diff --git a/‎.changeset/22345-run-provenance-context-retired.md‎
Lines changed: 23 additions & 0 deletions b/‎.changeset/22345-run-provenance-context-retired.md‎
Lines changed: 23 additions & 0 deletions
diff --git a/‎examples/app-showcase/src/automation/flows/index.ts‎
Lines changed: 5 additions & 3 deletions b/‎examples/app-showcase/src/automation/flows/index.ts‎
Lines changed: 5 additions & 3 deletions
diff --git a/‎packages/metadata-protocol/src/protocol.platform-store-system-opt-in.test.ts‎
Lines changed: 4 additions & 3 deletions b/‎packages/metadata-protocol/src/protocol.platform-store-system-opt-in.test.ts‎
Lines changed: 4 additions & 3 deletions
diff --git a/‎packages/metadata-protocol/src/protocol.ts‎
Lines changed: 7 additions & 5 deletions b/‎packages/metadata-protocol/src/protocol.ts‎
Lines changed: 7 additions & 5 deletions
diff --git a/‎packages/platform-objects/src/system/sys-secret.object.ts‎
Lines changed: 4 additions & 3 deletions b/‎packages/platform-objects/src/system/sys-secret.object.ts‎
Lines changed: 4 additions & 3 deletions
diff --git a/‎packages/plugins/plugin-auth/src/auth-manager.ts‎
Lines changed: 2 additions & 2 deletions b/‎packages/plugins/plugin-auth/src/auth-manager.ts‎
Lines changed: 2 additions & 2 deletions
diff --git a/‎packages/plugins/plugin-auth/src/auth-plugin.ts‎
Lines changed: 2 additions & 2 deletions b/‎packages/plugins/plugin-auth/src/auth-plugin.ts‎
Lines changed: 2 additions & 2 deletions
diff --git a/‎packages/plugins/plugin-auth/src/principal-less-producers-system-context.test.ts‎
Lines changed: 4 additions & 3 deletions b/‎packages/plugins/plugin-auth/src/principal-less-producers-system-context.test.ts‎
Lines changed: 4 additions & 3 deletions
diff --git a/‎packages/plugins/plugin-auth/src/scim-connection-service.ts‎
Lines changed: 2 additions & 1 deletion b/‎packages/plugins/plugin-auth/src/scim-connection-service.ts‎
Lines changed: 2 additions & 1 deletion
diff --git a/‎packages/plugins/plugin-security/src/get-metadata-readable-fields.test.ts‎
Lines changed: 7 additions & 5 deletions b/‎packages/plugins/plugin-security/src/get-metadata-readable-fields.test.ts‎
Lines changed: 7 additions & 5 deletions
@@ -0,0 +1,23 @@
+---
+'@objectstack/service-automation': minor
+'@objectstack/plugin-security': patch
+'@objectstack/runtime': patch
+'@objectstack/service-analytics': patch
+'@objectstack/platform-objects': patch
+---
+
+fix(service-automation)!: retire the `RunProvenanceContext` type; `RunDataContext` names only what `resolveRunDataContext` returns
+
+Clause-②: no (narrowing)
+
+<!-- adr-0087: not-required (runtime-interface-only packages/services/service-automation/src/runtime-identity.ts#RunDataContext) Two TypeScript-only declarations in one runtime file move, and neither is metadata: `RunDataContext` loses its `RunProvenanceContext` arm, and the `RunProvenanceContext` interface declared beside it in the same file is removed together with its type export. No spec key, authorable spelling, Zod schema or stored shape moves, and no stored row is read or rewritten, so `objectstack migrate meta` has nothing to rewrite. The channel that reaches an affected consumer is the compiler, at the consumer's own import. -->
+
+**BREAKING** for TypeScript code that imports from `@objectstack/service-automation`: one type export is removed and one type narrows. It ships as `minor` under the launch-window convention for breaking changes. No runtime behaviour changes in any package.
+
+**What is removed.** The `RunProvenanceContext` type export, the `{ flowRunId }`-only "provenance" envelope, and its arm of `RunDataContext`. No code in this repository builds or reads one. Since ADR-0096 D5, the data engine's security middleware refuses a context that carries no principal and is not a system context (`403 PERMISSION_DENIED`, for every verb). So the type described a context the engine refuses, while its docstring said such a context was "indistinguishable from passing no context at all" and was let through.
+
+**What `RunDataContext` is now.** Exactly what `resolveRunDataContext` returns: `isSystem: true` for a `runAs: 'system'` run, and the triggering user's principal for a `runAs: 'user'` run. A run that resolves no principal is refused before any data operation (`AUTOMATION_UNSCOPED_RUN_DATA_ACCESS`), as before.
+
+**If your code named the type.** There is no replacement, because the context it described is refused. A custom data node builds its context with `resolveRunDataContext(context)`, typed `RunDataContext`.
+
+**`@objectstack/plugin-security`, `@objectstack/runtime`, `@objectstack/service-analytics`, `@objectstack/platform-objects`:** comment and docstring text only. Shipped comments that said the security middleware hands through, skips or falls open for a context with no principal now say that it used to, and that ADR-0096 D5 refuses such a context. Nothing these packages do changes.
@@ -1581,9 +1581,11 @@ export const InboundTaskWebhookFlow = defineFlow({
   type: 'api',
   status: 'active',
   // An inbound webhook has no authenticated user, so the create must run as the
-  // system principal (#1888 runAs is now enforced). Without this it relies on the
-  // "no identity → security-skipped" fall-through, which breaks the moment the
-  // target object carries row-level security.
+  // system principal (#1888 runAs is now enforced). Without this the run is
+  // user-less under the default `runAs:'user'`, so its create is refused
+  // (`AUTOMATION_UNSCOPED_RUN_DATA_ACCESS`); the "no identity → security-skipped"
+  // fall-through it once relied on is gone (ADR-0096 D5 refuses a principal-less
+  // context in the security middleware too).
   runAs: 'system',
   nodes: [
     {
 
