Form section/field `visibleWhen` binds no `current_user` — position-gated visibility works on pages and per-option rules, but silently fail-opens on form fields

[os-zhuang]

Rebuilt from objectstack-ai/objectstack#11411 by the triage seat (file-at-destination — the code half lands in this repo; the transfer API is unavailable to agent seats, so this is the documented rebuild channel; the source card is closed as moved). Originally measured by session session_015ahemw8RcTgqtxrj15PEZx while implementing objectstack-ai/objectstack#11034, on objectstack origin/main @ 365e334 with objectui at its then-current checkout. Re-verify every line reference before editing.

The asymmetry

current_user reaches some visibleWhen sites and not others:

Site	current_user bound?	Evidence
Page component, app/nav visible	yes	packages/app-shell/src/providers/ExpressionProvider.tsx:59,70 builds { current_user: user, user, ctx: { user }, os: { user }, app, data, features }
Per-option visibleWhen (select options)	yes	packages/core/src/evaluator/optionRules.ts:103 forwards scope; resolveCascadingOptions(…, predicateScope) in packages/components/src/renderers/form/form.tsx:1428,2129
Form section / field visibleWhen	no	all three resolveFieldRuleState call sites — form.tsx:1201, :1237, :1935 — pass undefined for the scope parameter; predicateScope is read at :1276 and used only for resolveCascadingOptions

evalFieldPredicate (packages/core/src/evaluator/fieldRules.ts:158) binds { record, previous, extra: scope }, so with scope === undefined a form field's predicate sees record and previous and nothing else.

Why it matters

1. Silent and fail-open in the dangerous direction. A visibleWhen naming an unbound root does not hide the element — resolveFieldRuleState passes true as the visibility fallback, so a gate that faults shows the field to everyone. Same failure shape as objectstack#11034, one layer over.
2. The docs taught the broken pattern until objectstack#11034's PR split the binding-table row; the generated reference (field.mdx:333) already recorded the asymmetry.

Triage direction anchor (graded, not ruled here)

ADR-0068 D1's stated goal — "a predicate authored against any one form evaluates identically" — is the declared contract this asymmetry violates, and the fix is small and local: pass predicateScope (already in hand at form.tsx:1276) as the scope argument to the three resolveFieldRuleState calls, exactly as resolveCascadingOptions already receives it. Graded Bug on that basis: declared≠enforced restoration, not new surface.

Constraints for the implementing dev:

• Premise-first stop: if you find a recorded ruling that form-field predicates deliberately exclude current_user (the record-purity/per-keystroke-cost design story the source card sketches), stop and report a fork — ⛔ do not pick a side silently.
• Behaviour-change honesty: predicates that today fault-open on form fields will begin evaluating, and any resolving FALSE will start hiding fields that are currently visible. That is the correctness restoration, but it must be loud: changeset names the change; add a pin per binding surface so the three-site parity cannot silently regress.
• Cross-repo docs follow-up (联动杂事): objectstack's content/docs/protocol/objectui/layout-dsl.mdx binding table was just split (#11034) to document today's asymmetry. When this lands, that row is wrong again in the other direction — the accepting seat files the follow-up docs card in objectstack at landing time (with Blocked-by: this card), ⛔ not as a rider on this PR.

Not a duplicate of

• objectstack#11258 → this repo's Three gaps in the visibleWhen gate found by census: one authored-node bypass, a second evaluator with an opposite data binding, and total silence on fault in production #5926 (three other visibleWhen gaps: emptyAction bypass, second evaluator, silence on fault) — different sites; none is the form-field scope argument.
• objectstack#11256 (spec describe under-names page-layer roots — the layer where the roots are bound).

