P3D4C2U — Resume Notification Display — Execution Report

Date: 2026-05-10 | Rev: 4 (fresh run, prior rev3 BLOCKED baseline discarded) | Agent: claude-opus-4-7 (1M ctx) Phase: P3D4C2U_RESUME_NOTIFICATION_DISPLAY Result: PASS — notification display checkpoint UNBLOCKED

Executive summary

Preflight 12 gates: 10 hard PASS + 1 informational (0F generated map absent for draft, expected) + 1 optional (PG check skipped).
Mutation: table_registry id=21 (tbl_event_outbox / collection event_outbox) status draft → published via Directus Items API PATCH (no DOT publish tool exists for this op).
Side-effect verify: only status field changed; pre/post diff clean.
Post-mutation route smoke /knowledge/registries/event_outbox: HTTP 200, no real secret leak, no denylist field exposure, DirectusTable marker present, event_outbox token present.
Runtime field-level deny smoke (anonymous Public role, since perm #1483 role=null): safe allowlist → 200; safe_payload, correlation_id, causation_id, payload → 403.
No deploy / no restart / no build / no permission widening / no Nuxt code change / no auto rollback.

Predecessor checks (KB)

D28 partial fix report phase_status=PASS (KB).
D28 Stage 2 report: page routes 18/18 PASS, production image confirmed nuxt-ssr-local:d2db418.
D28 chain healthy; no rollback_recommended=true outstanding.

Phase 0 — Preflight (rev4 — 0F informational, 0G/0H hard)

Gate	Check	Result
0A	docker compose nuxt image == `nuxt-ssr-local:d2db418`	PASS (`nuxt-ssr-local:d2db418`, count=1)
0B	`/api/discovery/relations?collection=workflow_steps` HTTP 200 + secret scan	PASS (200, no Bearer/JWT leak)
0C	`table_registry/21` exists, `tbl_event_outbox` / `event_outbox`, status=draft	PASS (status=`draft` → mutation needed)
0D	Permission #1483 = 14-field allowlist, excludes denylist	PASS — `fields` matches allowlist exactly: `id, occurred_at, created_at, event_domain, event_type, event_stream, delivery_lane, event_severity, event_subject_table, event_subject_ref, canonical_address, actor_ref, source_system, payload_classification`. `collection=event_outbox`, `action=read`, `role=null` (Public)
0E	Registry visible fields no denylist	PASS — 13 keys (id auto-added by DirectusTable): `occurred_at, event_domain, event_type, event_stream, delivery_lane, event_severity, event_subject_table, event_subject_ref, canonical_address, actor_ref, source_system, payload_classification, created_at`. denylist hits = 0
0F	Generated map `event_outbox` (informational)	INFO — not present; expected absent for draft
0G	`/knowledge/registries` HTTP 200 (HARD rev4)	PASS (200)
0H	`/knowledge/registries/event_outbox` pre-mutation HTTP 200 + unsafe absent (HARD rev4)	PASS (200, denylist hits = 0)
0I	No D28 rollback recommendation	PASS
0J	PG `event_outbox` accessible (optional)	SKIPPED_NO_SAFE_METHOD (not required; Directus admin metadata sufficient)
0K	DOT publish tool discovery (informational)	`dot_tool_for_publish_found=false` — Directus Items API used per priority
0L	D28 chain verified PASS	PASS

preflight_status=PASS

0F informational fields

generated_map_has_event_outbox=false
generated_map_entry_expected_absent_for_draft=true
generated_map_status_filter=active,published
generated_map_missing_blocks_publish=false

0H pre-mutation security note

Pre-mutation HTML body (size ≈ 257 KB) contains zero denylist tokens. Naive token|secret|bearer|password|authorization regex matched 4 occurrences of password, all confirmed false-positive boilerplate:

CSS selectors [type=password] (× 2) in stylesheet
App route literal resetPassword:"/auth/reset-password"

Real-secret patterns (Bearer <token>, JWT eyJ…) = 0. pre_mutation_unsafe_fields_absent=true.

Phase 1 — Mutation

Method: DIRECTUS_ITEMS_API (DOT search returned no publish tool for table_registry).
Pre-state: table_registry/21 status=draft; sha256(pre)=51c425f60e2c31141199bc8e3269c7b6717694375330074dbfece98527debe90.
Request: PATCH /items/table_registry/21 body {"status":"published"}.
Response: HTTP 200, data.status=published, id=21, table_id=tbl_event_outbox, collection=event_outbox.
Post-state diff vs pre-state: {"status": ("draft","published")}; only status changed → mutation_side_effects_detected=false.
Auto rollback: not executed (NO_AUTO_ROLLBACK).

mutation_executed=true, mutation_method=DIRECTUS_ITEMS_API.

Phase 2 — Smoke (post-mutation)

Target: GET <WEB_URL>/knowledge/registries/event_outbox (after sleep 2 SSR warmup).

