Repository navigation
fix(plugin-webhooks): re-arm an encrypted-secret webhook when the CryptoProvider registers (#8022) - #8043
Merged
huangyiirene merged 3 commits intoAug 12, 2026
Conversation
…ptoProvider registers (#8022) A webhook whose signing secret is encrypted was unsubscribed for ~60s after every restart: a record change in that window produced no delivery and no `sys_http_delivery` row, while the row still read `active: true`. Not a race — an ordering. Plugins run inside `kernel:ready`, which `runtime.start()` completes, and every host wires `setCryptoProvider` only after `runtime.start()` returns. So `AutoEnqueuer`'s first cache build always preceded the capability it needs, correctly dropped every secret-bearing subscription (#7799 fail-closed), and nothing re-read until the periodic refresh. `ObjectQL.onCryptoProviderChange(listener)` reports the registration; the auto-enqueuer subscribes before its first build and rebuilds when it fires, without joining the in-flight pre-registration refresh. Feature-detected, as `resolveSecretField` already was. The fail-closed drop itself is unchanged. It now reports at `error` with the consequence and the fix, carries the ADR-0112 `INTERNAL_ERROR`/500 pair, and is said once per outage rather than every refresh. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FuYKU5d8xPfHSZyASNsyia
… main too (#8022) Every harness that can inject the CryptoProvider registration while the first cache build is in flight also moves the secret resolution to after it, so the naive `() => this.refresh()` passes the test as well. A case that cannot separate the two revisions is a false green, so it is removed rather than kept as coverage it does not provide. The guard in `rearmAfterCryptoRegistered` stays, with the reasoning stated where it lives. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FuYKU5d8xPfHSZyASNsyia
|
The latest updates on your projects. Learn more about Vercel for GitHub. 1 Skipped Deployment
|
Contributor
📓 Docs Drift CheckThis PR changes 2 package(s): 16 hand-written doc(s) reference the affected code and may need an implementation-accuracy re-verification:
⛔ 1 release-owned page(s) also reference the affected code. These are read-only:
|
github-actions
Bot
added
documentation
…#8022) The set that makes the fail-closed drop report once per outage instead of once per refresh kept every id it ever saw. Two consequences: it grows for the life of the process, and a webhook deactivated while broken and later reactivated still broken has its first report suppressed as a repeat. Each refresh now forgets ids the read no longer returns. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FuYKU5d8xPfHSZyASNsyia
This was referenced Aug 12, 2026
huangyiirene
marked this pull request as ready for review
August 12, 2026 14:19
huangyiirene
deleted the
claude/issue-8022-webhook-cache-crypto-ordering
branch
August 12, 2026 14:37
This was referenced Aug 12, 2026
This was referenced Aug 13, 2026
akarma-synetal
pushed a commit
to akarma-synetal/framework
that referenced
this pull request
Oct 7, 2026
…mit that decided it (objectstack-ai#20850) Part of objectstack-ai#20596 Clause-②: no ## What changed This is the sixteenth stage of the `domain:services` lane of the dead-citation sweep. It covers `packages/plugins/plugin-webhooks/src/**` and nothing else. By the seat's claim (`5909908590`), it is the next of the three single-site packages left in the lane, taken one package per stage. Later stages cover the other packages, so this PR says `Part of` and the card stays open. Every comment or docblock site in scope that cited a tracker number answering 404 has been rewritten in ruling C+D's form C (comment 5749154545 on objectstack-ai#19123), by the method of stages 1 to 15 (the latest is PR objectstack-ai#20836, landed as `bbe03f406`). That is **1 site on 1 line in 1 file, covering 1 number**: - `src/translations/index.ts:26`, the census's one site in this package at the base. No test comment, test string, source string or gate-invisible spelling in this package carries a dead number (see the supplementary reading below), so the census site is the whole population. The rewritten line now cites the commit in this repository that decided what it describes: **1 commit sha**. No ADR or ruling record records that decision (see the per-number table), so ruling C's commit rung applies. No number was dropped. Only a comment changed. The file keeps its line count (1 line out, 1 in), so no line citation into it moves. No code token moves (see the guard below). **No citation number is added**: the only tracker number on the added line is the live `objectstack-ai#12069`, which already stood on it. The rewritten line is byte-identical to the line the six sibling translation sets already carry (`plugin-approvals:26`, `plugin-audit:28`, `plugin-security:26`, `plugin-sharing:26`, `service-messaging:29`, `service-storage:29`), landed by stages 1, 2, 4, 6, 7 and 9. **No changeset.