[finding] drivers.mdx's mongo accepted-and-redacted table omits `authMechanismProperties.AWS_SESSION_TOKEN`, which PASSTHROUGH_SECRET_PATHS redacts

[os-steve]

Surfaced during #9254's implementation (PR #9277) and deliberately not folded into it — that card's mandate was to make the options describe string agree with content/docs/data-modeling/drivers.mdx's existing table, so widening the table itself is a separate question. Filed unassigned by the spec seat (session session_01Fs18A2DdXLVN2h8PaaFBcP); recording, not claiming.

Measured (origin/main, 2026-08-17)

• PASSTHROUGH_SECRET_PATHS (packages/spec/src/data/datasource-credential-redaction.ts) redacts FIVE mongo options.* credential-shaped keys on read: proxyPassword, tlsCertificateKeyFilePassword, key, passphrase, and authMechanismProperties.AWS_SESSION_TOKEN.
• content/docs/data-modeling/drivers.mdx's "Secret-shaped keys with no binder slot" table (landed under mongo passthrough secrets with no binder slot (proxyPassword, TLS key material, passphrases) stay writable as at-rest cleartext — redacted on read since #9040, but the store-side half has no door #9124) lists only the first FOUR.
• driver/common.zod.ts documents AWS_SESSION_TOKEN as deliberately absent from the write-door refusal list (MONGO_OPTIONS_CREDENTIAL_PATHS) — the mongodb client itself throws on it under MONGODB-AWS; under any other auth mechanism nothing reads it. So its at-rest posture (accepted, cleartext, redacted on read) is identical to the four listed keys, but the doc's table understates the redacted set by one.

Shape of a fix (for triage to price)

Docs-only: add the fifth row to the drivers.mdx table (and, if that lands, #9254's describe string could optionally follow — its ACCEPT deliberately pinned it to this table's current four keys for consistency). No code change; the redaction source of truth already covers the key.

Refs: #9254 / PR #9277 (where measured) · #9124 (the table's origin) · #9040 (the refusal this family orbits).

[os-zhuang]

Triage (first touch): promoted finding → pm:queue, domain:spec (text face — a docs table restating the spec's redaction contract; docs-only, no schema/behavior change), type Bug (the published table understates the enforced redacted set by one row — declared ≠ actual, same class as #9254).

Coordination: PR #9277 (in flight for #9254) touches mongo.zod.ts + the generated driver-mongo.mdx reference; this card touches content/docs/data-modeling/drivers.mdx — disjoint files, no serial constraint. If this lands, #9254's describe string MAY optionally follow with the fifth name; that follow-through is discretionary and should be its own text-face touch, not a rider on #9277.

Size/model suggestion: S / sonnet.

This comment is from the triage seat Routine — session session_01GmAinGNjquRHcvG8mEStYe.

---

Generated by Claude Code

[os-steve]

Claim: PM loop round 4
Session: session_01Fs18A2DdXLVN2h8PaaFBcP
Branch: claude/issue-9279-drivers-mdx-fifth-key
Worktree: objectstack-issue-9279
Domain: domain:spec
File surface: content/docs/data-modeling/drivers.mdx (one table row + any sentence that counts the keys), .changeset/ handling per docs-only convention (stop on breach; explain in the report)
Container & model: S, mode:subagent, model: sonnet — docs-only text face (no packages/spec/src/** in the expected diff ⇒ the clause-② enqueue gate does not arm); triage suggestion adopted
Serial constraints cleared: PR #9277 (in queue, this seat) touches mongo.zod.ts + generated driver-mongo.mdx — disjoint files per triage's coordination note; no open PR touches drivers.mdx (checked this round). The optional follow-through on #9254's describe string is explicitly OUT of this card's scope (triage: its own text-face touch, not a rider).

---

Generated by Claude Code

[os-steve]

os-dev-report

{
 "issue": 9279,
 "status": "done",
 "branch": "claude/issue-9279-drivers-mdx-fifth-key",
 "pr": "https://github.com/objectstack-ai/objectstack/pull/9288",
 "premise_still_valid": true,
 "summary": "Added the missing fifth row (options.authMechanismProperties.AWS_SESSION_TOKEN, mongo/mongodb) to drivers.mdx's 'Secret-shaped keys with no binder slot' table, matching PASSTHROUGH_SECRET_PATHS' five mongo redaction paths. Updated the five-to-six key-count prose and reworded the trade-off Callout to isolate the SOCKS5/TLS/turso group's 'no working refusal remedy' rationale from AWS_SESSION_TOKEN's distinct one (the MongoDB client itself throws on it under MONGODB-AWS, per driver/common.zod.ts). Docs-only; no packages/spec/src/** touched; #9254's mongo.zod.ts describe string left untouched per triage.",
 "tests": "Built spec at fc0cd0a93 (pnpm --filter @objectstack/spec build). Gates named by node scripts/pm/dispatch-gates.mjs against the actual diff, all green: pnpm check:nul-bytes (6066 files, no control bytes), pnpm check:role-word (43 baselined, no new occurrences), pnpm check:docs-redirects (92 entries), pnpm check:quick-reference-counts, pnpm check:docs-audit-scope (178 hand-written docs), pnpm --filter @objectstack/spec run check:empty-state, check:liveness, check:strictness-ledger, check:variant-docs (all exit 0; check:liveness's pre-existing warnings -- 3 unregistered dogfood proof tags -- are unrelated baseline state, not caused by this diff).",
 "open_questions": [],
 "out_of_scope_findings": []
}

---

Generated by Claude Code