[security] Two more spec schemas permit inline credentials: `ExternalDataSourceSchema.authentication` (clientSecret/apiKey) and `MessageQueueConfigSchema.sasl.password` — census toward #7990's parked boundary-guard reopen trigger

[huangyiirene]

Found during the #7990 spec-half census (dev session session_0123k4cam2jEAkPmbJeoaY3r, 2026-08-12). Filed unassigned for triage to grade and route; not fixed in the #7990 PR — the maintainer's Option-A ruling (#7990 comment 5266068845) scoped that fix to the two measured surfaces (driver config, connector authentication) and parked the class-level sys_metadata write-boundary guard with reopen trigger = "a third measured artefact-type surface". This card is the census input for that trigger, not a re-litigation of the ruling.

What was measured (file:line on origin/main, 2026-08-12)

1. packages/spec/src/data/external-lookup.zod.ts — ExternalDataSourceSchema.authentication is { type: 'oauth2' | 'api-key' | 'basic' | 'none', config: … } whose module docblock's own example writes "clientSecret": "..." inline (~L23). The schema accepts inline secrets in authentication.config.
2. packages/spec/src/system/message-queue.zod.ts:60-65 — MessageQueueConfigSchema.sasl declares password: z.string().describe('SASL password') — a required inline broker credential when sasl is present.

What was NOT measured (the grading question)

Whether either schema is reachable from a sys_metadata publish door (metadata-type binding, stack collection, or /meta route) — i.e. whether these are cleartext-at-rest sinks like #7990's ①-c/①-d, or dormant declared shapes with no persisting consumer. ExternalDataSourceSchema sits in data/ next to field-level external-lookup config (plausibly authored inside object metadata); MessageQueueConfigSchema's consumers were not traced. If either is (a) reachable and persisted, it is a third measured surface for the parked Option-B guard; if (b) unreachable, ADR-0049 enforce-or-remove applies instead.

Prior art

• [security] sys_metadata.metadata is a general cleartext sink: any authored artefact whose schema permits an inline credential lands it there (datasource config.password, connector authentication) #7990 — the ruled per-artefact closure (driver config + connector authoring door), spec half in PR (branch claude/issue-7990-inline-credential-refusal).
• [security] sys_sso_provider.oidc_config carries the OIDC clientSecret in a cleartext JSON textarea, by its own field description #8009 — sibling: sys_sso_provider.oidc_config clientSecret.
• The finding: survey — which other config objects still keep credentials in a JSON blob column, now that resolveSecretField() makes the Field.secret() channel readable #7902 survey (comment 5264546868) — the 26-surface verdict table these two were not part of.

---

Generated by Claude Code

[hotlong]

Triage: domain:spec (the two schemas are packages/spec acceptance surface; per the one-package-three-seats split any card that may change accept/reject behaviour is the semantic lane's), pm:queue. Scope as dispatched: measurement first, no fix without the ruling. The deliverable is the reachability trace the card itself names as the grading question — whether ExternalDataSourceSchema.authentication and MessageQueueConfigSchema.sasl.password are reachable from a sys_metadata publish door (metadata-type binding, stack collection, or /meta route) and persisted.

Outcome fork, pre-agreed at triage so the dev does not have to guess:

• (a) reachable + persisted ⇒ report back with file:line evidence and STOP — that is the "third measured artefact-type surface" reopen trigger for the maintainer's parked Option-B boundary-guard ruling ([security] sys_metadata.metadata is a general cleartext sink: any authored artefact whose schema permits an inline credential lands it there (datasource config.password, connector authentication) #7990 comment 5266068845). Reopening that ruling is the maintainer's, not ours; the card flips to needs-user-decision with the evidence attached.
• (b) unreachable / no persisting consumer ⇒ ADR-0049 enforce-or-remove applies; report with the zero-consumer evidence and the card gets re-scoped to the retirement route (spec seat, claude-fable-5 per the mandatory tiering clause, since removal changes the acceptance surface).

premise_still_valid: false with evidence is a fully successful run here. Mandatory model note for the claiming seat: this is domain:spec semantic lane ⇒ dispatch at claude-fable-5 (measurement may collapse into an acceptance-surface change; do not tier down).

本评论来自分诊座位 Routine。

---

Generated by Claude Code

[huangyiirene]

Claim: PM loop round 2 (spec seat, seat post #6017) — measurement only, per the triage scope
Session: session_0123k4cam2jEAkPmbJeoaY3r
Branch: none expected (pr: null is the anticipated deliverable; a branch only if the trace needs a pinned probe test, named in the report if so)
Worktree: objectstack-issue-8075 (read-mostly)
Domain: domain:spec
File surface: read-only reachability trace of ExternalDataSourceSchema.authentication and MessageQueueConfigSchema.sasl.password against the sys_metadata publish doors. ⛔ No fix in this dispatch — the triage-agreed fork governs: (a) reachable+persisted ⇒ evidence + STOP (third-surface reopen trigger → needs-user-decision); (b) unreachable ⇒ evidence, card re-scopes to the ADR-0049 retirement route in a later dispatch.
Container & model: S–M, mode:subagent, model: fable (triage's mandatory note: semantic lane, measurement may collapse into an acceptance-surface question — do not tier down)
Serial constraints cleared: read-only; no file-face intersection with #7831 (the only other in-flight claim).

