security(datasource): credential-shaped values in some datasource configurations are stored and served without the platform's secret handling — detail withheld pending maintainer

[objectstack-fleet]

Found while verifying a candidate from the 17.7 pre-release console run #21784 (integration-system area, outside the item's clauses), by an independent verifier (RUNNER rule 7) on current main.

• Class: secret hygiene. For some datasource configurations, credential-shaped values are kept at rest and served on admin reads without going through the secret store or redaction the platform applies elsewhere. Reachable only by platform administrators; no lower-privilege read was found. Under RUNNER rule 2 the detail is withheld pending maintainer, held in the PM session (Claude Code session session_018zT8d8NpiQ1ExhuNd5TxY6).
• Direction: credential-shaped datasource values go to the secret store (or are refused at write, as other configurations already are), and every read door redacts them.
• Severity as judged by the verifier: P2. Predates 17.6.0. Related, closed: [security] Stored datasource credentials are served unredacted to an admin through a read path outside the two datasource read doors — detail withheld pending maintainer #21086, [security] datasource credential in a nested config position is served in cleartext on read — redaction is top-level-key-only #13405, mongo options.autoEncryption.kmsProviders secret material (CSFLE: secretAccessKey / privateKey / clientSecret / local.key) is not on passthroughSecretPaths and is served cleartext on datasource reads #13602.
• Owning repo: objectstack. No open card covers it.

---

Generated by Claude Code

[objectstack-fleet]

Path: an API a customer can call — external data; secrets can be neither written in nor read out | integration-system.datasource-credential-refusal-matrix | P2

Triage: first grade — bug · security · priority:p2 · domain:services · area:access · pm:queue. Credential-shaped datasource values follow the platform's secret handling on write and on every read

Triage seat (objectstack-wide, seat post #6015) · session_01AavokzJ5DndAwitDXvKy4U · 2026-10-05T07:54Z. ⛔ Not a claim, ⛔ not a dispatch. ⛔ Classes and positions only. The withheld detail stays withheld (RUNNER rule 2); this seat does not hold it.

Triage: lands in the datasource configuration's write and read doors (service-datasource, by class) ⇒ domain:services; rationale: other configurations already refuse or store such values as secrets, and these do not.

• Direction, as the card states (no boundary moves):
  • credential-shaped values go to the secret store, or are refused at write as other configurations already are;
  • every read door redacts them;
  • ⛔ no second redaction helper: reuse the one the refusal matrix already uses.
• Why p2. The verifier graded it P2. It is reachable by platform administrators only, and no lower-privilege read was found. It predates 17.6.0. Related, closed: [security] Stored datasource credentials are served unredacted to an admin through a read path outside the two datasource read doors — detail withheld pending maintainer #21086, [security] datasource credential in a nested config position is served in cleartext on read — redaction is top-level-key-only #13405, mongo options.autoEncryption.kmsProviders secret material (CSFLE: secretAccessKey / privateKey / clientSecret / local.key) is not on passthroughSecretPaths and is served cleartext on datasource reads #13602.
• The withheld detail goes to the claiming seat from session_018zT8d8NpiQ1ExhuNd5TxY6 on the maintainer's word.

---

Generated by Claude Code

[objectstack-fleet]

Claim: PM loop round 1 (17.7 pre-release follow-up, dispatched on the maintainer's direct order)
Session: session_018zT8d8NpiQ1ExhuNd5TxY6
Account: hotlong (the seat's linked user as GET /user answers it; always the card's assignee)
Branch: claude/issue-21840-datasource-secret-keys
Worktree: objectstack-issue-21840
Domain: domain:services (card label, as triage set it)
File surface: packages/spec/src/data, packages/services/service-datasource/src, packages/qa/dogfood/test, .changeset/
Container & model: M, mode:subagent, model: opus (default tier; no path-derived mandate)
Clause-②: no
Thread-read: 5990389094
Serial constraints cleared: none named

Provenance: the maintainer, in Claude Code session session_018zT8d8NpiQ1ExhuNd5TxY6, 2026-10-05, verbatim: 「都开单派发」; landing per the standing order 「开发完整就进队列合并」. Dispatched one at a time within the session's load cap. Where the card withholds detail, this session holds it and the dispatch carries it privately.

