[security] Stored-metadata-body family: two exits #21120 did not reach. An engine-only door serves an administrator credential material in cleartext, and the data door serves a content hash computed over the withheld credentials

[objectstack-fleet]

Ruled: 5950183039 · letter A / A / A · 2026-10-02T10:24Z

Ruled: 5942670275 · letter B · 2026-10-01T23:30Z

立卡门 ①(例外:可能泄露数据,已测可达)。finding 类别 a。reach: 公开入口实测一次(管理员 API key,真实启动)。
动手的读者:分诊定级和定车道后,由承接该族的车道席位派发。族的上一张收口卡 #21120 在 domain:services;第一处出口的代码在 packages/mcp(domain:cli)。
查重:mcp__github__search_issues 查 "mcp stdio record tools serve stored metadata body credential cleartext engine-only reader",9 条命中;查 "stored metadata content hash checksum over withheld credential offline verifier",5 条命中。都含 closed,都不是本题。最近的几条:#21120(本族收口卡,已 closed,其 PR 没覆盖这两处),#7990(族的起源,closed),#8083 / #8266(stdio 绕过 ADR-0049 暴露门,closed)。
⚠️ 安全类卡:只写类别与位置,不写请求、字段路径或值。detail 留在 dev 的私有暂存区。

来源

#20790 的 dev 实测报告 5935832144(out-of-scope findings 第 1、2 条)。实测在 main 的 cb45469e 上做,已包含 #21120 的收口 PR(336e1914)。

出口一:engine-only 读取门(类别 a)

• 位置: packages/mcp/src/stdio-data-bridge.ts 的 query 与 get 路径(约 :353、:146),以及同包 plugin.ts 的 record resource(约 :597)。三处都只经引擎读取。
• 实测: 用真实的管理员 API key,按 stdio 门自己的解析方式调用,门返回存储行与版本历史行的元数据体,其中的凭据为明文。成员调用被拒(PERMISSION_DENIED)。
• 原因(源码读): 族的投影只挂在协议的数据门方法上。本族的枚举 pin(stored-metadata-body-family.pin.test.ts)覆盖了数据门、audit、analytics、realtime,没有覆盖这个门。
• 范围: 实测用的是流程元数据体。数据源元数据体走同一条引擎读,从构造上同样受影响(源码读,未单独实测)。

出口二:内容哈希(类别 a,安全例外)

• 位置: packages/metadata-core(或其仓库层)sys-metadata-repository.ts 约 :537:存储行的内容哈希是对整份存储体做 sha256,凭据也在其中。
• 实测: 通用数据门向管理员提供这个哈希,且它等于保存回执里的版本号。
• 后果: 对低熵凭据而言,哈希加上已投影的正文,就构成一个离线校验器,可以验证对凭据的猜测。

与 #20790 的关系

#20790(流程凭据进只写通道)落地后,流程的凭据会离开存储体,上面两处出口对流程就关闭了。对数据源不会关闭。所以本卡不依赖 #20790,但定级时可以只按数据源和历史存量来量剩余范围。

方向(供分诊参考,不是裁决)

• 出口一:按族的既有做法,把这个门纳入投影或拒收,并加进族的枚举 pin。⛔ 不新造第二套投影。
• 出口二:哈希只对投影后的正文计算,或不再对外提供。哪种做法会影响版本号语义,由分诊判断。

---

Generated by Claude Code · domain:services seat 2 (#21118) · session_01DiCSbmJrkzNhuEAier4VoJ · https://claude.ai/code/session_01DiCSbmJrkzNhuEAier4VoJ

[objectstack-fleet]

Triage: first grade — bug · security · priority:p1 · domain:cli · area:access · pm:queue. Exit one joins the family's projection and pin; exit two's hash becomes keyed, not narrowed

Triage seat (objectstack-wide, seat post #6015) · session_01AavokzJ5DndAwitDXvKy4U · 2026-10-01T16:53Z. ⛔ Not a claim, ⛔ not a dispatch. ⛔ Classes and positions only.

Why p1. Both exits were measured with an administrator's credential, and members are refused. It is the family's grade (#21120, p1). Exit one serves credential material in cleartext, so it is first in the PR.

Routing. Exit one lands in packages/mcp (domain:cli). Exit two lands in the metadata repository (domain:engine), declared as the same claim's cross-lane surface and dispatched vertically.

The ruling (triage's; overturnable by the maintainer):

1. Exit one. The engine-only reader joins the family's one projection: it serves the projected body, or refuses. It is added to the family's enumeration pin (stored-metadata-body-family.pin.test.ts), so a future reader fails the pin instead of joining silently. ⛔ No second projection.
2. Exit two: a keyed hash, not a narrowed one.
   • Hashing only the projected body would stop a credential-only change from moving the version, which breaks version identity.
   • So the served content hash becomes a keyed hash (HMAC under a server-held key). The version still moves on every change, and no offline verifier exists.
   • The claim lists every consumer that compares these hashes. If one compares across deployments, it says so here before building.

• Measure in the same claim: the datasource body on exit one, which is affected by construction but not measured.

Pins: each exit, as an administrator, serves no credential material and no unkeyed hash, with a credential-free body as the control.

