security(flows): move a flow's inbound-hook secret out of flow metadata into the write-only secret seam #7799 established — no read, the generic data door included, returns it

[objectstack-fleet]

Ruled: 5910098951 · letter 17.x — the secret seam ships in the 17.x train (Q1 B · Q2 A · Q3 A · Q4 A per 5909514730); re-claim after PR #20830 lands, after #20761 on the access axis · 2026-09-30T11:21Z

Filed by the triage seat (objectstack-wide, seat post #6015, session_01AavokzJ5DndAwitDXvKy4U) on the maintainer's ruling. ⛔ Not a claim, ⛔ not a dispatch. Graded here: enhancement · security · priority:p2 · domain:services · area:access · pm:queue.

⚠️ Disclosure discipline: this card and every comment and PR on it carry no request body, header or field path. The measurements stay in the dev's private scratch space.

The ruling

The maintainer answered 「同意」 in the live PM chat with the triage seat, 2026-09-30, to triage's proposal: move the flow inbound-hook secret into a write-only seam, the way #7799 moved the outbound webhook signing secret. The proposal was parked in triage's grade of #20552 (5882728818: "the durable answer, but it is a new authoring surface, so it goes to the maintainer as a decision after this lands").

Why it is still needed after #20552

• [security] a flow's inbound-hook secret (config.secret on the start node) is served in cleartext by the flow-definition read; after #20529 every armed hook carries one #20552 (p0, closed with PR fix(service-automation,metadata-protocol,metadata,runtime): withhold a flow's inbound-hook secret from every served definition, and keep it on a round trip (#20552) #20585) projects the secret out of every definition read, and keeps it across a read-edit-republish.
• The secret still lives in the flow's stored definition. PR fix(service-automation,metadata-protocol,metadata,runtime): withhold a flow's inbound-hook secret from every served definition, and keep it on a round trip (#20552) #20585's acceptance note (OOS2) and the domain:services seat's landing record measured that an administrator reads the at-rest row through the generic data door.
• A projection hides it from one class of reads. A write-only seam removes the class.

Direction

• One seam, the existing one. The secret is stored through the platform's secret-field mechanism [security] The webhook signing secret is stored in cleartext in sys_webhook.definition_json #7799 introduced (PR fix(webhooks): stop storing the subscriber signing secret in cleartext (#7799) #7901, ObjectQL.resolveSecretField). It is written or replaced on authoring, resolved only at verification time inside the inbound door, and returned by no read: definition reads, /meta, export, and the generic data door alike.
  • ⛔ No second secret mechanism.
  • ⛔ No per-door redaction added on top.
• The flow definition keeps a reference, not the value. A republish that carries the reference (or the redacted form [security] a flow's inbound-hook secret (config.secret on the start node) is served in cleartext by the flow-definition read; after #20529 every armed hook carries one #20552 defined) keeps the stored secret. Only an explicit new value rotates it. [security] a flow's inbound-hook secret (config.secret on the start node) is served in cleartext by the flow-definition read; after #20529 every armed hook carries one #20552's round-trip rule is kept.
• Migration. Existing flows whose definition still carries the value are moved into the seam once, with an ADR-0087 disposition. The value never appears in any log or report.
• Pins:
  • no read surface returns the value, including the generic data door as an administrator;
  • the inbound door still verifies with the original secret after a move and after an edit-and-republish;
  • an explicit rotation replaces it;
  • a legacy flow is migrated.
• Coordinate. [security] closeout: two stored-credential positions outside #20552's projection still reach a served read unredacted (a flow http node's signingSecret; the /meta list read's raw fallback) #20590 (the flow-credential closeout) is in the same family.

Why p2. The residual reach is an administrator reading an at-rest row, a least-privilege gap. It is not reached below administrator as measured, and #20552 already closed the member-level reads.

[objectstack-fleet]

Serial wait · domain:services seat (#6021) · session_01XY5uCwTjZj7884yYtyur4H · 2026-09-30T07:04Z

This card is next in this lane by label order (priority:p2). It is not claimed yet, because its file surface intersects an in-flight claim.

Expected surface, at area level. It is read off #20552's landing (PR #20585 as c96beb27) and this card's direction, and the dev re-measures it:

• packages/services/service-automation/src/**: the flow-credential projection, the plugin wiring and the inbound door;
• packages/metadata-protocol/src/** and packages/metadata/src/**;
• packages/runtime/src/domains/automation.ts;
• a migration for existing flows.

The secret seam itself lives in packages/objectql (domain:engine). As the direction reads, it is used, not changed. A packages/spec change for the reference form would be cross-lane, and is measured before it is declared.

In flight on that surface: #20596 stage 14 (claim 5905919247). It covers comment and docblock prose across every file under packages/services/service-automation/src/**, and was dispatched at 2026-09-30T07:00Z.

Fold or serial: serial. The fold's first gate fails. A citation re-anchoring sweep and a secret-storage change are different defect shapes with different fixes.

Next: this card is claimed when stage 14's PR lands. It waits from this comment's stamp.

