spec+service-settings: build ADR-0128 D1–D3, a producer-discriminated, delimiter-safe AAD on CryptoContext, with a versioned handle and an at-rest rewrap

[objectstack-fleet]

Filed by the domain:spec seat 1 (session_01UtnxvdiN376GF3sgXwAw4d, seat post #6017) as an execution parameter of the maintainer's ruling A on #21263 (5945612493, batch #267 item 1, 「其他同意」). The ruling reads: "D1: the claiming seat files one card for ADR-0128 D1, scoped as ADR-0128 §2 and §4 state it (priority from triage). It is not this PR." ⛔ Not a claim. ⛔ Not graded here: priority and lane are triage's.

⚠️ Security family: this card names classes and positions only.

Why now

ADR-0128 (Accepted 2026-09-07) recorded D1–D3 as a direction and deferred the work (§4), naming four triggers that fund it. One of them is met: "ICryptoProvider is opened for another breaking change". PR #21292 (#21263) adds the required keyedDigest member. The ruling lands that break alone, because the organisation's repositories hold zero out-of-repo implementers (census 5945420994), so bundling would save a second break for no measured population. The deferral is therefore over, and this card schedules the work. A separate Tier H card carries ADR-0128's dated note.

Scope (ADR-0128 §2 and §4, as written)

• D1: CryptoContext (packages/spec/src/contracts/crypto-provider.ts) carries a required scope discriminant from a closed set, with one member per producer: settings, object secret field and datasource credential. Every provider that binds AAD folds it in.
• D2: the AAD encoding is delimiter-safe: length-prefixed, escaped or canonical structured. ⛔ No unescaped join.
• D3: the fix is at the producer of the AAD (ICryptoProvider and LocalCryptoProvider in packages/services/service-settings). ⛔ No consumer-side fallback that tries another vocabulary's AAD.
• §4.2, the expensive half: an at-rest rewrap of every existing ciphertext. It reads under the old AAD and writes under the new one, so the handle needs a version that says which derivation sealed it. The rewrap must be resumable, safe against a live deployment, and fail closed on any row it cannot read. rotateKey is the seam §4 names.
• The producers to thread the discriminant through (ADR-0128's Consumers line): the settings service, the engine's secret-field path (@objectstack/objectql) and the datasource secret binder (@objectstack/service-datasource). Out-of-repo, every cloud host constructs LocalCryptoProvider through a link: dependency (census 5945420994), so a framework change reaches them with the implementation.

What triage decides

• Priority, and whether this splits into stages, for example contract + provider + versioned handle first and the rewrap second. ADR-0128 §4's ordering note says both derivations must coexist during the migration.
• Lanes: the work spans domain:spec (the contract) and domain:services (the provider and the producers).
• ⛔ This card does not reopen the direction (ADR-0128 D1–D4 stand). It only schedules them.

Dedupe

The 100 most recently updated open issues and PRs were listed over REST (repo-scoped) and grepped for ADR-0128, producer-discriminated and rewrap. The hits are seat post #6017 and PR #21292, the ruling's PR, and neither schedules D1. #12599 is the closed source card. #21263 is the ruling's anchor.

Dedupe words: ADR-0128 D1 producer-discriminated AAD · CryptoContext scope discriminant · sys_secret rewrap versioned handle

[objectstack-fleet]

Triage: first grade — enhancement · security · priority:p3 · domain:spec · area:access · pm:queue. ADR-0128 D1–D3 as written, scheduled by the maintainer's ruling A on #21263

Triage seat (objectstack-wide, seat post #6015) · session_01AavokzJ5DndAwitDXvKy4U · 2026-10-02T04:54Z. ⛔ Not a claim, ⛔ not a dispatch.

⛔ Classes and positions only.

Why p3. ADR-0128 §1.4 measured the confusion as constructible, with zero live instances. The census (5945420994) measured zero out-of-repo implementers. So this is hardening with no exposed population. It is scheduled because the maintainer ruled it a card of its own (5945612493), not because it is urgent.

Routing. The contract (packages/spec/src/contracts/**, Clause-②: yes) is domain:spec. service-settings is a declared cross-lane surface, as on #21263.

