Studio: switch a read-only package's flow off for this deployment from the Automations pillar — ledger switch on the item, posture-aware, refusal verbatim

epic:#28130#1 · hotlong · session_040dfd80c4c9411b895c698e785a6848

Filing gate: ④ child of epic #28236 — re-scoped from ADR-0146 child 2b on the maintainer's rulings of 2026-10-30, verbatim: 「方向定为包级覆盖：代码和 Studio 用同一机制，定制都进 .custom。」 · 「#28148 只继续本部署开关，克隆部分停」 · 「等我拍板的 8 个问题，全部同意」. The original body (2b, switch + Clone) is in this card's edit history. The claim (6525340005) and assignee stand. The pause recorded in 6525828736 (「2a、2b 开发暂停 #28147 和 #28148 上」) is lifted for this re-scoped card — maintainer, 2026-10-31, verbatim: 「这些卡都可以放回车队开发吧」. Resume from claude/project-thread-dhj1ou@1a9e7703b4, drop the Clone half.

Part of #28236 (P0, child N-04) · lane: domain:ui · size: S–M · work so far: claude/project-thread-dhj1ou@1a9e7703b4 (unreviewed).

Business reason. In Studio a read-only package's flow shows a locked switch that reads the flow definition, beside a status chip that reads the deployment ledger — they disagree. Measured at d6c0a75f1a (showcase): after the ledger switched showcase_urgent_task_alert off, the header read 「状态: 已停用 — 不会运行」 next to 「🔒 已启用」. An administrator cannot switch a packaged flow off where they look at it; they must find Setup → Packaged automation.

Wanted.

On a read-only package's flow in the Automations pillar: a ledger switch worded "off for this deployment", bound to GET /api/v1/automation/_status + POST /api/v1/automation/<name>/toggle; its three readings from views/setup/packagedFlows.ts#activationReading (on / enabled-but-not-running with the server's reason verbatim / off). A writable package's flow keeps its definition switch — two controls, two words.
Authority stays the server's: disabled in the console's own words for a principal the ledger gate refuses, read from the two facts (useTenancyPosture() → features.tenancyPosture, user.isPlatformAdmin) — ⛔ not walledCatalogReadOnly itself, which answers false for a flow (director note 6526396053); after an attempt, the server's refusal shown verbatim. Share the toggle request with PackagedAutomationPage.tsx (one module), no second copy.
Remove the read-only hint "请切换或新建可写软件包后再编辑" from the flow switch.
Tests: switch bound to the ledger, not status; the measured disagreement case reads "off"; walled non-platform-admin disabled, single enabled; refusal verbatim; writable package's row unchanged.

Not here (moved). Clone → epic child N-22 ("new similar", into <base>.custom); the action ledger switch → #27842/#27504; customizing the flow → N-18.

Dedupe. #27356 rows 19/21, PR #27376, #27504/#27842 (actions). No other open card puts the ledger switch on the item.

Links back: #28236, #28130 (superseded), ADR-0126 §7.2/§7.4.

Generated by Claude Code

domain:ui#3 · os-tesla · session_01L9qibz8HEj53Wx2uphTo2o

Claim: PM loop round 1 · 2026-10-30T14:34Z
Session: session_01L9qibz8HEj53Wx2uphTo2o (seat; implementation by card thread session session_01L9qibwzHimUXAoJvtdW6Tv, mode:thread)
Account: os-tesla (the seat's linked user as GET /user answers it; the card's assignee)
Branch: claude/project-thread-dhj1ou (the card thread's designated push branch, the recorded platform exception to claude/issue-<n>-<slug>)
Worktree: objectstack-issue-28148
Domain: domain:ui
Seat: domain:ui#3
File surface: ui/packages/app-shell/src/views/studio-design/StudioDesignSurface.tsx (region: AutomationsPillar / FlowStatusDot), ui/packages/app-shell/src/views/studio-design/FlowItemMoreMenu.tsx, a new shared automation-ledger helper, the minimal move out of ui/packages/app-shell/src/views/setup/PackagedAutomationPage.tsx (seat 2 notified on #25995), the Studio i18n keys, their tests, .changeset/28148-*.md (stop on breach; explain in the report)
Container & model: M, mode:thread, model: default (dispatch-gates --tier: no path-derived mandate), effort: high
Clause-②: no
Metadata-protocol: none
Responsibility: n/a — not a defect card
Thread-read: none
Premise: holds
Serial constraints cleared: sibling #28147 (same seat) shares StudioDesignSurface.tsx by declared region (InterfacesPillar vs AutomationsPillar); no other live claim names these files (in flight: #28068 #28053 seat 1, #27524 seat 2, #28077 #28078 #28079 #28084 seat 4)

Routing: cut into the domain:ui queue by the director seat (epic #28130 comment 6524722681) after ADR-0146 merged (cdbf08d1); the maintainer's epic word 「同意，立专题卡」. Order: /mnt/project-files/ui-seat-3/r2026-10-30/dispatch-28148.md under FRAME.md.

domain:ui#3 · os-tesla · session_01L9qibz8HEj53Wx2uphTo2o

Paused · 2026-10-30T14:57Z — the maintainer, in the os-tesla project chat, verbatim: 「2a、2b 开发暂停 #28147 和 #28148 上」 (2026-10-30T14:56:18Z).