---

Generated by Claude Code

[objectstack-fleet]

Claim: PM loop round 1 of the domain:cli seat's session session_01VvcEokUG1tvVxkceYfR5XB (batch 3): priority:p1 security, triage's first grade 5936231568, filling a free slot under the maintainer's 「并发保持3」
Session: session_01VvcEokUG1tvVxkceYfR5XB
Account: huangyiirene
Branch: claude/issue-21207-stored-body-two-exits
Worktree: objectstack-issue-21207
Domain: domain:cli
Seat: domain:cli#1
File surface (classes and positions only, ⛔ no request, field path or value):

• Exit one, the engine-only reader: packages/mcp/src/stdio-data-bridge.ts (its query and get paths, around :146 / :353 on 097ef80270) and packages/mcp/src/plugin.ts (the record resource, around :597).
  • It joins the family's one projection from [security] Family closeout: stored metadata bodies (stored datasource credential material included) are still reachable outside the redacting doors at several further positions — detail withheld pending maintainer #21120 (PR fix(security): close out the stored-metadata-body family — project or refuse every further read/copy/evaluate exit #21144, 336e191441): it serves the projected body, or refuses. ⛔ No second projection.
  • It is added to the family's enumeration pin packages/metadata-protocol/src/stored-metadata-body-family.pin.test.ts, so a future reader fails the pin instead of joining silently.
• Exit two, the served content hash: packages/metadata-protocol/src/sys-metadata-repository.ts, the row hash and the version it feeds, a cross-lane surface declared per triage. The served hash becomes keyed (HMAC under a server-held key), so the version still moves on every change and no offline verifier exists. ⛔ It is not narrowed to the projected body.
  • Stop clause: before building, the dev lists every consumer that compares these hashes (version history, parent links, the save receipt, drift or sync checks, anything else) and where the server-held key comes from. If any consumer compares hashes across deployments, or the key source needs a new secret, the dev stops and reports it here first.
• Measure in the same claim: the datasource body on exit one, affected by construction but not yet measured.
• Pins:
  • for each exit, an administrator gets no credential material and no unkeyed hash;
  • a credential-free body is the control;
  • a member stays refused.
• One .changeset/21207-*.md at the level the real diff takes.
• ⚠️ Disclosure discipline: the PR body, the changeset and test titles name classes, doors, roles, codes and statuses only. ⛔ No request, header, field path, value or seeding recipe in public text.
  (stop on a breach outside these; explain in the report)
  Container & model: M, mode:subagent, model: opus (dispatch-gates --tier: no path-derived mandate, floor sonnet · default opus · ceiling fable).
  Clause-②: no
  Thread-read: 5936231568
  Serial constraints cleared: No open PR touches packages/mcp/src/**, packages/metadata-protocol/src/sys-metadata-repository.ts, the family pin or protocol.ts (the file lists of all 16 open PRs were read in this act, main 097ef80270). In flight on this seat: #20752 stage 3 (packages/runtime strings), disjoint. area:access in flight elsewhere: #21185, #21180, #21154 and #21079, on drivers, forms spec, plugin-audit and plugin-security, all disjoint.

---

Generated by Claude Code

[objectstack-fleet]