Direction: ADR-0128 §2 and §4 as written: D1 (a required, closed scope discriminant), D2 (a delimiter-safe encoding), D3 (a producer-side fix, ⛔ no consumer fallback), with a versioned handle and the at-rest rewrap migration. The card's scope is accepted.

Serial: after PR #21292 (#21263) lands, because both edit crypto-provider.ts.

---

Generated by Claude Code

[objectstack-fleet]

Claim: PM loop round 1 (stage 1 of a staged card: ADR-0128 D1–D3 and the versioned handle)
Session: session_01YDt3PzwfrkuFzUBF89WPmM
Account: os-tesla (the seat's linked user as GET /user answers it; the card's assignee)
Branch: claude/issue-21326-aad-scope-discriminant
Worktree: objectstack-issue-21326
Domain: domain:spec
Seat: domain:spec#2
File surface (stage 1, at 8b123c0aec):

• packages/spec/src/contracts/crypto-provider.ts (CryptoContext, ICryptoProvider): D1, a required scope discriminant from a closed set, one member per producer.
• packages/services/service-settings/src/ (local-crypto-provider.ts, in-memory-crypto-provider.ts, crypto-adapter.ts): D2, a delimiter-safe AAD encoding; D3, the fix at the producer; and a handle version that names the derivation that sealed it.
• The producers that thread the discriminant: the settings service, the engine's secret-field path (@objectstack/objectql), and service-datasource's datasource-secret-binder.ts.
• Their tests and pins, the regenerated spec artefacts, and one changeset per published package.
• ⛔ No cloud edit (cloud hosts take the implementation through their link: dependency).
• Stop on breach and explain in the report.

Staging (the seat's sequencing, which the card's "What triage decides" leaves open; triage 5945843248 accepted the scope without splitting it):

• Stage 1 (this claim): D1–D3 and the versioned handle. New seals use the new derivation. Reading an existing handle dispatches on its recorded version, so the derivation that sealed it is the one that opens it. This is ⛔ not a consumer-side fallback that tries another vocabulary (D3): the version decides, and nothing is tried.
• Stage 2 (next claim): the at-rest rewrap through rotateKey (§4.2). It is resumable, safe against a live deployment, and fails closed on any row it cannot read.
• If the dev measures that stage 1 cannot ship without the rewrap, it returns here before building.

Container & model: L, mode:subagent, model: opus (dispatch-gates --tier at 8b123c0aec: no path-derived mandate; floor sonnet · default opus · ceiling CONTRACT_REVIEW_TIER). This is a security-family contract change, and the at-tier contract review runs as a separate isolated subagent after the PR opens.
Clause-②: yes
Thread-read: 5945843248
Serial constraints cleared:

• Triage's serial condition holds: PR feat(spec): ICryptoProvider gains a required keyedDigest member; LocalCryptoProvider implements it #21292 (spec(contracts): ICryptoProvider gains a required keyed digest — the server-held-key HMAC that #21207's served content hash is ruled onto (option B) #21263) landed as 222ecc27f9.
• At 2026-10-02T16:06Z, no open PR touches crypto-provider.ts, service-settings, service-datasource's secret binder or objectql's secret path. The one hit, PR chore: version packages #21352, is the Version Packages PR, through changeset names.
• The dispatch waits for verify-lock depth below 2.

Seat terms: p3, under the maintainer's 「p3 的卡也可以派了」 (5952442849). This PR is Part of #21326 (stage 1); stage 2 closes the card.

⛔ Security family: comments on this card name classes and positions only.

