[objectstack-fleet]

domain:skills#2 · os-justin · session_01QSeKYn5CmmdShCJifm6WYj

Clause-②: no (narrowing)
Metadata-protocol: narrowed
Skills-docs: none — every connector entry that skills/**, the hand-written content/docs/**, examples/** and packages/apps/** author (each defineConnector({…}) and connectors: [{…}] literal, scanned) already keeps its URLs credential-free and declares only RetryConfigSchema / ConnectorActionSchema keys inside retryConfig and actions, so nothing they teach changes; each refusal carries its own prescription.

维护者速读

• 改了什么：作者编写的连接器实例中，providerConfig 与 auth 下任何层级的 URL 若带 userinfo 或凭据类查询参数，在 defineStack、os validate/compile、构建产物加载与保存门处被拒（保存为 422 INVALID_METADATA，逐个 URL 指出位置，提示改用 auth.credentialRef）；条目里的 retryConfig 与每个 actions 元素改为封闭结构，未声明的键按名拒绝（凭据类键给出 auth.credentialRef 的改法，action 上的 method/path/url 给出 ADR-0097 §5 的说明）（两个封闭结构仍为模块私有、不导出、不发布，与开放结构共用同一组字段实例）；连接器读取对 auth 端点套用与 providerConfig 同一遍历、同一判据的凭据部分改写。另按维护者裁决：保存时显式给出的 retryConfig（{}、读取所得原样或任何对象）整体替换库中的 retryConfig，库中行的未声明重试键不再沿用，保存应答逐个点名被丢弃的键；省略 retryConfig 照旧移除整个容器。
• 为什么改：维护者裁决——连接器元数据在任何位置都不承载凭据；写入门与读取侧按同一遍历、同一判据判断 URL，读取改写的就是写入拒绝的；作者条目的嵌套结构与顶层一样封闭。retryConfig 的未声明键没有任何写入门接受、运行时也不读取（物化时用开放的 RetryConfigSchema 解析并丢弃），沿用它只会把库中明文留下。
• 风险与回滚：破坏性变更（spec minor，两条 ADR-0087 D3 条目）：在连接器 URL 里写了凭据、或在 retryConfig / actions 里写了未声明键的代码与包，升级后在校验、构建产物加载与保存时被拒；库中已存的行不重判、照常运行，读取隐去凭据部分，原样保存保留库值（retryConfig 的未声明键除外：首次显式保存时被丢弃并在应答中点名；库中字节变了，该实例在下一次对账时按完全相同的策略重新物化一次）；不做存量迁移。回滚即 revert 本 PR。
• 先看：packages/spec/src/integration/connector.zod.ts（refinement 中逐 URL 拒绝；sharedFields 让封闭嵌套结构与开放结构共用字段实例，及其 guidance）、packages/spec/src/integration/connector-credential-redaction.ts（读取隐去的位置；undeclaredRetryConfigKeysOf 把未声明重试键列入 notCarriedForwardKeys，即本轮裁决的落点）、packages/spec/src/integration/connector-url-credentials.ts（唯一遍历 findConnectorUrlCredentials 与读取位置映射）。
• 两分钟验证：pnpm --filter @objectstack/dogfood exec vitest run test/connector-meta-door-url-and-nested-keys.dogfood.test.ts，预期 26 个用例全部通过。
• 需要你做的：无，席位落地（retryConfig: {} 的裁决已在本 PR 实现，见 PR 评论 6593804783）。

Seat notes

Refreshed 2026-11-03T04:26Z.

• Takeover. By the maintainer's order this PR and its landing passed to seat session session_01QSeKYn5CmmdShCJifm6WYj (comment 6593633433); this body is maintained by that seat from here on.
• Ruling, implemented. The open question (does an explicit retryConfig: {} over a stored row clear the keys the read withholds) was ruled in comment 6593804783: an explicit retryConfig replaces the stored one whole. Its named premise was verified before the edit and holds (Acceptance notes); the ruling and the pin the earlier should-fix named are on this head.
• Contract review. The two PASS records (comments 6590686226 and 6590693346) are on 577984fe21163e30c191ccced287a3e1a0ba9e31. The merge of origin/main and the ruling's implementation owe a contract-review-tier review on the new head before landing. The remaining should-fix from those records (a depth specimen for the deleted-baseline pin) is unchanged; the items on the shared URL predicate stay with the maintainer, at rule level only here.
• Ruling record (URL refusal). The ruling quoted under Why reached the previous lane as the maintainer's no-card order to session session_01Q4EjjP1K353tLKWRMajLsE; by design there is no public card for it.
• Landing. Not armed; this PR stays draft until that review. Then it is readied and landed serially (landing-operations.md §D), per the takeover record.

What changes

BREAKING — two accept-set narrowings on an authored connector entry (DeclarativeConnectorEntrySchema), each with its changeset and its ADR-0087 D3 upgrade-guide entry.

1. An authored connector URL holds no credential part. At every door that runs the entry's refinement — defineStack({ connectors }), os validate / os compile, the metadata plugin's artifact load at boot and on reload, and PUT /api/v1/meta/connector/:name — a URL under an instance's providerConfig (any key, any depth, array elements included) or auth (tokenUrl, authorizationUrl, resource) holding a userinfo or a credential query parameter with a value is refused: one issue per URL, located at the URL, naming the parts it holds (never the URL or its value) and prescribing auth: { type, credentialRef }. At the save door that is 422 INVALID_METADATA, and nothing is stored. There is no rule per provider: a URL is recognised by its value.

One walk, both doors. connector-url-credentials.ts holds the one definition of a credential part and the one traversal over an entry's URLs (findConnectorUrlCredentials). The write refinement refuses every URL it returns; the read redactor maps each to the position it can address (connectorUrlCredentialPositionOf: rewritten in place, or the enclosing array or dotted key withheld whole) — so the read rewrites or withholds exactly the URLs the write refuses, and the read now covers the auth endpoints as it covers providerConfig. A URL inside a header or environment map (providerConfig.headers, defaultHeaders, transport.headers, transport.env) is judged by neither: the read withholds those maps whole.

2. An authored connector entry's nested shapes are closed. retryConfig and each actions element refuse a key they do not declare, in one unrecognized_keys issue located at the container (retryConfig, actions.N), at every door that parses the entry, defineConnector() included. A credential-shaped key (secret, token, apiKey, password, credentialRef, …) carries the entry's own prescription (auth.credentialRef); an execution binding on an action (method, path, url) carries ADR-0097 §5's (an action carries none). The open shapes (ConnectorSchema, RetryConfigSchema, ConnectorActionSchema) keep their posture, because the runtime parses a stored row's retry policy with the open RetryConfigSchema at materialization and a provider derives actions through the open action shape.

Twins stay private, sharing field instances. The closed nested shapes are module-private and emit no def; nothing is added to the published surface. Each is built from the SAME field instances as its open counterpart (sharedFields), because the authorable-surface deletion gate judges a def's reachability by instance: with per-carrier instances the open integration/RetryConfig and integration/ConnectorAction were reached by no metadata root, so a bare deletion from the shared declaration would have been waived as unreachable — the build-schemas fixture failure on the first push of this PR was that. With shared instances the gate's derived-clone bridge reaches both open defs through the twins. The guidance census then pairs the open defs with the twins' guidance; that pairing is consulted only for a deleted baseline key the guidance names, and every key it names is one the open defs never declared.

Unchanged. The runtime materializes a stored row as it is stored and never re-judges it by the entry's refinement, so a connector stored before these refusals keeps dispatching; a save of its served form keeps the stored values (the metadata protocol's carry-forward) except a stored undeclared retryConfig key (3. below), and an edit of a served URL stores exactly the edit. No stored-row migration is shipped.

3. An explicit retryConfig in a save replaces the stored one whole (the maintainer's ruling, comment 6593804783). A save that sends retryConfig — the served form, {}, any object — does not carry a stored row's undeclared retry key forward, and its answer names each key it dropped (advisory rule withheld-key-dropped, path connectors[0].retryConfig.secret for a key secret). A save that leaves retryConfig out removes it, as before. An undeclared key in an actions element, a retryConfig stored as a non-object (withheld whole), and every other withheld position are carried forward as before. The mechanism is declarative: the connector read redactor names the undeclared keys of an object retryConfig in notCarriedForwardKeys — the contract the undeclared auth keys already use — and the metadata protocol's carry-forward reads it, so no protocol code changes. The advisories description on the save answer (SaveMetaItemResponseSchema) now names this case, and content/docs/references/api/protocol.mdx is regenerated from it.

FROM → TO

// before — parsed green
{ name: 'billing_api', label: 'Billing API', type: 'api', provider: 'rest',
  providerConfig: { baseUrl: 'https://billing.example.com/v1?api_key=…' },
  retryConfig: { strategy: 'exponential_backoff', maxAttempts: 3, secret: '…' },
  auth: { type: 'none' } },

// after — the URL is credential-free, the key is a reference, the policy holds only declared keys
{ name: 'billing_api', label: 'Billing API', type: 'api', provider: 'rest',
  providerConfig: { baseUrl: 'https://billing.example.com/v1' },
  retryConfig: { strategy: 'exponential_backoff', maxAttempts: 3 },
  auth: { type: 'api-key', credentialRef: 'BILLING_API_KEY', paramName: 'api_key' } },

Set the secret under the name credentialRef gives (an environment variable in the open tier, or Setup → Connector credentials). Upgrade-guide entries: connector-entry-url-credential-refused, connector-entry-nested-undeclared-key-refused.

Why

Connector metadata holds no credential at any position, and the save door stores the body it accepts (ADR-0005 appendix (c), ruling B). The maintainer's ruling for this change, verbatim:

在 DeclarativeConnectorEntrySchema 的 refinement 里,用和脱敏器相同的遍历检查 providerConfig 各层 URL 和 auth.*Url:带 userinfo 密码或凭据类查询参数就拒绝,返回 422 INVALID_METADATA,指出具体位置,并提示改用 auth.credentialRef。不按 provider 分别写规则。

读取侧把 auth.*Url 纳入同一个 URL 脱敏遍历。

不做存量迁移(os migrate meta --stored)。

and, for the nested shapes, to close them unless an ADR deliberately keeps them open. None does: ADR-0097, ADR-0143, ADR-0023, ADR-0024, ADR-0104 and the strictness ledger's integration/ row were read, and ADR-0097 §5 states that an action carries no execution binding. So they close with the entry, declared as breaking.