---

Generated by Claude Code

[huangyiirene]

{
 "issue": 8075,
 "status": "done",
 "branch": null,
 "pr": null,
 "premise_still_valid": true,
 "summary": "Both schemas land on fork (b): unreachable / no persisting consumer — this census does NOT produce the third measured artefact-type surface, so the #7990 Option-B reopen trigger is not met. (1) ExternalDataSourceSchema.authentication (packages/spec/src/data/external-lookup.zod.ts:31-67; config is a record of unknown at :65, docblock inline clientSecret at :23): no metadata-type binding — kernel/metadata-type-schemas.ts imports neither module (its import block :29-71), BUILTIN_METADATA_TYPE_SCHEMAS has no entry, UNREGISTERED_KIND_SCHEMAS (:215-243) is webhook/connector/sharing_rule only, and no code outside spec calls registerMetadataTypeSchema (only docblock mentions in metadata-protocol); no stack collection — stack.zod.ts imports nothing from external-lookup.zod; no object/field embedding — field.zod.ts:1011 externalId is a plain boolean and object.zod.ts:1648 external binds ObjectExternalBindingSchema (:1003 — remoteName/remoteSchema/writable/columnMap, no authentication; the ADR-0015/0062 federated path routes credentials through datasources, not this schema). Exported-but-unconsumed, the NormalizedFilterSchema shape; concurs with the prior in-repo verdict at conversions/registry.ts:4467-4471 (no external-lookup document exists for the walker to visit). (2) MessageQueueConfigSchema.sasl.password (packages/spec/src/system/message-queue.zod.ts:54-65, password :63): zero consumers outside packages/spec repo-wide (definition + own tests + generated artifacts + auto-generated docs only); DEFAULT_METADATA_TYPE_REGISTRY has no message_queue type; integration/connector.zod.ts:584 'message_queue' is only a ConnectorType enum value (connector authentication is #7990's already-measured surface and does not reference this schema); the consumed near-namesake EventMessageQueueConfigSchema (kernel/events/integrations.zod.ts:104-150, used by EventBusConfigSchema.messageQueue at bus.zod.ts:59) deliberately carries NO credential field — so the consumed MQ shape has no credential key and the credential-bearing MQ shape has no consumer, not even a runtime-received one. Door-side context, not a consumer of these schemas: saveMetaItem's documented 'unregistered type stores without validation' branch (metadata-protocol/src/protocol.ts:416 and :8642-8648 — no static registry entry synthesises allowRuntimeCreate true) persists arbitrary JSON under any unregistered type name, but no payload through that door is parsed by either schema; that door class is already tracked in-code under #6245 with the #2657 B/C decision open, so nothing new to file. ADR-0049 enforce-or-remove applies to both; note the auto-generated reference page content/docs/references/data/external-lookup.mdx teaches the inline-clientSecret example straight from the schema docblock and falls out with a retirement.",
 "tests": "No build/test run — read-only static trace on origin/main @ 3670cf9f2; no branch, no worktree edits, no executable pin needed (per dispatch, pr: null anticipated; the template's branch field does not apply and is null). Zero-hit controls per the method requirement: (a) grep 'external-lookup|ExternalLookup|ExternalDataSource' over packages/** excluding packages/spec = 0 files, and 'message-queue|MessageQueue' same scope = 0 files, while the SAME scope returns 34 occurrences across 21 files for 'DeclarativeConnectorEntrySchema|DatasourceSchema' and 15+ files for 'getMetadataTypeSchema' — the search demonstrably reaches the corpus. (b) Value-level control: case-insensitive 'sasl' outside packages/spec hits only pnpm-lock.yaml (@mongodb-js/saslprep, unrelated mongodb dep) and the auto-generated docs table — no example or runtime authors a sasl block. (c) Artifact-census control: authorable-surface.base.json lists data/ExternalDataSource:authentication (:3254) and system/MessageQueueConfig:sasl (:6058), proving the generated census sweeps ALL exported schemas — presence there is not reachability evidence. Repo-wide grep of the export names (whole checkout, no glob) hit only packages/spec, content/docs, and .changeset.",
 "open_questions": [],
 "out_of_scope_findings": []
}

---

Generated by Claude Code

---

Generated by Claude Code