** The rewritten docblock does not reach `dist`, and `dist` is byte-identical with and without the rewrite (see Changeset below), so this PR takes `skip-changeset`. ## Census: `plugin-webhooks`, before and after **Instrument (A1).** The gate's own `node scripts/check-issue-citations.mjs --census --json`, read-only and unchanged. The count below is its `allocated-but-absent` findings under `packages/plugins/plugin-webhooks/`. Each run counts as a reading only because its board frontier equals the newest issue or pull-request number, read by a separate request just before and just after the run. | reading | tree | board | whole-repo `allocated-but-absent` | plugin-webhooks sites | lines | files | numbers | |---|---|---|---|---|---|---|---| | before | base `bbe03f406`, run 2026-09-30T11:09:05Z to 11:12:38Z | enumerated, 187 pages, frontier objectstack-ai#20841 (newest objectstack-ai#20841 before and after) | 748 | **1** | 1 | 1 | 1 | | after | head `01312906e`, run 11:26:38Z to 11:30:05Z | enumerated, 187 pages, frontier objectstack-ai#20843 (newest objectstack-ai#20842 before; objectstack-ai#20843 after, a pull request opened 11:29:02Z inside the run, so the frontier equals the newest at the run's end) | 747 | **0** | 0 | 0 | 0 | The whole-repo drop is 1, exactly this diff's census site. The `resolves` tally is 33,194 in both runs, and `resolves-as-pull-request` (1,985) and `cross-repo-unjudged` (1,018) did not move either. Neither run was truncated or discarded: both enumerations read 187 pages at the newest frontier. The seat's census counted 1 here at `6bff748b`, and the base agrees: `6bff748b` is an ancestor of the base, and the one commit between them that touches this package's `src` (`7184436a4`, a re-translation of generated object leaves) does not touch `translations/index.ts:26`. **Supplementary instrument, the whole scope.** The census does not read test files or strings. So a second reading runs the gate's own exported `extractCitations` (whole-file and comment-prose projections) and `namesThisRepository` over every `.ts` file under `plugin-webhooks/src` (34 files). It takes its verdicts from the before census's own board reading rather than from a second enumeration: a number is dead when that census reported it `allocated-but-absent`, and alive when the gate's own census-scope extraction judged it and the census did not report it. 4 numbers are covered by neither, because they stand only in test files. Each was read on its own through the read-only tools: `objectstack-ai#10619` answers as an issue; `objectstack-ai#8556`, `objectstack-ai#13565` and `objectstack-ai#15687` answer as pull requests. The probe's controls: `objectstack-ai#11671` and the known issue `objectstack-ai#10619` answer 404 on the pull-request endpoint. | reading | citations | dead | src comment | test comment | src string | test string | |---|---|---|---|---|---|---| | before, `bbe03f406` | 369 | **1** | 1 | 0 | 0 | 0 | | after, `01312906e` | 368 | **0** | 0 | 0 | 0 | 0 | Its src-comment column equals the census's 1, which is the control on the second instrument. The 368 live citations are the same in both readings (363 by the census's judgement, 5 by the single reads), none is cross-repo, none is unjudged, and the drop of 1 citation is exactly the rewritten site. A third, raw reading (every `#` followed by 2 to 6 digits, whatever surrounds it) finds 378 occurrences before and 377 after, the same drop of 1. The 9 tokens beyond the gate's grammar are the same before and after, and none is dead (see Acceptance notes). ## Per-number table Sites and files count every dead occurrence in scope at the base (comments and strings, tests included). | number | sites / files | rewritten / left | anchor: what it decided | |---|---|---|---| | `objectstack-ai#11671` | 1/1 | 1/0 | `09b4f4e4e` (PR objectstack-ai#12557): the extract command's `--source-hashes` option writes a per-locale provenance companion, `LOCALE.source-hashes.generated.ts`, beside the generated translation bundles, recording for each leaf the source revision it is still a byte copy of, per maintainer ruling objectstack-ai#12069 Option A. That is exactly what `:25-26` say. Its message names `objectstack-ai#12069` but not `objectstack-ai#11671`; its own diff