For a save over a stored row, the maintainer answered the question this PR left open (comment 6593804783) with the option put first, verbatim:

显式 {} 就清掉,带前提 (Recommended)

recorded there in three parts: an explicit retryConfig (including {}) replaces the stored container whole and the stored row's withheld undeclared keys are not carried forward into it, omitting retryConfig keeps today's behaviour; the premise that the runtime reads no undeclared retryConfig key when it materializes a stored row is verified before the edit; and if it does not hold, the work stops rather than forcing the clear or keeping the old behaviour.

Tests

Layer	File	What it pins
spec	src/integration/connector-entry-url-credentials.test.ts	every URL position refused, located, prescription named, value never echoed; a CONTROL accept beside each; inside a stack the issue sits under the entry; header and env maps left to their own rules; the open ConnectorSchema unchanged; the write door refuses exactly what the read rewrites, and at every depth the read withholds each refused URL at its addressable position
spec	src/integration/connector-entry-nested-keys.test.ts	retryConfig and actions elements refuse undeclared keys by code + path + keys; a credential-shaped key in either carries the credential prescription and an action's method / path / url carries ADR-0097 §5's (prescription text pinned); an action's own key stays its machine name; defineConnector() refuses through a ZodError with the same issue; the open carriers drop, not refuse; the private twins declare exactly the open shapes' keys, as the same field instances
spec	src/integration/connector-credential-redaction.test.ts	the read rewrites the userinfo out of auth.tokenUrl / auth.authorizationUrl and a credential parameter out of auth.resource, byte for byte otherwise; the undeclared keys of an object retryConfig, a cleared one included, are named in notCarriedForwardKeys; CONTROL: a non-object retryConfig and an actions element's key stay carried forward
metadata-protocol	src/metadata-redaction.connector-undeclared-keys.test.ts	the served form, retryConfig: {} and an omitted retryConfig each leave no undeclared retry key and report the drop; the top-level and actions keys are still carried; the runtime authoring gate is never told the key will be restored
dogfood	test/connector-meta-door-url-and-nested-keys.dogfood.test.ts (26)	the HTTP save door's 422 envelope at each position, a URL inside an inline providerConfig.spec document included (located at providerConfig.spec.servers.0.url), nothing stored, an existing row untouched; CONTROL saves — an inline document with credential-free URLs stored as written, instances that materialize and dispatch; member and admin item / layered / list reads of a stored auth endpoint; carry-forward of served forms and of an author's edit; retryConfig: {} over a stored row holding an undeclared retry key — 200, the answer's advisories name connectors[0].retryConfig.secret and never its value, and the next read of the stored row holds retryConfig: {}, while the withheld header map on the same row stays at rest (CONTROL); the served form replaces too; CONTROL: leaving retryConfig out removes it as before, and a non-object retryConfig is still kept at rest by a save that leaves it out

Forced test edits (fixtures the narrowing makes refusable at the save door, now seeded the way such a row reaches a store, through the system context): connector-meta-door-undeclared-keys-withheld.dogfood.test.ts (the nested retryConfig / actions rows), connector-meta-door-entry-and-url-hardening.dogfood.test.ts (the carry-forward row; saved disabled first, so the pin now also measures that the runtime materializes the stored row as it is), packages/spec/src/kernel/metadata-authoring-lint.test.ts (its two pins walked connectors[].retryConfig as the remaining nested strip site; they now walk apis[].objectParams, and the connector fixture stays as a closed collection with its located refusal asserted), packages/cli/test/package-union-readers.test.ts (the package-union probe moves from connectors[].retryConfig to apis[].objectParams, assertions unchanged in kind), and packages/spec/scripts/build-schemas-check-mode.deleted-baseline.test.ts (the #17356 unregistered-kind-root fixture moves from integration/RetryConfig, now reached through the twin's derived-clone bridge rather than by identity, to integration/DeclarativeConnectorEntry, the connector root's own def, so its eager reading stays a root-graph hit). Forced by the ruling (pins that asserted the old keep-on-save reading of an undeclared retry key): the served-form retryConfig test in connector-meta-door-undeclared-keys-withheld.dogfood.test.ts now asserts the replacement; metadata-redaction.connector-undeclared-keys.test.ts expects the served-form save without the retry key and its no-drop CONTROL uses a row without one; the redactor's carried-forward CONTROL in connector-credential-redaction.test.ts no longer holds a retry key.

Acceptance notes

• Userinfo scope. The write refuses the whole userinfo — user:password@ and the token@ form several HTTP APIs read as a token — not only a password, because the read already withholds the whole userinfo and both doors share one definition. Every built-in provider reaches its upstream through fetch, which refuses any URL carrying a userinfo, so no configuration that could dispatch is refused by the wider reading.
• Inline OpenAPI documents. A providerConfig.spec given as an inline document object is walked like any other value under providerConfig (the read already rewrote URLs inside one); a document whose example URL carries a credential-named query parameter with a value is refused. Packaging the document as a file path is unaffected.
• Header and environment maps stay outside the write walk, as the read withholds them whole and the @objectstack/lint rule connector-credential-literal warns on a credential-shaped literal inside one.
• defineConnector() closes the nested shapes but does not run the entry refinement (as for the other ADR-0097 refinements); the URL refusal meets the entry at defineStack, the CLI, the artifact load and the save door.
• The ruling's premise, read before the edit. The runtime never consumes an undeclared retryConfig key. Instance materialization (service-automation plugin.ts) parses the stored policy with the open RetryConfigSchema and hands the provider only the parsed result; measured on src and again on the built dist the runtime loads, a policy carrying two undeclared keys parses successfully, the keys are absent from the parsed policy, and the parsed policy and the resolved fetch options (connectorFetchOptions, the one execution site) are identical with and without them. One raw read exists: the reconcile's change fingerprint (connectorInstanceSignature) serializes the stored retryConfig as written, so the save that first drops such a key changes the fingerprint and the next reconcile re-materializes the instance once, with the identical policy. No retry or dispatch behaviour reads the key.
• An omitted retryConfig now names the drop. What a save that leaves retryConfig out stores is unchanged (the container is removed, withheld keys included); its answer now also carries one withheld-key-dropped advisory per undeclared key the stored container held, as an omitted auth already does for its undeclared keys.
• Merge of origin/main. Merged at 0eb97fa47 (merge commit 9a0d87754, a real merge, through scripts/pm/os-regen-merge.sh), no conflicts. Two files were auto-merged because both sides moved them — connector-credential-redaction.ts and its test, where main had added notCarriedForwardKeys for undeclared auth keys (feat(spec): a save of a connector's served form drops a leftover undeclared auth key and names it #29456); both sides' hunks are in the merged file and that contract is what the ruling now uses. The one merge=os-regen path the branch changes, the strictness counts shard integration.md, was changed by the branch only, so the script kept its bytes; check:strictness-ledger reads it current after the merge.
• Strictness ledger. integration/ counts regenerated (4 → 6 sites: the two closed twins).

Verification

All local runs went through scripts/pm/os-verify-lock.sh (its VERDICT command-exit line is the reading), each exit code captured before any pipe. Final head: 7d0799474 (branch merged with origin/main at 0eb97fa47). The readings below are this round's, on that head unless a row says otherwise; the previous round's readings on 577984fe are superseded by them. CI on this head is its own reading.

Suites and typechecks

Command	Head	Result
pnpm --filter @objectstack/spec test (the local project)	7d0799474	exit 0 · 805 files · 23864 passed, 1 todo
pnpm --filter @objectstack/metadata-protocol test	7d0799474	exit 0 · 308 files passed, 4 skipped · 22272 passed, 26 skipped
the three connector-door dogfood files (url-and-nested-keys, undeclared-keys-withheld, entry-and-url-hardening)	7d0799474	exit 0 · 3 files · 44 passed
pnpm --filter @objectstack/spec typecheck · @objectstack/metadata-protocol typecheck · @objectstack/dogfood typecheck	7d0799474	exit 0 · exit 0 · exit 0
pnpm --filter @objectstack/spec exec vitest run --project repo scripts/build-schemas-check-mode.deleted-baseline.test.ts	7d0799474	exit 0 · 1 file · 15 passed
pnpm --filter @objectstack/cli exec vitest run --project integration --maxWorkers=1 test/package-union-readers.test.ts	7d0799474	exit 0 · 1 file · 7 passed
pnpm --filter @objectstack/dogfood test (whole battery, no shard, no path)	7d0799474	exit 0 · 402 files passed, 3 skipped · 3336 passed, 28 skipped

The rest of the spec repo project and the cli suites are CI's reading on this head (Test Core): of their files, this PR's diff edits only the two run above.

Ablation (one run, the ruling's implementation committed first)

One mutation through scripts/ablation-replace.mjs (anchor hit once, blob changed): the undeclared retryConfig keys stay withheld but are no longer named in notCarriedForwardKeys — the pre-ruling behaviour. packages/spec rebuilt (tsup), scripts/ablation-dist-preflight.mjs → the marker present in 4 built files, so the protocol and dogfood suites (which resolve @objectstack/spec through dist/) read the mutation.

Pin	Mutated	Restored
spec connector-credential-redaction.test.ts — the three retryConfig not-carried-forward cases	red (3)	green
spec, same file — CONTROL: a non-object retryConfig stays carried forward; every other case	green (64)	green (67/67)
metadata-protocol metadata-redaction.connector-undeclared-keys.test.ts — served form, {}, omission each report the drop; the gate is not told; the served-form save without the key	red (5)	green
metadata-protocol, same file — CONTROL no-drop row, the author's word, removal, reorder, malformed	green (11)	green (16/16)
dogfood — retryConfig: {} replaces whole (with its header-map CONTROL), the served form replaces, the second file's served-form retryConfig	red (3)	green
dogfood — CONTROL: omission removes as before; a non-object retryConfig kept at rest; every other pin in the three files	green (41)	green (44/44)

Restore: ablation-replace --restore; git hash-object equals git rev-parse HEAD:PATH; git diff HEAD empty and whole-tree git status --porcelain empty. packages/spec rebuilt, then ablation-dist-preflight … --absent → the marker absent from all 592 built files.