Premise reads at this act (the dev re-measures each):

• [security] a flow's inbound-hook secret (config.secret on the start node) is served in cleartext by the flow-definition read; after #20529 every armed hook carries one #20552 is closed completed; PR fix(service-automation,metadata-protocol,metadata,runtime): withhold a flow's inbound-hook secret from every served definition, and keep it on a round trip (#20552) #20585 landed as c96beb27.
• [security] closeout: two stored-credential positions outside #20552's projection still reach a served read unredacted (a flow http node's signingSecret; the /meta list read's raw fallback) #20590, which the direction says to coordinate with, is closed completed (PRs fix(service-automation,metadata-protocol,runtime): withhold the remaining stored flow-credential positions at every depth, and answer a /meta list fault as itself (#20590) #20615 and fix(service-automation): the http node's url and headers describes route an outbound credential to a connector's credentialRef, and the showcase says its webhook url is served (#20590) #20672). Nothing in that family is in flight.
• [security] The webhook signing secret is stored in cleartext in sys_webhook.definition_json #7799 is closed completed. Its seam, ObjectQL.resolveSecretField, is on main in packages/objectql/src/engine.ts, and plugin-webhooks, plugin-auth and service-messaging already use it.

---

Generated by Claude Code

[objectstack-fleet]

Serial wait, updated · domain:services seat (#6021) · session_01XY5uCwTjZj7884yYtyur4H · 2026-09-30T08:54Z

A second intersection, read in this act from the open PRs' file lists. It adds to 5906001334.

• access-security.packaged-flow-write-door-parity clauses 2 and 3 fail on main — detail withheld pending maintainer #20679 (domain:cli) is in flight as PR fix(runtime,metadata-protocol): the /automation write doors keep the packaged-base lock the /meta door keeps (#20679) #20817. That PR edits packages/metadata-protocol/src/protocol.ts and packages/runtime/src/domains/automation.ts, and both files are on this card's expected surface.
• dead tracker citations in the domain:services packages (629 sites, 112 numbers, 152 files): the ruling C+D stage for this lane (from #20556) #20596 stage 14 is now PR docs(service-automation): re-anchor the dead tracker citations to the commits and ADR that decided them #20816 (comment prose only, 27 files including engine.ts). Its authoring is finished, and it waits on its at-tier contract review.

Next: this card is claimed when both PRs have landed, or earlier if one lands and the other's files turn out disjoint from the measured surface. It keeps waiting from 5906001334's stamp.

---

Generated by Claude Code

[objectstack-fleet]

Claim: PM loop round 1 · 2026-09-30T09:56Z
Session: session_01XY5uCwTjZj7884yYtyur4H
Account: os-justin (the seat's linked user as GET /user answers it; the card's assignee)
Branch: claude/issue-20790-flow-hook-secret-seam
Worktree: objectstack-issue-20790
Domain: domain:services
Seat: domain:services (seat 1, seat post #6021)
File surface. This is the cross-lane exception path: triage graded this card into domain:services, and its direction reaches files in other lanes, so the whole surface is declared here.

• packages/services/service-automation/src/**: the flow-credential projection, the plugin wiring, the engine's trigger binding and publish checks, and the one-time move of existing flows.
• packages/triggers/trigger-api/src/**: the inbound door resolves the secret through the seam at verification time.
• packages/platform-objects/src/** (domain:engine): only if the measured design needs a secret-typed field to hold the value. ⛔ Not the generated translation files that open PR feat(spec): the picklist metadata kind — a shared option list select fields reference by name (#19518) #20823 edits.
• packages/metadata/src/** (domain:engine): only if the stored-definition write path needs it.
• packages/metadata-protocol/src/** (domain:engine): only files no open PR holds. ⛔ Not protocol.ts, plugin.ts, runtime-authoring-gate.ts, sys-metadata-repository.ts or the migrations/ files that open PR fix(metadata-protocol): refusals, hints and log lines state each decision in words instead of a tracker number (stage 2) #20830 ([finding] runtime warnings outside the migration ledger print tracker numbers to authors and operators: the AutomationEngine resumeAuthority boot warning (#3801 / #5561 / #3823) and two objectql data-event warnings (#4639 / #4626) #20513 stage 2) edits. If the design cannot avoid one of them, the dev stops and reports, and this card serializes behind that PR.
• packages/runtime/src/domains/automation.ts (domain:cli): only if a definition exit needs it. access-security.packaged-flow-write-door-parity clauses 2 and 3 fail on main — detail withheld pending maintainer #20679's PR fix(runtime,metadata-protocol): the /automation write doors keep the packaged-base lock the /meta door keeps (#20679) #20817 has landed, and no open PR holds the file.
• packages/lint/src/validate-flow-trigger-readiness.ts (domain:spec by the anchoring rule): only if the reference form changes what counts as a publishable secret.
• content/docs/** (domain:devx): only a page that states where this secret is stored.
• .changeset/20790-*.md.
• ⛔ Not packages/spec/src/**, and ⛔ not packages/objectql/src/**: the seam is used, not changed, and engine: a caller-supplied formula value reaches the driver (SQL fails with its own text, memory stores it) — strip it, report it in droppedFields, and let engine.validate run the same write doors (engine half of #20701) #20805 holds objectql/src/engine.ts. If either is needed, the dev stops and reports.
• ⛔ Disclosure: no request body, header or field path in the PR or any comment. The measurements stay in the dev's private scratch space.
  (stop on a breach outside these; explain in the report)
  Container & model: M, mode:subagent, model: opus (dispatch-gates --tier: no path-derived mandate, floor sonnet · default opus · ceiling fable). The design reuses one existing seam for one secret, with a one-time move and four named pins, so the work is bounded and the default tier fits. The contract review runs at CONTRACT_REVIEW_TIER.
  Clause-②: yes
• Why yes: it is taken conservatively, because a reference form accepted on republish may widen the authoring accept set, while the at-rest read narrows.
• Measured, not copied: the dev measures both directions, and the PR's line 2 carries the measured grammar (yes, yes (narrowing) or no (narrowing)).
  Thread-read: 5907724716
  Serial constraints cleared:
• The two PRs this card waited on have landed: dead tracker citations in the domain:services packages (629 sites, 112 numbers, 152 files): the ruling C+D stage for this lane (from #20556) #20596 stage 14 (PR docs(service-automation): re-anchor the dead tracker citations to the commits and ADR that decided them #20816 as 73155fed) and access-security.packaged-flow-write-door-parity clauses 2 and 3 fail on main — detail withheld pending maintainer #20679 (PR fix(runtime,metadata-protocol): the /automation write doors keep the packaged-base lock the /meta door keeps (#20679) #20817 as 4b45afae).
• dead tracker citations in the domain:services packages (629 sites, 112 numbers, 152 files): the ruling C+D stage for this lane (from #20556) #20596 stage 15 (service-settings, claim 5908460751) is disjoint.
• Open PRs:
  • fix(metadata-protocol): refusals, hints and log lines state each decision in words instead of a tracker number (stage 2) #20830 (domain:engine) holds the 8 metadata-protocol source files excluded above.
  • feat(spec): the picklist metadata kind — a shared option list select fields reference by name (#19518) #20823 (domain:spec) edits metadata-protocol tests and platform-objects generated translations, which are not on this surface.
  • chore: version packages #20639 (Version Packages) is release-owned.
• Claims:
  • engine: a caller-supplied formula value reaches the driver (SQL fails with its own text, memory stores it) — strip it, report it in droppedFields, and let engine.validate run the same write doors (engine half of #20701) #20805 (domain:engine) names objectql/src/engine.ts, which is excluded.
  • rest: the /meta dashboard item and list reads pass no packaged base to translateDashboard, so a published org overlay on a translated dashboard keeps the shipped widget title — per-layer child of #20680 #20730 (domain:cli) excludes metadata-protocol from its own surface.
  • [finding] runtime warnings outside the migration ledger print tracker numbers to authors and operators: the AutomationEngine resumeAuthority boot warning (#3801 / #5561 / #3823) and two objectql data-event warnings (#4639 / #4626) #20513's in-flight stage is PR fix(metadata-protocol): refusals, hints and log lines state each decision in words instead of a tracker number (stage 2) #20830, covered above.

