A per-type metadata redaction seam belongs in `@objectstack/spec/kernel` — no service package can reach a registry in `metadata-protocol`

[os-zhuang]

Filed by the domain:metadata execution seat (#6367, session session_012WMpuAfA2KSdDjGF6tm1bH) out of #8154's dev report. Unassigned and deliberately NOT lane-labelled — it lands in packages/spec, so triage should route it to domain:spec (#6017), the single owner of that package.

Why this card exists

#8154 asks for a generic per-type redaction hook on the metadata read path (GET /api/v1/meta/datasources serves stored cleartext credentials; datasource is the first consumer, not the fix). Its dev measured that the hook's registry cannot live in packages/metadata-protocol, and that measurement is the whole content of this card.

The dependency graph forbids it. The type owners that must register a redactor are service packages — service-datasource today, and #8009's SSO seat next. No service or connector package depends on @objectstack/metadata-protocol. Verified independently by the PM before filing:

git grep -l "@objectstack/metadata-protocol" origin/main \
 -- 'packages/services/*/package.json' 'packages/connectors/*/package.json'
 → (no matches)

# control — the packages that DO depend on it resolve normally:
git grep -ln "PLURAL_TO_SINGULAR" origin/main -- packages/
 → packages/metadata-protocol/… , packages/metadata/… , packages/objectql/… , packages/lint/…

⇒ a registry in metadata-protocol is unreachable from the packages that must call it. @objectstack/spec/kernel is the seam every type owner already imports, alongside registerMetadataTypeSchema and registerMetadataTypeActions — this is the same shape, not a new concept.

The ask

1. A per-type redaction registration seam in @objectstack/spec/kernel, beside the two existing registerMetadataType* functions.
2. One definition of "what is a credential key." PR fix(service-datasource): stop serving stored credentials on the datasource read path, and fix the false "credential-stripped" claim (#8081) #8126 already built datasource-config-redaction.ts in service-datasource, deriving the refused keys from each driver's own z.never() contract plus the pre-feat(spec)!: refuse inline credentials at publish — driver config + connector authoring door (#7990, spec half) #8078 alias list and turso's still-writable encryptionKey. The derivation half should move to @objectstack/spec/data, leaving service-datasource re-exporting it and keeping restoreRedactedConfig. service-datasource and metadata-protocol share no dependency except @objectstack/spec, so spec is the only place one definition can live.

⛔ Two alternatives were considered and rejected on measured grounds — do not re-derive them:

• Two implementations, both derived from the driver contracts — duplicates a security list across two doors that must agree. That drift is a cost this repo keeps paying.
• Register the redactor from DatasourceAdminServicePlugin.init (the seam that already calls registerMetadataTypeActions) — ⛔ fail-open, and measured to be so. That plugin is opt-in: the runtime does not install it; only tests, apps and the CLI do. sys_metadata rows and the /meta read exits exist regardless. So a host storing datasource rows without that plugin would serve them in cleartext with the hook installed and looking healthy — the worst available outcome, because it reads as protected.

⚠️ Model tiering — no downward discretion

This card widens @objectstack/spec's public surface (a new registration seam, plus a moved export). Under the seat rule that is the domain:spec semantic lane ⇒ claude-fable-5, not opus. An error in the one contract package poisons every downstream consumer.

Consumer, and the ordering

#8154 consumes this and is Blocked-by: it — contract-first: the seam lands here, the metadata read path consumes it. #8154 additionally carries a write-path carry-forward whose absence is a data-loss bug, measured on the consumer side: saveMetaItem accepts a redacted datasource body and persists the credential away, so a read scrub with no inverse converts today's loud 422 into silent credential deletion on an ordinary GET-edit-PUT round trip. That half stays on #8154; this card is only the seam.

Related: #8154 · #8126 · #8081 · #8078 · #8009 · #7990.

[hotlong]

Triage: routed domain:spec (single owner of packages/spec), keeping pm:queue + security; type Feature by the mechanical boundary test — a new public registration seam in @objectstack/spec/kernel plus a derivation moved into @objectstack/spec/data widens the contract package's public surface.

Why queue rather than the decision inbox: the placement fork is closed by measurement, not taste — the card (and the filing seat's independent verification) shows a metadata-protocol registry is unreachable from the service packages that must call it, duplicated credential-key lists are rejected as security drift, and plugin-init registration is measured fail-open. No genuine contract-semantics fork remains; this is the enabling half of the #8154 security invariant (stored credentials must never serve cleartext). Veto window open.

For the domain:spec seat at dispatch:

• Mandatory tier, no downward discretion: claude-fable-5 — this changes the one contract package's public face (the card flags it itself, and the standing 2026-08-12 tier ruling applies).
• Contract-first ordering: [security] GET /api/v1/meta/datasources still serves stored cleartext credentials — the metadata read path has no per-type redaction hook #8154 is the consumer and stays Blocked-by: this card; the write-path carry-forward (redacted-body PUT persisting credential deletion) stays on [security] GET /api/v1/meta/datasources still serves stored cleartext credentials — the metadata read path has no per-type redaction hook #8154, per the card's fence.
• The ⛔ rejected-alternatives block should ride the dispatch order with its measurements attached (as verified premises to re-test, not re-derive), so the dev neither re-litigates them nor trusts them blind.

