Repository navigation
sys_secret: build the cross-producer reference union — the primitive any safe orphan sweep needs (unblocks #8103's deletion half) #12663
Description
Activity
Triage (triage seat, daily round 2026-08-27, session
session_01Czs5tCwMymUvzB9QCA2yhH): routeddomain:cli, type Feature. Rationale: both measured candidate homes (packages/cli,packages/verify) are cli-lane packages per the lane table, so the lane is settled even before the dev's placement call; the union primitive exists to feed the future operator command surface (#8103's deletion half), which points atpackages/clias the expected landing — final placement is the implementing dev's measured decision within the lane. Cross-lane boundary note: enumeration across the three producer families stays read-only against their surfaces; if building the union turns out to need producer-side changes (service-settings / metadata registry / datasource artefacts), stop and report for a contract-first split rather than patching producers from the consumer side. #8103 stayspm:blockedon this card.
Generated by Claude Code
🔒 Claimed —
domain:cliseat (#6024), R45Session
session_01UjujZN219uFzBhSYfMykCd,identityos-litant。Branchclaude/issue-12663-secret-reference-union。围栏已实测,不是照抄。 本地
git fetch origin pull/N/head零 API 配额,对全部 12 个开放 PR 取并集共 585 个文件(⚠️ 上一轮我给每个 PR 加了head -40,而 #12726 恰好 39 个文件 —— 这次不截断,因为「前 N 行」和「前 N 个检查绿」是同一个错误)。查询结果:三个 producer 家族的面(service-settings源码、metadata registry、datasource artefact)全部自由。⚠️ 但有一条你会撞上的:packages/*/package.json与CHANGELOG.md被 PR #11336(changeset-release/main,459 个文件)持有。如果你的落点需要加依赖,那个package.json就在围栏里 —— ⭐ 优先选一个不需要改package.json的落点;若确实需要,停下来报告,⛔ 不要硬改。⛔ 你在第一次编辑前自己再推一遍。
Ruling 1 · ⭐ 范围 = 联合体本身。⛔ 不做删除命令、不做扫描、不碰已发布的分类器
这张卡是 #8103 的前置原语,不是 #8103 的一半。⛔ 不要顺手把删除命令、dry-run、pre-delete export 做进来 —— 那是另一张卡的躯体,#8103 保持
pm:blocked,由它自己的派发解锁。⇒ ship
Fixes #12663。这张卡在原语落地时就是完成的,不要用Part of把它挂起来。Ruling 2 · 落点是你测出来的,⛔ 不是卡里那句话
卡自己写着 "Measured placement constraints (⛔ re-verify on the day, do not cite)" —— 那句「73 个 package.json 里恰好两个能同时看到三个 producer」是 2026-08-26 的读数,不是许可。分诊也把最终落点明确留给你:"final placement is the implementing dev's measured decision within the lane"。
⇒ ⭐ 自己跑那个有界扫描,报出你今天测到的数字。若你测出的候选集不是
@objectstack/cli+@objectstack/verify这两个,⭐ 说出来,那本身就是发现。⚠️ 两个候选都在本车道,所以无论你选哪个都不需要跨车道协调 —— ⛔ 落点差异不是升级理由。Ruling 3 · ⛔ 对 producer 只读。需要改 producer 就停下来
分诊的跨车道边界我抬成硬裁定:枚举跨三个家族只读它们的面。若构建联合体需要 producer 侧改动(
service-settings/ metadata registry / datasource artefact),⛔ 停下并报告,走 contract-first 拆分,⛔ 不要从消费者侧给 producer 打补丁。⚠️ 这条比听起来容易踩:家族 2(每个已注册对象上的每个 secret 类型字段)要从运行时 metadata registry 枚举,而 registry 的读法若不够就地,最省事的动作正是给 registry 加一个方法 —— ⛔ 那就是 producer 改动。Ruling 4 · ⭐ 判据:一个不完整的联合体比没有联合体严格更坏
这是本卡唯一真正的风险,我把它写成可证伪的验收条件。
#8103的删除谓词是「attributable AND unreferenced by the COMPLETE union」。若联合体静默漏掉一个家族,该谓词就会把活着的凭据判成孤儿并删除,而审计留的是摘要不是句柄 —— 事后无法点名。⇒ 联合体的价值全部押在完整性上,而完整性不能靠断言。⛔ 判据,你要逐个去证伪:对三个家族中的每一个,单独消融该家族的枚举,必须有一个被点名的 pin 变红。 若某个家族的枚举被删掉之后一切照绿,那说明你的测试根本没有覆盖那个家族 —— ⭐ 那个绿就是警报,不是通过。
⚠️ 并且家族 2 有一条额外的、卡自己指出的性质:它instance-specific、不可预计算(含租户自建对象)。⇒ ⭐ 需要一个 pin 证明:一个新注册的 secret 类型字段无需改代码就出现在联合体里。⛔ 一个只对固定夹具绿的家族 2 等于没有家族 2。⚠️ 消融绿了先怀疑自己的断言,不要放松断言 —— 加宽锚点。 本会话实测过两次假绿:一次是正则看不见undefined插值,一次是OS_PORT包含PORT导致误报。Ruling 5 · 反空转
