Repository navigation
service-datasource: a runtime-origin or reconnected plugin-driver datasource loses the #27277 external-driver floor, because the connection service registers the datasource def without its driver id and unregisterDriver drops the stored one (epic #27261) #27666
Description
epic:#27261#1 · marchtian · session_017ihL2c5z3q4h8inrn5kwqV
Filing gate: ① fail-open of a refusal boundary owed by landed work (#27277, PR #27403 86edcaf8), escalated as must-fix class by the post-landing contract review 6502877381 (③). It sharpens the epic body's "P2 prerequisite" line, which this card now carries.
Reader: the epic PM (#27261) dispatches it in the epic subtree; the fix is in packages/spec/src/contracts/data-engine.ts (EngineDatasourceDef), packages/services/service-datasource/src/datasource-connection-service.ts (connect, reconnect's restoreOldPool) and an engine test.
Dedupe (open AND closed): "datasource reconnect unregisterDriver registerDatasourceDef driver id lost external driver floor" → 15 hits, none this defect (#12758 widened the def for credentialsRef, the same shape of fix).
reach: read on main, not measured live. needsExternalDriverFloor reads def.driver ?? stored.driver. DatasourceConnectionService.connect (:669) calls :829–870, reached from the admin plugin's update door ~:552) first calls registerDatasourceDef({ name, schemaMode, external }) with no driver (EngineDatasourceDef has no such key), and reconnect (engine.unregisterDriver(name), which deletes the stored def (engine.ts ~:9216). So a datasource built through the connection service, whose host-provided datasource-driver-factory supports a plugin driver id, is never floored, and nothing says so: a driver that ignores where would serve rows outside the caller's sharing/RLS scope, and remote write refusals would not map. Manifest datasources (registerApp → registerDatasourceDef(ds) with driver) keep the floor.
type: Bug
维护者速读
- 现象： 通过数据源管理（运行时创建或编辑后重连）接入的插件驱动外部数据源，不会挂上 objectql: virtual-object correctness floor —
applyDriverQueryInMemoryhelper, per-datasource row cap with a loud refusal,supportshonoured for plugin drivers, refusal-envelope mapping for driver failures (epic #27261 P1) #27277 的兜底层（行数上限、内存里重新过滤 where、写入拒绝映射），而且没有任何提示。 - 原因： 连接服务登记数据源定义时不带驱动 id，重连时引擎又把之前存的定义一起删掉，于是引擎判断「不是插件驱动」。
- 影响： 目前仓库内没有为插件驱动提供的驱动工厂，所以只有宿主自己注册了这类工厂时才会触发；一旦触发，忽略 where 的驱动可能越过共享/行级权限返回数据。
- 最小修法：
EngineDatasourceDef加可选driver，连接服务在 connect 和 restoreOldPool 都把record.driver传进去；补一个「unregister 再 connect」的引擎测试。 - 需要您做的： 无。
Task
-
EngineDatasourceDef(spec contracts) gains an optionaldriverid;DatasourceConnectionService.connectandreconnect's restore path passrecord.driver/ the previous driver id. - Pin: a plugin-driver datasource connected through the connection service is floored; after
reconnect(unregister, then connect) it is still floored; a built-in driver stays unfloored. - Riders from the same review (6502877381 ④, comment-only): the
EXTERNAL_ROW_CAP_EXCEEDEDledger row notes that it deliberately differs from the standardMAX_RECORDS_EXCEEDED(400, a caller-side limit) because the cap is a 422 on a valid query the remote's size makes unservable (ruling 6487532394); the "ADR-0015 Tier A" citations in the ledger row,external-driver-floor.tsandexternal-driver-errors.tscite the epic ruling instead. - The epic body's "P2 prerequisite" line points here.
Clause-②: yes (an optional key on a published spec contract) · Metadata-protocol: none. Touches packages/spec/src/**: owes a full Fable review and a CONTRACT_REVIEW_TIER record before landing.
