qa(checklist): add items for the security fixes landed in the 17.7 pre-release follow-up

[objectstack-fleet]

Requested by the maintainer in Claude Code session session_018zT8d8NpiQ1ExhuNd5TxY6, 2026-10-06 (「两张卡都开」).

The 17.7 pre-release runs (#21782, #21784, #21845) led to a set of security fixes. The platform checklist (docs/qa/platform-checklist/) has not caught up with the rules they introduced. A keyword pass over the checklist found these gaps. Each row names a rule, not a reproduction.

Fix	Checklist today	Item to add or extend
#21792 (keyed digest for secret settings, PR merged)	no item	the settings audit trail stores no digest of a secret-valued setting that a reader can match offline; a read-only holder sees no value
#21846 → #21872 (implicit account linking)	one item, older rule	an external sign-in does not link implicitly to an unverified local user; after an unlink, implicit sign-in does not re-link; an explicit, signed-in link still works; the platform IdP exception holds only on its OAuth path
#21839 → #21890 (share-link password)	items exist, new behaviour missing	no exit returns the stored hash; the password is accepted from the X-Share-Password header; public resolve and messages responses carry Cache-Control: no-store
#21835 → #21864 (public-form withdrawal, in flight)	withdrawal items exist, layering missing	an env-wide withdrawal is not re-opened by an org overlay; only an explicit false withdraws; a package's shipped false withdraws; the env-wide definition may open a package-closed form; the ruled known limit is recorded as a known gap
#21836 → #21879 (global search skips unreadable objects)	one item	add the two cases #21880 lists: row scope still narrows a searched object; a term present only in a field hidden from the caller yields no hit
#21867 → #21928 (run-state trigger record mask, in flight)	added by that PR	none, beyond confirming that it lands

Also re-check these two:

• integration-system.datasource-credential-refusal-matrix:
  • Steps A2 and A7 have been blocked by environment (an external database) in every run. Either supply the fixture recipe or record them as a known gap.
  • security(datasource): credential-shaped values in some datasource configurations are stored and served without the platform's secret handling — detail withheld pending maintainer #21840 was closed as not planned (ruling on decision: how a datasource driver with no shipped config contract keeps credentials out of metadata (declaration vs. key-name heuristic) #21921). Re-word any clause that expects the platform to judge credentials in a plugin driver's config: that is the plugin author's responsibility, per the docs note in docs(drivers): a plugin driver's config is its author's to keep free of credentials #21927.
• The checklist-accuracy notes in the QA run · follow-up: 6 previously unrun or published-only items (6/6) · 316be321 + 53021e3a · 2026-10-05 · 4 PASS / 0 PARTIAL / 2 FAIL / 0 BLOCKED / 0 NOT-RUN #21845 record: docs(qa): unblock 4 fixture-blocked checklist items and re-point the clauses run 21845 found mis-asserted #21891 handled the four unblocked items. Confirm the CLI note (the trailing npm install fails on a pnpm-installed scaffold) and the quorum N1 note were also applied.

Suggested method: the checklist-author skill, scoped to the PRs above, one items PR.

Done when every row above has an item or clause on main with its automated.ref or run steps, check:platform-checklist is green, and the two re-checks are resolved.

---

Generated by Claude Code

[objectstack-fleet]

Path: ③ verify: refuse the wrong loudly, admit the right — the platform checklist | 缺项 (the rows in this card's table) | P3

Triage: first grade — documentation · priority:p1 · domain:devx · pm:queue. It is release-linked: the checklist must cover the 17.7 security rules before 17.7.0 is verified

Triage seat (objectstack-wide, seat post #6015) · session_01AavokzJ5DndAwitDXvKy4U · 2026-10-06T01:55Z. ⛔ Not a claim, ⛔ not a dispatch.

Triage: lands in docs/qa/platform-checklist/ ⇒ domain:devx; rationale: these are checklist items for rules that are already merged. It is a docs disconnect, so it enters the queue under the triage rule that docs disconnects do.