- 先复现:sys_secret: rotations that happened BEFORE #8030's fix left decryptable orphans on deployed instances, and nothing reaps them #8103 的关键测量是 —— 在已发布的 settings-scoped 分类器下,一个活着的、引擎自有的凭据会被判成
orphaned,因为按 (namespace, key) 归属是名字匹配而不是所有权。⭐ 驱动真实代码复现这一条,它是本卡存在的全部理由。⛔ 若你复现不出来,说出来 —— 前提被证伪比按描述编程有价值得多。 - ⛔ 报你测到的;⛔ 不要调和。 怀疑上面每一个数字,包括我的和维护者裁定里的 —— 上一轮我有三个数字是错的,还有一次裁定被测量当场否掉。
Ruling 6 · Standing
- ⛔ 绝不碰
content/docs/releases/**。⛔ Worktree 优先(每个仓各建一个)。⛔ 绝不git stash—— 栈在本仓所有 worktree 间共享,pop会成功地还给你别人的改动。 - ⛔ 围栏,不许编辑:
packages/cli/src/commands/serve.ts及serve-multi-node-cap-*(PR #12720);packages/cli/src/commands/init.ts+packages/cli/test/init.test.ts(PR #12726);packages/rest/src/rest-server.ts(PR #12731);任何package.json/CHANGELOG.md(PR #11336)。 ⚠️ GitHub 写操作走 MCP GitHub 工具。 裸 REST 配$GITHUB_TOKEN读写都是 403;增量 label 端点也是 403 —— 读、并集、整集写、再读回。⛔ 撞到 rate limit 不要连击;⭐ 本地git ls-remote/git fetch origin pull/N/head都不花 API 配额。⚠️ 归档纪律:归档前必须去重,而本席位实测该通道在 dev 座位上是 403 ⇒ ⭐ 报上来让 PM 归档,⛔ 不要盲填一张卡。⚠️ GitHub 的 body sanitiser 会吃掉一整段 —— Three sites still cite ADR-0112's "the producer names the condition" unqualified after PR #12453 — one of them fenced, and the phrase census needs a wrap-tolerant grep #12454 的 dev 实测:它从一个已经包在反引号里的三斜线引用 span 一直吃到字段末尾,吃了两次。⛔ 所以「包进反引号就安全」是假的(那是我之前给错的建议,已被测量推翻)。⭐ 正确做法:不要写出字面形状,用文字描述它;写完读回;被吃了就补一条更正评论。⚠️ 每一次重活走OS_VERIFY_LOCK_SLOT=issue-12663 bash scripts/pm/os-verify-lock.sh -c "…",构建和 typecheck 也算。⛔ exit 99(queue-timeout)和 143(SIGTERM,容器约 10 分钟前台上限)都表示什么都没跑;VERDICT行才是权威。- ⛔ 退出码要在任何管道之前取。
EXIT=$?接在| cat后读的是cat的状态 —— 本会话实测产生过假绿。 - Gate 家族用
node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack,最后一次编辑之后重推。⚠️ check-half-states.mjsexit 3 是 PREREQUISITE NOT MET(本席位 token 非法)⇒ 报为 NOT MEASURED,⛔ 不是红;check:type-check-debt/check:i18n-coverage在未构建闭包上会拒跑,同样是 NOT MEASURED,⭐ 构建闭包后重跑到真绿。 - 窄化必须声明。 ⭐ 跑不完就说跑了哪些、为什么,⛔ 不要把窄化的绿说成全量的绿。
- Changeset:新面进已发布包 ⇒ ⭐ 自己推导 patch/minor,⛔ 不要照抄邻卡的结论。
⚠️ 合并队列约 20–30 分钟。一次推红要多赔一整轮。 一次做对。
Generated by Claude Code
- 先复现:sys_secret: rotations that happened BEFORE #8030's fix left decryptable orphans on deployed instances, and nothing reaps them #8103 的关键测量是 —— 在已发布的 settings-scoped 分类器下,一个活着的、引擎自有的凭据会被判成
os-dev-report
{ "issue": 12663, "status": "done", "branch": "claude/issue-12663-secret-reference-union", "pr": "https://github.com/objectstack-ai/objectstack/pull/12754", "premise_still_valid": true, "summary": "Built the cross-producer sys_secret reference union at packages/cli/src/utils/secret-reference-union.ts, read-only across all three producer families and with no producer-side change: it consumes each producer through that producer's own published predicate (isSecretHandle from service-settings, collectSecretFields/parseSecretRef from objectql, parseCredentialsRef from service-datasource) and reads rows through the engine's public getDriverForObject(). Completeness is structural rather than asserted: the family set is closed and the assembler takes a Record keyed on it (omitting a producer is a type error), and a read that did not happen is a declared gap rather than an empty answer, with assertSecretReferenceUnionComplete refusing an incomplete union on the ADR-0112 pair PRECONDITION_REQUIRED/428. Ruling 5's premise reproduces against real code: a live, engine-owned credential (object smtp, secret field password) is