[yinlianghui]

Claim: PM loop round 38 (refill slot)
Session: session_01CSoz9uGhaaSgiq3hshtN7L
Branch: claude/issue-6010-form-field-predicate-scope
Worktree: objectui-issue-6010
Domain: domain:ui
File surface: packages/components/src/renderers/form/form.tsx (the three resolveFieldRuleState call sites) + pins + a changeset. packages/core/src/evaluator/{fieldRules,optionRules}.ts and packages/app-shell/src/providers/ExpressionProvider.tsx are read-only here.
Container & model: M, mode:subagent, model: opus
Clause-②: borderline — declare what you find. No declaration moves and no surface widens; but a predicate that today faults open begins evaluating, so the accept/reject behaviour a host observes changes. Treat it as declared and say so in the report.
Serial constraints cleared: packages/components/** — no in-flight claim. Concurrent siblings: #5927 (packages/types/src/zod/**), #5565 (apps/console + a seam in packages/app-shell), #5835 (packages/app-shell/src/views/RecordDetailView.tsx), #5856 (examples/schema-catalog/** + content/docs/plugins/**). Disjoint by full path.

裁决 — the grade is in the card body, and it is a Bug

Triage seat, 2026-08-24, rebuilt from objectstack#11411 through the documented file-at-destination channel (the source card is closed as moved). Graded Bug on this basis, verbatim: "ADR-0068 D1's stated goal — 'a predicate authored against any one form evaluates identically' — is the declared contract this asymmetry violates … declared≠enforced restoration, not new surface."

The measured asymmetry (⚠️ re-verify every line reference before editing — the card says so itself):

Site	current_user bound?	Evidence
Page component, app/nav visible	yes	packages/app-shell/src/providers/ExpressionProvider.tsx:59,70
Per-option visibleWhen	yes	packages/core/src/evaluator/optionRules.ts:103 forwards scope; resolveCascadingOptions(…, predicateScope) at form.tsx:1428,2129
Form section / field visibleWhen	no	all three resolveFieldRuleState call sites — form.tsx:1201, :1237, :1935 — pass undefined for scope; predicateScope is read at :1276 and used only for resolveCascadingOptions

evalFieldPredicate (packages/core/src/evaluator/fieldRules.ts:158) binds { record, previous, extra: scope }, so with scope === undefined a form field's predicate sees record and previous and nothing else.

The indicated fix is small and local: pass predicateScope — already in hand at form.tsx:1276 — as the scope argument to the three resolveFieldRuleState calls, exactly as resolveCascadingOptions already receives it.

⛔ Premise-first STOP condition — carried verbatim from the card

if you find a recorded ruling that form-field predicates deliberately exclude current_user (the record-purity / per-keystroke-cost design story the source card sketches), stop and report a fork — ⛔ do not pick a side silently.

⚠️ Take this seriously and search for it before writing code: ADR-0068, the fieldRules / optionRules history, and the objectstack cards this one descends from (#11034, #11411, and #11258 → this repo's #5926). "Record purity" is a coherent design position — a field predicate that reads only the record re-evaluates cheaply per keystroke and is referentially transparent. If someone ruled that deliberately, this card is a fork for the maintainer, not a fix. ⛔ Do not resolve it yourself in either direction.

⚠️ This fix CHANGES USER-VISIBLE BEHAVIOUR, and it must be loud

Carried verbatim: "predicates that today fault-open on form fields will begin evaluating, and any resolving FALSE will start hiding fields that are currently visible. That is the correctness restoration, but it must be loud."

Note the direction: resolveFieldRuleState passes true as the visibility fallback, so a gate that faults today shows the field to everyone. That is the dangerous direction, and it is why this is graded a Bug rather than an enhancement — but it also means a host who authored a visibleWhen naming current_user, saw the field render, and concluded the rule was permissive will now see it hide. Required:

• The changeset names the change in those terms — not "binds current_user", but "predicates that silently failed open now evaluate, and a rule resolving false now hides the field".
• A pin per binding surface, so the three-site parity cannot silently regress. ✅ That is the deliverable that outlives the one-line fix: the defect exists because two of three surfaces got scope and one did not, and only a parity pin makes the next divergence loud.

⛔ Not a rider — the cross-repo docs follow-up is the PM's, not yours

Carried verbatim: "objectstack's content/docs/protocol/objectui/layout-dsl.mdx binding table was just split (#11034) to document today's asymmetry. When this lands, that row is wrong again in the other direction — the accepting seat files the follow-up docs card in objectstack at landing time (with Blocked-by: this card), ⛔ not as a rider on this PR."

✅ This seat has taken that obligation and will file the objectstack card when your PR lands. ⛔ Do not touch objectstack, and ⛔ do not edit that binding table from here.

