[security] driver-sql's own server-log lines (raw and read terminals, three unresolvable-column refusals) write the compiled statement and inlined bound values, beneath the engine-boundary redaction of #21274 / #21345

[objectstack-fleet]

Ruled: 5950942037 · letter A · 2026-10-02T11:03Z

Filing gate: ① a defect with named positions, filed under the reach exception for possible data disclosure: a server-log line can carry a statement's bound values. ⚠️ Classes and positions only: no statement, value or reproduction here. This is the third position of the driver-fault redaction family, after #21274 (PR #21335) and #21345 (PR #21384, open).

reach: measured at the public engine door ObjectQL.execute, over a real SqlDriver on better-sqlite3, live PostgreSQL 16 and live MySQL 8.0, by #21345's dev (os-dev-report on #21345, open_questions[0] and out_of_scope_findings[0]). A synthetic sentinel bound into a raw statement reached the driver's own raw-terminal WARN line, for the four listed leading verbs and for unlisted ones alike, on all three dialects. The other four lines below are the same family by the driver's own words; they are read from source, not driven.

Filed by domain:engine#1 (seat post #6367, session_017xfMoEjKUuSh2xYB8sCozp). Reader who acts: the maintainer. The fix would amend the log half of an earlier maintainer ruling, so this card goes to the decision box, and the analysis is the next comment. ⛔ Not a claim.

Positions (packages/drivers/driver-sql/src/sql-driver.ts at origin/main 43e928dd4)

Five WARN lines say, in their own words, that the dialect message they write is "kept server-side" because it carries the statement and, on the dialects that inline them, the bound literals:

1. The raw terminal (near :10284, before rawStatementFaultError). The line also writes the statement the door sent. This is the line the probe measured.
2. The read terminal (near :10215, before backendStatementFaultError): "it carries the compiled statement, and on the dialects that inline them the bound literals too".
3. The unresolvable WHERE column (near :10087, INVALID_FILTER): "because it inlines the statement bound literals".
4. The unresolvable groupBy / aggregation column (near :10960, INVALID_FIELD): the same words.
5. The unresolvable listed distinct column (near :11253, INVALID_FIELD): the same words.

Each line runs inside the driver, before the engine's boundary helper (redactPropagatedDriverFault, #21274) sees the fault. So the engine-boundary cut, and #21345's by-construction cut at ObjectQL.execute, both stop above these lines.

Governing text: two positions that disagree

• [security] A driver error on an auth-table write reaches the auth library's logger unredacted: the server log carries the statement's bound values (credential material among them), while the engine's own line is redacted #21274's ruling (5943536760, triage's, overturnable by the maintainer): "Logs leave the trust boundary of the data: they are shipped, aggregated and read by operators", and "The error that propagates out of the engine carries the same redaction the engine's own log line already applies: no statement, no bound values."
• The driver's design under the maintainer's ruling of 2026-08-17 on A dotted WHERE key escapes as a raw dialect error with the bound literal inlined on Postgres and MySQL — pre-existing, and measured against live servers #8931 (「同意 C」): the read and raw terminals write the dialect message to the server log, "kept server-side", so an operator can read the diagnostic. The client envelope withholds it.

#21274's premise reaches the engine's carriers; the 2026-08-17 design places the driver's own log inside the data's trust boundary. Which one governs the driver's log lines is the maintainer's call.

Dedupe

Through mcp__github__search_issues, repo-scoped, open and closed: 「driver-sql server log line writes compiled statement bound values rawStatementFault backendStatementFault kept server-side」 gave 4 hits:

• [security] Driver-fault redaction residue after #21274: a raw statement whose leading verb the leak predicate does not list, and the lifecycle archiver's direct cold-store writes, can still carry a statement to a logger #21345 (open): this family's second position;
• [security] A driver error on an auth-table write reaches the auth library's logger unredacted: the server log carries the statement's bound values (credential material among them), while the engine's own line is redacted #21274 (closed): the first position;
• engine: a caller-supplied formula value reaches the driver (SQL fails with its own text, memory stores it) — strip it, report it in droppedFields, and let engine.validate run the same write doors (engine half of #20701) #20805 (closed): a caller-supplied formula value, a different subject;
• objectql: the value-bearing-diagnostic list in driver-fault-redaction.ts has one entry and no way to notice a second is missing (observation) #9160 (closed): the value-bearing-diagnostic list in driver-fault-redaction.ts, a different subject.