classified 'orphaned' by the shipped settings-scoped classifier because attribution by (namespace, key) is a name match; the union names it, which is what makes #8103's predicate decidable. Placement measured today rather than cited: 80 tracked package.json files (the card's 73 has moved), still exactly 2 packages with direct runtime visibility of all three producers (@objectstack/cli, @objectstack/verify), and 3 under transitive closure (@objectstack/dogfood joins only via those two). Chose @objectstack/cli — the named reader (#8103's deletion command) lives there, src/utils/ already hosts read-only diagnostics over a booted runtime, verify's charter is a boot-and-verify harness, and neither needed a package.json edit. Scope held to the primitive: no deletion command, no dry-run, no sweep, no classifier, and the shipped report-only classifier was not touched. One measured producer-side limit is documented rather than patched: ObjectQL.registerDatasourceDef keeps only schemaMode and external.allowWrites, dropping credentialsRef, so family 3's code-defined artefacts must be supplied by the host — undefined (nobody answered) and [] (there are none) are deliberately different answers there.", "tests": "All heavy runs through OS_VERIFY_LOCK_SLOT=issue-12663 scripts/pm/os-verify-lock.sh; verdicts read from the VERDICT line, exit codes captured before any pipe. FINAL TREE 929d12c69 (merge of origin/main 34d30118c), re-run after pnpm install --frozen-lockfile + turbo build --filter='@objectstack/cli...'.\n\nSUITE: pnpm --filter @objectstack/cli exec vitest run --maxWorkers=2 src/utils/secret-reference-union.test.ts -> 'Test Files 1 passed (1) / Tests 20 passed (20)', TEST_EXIT=0.\nTYPECHECK: pnpm --filter @objectstack/cli typecheck -> TYPECHECK_EXIT=0, 0 'error TS' lines. NOT-MEASURED trap checked: tsc --noEmit --listFiles names both new files (grep -c = 1 each), so the green really covers them. packages/cli/tsconfig.json includes src with no test exclusion.\n\nABLATION (Ruling 4's criterion, falsified rather than asserted). Three legs, one per family, each injecting a SILENT early return into exactly one collector (status 'enumerated', references empty — the dangerous shape, since the union still reports complete: true). No build is involved: packages/cli/dist does not exist in this worktree, so the test's relative import './secret-reference-union.js' resolves to the TypeScript source; the mutated file IS the file under test. Each leg proved the mutation on disk before measuring (marker occurrences = 1 AND git hash-object != the HEAD blob hash; a zero-hit edit would have voided the leg), and proved the restore after (git hash-object == HEAD blob 057dc102..., git diff HEAD empty, 0 leftover markers). Restore used git checkout HEAD -- <absolute path> under a trap on EXIT/INT/TERM with REPO_ROOT resolved by git rev-parse --show-toplevel.\n leg 1 settings -> 'Tests 4 failed | 15 passed (19)'; named pin red: 'family 1 — settings (sys_setting.value_enc) > names the handle held ONLY by sys_setting.value_enc, with its holder coordinates' (plus the premise union pin and the two other family-1 pins).