[os-project-manager]

domain:server#2 · os-project-manager · session_0186vfjHHMsRXC9EUT9hTFMo

Requested by Leehom · project thread

Refs #28284

Clause-②: no
Metadata-protocol: none

维护者速读

• 改了什么：读取 connector 时，retryConfig 里和 actions 每个元素里只返回各自 schema 声明过的键，其余整键不返回；形状不对的 retryConfig / actions 整体不返回；库里的行不变。原样保存时这些值从库里带回不丢；actions 元素按 key 对应，重排也不串位；作者删掉 retryConfig 或某个 action 时才删。getPublished 对作者文档脱敏，元数据层的标量记账键原样返回，多次发布留下的嵌套快照同样逐层脱敏。
• 为什么改：QA 第三轮发现的安全加固(细节按披露裁决不公开)
• 风险与回滚：spec / metadata-protocol / metadata 三个 patch。保存接受什么不变。连带变化：carry-forward 中没有 id 的数组元素现在按 key 识别(目前只有 connector 的 action 有这种形状)。回滚即 revert 本 PR。
• 先看：packages/spec/src/integration/connector-credential-redaction.ts(模块说明第 8 项与 undeclaredNestedKeysOf) → packages/metadata-protocol/src/metadata-redaction.ts 的 identityOf → packages/metadata/src/metadata-manager.ts 的 redactServedBody。
• 两分钟验证：pnpm --filter @objectstack/spec exec vitest run src/integration/connector-credential-redaction.test.ts，预期 52 passed。
• 需要你做的：无，席位做 contract review 后落地。

What changes

• Connector read, nested shapes. Inside retryConfig and inside each actions element, every metadata read exit serves only the keys RetryConfigSchema and ConnectorActionSchema declare. The declared sets are read from the schemas' own shapes. Each withheld position is named in redactedKeys (retryConfig.<key>, actions.<index>.<key>). A retryConfig that is not an object, and an actions that is not an array or holds an element that is not an object, are withheld whole and named by the container (a cleared form and an empty list are served as written; an element is never removed on its own). The stored row is never changed.
• Carry-forward follows an action by its key. identityOf in the protocol's carry-forward returns id when present, and otherwise a non-empty string key. A reordered actions list keeps each element's withheld value on that element; twin keys carry neither, the existing ambiguity rule. A removed retryConfig or element is not minted back.
• MetadataManager.getPublished hands the type's redactor the authored document alone, and serves the metadata layer's own scalar bookkeeping (packageId, state, the publish keys) beside the answer unchanged. A publish snapshot nested under publishedDefinition (a package published more than once) is served through the same redaction at every depth; any other bookkeeping value that is not a scalar is not served. A body with nothing to withhold at any depth is served as before.

Nothing an author can write changes; no public export changes.

Why

QA 第三轮发现的安全加固(细节按披露裁决不公开)

Verification

Every reading below is on head 8daa64f1 (two commits on main at 3ac22c9d) unless it names 1fed7aac, the first commit.

Package suites and typecheck

• pnpm --filter @objectstack/spec test: 23335 passed, 1 todo. typecheck exit 0.
• pnpm --filter @objectstack/metadata-protocol test: 22113 passed, 26 skipped. typecheck exit 0.
• pnpm --filter @objectstack/metadata test: 929 passed. typecheck exit 0.
• @objectstack/dogfood typecheck exit 0. The connector door file reads 9 passed (--maxWorkers=1, under the verify lock).
• Whole dogfood battery (pnpm --filter @objectstack/dogfood exec vitest run --maxWorkers=1, under the verify lock): on 1fed7aac, 384 files passed, 3 skipped, 3171 tests passed, exit 0. On 8daa64f1: NOT MEASURED. The run was still in progress when work stopped; CI's Dogfood Regression Gate is green on this head.
• pnpm --filter @objectstack/spec check:generated: exit 0 (on 1fed7aac; the second commit moves no schema).
• CI on this head: Test Core (8 shards), Type Check (debt ledger included), Lint, Check Changeset, Dogfood Regression Gate all green; no red.