None covers the driver's own log lines.

Dedupe words: driver-sql raw terminal log bound values · rawStatementFault server log statement · backendStatementFault dialect text log · driver log line redaction · statement kept server-side operator log

---

Generated by Claude Code

[objectstack-fleet]

决策请求:driver-sql 自己写的服务端日志,要不要也去掉语句和绑定值

domain:engine#1 · session_017xfMoEjKUuSh2xYB8sCozp · 2026-10-02T09:53Z。⛔ 只写类别与位置,不含任何语句、值或复现载荷。

一句话问题: 客户写入的数据(包括登录、凭据这类敏感字段的值)在数据库报错时,会被数据库驱动原样写进服务器日志。引擎这一层已经在出口把它们抹掉了(#21274、#21345),但驱动自己先写的那几行日志没抹。要不要也抹,和 2026-08-17 的一条维护者裁决相冲突:那条裁决的设计是「这些诊断留在服务器端,给运维看」。

背景

• [security] A driver error on an auth-table write reaches the auth library's logger unredacted: the server log carries the statement's bound values (credential material among them), while the engine's own line is redacted #21274(p1,security)实测过:认证表写入出错时,凭据类的值会进服务器日志。分诊的裁定(5943536760)前提是:「日志会离开数据的信任边界:被转运、汇聚、给运维看」。修复放在引擎出口,截一次,覆盖所有消费方。
• [security] Driver-fault redaction residue after #21274: a raw statement whose leading verb the leak predicate does not list, and the lifecycle archiver's direct cold-store writes, can still carry a statement to a logger #21345(PR fix(objectql): the raw-statement door and the lifecycle sweep cut a driver fault by construction (#21345) #21384,待落地)补了同族的两处残留:原始语句入口按构造截断(不再靠识别前导动词);生命周期归档器的直连写入也走同一个截断函数。
• [security] Driver-fault redaction residue after #21274: a raw statement whose leading verb the leak predicate does not list, and the lifecycle archiver's direct cold-store writes, can still carry a statement to a logger #21345 的开发在三种数据库(SQLite、PostgreSQL 16、MySQL 8.0)上用合成哨兵值实测:driver-sql 自己的原始语句终点 WARN 行,在引擎截断之前就把语句和绑定值写进了日志。无论前导动词是否在名单里,三种数据库上都一样。
• 同一文件里还有另外四行,用自己的话写着同样的设计:「方言消息留在服务器端,因为它内联了语句的绑定字面量」。这四行是读源码确认的,没有逐行实测。

Governing text

• [security] A driver error on an auth-table write reaches the auth library's logger unredacted: the server log carries the statement's bound values (credential material among them), while the engine's own line is redacted #21274 的裁定 5943536760(分诊作出,维护者可推翻):日志离开数据的信任边界,从引擎出去的错误不带语句、不带绑定值。
• Undeclared fields still reach the driver: beforeInsert hooks run and an auto-number is consumed before the request is refused, and the whole INSERT with its values is logged at ERROR (17.0.0 GA) #8682(packages/objectql/src/driver-fault-redaction.ts 头注):「Keep the CALLER'S VALUES out of the server log when a driver-level write fault is logged」。引擎自己的写路径日志早已按这一条截掉语句和值;诊断尾部特意保留,给运维排障用。
• 维护者 2026-08-17 在 A dotted WHERE key escapes as a raw dialect error with the bound literal inlined on Postgres and MySQL — pre-existing, and measured against live servers #8931 上的裁决(「同意 C」),以及 driver-sql 据此写下的设计:读路径和原始语句的终点把方言消息写进服务端日志,「留在服务器端」给运维读;返回给客户端的信封则不带它。
• 协议声明:两者都不是 spec 条文,不改协议。本卡要裁的是 2026-08-17 那条裁决的日志这一半是否继续成立。

前提(每条带复查命令)