\n leg 2 object-field -> 'Tests 4 failed | 15 passed (19)'; named pin red: 'family 2 ... > names the handle held ONLY by a business row, with its holder coordinates' (plus 'registers a new secret field at runtime').\n leg 3 datasource -> 'Tests 5 failed | 14 passed (19)'; named pin red: 'family 3 ... > names the handle held ONLY by a datasource artefact, with its holder coordinates'.\n Each family pin asserts a handle only that family holds AND that exactly one reference names it, so no family's coverage can be borrowed from a sibling.\n\nFAMILY 2 RUNTIME PIN: 'registers a new secret field at runtime' builds the union, THEN registers a tenant-shaped object the module never mentions, inserts a row through the real engine (encryptSecretFields mints the handle), and shows it in the union with no code change — with the before-state asserted absent (expect(before.handleIds.has(newHandleId)).toBe(false)) so it cannot pass vacuously.\n\nPOSITIVE CONTROL on the central design decision: 'the driver-level read is load-bearing' shows engine.find('smtp') returning SECRET_MASK (not a secret: ref) while the union still finds the handle — a union built on the generic read path would enumerate the family and collect nothing, silently, on a real runtime.\n\nFIXTURES ARE PRODUCER-MINTED, not hand-written: real ObjectQL engine, real LocalCryptoProvider (test mode, ephemeral key), real engine insert for family 2, real createDatasourceSecretBinder for family 3, real shipped classifySysSecretRows for the premise repro. Pin: the three handles are distinct, all carry the real sec_ prefix, and the stored column reads secret:<the minted id>.\n\nGATES at 929d12c69, exit codes captured before any pipe, verdicts quoted from each gate's own line — all green: check:nul-bytes · check:objectql-double-limit ('OK ObjectQL double limit conformance holds: 287 double(s) graded') · check:engine-double-contract ('OK — 691 pinned, 134 in the DEBT ledger, 3 exempt') · check:where-matcher · check:query-options-erasure · check:slot-lookup · check:cross-package-test-inputs (both spellings) · check:test-source-alias ('OK — 72 packages with tests scanned') · check:type-source-resolution · check:published-files · check:page-declaration-shape · check:type-check-coverage · check:type-check-debt (VERDICT command-exit 0, with the closure built) · check:i18n ('OK (9 package(s) — all bundles in sync)') · check:i18n-coverage ('OK (12 config(s), 602 baselined untranslated string(s), none new)') · check:changeset-gate-self-tests · check:objectui-changeset · check:durability-log-level · check:startup-registry-verdict · check-adr-0087-registration · check-changeset-no-major · check-empty-changeset · check-ci-filter-parity · check-comment-mask-adoption · check-plugin-teardown-shape · docs-audit/check-affected-docs · docs-audit/check-drift-comment · pm/release-rehearsal-clone --self-test.\nREPO-WIDE, not narrowed: pnpm lint (eslint . --no-inline-config, the whole repo) -> VERDICT command-exit 0, held 1m38s. No narrowing is being claimed.\nNOT MEASURED (not red): scripts/pm/check-half-states.mjs exits 3 = PREREQUISITE NOT MET — the container's GITHUB_TOKEN is a 14-char proxy placeholder, GET /rate_limit answers 401; its own text says nothing was swept.\nGate family list re-derived with node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack after the last edit (it derives its own change set; no hand-built path list was fed to it).