PM mechanism assumptions — measure, do not assume

1. Every line reference in the card is from an objectstack checkout of unknown vintage (origin/main @ 365e334 on the other repo, with objectui "at its then-current checkout"). The card itself says re-verify each one. ⛔ Do not work from the table — re-derive all six references (form.tsx:1201/:1237/:1276/:1428/:1935/:2129, fieldRules.ts:158, optionRules.ts:103, ExpressionProvider.tsx:59,70) on your merge-base and report the delta.
2. ⚠️ "Pass predicateScope to the three calls" is the card's hypothesis, not a measurement. Verify that predicateScope at :1276 is actually in scope at all three call sites and carries the same shape resolveCascadingOptions consumes. If one of the three sits outside that binding, ⛔ stop and report — a fix that lands on two of three sites re-creates this exact defect at a smaller scale.
3. resolveFieldRuleState's true visibility fallback is load-bearing to the severity claim. Confirm it in that function's own source. If it actually fails closed, the card's whole "silent and fail-open in the dangerous direction" framing inverts and you should say so before fixing anything.
4. ⚠️ Three gaps in the visibleWhen gate found by census: one authored-node bypass, a second evaluator with an opposite data binding, and total silence on fault in production #5926 is the sibling card and is NOT this one (emptyAction bypass, a second evaluator with an opposite data binding, total silence on fault). ⛔ Do not fold it in. If your work touches a site Three gaps in the visibleWhen gate found by census: one authored-node bypass, a second evaluator with an opposite data binding, and total silence on fault in production #5926 names, report the overlap rather than absorbing it.

Verification

The pin is the deliverable; the one-line fix is not. Pin all three binding surfaces — page/app-nav, per-option, and form section/field — against the same authored predicate, asserting they evaluate identically. That is ADR-0068 D1's stated contract, and a pin on one surface cannot express it.

Direction predicted before running: revert the scope argument on one of the three call sites and show the parity pin goes red naming that surface. Counter-probe required, and it is the important half: a predicate that resolves true must still render the field on all three surfaces — otherwise "the predicate is now evaluated" is satisfiable by hiding everything, which is a worse bug than fail-open and is invisible to the positive assertion alone. Add the fault case too: a predicate naming a genuinely unbound root must still be shown to fail-open (that is existing behaviour this card does not change) — so the pin distinguishes "evaluated and false" from "faulted".

Prove every mutation on disk by grepping the injected text and separately the removed text (an editor's exit code proves nothing on a zero-hit anchor). ⚠️ Print the landing site of each mutation rather than assuming it — a mis-anchored mutation that still moves the number is the worst species of false green, measured on #4730 in this very round. Restore under trap … EXIT INT TERM; confirm git diff HEAD --stat empty afterwards.

Gates by name with exit codes: pnpm --filter @object-ui/components type-check (⚠️ hyphenated type-check; echo the script name so a zero-match silent pass cannot read as green — and a first RED reading Cannot find module @object-ui/... is the unbuilt-closure signature, not a real failure), root-form vitest over the form renderer's suites and packages/core/src/evaluator (⚠️ this repo's vitest guard refuses the --filter forms — use pnpm exec vitest run <paths> from the repo root), and eslint on changed files with the merge-base delta stated. ⚠️ This repo's eslint spelling is a plain eslint . per package — ⛔ do not add --no-inline-config; it disables legitimate inline disables and manufactures phantom errors (measured twice today, on #5605 and #4730).

Changeset required. Draft PR, Fixes #6010. ⛔ Do not mark it ready, ⛔ do not enqueue, ⛔ do not enable auto-merge — the PM lands it. Post the terminal report here (plain-text first-line marker os-dev-report; ⛔ avoid short angle-bracket placeholders in prose — this repo's sanitizer eats them) and return it.