os-dev-report
{
"issue": 21207,
"status": "needs_decision",
"branch": "claude/issue-21207-stored-body-two-exits",
"pr": "#21228",
"session": "session_01VvcEokUG1tvVxkceYfR5XB — mode:subagent, the dispatching domain:cli seat session id",
"premise_still_valid": true,
"summary": "Exit one is delivered in draft PR #21228 (Part of #21207). The MCP stdio transport's engine-only reader (the stdio bridge's query, get and aggregate verbs, plus the record resource) now serves stored-metadata rows through the family's one projection (redactStoredMetadataRow, @objectstack/spec/kernel). It refuses the evaluate shapes (group, filter, sort, aggregate member on the stored body column) with the data door's INVALID_FIELD / 400. The family enumeration pin gains the two MCP rows; a new per-package pin classifies every bridge member and enumerates every engine read call site of packages/mcp/src on the syntax tree. Exit two was not built: it stopped at the claim's stop clause because the keyed hash needs a key source that does not exist. No existing keyed primitive reaches the metadata repository, so it needs either a new secret or a new keyed method on the crypto-provider contract. The decision is open_questions[0]; #21207 remains open for it. Premise measured live: the datasource body, affected by construction, is affected by measurement (cleartext to an administrator via the record resource and the bridge, member refused). The served content hash is an unkeyed sha256 over the whole stored body and equals the save receipt's version.",
"tests": "Head ae754f9. @objectstack/mcp pnpm test: Test Files 33 passed, Tests 366 passed (exit 0). @objectstack/mcp pnpm typecheck: exit 0, 'check:test-typecheck: OK' and the new test file is in the tsconfig.test.json program (listFilesOnly count 1). @objectstack/metadata-protocol vitest run: Test Files 200 passed / 3 skipped, Tests 2973 passed / 19 skipped (exit 0). @objectstack/metadata-protocol pnpm typecheck: exit 0, and the family pin is in its program. New pin src/stdio-data-bridge.stored-metadata-body.test.ts: 22 passed. Ablations: the fix was committed first, each mutation went through scripts/ablation-replace.mjs (anchor hit, blob changed), and each restore was proven 'blob == HEAD and git diff HEAD empty'. A1 (projection removed in serveStoredMetadataRow): 5 failed / 17 passed; red = the administrator no-credential pins (query, get, unjudgeable body, body-only projection, record resource), green = controls, refusals, member, teeth. A2 (evaluate refusal disabled): 9 failed / 13 passed; red = all 9 refusal pins, green includes the scalar-column control. A3 (an extra engine read behind a cast in plugin.ts): 1 failed / 21 passed. A4 (an unclassified bridge member): 1 failed / 21 passed. First attempts of A3 and A4 were no-ops: the replacement kept the anchor, so the tool refused and nothing ran; both were re-run with new anchors. A3 against the original name-based scan stayed green, so that scan was replaced by the AST scan and A3 was re-run red. No dist-reading committed test exists: the dogfood probe was private. The probe ran against a rebuilt mcp dist (marker count of the new function in dist: 3).",
"mcp_calls": "0 — no MCP GitHub tool was called; GitHub reads were single-card REST reads (issue #21207 and its comments, the #20790 dev report comment, PR #21228 read-back)",
"api_writes": "3 — all through scripts/pm/ tools over the fleet-write relay (each a POST /repos/objectstack-ai/objectstack/dispatches with the session token, executed by the relay as objectstack-fleet[bot]): (1) fleet-write/dispatch.mjs pr_create → POST /repos/objectstack-ai/objectstack/pulls (draft #21228, body read back identical 8720 bytes); (2) label-write.mjs --assign huangyiirene → POST /repos//issues/21228/assignees (read back: assignee matches); (3) post-stamped.mjs → POST /repos//issues/21207/comments (this report). git push is not REST.",
"open_questions": [
{
"question": "Exit two: the ruled keyed hash has no key source in the tree, and its at-risk population is the stored rows that already exist. Which key, and at which boundary? Measured: datasource save door refuses a credential in the body (422), and flows leave the body with #20790. So a hash keyed at WRITE time protects mainly flows written before #20790, while the existing stock and its history rows (the rows that actually carry credential material) keep serving the unkeyed sha256 unless they are re-keyed.",
"options": [
"A — write-time keyed hash under a NEW dedicated server secret (refuse production boot without it; dev/test a persisted local key), plus a one-off re-key migration of every existing row's checksum and previous_checksum. Cost: a new operator secret in every deployment; amending the repository contract's canonical-hashing invariant and the shared contract suite (metadata-core); the spec description of the history checksum; the stored-row checksum column bound (71 chars, a keyed prefix needs 76); the second producer in packages/metadata (DatabaseLoader) moved to the same function; rewriting append-only history; client-held versions answer one 409 after the switch.",
"B — serve-time keyed transform. Stored checksums stay canonical sha256 (contract, suite, both producers, FS layer and parent links untouched); every serve exit of a hash serves HMAC(key, stored hash), and every inbound version (If-Match / parentVersion, revert-to-version) is compared in that form. The key comes from the existing OS_SECRET_KEY through a new keyed method on the crypto-provider contract (spec contract widening, Clause-② yes; every provider implements it). No provider wired ⇒ the hash is withheld, never served raw. Cost: a hash-serving exit family to enumerate and pin (data door both tables, this MCP door, save receipt, /meta version and history, ETag), one contract method, and old clients' held versions answer one 409.",
"C — re-rule without a key: serve no hash for a row whose projection withheld material (the oracle exists only there), and keep serving the stored hash for every other row. Cost: those rows lose a served version, so their optimistic lock falls back to the existing last-write-wins path. Triage's 'keyed, not narrowed' ruling rejected hashing the projected body; this is a different narrowing and would need the ruling reopened."
],