New tests

• packages/spec/src/integration/connector-credential-redaction.test.ts: nested keys withheld under retryConfig and per actions element; cleared values; the declared nested sets equal the schemas' shapes; a malformed retryConfig or actions withheld whole (four shapes) with the cleared-form control; input never mutated. The file reads 52 passed.
• packages/metadata-protocol/src/metadata-redaction.connector-undeclared-keys.test.ts (7): the served form withholds the keys (control); a served-form save keeps every value; a reordered actions list follows each element by key; the author's own value wins; a removed retryConfig or element is not minted back; twin keys carry neither; a malformed container withheld whole is kept at rest by a save of the served form.
• packages/metadata/src/published-body-bookkeeping-redaction.test.ts (5): a never-published row and a published snapshot keep their scalar bookkeeping beside the redacted answer; a package published twice is redacted at every depth; a non-scalar bookkeeping value that is not a snapshot is not served; a clean body is served as stored.
• packages/qa/dogfood/test/connector-meta-door-undeclared-keys-withheld.dogfood.test.ts (9): the HTTP read doors (item, /layers, /published, both list spellings) for a member and an administrator, plus the published read of a package published twice; served-form saves keep the values at rest, including a reordered actions list; a removed retryConfig is cleared. CONTROL: a credentialRef instance saves, reaches ready and dispatches.

Ablation (rebuilt, proved on disk)

Markers use the String('…').length form so the build cannot fold them. scripts/ablation-dist-preflight.mjs ran on each package.

Fix ablated	Head	Result while ablated
all three (nested withholding, key identity, bookkeeping peel)	1fed7aac	spec 3 failed / 48 · metadata-protocol 2 failed / 6 · metadata 3 failed / 3 · dogfood 2 failed / 8
key identity alone	1fed7aac	metadata-protocol 2 failed / 6 (served-form save, reorder) · dogfood 1 failed / 8 (reorder)
getPublished at every depth (metadata-manager.ts set back to its 1fed7aac blob)	8daa64f1	metadata 2 failed / 5 (published twice; non-scalar bookkeeping) · dogfood 1 failed / 9 (published twice)

Restore leg each time: blob equals HEAD, git diff HEAD empty, rebuild exit 0, and the same files green again (the first two legs also read the marker absent from every built file: spec 588, metadata-protocol 24, metadata 42).

Derived gate families

node scripts/pm/dispatch-gates.mjs --commands on 8daa64f1 derives 81 families. 80 ran locally, each with exit 0. check:type-check-debt is NOT MEASURED locally: it queued behind the dogfood hold on the verify lock and timed out (exit 99) before it got a turn. Its CI family, Type Check · debt ledger, is green on this head. The --ran reconciliation reads 81 derived, 80 run, 1 NOT-MEASURED. Repo-wide scans (pnpm lint and the rest of the lint workflow) are left to CI.

Human Minimum

• 1. Schemas start as Zod; packages/spec holds no runtime logic beyond the existing read-path redactor module this extends.
• 2. Every name I added uses the casing for its kind.
• 3. No formatter ran; pnpm lint is left to CI.
• 4. One branch off an up-to-date main, one pull request (no issue: Refs #28284).
• 5. Changeset present; both declaration lines are filled in here and in the changeset.
• 6. packages/spec touched: check:generated reads every generated artifact up to date (no schema changed).
• 7. No hand edits to content/docs/references/, packages/*/CHANGELOG.md or content/docs/releases/.
• 8. Title and body sections other than the maintainer brief are in English.

🤖 Generated with Claude Code

https://claude.ai/code/session_01FEkQ5mgePB9NQ4PNhvYVxk

[github-actions]

📓 Docs Drift Check

This PR changes 3 package(s): @objectstack/metadata-protocol, @objectstack/metadata, @objectstack/spec, touching 13 documentable anchor(s).

6 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/automation/flows.mdx (via retryConfig (literal, a string literal in undeclaredNestedKeysOf))
• content/docs/concepts/metadata-lifecycle.mdx (via MetadataManager (symbol, a top-level class))
• content/docs/kernel/cluster.mdx (via MetadataManager (symbol, a top-level class))
• content/docs/kernel/contracts/metadata-service.mdx (via publishedDefinition (literal, a string literal in redactServedDocument))
• content/docs/plugins/adding-a-metadata-type.mdx (via MetadataManager (symbol, a top-level class))
• content/docs/protocol/kernel/metadata-service.mdx (via MetadataManager (symbol, a top-level class))

⛔ 3 release-owned page(s) also name something this change touched. These are read-only:

• content/docs/releases/implementation-status.mdx (via MetadataManager (symbol, a top-level class))
• content/docs/releases/v17/17-0.mdx (via MetadataManager (symbol, a top-level class))
• content/docs/releases/v17/17-5.mdx (via retryConfig (literal, a string literal in undeclaredNestedKeysOf))

content/docs/releases/ is RELEASE-OWNED (AGENTS.md "Documentation Guardrails"): release
notes are written centrally at release time, and a code PR that edits them is the exact PR
that guardrail exists to stop. They are still audited — read-only. If one of them is actually
wrong, file an issue or open a dedicated docs-only PR; do not edit it here.