---

Generated by Claude Code

[objectstack-fleet]

os-dev-report
{
"issue": 20790,
"status": "blocked",
"branch": "claude/issue-20790-flow-hook-secret-seam",
"pr": null,
"session": "session_01XY5uCwTjZj7884yYtyur4H — mode:subagent, the dispatching domain:services seat's session id",
"premise_still_valid": true,
"summary": "I stopped before writing code, as the order and the claim require. The design cannot avoid packages/metadata-protocol/src/protocol.ts, or sys-metadata-repository.ts for the restore path, and open PR #20830 edits both. Only one point is crossed by every metadata-plane write of a flow before the body is hashed and written. The body is written to three places: the stored row, a per-version history row, and the audit ledger's snapshot. That point is saveMetaItem's carry-forward-then-put step (protocol.ts 16935-16944). Migrate-stored (17522) and duplicatePackage (20324) both go through it. restoreVersion re-puts a stored history body directly (sys-metadata-repository.ts 1064, called at protocol.ts 21235 and 21625). The runtime publish gate learns which withheld credential is present from one place only: restoredCredentialPathsFor (protocol.ts 7482-7506), which reads the stored body. So once the value leaves that body, every redacted-form republish of a moved inbound flow is refused with flow-api-trigger-secret-missing, unless the protocol tells the gate that the seam holds the secret. I measured every route inside the claimed surface and rejected each one (rejected_routes). The premise holds at 4b45afa. Nothing has changed the stored-row object definitions since #20585's live measurement (ancestor check exit 0, clone not shallow). Three decisions the ruling does not settle are in open_questions, so the redispatch after #20830 lands can carry the answers.",
"off_surface_need": [
"packages/metadata-protocol/src/protocol.ts: (1) a per-type pre-put sink, registered by the automation plugin, in saveMetaItem between the carry-forward and repo.put (16935-16944). The sink moves an explicit inbound-hook value into the seam and puts the body without it. Migrate-stored and duplicatePackage inherit it. (2) Seam-held positions added to the runtime gate's restored-credential set (7482-7506). (3) The publish/promote path (18144), so that a draft save's value rotates the live hook only when it is published. (4) The restore callers (21235, 21625), so that restoring a pre-move version moves the value again instead of putting it back at rest.",
"packages/metadata-protocol/src/sys-metadata-repository.ts: only if the restore sink sits at the repository verb (restoreVersion 1064) rather than at its two protocol callers.",
"packages/spec/src/contracts/automation-service.ts: only if Q2 option B is chosen (an async seam write reachable from the runtime clone door)."
],
"measurements": [
"B1 HELD, and the value has more at-rest copies than assumed. The start node's config is stored in three places. First, the flow's stored metadata row (draft and active). Second, a per-version history row, written in the same transaction with the same body (sys-metadata-repository.ts 639 and 682). Third, when the audit plugin is composed, the audit ledger's after-snapshot of that row (audit-writers.ts 1412, hooks 1617-1618; the row's object is not in its skip list). All three objects are declared get and list on the generic data door. Their anchors are in the scratch reading readings/at-rest-census.txt. All of this is source-read; #20585's landing record measured the first live. In-process consumers: the engine's api binding (engine.ts 3597-3600) hands the start-node config to trigger-api start() (api-trigger.ts 133), which verifies against it at 202. The publish-time refusal is validateApiTriggerSecret (engine.ts 10127, called at 4311). The lint rule validateFlowApiTriggerSecret (validate-flow-trigger-readiness.ts 852) reads it at 320, with the runtime gate's restored-path input at 866. The clone door (runtime/src/domains/automation.ts 2521) calls getFlow, then cloneFlowDefinition (flow-clone.ts 234, a structuredClone of the whole definition), then registerFlow (2549). The boot pull reads it at plugin.ts 992 (ObjectQL registry items). The execution-face rebind reads it at plugin.ts 1984, 2044 and 2092. The raw in-process getFlow is engine.ts 4608.",
"B2 HELD. I read webhook-secret.ts whole. The plugin writes the plaintext once into a secret-typed column, and the engine encrypts it, failing closed. Every read masks it. resolveSecretField (engine.ts 8696) dereferences at driver level and refuses any field that is not secret-typed. Presence is decidable without decrypting (mask or null), and that is what a synchronous registration check can use.",
"B3 measured by source, with no live boot. serve.ts wires the crypto provider only after runtime.start() returns (5041, then 5074). On os serve, therefore, nothing at kernel:ready has a provider. With no provider the engine refuses a secret write loudly (engine.ts 8339). It announces a later registration through onCryptoProviderChange (8245), the channel plugin-webhooks uses. The ruling settles the posture by construction, so it is not a fork. A save that carries an explicit value on a host with no provider is REFUSED: the seam's own fail-closed throw becomes the save's refusal, and nothing is kept in the definition or dropped. The one-time move runs when a provider registers. On a host that never registers one, it leaves each legacy row exactly as it is and reports the flow by name, never the value. This is #7901's precedent, the one the ruling names.",
"B4 Choice: a companion object that service-automation owns and registers. It registers through the manifest service, the same way plugin.ts 581-592 registers the engine's run objects. The object has one secret-typed field, keyed by flow name and organization. A draft gets its own row, promoted on publish, so a draft save never rotates the live hook. On a flow delete, the automation plugin's registered mutation projector deletes the row, so no secret is left orphaned. Rejected: a secret-typed field on the stored metadata row itself. That object lives in packages/metadata-core, outside the claim, and the column would sit on every row of every metadata type.",
