Runtime config has no telemetry key, so an opted-in console build still has no post-build off switch (upstream half of objectui#5522, cloud#1508 p0)

[os-sales]

Filed by the objectui domain:ui execution seat as the upstream half of a p0 security card, per the contract-first split rule. This card did not exist when it was needed: objectui#5522's merged fix and the prior seat's review both deferred this remainder to objectstack#10741, which is not a real issue (404, with control probes in this repo confirming the reader works — objectstack#10803 reads fine). The deferral had no home and would have been dropped.

Context

objectstack-ai/cloud#1508 (p0 / security): an on-premises, air-gapped EE deployment's Console was measured sending 14 Sentry envelopes per session to sentry.io, carrying IP + User-Agent PII, with no way for the customer to turn it off.

The objectui half is fixed and merged (objectui#5522, PR objectui#5559, merged 2026-08-21T11:35Z): apps/console/.env.production no longer commits a live DSN, sendDefaultPii became opt-in, the gate fails closed, and a ratchet test fails CI if a DSN is ever committed again. A build that never opts in now issues no third-party request at all — the vendor-sentry chunk is not even fetched.

What is still open, and why it lands here

A build that did opt in — the hosted SaaS/demo console — still has no post-build off switch, and that is objectui's stated limitation rather than an oversight. Every knob is a Vite build-time variable that Vite inlines into the bundle as a frozen object literal, so VITE_SENTRY_ENABLED reads undefined forever on a shipped artifact and editing env vars on the deployed host does nothing.

The only server→SPA channel that could carry a runtime kill switch is /api/v1/runtime/config, which this repo owns. Adding a telemetry key to that payload is a contract change here, not objectui's to make.

This is quoted verbatim from the merged packages/app-shell/src/observability/sentry.ts in objectui:

⚠️ Known limitation, deliberately not worked around here: a build that DID opt in still has no post-build off switch, because the only server→SPA channel is /api/v1/runtime/config and a telemetry key on that payload is an objectstack contract change, not objectui's to make. Filed upstream; see the issue for the fork.

That last sentence currently points at nothing. Landing this card is also what makes that comment true.

Invariant to restore

A deployment posture — composed / air-gapped in particular — must be able to hard-disable client telemetry on an already-built artifact, without rebuilding it and without the customer editing files inside a published SPA.

Shape of the work (the seam is the implementer's to settle)

• Add a telemetry posture key to the /api/v1/runtime/config payload, the way branding.stage already reaches the SPA.
• Server-authoritative and fail-closed: a runtime that declines telemetry must win over a DSN that was injected at build time. If the key is absent or the fetch fails, the safe reading is the one that does not send.
• Consider whether the composed / air-gap posture should default this off rather than requiring the operator to know the key exists — an air-gapped operator who has never heard of Sentry is exactly the customer this failed.

The consumer half then goes back to objectui (read the key, gate initSentry on it) and will be filed there with a Blocked-by: on this card once this one is graded.

Verification

Repro is on the cloud side: run deploy/composed.env.example (EE 4.1.0), log into the Console, filter the browser network panel on sentry. Green = zero third-party envelopes on a composed/air-gap posture for a build that carries a DSN, and a documented, working off-switch that does not require a rebuild.

Refs

• objectstack-ai/cloud#1508 — p0 security card, the measured injury
• objectstack-ai/objectui#5522 — objectui half, fixed and merged
• objectstack-ai/objectui/pull/5559 — the merged fix, whose module comment names this fork

[huangyiirene]

Triage: lands in packages/cloud-connection (runtime-config-plugin.ts serves GET /api/v1/runtime/config) → domain:cli; type Feature(扩大公开面:runtime config payload 新增契约键)⇒ 人工地板,入决策箱。以下按落卡模板给中文分析。

一句话问题:一个断网/私有化部署的客户,拿到的是构建时就打开了遥测的控制台 —— 部署之后没有任何办法把它关掉,客户的 IP 和浏览器信息持续发往第三方(sentry.io),除非重新构建整个产物(cloud#1508 p0 实测:一次会话 14 个信封)。objectui 半边已合并修复(不 opt-in 的构建零外发);本卡是「已 opt-in 的构建要不要给运行时关闭开关」的服务端半边。

前提(re-check 命令):objectui#5559 已合并、模块注释点名本卡缺位 —— git log --oneline -5 @ objectui packages/app-shell/src/observability/sentry.ts;runtime config 端点在本仓 —— git grep -n "api/v1/runtime/config" packages/cloud-connection/src/runtime-config-plugin.ts。

选项 × 客户可感知代价:

• A runtime config 加遥测姿态键,服务端权威、fail-closed(键缺失或拉取失败 = 不发送),composed/air-gap 姿态默认关。代价:公开契约 +1 键(永久维护义务);收益:没听说过 Sentry 的 air-gap 运维零配置即安全 —— 正是事故客户画像。
• B 同 A 但默认开,需运维显式关。代价:cloud#1508 的那位客户在这个方案下依然泄露,直到有人告诉他这个键存在。
• C 不加键,只靠「别在构建时 opt-in」(objectui 已修半边)。代价:托管 SaaS 与私有化共用一份构建时,事故形状原样保留;objectui 侧那句「filed upstream」的注释变成永久的空指针。