• driver-sql 有五行 WARN 写「kept server-side」。复查命令:git grep -n "kept server-side" origin/main -- packages/drivers/driver-sql/src/sql-driver.ts,在 43e928dd4 上命中 5 行。
• 引擎截断函数只在 objectql 里。复查命令:git grep -n "export function redactPropagatedDriverFault" origin/main -- packages,命中 1 处。
• driver-sql 不依赖 objectql。复查命令:读 packages/drivers/driver-sql/package.json 的 dependencies,其中没有 @objectstack/objectql。

选项 × 真实代价

选项	做什么	客户/运维能感知到的后果
A. 同一把刀截掉	把截断核心(切分、结构化切割、值模板)从 objectql 下沉到共享层(例如 @objectstack/types,属 domain:cli,需跨车道申报)。driver-sql 的五行日志和引擎出口调用同一个函数。每行保留错误码、错误类别和数据库自己的诊断文字。	日志里不再出现客户数据;运维仍能看到「哪种错、哪张表、数据库怎么说的」。实测过的那一行会被钉住。
B. 维持现设计	不改代码。在卡上记录:驱动层的服务端日志属于数据的信任边界之内,#21274 的前提止于引擎。	日志照旧可能带客户值,包括认证类字段的值。哪天日志被转运到第三方,值也跟着走。
C. 只记参数化语句和错误码	driver-sql 只写带占位符的语句文本和错误码,丢掉方言消息。	便宜;但运维丢了排查最有用的那句诊断,而 PostgreSQL 的诊断本身有时就带值,删了还不干净。

业务含义直译

• A 等于:银行的交易日志只记「哪笔交易、什么错误码、系统怎么说」,不记卡号,所有渠道用同一个打码规则。
• B 等于:承认后台日志可以有卡号,只要不发给客户;前提是后台日志永远不外流。
• C 等于:为了不记卡号,连错误说明也不记了,排障只能靠猜。

四轴论证

• 项目长远合理性(①): A 是一把刀、一个地方,覆盖所有日志面。B 等于在同一类数据的两个出口之间划两套规矩,下一个写日志的人照旧会漏。C 修了症状,又丢掉诊断。两年后该有的样子:平台任何一层的日志都不带客户绑定值,只带错误分类和诊断。这也是主流做法:PostgreSQL 13 起 log_parameter_max_length_on_error 默认 0,即出错时不记绑定参数;Rails 的 filter_parameters 也默认过滤敏感参数。
• 实际业务拉动(②): 原始语句入口服务的是要绑定调用方值的系统服务,开发已在三种数据库上实测到哨兵进了这一行。[security] A driver error on an auth-table write reaches the auth library's logger unredacted: the server log carries the statement's bound values (credential material among them), while the engine's own line is redacted #21274 实测过的就是认证类写入,同一类值。今天就会撞上的,是任何把日志转运到汇聚平台的部署。
• 防 AI 犯错(③): 出错时谁看到什么?B 下没人看到。值悄悄进日志、进汇聚平台,是静默泄露。A 下结构上就进不去,一个函数、多处调用,下一行新日志也该调同一个函数。一层截掉、另一层又写出来,这种陷阱评审看不出来。
• 创业阶段不扩散(④): A 是挪一个现有函数加五处调用,不加新接口、不加门禁。B 零成本,但留着这一类问题。C 更便宜,却删掉了运维诊断,而 Undeclared fields still reach the driver: beforeInsert hooks run and an auto-number is consumed before the request is refused, and the whole INSERT with its values is logged at ERROR (17.0.0 GA) #8682 正是特意保留这段诊断的。

os-decision-facets

• ① 长远:A 收窄特例,一把刀管所有日志面;B 保留两套规矩;C 修症状丢诊断。
• ② 拉动:已实测到原始语句入口的日志行带值(三种数据库);认证类写入是 [security] A driver error on an auth-table write reaches the auth library's logger unredacted: the server log carries the statement's bound values (credential material among them), while the engine's own line is redacted #21274 实测过的同类值。
• ③ 防 AI 犯错:A 结构上闭合;B 是静默泄露,评审看不到;C 闭合但丢掉信息。
• ④ 不扩散:A 挪现有函数加五处调用,无新面、无新门禁;B 零改动但留着这类问题。

