S161E — Layer 3 + Layer 4 Report

Agent: Claude Code (CLI) | Ngày: 2026-03-25 PRs: #615 (main feature), #616 (permission workaround), #617 (issue_type matching), #618 (limit fix), #619 (external URL + pagination) Status: Layer 3 WORKING. Layer 4 BLOCKED (Directus RBAC).

---

Deliverables

✅ Working:

Component	Status	Evidence
sub_class field in system_issues	✅ Created via Directus API	754/754 classified, 0 NULL
SQL classification	✅ 754 issues classified	orphan_dep_target=110, no_dependencies=606, etc.
API: /api/registry/system-issues-subgroups	✅ Working	Returns sub_class breakdown per issue_class
Layer 2 → Layer 3 navigation	✅ Labels link to Layer 3	NuxtLink added
Layer 3 page ([issue_class].vue)	✅ Created	Orange LAYER 3 badge, sub_class table
Layer 4 page ([issue_class]/[sub_class].vue)	✅ Created	Violet LAYER 4 badge

❌ Blocked:

Component	Status	Blocker
API: /api/registry/system-issues-detail	❌ 403 from Directus	Service token can't read system_issues ITEMS (only aggregates)
Layer 4 data rendering	❌ No data	Depends on detail API

Root Cause of Layer 4 Blocker:

The Directus service token (DIRECTUS_ADMIN_TOKEN) can execute:

• ✅ Aggregate queries (groupBy, count) on system_issues
• ✅ Meta queries (total_count) on system_issues
• ❌ Item-level reads (GET /items/system_issues?filter=...&fields=...&limit=N) → 403

This is a Directus RBAC configuration issue on the VPS Docker container. The service token role allows aggregates but blocks item reads for system_issues. Fix requires: VPS SSH → Directus admin panel → update permission for the service token role → add item-level read for system_issues.

---

sub_class Classification

issue_class	sub_class	Count
data_fault	no_dependencies	606
render_fault	orphan_dep_target	110
render_fault	stale_check	14
render_fault	orphan_dep_source	9
data_fault	missing_identifier	9
sync_fault	count_drift	2
render_fault	missing_registry_config	2
watchdog_fault	runner_liveness	1
contract_fault	cascade_failure	1
Total		754

---

VERIFY NUXT

VERIFY NUXT:
- Nuxt URL: /api/registry/system-issues-subgroups?issue_class=render_fault
  Hiện: 4 sub_groups (orphan_dep_target=110, stale_check=14, orphan_dep_source=9, missing_registry_config=2)
  PG: Identical. KHỚP.

- Nuxt URL: /api/registry/system-issues-subgroups?issue_class=data_fault
  Hiện: 2 sub_groups (no_dependencies=606, missing_identifier=9)
  PG: Identical. KHỚP.

- Nuxt URL: /api/registry/system-issues-detail?sub_class=orphan_dep_target
  Hiện: 403 Forbidden. BLOCKED — Directus RBAC item-level read.

- Invariant L1=L2=L3: 754 = 754 = 754. KHỚP.

---

Next Steps

1. Fix Directus RBAC on VPS: Add system_issues item-level read permission for service token role
2. After RBAC fix: Layer 4 detail API will work automatically (code already deployed)
3. Test Layer 4 page rendering end-to-end