Development on this card stops here. The claim 6525340005 and the assignee stand; nothing is released, and no PR is open.
Work so far: claude/project-thread-dhj1ou@1a9e7703b4 (unreviewed WIP). Resume from that sha when the maintainer lifts the pause; ⛔ no push, PR or relay write on this card until then.
Waiting on: the maintainer's word to resume (or to release the card back to pm:queue).

epic:#28130#1 · hotlong · session_040dfd80c4c9411b895c698e785a6848

Recorded 2026-10-30T15:21Z (desktop session 040dfd80-c4c9-411b-895c-698e785a6848).

Label added: pm:epic (beside pm:dispatched; assignee unchanged; read back); linked as a sub-issue of #28130.

Instruction — the maintainer, in a direct desktop session, verbatim: 「相关的issue 你都应该标记 epic，避免被车队认领」.

Development on this card is paused by the maintainer, who notified the lane agent directly — verbatim: 「#28147 和 #28148 开发暂停我已经通知了」 and 「我直接通知车道agent了」. The direction ruled in the same session — 「方向定为包级覆盖：代码和 Studio 用同一机制，定制都进 .custom。」 — supersedes this card's ADR-0146 shape; it is re-scoped or replaced in the epic's re-plan.

The label write and the sub-issue link above were made with the maintainer's own account (hotlong) from the desktop session before this seat switched to the fleet write tools; this record is the provenance the transition owes.

director#1 · os-bill · session_01Utp6CaRN6wdrRyLKJSCMYH

Note for the implementer (2026-10-30T15:23Z, from contract review 6526328096 S16 on PR #28145): walledCatalogReadOnly / useWalledCatalogReadOnly answer true only for the three security catalog types — a flow is none of them, so calling either for the ledger switch yields false for a walled tenant administrator and draws the live-control-that-always-answers-403 this card forbids. Reuse the two facts (useTenancyPosture() → features.tenancyPosture, user.isPlatformAdmin) and the posture-and-rung half of the verdict only; the ledger gate (activation-gate.ts#refuseUngrantedActivationWrite) has no type input. ⛔ Not a claim.

Generated by Claude Code

domain:ui#3 · os-tesla · session_01L9qibz8HEj53Wx2uphTo2o

Amendment to Release 6541889272 · 2026-10-31T09:51Z: the card's state is needs-user-decision alone, not pm:queue + needs-user-decision. The state labels are one-of and the ruling is owed first. When the maintainer lifts the pause, the card moves to pm:queue. Assignee cleared.

epic:#28130#1 · hotlong · session_040dfd80c4c9411b895c698e785a6848
2026-10-31T11:34Z

Ruled: the pause is lifted. Maintainer, verbatim, in the desktop PM session, answering the ui seat's resume question (release 6541889272 / amendment 6541903860): 「28148 暂停解除」. This supersedes the 2026-10-30 pause 「2a、2b 开发暂停 #28147 和 #28148 上」 (6525828736) for this card; #28147 stays closed (replaced by N-17).

State: needs-user-decision → pm:queue (one replace write, read back). No assignee — the next domain:ui seat claims it fresh.

For the claiming seat:

Resume-from: claude/project-thread-dhj1ou@1a9e7703b48cd4e976eeaa8b90b9aec790dac876 (no PR), per release 6541889272.
Scope is N-04 as re-scoped: the ledger switch on the item only. Clone moves out to N-21 (Flow clone door → "new similar": the copy lands in a writable target package, by default the paired <base>.custom, never package-less #28149) — drop FlowCloneDialog and the Clone menu entry from the resumed PR.
Still owed (from the release): merge main (feat(app-shell): Studio item toolbar — layers, references, history with rollback, audit and source on every pillar item #28296 and fix(studio): object pickers offer only the objects the edited package may reference #28329 have landed in StudioDesignSurface.tsx), type-check, ablations, the derived gates, the draft PR and the report.
Governing text: ADR-0146 D4 (switch on the item, posture-aware, refusal verbatim) as merged in docs(adr): rewrite ADR-0146 as the package-level override record — paired <base>.custom, one declared override shared by code and Studio; dated pointers on six Status lines #28295.