---

Generated by Claude Code

[objectstack-fleet]

os-dev-report

{
  "issue": 21840,
  "status": "done",
  "branch": "claude/issue-21840-datasource-secret-keys",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/21877",
  "session": "session_018zT8d8NpiQ1ExhuNd5TxY6",
  "premise_still_valid": true,
  "summary": "Premise confirmed on origin/main 9f9510f25e: for a datasource whose driver ships no config contract, the write door judged nothing and the read redactor withheld only the canonical credential spellings and URL credentials. Fix, class-level: one name predicate in packages/spec/src/data/driver/common.zod.ts judges credential-shaped config keys (and connection-string credential segments) for contractless drivers only; DatasourceSchema refuses that material at publish with the bound-secret remedy, and the single existing redactor redactDatasourceConfig withholds it, so every read door that already routes through it (meta, admin, data door, history, audit and activity copies) is covered with no second helper. Option chosen for (b): refuse at write, not route to the secret binder, per ADR-0015 section 10 and ADR-0062 D3: nothing says which key a contractless factory reads, so a silent move into the single bound secret would break the connection quietly (the reasoning the credential-migration planner already encodes); known-driver behaviour unchanged at both doors. Environment placeholders, empty strings, non-string values and array data stay accepted, which keeps the existing contractless-placeholder boundary pins green. The credential-migration planner in service-datasource now reports such keys as residue instead of nothing-to-migrate. Draft PR open, assignee mirrored from the card; no labels written (the dispatch named none and skip-changeset does not apply). File surface beyond the claim: one new ADR anchor, scripts/adr-anchors/packages__spec__src__data__datasource.zod.ts.json (AGENTS.md directive 13), plus the regenerated packages/spec api-surface and export-origins shards.",
  "tests": "HEAD 6a4fb54fca. spec: new src/data/datasource-contractless-credentials.test.ts 164 passed; spec src in three batches 121 files 4084 tests, 257 files 6630 tests, 188 files 6226 tests, all passed. service-datasource: new __tests__/datasource-contractless-credentials.test.ts; whole package 38 files 730 tests passed. dogfood: new test/datasource-contractless-credentials.dogfood.test.ts on the showcase boot with admin routes and AuditPlugin mounted as os serve mounts them, cold boot on one db file: write doors refuse (422 INVALID_METADATA naming six positions; admin create 400), clean body saves, ten read doors serve a seeded pre-refusal row with a positive-control marker and no credential, audit copy and its data door clean: 4 of 4 passed. Consumer suites: metadata-protocol redaction 4 files 76 tests, plugin-audit stored-metadata 2 files 24 tests passed. Typecheck spec, service-datasource, dogfood green. Ablation (fix committed first): ablation-replace on the read-side contractless switch, anchor 1 to 0, blob 61116efee71e to a17509115dbd, spec rebuilt, dist preflight marker in 8 built