Gates

node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands on 7d0799474 (20 paths against merge base 0eb97fa47) derived 108 commands; each ran with its exit recorded before any pipe, and --ran on the command :: exit N record → 108 derived, 108 run, 0 NOT-MEASURED (derived from the recorded codes), 0 UNRUN; all exit 0. pnpm check:dual-build-cjs-loads first answered exit 3 (PREREQUISITE NOT MET: seven packages outside the dogfood build closure had no dist/); those seven were built and it was re-run: exit 0. pnpm --filter @objectstack/spec check:generated: all 14 generated artifacts up to date; content/docs/references/api/protocol.mdx was regenerated by check:generated --fix (gen:docs) for the advisories description edit and is the only generated file this round changes; check:api-surface reads the public API surface unchanged, check:authorable-surface exit 0, check:strictness-ledger current (14 shards).

Human Minimum

• 1. Schemas start as Zod; packages/spec holds no runtime logic.
• 2. Every name I added uses the casing for its kind.
• 3. No formatter ran; pnpm lint passes. (No formatter ran; pnpm lint is CI's run.)
• 4. One branch off main, one pull request (a no-card order: no issue to reference).
• 5. A change that publishes carries a changeset, and both declaration lines are filled in here and in the changeset.
• 6. packages/spec touched: its generated artifacts are regenerated and committed.
• 7. No hand edits to content/docs/references/, packages/*/CHANGELOG.md or content/docs/releases/.
• 8. Title, body and comments are in English.
• The Before Submitting list in CONTRIBUTING.md is done. (Local scope per the dispatch contract; the full battery is CI's.)

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/spec, touching 51 documentable anchor(s).

27 hand-written doc(s) name something this change touched — list omitted above 15 rows. Re-derive on the tree named below: node scripts/docs-audit/affected-docs.mjs --json c76c0e042ea1efc9ccb7b209a82dd8f0fc119953.

⛔ 4 release-owned page(s) also affected — read-only, see AGENTS.md Documentation Guardrails.

What this run could not see

• 9 name(s) were too generic to anchor anything (single lowercase words)
• the SDK route bridge reached 61 of 218 client-bound route-ledger rows — the other 157 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 157: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 55 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 102 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 168 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json c76c0e042ea1efc9ccb7b209a82dd8f0fc119953 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from fafe515edaf84aeba42f3bc90a1c6aff95a138a7 — the merge of head 7d079947412d31180bc9427968bca044dc0b9554 into base c76c0e042ea1efc9ccb7b209a82dd8f0fc119953, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin fafe515edaf84aeba42f3bc90a1c6aff95a138a7 && git checkout fafe515edaf84aeba42f3bc90a1c6aff95a138a7
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin c76c0e042ea1efc9ccb7b209a82dd8f0fc119953 7d079947412d31180bc9427968bca044dc0b9554 && git checkout -B drift-repro c76c0e042ea1efc9ccb7b209a82dd8f0fc119953 && git merge --no-ff 7d079947412d31180bc9427968bca044dc0b9554

node scripts/docs-audit/affected-docs.mjs --json c76c0e042ea1efc9ccb7b209a82dd8f0fc119953

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs c76c0e042ea1efc9ccb7b209a82dd8f0fc119953 → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[objectstack-fleet]

triage#1 · os-zhuang · session_01AavokzJ5DndAwitDXvKy4U

Contract-review-claim: session_01AavokzJ5DndAwitDXvKy4U · head 577984f · 2026-11-02T23:01Z

Taken under (b): the head has waited 75 min, with no lane signature, record, claim or hold.

---

Generated by Claude Code

[objectstack-fleet]

domain:spec#1 · hotlong · session_01Q4EjjP1K353tLKWRMajLsE

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 577984fe21163e30c191ccced287a3e1a0ba9e31
Local-runs: none
Scope: packages/spec/src/integration/connector-credential-redaction.ts, packages/spec/src/integration/connector-url-credentials.ts, packages/spec/src/integration/connector.zod.ts, packages/spec/src/migrations/entries/semantic/18.connector-entry-nested-undeclared-key-refused.ts, packages/spec/src/migrations/entries/semantic/18.connector-entry-url-credential-refused.ts, packages/spec/src/integration/connector-entry-url-credentials.test.ts, packages/spec/src/integration/connector-entry-nested-keys.test.ts, packages/spec/src/integration/connector-credential-redaction.test.ts, packages/spec/src/kernel/metadata-authoring-lint.test.ts, packages/spec/scripts/build-schemas-check-mode.deleted-baseline.test.ts, packages/cli/test/package-union-readers.test.ts, packages/qa/dogfood/test/connector-meta-door-url-and-nested-keys.dogfood.test.ts, packages/qa/dogfood/test/connector-meta-door-entry-and-url-hardening.dogfood.test.ts, packages/qa/dogfood/test/connector-meta-door-undeclared-keys-withheld.dogfood.test.ts, docs/audits/2026-07-unknown-key-strictness-ledger.counts/integration.md + packages/spec/scripts/build-schemas.ts (computeSurfaceReachability, reachabilityRootTypes, computeGuidanceRoutes, check (c) proof 4), packages/spec/src/shared/strict-object.ts (strictObjectDeclarations), packages/spec/src/data/driver/common.zod.ts (credentialQueryParamOf, urlCredentialQueryParams), packages/spec/src/data/datasource-credential-redaction.ts (redactUrlCredentialQueryParams), packages/spec/src/shared/connector-auth.zod.ts, packages/spec/src/kernel/metadata-type-schemas.ts, packages/spec/src/stack.zod.ts, packages/metadata-protocol/src/metadata-redaction.ts (planCarryForward), packages/metadata-protocol/src/protocol-credential-carry-forward.ts, packages/metadata-protocol/src/protocol.ts (save door: schema parse, then gate, then carry-forward before the put), packages/metadata-protocol/src/metadata-diagnostics.ts (decorateMetadataItem), packages/services/service-automation/src/plugin.ts (retry parse at materialization), packages/spec/src/integration/connector-fetch-policy.ts, packages/connectors/connector-rest/src/rest-connector.ts (buildUrl), packages/connectors/connector-openapi/src/openapi-provider.ts (loadOpenApiDocument), packages/connectors/connector-mcp/src/mcp-provider.ts, packages/spec/src/shared/resilient-fetch.ts, packages/spec/src/migrations/entries/README.md, packages/spec/src/migrations/entries/semantic/18.connector-entry-undeclared-key-refused.ts (D3 precedent), docs/adr/0097-declarative-connector-instances.md (§5), scripts/check-adr-0087-registration.mjs (breakingDeclaration), packages/spec/src/kernel/metadata-authoring-lint.ts

This record supersedes the one on 6f2a38490e7c1f3a53c8334b0514ec80691828ef. The merge base is unchanged (origin/main at 5651647d). The delta between the two heads touches six files: connector.zod.ts, the nested-keys spec test, the URL-and-nested-keys dogfood test, the nested changeset, and two moved CI fixtures (packages/spec/scripts/build-schemas-check-mode.deleted-baseline.test.ts, packages/cli/test/package-union-readers.test.ts). Everything else in the net diff — the shared URL module, the read redactor, both D3 entries, the URL changeset, the authoring-lint pins, the two edited dogfood files and the ledger shard — is byte-identical to the first head, so the judgments below that concern them are carried forward unchanged and re-stated in brief.

Check-runs on this head at review time, all completed: success — Test Core (and shards 1/8 to 8/8), Test UI (and shards 1/16 to 16/16), TypeScript Type Check, Lint & Repo Gates, Type Check UI, Build & E2E UI, Build Core, Build UI Deps, Live E2E UI, Plan Test Core shards, Dogfood Regression Gate, Auto Label, Check Documentation Links, Lint · scoped · tooling self-tests, Type Check · consumer gates, Type Check · workspace, Lint · PM dispatch-gates, Lint · CI, release & engine gates, Type Check · source gates, Lint · scoped · query-options erasure, Type Check · debt ledger, Lint · docs & code guards, Lint · scoped · slot lookup & corpus, Lint · repo & tooling gates, Lint · ESLint, Flag docs affected by code changes, Governed Surface Queue Guard, PR-body guards, filter, Spec property liveness, Check PR Size, Check Changeset; skipped (opt-in or matrix placeholders) — Lint UI, UI Published Artifacts, Build Docs, Dogfood Regression Gate shard placeholder, Temporal Conformance, Dogfood Verify CLI, 18.x upgrade harness, Packed-tarball smoke, Schedule gate. Nothing is in progress and nothing is red.

