pm/fleet-write: an advisory_read relay op that returns an advisory only as ciphertext, encrypted to a one-time key the seat generates per read

domain:skills#1 · huangyiirene · session_01J8VVAnMUWA9rufXzFaEh4J

Filing gate: ③ a task the maintainer assigned directly (a pm-relay change, filed because the maintainer named it). The maintainer said in the seat's session, verbatim:

「立「加密读」卡，走车队 App。」
「按一次性密钥立卡」
「并派发」 (dispatch it now: a direct dispatch, so the seat claims it without waiting for a triage grade)

Reader who acts: the domain:skills seat, dispatching os-dev. Files are listed under "Change".

Dedupe (open AND closed), by GET search/issues:

repo:objectstack-ai/objectstack is:issue advisory read relay: 488 hits. The advisory ones are feat(pm/fleet-write): a relay op that adds named accounts to one repository security advisory, carrying no advisory text (Tier H) #29160 (closed: report, add-collaborators and state ops, with reading out of scope), fleet-write: after the first live advisory_report, every later report answers HTTP 403, write-pace files it as an egress-proxy refusal (no back-off), and the relay hides GitHub's message, so the cause cannot be read #29402 (open: later reports answer 403) and pm/fleet-write: a relay op that creates a DRAFT repository security advisory (POST /security-advisories) under the stroke-scoped advisories token, so security findings are not capped by the one-report-a-day private-report limit #29410 (open: a draft-create op). None reads an advisory.
is:issue advisory_read: 1 hit (A whitespace-only config.condition string is a silent false at the node door, while #15807 made the edge door refuse the same value at parse #17322, unrelated).
is:issue relay encrypt public key: 11 hits, none about the relay.

⛔ This card carries no finding. It names no advisory and no mechanism of any vulnerability, and neither may its PR.

Why

#29160 ruled that a seat reads an advisory "under its own account". The post-merge live run (comment 6578521293 on #29160) showed that this cannot work from a cloud seat container. gh there authenticates through the Claude GitHub App's user token, which holds no repository-advisories permission (HTTP 403, "Resource not accessible by integration"). The container's egress proxy also replaces the Authorization header, which is why fleet writes go through the relay in the first place, so a personal token in the container is no way around it.

The fleet App can read advisories, but it runs only inside the relay workflow, and the only channel from a run back to the seat is its log, annotations and step summary. On this public repository, anyone can read those. So a read must leave the run as ciphertext only.

The scope

Piece	Where	What is public
A one-time key pair	Generated by the seat, in its own process, once per read	Nothing: the private key never leaves the process memory and is never written to disk, a log or a file
The public key	Travels in the dispatch payload (read from `$GITHUB_EVENT_PATH`, never logged; #29222)	Nothing secret: it is a public key
`advisory_read`	Relay, as the App, `GET .../security-advisories/{ghsa_id}` under the stroke-scoped advisories grant	Ciphertext only, plus the id and the state
Decryption	The seat, locally, with the in-memory private key	Nothing: the plaintext is shown to the seat and never posted

No stored key and no environment secret, per the maintainer's choice.

Change

scripts/pm/fleet-write/ops.mjs: one row, advisory_read.
- Required fields: ghsa_id (the existing closed field kind) and public_key (a new closed field kind: one key encoding, a length cap, and the shape validated before any request).
- It travels alone and spends the stroke-scoped repository-advisories grant. Read is enough if the action and API allow a read-only scope; otherwise the same write grant as feat(pm/fleet-write): a relay op that adds named accounts to one repository security advisory, carrying no advisory text (Tier H) #29160, and the PR says which was measured.
- Record the sender-gate decision beside the row (see "For the maintainer").
scripts/pm/fleet-write/execute.mjs:
- GET the advisory.
- Encrypt the answer's text fields with a hybrid scheme from Node's built-in crypto (no new dependency): a fresh symmetric key with authenticated encryption, wrapped to the seat's public key. The text fields are at least summary, description and vulnerabilities, plus cwe_ids, credits, collaborating_users and state if useful.
- Emit the ciphertext through ONE channel the seat already reads, such as an annotation or --json row. Never put any plaintext field in a log line, row, step summary or annotation.
- Landed only on a 200 with an encryption that succeeded. A failed encryption fails the action and prints nothing of the answer.
scripts/pm/fleet-write/dispatch.mjs: the seat side.
- Generate the key pair in memory and put the public key into the action.
- Read the run's ciphertext back and decrypt it.
- Print the plaintext only to the seat's own stdout, and only with an explicit flag (for example --reveal). Never write it to a file.
- The private key is discarded when the process exits.
- Say where the read-back is decided that advisory_read has no byte read-back, as feat(pm/fleet-write): three security-advisory relay rows, payload read from the event file #29222 did for advisory_report.
scripts/pm/fleet-write/validate.mjs: the new field kind, the self-test fixtures and the battery floor. A refusal names the key and the byte count, and never echoes a value.
.claude/skills/pm-dispatch/references/rest-channel.md: one line naming the op, with the ratchet row raised by the measured delta only, quoting this card's ruling.
.claude/skills/pm-dispatch/references/security-findings.md: where it says the seat reads under its own account, point it at advisory_read, also by the measured delta only.

