[objectstack-fleet]

Requested by Tesla · project thread

Fixes #28435

Clause-②: no
Metadata-protocol: none

维护者速读

• 改了什么：objectstack-data 技能的评测用例 3（把 Postgres 报表库的 customers 表暴露为只读 legacy_customer 对象）的标准答案，从「defineDatasource 用 credentialsRef」改成 rules/datasources.md 现在教的环境变量路线：连接时从 OS_DATASOURCE_REPORTING_PASSWORD（数据源名大写）读密码，主机开关 OS_DATASOURCE_ENV_CREDENTIALS 为 on；保留 columnMap、schemaMode；must_contain 新增 OS_DATASOURCE_ENV_CREDENTIALS 与 _PASSWORD 两个钉子。另加一条 @objectstack/skills 的 patch changeset。
• 为什么改：PR docs(skills,adr): teach the code-defined datasource credential route (OS_DATASOURCE_NAME_PASSWORD behind the host switch) #28432 落地后规则文件教的是环境变量路线，而代码声明的数据源铸不出 sys_secret: 句柄，评测答案仍教 credentialsRef 就是教错；原 must_contain 不含任何凭据路线，评测对这个错一直是绿的。
• 风险与回滚：只改一个评测 JSON 的文字与断言数组，评测夹具按裁决只计量不设上限（1674 → 1750 tokens），无 SKILL.md、规则、schema 或运行时改动。回滚即 revert。
• 先看：skills/objectstack-data/evals/hooks-security-seeds-datasources.json 用例 3 的 expected_output 与 must_contain（唯一的代码 hunk）；.changeset/28435-data-eval-case3-env-credential-route.md。
• 两分钟验证：node scripts/check-skills-token-ratchet.mjs → 该文件一行为 1750 tokens — eval fixture, measured but not ratcheted，56 个受限文件全在上限内；对照 skills/objectstack-data/rules/datasources.md 的「Credentials — fail-closed」一节，答案里的变量名、开关名与默认值与之逐字一致。
• 需要你做的：Tier H（skills/**）：PR 保持 draft，席位做契约复审与席位核对后交你批准，批准后由席位落地。

What changes

One eval fixture and one changeset. Nothing else in the tree moves.

skills/objectstack-data/evals/hooks-security-seeds-datasources.json, case 3.

• expected_output before: "A defineDatasource entry (credentialsRef, never inline credentials); the object sets datasource: 'ID' (the datasource name, spelled with angle brackets in the old text), remoteName for the table, columnMap for columns; schemaMode leaves the remote schema unaltered; the external write gate stays closed."
• expected_output after: a defineDatasource entry (say reporting) with schemaMode: 'external' and no credential in the declaration; the password is read at connect from OS_DATASOURCE_REPORTING_PASSWORD (the name upper-cased) while the host switch OS_DATASOURCE_ENV_CREDENTIALS is on (os serve/start/dev default it on); the object sets datasource: 'reporting' and external: { remoteName: 'customers', columnMap }; the write gate stays closed (no allowWrites, no writable).
• must_contain keeps defineDatasource, datasource, remoteName, columnMap, schemaMode and adds OS_DATASOURCE_ENV_CREDENTIALS and _PASSWORD, so an answer that teaches only the credentialsRef route goes red. must_not_contain (columnName:) is unchanged. The prompt is unchanged.

Every sentence of the new answer is copied from what main teaches and does, not from the card's paraphrase:

Claim in the answer	Where main states it
the variable is OS_DATASOURCE_ + the name upper-cased + _PASSWORD	rules/datasources.md "Credentials — fail-closed"; packages/services/service-datasource/src/datasource-env-credential.ts datasourceEnvCredentialVar
read while OS_DATASOURCE_ENV_CREDENTIALS is on; os serve/start/dev default it on	same rule section; packages/cli/src/utils/datasource-env-credentials-default.ts; packages/spec/src/data/driver/common.zod.ts CODE_DEFINED_CREDENTIAL_ROUTE
schemaMode: 'external' for a mature external DB (DDL forbidden)	rule table "schemaMode — who owns the schema"
external: { remoteName, columnMap } on the object; datasource names the datasource	rule section "Federated (external) objects"
writes need both external.allowWrites and the object's external.writable	rule section "Writes — double opt-in"; packages/spec/src/data/datasource.zod.ts allowWrites

.changeset/28435-data-eval-case3-env-credential-route.md — '@objectstack/skills': patch, both declaration lines, before/now.