What this run could not see

• the SDK route bridge reached 60 of 216 client-bound route-ledger rows — the other 156 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 156: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 55 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 101 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 171 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json ab085a048241b0bf1fde06696fc6cbf659a6707f → packageMentionDocs.

Which tree this was computed on

This run read content/docs from e21776503575b90ceec8546459f27b442930383a — the merge of head 8daa64f14fc48cfb00e99cc3a400b6c609172db3 into base ab085a048241b0bf1fde06696fc6cbf659a6707f, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin e21776503575b90ceec8546459f27b442930383a && git checkout e21776503575b90ceec8546459f27b442930383a
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin ab085a048241b0bf1fde06696fc6cbf659a6707f 8daa64f14fc48cfb00e99cc3a400b6c609172db3 && git checkout -B drift-repro ab085a048241b0bf1fde06696fc6cbf659a6707f && git merge --no-ff 8daa64f14fc48cfb00e99cc3a400b6c609172db3

node scripts/docs-audit/affected-docs.mjs --json ab085a048241b0bf1fde06696fc6cbf659a6707f

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs ab085a048241b0bf1fde06696fc6cbf659a6707f → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[objectstack-fleet]

domain:server#2 · os-project-manager · session_0186vfjHHMsRXC9EUT9hTFMo

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 8daa64f14fc48cfb00e99cc3a400b6c609172db3
Local-runs: none
Scope: packages/spec/src/integration/connector-credential-redaction.ts + packages/spec/src/integration/connector.zod.ts (RetryConfigSchema, ConnectorActionSchema, the entry's retryConfig and actions bindings), packages/spec/src/kernel/metadata-credential-fields.ts (objectShapeOf, wrapperChainOf, walkDeclaredFields), packages/spec/src/kernel/metadata-type-redaction.ts (the registry), packages/spec/src/shared/lazy-schema.ts, packages/metadata-protocol/src/metadata-redaction.ts (identityOf, elementWithIdentity, resolveHops, locate), packages/metadata-protocol/src/protocol.ts (the served reads, the per-package list the package export reads), packages/metadata/src/metadata-manager.ts (getPublished, redactServedBody, redactServedDocument, publishPackage), packages/metadata/src/stored-envelope.ts (STORED_ENVELOPE_KEYS), packages/services/service-automation/src/flow-credential-projection.ts (the one other redactor that names array paths), packages/runtime/src/domains/packages.ts (the publish door), packages/rest/src/meta-item-history-routes.ts (the published read)

Round 2 on this head. Round 1 was a FAIL on 1fed7aac (one must-fix in the published read's bookkeeping pass-through, now fixed and pinned; one should-fix in the redactor's handling of a malformed nested container, now closed). This record stands on its own: it covers the whole PR, two commits on main at 3ac22c9d (the merged #28764), with no force push.

Inputs read: the PR body, both commits and their messages, the changeset, the eight changed files at the head, the net diff against the merge-base and the interdiff from 1fed7aac, the cited code at the head, the two #28764 review records (comments 6562139912 and 6563090347), the claim on #28284 (comment 6568020317), the open PRs touching the same files, and the check-runs on the head. No card exists by design.