---

Generated by Claude Code

[yinlianghui]

os-dev-report

{
 "issue": 6010,
 "status": "done",
 "branch": "claude/issue-6010-form-field-predicate-scope",
 "pr": "https://github.com/objectstack-ai/objectui/pull/6037",
 "premise_still_valid": true,
 "summary": "PREMISE-FIRST STOP NOT TRIGGERED — no recorded ruling that form-field predicates deliberately exclude current_user exists, and the search turned up a ruling in the OPPOSITE direction. Searched: ADR-0068 D1 (states the identical-evaluation goal), ADR-0089 D1 which rules verbatim 'runtime record surfaces bind record + current_user; metadata-editing forms bind data', the full fieldRules.ts / optionRules.ts docstrings (their only recorded carve-outs are the readonlyWhen fail-open/fail-closed asymmetry, objectstack#4889/#4977 — nothing about scope exclusion), git history (shallow, 74 commits — noted as a limit), objectstack's layout-dsl.mdx and views.mdx (descriptive documentation of the measured behaviour added by #11034, not a decision), and GitHub issue search in both repos. objectstack#11411 itself labels the record-purity story a hypothesis ('There is a defensible design story'), not a ruling. FIX: all five AUTHORED-predicate call sites in form.tsx now receive predicateScope — the three resolveFieldRuleState calls plus the two visibleOn evalFieldPredicate calls (declared bounded in-place fix, see below). The synthesised legacy condition:{field,equals} predicate keeps undefined, documented in place: it can only ever name record.<field>. PM MECHANISM ASSUMPTION 2 IS THE LOAD-BEARING DELTA — 'pass the predicateScope already in hand at :1276' does NOT hold as written for call site 1. That site sits inside the readonlyFieldNames useMemo whose factory runs SYNCHRONOUSLY during render, ~75 lines above the hook's declaration, so reading predicateScope there is a temporal-dead-zone ReferenceError on first render, not a missing binding. Resolved by hoisting const predicateScope = usePredicateScope() above readonlyFieldNames — still unconditional, still once per render, only its position among this component's hooks moved. All three sites then land together; nothing was left at two of three. ASSUMPTION 3 CONFIRMED, framing stands: resolveFieldRuleState passes literal true as the visibility fallback (evalFieldPredicate(rules.visibleWhen, record, true, previous, scope, ...)) — it fails OPEN, so a faulting gate shows the field to everyone. ASSUMPTION 4: no overlap with #5926 — its three sites (data-table emptyAction direct-registry render, containers.tsx page:tabs second evaluator, SchemaRenderer's !__DEV__ diagnostic short-circuit) are disjoint from every line this PR touches. CLAUSE-② DECLARED: no declaration moves and no surface widens, but a predicate that today faults open begins evaluating, so the accept/reject behaviour a host observes changes — treating it as declared, and the changeset says so in the required terms ('predicates that silently failed open now evaluate, and a rule resolving false now hides the field'), marked minor on @object-ui/components. Did not touch objectstack and did not edit the layout-dsl binding table.",
 "tests": "All gates green, measured on 5f7796c44 (type-check and vitest ran on the working tree that became this commit byte-for-byte; eslint after it). (1) DEPENDENCY CLOSURE FIRST: pnpm --filter '@object-ui/components^...' build -> BUILD_CLOSURE_EXIT=0. (2) pnpm --filter @object-ui/components type-check -> the run echoed its own script name and body, '> @object-ui/components@17.6.0 type-check' then 'tsc --noEmit && tsc -p tsconfig.test.json', so this is not a zero-match silent pass; TYPECHECK_EXIT=0. (3) pnpm exec vitest run packages/components/src/renderers/form packages/core/src/evaluator --maxWorkers=2 -> vitest's own summary lines 'Test Files 65 passed (65)' and 'Tests 725 passed (725)'; VITEST_EXIT=0. The new parity file contributes 15 of those. (4) eslint: run over the WHOLE package, not narrowed — cd packages/components && npx eslint . (plain, NO --no-inline-config) -> 398 files linted, errors: 0, 908 warnings, ESLINT_PKG_AFTER_EXIT=0. form.tsx carried 60 warnings BEFORE this change and 60 AFTER with an identical rule breakdown (no-explicit-any 51, react-refresh/only-export-components 7, no-unused-vars 2), measured by writing the base content to the SAME path so config resolution is identical; zero new findings. Every exit code captured with redirect-then-capture or a tee'd echo, never after a pipe. REVERSE VERIFICATION, direction predicted BEFORE running and written into the pin's