"B5 measured: the stored reference CAN be the #20552 redacted form (the key absent), and it should be, because absence fails closed. No seam row means no secret, so the engine and the trigger refuse. A spelled reference kept in the same key would pass validateApiTriggerSecret and trigger-api start() as a non-blank secret. A lost seam row would then arm a hook that verifies against a publicly known string. The cost of absence: the runtime gate's restored-path set is computed from the stored body (protocol.ts 7506, over metadata-redaction.ts 515). The protocol must therefore add seam-held positions to that set, which is another need in protocol.ts. Clause-② for the eventual diff, measured from this design rather than copied from the claim: authors keep writing the literal, and absent still means keep. So the authoring accept set does not widen on a host with a provider. It NARROWS on a host with no provider, where an inbound-flow save accepted today is refused. It also narrows at the clone door if Q2 option A is taken. The exported FlowTriggerBinding interfaces (service-automation engine.ts 514, trigger-api api-trigger.ts 11) gain a resolver member, which widens the public surface. Expected line: Clause-②: yes (narrowing), to be re-measured on the real diff.",
"B6 A packaged flow carries its value in the package artifact, which is the author's source. It is bound from the execution face and withheld from every served read by #20552. I searched this repository's object definitions: none stores a package artifact body behind the generic data door. The control plane's package store lives in another repository and was not read: NOT MEASURED. The door reaches a packaged flow's value only once an overlay row is saved. #20585 measured that save as refused (403) in the default posture, and allowed only under the writable-types escape hatch. Whether a packaged flow moves into the seam at install is Q3.",
"B7 Today the clone door copies the whole definition, value included, into the clone's engine registration (flow-clone.ts 234, automation.ts 2549). The door persists nothing, so it creates no at-rest copy. After the move, a seam-held source has no value to copy. The engine refuses a secretless inbound flow at registration, so the clone door would answer 400 for it. The ruling does not settle this: Q2.",
"B8 The http node's signing secret is stored in the same row, history row and audit snapshot as the inbound secret. #20615's projection acts on served reads only. It is reported in out_of_scope_findings and not folded in.",
"B9 The one-time move belongs in service-automation. It runs on crypto-provider registration, not at kernel:ready, because os serve has no provider then. It works per stored row, and so per organization. It is idempotent: a row without the value is skipped, and the seam write is an upsert. It logs only the flow name and outcome. It cannot go through saveMetaItem, whose carry-forward reads an absent key as keep, so the protocol's public save cannot remove a value. It needs the same protocol-level sink. The ADR-0087 category measured as not-required (no-migration-prescription): nothing is left for an author or an upgrading agent to rewrite, and no spelling is retired. A rotation instruction is not a FROM/TO block. The gate was not run, because no changeset exists."
],
"rejected_routes": [
"ObjectQL write hooks on the stored-row and history objects. They would be a second writer below ADR-0008's single repository route. The row's checksum is a sha256 over the canonical body with the value in it (sys-metadata-repository.ts 536, canonicalize.ts 135). So a stripped row keeps an offline guess-verifier of the secret, and no longer hashes to its own checksum. A draft save would also rotate the live hook.",
"A metadata authoring gate that mutates the body. The gate's contract is veto only. It is skipped on the package-author channel (protocol.ts 16739). It runs before the carry-forward and the put, so a 409 after the seam write rotates the hook for a save that never landed. Publish reuses the draft's gate, and restore re-puts a history body.",
"The flow canonicalizer stripping the value. It is synchronous, so it cannot write the seam. When it throws, the save persists the raw body (protocol.ts 16527 and 16584), so the value would land at rest exactly when it fails.",
"A migration only, with the write path unchanged. Every later Studio save or rotation would land the value at rest again. The runtime gate would refuse the redacted-form republish of every moved flow (B5).",
"Wrapping the protocol service's saveMetaItem from the automation plugin. That monkey-patches another package's service (Route & surface ownership rules 1-2, Prime Directive 5), and restoreVersion still bypasses it."
],
"tests": "No code was written, so no test, typecheck or gate ran. node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack exited 2: 'this branch changes nothing against origin/main (merge base 4b45afa) — nothing to derive'. The readings, each with its exit code, are in the scratch folder issue-20790/readings/: b1-consumers.txt (git grep, EXIT=0), b-census.txt (EXIT=0), at-rest-census.txt (EXIT=0), premise-drift.txt (merge-base --is-ancestor c96beb2 HEAD exits 0 on a non-shallow clone, and no commit since touches the stored-row object definitions), gates-derived.txt (EXIT=2) and push0.log (EXIT=0). NOT MEASURED live: every B reading is source-read at 4b45afa. The history and audit copies were not reproduced on a composed boot. The decisive facts are structural, and the stop does not depend on them.",
"mcp_calls": "14, all read-only: mcp__github__issue_read x7 (#20790 get and comments, #20552 get and comments, #7799 get and comments, #20590 get) and mcp__github__pull_request_read x7 (#20585, #7901, #20615, #20672 get; #20830 get_files and get; #20823 get_files). No write tool.",
"api_writes": "1: this report comment, through scripts/pm/post-stamped.mjs (the fleet relay). The push of the empty branch is git, not REST. No PR was created, and no label was written.",
"open_questions": [
{
"question": "Q1. The move can leave copies of a legacy flow's value outside its definition. Earlier copies sit in the per-version history rows and, with the audit plugin composed, in the audit ledger's change snapshots. The generic data door serves both to an administrator. The ruling's migration names 'flows whose definition still carries the value', and its first pin says no read surface returns the value. Do the older copies get scrubbed, or does the move only stop new copies and require a rotation?",
"options": [
"A: Scrub. The one-time move also removes the value from every history row of the flow and from the audit snapshots.",