① Derived judgments

1. What the connector read now withholds, nested. Inside retryConfig and inside each element of actions, every key RetryConfigSchema and ConnectorActionSchema do not declare is withheld whole, whatever its value, cleared forms included. The declared sets are read from the two schemas' own shapes through objectShapeOf, which walks the lazy wrapper to the object; an unreadable shape leaves the set empty and withholds every nested key, failing closed. The entry binds the same two schemas, so no declared nested key is withheld. Right.
2. A nested container that is not the declared shape. A retryConfig that is not an object, and an actions that is not an array or holds an element that is not an object, are withheld whole and named as retryConfig or actions; a cleared form (null, '', {}) and an empty list are served as written. This is the posture the module already takes for a non-object auth, and an element is never removed alone, so no index shifts. The spec pins cover four malformed shapes and the cleared-form control; the protocol pin shows the served form saves and keeps the stored value at rest. Right.
3. On which exits. The withholding sits inside the one registry entry every body-serving exit resolves: the item read, the list in both spellings, the layered read, the history diff, the generic row door, the published read, and the per-package list the package export reads. The execution reads apply no serving decoration, by design. Right.
4. The paths named. retryConfig.KEY and actions.INDEX.KEY (the element by its index), or the container's own name when it is withheld whole; sorted with the rest of redactedKeys. withoutKeyAt copies an array hop and readAt reads through one. The input is never mutated and is returned by reference when nothing is withheld. Right.
5. MetadataManager.getPublished and redactServedBody. The served body is walked by redactServedDocument: a key outside STORED_ENVELOPE_KEYS is the authored document and goes to the type's redactor; a scalar bookkeeping value (packageId, package, state, version, publishedAt, publishedBy, all strings or numbers as publishPackage writes them) is served beside the answer unchanged; a publishedDefinition that is an object is a document of the same type and goes through the same redaction at every depth; any other non-scalar bookkeeping value is not served. The input is returned by reference only when nothing at any depth changed. For every type with a redactor, the published read now serves no document that the type's redactor has not judged. Pinned in the metadata unit test (two legs, the first guarding its own guard) and in a dogfood /published leg for a member and for an administrator. Right; the round-1 must-fix is closed.
6. Carry-forward identity by key. identityOf returns id when present, otherwise a non-empty string key. Read in every path producer: the flow redactor addresses nodes, which carry id, and regions, which carry neither and are anchored as before; the datasource and derived redactors name no array path. In the tree today only a connector action is followed by key, as the changeset says; the twin-key case carries neither, the existing rule, and is pinned. Right.
7. Declared keys, execution reads and the served-form save. The save door's order is unchanged; a served form carries only declared nested keys, so the nested shapes accept it; each nested entry in redactedKeys resolves at the standard split, the actions hop by the element's key, and the position check keeps the graft because the redactor still withholds it. A removed retryConfig or element is not minted back. The control pins a credentialRef instance that saves, reaches ready and dispatches. Right.
8. Public surface. No package entry reaches redactConnectorItem, identityOf or redactServedDocument; redactServedBody is private. No published export changes. Right.

② Semver level

• Changeset at the head: '@objectstack/spec': patch, '@objectstack/metadata-protocol': patch, '@objectstack/metadata': patch; Clause-②: no; Metadata-protocol: none. The PR body carries the same two lines, and every package the diff moves is named.
• Metadata-protocol: none is right: the two nested shapes still accept what they accepted, every save that succeeded before succeeds now, and no key, value or type is added, removed or re-meant.
• Clause-②: no holds, on the reading the fix(spec): the connector read withholds root keys the entry shape does not declare #28764 records set for this function: the read serves fewer keys of a stored row, but every withheld position is outside the declared sets, no declared capability leaves the consumer, and the carry-forward change only carries more. The (narrowing) arm would be owed only if the nested write shapes were closed, which this PR does not do.
• The level follows the kind alone: none takes patch on every entry, and no authorable-surface baseline moves. Consistent with scripts/check-changeset-no-major.mjs and ruling A on changeset levels: minor only when the metadata protocol changes (added / narrowed / semantic), patch otherwise; release notes grouped by what the reader must do (maintainer ruling A, 2026-10-21) #25105; Check Changeset is green on the head.
• Disclosure: the changeset, both commit messages and the source comments (module note item 8, the redactServedBody docblock) say what is hardened and how behaviour changes, in product words; the maintainer's "为什么改" line is present verbatim in the 维护者速读 and under ## Why. No breach.

③ Boundary flags

The PR's user.login is os-project-manager, not objectstack-fleet[bot]: the seat's own account. Named here; the seat reads this before landing.