① Derived judgments

What the delta changes, each judged:

1. The closed nested twins now share the open shapes' field instances (retryConfigShape and connectorActionShape are built once through sharedFields; the open RetryConfigSchema / ConnectorActionSchema and the module-private AuthoredRetryConfigSchema / AuthoredConnectorActionSchema hold the same instances, pinned by identity in the spec test). Right, and necessary. On main the open integration/RetryConfig and integration/ConnectorAction defs were reachable from the connector root through the open nested shapes of the entry (root-graph); on the first head the closed entry carried its own twin instances, so the authorable-surface gate (computeSurfaceReachability) reached neither open def from any root and a bare deletion of one of their baseline lines would have been waived as over-collection — the regression that reddened CI. Sharing the instances makes the gate reach each open def through its derived-clone bridge (same name, same instance in a visited object node), so a bare deletion is refused again unless it carries its proof. The published surface is unchanged: the twins emit no def, and the net diff carries no change under packages/spec/api-surface, authorable-surface, authorable-defaults, export-origins, declaration-map, json-schema, or content/docs/references (verified against the net file list; the only artifact in the diff is the strictness-ledger count shard, 4 → 6).
2. The computeGuidanceRoutes reasoning connectorBaseShape's docblock records — read against the gate. The census pairs an emitted def with a strictObject declaration by shape signature and by the identity of every field, so with shared instances the open integration/RetryConfig and integration/ConnectorAction defs now pair with their twins' declarations and are read as owing the twins' prescriptions. That pairing is consulted in one place only: check (c) proof 4, for a baseline line the build stopped emitting on that def. A deleted baseline line of an open def can only name a key that def once declared, and every key the twins' guidance names — the credential-shaped keys, and method / path / url on an action — is one the open defs never declared (the census itself drops a guidance entry filed under a declared key). So no deletion of these defs can reach the pairing today, and the open defs are not charged anything. The one way it could in future — a guidance entry added to a twin for a key the open def declares, and that key later deleted — yields a declared-but-silent violation, which refuses the deletion rather than waiving it: a louder outcome, never a softer one, and the alias-integrity audit flags such an entry as a false claim before that. The top-level reasoning stays as written (connectorBaseShape is still a function, and the closed entry keeps its own top-level instances); the nested docblock records why the cost does not bite one level down. Right.
3. S2 delivered: both twins carry the entry's credential-key guidance (one shared, frozen table, also spread into the top-level entry's guidance), the action twin additionally answers method, path, url with the ADR-0097 §5 prescription, and the action's own key is excluded from the credential table because it is a declared key. Pinned per key, with the value never echoed. The nested changeset's "Now" bullet is updated to say so. Right.
4. S3 delivered in part: the dogfood pins an inline providerConfig.spec document — a URL inside it holding a credential query parameter is refused at providerConfig.spec.servers.0.url (the write door's array-element position), and a document whose URLs are credential-free saves as written (saved disabled, so the pin is the door's answer). Right. The retryConfig: {} pin is not added, consistent with ③(b) being escalated rather than ruled.
5. Moved CI fixtures (question 2):
   • packages/cli/test/package-union-readers.test.ts — the #22238 probe of the undeclared-authoring-key walk over a two-package union moves from connectors[].retryConfig (now refused by the load) to apis[].objectParams (still a strip-mode nested site under a closed root); the assertion keeps its shape (toEqual([stringContaining(path)])) and the test's named claim — that os validate --json carries the walk's finding across the package union — is measured as before. Not weakened.
   • packages/spec/scripts/build-schemas-check-mode.deleted-baseline.test.ts — the #17356 specimen moves from integration/RetryConfig (two hops under the unregistered connector root; after this PR reachable only through the derived-clone bridge) to integration/DeclarativeConnectorEntry, the root's own def. The test's named claim ("a def rooted only in an UNREGISTERED kind is reachable, and a genuinely unreachable one still is not") is measured with unchanged regexes in both regimes, and the entry def's only root is indeed the unregistered kind. What the old specimen carried incidentally — that the walk descends two hops beneath an unregistered root and reports a root-graph hit there — is no longer measured by this pin. Measures its claim; narrower on depth (should-fix S4 below, low weight).
6. Everything carried forward from the first record holds on this head (question 4): the URL refusal and its one walk shared with the read, the read's rewrite of the auth endpoints, the open exports' posture, the save door's order (parse, gate, carry-forward, put) and the no-migration posture, _diagnostics on the raw stored body, no new public export, the ledger shard delta, and the forced test edits — each re-read on this head's tree where the delta touched it and unchanged where it did not.

Caller classes, unchanged from the first record and still holding: read + write (served form saves and keeps stored values; an edit stores the edit; a refused body leaves the row as it was); read-only (member and admin withheld alike on item / layered / both list routes); write without read (the refusal holds on the body as sent; the carry-forward re-grafts only where the incoming value equals the served form); create-only (nothing to carry; a credentialRef-only instance saves, reaches ready, dispatches); admin (no door distinguishes the caller); system context (every metadata door parses; a data-layer write is not a door and is how the pre-refusal rows are seeded; the runtime materializes such a row as stored); cross-org (rows are environment-level, the rules depend on the body); defineConnector() (closes the nested shapes, does not run the URL refusal — ③(e)).

② Semver level

Unchanged and still correct: two changesets, '@objectstack/spec': minor, feat(spec)!:, **BREAKING**, FROM → TO, line-initial Clause-②: no (narrowing) and Metadata-protocol: narrowed, adr-0087: registered markers matching the two 18.* D3 entries (ids, filenames, doors, declared-key lists and acceptance criteria match the tree; the registry is generated and git-ignored, no index to edit). The only published package touched is @objectstack/spec; the CLI test, dogfood tests, the spec script test and the ledger shard publish nothing; the generated surface artifacts are byte-identical to the merge base, so no artifact regeneration is owed beyond the ledger shard. The delta's changeset edit adds the prescriptions the twins now carry and changes no level or line.

③ Boundary flags

• (a) The whole userinfo, including a bare token before the host — within the ruling. Unchanged: the ruling binds the write to the redactor's own traversal and judgement, the redactor on main already withheld the whole userinfo, and the built-in providers reach their upstream through fetch, which refuses a URL carrying any userinfo, so no dispatchable configuration is lost. No finding.
• (b) retryConfig: {} over a stored row holding a withheld nested key — escalate (unchanged). Omitting retryConfig removes it with its withheld keys (pinned); retryConfig: {} keeps the withheld key at rest under the protocol's per-path carry-forward, which grafts into any container the incoming body still carries. The acceptance says 「明确清除({})才删除」; the tree reads omission as the explicit clear. The substance holds (a served-form save loses nothing; the author has a clear), the letter does not, the diff touches no protocol code, the carry-forward's reading of an empty container is type-wide, and the PR discloses it. A maintainer decides: either omission is the explicit clear and this PR stands, or an empty container becomes a clear in the protocol's carry-forward — a @objectstack/metadata-protocol change with its own declaration and pins. Whichever wins should be pinned (S3's remaining half).
• (c) Header and environment maps outside the write walk — consistent with 「用和脱敏器相同的遍历」. Unchanged: the redactor's traversal never enters those maps (withheld whole before the URL walk; the shared walk returns at a map path), so the same traversal excludes them by construction, pinned "judged by neither". The lane-seat note stands: the PR body's claim that the authoring lint warns on a credential-shaped literal inside a map is not in packages/spec/src/kernel/metadata-authoring-lint.ts on main; the ruling does not ask for one.
• (d) An inline OpenAPI document under providerConfig.spec walked at the write door — acceptable narrowing within the ruling, now pinned at the HTTP door. 「providerConfig 各层 URL」 is every level; the read on main already walked an inline document; the provider accepts an inline object, an http(s) URL or a package file path and never parses a JSON string inline, so no inline form escapes the walk. The cost (a document whose example URL carries a credential-named parameter with a value is packaged as a file) is declared.
• (e) defineConnector() does not run the URL refusal — conforming. Unchanged: the ruling places the rule in the entry's refinement; DefineConnectorSchema has parsed the closed base without the ADR-0097 / ADR-0143 refinements since the top-level close, stores nothing, and every stack door re-parses its value; the nested close does apply there and each changeset lists the doors it binds.

④ Design judgment

• packages/spec/src/integration/connector.zod.ts — holds on this head. sharedFields memoises each shape's field set once per process; zod 4 field schemas are immutable, strictObject builds its closed object around the shared shape without touching the fields, and the declaration it registers carries that same shape, which is exactly what makes the gate's identity bridge reach the open defs. The twins stay module-private; the open exports keep their posture (pinned); the refusal messages name the surface, the keys and the prescription, never a value (pinned). connectorBaseShape stays a per-carrier function at the top level, and the nested docblocks state why sharing is safe one level down (see ① item 2). Should-fix S1 (open item, carried forward): one item on the shared URL module is carried to the maintainer outside this record; it is a should-fix, not a must-fix, and does not block the verdict. (Its detail is withheld from this public copy by the seat.)
• packages/spec/src/integration/connector-url-credentials.ts — unchanged between heads; the first record's judgment stands (holds against credentialQueryParamOf / urlCredentialQueryParams / the redactor's userinfo regex; every input form tried is judged identically by both doors; connectorUrlCredentialPositionOf is right).
• packages/spec/src/integration/connector-credential-redaction.ts — unchanged between heads; the first record's judgment stands (a carry-forward of main's behaviour on the shared walk; removals first; auth endpoints rewritten in place; served auth stays declared keys only).
• The two D3 entries — unchanged between heads; consistent with the tree.
• Tests — the spec pins now also cover each prescription the twins carry and the field-instance identity the gate relies on; the dogfood adds the inline-document refusal and its control. Should-fix S3 (remaining half): pin retryConfig: {} once ③(b) is ruled. Should-fix S4 (low): the #17356 pin now holds the unregistered root's own def; keep a specimen beneath that root too (an instance-auth kind reached through connector.auth stays root-graph in the closed entry), so the walk's descent beneath an unregistered root is measured again and not only its enumeration.
• Cited-code cross-checks — reachabilityRootTypes() unions the registered types with the unregistered kinds, so connector is a root and the closed entry is visited; computeSurfaceReachability().reachableVia answers derived-clone for a def whose shape entry (same name, same instance) appears in a visited node, which is what the shared instances give the two open defs; verdictFor is reached only from the deleted-baseline branch of check (c). The strictness ledger's hand-written integration/ row (docs/audits/2026-07-unknown-key-strictness-ledger.md) still describes only the top-level close with its own-instances reasoning; a sentence on the two twins and their shared instances would keep it current — a docs matter for the lane seat, not a tree finding.

Findings: must-fix — none. Should-fix — S1 (open item on the shared URL module, carried to the maintainer), S3 (pin retryConfig: {} once ③(b) is ruled; the inline-document half is delivered), S4 (a depth specimen for the #17356 pin). Delivered since the first record — S2 (guidance on both twins), S3's inline-document pin. Escalate — ③(b), the {} reading of the acceptance (unchanged).

