L5: Setup page "packaged automation" — on/off + clone actions for packaged flows (ADR-0126 §7.4)

[os-support-ai]

Part of objectstack-ai/objectstack#12150 (Epic: ADR-0126 implementation, v17 line — 17.x minor, maintainer-ruled).
Blocked-by: objectstack-ai/objectstack#12155
Blocked-by: objectstack-ai/objectstack#12157
Blocked-by: objectstack-ai/objectstack#12156
Dispatch: coordinated under the objectstack#12150 program — ⛔ not from the general queue; the program dispatches on unlock (maintainer anti-preemption instruction, 2026-08-25, PM session session_01KWRU3s15AJz7PGW7a7wdCh). Contract: ADR-0126 §7.4 + §9 (objectstack, merged 28b47a93; Fork D → D2 settled by the merge).

Deliverable

A new Setup page for packaged automation — automation UI is Studio-only today (studio.app.ts:234-239), so this page is new work; the Setup permission-set page is the precedent shape (contributed the way nav_permission_sets is, security-plugin.ts:974). Studio keeps the editing; Setup gets the operational state.

Per packaged flow, the page shows and does exactly:

• on/off for this scope (reads the sys_metadata_activation state; flip invokes the L2 action) — that is all the ledger knows; the page claims nothing more;
• clone (invokes the L4 action; new-name prompt; carried-over definition blobs are ⛔ not editable form fields — the #11753 discipline);
• ⛔ no drift or ancestry surface: no diff-vs-base, no "customized" badge, no base-moved notice (ADR §9) — cloned-without-disabled and disabled-without-clone are ordinary states shown plainly.

Acceptance

• Page reachable in Setup with the nav-contribution mechanism (not a Studio tab);
• disable/enable round-trip visible; refusals (operator gate, subflow guard) surface the server's message verbatim — no client-side softening;
• clone flow completes with the new name; no ancestry shown anywhere.

Refs: ADR-0126 §7.4, §9 · #11753 · Setup permission-set page precedent

[os-support-ai]

Claim: maintainer direct-dispatch (objectstack#12150 program; standing autonomy ruling 「继续自主完成所有开发」). Unblocked — all three Blocked-by legs are merged on objectstack main: L1 ledger 428f9b24, L4 clone c68c6708, L2 disable write path 15249270 (PR objectstack#12296).
Session: session_01KWRU3s15AJz7PGW7a7wdCh
Branch: claude/issue-6301-packaged-automation-setup-page (this repo)
Domain: domain:ui
File surface: the new Setup "packaged automation" page + its nav contribution (+tests); ⛔ no framework-repo changes, no drift/ancestry UI, no client-side softening of server refusals
Container & model: mode:subagent, model: opus
Clause-②: no — UI consuming landed server contracts (POST /automation/:name/toggle, POST /automation/:name/clone, flow runtime states); no accept/reject behavior changes
Serial constraints: none known in this repo; the server surfaces consumed are merged and stable

---

Generated by Claude Code

[os-support-ai]