1. Open question: narrowing the nested write shapes. Answer: not needed for this PR's hardening, and not owed by it. The write side is a separate Clause-②: no (narrowing) card, with a census of what the ADR-0023 and ADR-0024 generators and the hand-registered path put on an action first. The seat decides whether to open it; it does not block this PR.
2. Out-of-scope findings in the hand-back. Both stand as separate cards; neither is a gap this PR should close.
3. PR body is the round-1 text. should-fix, prose, before ACCEPT. The "What changes" bullet still says a non-object retryConfig or element is not walked, and the getPublished bullet still says the bookkeeping is served unchanged; both describe 1fed7aac. The Verification section is stamped on 1fed7aac, the test counts predate the second commit (the spec file now holds more cases than the 两分钟验证 line expects), and the ablation table lacks the second commit's leg. Prose is the lane seat's face; the ACCEPT reads the body against this head.
4. Overlap. Open PR feat(spec): an oauth2 authorization_code connector instance can take its OAuth client from the installer — clientSource: 'installer' #28920 touches connector.zod.ts (an oauth2 instance key) and one line of the redaction test's declared-not-a-secret list; no hunk coincides with this PR's, so the later of the two to land rebases cleanly.
5. Check-runs on the head at record time. 13 success, 12 skipped, 0 red, 13 still in progress (Build Core, Build UI Deps, Plan Test Core shards and the Test Core shards behind it, Live E2E UI, the Type Check and Lint families). Check Changeset, Governed Surface Queue Guard, Spec property liveness, Dogfood Regression Gate, Lint · PM dispatch-gates and the PR-body guards are green. No red is known. The landing rule wants every check green, so the seat re-reads the head before queueing.

④ Design judgment

• undeclaredNestedKeysOf is a sibling of undeclaredRootKeysOf, run first with the same no-cleared-form rule for keys and the module's existing whole-container rule for a malformed shape; item 8 of the module note now records both next to item 7, in product words.
• redactServedDocument is one walk for the document and the bookkeeping, with the one document-valued bookkeeping key handled by recursion and every other non-scalar value failing closed. The reference-return rule is kept, so a clean body still serves by identity.
• The key fallback sits in identityOf alone, so the ambiguity guard, the anchor rule and the relocation by identity apply unchanged.

Findings: no must-fix. One should-fix, ③ 3 (prose, the lane seat's face). Two notes, ③ 1 and ③ 2.

Implemented-by: claude/project-thread-fayfxc
Reviewed-by: session_0186vfjHHMsRXC9EUT9hTFMo

VERDICT: PASS

---

Generated by Claude Code

[objectstack-fleet]

domain:server#2 · os-project-manager · session_0186vfjHHMsRXC9EUT9hTFMo

席位核对

ACCEPT · domain:server seat 2 · os-project-manager · session_0186vfjHHMsRXC9EUT9hTFMo · 2026-11-02T07:13Z · head 8daa64f1 · seat 2's confidential hardening series, claim on mailbox #28284 (comment 6568020317)

The maintainer's standing authorisation for landing reviewed PRs, verbatim: 「按照 pm-dispatch 规则复核过的都授权」. Security work in this series follows the maintainer's 「所有的安全卡不要创建issue，直接派发处理修复」, so the PR refers to the mailbox and has no card.

1. Shape:
   • A draft against main with Refs #28284 and no closing keyword. It declares Clause-②: no and Metadata-protocol: none, with three patch entries.
   • The head is two commits on main at 3ac22c9d, with no force push. Landing tier S.
2. Contract review at CONTRACT_REVIEW_TIER: PASS on this head (6570593720). Its one prose should-fix was that the PR body was stale; the body is refreshed to this head with this ACCEPT, which keeps the head.
3. Gates:
   • CI on this head shows 56 success, 13 skipped and 0 red.
   • Local: the drafter's whole dogfood battery and one derived family are NOT MEASURED on this head (stopped at the wrap-up). Their CI families, Dogfood Regression Gate and Type Check · debt ledger, are green.
   • The merge queue re-runs CI against current main.
4. Serial: item ③ of the series rebases onto this after it merges. It is paused under the maintainer's 07:11Z wrap-up.
5. Landing: body refresh + pr_ready + automerge_enable in one relay dispatch.

---

Generated by Claude Code

[objectstack-fleet]

domain:server#2 · os-steve · session_01ADHkmQxwoGb5fSnrFkpxmt

Landing record · PR #28997

domain:server seat 2 · session_01ADHkmQxwoGb5fSnrFkpxmt · 2026-11-02T09:09Z · series item ② (mailbox only)

Reading	Probe	Result
Merged	PR #28997 state	merged, merge commit ceef7143ff
On main	git merge-base --is-ancestor ceef7143ff origin/main	yes
Queue refs	git ls-remote origin refs/heads/gh-readonly-queue/* matching 28997	0

• Landed: a connector read serves only the keys its nested shapes declare, and saving the served form back keeps the stored values it did not serve.
• Card: none on GitHub; tracked in the seat's mailbox.
• Follow-up: the next series items are held.

---

Generated by Claude Code