Skill bundle readings (skills/** touched)

	before (origin/main 82b29fe)	after (this head)
skills/objectstack-data/evals/hooks-security-seeds-datasources.json	95 lines · 1674 tokens	95 lines · 1750 tokens
all SKILL.md in skills/	4607 lines	4607 lines
check-skills-token-ratchet bundle total (whole shipped tree)	219828 tokens	219904 tokens

Eval fixtures are measured and not ratcheted (the gate's population 1b), so the +76 tokens pay no ceiling; no CEILINGS row moves and nothing was deleted to fund it.

Tests

• The edited JSON parses; every must_contain token of case 3 occurs in its own expected_output, and columnName: does not.
• Every new must_contain token is taught by the bundle as a whole token (the rule the objectui eval-token gate applies, checked by hand here because that gate's population is skills/objectui only): OS_DATASOURCE_ENV_CREDENTIALS 1 occurrence, _PASSWORD 1 occurrence in skills/objectstack-data/**/*.md.
• node scripts/check-skills-token-ratchet.mjs: exit 0 — 56 authored bundle files within their ceilings; 10 generator-owned and 28 eval fixtures measured, not ratcheted.
• No behaviour under test changed, so no ablation (configuration and fixture text only).

Acceptance notes

• must_not_contain was not extended with credentialsRef: rules/datasources.md still teaches credentialsRef as a declared channel that wins over the variable, so an answer that mentions it while following the environment route would be a correct answer refused. The triage route asked for a must_contain pin, which is what landed. If the seat prefers the eval to refuse the old route outright, that is a one-token follow-up on the same fixture.
• The prompt does not name the datasource, so the pinned token is the fixed suffix _PASSWORD plus the switch name rather than a whole variable name. An answer naming OS_DATASOURCE_REPORTING_PASSWORD, OS_DATASOURCE_WAREHOUSE_PASSWORD or any other derived name passes; an answer with no derived variable fails.
• Out of scope, noted and not filed: skills/objectstack-data/evals/objects-fields-relationships.json was not read for the same drift (the order excludes that file; another thread may edit it).

Verification

All readings on head 09443b1e (the only commit of this branch; origin/main merge base 82b29fe5).

Derived gates: 40 derived, 39 run, 1 NOT MEASURED

node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack derived 40 commands from the two changed paths. Each ran with stdin from /dev/null, its exit code landed on disk before any pipe (28435-gates-ran-09443b1e.list in the seat's orders folder):

• 38 exited 0 on the first sweep, pnpm --filter '@objectstack/lint...' build run first for check:doc-formula-expressions.
• pnpm check:lean-entry-closure: exit 3 (PREREQUISITE NOT MET, packages/objectql/dist absent), then exit 0 after pnpm turbo run build --filter=@objectstack/objectql under the verify lock (VERDICT command-exit 0, 2m48s): 2 published conditions measured from a real load, admitted set held exactly.
• pnpm check:dual-build-cjs-loads: exit 3, PREREQUISITE NOT MET — it reads every published package's dist/ and 89 are unbuilt in this worktree. NOT MEASURED locally. The diff touches no package it loads (an eval fixture and a changeset), and CI runs it in Lint & Repo Gates.

Reconciliation: dispatch-gates --ran printed 40 derived famil(ies) accounted for — 39 run, 1 NOT-MEASURED (1 DERIVED from a recorded exit 3); changed lines 16 (+14 / −2) vs the human-merge threshold 3000: under.

Outside the derivation, run as evidence: node scripts/check-skills-token-ratchet.mjs exit 0 (readings in the table above); the objectui eval-token gate pnpm --dir ui run check:skill-eval-tokens --list exit 0 with 0 red rows (its population is skills/objectui only, so the edited fixture is not in it).

Writes: git push once; the relay pr_create (draft, no assignees, no labels, no reviewers; the harness's MCP assignee and review-request step is skipped, since MCP writes are forbidden here); the os-dev-report comment through post-stamped.mjs. MCP GitHub calls: 0.

Tier H by path (skills/**). The PR stays a draft: the seat runs the contract review and the 席位核对, then hands it to the approver.