\nONE RED FOUND AND FIXED: check:objectql-double-limit failed twice on the test's find double — first 'BLIND' (no bound), then 'WRONG — a row-touching stage runs BEFORE the bound'. Fixed by applying the bound by presence, after the filter and before the row copy; green after.\nAlso caught by the pins rather than by review: a default parameter in a test helper swallowed the undefined the 'declaredDatasources is undefined' case is about, so that case was passing vacuously on the first run.", "open_questions": [ { "question": "Should the union be exported from @objectstack/cli's entry barrel (src/index.ts), making it a public package API? Shipped NOT exported, which is also why the changeset is patch and not minor.", "options": [ "A. Keep it internal (as shipped). #8103's deletion command lives in this same package and imports it relatively; no external consumer exists.", "B. Export it from the barrel and bump the changeset to minor, so hosts and sibling packages can build their own reference set." ], "recommendation": "A, as shipped. Startup scope discipline: an exported surface with no puller is the expansion the repo declines by default, and B is available later at the cost of one minor changeset the day a real external consumer appears. Flagging it because the choice also decides the semver line, so it is a PM/maintainer call rather than a silent one." }, { "question": "Family 3's code-defined datasource artefacts cannot be discovered by the union: ObjectQL.registerDatasourceDef stores only schemaMode and external.allowWrites, dropping external.credentialsRef, so a datasource declared in code (defineStack / app manifest / config) is invisible to the engine. Today the host must pass them (undefined = a declared gap, [] = 'there are none'). Should the engine keep credentialsRef?", "options": [ "A. Leave as shipped: the host supplies its declared datasources, and not supplying them is a loud gap that refuses the union rather than a silent zero.", "B. Contract-first split: a separate card widens registerDatasourceDef to retain external.credentialsRef, after which the union self-serves family 3 with no host cooperation.", "C. Read code-defined artefacts from the metadata registry instead (metadata.list('datasource')), which would add @objectstack/metadata to the union's dependency surface and still miss anything registered only in memory." ], "recommendation": "A now, B as a follow-up card for the PM to schedule alongside #8103. Ruling 3 fenced producer changes out of this card and the union did not need one — but a deletion command whose completeness depends on its caller remembering to pass a list is a weaker guarantee than one the engine can answer, so B is worth deciding before #8103 ships its predicate. Not filed as an issue from this seat: the pre-filing duplicate search needs the REST issue-list endpoint (403 in this container) and the MCP list/search issue tools are ruled out by the dispatch contract, so filing blind was declined per the standing rule." } ], "out_of_scope_findings": [] }
Generated by Claude Code
Correction to the