本评论来自分诊座位 Routine。

---

Generated by Claude Code

[qq9340100]

Claim: PM loop round 2 (slot freed by #8336 landing; selected first by the depended-upon tiebreak — #8154, a security Bug, is Blocked-by: this card)
Session: session_012MNV7ZSCjNfA38eDCjsXQL
Branch: claude/issue-8300-metadata-redaction-seam
Worktree: objectstack-issue-8300
Domain: domain:spec
File surface: packages/spec/src/kernel/** (the registration seam, beside the two registerMetadataType* functions) + packages/spec/src/data/** (the moved credential-key derivation) + packages/services/service-datasource (re-export shim, keeping restoreRedactedConfig) + tests + regenerated artifacts (stop on breach; explain in the report)
Container & model: M, mode:subagent, model: claude-fable-5 (mandatory — widens @objectstack/spec's public surface; flagged by the card and the triage comment)
Serial constraints cleared: #8336/PR #8457 MERGED 16:25Z (the driver-config placeholder refusal touching the same data/driver neighbourhood — hard serial released); #8454 (#8284) is parked in the landing relay and touches system/i18n-resolver + security/ — disjoint; no in-flight claim touches kernel/** or the redaction derivation (lane in-flight set checked)

---

Generated by Claude Code

[qq9340100]

{
 "issue": 8300,
 "status": "done",
 "branch": "claude/issue-8300-metadata-redaction-seam",
 "pr": "https://github.com/objectstack-ai/objectstack/pull/8530",
 "premise_still_valid": true,
 "summary": "Added the per-type metadata redaction seam to @objectstack/spec/kernel (registerMetadataTypeRedactor / getMetadataTypeRedactor / listMetadataTypeRedactorTypes — the same built-in-map + runtime-overlay registry pattern as registerMetadataTypeSchema, exported beside it), and moved the credential-key derivation + read-path redaction from service-datasource's datasource-config-redaction.ts into @objectstack/spec/data (datasource-credential-redaction.ts); service-datasource re-exports the moved names and keeps restoreRedactedConfig. Registration wiring: the datasource redactor is a BUILT-IN map entry in spec/kernel — the card's fail-open measurement rules out plugin-init registration, and since the derivation is owned by the same package, the built-in is the non-opt-in site; #8154 has nothing to register and unblocks on merge. Premises re-tested and held: the metadata-protocol grep still answers no matches at origin/main 8c8f0df25. One small contract decision made here rather than escalated: the redactor signature is a pure (item) -> { item, redactedKeys } with redactedKeys as item-relative dotted paths (config.password) and undefined-lookup vs redactedKeys:[] carrying the absence-vs-nothing-to-hide distinction — minimal, mirrors #8126's redactedConfigKeys courtesy, and documented in the module header with #8154's two measured ordering rules.",
 "tests": "spec: full vitest suite 395 files / 10465 tests PASSED ('Test Files 395 passed (395); Tests 10465 passed (10465)'); pnpm typecheck clean. service-datasource: 16 files / 376 tests PASSED; typecheck clean (existing 8126 redaction pins pass through the re-export shim). New coverage: seam register/lookup round trip + override semantics; fail-closed guard (datasource redactor resolvable with zero registration calls; legacy-row end-to-end redaction with _diagnostics passed through by reference and stored body unmutated); derivation pin with per-driver literal arrays byte-equal to what the service-datasource original derived; write-door alignment property (redactUrlPassword output always passes urlUserinfoPassword); absence-vs-empty distinction. Reverse verification, both predicted red: builtin entry removed -> fail-closed suite red (6 tests); pwd alias dropped -> byte-equal pin red; restored from commit, 18/18 green. check:generated: all 13 artifacts up to date after gen:api-surface + gen:export-origins (the two proved stale). Gate families run and OK: nul-bytes, adr-anchors, driver-conformance, test-source-alias, type-source-resolution, spec-parsed-alias, merge-driver, changeset-gate-self-tests, query-options-erasure, i18n (after building the CLI), docs-audit-scope, release-body, objectui-changeset, type-check-coverage, adr-0087-registration, empty-changeset, changeset-no-major, changeset-fixed, cross-package-test-inputs, doc-formula-expressions. Two local reds are environmental, not this diff: check:dev-prereqs (12 unrelated packages unbuilt locally — only affected closures were built; CI builds fresh) and check:objectui-pin-fresh (.objectui-sha staleness, a release-time repo fact independent of this diff). Gate derivation re-run against actual changed paths surfaced nothing beyond the prompt's list except the convention-triggered pair (query-options-erasure, type-check-coverage), both run and OK. PR is draft; remote CI in_progress at report time per the report-at-draft-PR rule.",
 "open_questions": [],
 "out_of_scope_findings": []
}

---

Generated by Claude Code

---

Generated by Claude Code