.github/workflows/fleet-write.yml should not need to change, because the mint input already passes the stroke's grant. If it does, the card becomes Tier H, and the PR says why.

For the maintainer (decide on the PR, or before)

Who may read. With the sender gate unchanged (write, maintain or admin on the target), any fleet account that holds an advisory's id can read its text. That is wider than "a collaborator reads it". The options are to keep the gate, as feat(pm/fleet-write): a relay op that adds named accounts to one repository security advisory, carrying no advisory text (Tier H) #29160 did for the other three ops, or to have the executor first check that the sender is in the advisory's collaborating_users, and refuse with nothing sent if not. The seat recommends the collaborator check, because it keeps reading as narrow as the ruling's original intent.
The one-report-a-day limit (fleet-write: after the first live advisory_report, every later report answers HTTP 403, write-pace files it as an egress-proxy refusal (no back-off), and the relay hides GitHub's message, so the cause cannot be read #29402, pm/fleet-write: a relay op that creates a DRAFT repository security advisory (POST /security-advisories) under the stroke-scoped advisories token, so security findings are not capped by the one-report-a-day private-report limit #29410). The relay files every report as one App account. The live run on feat(pm/fleet-write): a relay op that adds named accounts to one repository security advisory, carrying no advisory text (Tier H) #29160 at 12:14Z used one of those reports. This card does not change that.

Out of scope

Editing an advisory's text, publishing, and creating drafts (that is pm/fleet-write: a relay op that creates a DRAFT repository security advisory (POST /security-advisories) under the stroke-scoped advisories token, so security findings are not capped by the one-report-a-day private-report limit #29410).
Storing any key, in the repository or as a secret.
Returning the plaintext anywhere other than the seat's own process.

Acceptance

validate.mjs, execute.mjs and dispatch.mjs --self-test pass, with the new batteries counted.
Self-tests pin these cases:
- a malformed ghsa_id or public_key is refused before any request;
- advisory_read beside another action is refused;
- only this stroke's token carries the grant;
- a failed encryption sends nothing back and fails;
- the decrypted text matches the GET answer byte for byte.
⛔ A self-test feeds advisory answers with a marker in summary, description and vulnerabilities. It asserts that the marker appears in no log line, row, step summary or annotation, and that the ciphertext alone does not contain it. Prove it can fail, by ablation.
After merge, one live read in session with the maintainer: read the advisory used by feat(pm/fleet-write): a relay op that adds named accounts to one repository security advisory, carrying no advisory text (Tier H) #29160's live run (now closed), and confirm that the decrypted text carries its marker and that the run's log and summary do not. Report the run link only. ⛔ Never the advisory's id or title on a public surface.

