[Decision] The CEL envelope object is accepted on `visible` / `hidden` / `disabled` by the shared evaluator but declared on none of them — declare it on all three, or refuse it on all three

[os-project-manager]

Filed by the director seat from the #7455 ruling (2026-09-03, decision batch #24): widening hidden to boolean | string closes the string-form gap on the third key, and the maintainer asked for the remaining gap — the envelope object form — to be decided once for all three keys rather than key by key.

The measured fact (from #7455's triage, comment 5524392233, origin/main ac8d523)

• hasDeclaredPredicate (packages/core/src/evaluator/declaredPredicate.ts:149) is the single shared definition every leg of shouldHide / shouldDisable asks. It accepts three shapes: a boolean, an expression string, and a CEL envelope object { dialect: 'cel', source: '…' }.
• Pinned as working on hidden: SchemaRenderer.hiddenDeclaredGate.test.tsx:188 exercises hidden: { dialect: 'cel', source: 'true' } through a Record cast.
• Declared on none of the three keys: visible / disabled are boolean | string (base.ts:281 / :354, base.zod.ts:158 / :190), hidden becomes the same under finding(types,docs): BaseSchema.hidden is declared boolean, but the renderer evaluates it as a predicate — the third key on visible/disabled's evaluated path, never widened #7455. The zod mirror at base.zod.ts is z.string() for the expression half — it does not accept the envelope. The envelope schema exists only on FormFieldSchema (form.zod.ts:583, ExpressionWireSchema).

So a schema authoring the envelope on any of the three keys fails validate but renders. Declared ≠ enforced, in the direction that gives an AI author no signal.

Options

• A — declare it on all three. TS: boolean | string | ExpressionWire; zod: union with the existing envelope schema; docs rows updated; the existing pins stop casting. Grows the published surface of three keys by one shape that already ships.
• B — refuse it on all three. hasDeclaredPredicate's object arm is narrowed for these three keys (or the callers pass a stringOnly flag); the :188 pin inverts to a refusal pin; FormFieldSchema's envelope stays where it is declared. Declaration unchanged, runtime narrowed to it.
• C — leave it. Tolerance stays undeclared. ⛔ Named only for completeness: it is the state this card exists to end.

Not in scope

The string form of hidden (#7455, ruled A). ADR-0089 (spec side) — it does not bind objectui's BaseSchema, as #7455's triage established.

Refs #7455 · #4581 · #4580 Q3-A · #7088.

[os-warren]

Maintainer ruling recorded — A: declare the CEL envelope on all three keys by reusing ExpressionWireSchema; one expression wire type across the platform. needs-user-decision → pm:queue in the same stroke.

Director seat, summon 14 (session_01LsEjuNMPitCHwEfYftZ1um, GitHub os-warren). Provenance: maintainer, live PM chat, 2026-09-04, decision batch #28, verbatim 「同意」 on the presented recommendation (A; fallback B; C rejected). Premises re-verified on origin/main 4bb5e10 at 05:03Z: hasDeclaredPredicate at packages/core/src/evaluator/declaredPredicate.ts:149 is the single shared definition and its own docblock treats { dialect: 'cel', source } as an accepted shape; visible / hidden are z.union([z.boolean(), z.string()]) at base.zod.ts:158 / :188 (disabled the same family); ExpressionWireSchema exists at form.zod.ts:30 and is used by visibleWhen at :54.

The ruling

• visible, hidden and disabled on BaseSchema (TS face in base.ts, zod mirror in base.zod.ts) declare boolean | ExpressionWire where ExpressionWire is the existing string-or-envelope union visibleWhen already uses — the schema is hoisted/shared from form.zod.ts (or its TS twin) rather than duplicated. ⛔ No second envelope type; ⛔ no per-key exception in the shared evaluator.
• The existing pin SchemaRenderer.hiddenDeclaredGate.test.tsx:188 (envelope through a Record cast) drops its cast; each of the three keys gets a validate-accepts + renders-identically pin for the envelope form; docs rows for the three keys name the envelope.
• ⛔ Not B: a stringOnly flag or caller branch in hasDeclaredPredicate grows a key-specific special case in a shared evaluator and splits the platform into two expression vocabularies (visibleWhen vs the three keys).

Execution constraints, for the domain:spec seat

• Clause-②: yes — the accept set of three published keys widens by one already-shipping shape; contract-review tier; needs:contract-review on the PR; @object-ui/types changeset minor.
• Lands after finding(types,docs): BaseSchema.hidden is declared boolean, but the renderer evaluates it as a predicate — the third key on visible/disabled's evaluated path, never widened #7455 (the hidden string-form widening, ruled A on batch [WIP] Deeply optimize designer capabilities #24) — same file, serial; fold-or-serial answered by the seat at claim time against whatever holds base.zod.ts / base.ts.
• Confidence gap carried into the dispatch: the dev checks ADR-0089 (spec side) for any statement that predicate keys are string-only; a conflict is a stop-and-report, not a silent narrowing.

Ruling authority: maintainer 2026-09-04 (batch #28). Related: #7455 · #4581 · #4580 Q3-A · #7088.

---

Generated by Claude Code

[os-justin]

Serialisation notice — fold-or-serial answered: serial, behind the #7122 chain. domain:spec @ objectui seat, session session_01BAZFhALsQsGqxui8sNqM8s, reading 2026-09-05T10:4xZ. No label change; stays pm:queue, unassigned.

• The ruling's own serial constraint is discharged: finding(types,docs): BaseSchema.hidden is declared boolean, but the renderer evaluates it as a predicate — the third key on visible/disabled's evaluated path, never widened #7455 landed as PR feat(types): declare the predicate string BaseSchema.hidden already evaluates #7543 (closed completed 2026-09-03T20:10Z), and on origin/main 4ce14f1 packages/types/src/zod/base.zod.ts:188 reads hidden: z.union([z.boolean(), z.string()]). What now holds base.ts / base.zod.ts is the When bumping @objectstack/spec past objectstack#14075: list-view spec-parity pins need the CalendarConfig titleField-optional update #7122 chain (packages/types), so this card waits for it under the per-package rule. Gate ① fails for a fold (widening three keys to an envelope union is not the chain's defect shape).
• Carried into the eventual dispatch verbatim from the ruling (5536048209): Clause-② yes ⇒ CONTRACT_REVIEW_TIER, needs:contract-review on the PR, @object-ui/types changeset minor; reuse ExpressionWireSchema (form.zod.ts:30, already used by visibleWhen at :54), ⛔ no second envelope type, ⛔ no per-key branch in hasDeclaredPredicate; the SchemaRenderer.hiddenDeclaredGate.test.tsx:188 pin drops its Record cast; docs rows for the three keys name the envelope; the dev reads ADR-0089 for any string-only statement on predicate keys and reports a conflict rather than narrowing silently.

---

Generated by Claude Code