connectors: os validate and the save door warn on a credential-shaped literal in a connector header or env map (#28640 ruling 1A)

domain:spec#2 · os-steve · session_01ADHkmSduNGC2SZXszyrNut

carries item ①A of #28640; #28640 keeps items ②B (the spec slice) and ③A (the export marker, filed beside this card).

Ruling-ref: 6566912252 (director record, batch #451 item 1, letters ①A·②B·③A, the maintainer's 「同意」). Filing gate: executing a recorded ruling. ⛔ Not a claim. No domain:* label: triage routes it; the ruling's Execution line names domain:server for this slice.

What the ruling binds (①A, quoted from 6566912252)

"①A — advisory, not refusal. The credential-literal predicate's existing author-time advisory extends to the connector's four maps (providerConfig.headers, defaultHeaders, transport.headers, transport.env): os validate and the save door emit a warning that names the literal and the auth.credentialRef route; nothing is refused. The predicate stays a heuristic; promoting it to a refusal needs its own card and ruling."

Where (seat readings on `origin/main` at filing)

packages/lint/src/credential-literal.ts: the heuristic predicate; its header says callers advise and never refuse.
packages/lint/src/lint-flow-credential-literals.ts: its one caller today, the precedent for the new caller (PR feat(lint,spec): a credential typed as a literal into a served flow position draws an author-time advisory that routes it to a connector (#20654) #20698 built it and its doors).
The connector's four maps are withheld whole on read since feat(spec)!: the connector write door refuses an inline secret on every instance auth kind; the metadata read redacts connector credential positions #28596; this card adds the author-time warning only.

Wanted

A connector lint rule calling the same predicate over the four maps, with an os explain entry, surfaced by os validate and the save door as a warning naming the literal and the auth.credentialRef route.
Tests: a Bearer … literal in each map warns; a non-credential header (Accept: application/json) does not; nothing is refused.

Workload (ruling): domain:server, one PR, about a day.

triage#1 · os-zhuang · session_01AavokzJ5DndAwitDXvKy4U

Path: none

Triage: p2 · `domain:server` · `pm:queue` · 2026-11-02T13:00Z

⛔ Not a claim.

Read fresh. This executes [Decision] connector credential follow-ups after #28596: header-value advisory, legacy auth keys at rest, whole-map withholding #28640 ruling ①A (record 6566912252): os validate and the save door warn on a credential-shaped literal in a connector's four header/env maps. It is advisory and never a refusal. The ruling's Execution line names domain:server, and the ruling's routing wins over the lint anchoring rule. p2.

Generated by Claude Code

domain:server#3 · os-steve · session_01ADHkmQJdgarUjPLNgFBY67

Claim: PM loop round 1 · card thread · 2026-11-02T13:13Z
Session: session_01ADHkmQJdgarUjPLNgFBY67 (the seat); the card thread is session_01ADHkmPZY72rbsdkcLx2ZoH
Account: os-steve (the seat's linked user; the card's assignee)
Branch: claude/project-thread-2sk293
Worktree: the card thread's own container checkout
Domain: domain:server
Seat: domain:server#3
Ruling-ref: the maintainer, verbatim, in the project thread: 「开 server 2、3、5 号席位, 前任已经下班，接手所有开发，包括跟进之前未完成的开发落地。」
File surface: packages/lint/src/ (a new connector credential-literal rule reusing credential-literal.ts, + its os explain entry and tests); the os validate and connector save-door advisory wiring; ⛔ not the connector redactor, not the package export path (#29342)
Container & model: card thread cmsg_01FdL1XeUyvVNxLreh3F4Qi9QkrVNjxTuWMqLuQJ2j3ycU, mode:thread, model: opus (--tier names no path mandate: PM's call, default), effort: high
Clause-②: no — a warning only; nothing refused, nothing widened
Metadata-protocol: none
Responsibility: the card thread measures, codes, tests and opens the PR; the seat reviews and lands
Thread-read: 6577787052
Premise: holds (site re-read on origin/main 57cde8cb by the seat before dispatch)
Serial constraints cleared: no open PR touches the credential-literal rule files at seat read; #29342 (also seat 3) is fenced to the export path
Resume-from: none — fresh from origin/main

State: pm:queue → pm:dispatched, assigned to os-steve, recorded by this claim. Order: project file server-seat3/standard-order.md + server-seat3/29341-delta.md.

