b.txt md5 66a5693f3d839830d10dcede19ac5e5f). Claim 6217602301 (revised) names this branch. PREMISE verified before any code, and it holds. I walked the Home route element's module graph (129 modules from HomeLayout and HomePage) and enumerated every PermCtx consumer it renders: the bell and Home activity feed, the Home inbox, the activity roster via useNavMemberGates, the command palette's record search and nav list, and HomePage's authoring gate. For a holder each answers the same with or without the context, except the intended change: a granted current_user.can() gate now includes its entry. The PR body has the table. A1: there was no existing common ancestor (/home and /apps were sibling routes, each with its own ProtectedRoute). A pathless layout route provides one without moving Studio. Implemented: (1) apps/console ConsolePermissionsScope, the same MePermissionsProvider with the same endpoint, fetcher and fallbacks, moved out of AppContent. App.tsx mounts it once, as the element of a pathless layout route whose only children are /home and /apps/:appName/*. One instance; one fetch per session load. (2) app-shell HomeLayout mounts an ExpressionProvider (stable empty user and features constants), so Home's nav predicate scope binds the map through useExpressionPermissions. Studio routing and studioEntry.ts are untouched. PR body opens with the closing keyword for this card, with Clause-②: no as the second line (measured: no published export changes shape).",
  "tests": "New pin apps/console/src/__tests__/App.homePermissions-12700.test.tsx. Real parts: App routes, ConsolePermissionsScope and MePermissionsProvider, HomeLayout and ExpressionProvider, useNavMemberGates, activityObjectRoster, Studio entry gate. Mocked: the network (the authenticated fetcher). Pins: (a) denied payload: roster 'crm_account' and zero app-shell:visible lines; (b) granted: 'crm_account,crm_forecast', zero lines; (c) /home then /apps/crm: 1 permissions request; Home shows the loading screen until the answer; (d) /studio builder probe reads no PermCtx. Final run on HEAD c7eb44573 (new pin, UnifiedSidebar.navCanPermissions-12700, navigationVisibility-12700, HomeLayout.searchOpensPalette-12601): 4 files / 21 passed. On 4aa5c2be7: 28 console files that import or mock App, AppContent, ProtectedRoute or Studio routing, 225 passed; part 1 pins (e: UnifiedSidebar.navCanPermissions-12700, navigationVisibility-12700, currentUserCan-4421.render, AppContent.landingMemberGates-12426) plus app-shell/src/console/home/ plus two AppHeader home tests, 33 files / 255 passed. i18nAfterSignIn-12034 was measured red (No ConsolePermissionsScope export on the ../AppContent mock), then fixed by adding a pass-through to the 4 AppContent mocks. Ablation 1 (the mount move, on the committed fix): /home back on its own ProtectedRoute without the scope, on-disk mutant marker 1 and fix marker 0; 3 failed / 2 passed, with (a) red on the warning (expected [ Array(1) ] to deeply equal []), (b) red, and the loading pin red. Restored via git checkout HEAD --, blob 428947b95 equal to HEAD, git diff HEAD empty. Ablation 2 (HomeLayout ExpressionProvider removed): 2 failed, (a) and (b); restored, blob 030429618 equal to HEAD. No dist leg: the console resolves @object-ui/* to src via alias. Closure builds: app-shell^... 28/28, console^... 34/34. type-check: app-shell exit 0; console exit 0, including tests (the first run caught an unused React import in the new test, fixed in c7eb44573). eslint --no-inline-config --format json on the 8 changed ts/tsx files: 8 files, 0 errors, 1 warning (react-refresh/only-export-components on systemRoutes, same line on the base). Population: git diff --name-only from base 378896da6. eslint.config.js has no type-aware linting. NOT MEASURED: the full apps/console dir (210 files; shard 1/3 alone is 617 s by the sequencer timings, killed at the 590 s cap) and the full app-shell package; narrowing declared, CI runs both. NOT MEASURED: check:eager-closure (needs a console vite build); by reading, no new module enters the eager closure. NOT MEASURED: the card's HotCRM screenshot acceptance (no HotCRM backend in the container).",
  "gates": "all exit 0, run after the final commit c7eb44573: check:phantom-deps, self-import, unreferenced-sources, doc-example-readers, handler-key-reads, side-effects-array, element-data-source-declaration, spec-symbols, action-forward-parity, designer-field-key-parity, icon-record-names, i18n-keys, i18n-drift, i18n-designer-parity, control-bytes, new-line-citations, test-path-roots; scripts/check-hand-rolled-comment-mask.mjs, check-changeset-fixed.mjs, check-changeset-presence.mjs, check-changeset-no-major.mjs; eslint narrowed (exit 0); type-check app-shell 0, console 0. check:spec-floors not run.",
  "line_budget": "not applicable: no skills/** or governed ledger touched; no .claude/** in the diff",
  "mcp_calls": "0",
  "api_writes": "2 — fleet-write relay dispatches (POST /repos/objectstack-ai/objectstack/dispatches): (1) pr_create objectui#12740, draft, assignee baozhoutao, 10510 bytes sent and stored identical; (2) this os-dev-report comment on #12700. Plus 4 git pushes to the branch: the empty probe, 042ab7ddb (carrying 671192466), 4aa5c2be7 and c7eb44573. Zero label writes: none named by the order, and no objectui gate reads labels.",
  "open_questions": [],
  "out_of_scope_findings": [
    "carrier: none (承接者:无) · apps/console/src/components/studioEntry.ts still describes PermCtx's only mount as AppContent covering /apps/:appName/*; the substance (Studio outside) holds, the wording is stale; the file is outside the surface by ruling · noted in the PR's Acceptance notes, not filed",
    "carrier: none (承接者:无) · Home's predicate scope binds no current_user identity (unchanged): a nav gate naming current_user.id or positions still faults on Home and is withheld and reported once, while the sidebar answers it; no producer serving such a gate measured · noted in Acceptance notes, not filed · dedupe words: home predicate scope identity, current_user positions home roster, nav visible fault home"
  ],
  "deviations": [
    "Order of first steps: the role file says push the empty branch before any edit; the order says verify the premise before any code and push nothing if it fails. I ran the premise verification read-only first, then pushed the empty branch probe, then edited.",
    "Surface: 4 existing console tests that vi.mock ../AppContent (App.docsPortalLazy, App.agentChatLink-10640, internalFormShell, i18nAfterSignIn-12034) got a pass-through ConsolePermissionsScope export: tests beside the changed App and AppContent, needed because vitest throws on a missing mock export.",
    "Narrowing: the full apps/console dir does not fit the foreground cap; the 28-file console set that reads the changed composition was run instead and declared.",
    "Harness trailer reminder (model-named Co-Authored-By) ignored as the order directs: every commit carries only Co-authored-by: Claude plus Claude-Session.",
    "The order asked for vitest one package dir at a time. The 33-file app-shell run and the 28-file console run each stayed within one package; the final 4-file run mixed console and app-shell files in one invocation."
  ],
  "files_changed": [
    ".changeset/12700-home-permissions.md",
    "apps/console/src/App.tsx",
    "apps/console/src/AppContent.tsx",
    "apps/console/src/__tests__/App.homePermissions-12700.test.tsx",
    "apps/console/src/__tests__/App.agentChatLink-10640.test.tsx",
    "apps/console/src/__tests__/App.docsPortalLazy.test.tsx",
    "apps/console/src/__tests__/i18nAfterSignIn-12034.test.tsx",
    "apps/console/src/__tests__/internalFormShell.test.tsx",
    "packages/app-shell/src/console/home/HomeLayout.tsx"
  ]
}