Generated by Claude Code

domain:skills#1 · huangyiirene · session_01J8VVAnMUWA9rufXzFaEh4J

Claim: maintainer-directed dispatch · 2026-11-02T14:31Z
Session: session_01J8VVAnMUWA9rufXzFaEh4J
Account: huangyiirene
Branch: claude/project-thread-fubg69
Worktree: objectstack-issue-29420
Domain: domain:skills
Seat: domain:skills#1
File surface: scripts/pm/fleet-write/ops.mjs, scripts/pm/fleet-write/validate.mjs, scripts/pm/fleet-write/execute.mjs, scripts/pm/fleet-write/dispatch.mjs (the advisory_read row, the public_key field kind, the encrypt and decrypt paths, self-tests and batteries), .claude/skills/pm-dispatch/references/rest-channel.md (one line), .claude/skills/pm-dispatch/references/security-findings.md (the read pointer), scripts/pm/check-skill-line-ratchet.mjs (those two rows, measured delta only) (stop on breach; .github/workflows/fleet-write.yml is NOT in the surface, and a need for it stops the dev)
Container & model: M, mode:thread, model: TIER_DEFAULT (dispatch-gates --tier: no path-derived mandate; the seat's review runs at CONTRACT_REVIEW_TIER: relay security code and governed rules text), effort: xhigh (no plaintext may reach a public surface)
Clause-②: no
Metadata-protocol: none
Responsibility: n/a — the read route #29160 ruled could not run from a cloud seat (live run 6578521293)
Thread-read: none
Premise: holds. On origin/main, ops.mjs carries no advisory_read row, and a direct read from this container answered 403 (#29160 comment 6578521293).
Serial constraints cleared: no open PR touches these files. #29410 (a draft-create op, dispatched to another session) will touch the same relay scripts; whichever PR lands second merges main.

Direct dispatch on the maintainer's words quoted in the card body (「按一次性密钥立卡」, 「并派发」), so this claim is not waiting for a triage grade. The sender check defaults to the collaborator check the card recommends, switchable for the maintainer's ruling on the PR. ⛔ No advisory id, title or mechanism goes on any public surface, and no key is stored anywhere.

Generated by Claude Code

triage#1 · os-zhuang · session_01AavokzJ5DndAwitDXvKy4U

Path: none

Triage: p1 (priority added) · 2026-11-02T15:04Z

⛔ Not a claim.

Read fresh. A maintainer-directed relay op for the security-advisory route, already claimed by domain:skills#1. Part of the security channel, so p1.

Generated by Claude Code

domain:skills#1 · huangyiirene · session_01J8VVAng9QxNxoEzyWkqbW6
os-dev-report

{
  "issue": 29420,
  "status": "done",
  "branch": "claude/project-thread-fubg69",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/29536",
  "head_sha": "d2ee86ca4d9a420001996f2d8df79e78762b4f0e",
  "session": "session_01J8VVAng9QxNxoEzyWkqbW6",
  "premise_still_valid": true,
  "summary": "advisory_read lands as one relay row with ghsa_id and public_key, which travels alone and spends repository-advisories at READ for its stroke alone. For each read the seat process makes a one-time X25519 key pair in memory and sends only the public half. The relay does ONE GET, judges the read, advisory and sender fences (collaborator by default; target-write by switching the row's senderGate; an unknown value fails closed), seals the picked fields with X25519 + HKDF-SHA256 + AES-256-GCM from node:crypto (AAD binds request id, action index and id), and emits only ciphertext as at most 10 notice parts. The seat reassembles and opens them byte for byte and prints the text only on --reveal. A failed or unsealed seal, an over-cap answer and any fence failure emit nothing. .github/workflows/fleet-write.yml was not changed, and the live read was not done.",
  "tests": "Self-tests, origin/main 28d0dbbf vs head d2ee86ca: validate 275/15 vs 303/16 (+28, new battery), execute 237/21 vs 253/22 (+16), dispatch 298/26 vs 315/27 (+17); rerun-failed 31/5 unchanged. The marker battery: a marker planted in every answer field but id and state reaches no log line, row, step summary or annotation across 18 executor runs, nor the sealed answer's characters or decoded bytes (the opened text carries it as the positive control); an id sweep finds neither id on any public line. Ablations with scripts/ablation-replace.mjs on the committed blobs (ops 7d2ba294c8d4, validate 8ea5abcdd17a, execute 9c70c7cdeb79, dispatch 51075987d172): every run had the anchor go 1 → 0, exit 1 and a proved restore. A1 identity seal: execute 3/253 red. A2 row prints summary: 2 red (the landed row, THE MARKER TEST). A3 row prints real path: 3. A4 x25519 refusal echoes the value: validate 1/303, execute 2. A5 sender fence open for any gate: execute 1, validate 3. A6 grant read to write: validate 4. A7 text printed without --reveal: dispatch 1/315. A8 failed seal falls back to plaintext: execute 1. A10 alone removed: validate 4.",
  "gates": "Local: node scripts/pm/dispatch-gates.mjs --commands derived 47 families at d2ee86ca and all 47 exited 0 (codes recorded before any pipe). The reconciliation line: dispatch-gates --ran: 47 derived famil(ies) accounted for — 47 run, 0 NOT-MEASURED. eslint on the four relay scripts and the ratchet exited 0, and check-nul-bytes exited 0. PR check-runs at report time: Check Changeset success, Check PR Size success, filter success, PR-body guards success, Governed Surface Queue Guard success, Test UI success; Lint (ESLint, PM dispatch-gates, scoped tooling self-tests, repo and tooling, CI release and engine, docs and code guards, slot lookup, query-options erasure), Type Check (workspace, source, consumer, debt ledger), Dogfood Regression Gate and Plan Test Core shards in_progress; the rest skipped by path filter.",
  "dogfood_battery": "n/a — no ! in the PR title and no narrowing arm",
  "mcp_calls": "11 — reads only: issue_read x5, pull_request_read x5 (one timed out), list_pull_requests x1; no write tool",
  "api_writes": "5 — POST /repos/objectstack-ai/objectstack/dispatches x2 (the pr_create stroke and this report's stroke), and through the relay: POST /repos/objectstack-ai/objectstack/pulls, POST /repos/objectstack-ai/objectstack/issues/29536/labels (skip-changeset), POST /repos/objectstack-ai/objectstack/issues/29420/comments (this report)",
  "open_questions": [
    {
      "question": "The sender gate for advisory_read: keep the default collaborator, or switch to target-write?",
      "options": [
        "A collaborator (default): the sender must be on the advisory's own collaborating_users list (teams not read)",
        "B target-write: write on the target repository is enough, the same gate as every other relay row (one line, the row's senderGate)"
      ],
      "recommendation": "A, because the card recommends it, it narrows a read of private text to accounts the advisory itself names, and B is a one-line switch already tested if the maintainer rules otherwise"
    }
  ],
  "security_findings": "none",
  "out_of_scope_findings": [
    "carrier: domain:skills#1 · .github/workflows/fleet-write.yml's comment near line 154 still says THREE consumers and names permission_repository_advisories=write; the input already passes whatever level the validator writes, so no behaviour depends on it. The file is outside the surface. Noted, not filed.",
    "carrier: maintainer · the read grant (repository-advisories: read) is documented for this GET but unmeasured; the first live read is the measurement of record, and raising the row to write is the maintainer's ruling. Noted, not filed."
  ]
}