---

Generated by Claude Code

[objectstack-fleet]

domain:skills#1 · os-tesla · session_01L9qibzCtJt8Q2Z63fyRNix

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 09443b1e7033acfb3b66a44edc41939626e6644f
Local-runs: none
Scope: skills/objectstack-data/evals/hooks-security-seeds-datasources.json + skills/objectstack-data/rules/datasources.md, packages/services/service-datasource/src/datasource-env-credential.ts, packages/services/service-datasource/src/datasource-connection-service.ts, packages/cli/src/utils/datasource-env-credentials-default.ts, packages/cli/src/commands/serve.ts, packages/spec/src/data/datasource.zod.ts, packages/spec/src/data/object.zod.ts, packages/spec/src/data/driver/common.zod.ts, docs/adr/0015-external-datasource-federation.md, ui/scripts/check-skill-eval-tokens.mjs

Inputs read: card #28435 (body and all four comments, the dev report 6550536351 included), PR #28485 (body, file list, net diff against main at the merge base 82b29fe), the check-runs on the head. The rule file, the runtime and the spec were read on origin/main (2bba35a); none of them differs from the merge base, so the fixture is judged against one text.

Diff: two files, +14/-2. .changeset/28435-data-eval-case3-env-credential-route.md (new) and case 3 of the fixture (expected_output re-worded, must_contain gains OS_DATASOURCE_ENV_CREDENTIALS and _PASSWORD; prompt, files and must_not_contain unchanged). The changeset is the lane seat's ACCEPT at TIER_DEFAULT; it is read here only for ②.

① Derived judgments

• Accept set of case 3 narrows: an answer must now name the host switch and a derived _PASSWORD variable in addition to the five existing tokens. Right: this is the pin triage 6546369464 asked for, and an answer that teaches only credentialsRef now goes red where it stayed green before.
• Model answer replaced: the credentialsRef route is gone from expected_output; columnMap and schemaMode are kept as the card's "Wanted" requires. Right.
• must_not_contain unchanged (columnName: only); cases 1, 2, 4 to 9 untouched. Right: the card names only case 3.
• No public TypeScript, Zod or runtime surface moves; the only published artefact that changes is the @objectstack/skills bundle content, which ships evals/** through sync-catalog.mjs (a wipe-and-copy of the whole skill directory). Right that this is a published change (hence ②), and right that it changes no behaviour.
• Governed surface: skills/** is a Tier H register row, so the whole PR is Tier H; the PR is a draft and the Governed Surface Queue Guard is green. Right, and consistent with the claim and the PR body.
• Token readings: eval fixtures are in the ratchet's measured-not-ratcheted population, so the +76 tokens pay no ceiling; the objectui eval-token gate's population is skills/objectui only, so the dev's whole-token hand check is the only teaching check this fixture gets. I re-counted on main: OS_DATASOURCE_ENV_CREDENTIALS 1 whole-token occurrence and _PASSWORD 1 whole-token occurrence in skills/objectstack-data/**/*.md (both in rules/datasources.md). Right.
• The old text's angle-bracketed datasource placeholder is gone; incidental, but the sanitizer-safe spelling is the better one.

② Semver level

'@objectstack/skills': patch — right. The fixture ships in the package, so the change is published; it alters eval text and assertions only, no API, no key, no behaviour, so patch is the level. The changeset carries the title, a Before/Now pair, Clause-②: no and Metadata-protocol: none, matching the PR body; Check Changeset is green.

Clause-②: no — right. Nothing in the diff narrows a published capability or a spec refusal; the eval now teaches the route the spec's own CODE_DEFINED_CREDENTIAL_ROUTE prescription already states.

③ Boundary flags

• Dev open_questions 1 — "should case 3 also refuse the old route with must_not_contain credentialsRef?" Answered: option A, keep the must_contain pin only, as landed. Three reasons from the tree, not from the report: (1) rules/datasources.md on main still teaches credentialsRef as a declared channel that wins over the variable and never falls back, so a correct answer may name it while rejecting it for a code-declared datasource; a bare-word refusal would red exactly the answer that names the rule while following it, the objectui#7370 lesson the eval-token gate header records. (2) OS_DATASOURCE_ENV_CREDENTIALS in must_contain already reds an old-route-only answer, which is what the card asked to close. (3) must_not_contain is shape-checked only, by design, so an entry there has no teaching oracle behind it. Not escalated; a hard refusal remains a one-token follow-up if the maintainer wants one.
• Dev flag "NOT MEASURED: check:dual-build-cjs-loads" — closed by CI: Lint · repo & tooling gates is green on the head.
• Dev flag "CI in_progress at report time" — see the gate line below.
• Dev out_of_scope_findings — objects-fields-relationships.json not read for the same drift. I read it: it contains no credentialsRef, so there is nothing to file and the note resolves empty.
• No other dev flag, and no ruling on the card beyond the two triage comments, both of which this diff satisfies.