"recommendation": "B, with C as the interim only if a contract widening is unwelcome now. 实际业务需求: the measured at-risk population is the existing stock and its history. B covers it on every exit without rewriting append-only history; A needs the re-key migration to reach it at all, and write-time keying alone protects almost nothing measured. 项目长远合理性: B keeps the version layer's canonical-hash contract intact and treats the keyed form as a serve-boundary concern, like the body projection, and the key stays with the existing secret owner (KMS-compatible). A changes the repository contract and runs two producers through a new secret. 防 AI 写错: B is one serve-time function plus an enumerated, pinned exit family, the pattern this body family already proved, and a missing provider fails closed. 创业阶段不扩散: B adds no operator secret and one contract method; A adds a secret, a migration and contract amendments; C adds nothing but reopens a ruling and degrades locking on exactly the credential-bearing rows."
}
],
"out_of_scope_findings": [
"carrier: 承接者:无 · noted, not filed — the generic data door's body-column filter refusal matches the exact column name, while this PR's door also refuses a dotted path into the body by its head segment. Whether the data door evaluates a dotted path into the stored body was read from source only and not measured, so it is not a finding. It is in PR #21228's Acceptance notes.",
"carrier: 承接者:无 · noted, not filed — packages/metadata's DatabaseLoader is a second producer of the stored-row and history checksum columns, with a different canonicalization (calculateChecksum) than the repository's hashSpec. Whether its save path is live in a production composition was not measured; it is listed in hash_consumers because exit two must move it too."
],
"gates": {
"head": "ae754f9e3a",
"derived": "node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands → 61 commands (exit 0; tree objectstack-ai/objectstack at ae754f9, change set 5 paths vs merge base bbcd20c)",
"ran": "61 of 61, each recorded 'COMMAND :: exit CODE', all exit 0 at ae754f9. check:dual-build-cjs-loads first answered PREREQUISITE NOT MET (8 packages without dist); it was re-run after building them and passed, exit 0. check:comment-mask-adoption first went red on a private comment stripper in the new test; fixed by moving the scan to the TypeScript AST, then exit 0.",
"reconcile": "dispatch-gates --ran: 61 derived, 61 run, 0 NOT-MEASURED (a DERIVED zero — all 61 recorded an exit code and none is 3)",
"lint": "pnpm lint (eslint . --no-inline-config, repo-wide, not narrowed): exit 0 at ae754f9, 139 s wall on a shared box",
"ci": "not awaited (in_progress at report time; CI convergence is the PM's)"
},
"deviations": [
"PR body first line is 'Part of #21207', not the dispatch's 'Fixes #21207': exit two is not built, so the merge must not close the card.",
"Clause-② is declared 'no (narrowing)', not the claim's 'no'. The diff narrows what a published door serves (projection instead of stored bytes) and accepts (evaluate shapes refused). This follows the family precedent (#21144 changeset): minor, BREAKING, ADR-0087 not-required (no-migration-prescription), and check:adr-0087-registration reads it '[BREAKING+bang+clause-②-narrowing]'.",
"Exit two stopped at the claim's stop clause (the key needs a new secret or a new contract method). No exit-two code was written, as the dispatch ordered.",
"Exit one's pins hold for credential material, the credential-free control and the member refusal. The 'no unkeyed hash' half is NOT MET: the stored checksum column is still served as stored and waits on open_questions[0].",
"The aggregate verb of the same stdio bridge is included in exit one. It is the same file and the same engine-only reader, and a group key on the body measured as serving the body.",
"The dispatch did not carry the four-axis decision framework. The recommendation uses the canonical copy in .claude/skills/pm-dispatch/SKILL.md 升级与决策, read once and not retained.",
"Measurement used a private probe test. It was copied into packages/qa/dogfood/test only for each run and removed right after (git status empty each time) and was never committed. Its readings are in the scratch folder issue-21207 (measure-before.json, measure-after.json).",
"The datasource credential case was measured on historical-stock rows, written straight to the two tables as the system, because the datasource save door refuses a credential in the body (measured 422).",
"Commits carry the model-free trailer pair from the dispatch and AGENTS.md. The harness attribution reminder asked for a model-named trailer, which was not used.",
"Labels documentation, size/l, tests and tooling on PR #21228 were applied by the repository's labelers, not by this run (the only label-write was the assignee)."
],
"files_changed": [
"packages/mcp/src/stdio-data-bridge.ts",
"packages/mcp/src/plugin.ts",
"packages/mcp/src/stdio-data-bridge.stored-metadata-body.test.ts",
"packages/metadata-protocol/src/stored-metadata-body-family.pin.test.ts",
".changeset/21207-mcp-stdio-stored-metadata-body.md"
],
"repro": {
"boot": "real boot (showcase + security + automation + SQLite file DB + connector plugins); administrator and member API keys minted through the key door and resolved the way the stdio door resolves them; before = origin/main 097ef80 build, after = branch build with rebuilt @objectstack/mcp",
"exit_one": [
{
"body": "flow body with credential",
"role": "administrator",
"before": "LEAK on record resource (resources/read), bridge get and query, both tables",
"after": "served as projection, no credential, on every path"
},
{
"body": "datasource body with credential (historical stock)",
"role": "administrator",
"before": "LEAK on record resource, bridge get and query, both tables",
"after": "served as projection, no credential, on every path"
},
{
"body": "credential-free body (flow and datasource)",
"role": "administrator",
"before": "served",
"after": "served byte-identical (same byte counts before and after)"
},
{
"body": "any",
"role": "member",
"before": "refused PERMISSION_DENIED on every path; the record resource answers an error text, no row",
"after": "same"
},
{
"body": "flow, datasource",
"role": "administrator",
"shape": "filter on the body column",
"before": "served — answered a guess (match vs no match)",
"after": "refused INVALID_FIELD / 400, engine not asked"
},
{
"body": "flow, datasource",
"role": "administrator",
"shape": "sort on the body; group by the body; aggregate filter on the body",
"before": "served (body in the answer / guess answered)",
"after": "refused INVALID_FIELD / 400"
},
{
"body": "flow, datasource",
"role": "administrator",
"shape": "aggregate member over the body",
"before": "refused by the engine INVALID_FIELD / 400",
"after": "refused here first INVALID_FIELD / 400"
},
{
"body": "flow, datasource",
"role": "member",
"shape": "evaluate shapes",
"before": "refused PERMISSION_DENIED",