@@ -4,9 +4,10 @@
  * [#21911, ADR-0096] The metadata protocol's platform-store calls carry the
  * EXPLICIT system opt-in, never a principal-less context.
  *
- * plugin-security hands an engine operation whose context carries no user, no
- * position, no permission set and no `isSystem` straight to `next()` (the
- * ADR-0096 E1 hand-off). The protocol's own reads and writes of the
+ * plugin-security used to hand an engine operation whose context carries no
+ * user, no position, no permission set and no `isSystem` straight to `next()`
+ * (the ADR-0096 E1 hand-off); since ADR-0096 D5 it refuses one. The protocol's
+ * own reads and writes of the
  * `sys_metadata` family reached the engine exactly that way — a `{ where }`
  * with no `context`, or a repository transaction context with only its
  * handle — so they worked only because the hand-off let them through. They
 
@@ -11230,11 +11230,13 @@ export class ObjectStackProtocolImplementation implements
         // were eliminated by measurement, not by reading:
         //  - the driver's tenant wall never engages — `buildDriverOptions`
         //    sets `DriverOptions.tenantId` only from `execCtx.tenantId`
-        //    (`objectql/engine.ts`), and this read passes no context;
-        //  - plugin-security's Layer 0 never engages — the middleware takes
-        //    its principal-less `return next()` thousands of lines before the
-        //    `objectFields.has('organization_id')` gate that would have
-        //    carried it;
+        //    (`objectql/engine.ts`), and this read's context carries no
+        //    `tenantId` (only the system opt-in below);
+        //  - plugin-security's Layer 0 never engages — the middleware
+        //    short-circuits on that `isSystem` opt-in (it used to take its
+        //    principal-less `return next()`, refused since ADR-0096 D5)
+        //    thousands of lines before the `objectFields.has('organization_id')`
+        //    gate that would have carried it;
         //  - no posture would save it anyway: `computeTenantLayer0Filter`
         //    yields `null` under `single` and the deny sentinel under
         //    `isolated` with no tenantId.
 
@@ -46,9 +46,10 @@ export const SysSecret = ObjectSchema.create({
   // store (settings/datasource credentials). Not covered by the wildcard `'*'`
   // grant — ordinary members get 403 from the generic data layer. Platform
   // admins retain access via the posture-gated superuser bypass. Internal
-  // readers are unaffected: `engine.resolveSecret` reads at DRIVER level,
-  // SettingsService / the datasource secret-binder read with no principal
-  // (middleware falls open for principal-less internal calls).
+  // readers are unaffected: `engine.resolveSecret` reads at DRIVER level, and
+  // SettingsService / the datasource secret-binder read with the explicit system
+  // opt-in (`isSystem: true`), which the middleware short-circuits. A
+  // principal-less read is refused (ADR-0096 D5).
   access: { default: 'private' },
   description:
     'Cipher store written by three privileged producers (see managedBy); each holds its handle in its own column. Never holds plaintext.',
 
@@ -3383,8 +3383,8 @@ export class AuthManager {
             // Both reads run as the platform (`withSystemContext`): this hook
             // IS the slug guard — the organization id is the `where`, not the
             // reader — so neither read reaches the engine with no principal
-            // and no opt-in (the security middleware's principal-less
-            // hand-off, ADR-0096).
+            // and no opt-in (the security middleware's former principal-less
+            // hand-off, which ADR-0096 D5 replaced with a refusal).
             const dataEngine = withSystemContext(rawEngine) as any;
 
             let currentSlug: string | undefined;
 