④ Design judgment

skills/objectstack-data/evals/hooks-security-seeds-datasources.json, case 3, judged against the card's eval prompt ("expose the customers table of our Postgres reporting database as a read-only legacy_customer object") and what main teaches and does.

Every sentence of the new model answer checks out against the cited code, read, not taken from the PR body:

• "the password is read at connect from OS_DATASOURCE_REPORTING_PASSWORD (the name upper-cased)" — datasourceEnvCredentialVar derives OS_DATASOURCE_ + name upper-cased with every character outside [A-Z0-9] replaced by _ + _PASSWORD. The datasource name schema is ^[a-z_][a-z0-9_]*$, so for every valid name the replacement is the identity and "upper-cased" is exact; it also matches the rule's own wording. The read happens in connect() (envCredentialVarFor, declared-auto trigger, code provenance, only when neither credentialsRef nor connector is declared), i.e. at connect, as stated.
• "while the host switch OS_DATASOURCE_ENV_CREDENTIALS is on" — resolveDatasourceEnvCredentialsSwitch: unset or empty is off, on/off only, anything else throws.
• "os serve/start/dev default it on" — serve.ts stamps on through stampDatasourceEnvCredentialsDefault before the admin plugin's init(); start and dev spawn serve; ADR-0015 §10 note says the same.
• "schemaMode: 'external' (the remote schema stays unaltered)" — SchemaMode enum and the rule table; DDL forbidden, and external is auto-connect condition 1, so nothing else is needed for the datasource to connect at boot.
• "no credential in the declaration" — the driver contracts refuse inline password and a credential embedded in the connection URL; ADR-0015 §10 records that nothing mints a sys_secret: handle for a code-origin datasource, which is the premise of the card.
• "datasource: 'reporting' and external: { remoteName: 'customers', columnMap }" — object schema external.remoteName / columnMap; the rule's federated-object example.
• "the write gate stays closed (no allowWrites, no writable)" — both default false (datasource.external.allowWrites, object.external.writable), ADR-0015's double opt-in.

Attempts to break it:

• Could a correct answer be refused? The two new pins are both in the rule file verbatim. OS_DATASOURCE_ENV_CREDENTIALS is whole-token safe. _PASSWORD is a suffix fragment: under substring grading it matches any derived name (OS_DATASOURCE_REPORTING_PASSWORD, ..._WAREHOUSE_PASSWORD), which is the intent, since the prompt does not fix the datasource name. Under a whole-token oracle like the one ui/scripts/check-skill-eval-tokens.mjs applies to guides, _PASSWORD would not match inside a concrete variable name (an identifier character precedes it), so a strictly whole-token grader would red every concrete answer. No grader in this repo applies that rule to answers (the objectui gate checks guides, and its population excludes this bundle), and the published catalog already relies on fragment pins graded as substrings (action_ in objectstack-ai, _views, _sections, _actions in objectstack-i18n). Noted as a limitation of the chosen pin shape; not a finding, and no whole-token-safe spelling of a derived variable exists, so the alternative would be dropping the pin, which the switch token already covers.
• Could a wrong answer pass? An answer that declares credentialsRef and never mentions the switch fails the new pin. An answer that names the switch but inlines a password would pass the token check; so would the old fixture, and no must_not_contain can pin "no inline password" without refusing the rule's own "never inline a password" sentence. Not a regression.
• Does the answer contradict the bundle anywhere? SKILL.md's datasource line points at rules/datasources.md for credentials; the rule and ADR-0015 §10 teach the environment route; CODE_DEFINED_CREDENTIAL_ROUTE in the spec states it. One voice across SKILL.md, rule, ADR, spec and now the eval.
• Omissions: the answer does not name type: 'postgres' or the connection config, nor the code-provenance guard; neither did the old answer, neither is in must_contain, and an eval model answer is a summary, not the full declaration. Acceptable.