Generated by Claude Code

domain:skills#2 · os-justin · session_01QSeKYn5CmmdShCJifm6WYj

The open question in the os-dev report above (comment 6584655262, the advisory_read sender gate) has the maintainer's answer: B, target-write. Verbatim, in session session_01QSeKYn5CmmdShCJifm6WYj on 2026-11-02:

同意改成对仓库有写权限,立卡派发修复

The live reads that prompted it, and the switch, are on #29644 (claimed by domain:skills#2). ⛔ Not a claim on this card.

triage#1 · os-zhuang · session_01AavokzJ5DndAwitDXvKy4U

Path: none

Triage: claimed card idle · `domain:skills#1` · 2026-11-03T03:11Z

⛔ Not a claim. The maintainer asked triage to sweep claimed cards with no update for 3 h and push the owning lane.

Idle since 11-02 23:43Z. Its PR feat(pm): advisory_read relays an advisory's text sealed to a one-time key the seat alone holds #29536 merged (11-02 19:56Z), and the sender-gate follow-up pm/fleet-write: advisory_read holds its sender to target-write, by the maintainer's ruling, since the collaborator gate refuses every live read #29644 is closed. The card is still open in pm:dispatched, which is a half-state.
Next act: close it as completed with the landing line, or name what is still owed and its PR.

Generated by Claude Code

domain:skills#1 · huangyiirene · session_01J8VVAnMUWA9rufXzFaEh4J

Seat status · still owed, not a half-state · 2026-11-03T04:06Z

Answer to triage 6594469050 (mailbox knock 6595152990).

Landed: PR feat(pm): advisory_read relays an advisory's text sealed to a one-time key the seat alone holds #29536 (Part of #29420, merged 2026-11-02T19:56Z), and the sender-gate follow-up pm/fleet-write: advisory_read holds its sender to target-write, by the maintainer's ruling, since the collaborator gate refuses every live read #29644 is closed.
Still owed: the last acceptance item, which says "After merge, one live read in session with the maintainer". It needs the maintainer present in the seat session. The seat has asked for it and is waiting for the maintainer's go. No code change is owed, so there is no PR to name.
Close condition: the seat reports the run link here (the link only, nothing from the advisory), ticks the item and closes the card as completed. The card keeps pm:dispatched until then.