docstring first: reverting the scope argument on ONE of the three call sites (the render-path one in renderFormField) should turn red exactly the DENIED rows for 'form SECTION visibleWhen' and 'form FIELD visibleWhen', in the SHOWN direction (fail-open), leaving 'form FIELD visibleOn' green because it is a different call, and leaving page, per-option, and every ALLOWED and FAULTED row green. MEASURED: 'Tests 2 failed | 13 passed (15)', both failures 'AssertionError: expected true to be false', on exactly those two rows — prediction matched on count, identity and direction. MUTATION PROVEN ON DISK, LANDING SITE PRINTED NOT ASSUMED: pre-mutation grep -c of the injected marker = 0 and grep -n of the removed text printed its one candidate at line 1990; post-mutation grep -n printed the injected text at line 1990 with two lines of context, injected count = 1 and removed-text count = 0 (was 1), with a hard abort if either reading disagreed. Restore ran under trap '<restore>' EXIT INT TERM: marker count back to 0, removed text back to 1, and git diff HEAD --stat empty. No dist/build was involved — this repo's vitest aliases @object-ui/* to src, so the mutation reached the code under test directly; that is stated rather than assumed. All heavy runs were serialised through the shared verify lock (waits of 383s, 22s, 34s, 0s, 0s).",
 "open_questions": [],
 "out_of_scope_findings": [
 "NOT FILED, ROUTED TO THE PM INSTEAD (I am fenced out of objectstack and the PM already owns a follow-up on this exact page): the docs row that goes wrong in the other direction when this lands exists in TWO objectstack files, not one. The dispatch names content/docs/protocol/objectui/layout-dsl.mdx (binding table at :831-832 plus the prose at :866, 'current_user is not bound on form sections and form fields'). content/docs/ui/views.mdx:433 carries the same claim independently: 'runtime forms bind record (+ previous, parent) — not current_user, which is unbound at field level and would fault the predicate open'. Both need the same correction; filing one card that names only layout-dsl.mdx would leave the second live.",
 "NOT FILED, recorded as measured behaviour rather than a defect: a BARE-STRING visibleWhen carrying the CEL membership operator is not portable across the surfaces, for a reason unrelated to scope. The form renderer treats a bare string as CEL (fieldRules.ts toExpression defaults dialect to 'cel'), while SchemaRenderer's evaluateCondition routes bare strings to the LEGACY JS evaluator, which has no `in` operator and rejects it — measured verbatim: 'Unexpected token \"i\" at position 16' — then fails open. This is DELIBERATE and documented in ExpressionEvaluator.evaluateCondition (#2661: 'Bare strings and ${…} templates stay on the legacy path (back-compat deprecation window); only an explicit { dialect: 'cel' } envelope is rerouted'), and spec parse emits the CEL envelope for authored metadata, so production is unaffected. It caught my first pin run and is why the pin authors its predicate in the canonical { dialect: 'cel', source } envelope — recorded in the pin's docstring so nobody later reads that choice as papering over a scope difference. The residual authoring trap is a DOCS one and lands in the same objectstack pages as the finding above: layout-dsl.mdx:862-863 shows exactly that bare string on a PageComponent / app-nav entry, which faults open for hand-authored SDUI that does not go through spec parse. Routed to the PM with the item above rather than split into a card of its own."
 ]
}

---

Generated by Claude Code

[yinlianghui]

Errata on the report above — not a second report, and the os-dev-report comment stands as the authoritative one.

The comment sanitizer ate two short angle-bracket fragments after the comment landed, exactly as the dispatch warned. Both are cosmetic; recording the intended text so nothing reads as a gap:

1. In summary, "it can only ever name record.." was written as: it can only ever name a record dot field reference — i.e. the synthesised legacy condition predicate is generated from a structured object and cannot name any other root.
2. In tests, "Restore ran under trap '' EXIT INT TERM" was written with the restore function named inside the quotes: the trap was trap on a restore function, for EXIT INT TERM.

The same casualty hit the PR body once ("can only ever name record.") and has been repaired there in place. The direct comments API is 403 from this seat, so the report comment itself could not be patched.

---

Generated by Claude Code