Activity
objectstack-fleet commentedon Oct 29, 2026
epic:#27261#1 · marchtian · session_017ihL2c5z3q4h8inrn5kwqV
Claim: PM loop round 6 2026-10-29T16:53Z
Session:
session_017ihL2c5z3q4h8inrn5kwqV(epic PM); implementing card threadsession_017ihL2g7k5VYcPSfjeD6S2WAccount:
marchtianBranch:
claude/project-thread-7zzy6q(the card thread's platform-assigned branch — measured platform exception toclaude/issue-<n>-<slug>)Worktree:
objectstack-issue-27666Domain:
domain:serverSeat:
epic:#27261#1(epic PM; nodomain:*seat). Maintainer order, 田騏 2026-10-29T04:21Z: 「影响你的任务进度的，你都统一接管」File surface:
packages/spec/src/contracts/data-engine.ts(EngineDatasourceDef.driver?),packages/spec/src/api/error-code-ledger.zod.ts(theEXTERNAL_ROW_CAP_EXCEEDEDrow comment only),packages/services/service-datasource/src/**(connection service and tests),packages/objectql/src/**(engine test; citation lines only inexternal-driver-floor.ts/external-driver-errors.ts), generated references the spec change re-records,.changeset/**(stop on breach; explain in the report)Container & model:
S,mode:thread,model: default tier (dispatch-gates --tier: no path-derived mandate),effort: highClause-②: yes
Metadata-protocol: none
Responsibility: #27277 (PR #27403) keyed the floor on the datasource def's driver id but only the manifest path registers it; the post-landing record 6502877381 (③) found the runtime and reconnect paths
Thread-read: none
Premise: holds — on
origin/mainDatasourceConnectionService.connectregisters the def with nodriver, andObjectQL.unregisterDriverdeletes the stored def beforereconnectconnects again.Serial constraints: PR #27648 (#27471) edits
external-driver-floor.ts/external-driver-errors.ts; this card touches only citation lines there. Contract face (published spec contract +Clause-②: yes): a full Fable review and aCONTRACT_REVIEW_TIERrecord before landing.objectstack-fleet commentedon Oct 29, 2026
epic:#27261#1 · marchtian · session_017ihL2c5z3q4h8inrn5kwqV
Claim amendment · 2026-10-29T20:23Z
The card thread (
session_017ihL2g7k5VYcPSfjeD6S2W) stalled on the model quota after pushing its commit25b652f0toclaude/project-thread-7zzy6q. Per the maintainer's order (田騏 2026-10-29T19:39Z: 「你没有fable了，使用 opus开发完之后等契约复审」), the epic PM takes the card over in its own session.claude/project-thread-6ml89f(the epic PM's platform-assigned branch).25b652f0was picked onto it with one comment-line conflict resolved; the two other "ADR-0015 Tier A" citations in objectql were fixed in the same pick.session_017ihL2c5z3q4h8inrn5kwqV.yes (narrowing), with a BREAKING banner and an ADR-0087 marker on the changeset: the floor now engages on datasources a host's plugin-driver factory builds, which narrows their accepted reads and writes.CONTRACT_REVIEW_TIERrecord PASS on its current head.The file surface is unchanged.
objectstack-fleet commentedon Oct 29, 2026
epic:#27261#1 · marchtian · session_017ihL2c5z3q4h8inrn5kwqV
Landed · 2026-10-29T21:20Z
PR #27715 merged through the queue as
869fa76723ae8c9f15458d8ca7d431df9b2bff3b(headdf7e3c66; contract review PASS 6508089206 atCONTRACT_REVIEW_TIER, which also served as the full review of the spec change; seat ACCEPT 6508112693).EngineDatasourceDefcarries an optionaldriver, and the datasource-connection service names it on connect and on the keep-old-pool restore, so a plugin-driver datasource built or reconnected at runtime is floored like a manifest one. The review's should-fixes are #27727 (p3, by pull).