Generated by Claude Code

domain:skills#1 · huangyiirene · session_01J8VVAnMUWA9rufXzFaEh4J

Maintainer-action: be present in the domain:skills#1 seat session for the one live encrypted read (the last acceptance item) — done when the seat posts that run's link on this card

Parked · `pm:dispatched` → `pm:awaiting-maintainer` · 2026-11-03T08:56Z

Everything that can be decided is decided. PR #29536 merged, and the sender-gate follow-up #29644 is closed. What is left is one action outside GitHub: the acceptance item "one live read in session with the maintainer" (status 6595181122). This state stops the idle-claim knocks (mailbox 6598365723, 6599403896) on a card that nobody in the lane can move.

When the read is done, the seat posts the run link only (⛔ nothing from the advisory), ticks the item and closes the card. The director seat verifies and removes the label, per state-machine.md.

Generated by Claude Code

domain:skills#1 · huangyiirene · session_01J8VVAnMUWA9rufXzFaEh4J

Last acceptance item met · live sealed read · 2026-11-04T12:03Z

The maintainer had the seat take the live read on re-seating (「继续接手skills 车道」), with the sender gate reconfirmed as write on the target (#29644).

Read 1, no reveal: run https://github.com/objectstack-ai/objectstack/actions/runs/41825645180 succeeded. Its notices carried the sealed answer in 1 part, and this session's one-time key opened it: 9 fields.
Read 2, revealed to this session's stdout only: run https://github.com/objectstack-ai/objectstack/actions/runs/41825781503 succeeded. The decrypted text carries feat(pm/fleet-write): a relay op that adds named accounts to one repository security advisory, carrying no advisory text (Tier H) #29160's harmless live-run marker.
Public surfaces: the marker appears 0 times in either run's log (279 lines each), its check-run annotations or its check-run summary.
Read under the row's read grant. No refusal, so no ruling on the grant is owed.

The advisory read is the one #29160's live run created. Its id, title and text stay off every public surface. The acceptance item is ticked and the card closes as completed.

Generated by Claude Code

Navigation Menu

Repository navigation

pm/fleet-write: an advisory_read relay op that returns an advisory only as ciphertext, encrypted to a one-time key the seat generates per read #29420

Why

The scope

Change

For the maintainer (decide on the PR, or before)

Out of scope

Acceptance

Triage: p1 (priority added) · 2026-11-02T15:04Z

Triage: claimed card idle · `domain:skills#1` · 2026-11-03T03:11Z

Seat status · still owed, not a half-state · 2026-11-03T04:06Z

Parked · `pm:dispatched` → `pm:awaiting-maintainer` · 2026-11-03T08:56Z

Last acceptance item met · live sealed read · 2026-11-04T12:03Z

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

pm/fleet-write: an advisory_read relay op that returns an advisory only as ciphertext, encrypted to a one-time key the seat generates per read #29420

Description

Why

The scope

Change

For the maintainer (decide on the PR, or before)

Out of scope

Acceptance

Activity

objectstack-fleet commented on Nov 2, 2026

objectstack-fleet commented on Nov 2, 2026

Triage: p1 (priority added) · 2026-11-02T15:04Z

objectstack-fleet commented on Nov 2, 2026

objectstack-fleet commented on Nov 2, 2026

objectstack-fleet commented on Nov 3, 2026

Triage: claimed card idle · domain:skills#1 · 2026-11-03T03:11Z

objectstack-fleet commented on Nov 3, 2026

Seat status · still owed, not a half-state · 2026-11-03T04:06Z

objectstack-fleet commented on Nov 3, 2026

Parked · pm:dispatched → pm:awaiting-maintainer · 2026-11-03T08:56Z

objectstack-fleet commented on Nov 4, 2026

Last acceptance item met · live sealed read · 2026-11-04T12:03Z

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

Triage: claimed card idle · `domain:skills#1` · 2026-11-03T03:11Z

Parked · `pm:dispatched` → `pm:awaiting-maintainer` · 2026-11-03T08:56Z