Prior rulings read: driver-sql server log line bound values → 4 hits(#21345、#21274、#20805、#9160);kept server-side 源码 5 处;ADR:none(docs/adr 搜 server log / redact,无相关裁定);thread: #21274 5943536760,#8682(引擎写路径日志截值),#8931(2026-08-17「同意 C」)。

推荐

推荐 A。 回退项是 B,仅当您认定驱动层日志属于数据信任边界之内,并且平台承诺日志永不外流。

只看①选 A;②③④ 是否翻转:否(②有实测拉动,③偏向结构闭合,④的成本小)。

置信缺口:

• 另外四行只读了源码,没逐行实测。
• 不知道有没有运维依赖日志里的原始值来排障(没测到)。
• 截断核心下沉到 @objectstack/types 会碰 looksLikeInternalErrorLeak recognises no such column: but not no such function: — a SQLite parse failure echoes the raw engine message into the 500 body #16019 冻结名单所在的文件。挪的是切割函数,不加名单行;是否合适,要在认领时测一下。

裁后执行

• 选 A: 本卡回到 pm:queue(domain:engine,security),派一个 dev:
  • 把截断核心下沉到共享层,在 cli 车道座位贴上申报;
  • driver-sql 五行日志改为调用它;
  • 钉住:五行在三种数据库上都不出现合成哨兵,错误码、类别和诊断保留;
  • 反向验证:只回退调用,哨兵测试变红;
  • Clause-②: no。
• 选 B: 在本卡和 [security] A driver error on an auth-table write reaches the auth library's logger unredacted: the server log carries the statement's bound values (credential material among them), while the engine's own line is redacted #21274 上记录裁定(驱动层日志在信任边界内),本卡关闭 not_planned。driver-sql 现有注释已经写明这一设计,不再改。
• 选 C: 与 A 同样派发,但五行只写参数化语句和错误码;另在卡上记录诊断信息的损失。

相关:#21274(第一处位置,已落地)、#21345 / PR #21384(第二处位置,待落地)、#8931(2026-08-17 裁决)、#16019(冻结名单)。

---

Generated by Claude Code

[objectstack-fleet]

Triage: grade for the decision box — bug · security · priority:p1 · domain:engine · area:access; needs-user-decision stays. ⛔ Triage does not rule this

Triage seat (objectstack-wide, seat post #6015) · session_01AavokzJ5DndAwitDXvKy4U · 2026-10-02T10:02Z. ⛔ Not a claim, ⛔ not a dispatch. ⛔ Classes and positions only.

Why security and p1. It is the third position of the driver-fault redaction family, and it has the same reach class as #21274 (p1, security): caller-supplied values, credential-class ones included, can reach a server-log line. The card's title carried [security] without the label; the label is added here.

Routing. The five lines are in packages/drivers/driver-sql (domain:engine). Option A's shared-layer move would be a declared cross-lane surface of whichever claim takes it. That is the claim's to declare after the ruling, not a routing choice now.

Why triage does not rule it. Two things put it on the human floor:

• it is a security boundary, namely which side of the data's trust boundary the driver's own log sits on;
• it amends the log half of a maintainer ruling (2026-08-17, A dotted WHERE key escapes as a raw dialect error with the bound literal inlined on Postgres and MySQL — pre-existing, and measured against live servers #8931, 「同意 C」).

Triage's own premise on #21274 (5943536760) is one of the two governing texts, and the maintainer can overturn it. So it is not cited here as settled.

What the box holds: options A, B and C with costs, the four-axis analysis, and the re-check commands, in 5949689104.

In flight, unaffected: #21345's PR #21384, the engine-side second position.

---

Generated by Claude Code

[objectstack-fleet]

Ruling: batch #269 item 1 · letter A · maintainer 「同意」 2026-10-02T11:02Z

Director seat, summon #32, session_016tKoy8NJa35Yih1FdzrVmn. Written as objectstack-fleet[bot] through the relay. ⛔ Classes and positions only.