Implemented-by: claude/connector-metadata-hardening
Reviewed-by: session_01Q4EjjP1K353tLKWRMajLsE

VERDICT: PASS

[objectstack-fleet]

triage#1 · os-zhuang · session_01AavokzJ5DndAwitDXvKy4U

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 577984fe21163e30c191ccced287a3e1a0ba9e31
Local-runs: none
Scope: packages/spec/src/integration/connector-url-credentials.ts, packages/spec/src/integration/connector.zod.ts, packages/spec/src/integration/connector-credential-redaction.ts, packages/spec/src/migrations/entries/semantic/18.connector-entry-url-credential-refused.ts, packages/spec/src/migrations/entries/semantic/18.connector-entry-nested-undeclared-key-refused.ts + packages/spec/src/data/driver/common.zod.ts (urlCredentialQueryParams, credentialQueryParamOf, CREDENTIAL_URL_QUERY_PARAM_NAMES), the two changesets, docs/audits/2026-07-unknown-key-strictness-ledger.counts/integration.md

Inputs read:

• PR feat(spec)!: an authored connector URL holds no credential part; its retryConfig and actions refuse an undeclared key #29573: body, 17 files, and the net diff against main (+1423/−174). There is no linked card.
• The maintainer ruling, as quoted verbatim in the body.
• Head check-runs, re-fetched at the end of the review.
• The cited code, read with git show prr-29573: and origin/main:.

① Derived judgments

• One judge at both doors: right. connector-url-credentials.ts now holds the one definition: the root set (providerConfig, auth), the excluded credential maps, the parameter set (the shared driver names, the connector names, and the instance's own auth.paramName), and connectorUrlCredentialPartsOf, which matches a userinfo or a credential query parameter with a value. It also holds the one walk, findConnectorUrlCredentials, which covers every key, depth and array element.
  • Write. The entry refinement (connector.zod.ts) adds one issue per URL that walk returns, located at its path.
  • Read. credentialUrlRewritesOf (connector-credential-redaction.ts) consumes the same walk, then maps each hit with connectorUrlCredentialPositionOf: rewritten in place, or the enclosing array or dotted key withheld whole.
  • So the read rewrites or withholds exactly what the write refuses, and the read now covers auth endpoints, as the ruling's second sentence asks. The old read-side copies of the parameter names and the regexes are moved, not duplicated. The two constants stay re-exported from the redaction module, so its importers are unchanged.
• The refusal text: right.
  • It names the position and the part (userinfo, or each parameter name).
  • It never echoes a value.
  • It gives the auth.credentialRef prescription per auth type, as the ruling asks.
  • It is not split per provider, which the ruling forbids (「不按 provider 分别写规则」).
• Accept-set narrowing 1, URL credentials: right in scope. Each door that runs the entry refinement refuses: defineStack, os validate/compile, artifact load, and the save door's 422 INVALID_METADATA. defineConnector() does not run the refinement, as for the other ADR-0097 refinements, and the body says so. Header and env maps stay outside the walk: they are withheld whole on read, and the authoring lint covers them.
  • On false positives: the parameter names are exact, case-insensitive key matches with a value (page_token, for example, is not matched). key, sig, signature and token were already redacted on read, so the write now refuses what the read already hid, which is consistent.
• Accept-set narrowing 2, closed retryConfig and actions[]: right. The closed twins are built from the same shape declarations as the published open schemas (retryConfigShape, connectorActionShape). The declared key sets are unchanged: action key label description inputSchema outputSchema effect, and retry strategy maxAttempts initialDelayMs maxDelayMs backoffMultiplier retryableStatusCodes retryOnNetworkError jitter. Only the authored entry (connectorBaseShape(true)) uses the closed twins. method, path and url get the ADR-0097 §5 guidance.
• Strictness ledger: integration/ goes from 4 to 6 sites, the two closed twins. That is consistent with the change.
• Gates on this head: 56 success, 9 skipped, 0 pending, 0 failures (total_count: 65). The PR reads mergeable: true, mergeable_state: clean.

② Semver level

There are two changesets: connector-entry-url-credential-refused.md and connector-entry-nested-undeclared-key-refused.md.

• Level: both are @objectstack/spec: minor with a BREAKING banner.
• Declarations: both carry Clause-②: no (narrowing) and Metadata-protocol: narrowed, at line start in each changeset and in the PR body.
• ADR-0087: each has <!-- adr-0087: registered … -->, naming a D3 semantic entry the PR adds under the same id.
• Verdict: a narrowing kind takes minor on the package that moves (AGENTS.md step 3). Right. The changeset and ADR-0087 gates are green.

③ Boundary flags

• Ruling provenance. The PR body quotes the maintainer's ruling verbatim but links no card and no ruling record. Triage judged the diff against the quoted text. The landing seat should link the record, a card comment or a director record, in the PR body.
• Stored rows are not re-judged, and no migration ships, as the ruling says (「不做存量迁移」). The dogfood pins carry-forward at the save door.
• The PR touches the strictness counts ledger, the R846/R847 queue-collision surface (Queue-flake anchor: scripts/strictness-ledger-doc.test.ts #29524). Merge origin/main and regenerate before enqueue, and land serially (landing-operations.md §D).

④ Design judgment

The design makes the ruling mechanical: one walk serves both doors, so the two cannot drift. Rewriting the read side onto the write's walk is the simplification the old twin copies lacked. Closing the nested shapes from the same shape builders keeps open and closed key sets equal by construction, and the new test pins that equality.

Tried to break it:

• A URL inside an array: it is withheld whole on read and refused at its index on write.
• A dotted key: it is withheld as the key.
• An inline OpenAPI document with a credential example URL: refused, which is documented.
• auth.paramName as a custom parameter: it is included in the set.
• A value echoed in a message: none is.

Must-fix: none.

Should-fix:

1. Scope gap. A small class of credential-bearing string forms falls outside the shared predicate at both doors. It sits outside the ruling's literal text, and it cannot dispatch, but it is stored at rest and served as written. The details go through the advisory channel. A follow-up card should be filed through that route, worded at rule level only.
2. Link the ruling record in the PR body (③).

Implemented-by: claude/connector-metadata-hardening
Reviewed-by: session_01AavokzJ5DndAwitDXvKy4U

VERDICT: PASS

---

Generated by Claude Code

[objectstack-fleet]

domain:skills#2 · os-justin · session_01QSeKYn5CmmdShCJifm6WYj

Takeover · 2026-11-03T02:11Z

By the maintainer's order, this PR and its landing pass to seat session session_01QSeKYn5CmmdShCJifm6WYj (account os-justin, which sits security#1 and signs domain:skills#2 until the security lane signature lands). The order, verbatim, in that session:

连接器开发：#29573 仍是草稿，有 12 个提交，落后 main 117 个提交。你负责接手跟进处理

The previous holder, domain:spec#1 · session_01Q4EjjP1K353tLKWRMajLsE, owes no annotation (a forced takeover).

Readings at takeover:

reading	value
head	577984fe21163e30c191ccced287a3e1a0ba9e31, draft
vs main	12 ahead, 118 behind (compare)
size	+1423 / −174 over 17 files, under 3000; no governed path
check-runs on the head	58 success, 11 skipped
contract review on the head	PASS ×2: comments 6590686226 and 6590693346, must-fix none

Next steps, in order:

1. A dev merges origin/main into this branch (a merge commit, no rebase, no force-push), regenerates the strictness counts ledger and every other generated file the merge touches, and re-runs the derived gates.
2. A contract-review-tier review covers the merge delta at the new head.
3. Then ready and auto-merge, landed serially (landing-operations.md §D).

The open question in 维护者速读 (does retryConfig: {} over a stored row clear its withheld keys) goes to the maintainer; per Seat notes it does not block landing.

[objectstack-fleet]

domain:skills#2 · os-justin · session_01QSeKYn5CmmdShCJifm6WYj

Ruling · retryConfig: {} over a stored row with withheld keys · 2026-11-03T02:23Z

The maintainer, in session session_01QSeKYn5CmmdShCJifm6WYj, answered the open question in 维护者速读. The seat asked whether an explicit retryConfig: {} over a stored row should clear the undeclared keys the read withholds (today they are kept; only omitting the container clears them). The answer was the option the seat put first, verbatim: 「显式 {} 就清掉,带前提 (Recommended)」.

1. Ruling: an explicit retryConfig: {} (or any explicit retryConfig object) replaces the stored container whole. Withheld undeclared keys of the stored row are not carried forward into it. Omitting retryConfig keeps today's behaviour.
2. Premise (named, falsifiable; the dev verifies it before editing): the runtime reads no undeclared retryConfig key when it materializes a stored connector row. A withheld key changes no retry or dispatch behaviour today.
3. Prohibition: if the premise does not hold, stop and report the fork. ⛔ Do not force the clear, and ⛔ do not quietly fall back to keeping.

This lands in this PR, with the pin the earlier should-fix named (a retryConfig: {} save over a stored row carrying an undeclared key; the key is gone on the next read of the stored row). The contract review at the new head covers it.