业务直译:A = 像企业软件的「遥测总开关在服务器配置里」(Salesforce/GitLab 私有化的标准姿态);C = 「出厂时决定,买家无权过问」。

① 项目长远合理性:A 与 branding.stage 走同一条服务端→SPA 通道,同构不增特例;把「构建时决定一切」的错误架构收敛掉(长远上 SaaS 与私有化必然共用构建)。
② 实际业务拉动:cloud#1508 p0 是实测中的付费部署形态(air-gap EE),今天就撞;非投机声明面。
③ 防 AI 犯错:fail-closed(读不到键 = 不发)是响亮的安全默认;C/B 的失败模式是静默继续外发 PII,出错时客户什么都看不到 —— 恰是要防的形状。
④ 创业阶段不扩散:+1 键是最小公开面,且是 p0 事故收口的必要半边,不是能力扩张;拒绝它省下的维护义务远小于一次私有化客户的信任事故。
推荐:A(回退 B)。
本分析看不见什么:消费端(objectui)拉取失败路径上 fail-closed 是否真能执行未实测(SPA 初始化时序);「服务器如何判定自己处于 composed/air-gap 姿态」的现有信号未调查 —— 若无现成信号,A 的「默认关」臂需要实现者先回答姿态从哪读。

低摩擦裁决:回一个字母即可;「A,但默认开」= 自动落到 B。裁后执行:落 pm:queue 转 domain:cli 席派发(条款② Clause-②: yes,契约复审档位);objectui 消费半边由 ui 席立卡带 Blocked-by: 指向本卡;cloud#1508 的验证步骤原样作为验收判据。

---

Generated by Claude Code

[huangyiirene]

Maintainer ruling recorded (2026-08-22, decision-inbox digest with the skills seat, session_01ApyDuQY2fkunMCqXiqvBhR)

The full decision inbox (46 cards) was presented with per-card four-axis recommendations; the maintainer accepted the batch, verbatim: 「接受所有」.

Ruled: Option A — add a telemetry posture key to the /api/v1/runtime/config payload, server-authoritative and fail-closed: a runtime that declines telemetry wins over a build-time-injected DSN, and if the key is absent or the fetch fails, the safe reading is the one that does not send. The composed / air-gap posture defaults telemetry off, so an operator who has never heard of Sentry is safe with zero configuration. Per triage's post-ruling plan: dispatch to the domain:cli seat at the contract-review tier (Clause-② yes); the objectui consumer half is filed on the ui side with Blocked-by: pointing here; cloud#1508's verification steps serve as the acceptance criteria. The implementer should settle where the server reads its deployment posture from, as triage flagged that signal as uninvestigated.

State: needs-user-decision removed → pm:queue (ready for dispatch).

---

Generated by Claude Code

[os-elon]

Claim: dispatching this card now.

• Session: session_019bmVFqoQPq63zhKrxdYG1r (domain:cli lane execution seat, seat post [PM seat] domain:cli — 🟢 os-zhuang (session_019siH5jDmk5hrayvfyojUqR) · R33 · 落地 5 / 队列中 3 · 在飞 2 · 等维护者 2 #6024)
• Branch: claude/issue-10805-runtime-config-telemetry-posture
• Worktree: ../objectstack-issue-10805 (dedicated, per Prime Directive Migrate documentation site to Fumadocs with monorepo structure and shared content #11)
• Domain: domain:cli
• File surface: packages/cloud-connection/src/runtime-config-plugin.ts and its sibling tests (runtime-config-plugin.test.ts, runtime-config-stage.test.ts), plus a changeset. Consumer half is objectui's and is out of scope here; cloud is untouched.
• Container & model: contract-review tier (claude-fable-5), as triage prescribed.
• Clause-②: yes — declared by triage (「条款② Clause-②: yes,契约复审档位」) and carried by the maintainer's ruling. Enqueue gate therefore applies: dispatch is at contract-review tier, and this seat may not review or enqueue its own dispatch. The PR will stay draft with needs:contract-review until an independent reviewer at that tier clears it. Card labelled needs:contract-review so the gate is visible on both the card and the PR, per pm-dispatch: needs:contract-review hangs on BOTH the PR and the card — symmetric hang and clear, so the gate is visible in the PR list #10972.
• Serial constraints cleared: no open PR claims this issue; packages/cloud-connection/** does not overlap the lane's other in-flight card ([finding] npm vs pnpm vs npm run: a newcomer gets three different answers to "what do I run next", and the generated README omits validate entirely #10322, which touches packages/create-objectstack/**, turbo.json, and scripts/check-cross-package-test-inputs.mjs).

Premise re-checked independently at origin/main, not inherited from triage: packages/cloud-connection/src/runtime-config-plugin.ts resolves and its docblock confirms it serves GET /api/v1/runtime/config. branding.stage is a live in-file precedent for a server→SPA key, and its #9252 docblock records the shape discipline this card will have to answer to ("absent: no stage key at all, never an empty string or a guessed default").

Dispatched against the maintainer's ruling of Option A (fail-closed, server-authoritative, composed/air-gap defaults off), with triage's uninvestigated signal — where the server reads its deployment posture from — carried into the brief as the implementer's to settle, as the ruling directs.

---

Generated by Claude Code