• Why p1: the maintainer's standing rule is that release-priority work is p1. These items are how the 17.7 pre-release runs check the security fixes that 17.7.0 carries.
• Order inside the card:
  1. The merged fixes first: security(settings): an observation outside platform-core.settings-hub-roundtrip's clauses (settings audit trail) at 316be321e — detail withheld pending maintainer #21792, fix(plugin-auth)!: implicit account linking requires the standard local-ownership condition; unlink is honoured #21872, fix(plugin-sharing): share-link password never leaves the server, is stored with the platform slow hash, and is accepted in a header #21890 and fix(metadata-protocol): global search skips objects and fields the caller cannot read #21879.
  2. Then fix(rest,metadata-protocol): a public form's intake withdrawal at any metadata layer holds; layering can only narrow intake #21864's row once security(forms): a public-form setting at one metadata layer can re-open intake that another layer withdrew — 17.7 regression, detail withheld pending maintainer #21835 lands. That row's "known limit" item records the ruled gap (6005722623) as a known gap, not a failing item.
  3. fix(trigger-record-change)!: a record-change flow's trigger record carries the credential mask and omits internal fields #21928's row only confirms that its own PR added the item.
• The two re-checks: datasource-credential-refusal-matrix A2 and A7 either get a fixture recipe or are recorded as a known gap. Any clause that assumes security(datasource): credential-shaped values in some datasource configurations are stored and served without the platform's secret handling — detail withheld pending maintainer #21840's heuristic is re-worded to the ruled boundary (#21921, driver config is the plugin author's).
• Items state rules, not reproductions, and the withheld security detail stays out of the checklist.

---

Generated by Claude Code

[objectstack-fleet]

Claim: PM loop round 63
Session: session_01VDtqoecgES7ScQYGbFVDRv
Branch: claude/issue-21932-checklist-17-7-security (cut from origin/main 9dce635337)
Worktree: objectstack-issue-21932
Domain: domain:devx
Seat: domain:devx#1
File surface: docs/qa/platform-checklist/areas/*.json. Method: the checklist-author skill, scoped to the card's PRs, in one items PR.

This PR covers:

• the merged rows, in triage's order: security(settings): an observation outside platform-core.settings-hub-roundtrip's clauses (settings audit trail) at 316be321e — detail withheld pending maintainer #21792, fix(plugin-auth)!: implicit account linking requires the standard local-ownership condition; unlink is honoured #21872, fix(plugin-sharing): share-link password never leaves the server, is stored with the platform slow hash, and is accepted in a header #21890 and fix(metadata-protocol): global search skips objects and fields the caller cannot read #21879;
• both re-checks:
  • integration-system.datasource-credential-refusal-matrix: A2 and A7 get a fixture recipe or a known gap. Any clause that assumes security(datasource): credential-shaped values in some datasource configurations are stored and served without the platform's secret handling — detail withheld pending maintainer #21840's heuristic is re-worded to the ruled boundary (decision: how a datasource driver with no shipped config contract keeps credentials out of metadata (declaration vs. key-name heuristic) #21921: driver config is the plugin author's responsibility).
  • The QA run · follow-up: 6 previously unrun or published-only items (6/6) · 316be321 + 53021e3a · 2026-10-05 · 4 PASS / 0 PARTIAL / 2 FAIL / 0 BLOCKED / 0 NOT-RUN #21845 CLI and quorum N1 notes, confirmed as applied by docs(qa): unblock 4 fixture-blocked checklist items and re-point the clauses run 21845 found mis-asserted #21891.

Held, not in this PR:

• The fix(rest,metadata-protocol): a public form's intake withdrawal at any metadata layer holds; layering can only narrow intake #21864 row: security(forms): a public-form setting at one metadata layer can re-open intake that another layer withdrew — 17.7 regression, detail withheld pending maintainer #21835's PR is still open at the claim ref.
• The fix(trigger-record-change)!: a record-change flow's trigger record carries the credential mask and omits internal fields #21928 row: that PR adds its own item in automation.json, which open PR fix(trigger-record-change)!: a record-change flow's trigger record carries the credential mask and omits internal fields #21928 holds.

This PR is Part of #21932, and the card stays open for those two rows. Items state rules, not reproductions, and withheld security detail stays out.

Stop on a breach and explain it in the report. That includes a row whose rule cannot be grounded in the merged PR's tests or code, and a checklist gate that needs a non-checklist edit.
Container & model: M (several area files, one items PR), mode:subagent, model: opus
Clause-②: no
Thread-read: 6007733371
Serial constraints cleared: board read at 2026-10-06T02:52Z.

• Of the open PRs, only fix(trigger-record-change)!: a record-change flow's trigger record carries the credential mask and omits internal fields #21928 touches docs/qa/platform-checklist/**, and only automation.json, which this claim excludes.
• fix(rest,metadata-protocol): a public form's intake withdrawal at any metadata layer holds; layering can only narrow intake #21864 and fix(trigger-record-change)!: a record-change flow's trigger record carries the credential mask and omits internal fields #21928 are open, so their rows are held as above.

Priority rule 3 reading: this is the lane's only P1, and it is release-linked (17.7.0). docs/qa/** is not a review face, so skip-changeset applies and no contract review is owed.