---

Generated by Claude Code

[objectstack-fleet]

os-dev-report
{
"issue": 21326,
"status": "done",
"branch": "claude/issue-21326-aad-scope-discriminant",
"pr": "#21453",
"session": "session_01YDt3PzwfrkuFzUBF89WPmM — subagent run, so this is the parent's id (the Claude-Session trailer on every commit)",
"premise_still_valid": true,
"summary": "RESUMED RUN: the container restarted mid-flight, so this run resumed a lost one. Found done and re-verified (not assumed): 4182cad, 73c1a93 and ace768e (13 files, +651/-104). They carry the required CryptoContext.scope from the closed CRYPTO_CONTEXT_SCOPES (settings, object_secret_field, datasource_credential), LocalCryptoProvider's version-2 AAD, the version-1 read-only path, the threading through all three producers, and the pins, including the D2 collision vector. Both pinned ciphertext vectors were re-opened independently with node:crypto and a hand-built AAD. Finished in this run: origin/main merged (c2c21f3); api-surface/ and export-origins/ regenerated for the two new exports; ADR-0128 anchors added for the contract and the provider; the changeset (spec and service-settings minor with the BREAKING banner, objectql and service-datasource patch, ADR-0087 not-required (no-migration-prescription), as in PR #21292); a label correction in the contract docblock (the versioned handle is ADR-0128 section 4's, and no-second-try is D3's); and every gate and both ablation legs. Draft PR #21453 is 'Part of #21326', with stage 2 (the at-rest re-wrap) left on the card.",
"tests": "All at HEAD 0b398e8 except where named, every build and test under scripts/pm/os-verify-lock.sh. BUILD: turbo build over the closures of service-settings, service-datasource and objectql: 'Tasks: 20 successful, 20 total' (VERDICT command-exit 0). spec test --project local: 'Test Files 600 passed (600) / Tests 17684 passed | 1 todo'. service-settings: '33 passed (33) / 603 passed'. service-datasource: '35 passed (35) / 709 passed'. objectql --project local in 3 shards: 2353 passed + 1 failed, then 2287 passed, then 2739 passed. The one failure: system-write-organization.test.ts 'publishes both names from the package BARREL' timed out at 5000 ms (it dynamically imports the whole barrel under load). Run alone it timed out again at 5054 ms, and with --testTimeout=120000 it passed at 3260 ms. This diff adds no objectql import. secret-fields.test.ts passed on its own, including 'seals and dereferences under its own scope, object_secret_field (ADR-0128 D1)'. cli integration tier, the two touched files: '2 passed (2) / 46 passed'. (A first try with --project unit selected nothing, exit 1, NOT a measurement; both files are integration-tier.) TYPECHECK exit 0: spec (check:test-typecheck OK), service-settings, service-datasource, objectql (check:test-typecheck OK) and cli (full tsc --noEmit plus check:test-typecheck OK). --listFiles: service-settings' program includes 33 test files and service-datasource's 35. ABLATION: see the ablation_legs field.",
"gates": {
"derived": "node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands at 0b398e8: 106 commands, each exit code written to disk before it was read",
"reconcile": "dispatch-gates --ran final-ran.list, exit 0: '✓ dispatch-gates --ran: 106 derived famil(ies) accounted for — 106 run, 0 NOT-MEASURED (a DERIVED zero — all 106 recorded an exit code and none of them is 3)'",
"first_refusals_then_rerun": [
"node scripts/check-engine-split-ratio.mjs --days 90: exit 2 (refused on a shallow clone whose window was not covered), then exit 0 after git fetch --shallow-since=2026-06-27",
"pnpm check:dual-build-cjs-loads: exit 3 (whole-workspace dist absent), then exit 0",
"pnpm check:i18n: exit 3, then exit 0",
"pnpm check:i18n-coverage: exit 3, then exit 0",
"pnpm check:i18n-walk-parity: exit 3, then exit 0 (the four were re-run once check:type-check-debt's own whole-workspace build had produced the dists)"
],
"named_in_dispatch": [
"pnpm --filter @objectstack/spec build (inside the closure build): exit 0",
"pnpm --filter @objectstack/spec check:generated: exit 0 — '✓ All 15 generated artifacts are up to date' (it first named exactly api-surface/ and export-origins/ stale, +2 lines each; regenerated in 0b398e8)",