"after": "refused INVALID_FIELD / 400 (before the engine, the data door's order)"
},
{
"body": "any",
"role": "administrator and member",
"shape": "tools query_records / get_record",
"before": "refused by the tool layer's system-object guard",
"after": "unchanged"
}
],
"exit_two": {
"served_hash_keyed": "NO — before and after: an unkeyed sha256 over the whole stored body (credential included), served on the generic data door and on this MCP door, equal to the save receipt's version (measured true)",
"version_moves_on_every_change": "YES today (the hash covers the whole body, credential included) — unchanged, nothing built",
"offline_verifier_defeated": "NO — not built (stopped at the stop clause)"
}
},
"hash_consumers": [
{
"where": "packages/metadata-protocol/src/sys-metadata-repository.ts:612-614 put()",
"compares": "caller-held parentVersion vs the stored checksum (optimistic lock)",
"cross_deployment": false
},
{
"where": "sys-metadata-repository.ts:620 put()",
"compares": "freshly computed hash of the incoming body vs the stored checksum (no-op short-circuit; needs a key stable across restarts and nodes)",
"cross_deployment": false
},
{
"where": "sys-metadata-repository.ts:485 getByHash() (ADR-0009 execution pinning), forwarded by metadata-core layered-repository.ts:96",
"compares": "a version looked up by history checksum; no production caller found in this checkout",
"cross_deployment": false
},
{
"where": "sys-metadata-repository.ts:785-828 delete()",
"compares": "parent lock on the stored checksum; tombstone records previous_checksum",
"cross_deployment": false
},
{
"where": "sys-metadata-repository.ts:922-997 promoteDraft() / dropPromotedDraftRow()",
"compares": "draft drained by its own checksum; parentVersion = active hash",
"cross_deployment": false
},
{
"where": "sys-metadata-repository.ts:1249 history read; :1926 rowToItem fallback",
"compares": "serves the parent chain (previous_checksum → parentHash); recomputes hashSpec(body) when a row has no checksum",
"cross_deployment": false
},
{
"where": "packages/metadata-protocol/src/protocol.ts:17673-17687 saveMetaItem, :18318 restore (parentVersion = history row checksum), :21898, :23031-23033 delete",
"compares": "parentVersion from the caller or the current hash vs the stored checksum; the save receipt echoes the version",
"cross_deployment": false
},
{
"where": "packages/rest/src/rest-server.ts:6992, :7222 (If-Match → parentVersion); packages/client/src/index.ts:806 (SDK If-Match); packages/cli/src/commands/meta/delete.ts (--if-match)",
"compares": "a client-held served version round-tripped to the same server",
"cross_deployment": false
},
{
"where": "packages/metadata/src/loaders/database-loader.ts:725-728, :1356-1366, :1404-1414 (calculateChecksum), :1002, :1145 (etag)",
"compares": "a SECOND producer of the same checksum / previous_checksum columns with a different canonicalization; no-op skip by equality; serves the checksum as an etag",
"cross_deployment": false
},
{
"where": "packages/metadata/src/metadata-manager.ts:3393",
"compares": "two versions' checksums side by side (version compare)",
"cross_deployment": false
},
{
"where": "packages/metadata-fs/src/repository.ts:261, :282, :361, :517, :530, :1004",
"compares": "the FS layer's own unkeyed hashSpec for file items; no FS-vs-DB hash comparison found (LayeredRepository probes each layer with its own hashes)",
"cross_deployment": false
},
{
"where": "packages/objectql/scripts/dry-run-hash-compat.ts",
"compares": "recomputes hashSpec(body) offline and compares with the stored checksum — an offline verifier by design",
"cross_deployment": "offline tool, same database"
},
{
"where": "packages/metadata-core/src/repository.ts:24 invariant 4; contract-suite.ts:207, :230, :270; packages/metadata-protocol/src/sys-metadata-repository.contract.test.ts",
"compares": "item.hash === hashSpec(item.body) — the repository contract every implementation (this one included) is tested against",
"cross_deployment": false
},
{
"where": "packages/spec/src/system/metadata-persistence.zod.ts:425; packages/metadata-core/src/objects/sys-metadata.object.ts:157-162 (maxLength 71); sys-metadata-history.object.ts:111-125 (maxLength 80)",
"compares": "declared shape: the history checksum is described as SHA-256 of the content; the stored-row column is bounded to a sha256-prefixed value",
"cross_deployment": false
},
{
"where": "cross-deployment consumers",
"compares": "none found in this checkout; the cloud repository (environment promotion, marketplace) was not available — NOT MEASURED",
"cross_deployment": "NOT MEASURED (cloud)"
}
],
"key_source": "None existing is reachable. The crypto provider contract (packages/spec/src/contracts/crypto-provider.ts) offers encrypt, decrypt, rotateKey and digest. Its digest may be plain SHA-256, and LocalCryptoProvider.digest is unkeyed sha256 (packages/services/service-settings/src/local-crypto-provider.ts:500). The provider is attached by the host after runtime.start (packages/cli/src/commands/serve.ts:5080-5092) into a private engine field (packages/objectql/src/engine.ts:3666), and the metadata repository cannot reach it. Its key material is OS_SECRET_KEY / OS_DEV_CRYPTO_KEY / a persisted file / an ephemeral test key, resolved inside service-settings. So a keyed hash needs a new secret, or a new keyed method on the crypto-provider contract plus a route from it to the hashing boundary. Either one triggers the claim's stop clause.",
"coexistence": "Write-time keying (option A): new rows store a keyed value and legacy rows keep sha256. The parent chain stays intact because previous_checksum copies the parent's stored value, so a keyed child points to an unkeyed parent. The first re-save of an unchanged legacy body mints one extra version unless no-op detection also accepts the legacy form. getByHash and history lookups keep matching stored values. Legacy rows keep serving their sha256, which is the offline verifier for exactly the stock at risk, until a re-key migration rewrites checksum and previous_checksum together. Serve-time keying (option B): nothing stored changes; legacy and new rows are served through the same transform, so the served chain stays consistent, and only versions clients held from before the switch answer one 409.",
"cleanup": "Worktree /home/user/objectstack-issue-21207 is clean (git status empty). After this comment posts: rm -rf its node_modules, then git worktree remove without --force. No server or monitor was started; the one gate batch that the harness moved to the background was waited on in the foreground with tail --pid and has exited."
}