"B: Rotate, don't scrub. The sink runs before the body is hashed, so no later row or snapshot carries a value. History and audit stay append-only. The move reports each legacy flow by name as 'exposed at rest before the move; rotate its secret', and the changeset says the same. The 'no read surface' pin is asserted for a secret written or rotated after the move.",
"C: Both A and B."
],
"recommendation": "B. Real business need: every Studio-authored inbound flow has had these copies readable to any administrator since it was authored. Scrubbing now does not unexpose a value that was already readable; only a rotation does. Long-term soundness: each history row's checksum is a sha256 over the full body, value included. A scrub either leaves an offline guess-verifier in place or re-hashes and breaks the previous-checksum lineage that diff and restore read. The audit ledger is append-only by design, and B keeps one write sink in one place. Preventing AI authoring mistakes: B makes the remaining exposure loud per flow, while A adds two more writers to engine-owned tables. No scope creep at this stage: A widens the card to two more tables and the audit plugin's ledger rules; B adds nothing."
},
{
"question": "Q2. What does the clone door do for a seam-held inbound flow? Today it copies the value into the clone's engine registration. After the move there is no value to copy, and the engine refuses a secretless inbound flow, so the door would answer 400.",
"options": [
"A: Refuse loudly with a prescription. The clone door names the missing secret, and the administrator authors the copy with its own secret through the metadata plane. No new key; an inbound flow can no longer be cloned in one step (a narrowing).",
"B: The closed clone body gains an optional secret, written to the clone's own seam row. This widens the clone body and needs an async seam write that the runtime door can reach, through a new IAutomationService method in packages/spec.",
"C: The clone gets its own seam row holding a copy of the source's value. Two hooks then share one credential."
],
"recommendation": "A. Real business need: the clone exists for ADR-0126 section 7.1 packaged-flow customization. A packaged inbound flow keeps its value in the artifact (Q3), so its clone is unaffected. Only a Studio-authored inbound flow reaches this fork. No example, doc, skill or client-SDK call reaches the flow clone door: 0 hits, against a positive control of 3 in the runtime source (readings/clone-usage.txt). Studio's caller lives in another repository and was not read. Long-term soundness: A adds nothing; B adds a contract method and a key; C makes one secret verify two hooks. Preventing AI authoring mistakes: A is a loud, contract-tightening refusal; C shares a credential silently; B widens an accept set. No scope creep at this stage: A is the smallest."
},
{
"question": "Q3. Do packaged (code-authored) flows move into the seam? A packaged flow's value lives in the package artifact, the author's source. No stored row holds it until an overlay is saved, and the save sink covers that overlay row. The ruling says the value is 'resolved only at verification time inside the inbound door'. Does that require one source for every flow?",
"options": [
"A: Out of scope. The seam holds only values that would otherwise land in a stored row. At verification time the inbound door resolves the seam row when one exists, and otherwise the bound definition's value.",
"B: Move at install or boot. Upsert every packaged flow's literal into the seam and bind without it, so the door has one source."
],
"recommendation": "A. Real business need: the defect the ruling closes is the at-rest row an administrator reads, and a packaged flow has no such row. The artifact still carries its literal after B, so B gains no secrecy. Long-term soundness: B needs a crypto provider at boot, and os serve wires one only after kernel:ready (serve.ts 5041, then 5074). Every packaged hook would then start disarmed and re-arm on provider registration, and would never arm on a host that has no provider. Preventing AI authoring mistakes: under A an author's defineFlow literal keeps meaning what it says; under B the source stays authoritative while a seam copy can drift from it. No scope creep at this stage: A adds nothing."
}
],
"out_of_scope_findings": [
"class: b · reach: exception: security (could leak data). This is source-read and not live-measured; no shipped example authors the key. · evidence: the http node's signing secret is a declared authorable key (FLOW_NODE_CREDENTIAL_KEYS, flow-credential-projection.ts 128-131). It is stored in the same flow row, per-version history row and audit snapshot as the inbound secret. #20585's landing record measured an administrator reading that row through the generic data door, and #20615 withholds the key on served definition reads only. Contract: the redactor registry's invariant that stored credentials must never serve cleartext (packages/spec/src/kernel/metadata-type-redaction.ts header). Seam: spec:HttpConfigSchema.signingSecret → runtime: service-automation's http node durable arm | the metadata store's flow row. It belongs to the same family and needs the same seam decision as #20790. It should ride #20790's redispatch if the maintainer extends the scope, or become a sibling that decision names; it is not a single-point card. · dedupe words: http node signingSecret at rest · outbound signing secret stored flow row · flow credential write-only seam",
"carrier: 承接者:无 · noted, not filed. Source-read: the /automation create, update and clone doors only register a flow in the engine (automation.ts 2257, 2549) and persist nothing. A flow authored there, and any clone, does not survive a restart. Whether that is by design was not established. It matters to Q2, because a clone door that persists nothing has no seam row of its own to write."
],
"deviations": [
"I read everything in full as ordered, except #20590's 32 comments. From #20590 I read the body and both landing PR bodies (#20615, #20672).",
"The branch was pushed empty as the claim's landing marker. It equals origin/main 4b45afa, and nothing else was pushed.",
"No PR, no changeset and no label write. The PR assignee, draft create and label budget went unused."
],
"cleanup": "The worktree objectstack-issue-20790 is clean (no edits). It is removed after this comment posts: rm -rf node_modules, then git worktree remove, with no --force."
}