"spec test / typecheck: exit 0 / exit 0",
"service-settings, service-datasource and objectql test and typecheck: all exit 0, except the objectql shard-1 load timeout above",
"node scripts/check-adr-0087-registration.mjs --base origin/main: exit 0 — '✓ check-adr-0087-registration: 1 declared-breaking changeset(s), each carrying an ADR-0087 disposition.'",
"node scripts/check-changeset-no-major.mjs --base origin/main: exit 0 — '✓ This diff introduces no major bump.'; level axis driven offline with --event (PR payload body 'Clause-②: yes'): exit 0 — '✓ LEVEL AXIS: this PR declares clause-② yes, and it grades a package whose packages/**/src/** it moves at minor or above'",
"node scripts/check-empty-changeset.mjs --base origin/main: exit 0",
"pnpm check:changeset-gate-self-tests: exit 0",
"pnpm check:doc-authoring: exit 0 — '✓ doc authoring guard: sibling-package prose ids hold the baseline — 204 pinned site(s) across 62 file(s) ...'",
"pnpm check:nul-bytes: exit 0 — 'check-nul-bytes: OK (scanned 9773 text file(s) ... no raw ASCII control bytes)'; a manual control-byte scan of the 18 changed files found 0 lines"
],
"selected_verdicts": [
"pnpm --filter @objectstack/spec run check:api-surface: '@objectstack/spec public API surface + factory signatures unchanged ✓'",
"pnpm check:adr-anchors: 'check-adr-anchors: OK (59 anchored file(s), every governing ADR still referenced ...)'",
"pnpm check:engine-double-contract: 'OK — 921 pinned, 129 in the DEBT ledger, 3 exempt.'",
"pnpm check:type-check-debt: 'check-type-check-coverage --re-measure: OK — 1 ledger entr(ies) re-measured in 1008.8s, 26 raw tsc error(s) total, none above its recorded number.'",
"pnpm check:test-source-alias: 'check-test-source-alias OK — 73 packages with tests scanned ...'",
"pnpm check:cross-package-test-inputs: 'OK: 30 package(s) read outside themselves, all declared ...'"
],
"roster_families_also_run": "Twelve extra commands, all exit 0: check:generated, check-changeset-fixed, check-published-list-mirrors, spec check:meta-url-spelling, spec check:spec-changes, check:authz-resolver, check:console-injection, check:error-code-casing, check:filter-alias-parity, check:i18n-stale-fill, check:published-readme-exports and check-dts-references --self-test",
"ci": "PR head 0b398e8: 32 check runs, 9 success, 3 skipped, 20 in_progress (read once; not waited on)"
},
"line_budget": "829 changed lines (+725 / -104) over 18 files, measured with git diff --shortstat from merge base c2c21f3. The human-merge threshold is 5000. The resumed branch held 651 / 104 of them; this run added 74 (changeset 54, anchors 14, generated 4, contract docblock 2 net). No skills/** or governed surface is touched, so no skill-line reading applies.",
"files_changed": [
".changeset/21326-crypto-context-scope-discriminant.md (new)",
"packages/spec/src/contracts/crypto-provider.ts",
"packages/spec/api-surface/contracts.json (generated)",
"packages/spec/export-origins/contracts.json (generated)",
"packages/services/service-settings/src/local-crypto-provider.ts",
"packages/services/service-settings/src/local-crypto-provider.test.ts",
"packages/services/service-settings/src/settings-service.ts",
"packages/services/service-settings/src/settings-service.test.ts",
"packages/services/service-settings/src/settings-routes.test.ts",
"packages/services/service-settings/src/sys-secret-orphan-report.test.ts",
"packages/services/service-datasource/src/datasource-secret-binder.ts",
"packages/services/service-datasource/src/tests/datasource-secret-binder.test.ts",
"packages/objectql/src/engine.ts",
"packages/objectql/src/secret-fields.test.ts",
"packages/cli/src/utils/secret-reference-union.test.ts",
"packages/cli/src/utils/sys-secret-orphan-sweep.test.ts",
"scripts/adr-anchors/packages__spec__src__contracts__crypto-provider.ts.json (new)",
"scripts/adr-anchors/packages__services__service-settings__src__local-crypto-provider.ts.json (new)"
],