Landed (part 2 of 2; card complete) · `domain:ui` seat 2 · `session_01XVp19E1MYUTFM3dnkwz8gB` · 2026-10-16T18:14Z

PR #12740 merged through the merge queue as 2dbe5f5, which is on main. Verified by content: all 10 of the PR's files on origin/main are blob-identical to the accepted head b4ab78f. The squash commit's message names no model.

What landed:

The console mounts its one /auth/me/permissions source above both /home and /apps/:appName/*, through a pathless layout route. That means one fetch per session load. /studio/* stays outside it, per studioEntry.ts.
Home's navigation predicate scope binds that map and the signed-in user, through the shared normaliser. So a current_user.can() nav gate answers on Home: denied withholds the entry, granted includes it, and no console warning fires.
Part 1 (71243db, PR fix(app-shell): a navigation visible gate withholds its entry when it cannot be evaluated (objectui#12700) #12728) made an unanswerable navigation gate withheld instead of shown on every nav surface.

Together these deliver the card's Target 1–3.

Owed by the maintainer: the card's 1280 px screenshot of HotCRM's navigation as a user without crm_opportunity read.

pm:dispatched leaves with this note. The card closed completed on merge.

Generated by Claude Code

Navigation Menu

Repository navigation

App navigation: a visibility predicate that calls current_user.can() is evaluated with the permissions map, so permission-gated navigation hides what the user may not read #12700

Source

Target

File surface

Acceptance

Constraints

Evidence

Seat ruling on the dev's open question · `domain:ui` seat 2 · `session_01XVp19E1MYUTFM3dnkwz8gB` · 2026-10-16T15:40Z

Landed (part 1 of 2) · `domain:ui` seat 2 · `session_01XVp19E1MYUTFM3dnkwz8gB` · 2026-10-16T16:17Z

Landed (part 2 of 2; card complete) · `domain:ui` seat 2 · `session_01XVp19E1MYUTFM3dnkwz8gB` · 2026-10-16T18:14Z

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

App navigation: a visibility predicate that calls current_user.can() is evaluated with the permissions map, so permission-gated navigation hides what the user may not read #12700

Description

Source

Target

File surface

Acceptance

Constraints

Evidence

Activity

objectstack-fleet commented on Oct 16, 2026

objectstack-fleet commented on Oct 16, 2026

objectstack-fleet commented on Oct 16, 2026

Seat ruling on the dev's open question · domain:ui seat 2 · session_01XVp19E1MYUTFM3dnkwz8gB · 2026-10-16T15:40Z

objectstack-fleet commented on Oct 16, 2026

Landed (part 1 of 2) · domain:ui seat 2 · session_01XVp19E1MYUTFM3dnkwz8gB · 2026-10-16T16:17Z

objectstack-fleet commented on Oct 16, 2026

objectstack-fleet commented on Oct 16, 2026

Landed (part 2 of 2; card complete) · domain:ui seat 2 · session_01XVp19E1MYUTFM3dnkwz8gB · 2026-10-16T18:14Z

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

Seat ruling on the dev's open question · `domain:ui` seat 2 · `session_01XVp19E1MYUTFM3dnkwz8gB` · 2026-10-16T15:40Z

Landed (part 1 of 2) · `domain:ui` seat 2 · `session_01XVp19E1MYUTFM3dnkwz8gB` · 2026-10-16T16:17Z

Landed (part 2 of 2; card complete) · `domain:ui` seat 2 · `session_01XVp19E1MYUTFM3dnkwz8gB` · 2026-10-16T18:14Z