os-dev-report

{
 "issue": 6301,
 "status": "done",
 "branch": "claude/issue-6301-packaged-automation-setup-page",
 "pr": "https://github.com/objectstack-ai/objectui/pull/6382",
 "premise_still_valid": true,
 "summary": "New Setup page 'Packaged automation' in @object-ui/app-shell (views/setup/PackagedAutomationPage.tsx + packagedFlows.ts), contributed by component ref 'automation:packaged' from services/builtinComponents — the same by-ref mechanism metadata:directory / metadata:resource / developer:packages use, so app navigation names the ref and ComponentNavView resolves it at /apps/APP/component/automation/packaged; no bespoke route added. Per packaged flow exactly two actions: on/off (reads GET /automation/_status, flips POST /automation/:name/toggle) and clone (POST /automation/:name/clone, mandatory new machine name + label, wire body exactly {name,label} — no definition blobs as form fields). All three server refusals (403 PERMISSION_DENIED posture gate, 409 DELETE_RESTRICTED subflow guard with its named callers, 409 clone name conflict) render verbatim via actionErrorDetail, fallback only when the response carried no message. No drift/ancestry surface anywhere, pinned including a response that smuggles clonedFrom/baseVersion. Scope test transcribes isCodeArtifactBody clause-for-clause rather than the _packageId shortcut, which would misread a tenant overlay bound to a package (cloud#970). Two follow-on commits: apiBase moved to a leaf utils/ module because the page is imported eagerly and the old home reaches the whole flow-designer canvas; and — after CI went red on my first push — the packagedAutomation key group added to en.ts plus real translations in all nine other packs, since inline defaultValue is explicitly not a fix (objectui#3517).",
 "tests": "All at merged head 082f466 (branch merged up to origin/main, plain merge, no rebase). Verdict lines quoted from each gate's own output, exit codes captured before any pipe.\n\n· node scripts/check-i18n-call-site-keys.mjs — exit 0: 'Every in-scope call-site key resolves against the en pack (2848 keys), every literal inline defaultValue matches the value the pack serves, every call site passes exactly the arguments that value has holes for, every inline defaultValue spells its placeholders the one way the provider-less fallback resolves'. (Was exit 1 with '24 call sites reference a key the en pack does not define (22 distinct)'.)\n· pnpm exec vitest run packages/i18n/ — exit 0: 'Test Files 55 passed (55) / Tests 910 passed (910)'.\n· pnpm exec vitest run packages/app-shell/src/views/setup/ — exit 0: 'Test Files 3 passed (3) / Tests 24 passed (24)'.\n· pnpm --filter @object-ui/i18n --filter @object-ui/app-shell type-check — exit 0, both 'tsc --noEmit && tsc -p tsconfig.test.json' Done.\n· check:i18n-keys / check:i18n-drift / check:i18n-dead-keys — exit 0; drift: '0 en value(s) changed (24 key(s) added, 0 removed)'.\n· eslint over the touched files, --format json — exit 0: 'files: 16 errors: 0 warnings: 0'.\n· check-changeset-presence — exit 0: '20 source file(s) of 2 released package(s) changed, and this change declares 1 changeset(s)'; check-changeset-no-major — exit 0.\n· Earlier at 7306a81: app-shell type-check exit 0, and vitest over views/setup/ + views/metadata-admin/previews/ + views/metadata-admin/inspectors/ (the page plus every importer of the moved apiBase) — exit 0, 'Test Files 103 passed (103) / Tests 1143 passed | 1 skipped (1144)'.\n\nReverse verification — no build/dist step is involved (vitest resolves these packages from source through the root alias table), so each leg is: mutate, PROVE the mutation reached disk with anchor greps on both the injected and the removed text, run, restore with `git checkout BRANCH -- PATH` against the committed fix, under a `trap ... EXIT INT TERM` that restores on any exit path.\n 1. isPackagedFlowItem loses the _provenance clause (injected marker 1, removed anchor 0) -> exit 1, 'Tests 3 failed | 21 passed', failures = the cloud#970 counterexample, the join case, and the rendered scoping case.\n 2. actionErrorDetail shadowed by a fallback-only softener (injected 1, original import spelling 0) -> exit 1, 'Tests 3 failed | 21 passed', failures = exactly the three verbatim-refusal tests.\n 3. clone result made to display the smuggled ancestry (injected 1, original notice line 0) -> exit 1, 'Tests 2 failed | 22 passed', failures = the no-ancestry test and the clone-success test.\n Leg 3's FIRST attempt was a no-op and is reported as such rather than as a result: a `perl -0pi -e s///` whose pattern contained `===` and `$` failed to compile ('syntax error at -e line 1'), the file was untouched, and the run came back exit 0 / 24 passed. The anchor greps caught it (injected 0, removed 1 — i.e. unchanged), so that green was discarded and the leg redone with a literal node replace that exits 9 on an anchor miss. Restore proof after all legs: 'ABLATED markers left: ...:0 ...:0' and an empty `git status` for both files.\n\nDeclared narrowing: the full 533-file packages/app-shell/ suite was started but held the shared verify lock 15 minutes with another agent queued behind it and emitted no per-file progress, so it was stopped by its own PIDs — NOT by name: five other vitest processes matching the same pattern were running from the shared /home/user/objectui checkout and a pkill -f would have killed other agents' runs — and replaced with the targeted runs above. CI runs the full farm. check:eager-closure is not reported: it requires a built apps/console/dist/eager-closure.json and refuses locally as a broken gauge rather than reporting a false pass; it is the gate commit 7306a81 exists to keep honest.",
 "open_questions": [],
 "out_of_scope_findings": []
}

(Marker note: this comment originally opened with the HTML-comment form of the os-dev-report marker. GitHub's body sanitizer removed it on write — the documented hazard — so the marker is restated as literal text on the first line, which survives.)

---

Generated by Claude Code