"producer_census": "Measured at c2c21f3 over every non-test encrypt, decrypt and rotateKey call site in *.ts, *.mts, *.js and *.mjs. Exactly three producers: (1) SettingsService, settings-service.ts, the seal in set() and the open in materialiseRow(), scope settings. (2) The ObjectQL engine's secret-field path, engine.ts, the seal in encryptSecretFields and the open in resolveSecret() (which resolveSecretField() calls), scope object_secret_field. (3) The datasource secret binder, datasource-secret-binder.ts, bind() and resolve(), scope datasource_credential. NO fourth producer. The SSO client secret, the webhook secret and headers, and the flow credentials all reach the provider through the engine's resolveSecretField(), so they are producer 2. rotateKey has no in-tree caller. crypto-adapter.ts builds no AAD: its CryptoAdapter is a separate interface over {namespace, key} for inline sys_setting.value_enc, and its only in-tree implementation is the base64 NoopCryptoAdapter. InMemoryCryptoProvider is a value alias of LocalCryptoProvider.",
"handle_version_design": "The derivation is recorded IN THE CIPHERTEXT, which the provider owns, not in CryptoHandle.version. Every new seal is 'v2:' + base64(iv||tag||ct). Its AAD is 0xFF || 'objectstack/crypto-context-aad/v2' || lp(scope) || lp(namespace) || lp(key), where lp is a 4-byte big-endian UTF-8 length followed by the bytes. decrypt and rotateKey dispatch on the marker and try exactly one derivation: no ':' is version 1 (UTF-8 'namespace|key', read-only, never seals); 'v2:' is version 2; any other marker throws UnknownCiphertextVersionError (fail closed). A missing or non-member scope throws CryptoContextScopeError on every entry point, including a version-1 open. WHY AN EXISTING HANDLE IS UNAMBIGUOUSLY VERSION 1, with no row read: (a) CryptoHandle.version is already a rotation counter (kmsKeyId is 'local:v' plus it), so a rotated pre-versioning handle already reads 2 or more, and the field cannot carry the derivation. (b) sys_secret.ciphertext and CryptoHandle.ciphertext are documented as provider-defined and round-tripped verbatim. (c) Every release's seal emitted bare standard base64 (Buffer#toString('base64'), alphabet A-Z a-z 0-9 + / =, no ':'). This was measured over the provider's full history under both file names via the REST commit list: 10 commits from 4f6bae0 to 222ecc2, each version's seal lines read on both the node:crypto and WebContainer paths. (d) 0xFF never occurs in UTF-8, so the version-1 and version-2 AAD spaces are disjoint, and a marker swap never authenticates (pinned both ways). Also verified: a pre-versioning release handed a v2 ciphertext refuses it (GCM auth failure), so a rollback fails closed. The changeset states this.",
"ablation_legs": "Expected direction, recorded before running: leg 1 RED on the D2 collision vector, leg 2 GREEN. Both legs ran from the committed state (HEAD 0b398e8, provider blob 77423577310b), inside the verify lock, via scripts/ablation-replace.mjs in WRAP mode. MUTATION: aadForVersion2's length-prefixed Buffer.concat (7-line anchor) was replaced by Buffer.from([requireScope(ctx), ctx.namespace, ctx.key].join('|'), 'utf8'). That is a naive join with the scope kept, so only D2 is ablated. On-disk proof: 'anchor x1 → x0', 'replace x0 → x1', 'blob 77423577310b → 0a2fa7a2a5d6'. LEG 1: exit 1, 'Tests 4 failed | 31 passed (35)'. The D2 test failed at line 281, 'expected true to be false' on aadForVersion2(left).equals(aadForVersion2(right)). The pinned v2 vector, the AAD byte pin and the unknown-marker test's positive control failed with it. The D1 scope matrix stayed green, as expected while the scope is in the join. RESTORE: tool output 'ok restored: blob == HEAD (77423577310b) and git diff HEAD is empty'. Independent check: POST_BLOB equals HEAD_BLOB, git diff HEAD 0 bytes, anchor line count 1, naive-join count 0. LEG 2: exit 0, 'Tests 35 passed (35)'. NO BUILD LEG: the test imports the subject as './local-crypto-provider.js' (relative source), so no dist/ is on its resolution path.",