---

Generated by Claude Code

[objectstack-fleet]

待维护者裁决:出口二(对外提供的内容哈希)要加密钥,但仓库里没有可用的密钥来源

_{domain:cli seat · session_01VvcEokUG1tvVxkceYfR5XB · 2026-10-01T19:02Z}

状态安排: 出口一由 PR #21228 交付(Part of #21207),正在复核与 CI 中,与本裁决无关、照常落地。它合并的同一笔里,本卡从 pm:dispatched 转 needs-user-decision,退出活动队列,进决策箱。在那之前本卡仍在飞。

一句话问题: 管理员读取元数据存储行时,每行都附带一个"版本号"。它是对整个存储体(含被隐去的凭据材料)直接算的 sha256。拿到它的人可以离线逐个猜凭据、对答案,猜中即知。分诊裁定改成"加密钥的哈希"(HMAC),但仓库里没有任何现成密钥能送到算哈希的地方。dev 按认领的停止条款停手,未写出口二的代码。

背景

• 分诊裁决 5936231568 第 2 条:对外提供的内容哈希改为 HMAC(服务端持有的密钥),⛔ 不缩窄成"只对投影体算哈希"。缩窄会让只改凭据的保存不再推动版本号,版本身份就坏了。
• 认领 5937050935 的停止条款:若任一消费方跨部署比较哈希,或密钥来源需要新的秘密,就先停、先报。后一条触发了。
• dev 报告 5938425782:
  • 列出了全部哈希消费方。在本检出内没有跨部署比较;cloud 仓未读,记 NOT MEASURED。
  • 实测了密钥来源:加密提供者契约只有 encrypt / decrypt / rotateKey / digest,本地实现的 digest 是不加密钥的 sha256;且提供者在运行时启动后才挂到引擎私有字段,元数据仓库够不到。

Governing text

• 分诊裁决 5936231568 第 2 条(见上)。
• packages/metadata-core/src/repository.ts:24,仓库契约不变量 4:「Canonical hashing. item.hash === hashSpec(item.body) — always.」
• packages/spec/src/contracts/crypto-provider.ts:155-161,digest 的说明是「SHOULD NOT reveal the plaintext (use HMAC or SHA-256 of canonical JSON)」。即契约允许不加密钥,所以不能依赖它来提供本安全性质。
• 协议声明:选项 B 要给加密提供者契约加一个方法,是公开契约放宽(Clause-②: yes),走 spec 车道并需契约复审;选项 A 要修改上面的不变量 4。

前提(各带复查命令)

1. 加密提供者契约里没有带密钥的方法。git grep -nE "^\s*(digest|encrypt|decrypt|rotateKey)\b|hmac" origin/main -- packages/spec/src/contracts/crypto-provider.ts:今天只命中四个方法。
2. 本地提供者的 digest 不加密钥。git grep -n "createHash('sha256')" origin/main -- packages/services/service-settings/src/local-crypto-provider.ts::501。
3. 存储行哈希列宽 71 字符,历史表 80 字符;带前缀的密钥哈希需要 76 字符。git grep -n "maxLength: 71" origin/main -- packages/metadata-core/src/objects/sys-metadata.object.ts。
4. 真正带凭据材料的,主要是已有存量行及其历史。dev 实测:数据源保存入口今天会拒收带凭据的存储体(422),流程存储体已由 security(flows): move a flow's inbound-hook secret out of flow metadata into the write-only secret seam #7799 established — no read, the generic data door included, returns it #20790 拿走凭据。复查 = 本卡 dev 报告的 repro.exit_two 与 key_source 段。
5. 只有管理员角色能拿到这个哈希,成员角色全路径被拒。复查同上 repro.exit_one。

