QA run · platform-core.settings-audit-secret-fingerprint (1/1) · 6bf16849 · 2026-10-16 · 1 PASS / 0 PARTIAL / 0 FAIL / 0 BLOCKED / 0 NOT-RUN #24078
Description
Run record for the re-run #24036 (half B) asks for after revising this item. Runner: an os-dev subagent dispatched by the domain:devx seat 2 PM (session session_016PVjjuVPte5XEJvaQx1E4t). Protocol: .claude/skills/checklist-test/SKILL.md + docs/qa/platform-checklist/RUNNER.md. Executed sequentially (no subagent tool in this runner).
Environment fingerprint
- framework:
6bf16849bdab557aadecf49c09a3e0cd39bc8c30, the tip of branchclaude/issue-24036-ledger-bat run time. Its product tree isorigin/mainc91af8ed6; the branch addsdocs/qa/platform-checklist/areas/*.jsononly. Built withpnpm install --frozen-lockfileandturbo run build(75/75 tasks). .objectui-sha:f8267df93aba8fb09cc1cc0692eadc0c8c5a5e56(no browser leg in this item).- boot:
OS_PORT=41911 objectstack dev --ui --seed-admin -p 41911 -d file:(run dir)/probe/data.dbfromexamples/app-showcase, its own port and file DB (the CLI also provisioned the siblingdata.telemetry.db), stopped by its own process-group id afterwards. - persona(s): the seeded admin (
admin@objectos.ai), identity proven withGET /api/v1/auth/get-sessionbefore the first cell; the no-key reader is played offline against the captured rows - timestamps: 2026-10-16, 23:32Z to 23:33Z
Scope
Selector platform-core.settings-audit-secret-fingerprint resolves to 1 runnable item: platform-core.settings-audit-secret-fingerprint at revision 2, P1, surface api. No planned or blocked-hidden item.
Per-clause verdicts
| # | clause (short) | verdict | evidence |
|---|---|---|---|
| 0 | keyed fingerprint on both ledgers | pass | sys_setting_audit newest mail.api_key: action set, encrypted true, scope global, new_hash hmac-sha256: + 64 hex. sys_audit_log config_change: object_name sys_platform_setting, new_value carries namespace/key/scope and a digest that is the encrypted marker wrapping that same keyed digest; metadata encrypted true. Neither row contains V1 |
| 1 | no offline confirmation of a guess | pass | offline FNV-1a 32 of V1's canonical JSON, FNV-1a 32 of bare V1, SHA-256 of V1 (bare, sha256:-prefixed, canonical JSON) and V1 itself: no hit in either row; the step-7 control's offline FNV-1a 32 DOES match |
| 2 | equal values, equal fingerprints | pass | writes V1, V2, V1: fingerprint 1 equals 3, differs from 2, all keyed shape, on both ledgers |
| 3 | reset records no fingerprint | pass | reset (provider log, api_key null): sys_setting_audit action reset, new_hash null; config_change event settings.reset, new_value null |
| 4 | non-secret keeps the unkeyed digest | pass | mail.from_email qa-control@example.com: new_hash fnv32:c8753918 = offline FNV-1a 32 of the quoted JSON string; the config_change row carries it too. SHA-256 of the same string does NOT match (the old item spelling) |
| 5 | no-keyed-digest arm (pin) | pass | packages/services/service-settings/src/settings-audit-secret-digest.test.ts, run with settings-routes.test.ts: 2 files, 38 passed |
Reproduction rules
No clause scored fail, so none is owed. No authentication or authorization hole was found; nothing here is withheld under the RUNNER rule-2 carve-out.
Derived item verdict
platform-core.settings-audit-secret-fingerprint r2: pass (6 pass of 6 clauses).
- The value V1 was a fresh random string for this run and is not recorded here.
Checklist-accuracy findings and fixture gaps from this run close out on #24036.
Generated by Claude Code
Activity
objectstack-fleet commentedon Oct 17, 2026
Close-out (
domain:devxseat 2): every clause PASS; nothing to extract. Ruling C on #24127 (maintainer): a verification re-run of a ledger edit no longer carries aqa-runrecord, and the existing ones close out now. The revised itemplatform-core.settings-audit-secret-fingerprintlanded with #24141 (9ffe8af094), Part of #24036; itshistoryrow names #24036.Generated by Claude Code