names `objectstack-ai#11671` on 16 added lines, the first of them its changeset's headline. `git blame` puts `:26` in `30928a615` (PR objectstack-ai#12724, which wires the serving-time read of that companion into all nine bundle sets), a descendant of the anchor. Reused: stages 1, 2, 4, 6, 7 and 9 gave the identical line in six sibling packages this anchor | The sha matches exactly one commit (`git rev-parse --disambiguate`, count 1) and is an ancestor of the base (`merge-base --is-ancestor`, exit 0; reverse leg, base against the anchor, exit 1; control legs exit 0: stage 1's landing `422db788a`, and the repository's root commit, 15,200 commits deep against the anchor's 3,802; the history is complete, `--is-shallow-repository` false, 15,201 commits). `objectstack-ai#11671` answers 404 on the issues endpoint and on the pull-request endpoint, read one by one. No ADR, `scripts/adr-anchors/` file or ruling record names `objectstack-ai#11671`, `objectstack-ai#12069` or the source-hash companion (`git grep` over `docs/adr` and `scripts/adr-anchors`: one unrelated `source-hash cache` hit in ADR-0080), so ruling C's first rung is empty. ## Wordings to check - **Tag swap in place.** 「(maintainer ruling objectstack-ai#12069 Option A, objectstack-ai#11671)」 became 「(maintainer ruling objectstack-ai#12069 Option A, commit 09b4f4e)」. It is the form, and the byte-identical line, the six sibling translation sets carry. ## Sites left - **In `src`: none.** No test title, assertion message, operator log string, runtime refusal, quoted maintainer ruling or generated file in this package carries a dead number. - **Outside `src`, listed and left, not edited in this stage:** - `scripts/i18n-extract.config.ts:17` names the dead `objectstack-ai#11671` (beside the live `objectstack-ai#12069`); the anchor for whoever next edits it is `09b4f4e4e`. The file is outside `files[]` and outside the census surface. - `tsconfig.scripts.json:1` names the dead `objectstack-ai#11351` (404 on the issue and pull-request endpoints). - `tsconfig.test.json:3` and `:56` name the dead `objectstack-ai#13176` (404 on both endpoints; stage 4 measured it dead). - The other numbers in those files and in `vitest.config.ts` are live: `objectstack-ai#12069`, `objectstack-ai#12559`, `objectstack-ai#10868`, `objectstack-ai#10756`, `objectstack-ai#5475`, `objectstack-ai#14062`, `objectstack-ai#5286`, `objectstack-ai#5449`, `objectstack-ai#12542`, `objectstack-ai#10772`, `objectstack-ai#10374`, `objectstack-ai#12642`. - The release-owned `CHANGELOG.md` names `objectstack-ai#11671` on 2 lines. - `package.json`, `tsconfig.json` and `tsup.config.ts` name none. `files[]` lists `README.md`, but the package has none. ## Mechanical guard: no code token moves The guard compares, base `bbe03f406` against head, over the one touched `.ts` file: - **Reading 1**, the TypeScript parser's leaf nodes (a `forEachChild` walk, so comments are trivia and JSDoc nodes are never visited). String and template literals are therefore read in full. - **Reading 2**, the full token stream in parser context (a `getChildren` walk, so punctuation and keywords are included; JSDoc nodes skipped). Results: - Real run at the head `01312906e`: 50 base leaf tokens, **0 files with a token change** on either reading (exit 0). - Comment control (「Recording alone changes nothing a user sees」 to 「... alters ...」): 0 files changed, as expected (exit 0). - Positive control, a code token renamed (`undefined, zhCNGeneratedSourceHashes)` to `...SourceHashesX)`): DIFFER on the identifier in both readings (exit 1). - Positive control, a string-literal key changed (`'es-ES'` to `'es-EZ'`): DIFFER on the string literal in both readings (exit 1). Every mutation went through `scripts/ablation-replace.mjs` (wrap mode) under a shell trap that restores by absolute path, and each landed (anchor 1 to 0, blob changed). Each restore was proven byte-identical to the HEAD blob (`929fa19989e2`), with `git diff HEAD` empty and a clean tree afterwards. ## Changeset: none (`skip-changeset`) `files[]` is `dist`, `README.md` and `CHANGELOG.md`, and the package is not private. Measured on the built package (A3), after `pnpm --filter '@objectstack/plugin-webhooks...' build` at `01312906e`, where the package's own `tsup` ran and cleaned its output folder: - The rewritten line, its whole docblock (`:22-55`, which sits on the unexported `const enSource`) and the old number appear in no `dist` file (0 in all 20, source maps included). Nor do its neighbours `:23`, `:25`, `:27` and `:30`, or a never-written negative phrase. - Positive controls, text that does ship: `WebhooksTranslations` from this same file is in `index.js`, `index.cjs` and both translations chunks (8), and `zhCNGeneratedSourceHashes` is in both translations chunks (4). A docblock line of this package, `auto-enqueuer.ts:33` (「Enqueue callback into the shared `service-messaging` HTTP outbox (ADR-0018 M3).」), is in `index.d.ts` and `index.d.cts`. - **Byte identity.