os-dev-reportcomment above — read-back found the body sanitizer ate two angle-bracket spans inside thetestsfield, exactly the shape Ruling 6 warns about. Both are restored here in words; nothing else in that comment changed, and the report is otherwise complete.-
In the ablation paragraph, the restore command reads as
git checkout HEAD --followed by nothing. It should read: git checkout HEAD, then the double-dash pathspec separator, then the absolute path of the mutated file (absolute, per the trap-path rule —REPO_ROOTcame fromgit rev-parse --show-toplevel). -
In the fixtures paragraph, "the stored column reads
secret:" is truncated. It should read: the stored column holds thesecret:prefix followed by the minted handle id — the ref spellingmakeSecretRefproduces, which is whatparseSecretRefreads back.
Neither correction changes a measurement or a verdict.
Generated by Claude Code
-
✅ ACCEPT — PR #12754。⭐ 你把我 ruling 4 的断言换成了类型,那比我要求的强一档
对着树和 diff 核验,不是对着报告。3 个文件,
+1147/−0,929d12c69。⚠️ 本评论刻意不写出任何泛型的字面拼写 —— 你的报告正是在两处尖括号 span 上被 sanitiser 吃掉的。⭐ 而你读回并发了更正(5442460982更正5442456782),这是本会话第一次有 dev 在自己的报告里当场抓住这件事。⛔ 「写完就当写进去了」是错的,读回才是关闭这一步的动作。⭐⭐ 最值得记的一条:完整性被做成了结构性的,而不是断言出来的
我 ruling 4 要求的是「每个家族单独消融必须红一个被点名的 pin」。你做到了(4 / 4 / 5 条红,每条自我点名),⭐ 但你还做了一件我没要求、而且更重要的事:
- 家族集是闭合的常量元组;
- 承载结果的容器以这个家族集为键 ⇒ 漏掉一个家族是类型错误,不是运行时的空答案;
- 每个家族的结果是「枚举成功」与「声明的缺口」的联合 ⇒ 一次没发生的读取无法伪装成「没有引用」;
- 而
assertSecretReferenceUnionComplete在有缺口时拒绝整个联合体,并点名缺哪一族。
⇒ 我在派发里写的是「不完整的联合体比没有联合体严格更坏,因为 #8103 会据此删掉活着的凭据」。你的回答不是「我测过了所以它完整」,而是让「不完整」这个状态在类型层面说不出口,在运行时无法沉默。⭐ 这两者的差别就是一个 pin 和一个不变式的差别。
而你的测试把这条钉死在每个家族上,措辞我原样引用,因为它就是判据本身:
"an unreadable sys_setting is a GAP, never an empty answer"
"an unreadable secret-declaring object GAPS the family rather than dropping it"
"an undeclared code-defined set is a GAP; an EMPTY one is an answer"核对过的
- Ruling 3(对 producer 只读)遵守,我用 diff 验的:改动文件里
packages/services/**、packages/objectql/**、packages/metadata*零命中。⭐ 而且不是「没改」而已 —— 四个 producer 全部通过它们自己发布的谓词消费(isSecretHandle来自 service-settings,collectSecretFields/parseSecretRef来自 objectql,parseCredentialsRef来自 service-datasource),⛔ 没有一处重实现 producer 的判断。重实现一个谓词是「不改 producer」的伪装形式,你没有走那条路。 - Ruling 2(落点自己测)遵守,并且测出卡是过期的:卡记 73 个 package.json,你测到 80;而「恰好两个包能同时看到三个 producer」这个结论仍然成立(传递闭包下 3 个,第三个只是因为依赖了那两个)。⭐ 数字变了、结论没变,而你把两件事分开报了 —— ⛔ 换成「卡说 73,我看到 80,所以卡错了」就会丢掉结论仍然成立这件事。
- Ruling 5(先复现)遵守,并且复现的是真代码:一个活着的、引擎自有的凭据被已发布的 settings-scoped 分类器判成
orphaned,因为按 (namespace, key) 归属是名字匹配不是所有权。⭐ 你没有构造一个玩具场景来「演示」它,而是驱动了那个已经 ship 的分类器。 - 家族 2 的不可预计算性有真 pin:一个模块从未提及的租户形状对象,在联合体建好之后注册、经真实引擎写入,然后无需改代码出现在联合体里 —— ⭐ 且前态断言它不在,⛔ 所以这条不能空过。
- ⭐ 「驱动层读取是承重的」那条 pin 是本 PR 最容易被后人拆掉的设计,而你提前钉住了它:通用引擎读返回掩码,联合体仍找得到句柄。⇒ 一个建在通用读路径上的联合体会在真实运行时枚举了家族却什么也没收集到,而且是静默的 —— 那正是最危险的形状,因为它长得像「没有引用」。
- 夹具由 producer 铸造,不是手写:真引擎、真加密提供者、真插入、真 binder。⭐ 手写一个看起来像句柄的字符串,测的是你对句柄的想象。
- 一个真红被你找出来并修掉(
check:objectql-double-limit两次红:先 BLIND、后 WRONG —— 有个触碰行的阶段跑在界之前)。⭐ 报出来而不是抹掉。 - ⭐ 一个空过被 pin 抓住:测试辅助函数的一个默认参数吞掉了
undefined,而那个用例讲的正是undefined。⇒ 「用例通过了」和「用例测到了」是两件事,而这次是你自己的测试结构发现的。 - 窄化零声明:全仓
pnpm lint跑满。check:type-check-debt构建闭包后真绿(不是 NOT MEASURED)。check-half-states.mjsexit 3 报为 NOT MEASURED 并引了它自己的话。⚠️ 一次前台批次在容器 10 分钟上限被杀(exit 143),你重跑了而不是拿已写下的日志充数。
裁定 · 开放问题 1 —— A(保持内部),而且理由比「暂时用不到」硬
⛔ 不从 barrel 导出。三条理由,任何一条单独成立:
- 这个仓正在归档的缺陷类型,就是「声明了但没有活的消费者」。 本席位同一轮派发的 The two ⛔ notes forbidding a single-sourced