[objectstack-fleet]

domain:skills#2 · os-justin · session_01QSeKYn5CmmdShCJifm6WYj
os-dev-report

{
  "issue": null,
  "status": "done",
  "branch": "claude/connector-metadata-hardening",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/29573",
  "session": "session_01QSeKYn5CmmdShCJifm6WYj (subagent: the dispatching seat's session)",
  "head_sha": "7d079947412d31180bc9427968bca044dc0b9554",
  "premise_still_valid": true,
  "summary": "Step 1: merged origin/main at 0eb97fa47 into the branch through scripts/pm/os-regen-merge.sh (real merge commit 9a0d87754, no rebase, no force-push, no conflicts). Step 2, premise read BEFORE editing: instance materialization (service-automation plugin.ts) parses the stored retryConfig with the open RetryConfigSchema (z.object, strip) and hands the provider only parsed.data; measured on src and again on the built dist, a policy carrying two undeclared keys parses successfully, the keys are absent from the parsed policy, and the parsed policy and connectorFetchOptions output are identical with and without them. One raw read exists and is recorded, not hidden: the reconcile fingerprint connectorInstanceSignature serializes the stored retryConfig as written, so the save that first drops such a key changes the fingerprint and the next reconcile re-materializes the instance once with the identical policy; no retry or dispatch behaviour reads the key, so the premise holds as the ruling states it. Ruling implemented at the carry-forward decision point the protocol already reads: the connector redactor now names the undeclared keys of an object retryConfig in notCarriedForwardKeys (main's contract for undeclared auth keys), so an explicit retryConfig (the served form, {}, any object) replaces the stored one whole and the save answer names each dropped key (advisory withheld-key-dropped); omission still removes the container; an actions element's key and a non-object retryConfig stay carried forward; no metadata-protocol source changed. Pinned at the spec redactor, the metadata-protocol carry-forward and the HTTP door (dogfood) with controls, ablated once. Changeset, D3 upgrade entry, the advisories .describe() (+ regenerated protocol.mdx) and the PR body (one relay issue_patch: 维护者速读 需要你做的 now says the ruling is implemented) updated at rule level.",
  "tests": "All under scripts/pm/os-verify-lock.sh, exit read from its VERDICT line, on head 7d0799474: pnpm --filter @objectstack/spec test → exit 0, 805 files, 23864 passed, 1 todo; pnpm --filter @objectstack/metadata-protocol test → exit 0, 308 files passed 4 skipped, 22272 passed 26 skipped; the three connector-door dogfood files → exit 0, 44/44 (url-and-nested-keys now 26 cases); spec / metadata-protocol / dogfood typecheck → exit 0 x3; spec repo project scripts/build-schemas-check-mode.deleted-baseline.test.ts → exit 0, 15/15; cli integration test/package-union-readers.test.ts → exit 0, 7/7. First dogfood run of the new pin was red on my own envelope guess (data.advisories): the meta save door serves the result unwrapped; fixed in 7d0799474 and re-run green. Ablation (one run, implementation committed first, own script with trap EXIT INT TERM, absolute paths): anchor `notCarriedForwardKeys.push(path.join('.'))` replaced via scripts/ablation-replace.mjs so retryConfig keys stay withheld but carried forward (anchor-count 0, marker-count 1, blob 14a0ea3f vs HEAD fa790442); spec rebuilt; ablation-dist-preflight marker present in 4 built files. Mutated: spec redaction file 3 red / 64 green, metadata-protocol file 5 red / 11 green, dogfood 3 files 3 red / 41 green (both CONTROLs green) - every red one predicted before the run. Restored: blob == HEAD blob, git diff HEAD empty, whole-tree git status --porcelain empty; spec rebuilt; preflight --absent: marker absent from all 592 built files; re-run 67/67, 16/16, 44/44.",
  "gates": "dispatch-gates --commands --repo objectstack-ai/objectstack on 7d0799474 (20 paths vs merge base 0eb97fa47) → 108 commands; each run with output redirected and exit captured before any pipe; --ran on the `command :: exit N` record → 108 derived, 108 run, 0 NOT-MEASURED (derived from recorded codes), 0 UNRUN, all exit 0. check:dual-build-cjs-loads first exit 3 (PREREQUISITE NOT MET: 7 packages outside the dogfood closure unbuilt), built them, re-run exit 0. check:type-check-debt exit 0 (nested in a locked run). Named by the order: check:authorable-surface exit 0; check:strictness-ledger exit 0 (counts current, 14 shards); spec check:generated 14/14 up to date (after check:generated --fix regenerated content/docs/references/api/protocol.mdx for the .describe() edit); check:api-surface unchanged; check:nul-bytes exit 0. CI on 7d0799474 (read, not awaited): 65 check-runs, 57 success, 8 skipped, 0 failed; required contexts Lint & Repo Gates, TypeScript Type Check, Test Core, Build Core, Governed Surface Queue Guard, Type Check UI, Test UI, Build & E2E UI, Live E2E UI success, Lint UI skipped; Check Changeset success. PR-body guards re-run on the body edit is CI's reading.",
  "dogfood_battery": "7d0799474 · os-verify-lock VERDICT command-exit 0 (held 1447s) · pnpm --filter @objectstack/dogfood test, no shard, no path · Test Files 402 passed, 3 skipped (405) · Tests 3336 passed, 28 skipped (3364) · no failures",
  "line_budget": "n/a - no skills/** file touched; PR net diff vs main 20 files +1603/-205 (under 3000); this round 9 files +197/-48 plus the merge",
  "files_changed": [
    "packages/spec/src/integration/connector-credential-redaction.ts (the ruling: undeclaredRetryConfigKeysOf → notCarriedForwardKeys; module note item 8)",
    "packages/spec/src/integration/connector-credential-redaction.test.ts",
    "packages/metadata-protocol/src/metadata-redaction.connector-undeclared-keys.test.ts (test only; main's file, forced by the ruling)",
    "packages/qa/dogfood/test/connector-meta-door-url-and-nested-keys.dogfood.test.ts (the {} pin + controls)",
    "packages/qa/dogfood/test/connector-meta-door-undeclared-keys-withheld.dogfood.test.ts (forced flip)",
    "packages/spec/src/api/protocol.zod.ts (advisories .describe())",
    "content/docs/references/api/protocol.mdx (generated by gen:docs)",
    ".changeset/connector-entry-nested-undeclared-key-refused.md",
    "packages/spec/src/migrations/entries/semantic/18.connector-entry-nested-undeclared-key-refused.ts (reason text)"
  ],
  "merge_conflicts": "none. Merge 9a0d87754 (origin/main 0eb97fa47, pre-merge base 73c24394). Auto-merged because both sides moved them: packages/spec/src/integration/connector-credential-redaction.ts and its .test.ts - main added notCarriedForwardKeys for undeclared auth keys (#29456), the branch moved the URL walk to connector-url-credentials.ts; both sides' hunks are in the merged file, read and tested. os-regen: docs/audits/2026-07-unknown-key-strictness-ledger.counts/integration.md changed by the branch only, the script kept its bytes; check:strictness-ledger and check:generated read every generated artifact current after the merge, so no regeneration was owed by the merge itself.",
  "deviations": [
    "Conflict with the dispatch wording, named not resolved silently: the control was written as `omitting retryConfig still carries forward`, but per the code and the PR's own earlier pin an omitted retryConfig is removed with its keys, before and after this change. Pinned two controls instead: omission removes as before (the ruling's `keeps today's behaviour`), and a non-object retryConfig (withheld whole) IS still carried forward by a save that leaves it out - the one case where omission carries forward.",
    "Consequence of reusing notCarriedForwardKeys, declared in the PR body: a save that omits retryConfig stores the same as before but its answer now also names each dropped undeclared retry key (withheld-key-dropped), as an omitted auth already does.",
    "Beyond the literal ask, to keep published text true: SaveMetaItemResponseSchema.advisories .describe() named only undeclared auth keys - widened and protocol.mdx regenerated; the D3 entry's reason said a served-form save keeps the key - corrected.",
    "PR body opening line re-signed to the current seat (domain:skills#2 · os-justin · session_01QSeKYn5CmmdShCJifm6WYj) after the takeover; Seat notes rewritten (takeover, ruling implemented, contract review owed on the new head).",
    "Commit trailers are AGENTS.md's model-free pair (Claude-Session + Co-authored-by: Claude), not the harness reminder's model-named trailer.",
    "Stray file created by a shell-scoping mistake: /build2.pid at the filesystem root (16 bytes, BUILD_PID=11485). Its removal was blocked by the safety check and not worked around; a human should run rm /build2.pid.",
    "Lock: two queue-timeouts (exit 99) re-run with kept slots; no run went unlocked.",
    "First post-stamped --body attempt was refused locally (two newer comments unacknowledged), nothing written; the second with --ack-through=6593804783 wrote; one PATCH landed.",
    "origin/main (shared ref) advanced to c76c0e042 during the round; not re-merged (AGENTS §10: only on a reported conflict, a main-caused red or a queue removal)."
  ],
  "mcp_calls": "0",
  "api_writes": "2 relay strokes (each one repository_dispatch from this session, executed as objectstack-fleet[bot]): issue_patch objectstack-ai/objectstack#29573 (PR body, read back 25661 bytes identical, run 41578107110); comment on #29573 (this report). git push x5 to the branch (not REST). No labels, no reviewers, draft untouched.",
  "open_questions": [],
  "security_findings": "none",
  "out_of_scope_findings": [
    "carrier: none · noted, not filed: comments naming the notCarriedForwardKeys class by its auth example only (spec kernel metadata-type-redaction.ts TSDoc, metadata-protocol metadata-redaction.ts docblocks) now under-describe it by one case; examples, not claims of completeness - polish, left as is.",
    "carrier: none · noted, not filed: connectorInstanceSignature hashes the raw stored retryConfig, so an undeclared retry key participates in change detection although nothing reads it; with the closed shape and this ruling such keys only drain, so the cost is one extra re-materialization per affected row - no defect."
  ]
}

[objectstack-fleet]

security#1 · os-justin · session_01QSeKYn5CmmdShCJifm6WYj

Contract-review-claim: session_01QSeKYn5CmmdShCJifm6WYj · head 7d07994 · 2026-11-03T04:30Z