domain:ui#4 · os-sales · session_01L6bhgWqjXeTcS3jtug46Dv

Claim: PM loop round 3 · 2026-10-31T11:40Z
Session: session_01L6bhgWqjXeTcS3jtug46Dv (seat; implementation by card thread session session_01L6bhgXdweWzW44zdh5YEjY, mode:thread)
Account: os-sales (the seat's linked user as GET /user answers it; the card's assignee)
Branch: claude/project-thread-krgxy0
Worktree: objectstack-issue-28148
Domain: domain:ui
Seat: domain:ui#4
File surface: ui/packages/app-shell/src/views/studio-design/** (StudioDesignSurface.tsx, FlowLedgerSwitch.tsx, FlowItemMoreMenu.tsx, tests), ui/packages/app-shell/src/views/setup/PackagedAutomationPage.tsx and packagedFlowLedger.ts, ui/packages/i18n/src/namespaces/studio/{en,zh}.ts, .changeset/28148-*.md (stop on breach; explain in the report)
Container & model: M, mode:thread, model: default (dispatch-gates --tier: no path-derived mandate), effort: high
Clause-②: yes
Metadata-protocol: none
Responsibility: n/a — not a defect card
Thread-read: 6542841890
Premise: holds — the pause is lifted by ruling 6542841890 (maintainer 「28148 暂停解除」); scope is N-04 as re-scoped there
Serial constraints cleared: no open non-mailbox PR touches studio-design/**, views/setup/Packaged* or packagedFlowLedger.ts at this read; #28296 and #28329 (StudioDesignSurface.tsx) have landed and are merged in from main; #28149 (N-21, Clone) takes the Clone half
Resume-from: claude/project-thread-dhj1ou@1a9e7703b48cd4e976eeaa8b90b9aec790dac876

Scope: Fixes #28148. Ruling verbatim: 「28148 暂停解除」 (6542841890). Only the ledger switch on the item. Clone moves to N-21 (#28149), so FlowCloneDialog and the Clone menu entry are dropped. Governing text: ADR-0146 D4 as merged in #28295. The inherited work is UNVERIFIED and is re-run in full. Clause-②: yes (widening): the change adds new @object-ui/i18n keys, so the seat owes a TIER_DEFAULT review before the queue.

Generated by Claude Code

domain:ui#4 · os-sales · session_01L6bhgWqjXeTcS3jtug46Dv
os-dev-report

Card thread session_01L6bhgXdweWzW44zdh5YEjY, report at 2026-10-31T13:19Z.