选项 × 真实代价

选项	做什么	客户可感知的后果
A 写入时加密钥	新增一个专用服务端秘密(生产缺失即拒启动),新写入的行存 HMAC。另做一次迁移,重算所有存量行与历史行的哈希。	每个部署多配一个秘密,运维可见。要改仓库契约不变量 4、合同测试套件、两个哈希生产方、列宽和 spec 描述,还要改写只增不删的历史表。迁移切换后,客户端手里的旧版本号会各撞一次 409。
B 对外提供时加密钥	存储照旧是规范 sha256(契约、两个生产方、文件层、父链全不动)。只在对外提供哈希的每个出口,把它换成"HMAC(密钥, 存储哈希)";入站版本号也按同形比较。密钥来自已有的 OS_SECRET_KEY,经加密提供者契约新增的带密钥方法取得。没挂提供者时不提供哈希,绝不提供原值。	不加新的运维秘密。要给 spec 契约加一个方法(Clause-②: yes),所有提供者都要实现。要枚举并钉住"提供哈希的出口族":数据入口两张表、本 MCP 入口、保存回执、/meta 版本与历史、HTTP 缓存校验值。切换后旧版本号各撞一次 409。
C 重裁:不加密钥	只对"投影隐去了材料"的行不提供哈希,其它行照旧提供。	那些行失去版本号,乐观锁退回"后写者赢"。这恰好是带凭据的那批行。需要推翻分诊"加密钥、不缩窄"的裁决。

业务含义直译

• A = 给每张存档单据换一种防伪编号,并且把档案室里的旧编号全部重印一遍。
• B = 档案内部照旧编号,对外开出的每张收据都盖一层只有本店认得的钢印。
• C = 对装了钥匙的那几个档案袋干脆不开收据。

四轴(业务立场)

• ① 项目长远合理性: B 把"带密钥"放在对外提供的那一层,和存储体投影是同一类边界,仓库内部的规范哈希不变量原样保留。密钥归现有的秘密持有者,将来可换 KMS。A 改的是仓库契约本身,两个生产方都要接入新秘密,历史还要重写。C 是又一种缩窄,版本身份在最敏感的那批行上失效。
• ② 实际业务拉动: 今天撞上的是持有管理员密钥的人,他能拿到存量带凭据行的哈希做离线猜测(实测)。真正处于风险中的是存量与历史。B 在每个出口上一次覆盖,不重写历史;A 不做迁移就几乎保护不到实测中的风险面,做迁移才能覆盖。
• ③ 防 AI 犯错: B 是一个提供时函数加一个钉住的出口族,和本家族存储体投影已证明可行的模式相同;新出口不进清单就让钉子测试变红,没挂提供者就不提供哈希(失败关闭,响亮)。A 让一个新秘密贯穿两个生产方,哪一处漏接就静默地写回不加密钥的值。
• ④ 创业阶段不扩散: B 多一个契约方法,不多运维秘密。A 多一个秘密、一次迁移和多处契约修订。C 什么都不加,但要重开裁决,并在带凭据的行上降级锁。

os-decision-facets

• ① 长远:B 不扩大特例,仓库契约的规范哈希不变量原样保留;A 修订仓库契约并重写历史;C 新增一类"无版本号"的行。
• ② 拉动:实测拉动存在(管理员可离线猜存量凭据);风险面是存量与历史,B 一次覆盖,A 须迁移才覆盖。
• ③ 防错:B = 单一提供时函数 + 闭合出口清单 + 失败关闭;A 漏接处静默写回不加密钥的值。
• ④ 不扩散:B 只加一个契约方法;A 加秘密、迁移与契约修订;C 不加但重开裁决。
  Prior rulings read: HMAC|keyed hash in docs/adr → 4 hits (all webhook / notification signing, unrelated); ADR none; thread: 5936231568 (triage ruling 2)

推荐:B。回退:C,作为过渡,仅当此刻不愿放宽 spec 契约时选。

• 只看①选 B;②③④ 是否翻转:否。
• 终态参照:两年后的平台应把对外版本号当作不透明令牌。RFC 9110 把 entity-tag 定义为不透明的校验值;Kubernetes 的 resourceVersion 也是不透明令牌,不是内容摘要。B 正是这个形态。

置信缺口:

• cloud 仓(环境提升、市场)有没有跨部署比较这个哈希,本席看不到(NOT MEASURED)。若有,B 的提供时密钥会让跨部署比较失效,需要该处改比较存储哈希。
• 也可以选择把现有 digest 改为带密钥,而不加新方法;但契约允许 digest 不加密钥,依赖它就是"声明而未强制",本席不荐。

裁后执行

• 选 B:
  • 先在 spec 车道立一张 Clause-②: yes 卡,给加密提供者契约加带密钥的方法,并经契约复审。
  • 再把出口二按"提供哈希的出口族"枚举、钉住、派发(本卡或其衍生子卡),本卡至此关闭。
  • 出口一已落,不受影响。
• 选 A: 立"新秘密 + 历史重算迁移"卡,并在发布说明里写明运维须配新秘密,其余同上。
• 选 C: 由分诊重裁并改本卡验收条款,再派发。

你要做的(一个动作): 回复 A、B 或 C(可附条件)。

---

Generated by Claude Code

[objectstack-fleet]

ACCEPT: PR #21228 at ae754f9e (exit one of #21207: the MCP stdio transport's engine-only reader joins the stored-metadata-body family). Part of: exit two waits on the maintainer (5938508053)

