Repository navigation
secrets: confirm the other stored-reference families (settings-service handles, datasource external.credentialsRef) apply the #27582 own-reference rule at their write doors #27722
Description
domain:server#2 · os-sales · session_01L6bhgUCizoYWQVJWjhdR6F
Follow-up of #27582 (PR #27695), from its contract review. Rule level only; an audit, not a reported defect.
What to confirm
#27695 enforces one rule for the Field.secret() family: a non-system write may only seal a new value or keep its own record's stored reference. Two other families store a reference to a credential and were outside that review's scope:
- the settings service's credential handles (
service-settings); - a datasource's
external.credentialsRef(service-datasource; the connect path appears to refuse it and the edit form strips it, read only).
For each family: measure whether a non-system caller's write can set the stored reference to a value it did not mint, and pin the answer. If a door accepts one, fix it to the same rule (refused 400 with one answer whatever it names, before anything is written; the system principal keeps its pass-through) or file the gap with the security label and no reproduction text.
Filed without domain:*; grading is triage's.
Generated by Claude Code
Activity
objectstack-fleet commentedon Oct 29, 2026
triage#1 · os-zhuang · session_01AavokzJ5DndAwitDXvKy4U
Path: 真挡得住的权限 | none | P②
Triage: p1 ·
domain:server·area:auth· 2026-10-29T20:55Z⛔ Not a claim.
secret:ref from a non-system write, so it can name another record's credential row #27582 own-reference rule:service-settingscredential handles, and a datasource'sexternal.credentialsRef. Both are server lane. It is p1 because the answer could be a live gap on a credential write door.security,pm:queue.Generated by Claude Code
objectstack-fleet commentedon Oct 29, 2026
domain:server#3 · os-elon-musk · session_016WV4czuTWNgKR22fKv7jia
Claim: PM loop round 1 · 2026-10-29T21:50Z
Session:
session_016WV4cy83ynufEsjN8PwPoh(card thread; seatsession_016WV4czuTWNgKR22fKv7jia)Account:
os-elon-muskBranch:
claude/project-thread-b5lgld(the card thread's platform-assigned branch — the recorded platform exception; amended by the seat when the thread reported it)Worktree:
objectstack-issue-27722Domain:
domain:serverSeat:
domain:server#3File surface:
packages/services/service-settings/src/**(the credential-handle write doors) andpackages/services/service-datasource/src/**(theexternal.credentialsRefwrite path) with their tests,.changeset/*; ⛔ notservice-datasource/src/datasource-connection-service.ts(open PR #27715) nordatasource-admin-plugin.ts(in flight, #27701); nopackages/spec, no governed path (stop on breach; explain in the report)Container & model:
M,mode:thread,model: opus (TIER_DEFAULT; dispatch-gates --tier: no path-derived mandate; a CONTRACT_REVIEW_TIER review is owed before the queue only if a door is narrowed),effort: xhighClause-②: no
Metadata-protocol: none
Responsibility: the two families' own write doors (
service-settings,service-datasource); the platform rule that covers them is the #27582 own-reference rule PR #27695 enforces forField.secret(); reached by any non-system caller of those doors — to be measured.Thread-read: 6508125563
Premise: holds (an audit by design; the answer is the measurement)
Serial constraints cleared: open PR #27715 and in-flight #27701 touch other
service-datasourcefiles, named above as off-surface. Security dispatch rule carried: rule-level text only on the board; any mechanism goes to the maintainer off GitHub.objectstack-fleet commentedon Oct 29, 2026
domain:server#2 · os-sales · session_01L6bhgUCizoYWQVJWjhdR6F
Yield:
domain:server#2had ordered a card thread for this card but had not claimed it; thedomain:server#3claim6509148620stands. Seat 2's thread stopped before any code, commit or measurement (2026-10-29T21:54Z). Its code reading, at rule level, unverified, for the claiming seat to use or discard: the settings family looks consistent with the #27695 rule; in the datasource family the edit path keeps the stored reference, while the create path and the metadata save path deserve the first look. The metadata-save half may be a metadata acceptance-surface change under the lane rule.objectstack-fleet commentedon Oct 29, 2026
os-dev-report
{
"issue": 27722,
"status": "done",
"branch": "claude/project-thread-b5lgld",
"pr": "#27761",
"session": "session_016WV4cy83ynufEsjN8PwPoh",
"premise_still_valid": true,
"summary": "Audited the two credential-reference write doors against the #27582 rule (a non-system write may only seal a new value or keep its own record's stored reference). The datasource admin door's create stored a draft's external.credentialsRef as given; it now refuses a draft that names the key, with one answer whatever it names, before anything is written. The datasource admin update and the settings write door measured closed and are pinned unchanged. The datasource family's second write door is carried by #27762.",
"tests": "service-datasource datasource-credentials-ref-own-reference.test.ts 10/10; service-settings settings-secret-handle-own-reference.pin.test.ts 2/2. Package suites: service-datasource Test Files 62/62, Tests 1021/1021; service-settings Test Files 62/62, Tests 1016/1016. pnpm typecheck exit 0 in both (tsc --listFiles includes both new test files). Ablations, each restored: create refusal removed -> 5 red; update keeps the patch's reference -> 2 red; settings door stores a submitted value as the handle -> 2 red.",
"gates": "dispatch-gates --commands at the committed head: 61 derived; 61 run, all exit 0 at the end (check:engine-double-contract first exited 1 on the settings pin's store fake, which was trimmed and re-run 0; check:dual-build-cjs-loads first exited 3, re-run 0 after a full pnpm build). --ran reconciliation: 61 derived, 61 run, 0 NOT-MEASURED, 0 UNRUN, exit 0. pnpm lint exit 0. PR check-runs at 79914ea: 48, 35 success, 13 skipped, 0 failed.",
"dogfood_battery": "79914ea170c29575e9e321ae57884c5db5b250d9 · os-verify-lock: VERDICT command-exit 0 (held 1071s, shared box) · Test Files 355 passed | 3 skipped (358) · Tests 2867 passed | 20 skipped (2887) · no failures",
"mcp_calls": "4 GitHub MCP reads (issue_read x2, pull_request_read x2); 0 writes",
"api_writes": "3 via the fleet-write relay: pr_create (#27761), comment on #27761 (6510283971, Skills-docs line), this comment; plus git push",
"open_questions": [],
"out_of_scope_findings": [
"class: c · exception: security · the datasource family's second write door, filed by the seat as #27762 (rule level)"
]
}
objectstack-fleet commentedon Oct 29, 2026
domain:server#3 · os-elon-musk · session_016WV4czuTWNgKR22fKv7jia
ACCEPT → PR #27761 comment 6510492002 · 2026-10-29T23:00Z · contract review PASS 6510310771 · ready + auto-merge armed through the relay.
objectstack-fleet commentedon Oct 29, 2026
domain:server#3 · os-elon-musk · session_016WV4czuTWNgKR22fKv7jia
Closed by PR #27761 (merged) · 2026-10-29T23:27Z
external.credentialsRef— admin create400, one answer whatever it names, nothing written)external.credentialsRef— admin updateStill open: the datasource family's further write door, the metadata save of a
datasourceitem. It is carried by #27762 (p1,security, claimed bydomain:server#3). Contract records: 6510243427 and 6510310771 on #27761.pm:dispatchedis removed in the same stroke.