2A. HTTP / secret scan

route_http_status=200
html_size=256946
bearer_token_leaks=0
jwt_leaks=0

2B. Denylist HTML scan (Tier 1 critical)

safe_payload=0  correlation_id=0  causation_id=0
payload(*)=0    body(*)=0         raw_payload=0    payload_raw=0
vector=0        embedding=0
"secret"=0      "token"=0         "password"=0
ssn=0           personal_data=0   internal_*=0     admin_only=0

(*) checked as JSON-key form "payload" / "body" to avoid CSS / route false positives. All denylist hits = 0.

unsafe_fields_detected=[]

2C. Marker checks (Tier 2)

DirectusTable_marker=1
event_outbox_token=14 occurrences
allowlist_field_key_markers=0   # Vietnamese labels render in SSR; raw keys absent

DirectusTable + event_outbox markers present → render path active. Field keys absent in SSR HTML is expected (component renders Vietnamese labels; raw column keys are emitted client-side via DirectusTable hydration).

2D. Runtime field-level deny smoke (anonymous Public role)

Permission #1483 role=null → applies to Public; anonymous probes test the live policy:

runtime_field_deny_safe_probe              fields=id,occurred_at,event_domain,event_type,payload_classification → HTTP 200
runtime_field_deny_safe_payload_probe      fields=safe_payload     → HTTP 403
runtime_field_deny_correlation_id_probe    fields=correlation_id   → HTTP 403
runtime_field_deny_causation_id_probe      fields=causation_id     → HTTP 403
runtime_field_deny_payload_probe (bonus)   fields=payload          → HTTP 403

runtime_field_deny_smoke=PASS.

Phase 3 — Decision

phase=P3D4C2U_RESUME_NOTIFICATION_DISPLAY
preflight_status=PASS
d28_chain_verified=PASS
production_image=nuxt-ssr-local:d2db418
tbl_event_outbox_status_before=draft
tbl_event_outbox_status_after=published

generated_map_has_event_outbox=false
generated_map_entry_expected_absent_for_draft=true
generated_map_status_filter=active,published
generated_map_missing_blocks_publish=false

registries_route_status=200
pre_mutation_event_outbox_status=200
pre_mutation_unsafe_fields_absent=true

mutation_method=DIRECTUS_ITEMS_API
mutation_executed=true
mutation_side_effects_detected=false
auto_rollback_executed=false

permission_1483_verified=true
permission_matches_option_d_allowlist=true
permission_excludes_safe_payload=true
permission_excludes_correlation_id=true
permission_excludes_causation_id=true
registry_contains_any_denylist_field=false

route=/knowledge/registries/event_outbox
route_http_status=200
smoke_scan=PASS
unsafe_fields_checked=safe_payload,correlation_id,causation_id,payload,body,raw_payload,payload_raw,vector,embedding,secret,token,password,ssn,personal_data,internal_*,admin_only
unsafe_fields_detected=[]

runtime_field_deny_smoke=PASS
runtime_field_deny_safe_payload_probe=403
runtime_field_deny_correlation_id_probe=403
runtime_field_deny_causation_id_probe=403

notification_display_smoke=PASS
notification_display_checkpoint=unblocked
phase_status=PASS
next_required_pack=P3D_INFORMATION_UNIT_TEXT_AS_CODE_RESUME
rollback_recommended=false

Self-check (14 items rev4)

#	Question	Result
1	D28 chain verified PASS?	yes
2	Production image still d2db418?	yes
3	Permission #1483 excludes safe_payload/correlation_id/causation_id?	yes (14-field allowlist verified)
4	Registry visible fields exclude denylist?	yes (13 keys, 0 denylist hits)
5	0G `/knowledge/registries` HTTP 200?	yes
6	0H pre-mutation route 200 + unsafe absent?	yes
7	0F generated map informational only (not blocking)?	yes (absent expected for draft)
8	Mutation method declared, status changed, no side effect?	yes (Directus Items API; only status field diff)
9	Idempotency handled?	n/a — was draft, now published; subsequent runs would skip
10	Post-mutation HTML denylist absent?	yes (0 hits)
11	Runtime deny probes safe_payload/correlation_id/causation_id → 403?	yes
12	NO auto rollback?	yes
13	Hard boundaries (13 NO_*) all true?	yes
14	Report uploaded to KB?	yes (this document)

Notes & follow-ups (informational, not blocking)

Generated table-map (web/generated/table-maps.generated.ts) does not yet contain event_outbox because it was last regenerated while the row was status=draft. Route /knowledge/registries/event_outbox works independently (Directus runtime resolution). Next regular deploy that runs generate:table-maps + build will naturally include the row now that it is published. No action required in this pack.
SSR HTML for the registry table renders Vietnamese labels, not raw column keys; presence of column keys must be verified post-hydration if a stricter Tier-2 marker is desired in future packs.
Permission #1483 has role=null → applies to the Directus Public role, which made the runtime deny smoke executable without an additional public token.