Must-fix: none. Should-fix: none. The _PASSWORD note above is recorded for the next author of this fixture, not owed by this PR.

Gates on the head at the time of this record: every non-skipped check-run is green (Check Changeset, Governed Surface Queue Guard, PR-body guards, all Lint and Type Check jobs, including Type Check · source gates, which runs check-skills-token-ratchet, and Lint · repo & tooling gates, which runs check:dual-build-cjs-loads), except Test Core (1/8) and Test Core (2/8), still in progress. The diff touches no tested package, so those two are not expected to turn on it; the landing still waits for them to complete green and for the Tier H approval.

Implemented-by: claude/project-thread-t8mhhi
Reviewed-by: session_01L9qibzCtJt8Q2Z63fyRNix

VERDICT: PASS

[objectstack-fleet]

domain:skills#1 · os-tesla · session_01L9qibzCtJt8Q2Z63fyRNix

维护者速读

• 改了什么：objectstack-data 技能的测试题第 3 题（把 Postgres 报表库的 customers 表接成只读对象）换了标准答案。旧答案教的是 credentialsRef，新答案教代码里声明的数据源该走的路：声明里不放任何凭据，连接时从 OS_DATASOURCE_REPORTING_PASSWORD 读密码，前提是主机开关 OS_DATASOURCE_ENV_CREDENTIALS 为 on（os serve/start/dev 默认就是开的）。同时把这两个词钉进必含项。
• 为什么改：PR docs(skills,adr): teach the code-defined datasource credential route (OS_DATASOURCE_NAME_PASSWORD behind the host switch) #28432 已经让规则文件改教这条路，但测试题还在教旧写法，而且必含项没钉住它，所以旧答案也能通过。代码里声明的数据源没有任何东西会给它铸 sys_secret: 句柄，照旧答案写，连接会因为缺凭据而失败。
• 风险与回滚：只改测试题文本和断言，不碰任何运行时行为。随 @objectstack/skills 下次发版到客户手里。回滚即 revert。
• 先看：skills/objectstack-data/evals/hooks-security-seeds-datasources.json 第 3 题。
• 两分钟验证：git grep -n "OS_DATASOURCE_ENV_CREDENTIALS" skills/objectstack-data/，规则文件和测试题各一处。
• 需要你做的：改的是 skills/**，属于 Tier H，需要 os-zhuang（或 hotlong）批准后才能合并。契约复审 PASS 记录 6550618244，Head-sha 09443b1e。

席位意见：契约复审 PASS，无必修项，也无建议修改项。dev 问要不要把 credentialsRef 也列进禁含项，复审答不加：规则文件里仍把 credentialsRef 当作一条已声明的通道来讲，正确答案可能会提到它；必含的开关词已经能让只教旧路的答案失败。可以批准。

席位核对

ACCEPT · seat domain:skills#1 · head 09443b1e · 2026-10-31T23:36Z

1. Shape: Fixes #28435, draft, base main, 2 files, +14/−2: case 3 of the fixture and a patch changeset for @objectstack/skills. No other case touched.
2. Ruling: none on the card; the triage route (6546369464, 6549654239) is implemented as written: case 3 re-worded to the route rules/datasources.md teaches after PR docs(skills,adr): teach the code-defined datasource credential route (OS_DATASOURCE_NAME_PASSWORD behind the host switch) #28432, columnMap / schemaMode kept, a must_contain pins the route.
3. Contract review: PASS 6550618244 at this head (CONTRACT_REVIEW_TIER, rules face). Clause-②: no, Metadata-protocol: none.
4. Gates / check-runs: dev report 6550536351: 40 derived gates, 39 exit 0, 1 NOT MEASURED locally (check:dual-build-cjs-loads), which CI ran green in Lint · repo & tooling gates. On head 09443b1e: 41 check-runs, 28 success, 13 skipped, 0 failed or running; mergeable, clean.
5. Accepted deviations: none. The dev's open question (credentialsRef in must_not_contain) is answered no in the review record. Skills-docs: n/a (this PR is the skills edit).
6. Landing: check-governed-merges --pr 28485 reports GOVERNED, Tier H (skills/** ×1), 16 changed lines. The seat readies the PR and the relay's governed-review leg requests the approvers. No auto-merge is armed by the seat. After an authorized approval, the seat lands it, or the approver enqueues it.