"semver": "@objectstack/spec minor and @objectstack/service-settings minor, with the BREAKING banner; @objectstack/objectql and @objectstack/service-datasource patch (their public surface does not move). This is the PR #21292 precedent's level and header. The fixed group versions in lockstep. Judging lines: check-changeset-no-major '✓ This diff introduces no major bump.' and the offline level axis '✓ LEVEL AXIS: this PR declares clause-② yes ... at minor or above'. check-adr-0087-registration '✓ ... 1 declared-breaking changeset(s), each carrying an ADR-0087 disposition.' with not-required (no-migration-prescription). Clause-② 'yes' is on the PR body's second line and in the changeset. No gate refused.",
"deviations": [
"Resume: the predecessor's commits were kept, not redone. Every item was re-verified, and nothing measured before the restart is cited.",
"The first phase-1 runner was killed while it held the lock and was building, to add a retry on lock exit 99. The build re-ran from scratch, and the tree was clean afterwards.",
"The first phase-2 gate runner was stopped after 2 commands to regenerate the spec artifacts first. All 106 gates then ran at 0b398e8.",
"git fetch --shallow-since=2026-06-27 origin main deepened the shared object store, as check-engine-split-ratio prescribes. It also advanced the shared origin/main to 535d1d2. The 4 new main commits touch no file or crypto call site on this branch (checked by diff), so the branch was not re-merged.",
"Labels: the dispatch named no label by name, so the label set written is empty and the one label-write call made only the assign. The path labeler added documentation, size/l, tests and tooling on its own.",
"Focused cli tsc via a scratch tsconfig: it inherited the package include and compiled all of cli (95 errors, all missing-dist TS2307/TS2882/TS7016 in other files, 0 in the touched files). It was superseded by the full cli typecheck, which passed once the whole-workspace dist existed."
],
"mcp_calls": "0",
"api_writes": "3 relay strokes, each one POST /repos/objectstack-ai/objectstack/dispatches (HTTP 204) carrying one write that the fleet-write workflow executes as objectstack-fleet[bot]: (1) pr_create, POST /repos/objectstack-ai/objectstack/pulls, run 37049417309, #21453, 12528 bytes sent and stored identically. (2) assign, POST /repos//issues/21453/assignees (os-tesla), run 37049516941, read back. (3) this os-dev-report comment, POST /repos//issues/21326/comments, via post-stamped.mjs. Not REST: 3 git pushes in this run (a2dcfd2, 629f48a, 0b398e8). Reads only: card, comments, rate_limit, commit history and file contents at 10 historical shas, PR read-back and check-runs. An org-wide search/code read was refused 403 (repository-bound session).",
"open_questions": [],
"out_of_scope_findings": [
"carrier: stage 2 of #21326 (the next claim) · version-1 ciphertext keeps opening with the older (namespace, key) binding until it is re-wrapped, and nothing yet retires version-1 opening after the re-wrap · noted, not filed",
"carrier: the at-tier contract review of PR #21453 · CryptoContextScopeError and UnknownCiphertextVersionError carry no ADR-0112 ledger code. They are in-process only: the settings read path logs and returns null, the binder returns undefined, and the engine throws to privileged in-process callers. The precedent is KeyedDigestKeyUnavailableError. ADR-0128's Builds-on line names ADR-0112 for implementation refusals · noted, not filed",
"carrier: 承接者:无 · objectql src/system-write-organization.test.ts 'publishes both names from the package BARREL' dynamic-imports the whole barrel inside its 5 s clocked window, so it timed out twice on this shared box (shard 1/3, and alone at 5054 ms) and passed at 3260 ms with a longer timeout. AGENTS.md: 'Clocked windows measure behaviour, never loading' · noted, not filed",
"carrier: 承接者:无 · service-settings' CryptoAdapter (inline sys_setting.value_enc) takes {namespace, key} with no scope. It is a separate interface from CryptoContext, its vocabulary is settings-only, and no in-tree implementation binds AAD · noted, not filed",
"carrier: 承接者:无 · NOT MEASURED: out-of-repo direct callers of encrypt, decrypt and rotateKey (org-wide code search answered 403 in this repository-bound session). Census 5945420994 measured zero out-of-repo implementers · noted, not filed"
]
}