---

Generated by Claude Code

[objectstack-fleet]

os-dev-report

{
  "issue": 21932,
  "status": "done",
  "branch": "claude/issue-21932-checklist-17-7-security",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/21943",
  "head_sha": "a72b827e431ba00765da70c52efbf3c0c02e7409",
  "session": "session_01VDtqoecgES7ScQYGbFVDRv",
  "premise_still_valid": true,
  "summary": "Draft PR #21943 is open (Part of #21932, not a closing keyword) with one commit, a72b827e43, touching docs/qa/platform-checklist/areas only: access-security, identity-auth, integration-system, platform-core and search. automation.json is untouched. It adds three items (platform-core.settings-audit-secret-fingerprint, identity-auth.implicit-account-linking-ownership, search.global-search-skips-unreadable) and extends two (access-security.share-link-capability-tokens rev 4 to 5; integration-system.datasource-credential-refusal-matrix rev 2 to 3). Every rule is grounded in merged code and tests, cited by symbol anchor and test-case name. Re-check 2 needed no edit. The #21864 and #21928 rows are held and listed in the PR body as remaining.",
  "rows": [
    "#21792 (the issue; the fix is PR #21809): NEW platform-core.settings-audit-secret-fingerprint, 6 clauses. Grounding: service-settings settings-service.ts#secretAuditDigest, config-change-audit.ts#CONFIG_CHANGE_ACTION, spec contracts crypto-provider.ts#keyedDigest. Pin settings-audit-secret-digest.test.ts (7 cases). 'A read-only holder sees no value' is written as: a reader of the audit rows who holds no server key finds neither the value nor an offline-reproducible digest. The check carries a positive control (the non-secret key's unkeyed digest IS found). The no-keyed-digest arm is pin-scored because a stock boot cannot reach it.",
    "#21872: NEW identity-auth.implicit-account-linking-ownership, 5 clauses: unverified local user gets no implicit link (error=account_not_linked, no sys_account row, stays unverified); a verified user still links; an unlink is honoured; an explicit signed-in link-social works, lifts the refusal, and does not verify an unverified user; the platform IdP exception holds only on the oauth method. Grounding: plugin-auth implicit-account-linking.ts#decideImplicitLink / #IMPLICIT_LINK_REFUSED / #PLATFORM_IDP_PROVIDER_ID / #recordUnlinkTombstone / #refuseImplicitAccountLink, plus docs sso.mdx. Pin implicit-account-linking.test.ts (named cases). Fixture: reuses linked-accounts-social's local OIDC provider recipe. The platform-IdP clause and the operator override are pin-scored (knownGaps).",
    "#21890: EXTENDED access-security.share-link-capability-tokens rev 5 with 3 clauses, 3 steps and 3 negatives; existing indices unchanged. (a) No exit (mint, list, redemption) carries password_hash. (b) The X-Share-Password header is accepted, the ?password= query form still works, and a CORS preflight allows the header. (c) Both public routes answer Cache-Control no-store and Vary X-Share-Password on every outcome, and the authenticated routes do not. Grounding: share-link-service.ts#withoutPasswordHash, share-link-routes.ts#SHARE_LINK_PUBLIC_RESPONSE_HEADERS, runtime share-links.ts#PUBLIC_RESPONSE_HEADERS, hono adapter.ts#DEFAULT_CORS_ALLOW_HEADERS, share-link-password.ts#hashShareLinkPassword. Pins: the [#21839] describe blocks in share-link-password.test.ts and share-links-public-cache-headers.test.ts, and the hono-plugin 'should allow X-Share-Password by default' case.",
    "#21879 (+ the two #21880 cases): NEW search.global-search-skips-unreadable, 5 clauses: an unreadable object is never queried, named or counted; objects= naming it answers identically to a nonexistent name; it stays 403 at its own door; row scope still narrows a searched object (#21880 case 1); a term only in a hidden field gives no hit (#21880 case 2). Grounding: metadata-protocol protocol.ts#searchAll (canReadObject pre-filter, getQueryableFields narrowing). Pins: dogfood search-skip-unreadable.dogfood.test.ts and 12 unit cases in protocol.search-skip-unreadable.test.ts. The two #21880 cases are grounded in the same code and the unit narrowing case, but have no end-to-end pin (knownGap). The open pinyin-companion finding on #21880 is a class-level knownGap: run with the flag off. Persona: area recipe qa-contributor-bound-member."
  ],
  "rechecks": [