• How it was ruled. Batch 🔗 Broken links detected in documentation #269 was presented in the live director chat with options A, B and C from 5949689104 (triage's grade 5949871533). The director recommended A, with fallback B. The maintainer answered the batch as presented: 「同意」.
• The freshness gate: no comment after 5949871533.

What this amends

• The governing text that changes is the server-log half of the 2026-08 driver-fault design under A dotted WHERE key escapes as a raw dialect error with the bound literal inlined on Postgres and MySQL — pre-existing, and measured against live servers #8931: maintainer authorisation (a), 5306729666, which states "the full text goes to the server log … never to the caller", in the finding: after the #7598 Q1=B ruling, a read scope with a driver-refused field reference answers 400 from the driver — which cuts across #5367's attribution argument on that one path #7929 shape. That design assumed the server log sits inside the data's trust boundary.
• That premise is retired for caller-supplied values.
  • The engine's own write-path log already drops statement and values (Undeclared fields still reach the driver: beforeInsert hooks run and an auto-number is consumed before the request is refused, and the whole INSERT with its values is logged at ERROR (17.0.0 GA) #8682).
  • [security] A driver error on an auth-table write reaches the auth library's logger unredacted: the server log carries the statement's bound values (credential material among them), while the engine's own line is redacted #21274's ruling (5943536760) states logs leave the data's trust boundary: they are shipped, aggregated and read by operators.
  • This ruling makes that the rule at every layer, the driver's own log lines included.
• The caller-envelope half of A dotted WHERE key escapes as a raw dialect error with the bound literal inlined on Postgres and MySQL — pre-existing, and measured against live servers #8931 is unchanged.

The ruling

A: one cutter for every log face.

• driver-sql's five WARN lines ("kept server-side") call the same redaction core that the engine boundary uses (redactPropagatedDriverFault's cutter, [security] A driver error on an auth-table write reaches the auth library's logger unredacted: the server log carries the statement's bound values (credential material among them), while the engine's own line is redacted #21274), moved to a shared layer the driver can import:
  • the raw terminal;
  • the read terminal;
  • the unresolvable WHERE, groupBy / aggregation and listed-distinct columns.
• Each line keeps the error code, the error class and the dialect's own diagnostic. Only the statement's bound values and inlined literals are cut, with the same value template as the engine.

Not taken:

• B: declare the driver log inside the trust boundary. It leaves a silent leak to any shipped or aggregated log, and two rules for the same values.
• C: parameterised statement plus code only. It drops the operator diagnostic Undeclared fields still reach the driver: beforeInsert hooks run and an auto-number is consumed before the request is refused, and the whole INSERT with its values is logged at ERROR (17.0.0 GA) #8682 deliberately kept, and is not clean on dialects whose diagnostics carry values.

四棱(本裁决新记录)

• ① 长远:平台任何一层的日志都不带调用方绑定值;一把刀、一处规则,覆盖所有日志面(主流同向:PostgreSQL 13 起出错时默认不记绑定参数,凭知识)。
• ② 拉动:原始语句终点那一行在 SQLite、PostgreSQL 16、MySQL 8.0 上实测命中;同类值(认证写入)[security] A driver error on an auth-table write reaches the auth library's logger unredacted: the server log carries the statement's bound values (credential material among them), while the engine's own line is redacted #21274 实测过。
• ③ 防 AI:结构上闭合,新增日志行调用同一个函数;不再有「一层截、下一层写出」的静默陷阱。
• ④ 不扩散:挪现有函数加五处调用,无新接口、无新门禁。
• 只看①选 A;②③④ 是否翻转:否。

Execution parameters (ruled here; no further decision card)

• This card: needs-user-decision → pm:queue in this act, domain:engine, security, p1.
• The shared layer is the claim's to measure and declare as its cross-lane surface. If @objectstack/types is chosen, it touches the file that holds the looksLikeInternalErrorLeak recognises no such column: but not no such function: — a SQLite parse failure echoes the raw engine message into the 500 body #16019 frozen list: the move adds no list row.
• Pins:
  • on all three dialects, no synthetic sentinel appears in any of the five lines;
  • code, class and diagnostic are retained;
  • the four lines read only from source are driven by the pins, not assumed.
• Reverse verification: reverting only the calls turns the sentinel pins red. Clause-②: no.
• In flight and unaffected: [security] Driver-fault redaction residue after #21274: a raw statement whose leading verb the leak predicate does not list, and the lifecycle archiver's direct cold-store writes, can still carry a statement to a logger #21345's PR fix(objectql): the raw-statement door and the lifecycle sweep cut a driver fault by construction (#21345) #21384, the engine-side second position. The claim waits for it if both edit the cutter.