files; dogfood went 2 failed 2 passed (8 read doors and the audit copy red, write test green as expected); restore blob 61116efee71e, git diff HEAD empty, rebuilt, preflight --absent over 228 files, tree clean. Gates: dispatch-gates --ran 98 derived, 97 run, 1 NOT MEASURED; check:generated green after regenerating api-surface and export-origins (four new exports); check:type-check-debt re-measure green; check-adr-0087-registration green (not-required no-migration-prescription). Lint narrowed: eslint --no-inline-config --format json over the 7 changed source files, 7 files 0 errors 0 warnings, each in the config population via --print-config, no type-aware linting in eslint.config.mjs so untouched files cannot move. NOT MEASURED: check:dual-build-cjs-loads, reason PREREQUISITE NOT MET (eight unrelated packages unbuilt in this worktree). NOT MEASURED: packages/spec/scripts tests (55 files, no diff path), reason exceeded the foreground window behind the shared lock. Both declared to CI.",
  "mcp_calls": "0",
  "api_writes": "3 — fleet relay repository_dispatch POSTs, each executed as objectstack-fleet[bot]: pr_create (POST /repos/objectstack-ai/objectstack/pulls, draft), label-write assign (POST /repos/objectstack-ai/objectstack/issues/21877/assignees hotlong), this os-dev-report comment (POST /repos/objectstack-ai/objectstack/issues/21840/comments). git push is not REST.",
  "open_questions": [
    {
      "question": "Clause-② line: the claim carries Clause-② no, while the diff adds four public spec exports and narrows the DatasourceSchema accept set for contractless drivers. The changeset and the PR body carry Clause-② yes (narrowing), with spec minor and a not-required ADR-0087 disposition.",
      "options": [
        "A keep yes (narrowing) as written",
        "B rewrite to match the claim"
      ],
      "recommendation": "A, because the dispatch asked for an accurate line and both facts (new exports, narrowed accept set) are true; the changeset gates read it green."
    },
    {
      "question": "A contractless plugin driver that needs more than one secret has no remedy for the second after this refusal: the datasource secret binder fills exactly one slot.",
      "options": [
        "A accept as the existing one-slot limit and record it",
        "B open a decision on a multi-slot binder contract"
      ],
      "recommendation": "A for this card (no driver in this repository is contractless, and the limit predates the change); B only if a real multi-secret plugin driver is named."
    }
  ],
  "out_of_scope_findings": [
    "carrier: none (承接者:无) · noted, not filed: the verify harness mounts the datasource admin service but neither its REST routes nor an audit writer, so the dogfood file mounts both itself the way os serve does; observation only, recorded in the dogfood file header.",
    "carrier: none (承接者:无) · noted, not filed: on a legacy contractless row that still holds a credential, an admin edit that changes config carries the withheld value forward and is then refused; sending that key as an empty string clears it; recorded in the PR Acceptance notes."
  ]
}