[objectstack-fleet]

security#1 · os-justin · session_01QSeKYn5CmmdShCJifm6WYj

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 7d079947412d31180bc9427968bca044dc0b9554
Local-runs: none
Scope: packages/spec/src/api/protocol.zod.ts, packages/spec/src/integration/connector-credential-redaction.ts, packages/spec/src/integration/connector-url-credentials.ts, packages/spec/src/integration/connector.zod.ts, packages/spec/src/migrations/entries/semantic/18.connector-entry-nested-undeclared-key-refused.ts, packages/spec/src/migrations/entries/semantic/18.connector-entry-url-credential-refused.ts, .changeset/connector-entry-nested-undeclared-key-refused.md, .changeset/connector-entry-url-credential-refused.md, docs/audits/2026-07-unknown-key-strictness-ledger.counts/integration.md, content/docs/references/api/protocol.mdx, packages/spec/src/integration/connector-credential-redaction.test.ts, packages/spec/src/integration/connector-entry-nested-keys.test.ts, packages/spec/src/integration/connector-entry-url-credentials.test.ts, packages/spec/src/kernel/metadata-authoring-lint.test.ts, packages/spec/scripts/build-schemas-check-mode.deleted-baseline.test.ts, packages/cli/test/package-union-readers.test.ts, packages/metadata-protocol/src/metadata-redaction.connector-undeclared-keys.test.ts, packages/qa/dogfood/test/connector-meta-door-url-and-nested-keys.dogfood.test.ts, packages/qa/dogfood/test/connector-meta-door-entry-and-url-hardening.dogfood.test.ts, packages/qa/dogfood/test/connector-meta-door-undeclared-keys-withheld.dogfood.test.ts + packages/spec/src/data/driver/common.zod.ts (credentialQueryParamOf, urlCredentialQueryParams, decodeQueryKey, CREDENTIAL_URL_QUERY_PARAM_NAMES), packages/spec/src/data/datasource-credential-redaction.ts (redactUrlCredentialQueryParams), packages/spec/src/shared/connector-auth.zod.ts (tokenUrl, authorizationUrl, resource), packages/spec/src/kernel/metadata-type-redaction.ts (MetadataRedactionResult.notCarriedForwardKeys), packages/metadata-protocol/src/metadata-redaction.ts (planCarryForward, resolveRedactedPath, carryForwardRedactedValuesReportingDrops), packages/metadata-protocol/src/protocol-credential-carry-forward.ts (carryForwardRedactedCredentials, storedBodyForCarryForward, droppedWithheldKeyNotices, WITHHELD_KEY_DROPPED), packages/metadata-protocol/src/protocol.ts (carryForwardRedactedCredentials, storedBodyForCarryForward), packages/services/service-automation/src/plugin.ts (connectorInstanceSignature, declaredInstanceFingerprint, the RetryConfigSchema.safeParse at materialization and the ConnectorProviderContext it builds), packages/connectors/connector-rest/src/rest-provider.ts and packages/connectors/connector-openapi/src/openapi-provider.ts (ctx.retryConfig), packages/lint/src/lint-connector-credential-literals.ts, docs/audits/2026-07-unknown-key-strictness-ledger.md (integration/ row), docs/adr/0097-declarative-connector-instances.md (§5)

Full review of the whole PR at this head, not a delta: the head moved from 577984fe21163e30c191ccced287a3e1a0ba9e31 (the two PASS records, comments 6590686226 and 6590693346) by a real merge of origin/main (9a0d87754, base now 0eb97fa47) and by the implementation of the maintainer's ruling in comment 6593804783. Inputs: the PR body, its 20-file list, every comment, the net diff against main at the merge base (+1603/−205), the check-runs on this head, and the cited code read with git show. The os-dev report (comment 6595468586) was read as the author's account and each of its claims tested in the tree, never cited as evidence. No card: a no-card order, as the Seat notes record.

Check-runs on this head: 69, all completed — 59 success, 10 skipped (opt-in and matrix placeholders: Lint UI, UI Published Artifacts, Temporal Conformance, Packed-tarball smoke, 18.x upgrade harness, Dogfood Verify CLI, the shard placeholder, the schedule gate, and one duplicate each of Check PR Size and Auto Label). Nothing is red and nothing is in progress. Those conclusions are the gate verdicts; Lint & Repo Gates, Check Changeset, Spec property liveness, Governed Surface Queue Guard and PR-body guards among them. The PR reads mergeable_state: clean, head repo is the base repo (not a fork).

① Derived judgments

Every accept-set and public-surface change, judged in the tree:

1. The URL-credential refusal, at every door — right, and reached by one walk. connector-url-credentials.ts holds the one definition (a userinfo, whole; a credential query parameter with a non-empty value, judged by credentialQueryParamOf on the percent-decoded, case-folded name, the fixed name set plus the instance's own auth.paramName) and the one traversal findConnectorUrlCredentials (every string under providerConfig and auth, any depth, arrays included, the four header/env map paths skipped). The entry refinement in connector.zod.ts adds one custom issue per URL it returns, located at the URL's path, naming the parts and never the URL or a value (pinned). The refinement is the DeclarativeConnectorEntrySchema superRefine, so it binds defineStack({ connectors }), os validate / os compile, the artifact load and PUT /api/v1/meta/connector/:name (the dogfood pins the 422 INVALID_METADATA envelope at 13 positions, nothing stored, an existing row untouched). It runs after the descriptor early-return, which is correct: a descriptor cannot carry providerConfig or auth (both refused there), so no URL position escapes. defineConnector() parses the closed base without the refinement, as for every other ADR-0097 refinement (③e). No rule per provider.
2. The closed retryConfig and actions shapes — right. retryConfigShape and connectorActionShape are built once through sharedFields and handed to both carriers; the open RetryConfigSchema / ConnectorActionSchema are z.object(shape()) (strip) and the private twins strictObject(...) over the same instances. connectorBaseShape(true) selects the twins only for DeclarativeConnectorEntryBaseSchema; ConnectorBaseSchema (behind ConnectorSchema) keeps the open nested shapes. The refusal is one unrecognized_keys issue at the container with keys listed (pinned by code + path + keys, with CONTROL accepts, at defineConnector() and inside a stack); the credential table (ENTRY_CREDENTIAL_KEYS_GUIDANCE) is shared by the entry and both twins, the action twin drops key from it (its own declared machine name) and adds ADR-0097 §5's prescription for method / path / url. The twins are module-private, emit no def, and the net diff carries no change under the api-surface, authorable-surface, json-schema or declaration-map artifacts; the only artifact that moves is the strictness count shard (4 → 6).
3. The read redactor covers the auth endpoints — right. credentialUrlRewritesOf consumes the same walk and maps each hit through connectorUrlCredentialPositionOf: rewritten in place via redactConnectorUrl (userinfo regex, then redactUrlCredentialQueryParams with the same params) when the path is object keys without dots; else the first array hop or dotted key is withheld whole, once. The walk runs on the served body after the removals, so a withheld map is never entered. tokenUrl, authorizationUrl and resource are plain z.string().url() fields on the oauth2 kinds, reached through the auth root like any other string. Pinned at the redactor (byte-for-byte remainder) and at the HTTP door (item, layered and both list routes, member and admin).
4. An explicit retryConfig replaces the stored one whole — the ruling, implemented at the contract the protocol already reads. undeclaredRetryConfigKeysOf names each undeclared key of an object retryConfig in notCarriedForwardKeys as well as redactedKeys; planCarryForward never grafts such a path and reports it in dropped whenever the incoming body holds no value there (an incoming {}, the served form, or an absent container alike); carryForwardRedactedCredentials and droppedWithheldKeyNotices turn dropped into one withheld-key-dropped warning per key on the save answer, path connectors[0].retryConfig.KEY, value never named. A non-object retryConfig and an actions element's undeclared key stay in the carried-forward half (undeclaredNestedKeysOf), pinned as CONTROLs. No metadata-protocol source changes; the body's claim that the mechanism is declarative holds.
5. The widened advisories describe — right and owed. SaveMetaItemResponseSchema.advisories now names the undeclared retryConfig keys beside the undeclared auth keys; it is a .describe() change only, no shape moves, check:api-surface is unchanged, and content/docs/references/api/protocol.mdx is the regenerated output of that one sentence (the only generated file in the diff besides the ledger shard).
6. The two D3 entries name the doors, the declared-key lists (RetryConfigSchema's eight keys, ConnectorActionSchema's six) and the prescriptions exactly as the tree declares them; the nested entry's reason now states the ruling (an explicit retryConfig replaces whole; an actions key stays at rest), matching the code.

Caller classes, each read against the doors: read + write (served form saves; stored URLs and actions keys kept; an explicit retryConfig replaces); read-only (member and admin withheld alike); write without read (refusal on the body as sent; the carry-forward re-grafts only where the incoming equals the served form); create-only (a credentialRef-only instance saves, reaches ready, dispatches — pinned with a live upstream); system context (a data-layer write is not a door; it is how every pre-refusal row is seeded, and the runtime materializes such a row as stored); defineConnector() (nested close yes, URL refusal no, ③e).

② Semver level

Two changesets, both '@objectstack/spec': minor, feat(spec)!: title, a **BREAKING** banner, a FROM → TO block with the one-line fix, line-initial Clause-②: no (narrowing) and Metadata-protocol: narrowed, and exactly one adr-0087: registered marker each naming the matching 18.* D3 entry — consistent with AGENTS.md step 3 (a narrowed kind takes at least minor on the package the diff moves) and with Check Changeset and the ADR-0087 gate, both green on this head. The PR body carries the same two declarations line-initial. @objectstack/spec is the only published package the diff moves; the metadata-protocol, cli and dogfood changes are test-only; the ledger shard and the regenerated mdx publish nothing. Skills-docs: none holds: on this head no connector literal under skills/**, content/docs/**, examples/** or packages/apps/** carries an undeclared retryConfig key or a userinfo URL (read with git grep), and the showcase the dogfood boots would refuse one at artifact load. The hand-written integration/ ledger row still describes only the top-level close; the count shard the gate reads is current. That sentence is a docs matter for the lane seat, not a tree finding (carried from 6590686226).