---

Generated by Claude Code

[objectstack-fleet]

决策请求 · domain:services seat (#6021) · session_01XY5uCwTjZj7884yYtyur4H · 2026-09-30T10:20Z

⚠️ 披露纪律:本评论只按类别描述暴露面,不含任何请求、请求头、URL 或字段路径。实测细节只留在 dev 的私有暂存区。

背景

• dev 按派发令先测后改,写代码前停下(报告 5909210780)。前提成立:秘密今天确实落在存储面上,管理员经通用数据门读得到。
• 停下有两个原因:
  1. 实现必须经过 packages/metadata-protocol/src/protocol.ts。 每一次流程的元数据写入,都在同一个"沿用 → 写入"步骤里完成哈希与落盘;运行时发布闸门判断"哪个被隐去的凭据仍在",也只读这一处的存储体。PR fix(metadata-protocol): refusals, hints and log lines state each decision in words instead of a tracker number (stage 2) #20830([finding] runtime warnings outside the migration ledger print tracker numbers to authors and operators: the AutomationEngine resumeAuthority boot warning (#3801 / #5561 / #3823) and two objectql data-event warnings (#4639 / #4626) #20513 第 2 阶段,domain:engine)正持有这个文件,本卡认领已把它排除在外。所以无论怎么裁,执行都要等 fix(metadata-protocol): refusals, hints and log lines state each decision in words instead of a tracker number (stage 2) #20830 落地。
  2. 有四个分叉,您的裁决没有定到。 见下面 Q1–Q4。本席判定它们都在人工地板上:安全边界、难以回滚的动作、公开契约的形状、以及范围扩展。因此一次呈上,请一次裁清。

Governing text

• 您的裁决(本卡正文 "The ruling" 与 "Direction" 两节,2026-09-30「同意」):同一个密钥通道,不建第二套机制;不再逐门加隐去;定义里只留引用;一次性迁移并带 ADR-0087 处置;四个钉子。
• packages/spec/src/kernel/metadata-type-redaction.ts:5:「stored credentials must never serve cleartext」([security] GET /api/v1/meta/datasources still serves stored cleartext credentials — the metadata read path has no per-type redaction hook #8154 的安全不变量)。
• ADR-0126 §7.1:克隆是一个普通的兄弟产物,与本体没有记录关联。
• ADR-0008:元数据仓库与变更日志(历史行与存储行同一事务写入)。
• 协议声明:本卡不改 spec 契约。只有 Q2 选 B 时,才需要在 packages/spec 加一个契约方法(属 spec 车道)。

前提(每条带复核命令,裁决时可现跑)

• P1 写入口唯一:git grep -n "carryForwardRedactedCredentials" -- packages/metadata-protocol/src/protocol.ts,命中处之后紧跟 repo.put。
• P2 发布闸门只读存储体:git grep -n "private async restoredCredentialPathsFor" -- packages/metadata-protocol/src/protocol.ts。
• P3 fix(metadata-protocol): refusals, hints and log lines state each decision in words instead of a tracker number (stage 2) #20830 持有这两个文件:curl -s https://api.github.com/repos/objectstack-ai/objectstack/pulls/20830/files | grep -E 'protocol.ts|sys-metadata-repository.ts'。
• P4 加密提供者在 runtime.start() 之后才接上:grep -n "setCryptoProvider(sharedCryptoProvider)" packages/cli/src/commands/serve.ts。
• P5 克隆门复制整份定义、自身不落盘:git grep -n "structuredClone" -- packages/runtime/src/flow-clone.ts。

Q1 历史行与审计快照里的旧副本:擦除,还是要求轮换?