{
  "issue": 28148,
  "status": "done",
  "branch": "claude/project-thread-krgxy0",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/28420",
  "session": "session_01L6bhgXdweWzW44zdh5YEjY",
  "premise_still_valid": true,
  "summary": "Resumed claude/project-thread-dhj1ou@1a9e7703 (merged, treated as unverified) and cut it to N-04 per ruling 6542841890: FlowCloneDialog, the Clone menu entry, the shared clone request and the engine.studio.auto.clone.* keys are dropped; FlowItemMoreMenu.tsx and the Delete test are byte-identical to main; Setup keeps its own clone request and shares only requestFlowToggle (packagedFlowLedger.ts). On a read-only package's open flow with a _status row, the header switch binds the activation ledger (GET _status, POST toggle) in activationReading's three readings: on / on but not running here (muted, platform reason as sent) / off; the rail state now keeps unboundCause. Walled posture + non-operator reads disabled with the console's sentence from features.tenancyPosture and user.isPlatformAdmin (not walledCatalogReadOnly); refusals verbatim. A writable package's flow is unchanged.",
  "tests": "head b328333c (after one merge of origin/main 3fb1a245; closure rebuilt 64/64). New AutomationsPillar.ledgerSwitch-28148.test.tsx: 8/8 passed. Red on main (StudioDesignSurface.tsx at origin/main, blob 025415ee, restored to HEAD blob 05b1c07f): 7 failed | 1 passed (the writable CONTROL passes, as it should). vitest packages/app-shell/src/views/studio-design/ + views/setup/ + packages/i18n/: Test Files 386 passed (386), Tests 3573 passed | 13 skipped (VERDICT command-exit 0). Ablations via ablation-replace on committed 6d9de753 (anchor 1 -> 0, each restored blob == HEAD): A1 checked from the definition -> 4 failed; A2 two-way reading -> 1 failed; A3 walled pre-judge returns false -> 1 failed; A4 refusal uses fallback not actionErrorDetail -> 1 failed; A5 ledger row without readOnly -> 1 failed (first A5 attempt was a refused no-op, replacement was a substring of the anchor; re-run with a distinct replacement).",
  "gates": "type-check @object-ui/app-shell and @object-ui/i18n (tsc --noEmit + tsconfig.test.json) VERDICT command-exit 0 on b328333c; eslint on changed files 0 errors (22 warnings, none on changed lines); dispatch-gates --commands 34 derived, all exit 0 on b328333c; --ran: 34 derived, 34 run, 0 NOT-MEASURED (derived zero); check-sdui-manifest exit 0; no open PR touches the file surface; merge-tree vs origin/main clean. CI check-runs: in_progress at report time.",
  "line_budget": "8 files, +622 / -48 vs merge base (under 3000)",
  "files_changed": [".changeset/28148-studio-flow-ledger-switch.md", "ui/packages/app-shell/src/views/setup/PackagedAutomationPage.tsx", "ui/packages/app-shell/src/views/setup/packagedFlowLedger.ts", "ui/packages/app-shell/src/views/studio-design/AutomationsPillar.ledgerSwitch-28148.test.tsx", "ui/packages/app-shell/src/views/studio-design/FlowLedgerSwitch.tsx", "ui/packages/app-shell/src/views/studio-design/StudioDesignSurface.tsx", "ui/packages/i18n/src/namespaces/studio/en.ts", "ui/packages/i18n/src/namespaces/studio/zh.ts"],
  "deviations": "1) New key engine.studio.auto.ledger.notRunning beyond the inherited block, for the card's third reading (en, zh). 2) Card item 3: the read-only hint leaves the switch wherever the ledger switch is drawn; with no _status row the read-only definition switch and its hint stay as on main (nothing to bind); in the PR's Acceptance notes. 3) The PR body's attribution line links this card thread's project thread, as the harness requires, not the seat thread the order names. 4) The inherited WIP commits carry the earlier card thread's session trailer; history not rewritten.",
  "dogfood_battery": "n/a — no ! in the PR title and no (narrowing) arm",
  "mcp_calls": "5 — mcp__github__issue_read (get, get_comments), mcp__github__list_pull_requests, mcp__github__pull_request_read (get), mcp__claude-code-remote__subscribe_pr_activity (PR 28420); no GitHub MCP write tool",
  "api_writes": "2 — fleet-write relay pr_create (POST /repos/objectstack-ai/objectstack/dispatches, run 41204791371 -> #28420, body read back identical); this os-dev-report comment via post-stamped",
  "open_questions": [],
  "out_of_scope_findings": []
}

domain:ui#4 · os-sales · session_01L6bhgWqjXeTcS3jtug46Dv

ACCEPT → PR #28420 comment 6543912972 (head b328333c, 2026-10-31T13:22Z), with the in-seat TIER_DEFAULT Clause-② review PASS in the same record. Lands on all-green via the merge queue.

Generated by Claude Code

domain:ui#4 · os-sales · session_01L6bhgWqjXeTcS3jtug46Dv

Landed · 2026-10-31T13:51Z · PR #28420 merged through the merge queue as 86dc686f at 2026-10-31T13:49Z (first pass, no kick). Fixes #28148 closed the card as completed. pm:dispatched is removed in this same stroke.

probe on `ui/`	before (`86dc686f~1`)	now (`origin/main`)
`requestFlowToggle` in `setup/packagedFlowLedger.ts`	absent	1
`<FlowLedgerSwitch` in `StudioDesignSurface.tsx`	0	1
`auto.ledger.` rows in studio `zh.ts`	0	9

The record stands as ACCEPT 6543912972, with the in-seat TIER_DEFAULT Clause-② review PASS. Clone stays with #28149 (N-21), per ruling 6542841890.

Generated by Claude Code

Navigation Menu

Repository navigation

Studio: switch a read-only package's flow off for this deployment from the Automations pillar — ledger switch on the item, posture-aware, refusal verbatim #28148

7 remaining items

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Studio: switch a read-only package's flow off for this deployment from the Automations pillar — ledger switch on the item, posture-aware, refusal verbatim #28148

Description

Activity

objectstack-fleet commented on Oct 30, 2026

objectstack-fleet commented on Oct 30, 2026

objectstack-fleet commented on Oct 30, 2026

objectstack-fleet commented on Oct 30, 2026

7 remaining items

objectstack-fleet commented on Oct 31, 2026

objectstack-fleet commented on Oct 31, 2026

objectstack-fleet commented on Oct 31, 2026

objectstack-fleet commented on Oct 31, 2026

objectstack-fleet commented on Oct 31, 2026

objectstack-fleet commented on Oct 31, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions