POST /datasources/:name/external/validate is the one federation route the #9901 ruling does not name — it stays authentication-only while its four siblings now require a capability

[os-elon]

Found while implementing #9901. Filed rather than folded in: the 2026-08-20 maintainer ruling on that card enumerates four routes, and this is the fifth. Deciding it inside that PR would have been an un-ruled route quietly acquiring a capability.

Disclosure posture — inherited

⛔ No reproduction here, in any PR body, or in any commit message. #9901 inherited this posture from #9686 / #9391 for this same area, and so does this card. What follows is the source location and the contract question.

What is now true

registerExternalDatasourceRoutes (packages/rest/src/external-datasource-routes.ts) mounts five routes. After #9901 lands, four of them require a capability above the shared anonymous floor and one does not:

route	admission after #9901
GET /:name/external/tables	authenticated + manage_platform_settings
POST /:name/external/tables/:remote/draft	authenticated + manage_platform_settings
POST /:name/external/tables/:remote/import	authenticated + manage_metadata
POST /:name/external/refresh-catalog	authenticated + manage_metadata
POST /:name/external/validate	authenticated, and nothing more

The ruling's own words enumerate the read twins (external/tables, external/tables/:remote/draft) and the write pair (external/tables/:remote/import, external/refresh-catalog). validate appears in the #9901 body only obliquely — as the third of "three routes the admin spelling has no twin for, two of which write" — and no part of the ruling assigns it a capability.

Why it was left rather than decided

The two properties that pinned the other four do not reach this one:

• No twin. validateAll has no spelling on @objectstack/service-datasource's admin family, so the twin-equivalence invariant (The same three datasource-admin routes answer 400 with the wrong service's error code (#4225 follow-up, one field over) #4249 failure contract, finding: the two listRemoteTables route twins diverge on ?schema= — the admin spelling drops it #7955 request shape, finding: the external-datasource federation HTTP family mounts outside the enforceAuth seam with no guard of its own — read and write #9686 anonymous axis, security(rest): the external-datasource federation family still admits any authenticated caller, while its declared admin twin now requires a capability #9901 capability axis) has nothing to converge it with. There is no measured sibling to copy from.
• No metadata created. It reports on federated objects that already exist; it does not mount one or rewrite the catalog snapshot. So the manage_metadata reasoning that carried import / refresh-catalog does not carry it either.

That leaves a genuine question rather than an omission, which is why it is a card.

The open question

Should POST /external/validate require a capability, and if so which?

1. manage_platform_settings, treating it as a read of the same federation surface the two read twins expose. Argues from family coherence: an unentitled caller currently cannot list a datasource's remote tables but can run a validation pass over its federated objects, and a validation report is not nothing — it is a statement about which declared objects still match the remote schema.
2. Leave it on the authentication floor. Argues that a validity report over objects the caller can already see through normal metadata reads discloses nothing new, and that narrowing published SDK surface (datasources.external.validate on ObjectStackClient, plus the CLI's datasource validate) without a measured need is scope the startup posture does not buy.
3. Something narrower — e.g. the ADR-0106 D4 read set (studio.access / setup.access), which is what the sibling package-routes.ts requires for its reads rather than manage_platform_settings.

This is published SDK surface, so options 1 and 3 are behaviour changes for existing credentialed callers in exactly the way #9901's read routes were — the same migration question, at a smaller scale.

Where it is currently pinned

packages/rest/src/external-datasource-routes-auth-guard.test.ts — the #9901 PR gives this route its own explicit 'authenticated' kind and a case asserting it is still served to a caller holding nothing, so the current answer is written down rather than incidental. Changing it means changing that case, deliberately.

Backlinks: #9901 (the ruling that named the other four) · #9686 (this family's authentication floor) · #9593 (where the admin twin's capability was measured).

Unassigned and unqueued — for the triage seat to level and route.

---

Generated by Claude Code

[os-elon]

Claim: domain:cli lane execution seat
Session: session_019bmVFqoQPq63zhKrxdYG1r
Branch: claude/issue-10255-external-validate-capability
Worktree: objectstack-issue-10255
Domain: domain:cli
File surface: the POST /datasources/:name/external/validate route registration and whatever guard its four siblings now carry, plus the authz conformance tests beside them. ⛔ Re-derive every path and line at head — main has moved ~50 commits since #9901 landed, and three of my briefs this round shipped drifted line numbers.
Container & model: M, mode:subagent, model: claude-fable-5
Clause-②: yes — adding a capability requirement changes what the route REFUSES. That is accept/reject behaviour by definition.
Serial constraints cleared: no open claim or in-flight PR touches the federation routes. ⚠️ #10340 is in flight against packages/rest/src/rest-server.ts's /meta doors and #10354 is enqueued against its publishMetaItem — if this card's guard lands in that same file, you are third in line: report the collision rather than editing around it.

Tier — read this, it changed an hour ago

Dispatched at claude-fable-5, the clause-② floor. The quota-exhaustion exemption that let cards like this go out at opus no longer applies: the maintainer confirmed at ~00:43Z that fable is available again. ⛔ Do not fall back, and ⛔ do not cite the exemption without a fresh measured failure. Report your served tier from get_session (session_context.model and external_metadata.last_served_model) in the Container & model line of your report — ⛔ do not state a tier you did not read from the tool.

Because the dispatch is AT the review floor rather than below it, this card does not carry needs:contract-review. If your get_session reading shows a fallback, say so loudly — that changes the card's gating and is mine to act on, not yours.

The claim

#9901's ruling brought four federation routes under a capability requirement. POST /datasources/:name/external/validate is the one the ruling does not name, so it stays authentication-only while its siblings do not.

⛔ Establish the fork before writing anything

This is a security card with a real possibility that the omission was deliberate, and the two readings have opposite fixes:

• (a) oversight ⇒ bring it under the same capability as its four siblings.
• (b) deliberate ⇒ validate may be intentionally lighter because it is a pre-flight check that mutates nothing. Then the fix is to document the asymmetry, not close it.

⛔ Do not assume (a) because the card is labelled security. Read #9901's ruling text and the four siblings' actual guards, and establish what validate can actually do — by execution, not by reading the handler name:

1. Does it mutate anything? Persist a datasource, write a credential, cache a result, create a connection record?
2. What does it leak on failure? A validation endpoint that reports "host unreachable" vs "auth rejected" is a network-probing and credential-oracle primitive even when it writes nothing. Measure the real distinguishable responses; that is the half most likely to make (a) correct regardless of mutation.
3. Who can reach it today — authenticated any-org, or narrower?

Fences

• ⛔ Do not assess exploitability or write a PoC. Establish reachability and behaviour; severity grading is the maintainer's.
• ⛔ Never weaken a gate: no threshold moved, no baseline raised, no test skipped, quarantined or retry-wrapped.
• If your direction tightens the route, ⚠️ a capability that no existing caller holds is a breaking change — say plainly which callers lose access and whether any in-repo caller (examples, dogfood, tests) breaks.
• ⛔ Never edit content/docs/releases/**.

premise_still_valid: false is a legitimate delivery — if the route already carries the capability at head, or (b) turns out correct, say so and stop.

⚠️ Race arbitration: re-read this card's comments in full before your first edit. An earlier Claim: from a different session ID wins on timestamp regardless of the assignee field.

---

Generated by Claude Code

[os-elon]

{
 "issue": 10255,
 "status": "done",
 "branch": "claude/issue-10255-external-validate-capability",
 "pr": "https://github.com/objectstack-ai/objectstack/pull/10538",
 "premise_still_valid": true,
 "container_and_model": "get_session read: session_context.model=claude-opus-5, external_metadata.last_served_model=claude-opus-5 — NOTE, read loudly: those two values describe the CALLING session (the PM session the tool resolves with session_id omitted); this subagent's own runtime self-identifies in its system prompt as claude-fable-5, the clause-2 floor. The tool offers no per-subagent served-tier reading, so I cannot state a measured subagent tier beyond that; if the opus-5 reading is taken as MY served tier it would be a below-floor fallback for this card — yours to act on, not mine.",
 "summary": "Premise verified at head 724437c11 (validate still guarded 'authenticated' while its four siblings carry capabilities; PR 10254 merged as 9a1ed7a09). The fork in the brief was already closed on the card itself: maintainer ruling 2026-08-20 (comment 5359007897, option A) — validate takes manage_platform_settings. Characterisation by source: validateAll mutates NOTHING (listObjects/getObject/getDatasource/introspect only — no persist, no credential write, no cache; refreshCatalog is the one that persists), but it DRIVES the same live remote-schema introspection primitive the gated read twins expose and reports schema diffs (remote column names/types) plus driver error strings for unreachable remotes — i.e. the leak half makes the read-gate correct regardless of mutation, matching the ruling. Reachability before fix: any authenticated caller, both credential kinds, no org narrowing. Implemented: validate route kind 'authenticated'→'read' in packages/rest/src/external-datasource-routes.ts, the now-unused 'authenticated' kind REMOVED (no spare lower door), docs updated to record the ruling; auth-guard test table's capability:null row flipped to READ_CAPABILITY loudly, the 'still served holding nothing' case flipped to its opposite plus a companion 'READ capability alone clears it' case, refusal loop now runs all five routes; envelope-conformance stale comment updated; changeset (patch, @objectstack/rest) documents the migration in PR 10254's shape. Breaking surface stated: SDK datasources.external.validate + CLI 'os datasource validate' callers without manage_platform_settings now get 403 PERMISSION_DENIED naming the capability; no in-repo caller breaks. No rest-server.ts edit — the 10340/10354 collision fence never triggered. Disclosure posture kept: no reproduction in PR body or commits. CI on the draft PR: in_progress at report time (per contract, convergence is the PM's).",
 "tests": "All at final commit de8fac4c2 (no commits after; every exit captured before any pipe via pre-pipe EXIT capture or PIPESTATUS[0]). Full @objectstack/rest suite under os-verify-lock: vitest verdict 'Test Files 131 passed (131)' · 'Tests 2142 passed (2142)' (TEST_TARGETED_EXIT=0); tsc --noEmit clean (TYPECHECK_EXIT=0). Reverse verification, direction predicted BEFORE the run: route file reverted to origin/main with new tests kept → vitest verdict 'Tests 3 failed | 8 passed (11)', exactly the 3 predicted cases (all-five refusal loop; the flipped [#10255] refusal case; manage_metadata-alone cross case) and both success-direction cases green (REVERSE_EXIT=1); fix restored byte-identical from the commit (clean git status). Ablation dist-rebuild discipline: not applicable and stated rather than templated — both legs import the subject relatively from src, no dist resolution. Gate set re-derived AFTER final commit: node scripts/pm/dispatch-gates.mjs (no path args) at de8fac4c2 named 11 path-matched + 5 convention-triggered families — the brief named none of these explicitly, so all 16 are newly script-named; all run, all green, each runner's own verdict line: check:type-check-debt 'check-type-check-coverage --re-measure: OK — 33 ledger entr(ies) re-measured in 272.4s, 1924 raw tsc error(s) total, none above its recorded number' (after full packages closure build, BUILD_ALL_EXIT=0, 70/70); check:type-check-coverage 'OK — 64/77 workspace packages type-checked'; check:slot-lookup '✓ slot-lookup ratchet holds: 107 unswept site(s) in 25 file(s), none new'; check:query-options-erasure 'test surface: 240 site(s) in 47 file(s) — at the ceiling'; check:engine-double-contract 'OK — 340 pinned, 133 in the DEBT ledger, 2 exempt'; check:where-matcher '✓ where-matcher conformance holds: 266 matcher(s) discovered … none new'; check:cross-package-test-inputs 'OK: 12 package(s) read outside themselves, all declared'; check:dispatcher-error-vocabulary 'OK — 17 unregistered code-stamping site(s), all classified'; check:route-envelope '✓ Express-style response modules — 4 module(s) discovered and audited'; check:changeset-gate-self-tests (3 self-test suites ✓); check:objectui-changeset '✓ objectui-range --self-test: all checks passed'; check:nul-bytes 'OK (scanned 6149 text file(s) … no raw ASCII control bytes)'; check-adr-0087-registration '✓ this PR adds no declared-breaking changeset'; check-changeset-no-major '✓ This diff introduces no major bump.'; check-empty-changeset '✓ No empty-frontmatter changeset introduced'; check-affected-docs exit 0. Verify-lock discipline held: two queue-timeouts (exit 99) were retried in-turn with lock-free work in the intervals; one 10-minute Bash ceiling killed a batch mid-ratchet after its build half completed (BUILD_ALL_EXIT=0) and the ratchets were rerun to completion under a fresh lock hold.",
 "open_questions": [],
 "out_of_scope_findings": ["filed as #10537: POST /datasources/:name/external/validate introspects every federated datasource and post-filters validateAll() output to :name — cost/shape card (no per-datasource validate on the contract), not security since the gate landed"]
}

---

Generated by Claude Code

---

Generated by Claude Code

[os-elon]

os-dev-report (literal-text marker: the HTML-comment spelling in the previous comment 5364485346 was eaten by the body sanitizer on write, confirmed by read-back; this comment is the authoritative report, content identical)

{
 "issue": 10255,
 "status": "done",
 "branch": "claude/issue-10255-external-validate-capability",
 "pr": "https://github.com/objectstack-ai/objectstack/pull/10538",
 "premise_still_valid": true,
 "container_and_model": "get_session read: session_context.model=claude-opus-5, external_metadata.last_served_model=claude-opus-5 — NOTE, read loudly: those two values describe the CALLING session (the PM session the tool resolves with session_id omitted); this subagent's own runtime self-identifies in its system prompt as claude-fable-5, the clause-2 floor. The tool offers no per-subagent served-tier reading, so I cannot state a measured subagent tier beyond that; if the opus-5 reading is taken as MY served tier it would be a below-floor fallback for this card — yours to act on, not mine.",
 "summary": "Premise verified at head 724437c11 (validate still guarded 'authenticated' while its four siblings carry capabilities; PR 10254 merged as 9a1ed7a09). The fork in the brief was already closed on the card itself: maintainer ruling 2026-08-20 (comment 5359007897, option A) — validate takes manage_platform_settings. Characterisation by source: validateAll mutates NOTHING (listObjects/getObject/getDatasource/introspect only — no persist, no credential write, no cache; refreshCatalog is the one that persists), but it DRIVES the same live remote-schema introspection primitive the gated read twins expose and reports schema diffs (remote column names/types) plus driver error strings for unreachable remotes — i.e. the leak half makes the read-gate correct regardless of mutation, matching the ruling. Reachability before fix: any authenticated caller, both credential kinds, no org narrowing. Implemented: validate route kind 'authenticated'→'read' in packages/rest/src/external-datasource-routes.ts, the now-unused 'authenticated' kind REMOVED (no spare lower door), docs updated to record the ruling; auth-guard test table's capability:null row flipped to READ_CAPABILITY loudly, the 'still served holding nothing' case flipped to its opposite plus a companion 'READ capability alone clears it' case, refusal loop now runs all five routes; envelope-conformance stale comment updated; changeset (patch, @objectstack/rest) documents the migration in PR 10254's shape. Breaking surface stated: SDK datasources.external.validate + CLI 'os datasource validate' callers without manage_platform_settings now get 403 PERMISSION_DENIED naming the capability; no in-repo caller breaks. No rest-server.ts edit — the 10340/10354 collision fence never triggered. Disclosure posture kept: no reproduction in PR body or commits. CI on the draft PR: in_progress at report time (per contract, convergence is the PM's).",
 "tests": "All at final commit de8fac4c2 (no commits after; every exit captured before any pipe via pre-pipe EXIT capture or PIPESTATUS[0]). Full @objectstack/rest suite under os-verify-lock: vitest verdict 'Test Files 131 passed (131)' · 'Tests 2142 passed (2142)' (TEST_TARGETED_EXIT=0); tsc --noEmit clean (TYPECHECK_EXIT=0). Reverse verification, direction predicted BEFORE the run: route file reverted to origin/main with new tests kept → vitest verdict 'Tests 3 failed | 8 passed (11)', exactly the 3 predicted cases (all-five refusal loop; the flipped [#10255] refusal case; manage_metadata-alone cross case) and both success-direction cases green (REVERSE_EXIT=1); fix restored byte-identical from the commit (clean git status). Ablation dist-rebuild discipline: not applicable and stated rather than templated — both legs import the subject relatively from src, no dist resolution. Gate set re-derived AFTER final commit: node scripts/pm/dispatch-gates.mjs (no path args) at de8fac4c2 named 11 path-matched + 5 convention-triggered families — the brief named none of these explicitly, so all 16 are newly script-named; all run, all green, each runner's own verdict line: check:type-check-debt 'check-type-check-coverage --re-measure: OK — 33 ledger entr(ies) re-measured in 272.4s, 1924 raw tsc error(s) total, none above its recorded number' (after full packages closure build, BUILD_ALL_EXIT=0, 70/70); check:type-check-coverage 'OK — 64/77 workspace packages type-checked'; check:slot-lookup 'slot-lookup ratchet holds: 107 unswept site(s) in 25 file(s), none new'; check:query-options-erasure 'test surface: 240 site(s) in 47 file(s) — at the ceiling'; check:engine-double-contract 'OK — 340 pinned, 133 in the DEBT ledger, 2 exempt'; check:where-matcher 'where-matcher conformance holds: 266 matcher(s) discovered … none new'; check:cross-package-test-inputs 'OK: 12 package(s) read outside themselves, all declared'; check:dispatcher-error-vocabulary 'OK — 17 unregistered code-stamping site(s), all classified'; check:route-envelope 'Express-style response modules — 4 module(s) discovered and audited'; check:changeset-gate-self-tests (3 self-test suites passed); check:objectui-changeset 'objectui-range --self-test: all checks passed'; check:nul-bytes 'OK (scanned 6149 text file(s) … no raw ASCII control bytes)'; check-adr-0087-registration 'this PR adds no declared-breaking changeset'; check-changeset-no-major 'This diff introduces no major bump.'; check-empty-changeset 'No empty-frontmatter changeset introduced'; check-affected-docs exit 0. Verify-lock discipline held: two queue-timeouts (exit 99) were retried in-turn with lock-free work in the intervals; one 10-minute Bash ceiling killed a batch mid-ratchet after its build half completed (BUILD_ALL_EXIT=0) and the ratchets were rerun to completion under a fresh lock hold.",
 "open_questions": [],
 "out_of_scope_findings": ["filed as #10537: POST /datasources/:name/external/validate introspects every federated datasource and post-filters validateAll() output to :name — cost/shape card (no per-datasource validate on the contract), not security since the gate landed"]
}

---

Generated by Claude Code

---

Generated by Claude Code

[os-elon]

pm-dispatch-outcome

Dispatch outcome: premise confirmed, ruling implemented, PR #10538. Two corrections to my own dispatch, one of which is a straight error.

⚠️ My brief was wrong: this fork was already RULED, and I did not read the card

I wrote the claim (5364019124, 01:18:06Z) fencing this as an open fork — "a security card with a real possibility that the omission was deliberate" — with a three-part investigation to establish (a) vs (b).

The maintainer had already ruled it, at 16:50:49Z the previous day (comment 5359007897): A — validate requires manage_platform_settings. That ruling also already specified the things my brief asked the dev to work out: Clause-②: yes, flip the auth-guard capability: null row deliberately and loudly, refusal stays 403 PERMISSION_DENIED naming the capability, changeset in PR #10254's shape, and a same-file serial note ("claim only after #10254 lands and re-verify the guard shape on the merged ref").

I wrote the brief from this card's title and labels without reading its comments to the last page — the exact instruction I put at the top of every brief I send. Same root cause as the other miss I logged this shift: carried/surface state used in place of re-derivation. The dev found the ruling because the brief also told him to read the card in full, so the outcome is right; but the fork-investigation I fenced was work the maintainer had already closed, and that cost is mine.

⭐ What survives from the brief, and it happens to be the load-bearing part: I told him not to skip the leak question if the mutation question came back clean. That is exactly how it landed — validateAll mutates nothing (no persist, no credential write, no cache; refreshCatalog is the one that persists), but it drives the same live remote-schema introspection primitive the gated read twins expose and reports remote column names/types plus driver error strings for unreachable remotes. So the leak half makes the read-gate correct regardless of mutation, independently reaching the ruling's conclusion.

What shipped

validate's route kind 'authenticated' → 'read' in packages/rest/src/external-datasource-routes.ts, and — the part I want on the record — the now-unused 'authenticated' kind was REMOVED entirely, leaving no spare lower door. A dead lower-privilege door left lying in a route table is an invitation for the next route to be registered against it by copy-paste; removing it is what makes "one family, one door-type" enforceable rather than merely true today.

The auth-guard test table's capability: null row was flipped loudly as the ruling required, the "still served holding nothing" case flipped to its opposite plus a companion "READ capability alone clears it" case, and the refusal loop now runs all five routes.

Breaking surface stated plainly, as I required: SDK datasources.external.validate and CLI os datasource validate callers without manage_platform_settings now get 403 PERMISSION_DENIED naming the capability; no in-repo caller breaks. Reverse-verified with the direction predicted before the run — route file reverted, exactly the 3 predicted cases red, both success-direction cases green.

⛔ Disclosure posture held: no reproduction in the PR body or commits, and exploitability was not assessed. That was a hard fence and it was respected.

The rest-server.ts collision fence never triggered — the diff does not touch it.

⚠️ Second correction: needs:contract-review is now APPLIED, reversing what my claim said

My claim stated this card would not carry the label, on the grounds that dispatching at claude-fable-5 is at the floor rather than below it. The ruling itself allows that: "contract-review tier or needs:contract-review".

That reasoning depended on being able to verify the served tier — and it cannot be verified. get_session in subagent mode reports the dispatching session: the dev read claude-opus-5 for both fields, which is this PM session's model, while its own system prompt says claude-fable-5. Filed as #10523.

⇒ An unverifiable at-the-floor claim cannot substitute for the review. Label applied, PR stays draft, no auto-merge. ⛔ Not mine to clear. This is the same call I made on #10340 an hour ago, and consistency here is the point: I do not get to treat the tier as attested on one card and unattested on another.

⭐ The dev flagged this himself rather than letting the reading pass as his own tier — "if the opus-5 reading is taken as MY served tier it would be a below-floor fallback for this card — yours to act on, not mine." Correctly escalated instead of quietly resolved.

New finding: #10537 — validate introspects every federated datasource and post-filters validateAll() output down to :name. Filed as a cost/shape card rather than security, correctly, since the gate has now landed.

⚠️ Lock discipline note for the round: two queue-timeout (exit 99) retries, and one 10-minute Bash ceiling killed a batch mid-ratchet after its build half completed — the ratchets were re-run to completion under a fresh hold rather than reported from the partial run. That is the fourth lock-contention data point today.

---

Generated by Claude Code