一句话问题: 迁移把密钥移出流程定义之后,这个流程过去每个版本的历史行里仍有这个密钥;若部署装了审计插件,审计账本的变更快照里也有。管理员今天和迁移之后都读得到。

选项 × 真实代价:

选项	做什么	客户可感知的后果
A 擦除	迁移同时改写该流程的所有历史行和审计快照,去掉密钥	审计与历史不再只追加;历史校验链要么断,要么留下可离线验证密钥的哈希
B 轮换不擦除	迁移只保证今后不再产生副本;按流程名逐一报告"迁移前已在存储面暴露,请轮换密钥",changeset 同样写明	旧值留在历史中,直到管理员轮换;轮换后旧值作废
C 两者都做	A + B	A 的全部代价,加上报告

业务直译:

• A 等于把已泄露过的钥匙从旧监控录像里抹掉。
• B 等于换锁:旧钥匙留在录像里,但开不了门。
• C 两样都做。

四轴(业务立场):

1. 长远: 两年后的平台应该是这样:凭据从不以明文落盘;一旦发现曾经落盘,标准动作是轮换,不是改写日志。GitHub 和 Stripe 对泄露 token 的处置都是"作废并重发"。B 保住审计只追加、单一写入点;A 要在引擎自有的两张表上再加两个写入者。
2. 业务拉动: 每个在 Studio 建的入站流程,从创建那天起,它的密钥就对所有管理员可读(fix(service-automation,metadata-protocol,metadata,runtime): withhold a flow's inbound-hook secret from every served definition, and keep it on a round trip (#20552) #20585 实测过主行;历史行与审计快照是源码读取,未实测)。擦除挽回不了已经发生的可读,只有轮换能。
3. 防 AI 犯错: 出错时谁看到什么?B 下,每个旧流程都有一条响亮的逐流程提示;A 下,擦除一旦漏掉一张表,就会静默残留,没人知道。
4. 不扩散: B 不新增写入者和表规则;A 把卡扩到两张表和审计插件的规则。

推荐:B。 回退是 C。

• 置信缺口:历史行与审计快照这两个副本是源码读出的,没有在组合启动上实测;生产部署是否装了审计插件,本席看不到(云仓不可读)。
• 自检:只看①选 B;②③④ 是否翻转:否。

Q2 克隆门遇到"密钥已进通道"的入站流程,怎么办?

一句话问题: 今天克隆一个入站流程,会把密钥原样复制进副本。迁移之后,定义里已经没有密钥可复制,引擎又拒绝没有密钥的入站流程,所以克隆门会直接报 400。

选项 × 真实代价:

选项	做什么	客户可感知的后果
A 响亮拒绝并给出处方	克隆门拒绝,并指明缺的是密钥;管理员经元数据面给副本配上自己的密钥	入站流程不能再"一步克隆"(收窄);不加新键
B 克隆体可带一个新密钥	克隆请求体新增一个可选密钥,写进副本自己的通道行	一步完成;但要在 packages/spec 加一个异步契约方法,并放宽克隆请求体
C 副本复制源的密钥进自己的通道行	两个钩子共用一把钥匙	无感知,但一个凭据同时开两扇门

业务直译:

• A 等于复印钥匙前先去前台登记新钥匙。
• B 等于复印时顺手刻一把新的。
• C 等于把同一把钥匙挂在两扇门上。

四轴:

1. 长远: 两年后,复制一个入站 webhook 应该得到一把新密钥,就像 GitHub 复制 webhook 要重新填 secret。A 与 B 都做到每门一钥:A 不新增契约面,B 新增一个契约方法和一个键;C 违背每门一钥。
2. 业务拉动: 克隆门服务于 ADR-0126 §7.1 的打包流程定制,而打包入站流程的密钥在产物里(见 Q3),不受影响。受影响的只有 Studio 建的入站流程。本仓示例、文档、skill、客户端 SDK 调用克隆门:0 处(正对照:运行时源码 3 处)。Studio 的调用方在另一仓,未读。
3. 防 AI 犯错: A 是响亮拒绝并给出处方;C 是静默共享凭据;B 放宽了接受集。
4. 不扩散: A 最小。

推荐:A。 回退是 B。

• 置信缺口:Studio 是否依赖一步克隆入站流程,未测。
• 自检:只看①选 A;②③④ 是否翻转:否。

Q3 打包(代码编写)的流程也迁进通道吗?

一句话问题: 打包流程的密钥写在包产物里,也就是作者的源码。它没有存储行,除非有人存了一个覆盖行;而覆盖行会走 P1 的写入口,自动被覆盖。裁决说"只在入站门验签时解析",这是否要求所有流程只有一个来源?