---

Generated by Claude Code

[objectstack-fleet]

Correction to the claim above: Clause-②: yes (narrowing), not no.

PR #21877 does two things to a published surface. It adds four exports to @objectstack/spec (the credential-key predicate and the connection-string helpers), which widens the surface. It also narrows DatasourceSchema's accept set: for a driver that ships no config contract, credential material in config that used to publish is now refused. That narrowing is BREAKING. The changeset grades spec minor, carries the BREAKING banner and the ADR-0087 not-required (no-migration-prescription) marker, and the PR is titled fix(spec)!:. A contract-tier review is owed on the PR head. No other part of the claim changes.

---

Generated by Claude Code

[objectstack-fleet]

os-dev-report

{
  "issue": 21840,
  "status": "done",
  "branch": "claude/issue-21840-datasource-secret-keys",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/21877",
  "session": "session_018zT8d8NpiQ1ExhuNd5TxY6",
  "premise_still_valid": true,
  "summary": "Round 2 on the security review, head 97f650b73c (from 6a4fb54fca). The contractless judgment moved into one walk in a new module, packages/spec/src/data/driver/contractless-credentials.ts (findContractlessCredentials over a word-based isCredentialShapedConfigKey), and both doors read it: DatasourceSchema refuses every finding, redactDatasourceConfig withholds every finding, so the doors are symmetric by construction (pinned: refused set equals redacted set, and the served shape is accepted). All seven review items addressed, contractless drivers only: (1) arrays are walked and their object elements judged by key, plus name/value header pairs; plain row data stays accepted; (2) whole-key word judgment with the added stems, plural and value/pem/json qualifiers, service-account key material, descriptor and flag/measure exclusions; (3) URL property tails, libpq keyword/value strings and scheme-less userinfo; (4) only the upper-case env-name placeholder grammar is exempt; (5) numbers and arrays under credential keys are refused, booleans are flags, a subtree past the depth cap is refused; (6) descriptor and identity leaves inside a credential-shaped object are not refused; (7) after a dropped segment, following segments go with it until a known connection-string keyword. restoreRedactedConfig in service-datasource now restores array positions by index; the migration planner reads the same walk. Changeset rule text rewritten to match the code. PR body not edited. The old predicate block in common.zod.ts is gone (that file is back to its main-branch content).",
  "tests": "HEAD 97f650b73c. spec: src in two batches, 283 files 8751 passed + 1 todo, and 283 files 8235 passed; the rewritten contractless test file covers every item in both directions. service-datasource: 38 files 733 passed (adds array restore and author-changed / author-removed controls). dogfood datasource-contractless-credentials: 4 of 4 passed (fixture extended with an array-element password and an Authorization header pair; write door names 8 positions; 10 read doors and the audit copy clean, positive controls present). metadata-protocol redaction 4 files 76 passed; plugin-audit stored-metadata 2 files 24 passed. Typecheck spec, service-datasource, dogfood green. check:generated green after regenerating api-surface and export-origins (8 new export entries). check:type-check-debt re-measure green. dispatch-gates --ran: 98 derived, 97 run, 1 NOT MEASURED. Narrowed lint: eslint --no-inline-config --format json over the 9 changed source files, 0 errors 0 warnings. Ablation (committed first, ablation-replace on the array-element walk): the first two attempts were no-ops caught by ablation-dist-preflight (the bundler dropped both side-effect-free marker spellings; nothing ran on them); the third, a call-shaped marker, landed (blob ef73faca1ac9 to bc838a1a501b, marker in 20 built files) and the dogfood file went 3 red of 4 (write positions missing the array ones; read doors leaking the array-element secret; audit). Restore: blob back to ef73faca1ac9, git diff HEAD empty, rebuilt, preflight --absent over 228 files, tree clean, dogfood 4 of 4 again. NOT MEASURED: check:dual-build-cjs-loads, reason PREREQUISITE NOT MET (unrelated packages unbuilt). NOT MEASURED: packages/spec/scripts tests, reason exceeded the foreground window behind the shared lock. Both declared to CI.",
  "mcp_calls": "0",
  "api_writes": "1 — fleet relay repository_dispatch, executed as objectstack-fleet[bot]: this os-dev-report comment (POST /repos/objectstack-ai/objectstack/issues/21840/comments). git push is not REST.",
  "open_questions": [
    {
      "question": "The metadata save door's carry-forward restores a withheld value inside an array only by element id. A legacy contractless row that still stores a credential inside an array element without an id loses it on an untouched metadata-door save of the served body. The admin edit door restores by index and is not affected. Such a value is now refused at write anyway.",
      "options": ["A accept: the credential has to be rebound through the secret anyway; state it in the changeset", "B follow-up card: let the datasource carry-forward restore by index, in metadata-protocol"],
      "recommendation": "B as its own card, because the file is outside this card's surface and the change touches a shared carry-forward path; A meanwhile."
    },
    {
      "question": "Placeholder grammar: the repo has no runtime environment-placeholder grammar (the spec's refusal treats any dollar-brace span as a placeholder). The exemption uses the review's upper-case env-name grammar.",
      "options": ["A keep the upper-case grammar", "B widen to mixed case"],
      "recommendation": "A, because every placeholder fixture in the repo is upper case and the review asked for that grammar."
    }
  ],
  "out_of_scope_findings": [
    "carrier: none (承接者:无) · noted, not filed: the metadata-door carry-forward point in open_questions[0]; it belongs with whoever next touches packages/metadata-protocol/src/metadata-redaction.ts."
  ]
}