    "Re-check 1, integration-system.datasource-credential-refusal-matrix rev 3. A2/A7 (acceptance[1] and acceptance[6]) have NO proven recipe, so they are recorded as a knownGap, not a recipe. What a run needs: a reachable, credential-protected postgres/mysql/mongo; the CI live-PG service shape is named as an example. What a run may not score from: publish success alone. What it can read without a database: the stored-credential half of A7, as a partial reading. Ruled boundary (#21921, docs #21927): acceptance[5], step 7, the unknown-driver negative and the title now state that for a contractless (plugin) driver only the fixed spellings are redacted (CANONICAL_CREDENTIAL_KEYS password/authToken, the former aliases, URL credentials), and that a non-canonical key served as written, or the write door accepting the config unvalidated, is the boundary and not a FAIL. Grounding: spec driver/common.zod.ts#CANONICAL_CREDENTIAL_KEYS and datasource-credential-redaction.ts#redactableConfigKeys, on main 9dce635337.",
    "Re-check 2: CONFIRMED applied by #21891 (merge 67c544cc), no edit. cli.scaffold-first-run rev 3 step 0 and cli.scaffold-console-first-paint rev 3 step 0 drop the trailing npm install and warn against it; their rev 3 history entries cite #21845; no npm install step remains in cli.json. approvals.quorum-m-of-n rev 4 negative[0] requires a NON-PRIVILEGED repeat actor and names the admin override (#3424) as never a distinctness FAIL."
  ],
  "held": [
    "#21864 row: its PR is still open",
    "#21928 row: that PR adds its own item in automation.json"
  ],
  "tests": "All at HEAD a72b827e43. (1) pnpm check:platform-checklist: EXIT=0. 'OK: 15 areas, 273 items (269 active, 2 planned) ... provisioning: 5 area recipes, 9 item references resolved ... symbol anchors: 674/684 resolved ... 10 on the named #16898 residual, 17 file floors held'. The baseline at 9dce635337 was 270 items and 657/667 anchors, so all 17 new anchors resolve. (2) dispatch-gates --commands --repo objectstack-ai/objectstack derived 13 commands; all 13 EXIT=0: check-ci-filter-parity, check-closing-keyword-parity (+ --self-test), check-comment-mask-corpus, lint check:doc-formula-expressions, check:cross-package-test-inputs, check:doc-authoring, check:driver-memory-census, check:gitlink-declared, check:nul-bytes, check:platform-checklist, check:refd-timer-probe, check:watch-hint-literal. doc-formula-expressions first exited 3 (PREREQUISITE NOT MET: formula and lint unbuilt). After building both under os-verify-lock (VERDICT command-exit 0) it exited 0. --ran reconciliation: 13 derived, 13 run, 0 NOT-MEASURED, 0 UNRUN. (3) No package source changed, so there is no build, test, typecheck or eslint owed. No ablation applies (data-only ledger edit).",
  "mcp_calls": "0",
  "api_writes": "3 — through the fleet relay (repository_dispatch, then executed as objectstack-fleet[bot]): pr_create POST /repos/objectstack-ai/objectstack/pulls (PR #21943, body read back byte-identical, 7437 bytes); label-write assign POST /repos/objectstack-ai/objectstack/issues/21943/assignees (baozhoutao, read back matching); this os-dev-report comment POST /repos/objectstack-ai/objectstack/issues/21932/comments. git push is not a REST write. No labels written: the claim says the PM adds skip-changeset.",
  "deviations": [
    "The dispatch asked for file:line citations. check:platform-checklist refuses any line-number pin, so citations are file#symbol anchors plus test-case names.",
    "The card's row says '#21792 ... PR merged'. #21792 is the issue; the merged fix is PR #21809. The item cites both.",
    "The first git push was refused by the pre-push hook because the commit message carried a 'Part of #21932' card line. The commit was amended (message only) before any push landed. The only pushed commit is a72b827e43."
  ],
  "open_questions": [],
  "out_of_scope_findings": [
    "carrier: none · noted, not filed. content/docs/data-modeling/drivers.mdx (the #21927 sentence) says a plugin driver's config is 'stored and served to administrators as written'. redactableConfigKeys still withholds password/authToken, the former aliases and URL credentials for a contractless driver. The docs are broader than the code, and the code is the more protective. The checklist follows the code. Not one of the three filing classes (no wrong answer at a public door); recorded in the PR's Acceptance notes."
  ]
}

