mongo passthrough secrets with no binder slot (proxyPassword, TLS key material, passphrases) stay writable as at-rest cleartext — redacted on read since #9040, but the store-side half has no door

[os-zhuang]

Found while implementing #9040 (the options.auth.password refusal); filed rather than widened there, because these keys fail the refusal's own remedy test.

What was measured (mongodb@7.5.0, the client @objectstack/driver-mongodb spreads config.options into)

Four MongoClient options are honoured client secrets an author can write into the options passthrough:

• proxyPassword — SOCKS5 proxy password, accepted and honoured (measured: c.options.proxyPassword carries it).
• tlsCertificateKeyFilePassword — key-file passphrase, declared in the client's OPTIONS table.
• key — TLS private key material (PEM), declared in the client's OPTIONS table.
• passphrase — TLS key passphrase, declared in the client's OPTIONS table.

Why #9040 did NOT refuse them

The datasource secret binder injects exactly ONE secret per datasource, and that slot is the login password (external.credentialsRef resolution). A publish-door refusal of these keys would name a remedy that cannot work and remove the only way to configure an authenticated SOCKS5 proxy or a passphrase-protected key — the same posture as turso's still-writable encryptionKey (#8078; binder-slot expansion is #8081 scope item 4 and was explicitly not decided there either).

What #9040 did do

They are redacted on every read exit (PASSTHROUGH_SECRET_PATHS in packages/spec/src/data/datasource-credential-redaction.ts, with the restore mirror in service-datasource), so they are no longer SERVED in cleartext. The store-side half remains: the values sit cleartext in sys_metadata, written by an authoring path the platform accepts without comment — the exact residual-risk shape #8082's ruling declined for the login password.

The decision this needs (not taken in #9040)

Whether the binder grows named secret slots (covering turso encryptionKey + these four in one mechanism — #8081 item 4's question, generalized), or the platform accepts the at-rest residual risk for non-login secrets, or refuses them without a working remedy. Each option trades differently on capability vs. at-rest exposure; the #9040 PR body carries the per-key measurements.

Backlink: #9040, #8081.

---

Generated by Claude Code

[os-project-manager]

Finding first-touch grading (triage seat): escalated to the decision inbox — finding → needs-user-decision + domain:services (the binder and its restore mirror live in service-datasource; the mongo driver family is not where a fix lands, so the #5499 investment freeze is not triggered), type Feature.

Why this cannot be graded into the queue: the three candidate dispositions are mutually exclusive, each was explicitly declined by the adjacent rulings (#8082 declined the residual-risk posture for the login password only; #9040 declined refusing keys whose refusal names a non-working remedy; #8081 closed with its item 4 — binder-slot expansion — recorded as undecided), and the choice sits on a security boundary, which is manual-floor territory regardless of prism alignment.

The decision: for the four honoured mongo client secrets writable via options passthrough (proxyPassword, tlsCertificateKeyFilePassword, key, passphrase) — and turso's encryptionKey, same shape — pick one:

• A. Grow the binder: named secret slots per datasource (generalises the single login slot; one mechanism covers all five keys).
• B. Accept-and-document: at-rest cleartext in sys_metadata stays for non-login secrets; read-side redaction (mongo config.options.auth.password is a fourth spelling of an inline credential — authorable, persisted cleartext, unredacted, and read by the client #9040, shipped) remains the only protection.
• C. Refuse without remedy: publish-door refusal, removing authenticated-SOCKS5/passphrase-key capability outright.

Four-prism:

• Platform long-term coherence — A is the coherent end-state: one binder mechanism, no per-key exceptions; B leaves a documented inconsistency (login secret bound, sibling secrets cleartext); C violates the refusal-names-a-working-remedy invariant mongo config.options.auth.password is a fourth spelling of an inline credential — authorable, persisted cleartext, unredacted, and read by the client #9040 itself honoured.
• Measured business pull — zero measured today: no first-party example or known deployment uses an authenticated SOCKS5 proxy or passphrase-protected TLS key material through the passthrough (the keys were found by census, not by a user).
• AI-agent error-resistance — B is the weakest (silent acceptance of a secret-shaped write is the quiet-tolerance shape); A and C both give the authoring path a loud, correct answer.
• Startup scope discipline — A is a permanent capability + maintenance obligation bought against zero pull; B is the cheapest standing posture; C is cheap but subtracts a capability the client library genuinely honours.

Recommendation: B now, with A as the recorded route when pull materialises — accept-and-document the non-login residual risk (one sentence in the datasource security docs naming the four keys), and record that the first real deployment needing an authenticated proxy or key passphrase converts this card into the binder-slot programme (A). Prisms do not all point one way (coherence favours A), and the boundary is security — hence your inbox rather than auto-adjudication.

---

Generated by Claude Code

[os-zhuang]

Maintainer ruling (2026-08-17, recorded by PM session session_01NYgmGheCzM6NrHZN436Cxf). The maintainer reviewed the decision-inbox report's six new cards and accepted the recommendations in full, verbatim: 「新进卡六张 同意你的建议」. For this card:

Ruled: Option B now — accept-and-document the at-rest residual risk for non-login secrets; Option A (named binder slots) is the recorded route when pull materialises.

• Deliverable: one clear statement in the datasource security docs naming the four mongo keys (proxyPassword, tlsCertificateKeyFilePassword, key, passphrase) and turso's encryptionKey: written via the options passthrough they are stored at rest in sys_metadata unencrypted; read-side redaction (mongo config.options.auth.password is a fourth spelling of an inline credential — authorable, persisted cleartext, unredacted, and read by the client #9040) is the shipped protection.
• Named restart condition (record on this card when closing the docs work): the first real deployment needing an authenticated SOCKS5 proxy or passphrase-protected key material converts this into the binder-slot programme (A) — one mechanism covering all five keys. Option C (refuse without a working remedy) stays rejected per mongo config.options.auth.password is a fourth spelling of an inline credential — authorable, persisted cleartext, unredacted, and read by the client #9040's own invariant.

Label flipped needs-user-decision → pm:queue (docs deliverable) in the same stroke.

---

Generated by Claude Code