③ Boundary flags

The earlier records' items, the dev's deviations and the Acceptance notes, each answered:

• (a) S1 — the shared predicate's scope (6590686226 ④; 6590693346 should-fix 1). Unchanged on this head, by design: both doors judge a string by one definition, and the class outside it is outside the ruling's literal text. Still a should-fix held by the maintainer through the advisory channel, at rule level only here; it does not block. A mechanism-level note goes to the seat, not to this record.
• (b) S3 — the retryConfig: {} pin. Delivered: the dogfood pins {} over a seeded row (200, one withheld-key-dropped advisory at connectors[0].retryConfig.secret, the value never in the answer, the stored row then holds {}, the withheld header map on the same row kept as the CONTROL), the served-form replacement, omission removing as before, and a non-object retryConfig kept by a save that leaves it out. ③(b) of 6590686226 is closed by the ruling.
• (c) S4 — a depth specimen for the #17356 pin. Still open, low weight, unchanged; the pin measures its named claim (an unregistered kind's own def is a root-graph hit). Should-fix, not blocking.
• (d) The ruling's premise, verified in the tree, not from the report. service-automation/src/plugin.ts parses entry.retryConfig with the open RetryConfigSchema (z.object, strip) and places only parsed.data on ConnectorProviderContext.retryConfig; the rest and openapi providers read ctx.retryConfig and nothing else; git grep '\.retryConfig\b' over the non-test tree finds no other reader of a stored row's raw value. The one raw read is connectorInstanceSignature, which stringifies the stored retryConfig into the reconcile fingerprint: a save that first drops an undeclared key changes the fingerprint and re-materializes the instance once, with an identical parsed policy. No retry or dispatch behaviour reads the key, so the premise holds as the ruling states it and the prohibition was not triggered. The dev's deviation naming the fingerprint is recorded, not hidden, and is no defect.
• (e) defineConnector() does not run the URL refusal — conforming. Unchanged (DefineConnectorSchema is the closed base in the residue stage, no refinement, stores nothing; every stack door re-parses).
• (f) An omitted retryConfig now names the drop (dev deviation 2). A consequence of reusing the notCarriedForwardKeys contract: planCarryForward reports a not-carried-forward path whenever the incoming body holds no value there, so omission — which already removed the container — now also carries one advisory per undeclared key, exactly as an omitted auth does. What is stored is unchanged (pinned at the protocol and the HTTP door); the advisory is non-gating and additive; the advisories describe says so. Accepted, within the ruling's "omitting keeps today's behaviour".
• (g) The control wording (dev deviation 1). The dispatch's "omission still carries forward" was wrong against the tree (an absent container is the author's word; pinned on main before this PR); the dev pinned the two true controls instead. Right.
• (h) Userinfo scope, inline OpenAPI documents, header and environment maps (Acceptance notes). Each unchanged from the PASS records and still consistent with the ruling's "same traversal, same judgement": the whole userinfo is what the read already withheld; an inline document under providerConfig.spec is a value under providerConfig (pinned at providerConfig.spec.servers.0.url); the maps are outside both doors and withheld whole on read. The body's claim that @objectstack/lint warns on a credential-shaped literal inside a map is now true of the tree (packages/lint/src/lint-connector-credential-literals.ts, rule connector-credential-literal), which closes the lane-seat note of 6590686226 ③(c).
• (i) Ruling provenance (6590693346 should-fix 2). The URL ruling is a no-card order recorded in the Seat notes; the {} ruling is comment 6593804783. Answered as far as a public record can.
• (j) The merge of origin/main. Between the pre-merge base (73c24394) and the merged main (0eb97fa47), main touched five of the PR's files: the redactor and its test (feat(spec): a save of a connector's served form drops a leftover undeclared auth key and names it #29456's notCarriedForwardKeys for undeclared auth keys), protocol.zod.ts and its mdx (the advisories describe), and the protocol test. Every main-side hunk is present at this head (undeclaredAuthKeysOf, item 1 in the module note, the set-only-when-present return, item 4 reduced to the non-object case), and the branch's addition sits in the same loop, in the same order (undeclared keys first, then the credential positions, then the URL walk over the served body). The one semantic interaction — feat(spec): a save of a connector's served form drops a leftover undeclared auth key and names it #29456's CONTROL "a row with no undeclared auth key reports no drop" used a fixture holding an undeclared retry key — was corrected by the ruling's implementation, not papered over. No semantic conflict.
• (k) The moved CI fixtures. package-union-readers.test.ts and the two authoring-lint pins move their nested strip site from connectors[].retryConfig (now refused) to apis[].objectParams, assertions unchanged in kind, and the connector fixture's hand-off is now asserted as a refusal; the #17356 specimen moves to the connector root's own def (③c). None weakens its named claim.
• (l) Governed surfaces. None in the file list; Governed Surface Queue Guard is green. This record is owed by the schema face and the declared narrowing, not by a Tier S path.

④ Design judgment

• connector-url-credentials.ts — holds against credentialQueryParamOf / urlCredentialQueryParams / decodeQueryKey (the query runs from the first ? to the fragment, pairs split on &, key percent- and plus-decoded, matched case-insensitively, an empty value carries nothing) and against URL_USERINFO_RE (every class excludes /?#, so the @ must sit in the authority and the greedy class backtracks to the last @ before the path). Tried to break the walk: a percent-encoded name (api%5Fkey) is judged; a credential name in the fragment or with an empty value is not, at both doors; a ? inside the fragment is fragment text at both doors; user@, user:pass@ and a@b@ are each one userinfo at both doors; a URL in a nested array (providerConfig.x.0.0) is refused at its index and withheld at providerConfig.x whole; a dotted key holding an object holding a URL is refused at the leaf and withheld at the dotted key whole; a string the module's own stated rule does not read as a URL is judged by neither door (the boundary ③a is about, held by the maintainer); providerConfig or auth that is not a plain object is walked by neither (and refused by the entry's own shapes). connectorUrlCredentialPositionOf is right: the first non-addressable hop ends the position, and the protocol's resolveRedactedPath tries the standard split first and longer trailing keys last, so a withheld dotted key is re-grafted by its whole-string name.
• Read/write symmetry — holds. The rewriter and the detector share the pair predicate and the same ? / # / & boundaries, and the userinfo is removed by the same regex, so the served URL re-judged at the write door holds no credential part: a save of the served form is accepted and the carry-forward re-grafts the stored URL where the incoming equals the served one (pinned at the HTTP door for the oauth2 endpoints; an edit stores the edit). A stored array or dotted key the read withholds whole is absent from the served form, so a served-form save re-grafts it and the position check keeps it (the redactor withholds it again where it lands). The dedicated spec pin walks eight URL forms through both doors in both roots and asserts refused ⇔ rewritten.
• connector.zod.ts — holds. sharedFields memoises the shape per process; zod 4 fields are immutable and strictObject builds around the shape without touching its fields, which is what the gate's derived-clone bridge needs (pinned by identity). The refusal text names the position, the parts and the prescription; the only entry value it echoes is entry.name, a declared machine name. The twins' guidance names only keys the open defs never declared, so computeGuidanceRoutes charges the open defs nothing (6590686226 ① item 2 re-read and still true on this head).
• connector-credential-redaction.ts — holds. Items 7 and 8 (carried forward) run first, then item 1 and the object retryConfig keys (not carried forward), then the credential positions, then the URL walk over the served body; no position is double-counted (undeclaredNestedKeysOf pushes retryConfig only when it is not an object and not cleared, undeclaredRetryConfigKeysOf only when it is an object). The declared retry keys are read from the open RetryConfigSchema through objectShapeOf — the fail-closed branch (every retry key withheld and dropped if the shape were unreadable) is not reached: the pins serve strategy and maxAttempts as stored.
• protocol.zod.ts — a sentence; holds against droppedWithheldKeyNotices and the dogfood answer.
• The two D3 entries — consistent with the doors, the declared keys and the ruling.
• Tests — the spec, protocol and dogfood pins each carry a CONTROL beside the refusal; placeholders never appear in a refusal, a served body or a save answer (asserted on the raw text). The ablation in the body is the author's account and was not re-run; the pins it names are the ones read here and they would read the pre-ruling behaviour red on their face.

Findings: must-fix — none. Should-fix — S1 (the shared predicate's scope, with the maintainer, at rule level), S4 (a depth specimen beneath the unregistered root, low). Delivered since the PASS records — S3 (the {} pin and its controls), the lint-rule claim now true of the tree. Escalate — nothing; the one open question was ruled and the ruling is in the tree with its premise verified.

Implemented-by: claude/connector-metadata-hardening
Reviewed-by: session_01QSeKYn5CmmdShCJifm6WYj

VERDICT: PASS

[objectstack-fleet]

security#1 · os-justin · session_01QSeKYn5CmmdShCJifm6WYj

席位核对

ACCEPT · head 7d079947412d31180bc9427968bca044dc0b9554 · 2026-11-03T04:42Z

• Shape: 20 files, +1603/−205, under 3000; not governed (check-governed-merges.mjs --pr 29573). Clause-②: no (narrowing), Metadata-protocol: narrowed, two ADR-0087 D3 entries.
• Takeover: by the maintainer's order (comment 6593633433), which hands this seat the PR's follow-through, landing included.
• The round this head carries: a real merge of origin/main (merge commit 9a0d87754, no conflict, no rebase, no force-push), and the maintainer's ruling (comment 6593804783): an explicit retryConfig replaces the stored one whole. The premise was measured before the edit and holds: materialization parses with the open RetryConfigSchema, so no retry or dispatch behaviour reads an undeclared key. The prohibition was not triggered.
• Contract review: comment 6595605254 records Served-tier: CONTRACT_REVIEW_TIER, a Head-sha equal to this head, and VERDICT PASS with no must-fix. It is a full review at the new head (merge and ruling), by an isolated reviewer that verified the premise in the tree itself. The two earlier PASS records were on 577984fe.
• Check-runs at this head: 59 success, 10 skipped, 0 failed, all completed. The skips are opt-in harnesses, matrix placeholders and duplicates, judged by name; check-expected-skips.mjs NOT MEASURED (no node_modules in this container). mergeable_state is clean.
• Serial landing (§D, strictness ledger): no other auto-merge-armed open PR touches the strictness ledger at this moment.
• Accepted deviations: the omission control pinned to the code's actual behaviour (an omitted retryConfig is removed, as before), which is the ruling's own "keeps today's behaviour"; the widened advisories describe plus regenerated protocol.mdx; the D3 reason text corrected.
• Out of scope: the review's should-fix S1 (the shared URL predicate's scope) is held by the maintainer through the advisory channel, at rule level only here; S4 (a depth specimen for the deleted-baseline pin) and the strictness-ledger prose sentence are low follow-ups for the spec lane.
• Landing: ready, then auto-merge.