** The package was rebuilt with the base line put back (through `scripts/ablation-replace.mjs`, with the file proven equal to the base blob `686646fac51d` during the leg), and again after the proven restore. The sha256 of all 20 `dist` files is identical in all three builds: JS entries, declaration files, chunks and source maps. So nothing this PR rewrites is published, and a changeset would announce a change no consumer can observe. No `.changeset/*` file is added or touched. ## Gates (head `01312906e`) - **Citation judging, as CI runs it:** `node scripts/check-issue-citations.mjs` exits 0 (「every citation this change adds resolves」). `pnpm check:issue-citations` exits 0 (self-test, 114 cases, 8 batteries). - **Doc authoring:** `pnpm check:doc-authoring` exits 0 (the sibling-package prose-id baseline holds, no growth). - **Derived gates:** `node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack` at `01312906e` (change set derived from git: 1 path against the merge base `bbe03f406`) derived 50 commands, all among the dispatch list's 65. - All 65 of the dispatch list ran, each with its exit code captured before any pipe, and all 65 exit 0; none exited 3. - `--ran`, fed each command with its exit code, reports 50 derived, 50 run, 0 NOT MEASURED (a derived zero), 0 unrun, and exits 0. - A full `turbo run build` over `./packages/*` and `./packages/*/*` ran first under the shared verify lock (71 of 71 tasks), so no gate hit an unbuilt workspace. - **Roster families the derivation lists outside its commands** (their rosters sit in a directory this diff touches): `pnpm check:authz-resolver`, `pnpm check:error-code-casing` and `pnpm check:filter-alias-parity`, plus `node scripts/check-changeset-fixed.mjs`, which the dispatch named. Each exits 0. - **Tests and typecheck, under the verify lock, at `01312906e`:** - `pnpm --filter @objectstack/plugin-webhooks test`: 13 files pass and 160 tests pass, which is every tracked test file under `src/`. - `pnpm --filter @objectstack/plugin-webhooks typecheck` exits 0, and `tsc --noEmit --listFiles` puts the touched file in the program (the config includes `src` and excludes no test file). - `pnpm --filter @objectstack/plugin-webhooks check:test-typecheck` exits 0 (0 files held in the package's debt ledger). - **Lint, as a proven narrowing:** eslint with inline config disabled, over the touched `.ts` file, gives 1 file, 0 errors and 0 warnings (its `--format json` output). The file is in eslint's own population (not reported ignored; `dist/index.js`, the control, reads ignored). `eslint.config.mjs` never enables type-aware linting (no `parserOptions.project`, as its own lines 327-328 state), so a comment edit here cannot move the verdict on any untouched file. The repo-wide `pnpm lint` is CI's run. - **Control bytes:** `pnpm check:nul-bytes` exits 0, and a raw scan of the changed file for control bytes finds none. ## Acceptance notes - **The gate-invisible spellings, grepped as the claim asked** (objectstack-ai#20636, including the `clause #N` position). At the base and at the head, `#N-word` is on 0 lines. `#A/#B` is on 8 lines (8 second numbers), and every second number is live: `objectstack-ai#8022` (3 lines), `objectstack-ai#7986` (2) and `objectstack-ai#8043` (2) by the census's own judgement, and `objectstack-ai#8565` read on its own as a pull request. `option #N`, `clause #N` and URL-spelled links are on 0 lines. So the claim's 0 / 8 / 0 / 0 / 0 hold, and nothing dead hides behind them. The one other raw token beyond the grammar is `PD objectstack-ai#12` at `auto-enqueuer.ts:919`, a Prime Directive ordinal the extractor excuses on purpose. - **Outside-`src` residue.** Three dead numbers in files outside `src` and outside `files[]` (`objectstack-ai#11671`, `objectstack-ai#11351`, `objectstack-ai#13176`, listed above) are left, as stages 13 to 15 left theirs. They ship nothing and move no gate. - **The census instrument did not truncate in this stage.** Both enumerations read 187 pages at the newest frontier. - **Anchor for the next stages:** `objectstack-ai#11671` → `09b4f4e4e`. `service-realtime/src/translations/index.ts:27` still carries the dead number in the identical sentence. - **Base.** The branch is on `main` at `bbe03f406`. `main` has since moved five commits (to `688ddef3c`). None touches `packages/plugins/plugin-webhooks`, `scripts/check-issue-citations.mjs`, `scripts/pm/dispatch-gates.mjs` or `.changeset/config.json`. No merge was taken; the merge queue rebuilds on the merged generation. --- _Generated by [Claude Code](https://claude.ai/code/session_01XY5uCwTjZj7884yYtyur4H)_ Co-authored-by: Claude <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #8022