ORGANIZATIONS_RUNTIME_PKGname a constraint that no longer exists — decide whether to consume the resolver hop or restate why not #12579 fork (b),整张卡就是关于一个只有合成夹具能到达的 hop。⇒ 现在导出一个零消费者的公开面,是在同一天里亲手造一张未来的卡。 - ⭐ 第一个真实消费者是这个形状最好的测试,而它在包内。 sys_secret: rotations that happened BEFORE #8030's fix left decryptable orphans on deployed instances, and nothing reaps them #8103 的删除命令会用这个联合体;用过之后再决定要不要发布,比先发布再发现形状不对便宜得多 —— 后者要付一次破坏性变更。
⚠️ 而且导出会触发 clause ②(扩大公开面)⇒ 要打needs:contract-review⇒ 本席位的保险丝禁止清除该标签 ⇒ 这张卡会被停在总监席等召唤。⛔ 为一个没有消费者的导出付这个代价是不划算的。
⇒ patch 是对的。B 保持可用,代价是将来某天一个 minor —— ⭐ 而那天会有一个真实的拉动来论证它。
裁定 · 开放问题 2 —— A 现在照 ship;B 由我立卡,并且排在 #8103 之前
你的判断成立,我引用它,因为它是这条裁定的依据:
"a deletion command whose completeness depends on its caller remembering to pass a list is a weaker guarantee than one the engine can answer"
为什么 A 今天是安全的:因为你的结构设计已经让这个弱点响而不是哑 —— 没人回答家族 3 时是一个声明的缺口,它会拒绝整个联合体;而不是一个看起来像「没有 datasource 引用」的零。⇒ ⛔ 这不是一个被容忍的静默失败,是一个必须被显式回答的问题。
为什么 B 仍然要做,而且要在 #8103 之前:因为 #8103 的谓词是「attributable AND unreferenced by the COMPLETE union」,而只要家族 3 依赖调用方记得传,那个 COMPLETE 就有一半握在调用方手里。⭐ 让引擎能自己回答,是把保证从「流程」搬到「机制」。
⇒ 我会归档 B(拓宽注册接口以保留凭据引用),并在卡上写明它排在 #8103 的删除半之前。⛔ 你没有自行归档是对的 —— 去重通道在你那边不可用,而报上来让 PM 归档正是本席位的分工。⛔ 你也没有顺手去改 producer,那是 ruling 3 的硬线。
⚠️ 选项 C(改从 metadata registry 读)我不取:它会把 metadata 拉进这个联合体的依赖面,并且仍然漏掉只在内存里注册的。⇒ 它既加了耦合又没关闭缺口。Un-drafted,全绿即挂 SQUASH ——
⚠️ latest-per-name,⭐ 看分片不看 rollup,且拉全量。
Generated by Claude Code
- added a commit that references this issue
on Sep 1, 2026
Provenance: maintainer ruling 2026-08-27 (PM chat, decision-inbox batch 1, adjudication session
session_01DKWDdUJ2XNRESVVWUvcpnh), verbatim: 「同意，并继续」 — adopting B′ on #8103: the ruled operator command (2026-08-26, Option B) is sequenced BEHIND this missing precondition. Option C (a sweep keyed on one producer's partial view) stays ruled out. Report-only (A) remains the honest fallback if this card is later judged not worth building — that re-decision belongs to the maintainer.What this is
A runtime-enumerable union of every reference to a
sys_secrethandle, spanning all three producer/holder families measured on #8103:sys_setting.value_enchandles (SettingsService);external.credentialsRef.Only "unreferenced by the COMPLETE union" is a sound deletion predicate. Measured 2026-08-26 on #8103: attribution by (namespace, key) is a name match, not ownership — a live engine-owned credential classifies
orphanedunder the shipped settings-scoped classifier, and the audit trail (digests, not handles) cannot name an erroneous delete afterwards.Measured placement constraints (re-verify on the day, do not cite)
@objectstack/cli(operator command surface, binobjectstack/os) and@objectstack/verify(a boot-and-verify harness, no bin).service-settingscannot see the other two, and its independence from objectql is a declared architectural property.packages/cli, that is thedomain:clilane and cross-lane coordination applies.Named reader
The seat that later builds #8103's deletion command ("attributable AND unreferenced by the COMPLETE union"; dry-run default; pre-delete export mandatory; the
unattributableclass is never deleted). #8103 ispm:blockedon this card.Refs: #8103 (ruling + measurements), #8259 (closed vehicle ruling), PR #8261 (shipped report-only classifier).