domain:server#3 · os-steve · session_01ADHkmPZY72rbsdkcLx2ZoH
os-dev-report

{
  "issue": 29341,
  "status": "done",
  "branch": "claude/project-thread-2sk293",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/29424",
  "session": "session_01ADHkmPZY72rbsdkcLx2ZoH",
  "premise_still_valid": true,
  "summary": "New advisory rule connector-credential-literal (packages/lint) asks the existing isCredentialShapedLiteral predicate over a connector entry's four maps (providerConfig.headers, defaultHeaders, transport.headers, transport.env) and warns per literal by path, never echoing the value, naming auth.credentialRef. Registered advisory on validate/build/lint and on the runtime publish gate for type connector (new TYPE_TO_STACK_KEY row connector: 'connectors'), so PUT /meta/connector rides the existing 2xx advisories channel; nothing is refused. os explain entry added. The transport.env verdict says a stdio MCP server takes no auth and credentialRef reaches it only over http, because the MCP provider applies auth to http headers only (measured).",
  "tests": "head 28b45f8e: lint 190 files / 7846 tests pass; metadata-protocol 304 files (4 skipped) / 22155 pass; lint + metadata-protocol typecheck exit 0; cli unit explain-rule-id 14/14; cli integration (OS_TEST_TIERS=nightly) connector + flow credential doors 4/4; spec check:generated up to date; pnpm lint exit 0. Ablation (ablation-replace + lint rebuild + dist preflight, restore + --absent): A1 severity->error: lint unit 3 red, save door LIT red with the 422; A2 predicate->any string: lint unit 6 red, save door LIT+DARK red; A3 connector stack-key row renamed: lint unit 2 red, save door LIT red. All restored, blob == HEAD.",
  "gates": "dispatch-gates --commands on 28b45f8e: 90 derived, 90 run, all exit 0 (5 first answered exit 3 prerequisite and were re-run green after fetching the pinned teardown commit and a full packages build); --ran reconcile: 90 derived, 90 run, 0 NOT-MEASURED, 0 UNRUN (DERIVED zero). pnpm lint exit 0. PR check-runs: in_progress at report time.",
  "dogfood_battery": "n/a — no ! in the PR title and no (narrowing) arm",
  "mcp_calls": "3 — mcp__github__issue_read x3 (get, get_comments x2); no write tool",
  "api_writes": "2 — fleet-write relay pr_create (POST /repos/objectstack-ai/objectstack/pulls, #29424); this os-dev-report comment (POST /repos/objectstack-ai/objectstack/issues/29341/comments). git push is not a REST write.",
  "files_changed": [
    ".changeset/29341-connector-credential-literal.md",
    "content/docs/deployment/cli.mdx",
    "content/docs/deployment/validating-metadata.mdx",
    "content/docs/getting-started/build-with-claude-code.mdx",
    "content/docs/ui/react-pages.mdx",
    "packages/cli/test/connector-credential-literal-doors.e2e.test.ts",
    "packages/lint/src/authoring-rules.ts",
    "packages/lint/src/index.ts",
    "packages/lint/src/lint-connector-credential-literals.test.ts",
    "packages/lint/src/lint-connector-credential-literals.ts",
    "packages/lint/src/rule-explanations.ts",
    "packages/lint/src/runtime-gate.ts",
    "packages/metadata-protocol/src/protocol.runtime-authoring-gate.test.ts"
  ],
  "line_budget": "+838 / -4 across 13 files (under the 3000 human-merge threshold); source +240, tests +579, docs transcripts 4x one-line count bump, changeset +15",
  "deviations": [
    "Card thread edits in a worktree at ../objectstack-29341 on the card branch: the shared checkout was detached to free the branch (claim says the container checkout).",
    "No PR assignee or reviewer set and no PR subscription: os-dev forbids assignees on a dev pr_create and the dispatch contract overrides the platform's subscribe posture.",
    "Forced docs edit: the four CLI transcripts printing Running author-time rules go 60 to 61 (check:docs-transcript-drift)."
  ],
  "open_questions": [
    {
      "question": "The ruling's env steer: for providerConfig.transport.env the warning names auth.credentialRef only with its condition (an http transport), because a stdio MCP server takes no auth (connector-mcp applyAuthToHeaders is http-only; the connector guide says stdio credentials ride transport.env). Keep this wording?",
      "options": [
        "A keep: the env verdict names auth.credentialRef reaching the server only over http (shipped)",
        "B say move it to auth.credentialRef verbatim for all four maps (a route stdio cannot follow)",
        "C drop transport.env from the rule pending a ruling on a stdio secret route"
      ],
      "recommendation": "A, because it keeps the ruling's letter (warning, names the route) without promising a route the runtime does not deliver for stdio"
    }
  ],
  "security_findings": "none",
  "out_of_scope_findings": [
    "class: none · noted, not filed: a stdio MCP server has no secrets-layer route for its credentials (only literal transport.env); a future card could add one (e.g. env values resolved from credentialRef). carrier: none"
  ]
}

Stamped 2026-11-02T14:39Z.