What was wrong
For ~60s after every restart, a webhook whose
signing_secretis encrypted — the population #7799 created — was not subscribed. A record change in that window produced no delivery and nosys_http_deliveryrow at all: no dead letter, no retry, no durable trace, whileGET /api/v1/data/sys_webhook/kept readingactive: true. It self-healed at the next periodic refresh, so it was invisible to anyone not watching the window.The fail-closed behaviour is unchanged
Dropping a subscription whose stored key cannot be recovered — rather than delivering it unsigned — is #7799's whole point and still holds. No unsigned delivery, no cleartext fallback, no weakened refusal. What was wrong is that a fail-closed drop outlived its own cause.
Root cause: an ordering, not a race
The filer read it off two log lines ~1.3s apart. It is stronger than that — it is deterministic. Plugins run inside
kernel:ready, whichruntime.start()completes (packages/core/src/kernel.tsPhase 3); the composition root callsengine.setCryptoProvider(...)only afterruntime.start()returns, unconditionally and on every host (packages/cli/src/commands/serve.ts,packages/verify/src/harness.ts). SoAutoEnqueuer's first cache build always precedes the capability it needs, drops every secret-bearing row on what it could see, and nothing re-reads until the periodic refresh up to 60s later.The shape landed
ObjectQL.onCryptoProviderChange(listener)reports the registration, fired after the provider is in place.AutoEnqueuersubscribes before its first build — the registration can land at any moment fromstart()onward, including mid-refresh — and rebuilds the cache when it fires.Event-driven, not a shorter poll. Chosen over the alternatives because it fixes every host rather than one: moving the wiring earlier in
serve.tsleavesapps/cloud,packages/verify, and every embedder with the same window, and a retry ladder only shrinks the hole. The engine is the sole party that knows the moment the provider arrives.The re-arm deliberately does not join an in-flight
refresh(): the build most likely running at that instant is the pre-registration one, so joining it would report success having re-armed nothing.The channel is feature-detected, exactly as
resolveSecretFieldalready was — this plugin takes no dependency on@objectstack/objectql. An engine without it keeps today's behaviour with the periodic refresh as backstop.The drop is no longer quiet
A subscription dropped for an unresolvable key now reports at
errorwith the consequence and the fix in the message, carrying an ADR-0112code/statuspair (INTERNAL_ERROR/500) in its metadata — the same pair the seeder's refusal for the same cause already carried. Per AGENTS.md "Degradation log levels" it is said once per outage per webhook rather than every refresh cycle; a webhook that recovers and breaks again is loud again.Half (b) — durability — is NOT closed here
A drop that leaves a
sys_http_deliveryrow would needIHttpOutboxto admit a row that is durable but never sendable, and today it cannot:enqueue()only mintspending, andredeliver()resets any terminal row back topendingfor a byte-for-byte replay. A row parked for a missing key has no signature, so the existing admin redeliver endpoint would send it unsigned — re-opening #7799 through a new door. That wants a design decision (a new column on thesys_http_deliveryplatform object, plus aredeliverrefusal), not a rider on this fix. Recommending its own card; reasoning in full in the issue report.Verification
origin/main(2 failed / 10 passed of 12 —expected [] to have a length of 1) and green after (12/12). It runs withrefreshIntervalMs: 0, so it cannot pass by waiting — the only thing that can re-arm the cache is the registration itself.sys_http_deliveryrow and the receiver's HMAC), never on cache internals or call counts.sys_webhook.definition_json#7799/[security] Webhook HMAC signing secrets are persisted in cleartext on everysys_http_deliveryrow #7722 invariants re-asserted in the same tests: the delivery is signed from a key that exists only as ciphertext, the row carriessignatureand not the key, and while the key stays unresolvable nothing is delivered at all.Generated by Claude Code