---

Generated by Claude Code

[objectstack-fleet]

Landed (part): PR #21943 → 412d7dd024, verified on origin/main by content at 2026-10-06T03:44Z.

• All 5 files on main are blob-identical to the landing head a72b827e43: access-security.json, identity-auth.json, integration-system.json, platform-core.json and search.json. automation.json is untouched. There is no product file and no .changeset; skip-changeset applies.
• Rows delivered:
  • security(settings): an observation outside platform-core.settings-hub-roundtrip's clauses (settings audit trail) at 316be321e — detail withheld pending maintainer #21792 (fix PR fix(service-settings): the settings audit trail records secret-valued settings with the keyed digest #21809): new item platform-core.settings-audit-secret-fingerprint.
  • fix(plugin-auth)!: implicit account linking requires the standard local-ownership condition; unlink is honoured #21872: new item identity-auth.implicit-account-linking-ownership.
  • fix(plugin-sharing): share-link password never leaves the server, is stored with the platform slow hash, and is accepted in a header #21890: extended access-security.share-link-capability-tokens, rev 4 → 5, existing indices unchanged.
  • fix(metadata-protocol): global search skips objects and fields the caller cannot read #21879 with security(search): a field-narrowed search still matches through the name field's pinyin companion #21880's two cases: new item search.global-search-skips-unreadable. The two security(search): a field-narrowed search still matches through the name field's pinyin companion #21880 cases have no end-to-end pin yet, which is recorded as a known gap.
• Re-check 1: integration-system.datasource-credential-refusal-matrix, rev 3.
  • A2 and A7 are recorded as a known gap: no fixture recipe is proven, and both runs were blocked by environment.
  • The plugin-driver clauses are re-worded to the decision: how a datasource driver with no shipped config contract keeps credentials out of metadata (declaration vs. key-name heuristic) #21921 boundary.
• Re-check 2: confirmed applied by docs(qa): unblock 4 fixture-blocked checklist items and re-point the clauses run 21845 found mis-asserted #21891, with no edit. The trailing npm install is dropped in both cli.* items, and quorum negative[0] requires a non-privileged repeat actor.
• Gates (dev, at the head):
  • check:platform-checklist OK: 273 items, with all 17 new symbol anchors resolving.
  • 13 of 13 derived dispatch gates exited 0.
  • CI was green, and the merge queue passed.

Still open on this card:

• the fix(rest,metadata-protocol): a public form's intake withdrawal at any metadata layer holds; layering can only narrow intake #21864 row (public-form withdrawal layering, card security(forms): a public-form setting at one metadata layer can re-open intake that another layer withdrew — 17.7 regression, detail withheld pending maintainer #21835), whose PR is still open;
• the fix(trigger-record-change)!: a record-change flow's trigger record carries the credential mask and omits internal fields #21928 row (card security(automation): a paused flow run's stored state keeps record-change values that #21830's mask removes elsewhere — detail withheld pending maintainer #21867), whose PR adds its own item.

Blocked-by: #21835, #21867

Noted, not filed: content/docs/data-modeling/drivers.mdx says a plugin driver's config is "served to administrators as written". redactableConfigKeys still withholds the canonical credential keys and URL credentials, so the code is more protective than the sentence. The checklist follows the code.

pm:dispatched → pm:blocked.

Seat domain:devx#1 · session_01VDtqoecgES7ScQYGbFVDRv

---

Generated by Claude Code

[objectstack-fleet]

Triage: unlocked — pm:blocked → pm:dispatched. Both blockers have closed, and the claim and assignee stand

Triage seat (objectstack-wide, seat post #6015) · session_01AavokzJ5DndAwitDXvKy4U · 2026-10-06T04:59Z. ⛔ Not a claim, ⛔ not a dispatch. The state goes back to what the seat set before its own block (6008901276).

• security(forms): a public-form setting at one metadata layer can re-open intake that another layer withdrew — 17.7 regression, detail withheld pending maintainer #21835 closed completed through PR fix(rest,metadata-protocol): a public form's intake withdrawal at any metadata layer holds; layering can only narrow intake #21864 (merged 2026-10-06T04:44Z). The public-form withdrawal row can now be written against what landed, with the ruled known limit (6005722623) recorded as a known gap.
• security(automation): a paused flow run's stored state keeps record-change values that #21830's mask removes elsewhere — detail withheld pending maintainer #21867 closed completed (2026-10-06T03:55Z). Its row only confirms that PR fix(trigger-record-change)!: a record-change flow's trigger record carries the credential mask and omits internal fields #21928's own item landed.
• The p1 stands: the remaining rows close the 17.7 checklist before 17.7.0 is verified.
• The seat's "noted, not filed" doc mismatch (drivers.mdx vs redactableConfigKeys) is carded by triage in this round as docs(drivers): the plugin-driver paragraph says config is "served to administrators as written", but the read path still withholds the canonical credential keys and URL credentials for every driver #21950, so this card stays checklist-only.

---

Generated by Claude Code