---

Generated by Claude Code

[objectstack-fleet]

os-dev-report

{
"issue": 21840,
"status": "done",
"branch": "claude/issue-21840-datasource-secret-keys",
"pr": "#21877",
"session": "session_018zT8d8NpiQ1ExhuNd5TxY6",
"premise_still_valid": true,
"summary": "Round 2 resumed after a container restart; head is 5c95e43, one commit on top of 97f650b. I checked all seven review asks against the code. 2, 4, 5 and 6 were already done. 1, 3 and 7 had gaps: some credential shapes inside strings were detected but not fully redacted, and a list of [name, value] header tuples was not walked. The new commit closes those gaps in the one shared walk, so the write door and the read door change together. It also stops one-word keys matching on a substring, stops a stem that already ends in s from taking a plural s, and stops the read door shifting array siblings when it drops an element. The changeset's rule text is rewritten to match the code clause by clause. Nothing was judged infeasible. The PR body was not edited and is now stale; see open_questions.",
"tests": "All runs are against the tree that was pushed as 5c95e43. Spec suite in two batches: 178 files / 6495 tests passed, then 616 files / 18656 tests passed (1 todo each); together that is all 794 spec test files. service-datasource: 38 files / 734 tests passed, typecheck green. metadata-protocol: 214 files passed, 3 skipped / 27745 tests passed, 19 skipped. plugin-audit: 39 files / 630 tests passed. The dogfood contractless file: 4 of 4 passed (built closure, dist-resolved). Spec typecheck green (test layer within its debt ledger). check:generated: all 15 artifacts up to date, no api-surface change. Ablations ran on the committed tree through scripts/ablation-replace.mjs, which verified each anchor hit 1 to 0 on disk. (1) Removing the array-element recursion turned 5 tests red: the write-door array, inverted-pin and tuple cases, and two read-door cases. (2) Removing bearer from the last-word stems turned 2 tests red: the predicate case and the write-door case. Each restore was proven: blob equals the HEAD blob 2bb9373623e1 and git diff HEAD is empty. dispatch-gates --ran: 98 derived, 97 run with exit 0, 1 NOT MEASURED. The NOT MEASURED one is check:dual-build-cjs-loads, exit 3: it needs a full repo build. check:type-check-debt timed out on the first pass and passed on a second run with a longer budget. The tree was 13 commits behind origin/main when pushed; main was not merged in.",
"mcp_calls": "0",
"api_writes": "2 — git push of the branch (not REST); POST issues/21840/comments for this report via scripts/pm/post-stamped.mjs",
"open_questions": [
{
"question": "The PR body is from round 1. It still says non-string values and array data are accepted, and it describes the read door as a separate predicate. That is now wrong. I was told not to edit the body, so it needs the seat's rewrite.",
"options": ["A seat replaces the Write door / Read door bullets with the changeset's refused-and-accepted lists and updates the test counts", "B leave the body as is and let the changeset be the description of record"],
"recommendation": "A, because reviewers read the PR body, and right now it contradicts the code and the changeset."
},
{
"question": "The placeholder exemption only accepts upper-case environment names. Directive 9 env vars are upper-case. The repo's script-side env regexes also accept lower-case names. Which should the exemption accept?",
"options": ["A keep upper-case only (current; lower-case placeholders are judged as written)", "B accept the POSIX name grammar with lower-case letters"],
"recommendation": "A, because a value meant as a placeholder has the narrowest room to hide a literal secret, and the platform's own env names are upper-case."
}
],
"out_of_scope_findings": [
"carrier: none · noted, not filed — the scheme-less userinfo shape can catch a user:x@host-shaped value that is not a credential (for example a mailto-style string). No real config was measured carrying one. Lookup words: scheme-less userinfo, false positive, contractless",
"carrier: none · noted, not filed — a multi-word key whose first word is a plural credential stem but which names a service (secretsManager holding a provider name) is judged credential-shaped. Over-refusal, not a leak. Lookup words: secretsManager, credential-shaped, descriptor",
"carrier: none · noted, not filed — the shared RFC 3986 userinfo parse in driver/common.zod.ts ends the authority at the first slash, so an unencoded slash in a URL password is not read as userinfo. WHATWG clients parse it the same way, so it is not a working credential. Lookup words: urlUserinfo, slash in password"
]
}