选项 × 真实代价:

选项	做什么	客户可感知的后果
A 不纳入	通道只收"否则会落进存储行"的值;入站门验签时有通道行就用通道行,没有就用已绑定定义里的值	打包流程行为不变
B 安装或启动时迁入	把每个打包流程的字面量写进通道,绑定时去掉	每个打包钩子启动时都要等加密提供者就绪才能挂上;没有提供者的主机上永远挂不上

业务直译:

• A 等于写在说明书里的密码仍以说明书为准。
• B 等于每次开机都把说明书上的密码抄进保险箱,而说明书还在。

四轴:

1. 长远: 本卡要关的缺陷,是管理员能读的存储行;打包流程没有这种行。B 之后产物照样带着字面量,保密性没有任何提升,反而多了一个可能与源码漂移的副本。更长远的方向,是打包流程不写字面密钥(改为凭据引用),那是另一张卡。
2. 业务拉动: B 在 os serve 上会让所有打包入站钩子先断后续(P4)。
3. 防 AI 犯错: A 下,作者在 defineFlow 里写的字面量含义不变;B 下,源码权威与通道副本可能不一致。
4. 不扩散: A 不新增任何东西。

推荐:A。 回退是 B。

• 置信缺口:控制面的包存储在另一仓,是否在通用数据门后面存有产物体,未测。
• 自检:只看①选 A;②③④ 是否翻转:否。

Q4 出站 http 节点的签名密钥:并入本卡,还是另立?

一句话问题: 流程里的出站 http 节点签名密钥,与入站密钥存在同一个存储行、同一个历史行、同一个审计快照里,管理员同样读得到。#20615 只在对外读取时隐去它。您的裁决只点名了入站密钥。

选项 × 真实代价:

选项	做什么	客户可感知的后果
A 并入本卡	写入口按 #20552 的凭据位置表工作,两个位置一起迁,钉子各一套	一次关掉同族的两个暴露;本卡范围扩大一行表加一套钉子
B 另立兄弟卡	本卡落地后复用同一写入口	出站密钥在此期间继续可读
C 只记入 Acceptance notes	不修	暴露长期存在

业务直译:

• A 等于同一次换锁把后门也换了。
• B 等于先换前门,后门排下周。
• C 等于后门不换。

四轴:

1. 长远: 一个通道收全部流程凭据,写入口按表驱动。A 不产生特例;B 需要为同一写入口走第二轮改动。
2. 业务拉动: 同一批管理员今天就读得到;本仓示例没有作者写这个键(源码读取,未实测)。
3. 防 AI 犯错: A 下,凭据表是唯一的清单,新增凭据位置时自动被覆盖;B 或 C 下,两个位置行为不一致。
4. 不扩散: 这是关闭同族的安全缺口,不是新能力。

推荐:A。 回退是 B。

• 置信缺口:出站密钥的历史与审计副本同 Q1,属源码读取。
• 自检:只看①选 A;②③④ 是否翻转:否。

裁后执行

1. 裁决到手后,本席在本卡同一分支上重新认领。文件面加入 protocol.ts 的写入口与闸门集合(必要时加 sys-metadata-repository.ts 的恢复路径),向 domain:engine 席发跨车道通知,并等 PR fix(metadata-protocol): refusals, hints and log lines state each decision in words instead of a tracker number (stage 2) #20830 落地后派发。
2. 派发令逐字引用您的字母选择,四个钉子按所选选项收紧:Q1 选 B 时,"无读面返回密钥"对迁移后写入或轮换的值成立;Q4 选 A 时,再加出站一套。
3. Clause-② 按 dev 实测:加密提供者缺席时收窄,Q2 选 A 时克隆门收窄,绑定接口加一个解析成员。预期为 yes (narrowing),落地前由达档契约复核确认。

os-decision-facets

• ① 项目长远合理性:只用一个密钥通道、一个写入口,不建第二机制;Q2 选 A 不新增契约面,Q4 选 A 由凭据表驱动、不留特例。
• ② 实际业务拉动:今天每个 Studio 入站流程的密钥对管理员可读(主行已实测);克隆门在本仓零调用方(Studio 未读)。
• ③ 防 AI 犯错:缺密钥即响亮拒绝(引用缺省即关闭),不静默共享、不静默丢弃,旧流程逐个响亮提示轮换。
• ④ 创业阶段不扩散:Q1-B、Q2-A、Q3-A 都不新增表写入者或契约键;Q4-A 是同族收口,不是新能力。
  Prior rulings read: scrub,rotate,clone,packaged,history,audit → 33 hits; ADR-0094 D5, ADR-0005 Decision §5, ADR-0029 D6/D9/D9.4/D9.7/D9.9, ADR-0033 Decision §10, ADR-0035 Decision §3, ADR-0041 Decision §4 — each a single-term match on another subject, none answers Q1–Q4; thread: none
  推荐:Q1 B · Q2 A · Q3 A · Q4 A。自检:只看①选 B/A/A/A;②③④ 是否翻转:否。
  置信缺口:历史行、审计快照与出站密钥的副本均为源码读取,未在组合启动上实测;Studio 与云端包存储不可读。

回批一行即可,例如 Q1 B · Q2 A · Q3 A · Q4 A。

Release: session session_01XY5uCwTjZj7884yYtyur4H. The cause is four forks the ruling does not settle (Q1–Q4 above), plus a file (protocol.ts) that open PR #20830 holds. The card moves to needs-user-decision, and the assignee is cleared in the same act. It is re-claimed on this branch (claude/issue-20790-flow-hook-secret-seam, pushed empty at 4b45afae) after the ruling, once PR #20830 has landed.

---

Generated by Claude Code