---

Generated by Claude Code

[objectstack-fleet]

Claim: PM loop round 1
Session: session_017xfMoEjKUuSh2xYB8sCozp
Account: huangyiirene (the seat's linked user as GET /user answers it; the card's assignee)
Branch: claude/issue-21385-driver-log-redaction
Worktree: objectstack-issue-21385
Domain: domain:engine
Seat: domain:engine#1 (seat post #6367)
Ruling-ref: 5950942037
File surface (⛔ classes and positions only on GitHub):

• The shared layer: the redaction core that packages/objectql/src/driver-fault-redaction.ts holds today (the split, the structural cut and the value templates behind redactPropagatedDriverFault) moves to a layer that both objectql and driver-sql already depend on. The hypothesis is packages/core (domain:engine): both packages list @objectstack/core as a dependency, and it does not touch the looksLikeInternalErrorLeak recognises no such column: but not no such function: — a SQLite parse failure echoes the raw engine message into the 500 body #16019 frozen-list file. objectql's boundary helper then calls the moved core. ⛔ No copy of the cut, and ⛔ no row added to packages/types/src/error-leak.ts's list. If the measurement shows the core must sit in @objectstack/types (domain:cli), the dev stops and reports before that edit, and the seat declares it on the cli seat post.
• packages/drivers/driver-sql/src/sql-driver.ts: the five WARN lines the ruling names (near :10087, :10215, :10284, :10960 and :11253 at origin/main 56238d890) call the moved core. Each keeps its code, class and the dialect's diagnostic.
• Pins in driver-sql (SQLite always, plus env-gated live PostgreSQL and MySQL cells) and in objectql, with changesets for the published packages that change.
  Container & model: M (a function move plus five call sites, with three-dialect pins), mode:subagent, model: opus (dispatch-gates --tier: no path-derived mandate, floor sonnet · default opus · ceiling fable)
  Clause-②: no
  Thread-read: 5950942037
  Serial constraints cleared: read at 2026-10-02T11:27Z against origin/main.
• [security] Driver-fault redaction residue after #21274: a raw statement whose leading verb the leak predicate does not list, and the lifecycle archiver's direct cold-store writes, can still carry a statement to a logger #21345's PR fix(objectql): the raw-statement door and the lifecycle sweep cut a driver fault by construction (#21345) #21384, which last edited driver-fault-redaction.ts, landed as d9569101a. That is the wait the ruling names, and it is met.
• In flight in this lane, none touches these files: objectql having and the per-aggregation filter answer a { $field } comparison against a no-class column (file, multi-valued, formula) where the where twin refuses it 400: the family's close-out card, with a per-position enumeration pin #21299 (objectql having-filter.ts, in-memory-aggregation.ts), #5930 step 4 (domain:engine): the engine-fed faces delete their hand-copied filter meaning (driver-sql, turso remote, memory query, mongodb, formula, having); the memory reference matcher retires (D6) #20822 group 4 (comment prose; its objectql sites are having-filter.ts and the door files, not the redaction module), and dead tracker citations in the domain:engine packages (645 sites, 160 numbers, 104 files): the ruling C+D stage for this lane (from #20556) #20595 stage 6 (PR docs(metadata): re-anchor the dead tracker citations to the commits that decided them (stage 6 of #20595) #21396, packages/metadata comments, in the merge queue).
• dead tracker citations in the domain:engine packages (645 sites, 160 numbers, 104 files): the ruling C+D stage for this lane (from #20556) #20595's next stage is packages/core's comment prose. It is sequenced after this card if this card's core file is one that stage would touch.
• The Clause-②: no line is the ruling's own execution parameter (5950942037).

---

Generated by Claude Code