_{domain:cli seat · session_01VvcEokUG1tvVxkceYfR5XB · 2026-10-01T19:13Z}

• Review route: the seat reviewed this PR itself, with no separate contract-review agent.
  • No contract face is hit: the claim 5937050935 declares Clause-②: no, and the PR declares no (narrowing). A narrowing is not a Clause-② widening.
  • The diff touches no packages/spec/src/** and no governed path.
  • The rule is the contract-review rule as amended on main in 5e5ce48cef.
• Exit one against triage's ruling 5936231568 item 1:
  • One projection: the bridge's query and get and the record resource serve through the family's one projection, redactStoredMetadataRow from @objectstack/spec/kernel. No second projection is written.
  • Engine first: the projection is applied to what the engine returns. A throwing redactor is not caught, so the read fails closed.
  • Evaluate shapes: a grouping, filter, sort or aggregate member on the body column is refused INVALID_FIELD / 400 after the exposure gate and before the engine. This covers the call's filter and each aggregation's own filter. A path whose head is the body column counts as the column.
  • Body-only projection: a projection naming the body without the type column reads the type and drops it again, so the caller gets exactly the columns it named.
  • Write verbs: the stored-body tables declare no write verb, so the exposure gate refuses create / update / remove there. This is pinned.
  • The family pin: stored-metadata-body-family.pin.test.ts gains the seam and refusal rows for @objectstack/mcp (6 → 8).
  • The package's own pin: it classifies every bridge member and enumerates every engine read call site on the syntax tree, so a new reader fails there.
• Measured (the os-dev-report 5938425782, real boot, before vs after):
  • an administrator's reads of a credential-bearing flow body and datasource body: served in cleartext before, served as the projection after, on all three paths and both tables;
  • credential-free bodies: byte-identical;
  • members: refused as before.
    The datasource body, which triage asked to measure, was affected and is now covered.
• Ablations: the dev ablated four legs on committed source, each red, then restored with blob == HEAD:
  • the projection removed: 5 red;
  • the refusal disabled: 9 red;
  • an extra engine read: 1 red;
  • an unclassified member: 1 red.
• Changeset, sentence by sentence against the diff:
  • the headline;
  • the BREAKING paragraph (minor for an accept-set narrowing, as in the family's precedent PR fix(security): close out the stored-metadata-body family — project or refuse every further read/copy/evaluate exit #21144);
  • the Reads and Evaluate-shapes bullets;
  • "What stays answerable".
    All hold. "No export or published type changes" holds: the new helpers are exported from stdio-data-bridge.ts, but src/index.ts does not re-export that module, and the package publishes only .. The adr-0087: not-required marker reads as the gate expects.
• Disclosure: the PR body, the changeset and the test titles name classes, doors, roles, codes and statuses only.
• Seat verification: checks on ae754f9e: 34 names, 31 success, 3 skipped (Build Docs, Console Pin Gate, Packed-tarball smoke (opt-in)), 0 red; Lint & Repo Gates and TypeScript Type Check are success. git merge-tree against origin/main: clean against 62b90d74f7, and no main commit since the merge base touches packages/mcp, the family pin or @objectstack/spec/kernel. check-governed-merges --pr 21228: NOT governed, +805 / −9.
• Checklist:
  • Draft, base main, first line Part of #21207.
  • 5 files: two source files, two pins and one changeset, all within the claim's exit-one surface.
• Not met here, by design: the "no unkeyed hash" half of the claim's pins is exit two. It stopped at the claim's stop clause because a keyed hash needs a new secret or a new contract method. The decision is in the maintainer's inbox as 5938508053.
• Out-of-scope findings, one line each:
  • The generic data door's refusal matches the body column's exact name, while this door also refuses a path into it. Whether the data door evaluates such a path was read from source, not measured. Acceptance notes.
  • A second producer of the stored-row checksum (packages/metadata's database loader) uses a different canonicalization. Whether it is live was not measured. Acceptance notes; it is input to exit two's execution.
• Next: readied and armed in this act. At the merge the seat records exit one, and in the same act moves this card from pm:dispatched to needs-user-decision, as 5938508053 states.

---

Generated by Claude Code

[objectstack-fleet]

Landed: exit one, PR #21228 → 3ddd3d0c4a (the MCP stdio transport's engine-only reader serves the stored body only as its type's read projection and refuses to evaluate it). A Part of landing: exit two waits on the maintainer

_{domain:cli seat · session_01VvcEokUG1tvVxkceYfR5XB · 2026-10-01T19:45Z}

• Landing reading: 3ddd3d0c4a is on origin/main as a single-parent squash on 62b90d74f7, 5 files, +805 / −9. Its diff equals the PR's net diff at head ae754f9e line for line, once the index and hunk-header lines are set aside.
• What is closed: exit one of this card. An administrator's key on the MCP stdio transport no longer reads stored credential material from either stored-body table, and the evaluate shapes on the body column are refused. The family pin now carries 8 surfaces.
• What remains: exit two, the served content hash. It stopped at the claim's stop clause, and the decision is 5938508053: A, B or C, with the seat recommending B.
• State: pm:dispatched → needs-user-decision, and the assignee is cleared, in the same act as this note. The card leaves the active queue until the maintainer answers. The seat's execution resumes from the ruling's "裁后执行" section.

---

Generated by Claude Code