Generated by Claude Code

domain:server#3 · os-steve · session_01ADHkmQJdgarUjPLNgFBY67

Seat ruling and claim amendment · #29341 · 2026-11-02T14:41Z

Read: os-dev-report 6579919803, and the net diff of PR #29424 at 28b45f8e.

The declaration is a widening. The diff adds three names to @objectstack/lint's published entry (packages/lint/src/index.ts): lintConnectorCredentialLiterals, CONNECTOR_CREDENTIAL_LITERAL and the ConnectorCredentialLiteralFinding type. It also adds a new advisory to the PUT /meta/connector save answer. The lane rule is that widening the public surface is declared as a widening, even when nothing is refused. So this claim's no is amended: the PR body and the changeset each carry Clause-②: yes (widening) as the one line-initial line naming the key. The reason goes on its own line, without the key. Metadata-protocol: none stands, since no authorable key or value moves. The level stays patch, a non-protocol change. Because of the new declaration, a declaration-face review at TIER_DEFAULT is owed before the seat ACCEPTs.
Open question (the stdio transport.env steer): A. Keep the shipped wording, which says auth.credentialRef reaches the server only over an http transport. A stdio MCP server takes no auth, so a verbatim "move it to auth.credentialRef" (B) would steer authors into a field that does nothing there. Dropping env (C) would hide a real literal.

Nothing else in the claim changes. No code edit is owed: change the two declaration lines, then report the new head.

domain:server#3 · os-steve · session_01ADHkmQJdgarUjPLNgFBY67

Landing record · #29341 · PR #29424

domain:server seat 3 · session_01ADHkmQJdgarUjPLNgFBY67 · 2026-11-02T15:36Z

Reading	Probe	Result
Queue membership	`git ls-remote origin 'refs/heads/gh-readonly-queue/main/pr-29424-*'`	0 refs (released)
Ancestry	`git merge-base --is-ancestor aca58cdb62 origin/main`	yes
Content	`git grep -n "connector: 'connectors'" origin/main -- packages/lint/src/runtime-gate.ts`	line 275

Landed: merged as aca58cdb. The advisory connector-credential-literal now warns on a credential-shaped literal in a connector's four header and env maps. It runs on os validate, os build, os lint and the PUT /meta/connector save door, naming each position and never echoing the value. It is always a warning, so every save lands.
Seat ACCEPT 6580273182 and the TIER_DEFAULT record 6580241094 (declaration face, PASS on e7f39bdf) are on the PR. The claim's declaration was amended to Clause-②: yes (widening) (6579967665), because the diff adds three @objectstack/lint exports. Fixes #29341 closed this card on merge.
Carried, not dropped: there is no secrets-layer route for a stdio MCP server's credentials. That is connector-mcp: a stdio MCP server has no secrets-layer route for its credentials, so transport.env can only carry a literal (the route #29341's advisory cannot point to) #29434.
State: pm:dispatched and the assignee removed in the same round.

Navigation Menu

Repository navigation

connectors: os validate and the save door warn on a credential-shaped literal in a connector header or env map (#28640 ruling 1A) #29341

What the ruling binds (①A, quoted from 6566912252)

Where (seat readings on `origin/main` at filing)

Wanted

Triage: p2 · `domain:server` · `pm:queue` · 2026-11-02T13:00Z

Seat ruling and claim amendment · #29341 · 2026-11-02T14:41Z

Landing record · #29341 · PR #29424

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

connectors: os validate and the save door warn on a credential-shaped literal in a connector header or env map (#28640 ruling 1A) #29341

Description

What the ruling binds (①A, quoted from 6566912252)

Where (seat readings on origin/main at filing)

Wanted

Activity

objectstack-fleet commented on Nov 2, 2026

Triage: p2 · domain:server · pm:queue · 2026-11-02T13:00Z

objectstack-fleet commented on Nov 2, 2026

objectstack-fleet commented on Nov 2, 2026

objectstack-fleet commented on Nov 2, 2026

Seat ruling and claim amendment · #29341 · 2026-11-02T14:41Z

objectstack-fleet commented on Nov 2, 2026

Landing record · #29341 · PR #29424

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

Where (seat readings on `origin/main` at filing)

Triage: p2 · `domain:server` · `pm:queue` · 2026-11-02T13:00Z