@@ -2478,8 +2478,8 @@ export class AuthPlugin implements Plugin {
         // the write both carry the explicit system opt-in (`isSystem: true`).
         // The platform-admin judge above is this route's authorization; the
         // raw engine would have handed the security middleware a context with
-        // no principal and no opt-in — the principal-less hand-off (ADR-0096),
-        // which is not an authorization at all.
+        // no principal and no opt-in — the principal-less hand-off it no longer
+        // makes (ADR-0096 D5 refuses that context), and never an authorization.
         const rawEngine = this.authManager!.getDataEngine();
         if (!rawEngine) {
           return c.json({ success: false, error: { code: 'SERVICE_UNAVAILABLE', message: 'Data engine unavailable' } }, 503);
 
@@ -10,9 +10,10 @@
  *  - the SCIM bearer verifier (`verifyScimBearerToken`): its credential probe
  *    carries the opt-in in the read's trailing options.
  *
- * A context with neither a principal nor `isSystem` is the security
- * middleware's principal-less hand-off (ADR-0096), which is not an
- * authorization: each of these calls is already authorized by its own door
+ * A context with neither a principal nor `isSystem` was the security
+ * middleware's principal-less hand-off (ADR-0096 E1) and is refused since
+ * ADR-0096 D5; it was never an authorization: each of these calls is already
+ * authorized by its own door
  * (the platform-admin judge; the bearer digest). The opt-in names that.
  *
  * Measured on a REAL engine: a middleware registered on it records the context
 
@@ -119,7 +119,8 @@ interface CredentialEngine {
  * verifier runs BEFORE any caller is known — the bearer it is verifying is the
  * only identity on the request — so there is no principal to carry, and the
  * read must say so rather than reach the engine with no principal and no
- * opt-in (the security middleware's principal-less hand-off, ADR-0096). The
+ * opt-in (the security middleware's former principal-less hand-off, which
+ * ADR-0096 D5 replaced with a refusal). The
  * digest equality in the `where` is the whole of what the probe may match.
  */
 const CREDENTIAL_PROBE_CONTEXT = { context: { isSystem: true } } as const;
 
@@ -5,10 +5,11 @@
  * `getReadableFields`.
  *
  * The two differ in exactly one place: what a caller resolving to ZERO
- * permission sets gets. On the DATA plane, falling open is the drift-free
- * answer — the engine middleware skips its whole gate for such a caller, and
- * reporting a narrowing the data path would not enforce is its own kind of
- * drift. On the METADATA plane the question is disclosure, and D7 rules that a
+ * permission sets gets. On the DATA plane `getReadableFields` keeps its
+ * fall-open answer, written when the engine middleware skipped its whole gate
+ * for such a caller (the middleware now refuses it: ADR-0056 D2's deny
+ * baseline at object admission, and ADR-0096 D5 outright for a principal-less
+ * one). On the METADATA plane the question is disclosure, and D7 rules that a
  * guest/public deployment's schema exposure must be a deliberate
  * permission-set decision rather than an accidental everything-default. So the
  * zero-set caller goes through the same fallback resolution
@@ -81,7 +82,8 @@ describe('[ADR-0106 D7] SecurityPlugin.getMetadataReadableFields', () => {
     const dataPlane = await plugin.getReadableFields('deal', context);
     const metadataPlane = await plugin.getMetadataReadableFields('deal', context);
 
-    // The data plane keeps its middleware-mirroring fall-open — unchanged.
+    // The data plane keeps its fall-open answer — unchanged (the middleware it
+    // once mirrored refuses this principal-less caller since ADR-0096 D5).
     expect(dataPlane).toEqual(['id', 'name', 'secret']);
     // The metadata plane does not.
     expect(metadataPlane).toEqual(['id', 'name']);
Original file line number	Diff line number	Diff line change
`@@ -10,9 +10,10 @@`
`10`	`10`	* - the SCIM bearer verifier (`verifyScimBearerToken`): its credential probe
`11`	`11`	`* carries the opt-in in the read's trailing options.`
`12`	`12`	`*`
`13`		- * A context with neither a principal nor `isSystem` is the security
`14`		`- * middleware's principal-less hand-off (ADR-0096), which is not an`
`15`		`- * authorization: each of these calls is already authorized by its own door`
	`13`	+ * A context with neither a principal nor `isSystem` was the security
	`14`	`+ * middleware's principal-less hand-off (ADR-0096 E1) and is refused since`
	`15`	`+ * ADR-0096 D5; it was never an authorization: each of these calls is already`
	`16`	`+ * authorized by its own door`
`16`	`17`	`* (the platform-admin judge; the bearer digest). The opt-in names that.`
`17`	`18`	`*`
`18`	`19`	`* Measured on a REAL engine: a middleware registered on it records the context`