[objectstack-fleet]

ACCEPT — PR #21453 @ 0b398e88 (stage 1 of #21326)

domain:spec seat 2 (session_01YDt3PzwfrkuFzUBF89WPmM), holder of claim 5956307339 · 2026-10-02T19:12Z

• Shape (read on GitHub): a draft against main. The first line is Part of #21326, and Clause-②: yes sits at a line start, with no closing keyword. 18 files, all inside the claim's stage-1 surface: the CryptoContext contract, the service-settings provider, the three producers, their pins, the regenerated api-surface/ and export-origins/ rows, two ADR-anchor records and one changeset.
• Contract review: at-tier PASS 5959407278 on this exact head.
• CI on 0b398e88: 32 success and 3 skipped by design: Build Docs path-filtered, Console Pin Gate with no .objectui-sha change, and the opt-in packed-tarball smoke.
• Governed surface: check-governed-merges --pr 21453 reads NOT governed. 829 changed lines, under the human-merge threshold.
• Against triage (5945843248) and the claim's staging:
  • D1: a required scope discriminant from a closed set, one member per producer. Every provider entry point refuses a missing or unknown scope, the read-only path included.
  • D2: a delimiter-safe encoding, pinned by a vector test. The ablation of the encoding turned that pin red, and restoring it turned it green.
  • D3: the fix sits at the producer. Reading an existing handle dispatches on the version recorded in it, so nothing is tried and there is no consumer-side fallback. An unknown version fails closed.
  • The producer census is exactly three producers, each with its own scope, and no fourth.
  • Release: minor for @objectstack/spec and @objectstack/service-settings with the BREAKING banner, and patch for @objectstack/objectql and @objectstack/service-datasource. This is the PR feat(spec): ICryptoProvider gains a required keyedDigest member; LocalCryptoProvider implements it #21292 precedent's level and header; the ADR-0087 disposition is not-required (no-migration-prescription).
• Answered in the review: the two new error classes carry no ADR-0112 ledger code. That is right for in-process-only refusals. A ledger row is owed if stage 2 gives them an operator-facing surface.

Stage 2 (the at-rest rewrap) stays on this card. The review record 5959407278 lists what it must carry. Above all, the rewrap must attribute each stored row's scope from the row's holder. A row with no reachable holder is not resealed under a guessed scope (D3).

Out-of-scope findings:

• Out-of-repo direct callers of the provider's entry points were not measured (the org-wide code read answers 403 in this session). They fail loud: at compile time on the missing member, and at run time on the scope refusal. → noted, not filed: for whoever holds the release that ships this changeset, a check of the sister repos' call sites.
• An @objectstack/objectql test outside this diff imports the whole barrel inside a clocked window and timed out under load on the dev's shared box. → handled by this seat separately.

Next: ready, auto-merge, the queue.

---

Generated by Claude Code

[objectstack-fleet]

Landed: PR #21453 → 57cc695062 (stage 1 of #21326)

domain:spec seat 2 (session_01YDt3PzwfrkuFzUBF89WPmM), holder of claim 5956307339 · 2026-10-02T19:46Z

• Landed: PR feat(spec,service-settings): CryptoContext gains a required scope discriminant, bound into a delimiter-safe, versioned AAD (ADR-0128 D1-D3, stage 1) #21453 went through the merge queue as 57cc695062, with one parent (9b7a0ef3fa). It is Part of #21326, so this card stays open.
• Blob check against the ACCEPTed head 0b398e88 (ACCEPT 5959625381, at-tier PASS 5959407278): 18 of 18 files are blob-equal.
• Delivered (ADR-0128 D1–D3 and the versioned handle):
  • CryptoContext carries a required scope discriminant from a closed set, one member per producer, and every provider entry point refuses a missing or unknown scope.
  • New seals bind the scope into a delimiter-safe encoding, pinned by a vector test.
  • The fix sits at the producer. An existing handle opens by the version recorded in it, with nothing tried and no consumer-side fallback. An unknown version fails closed.
  • All three producers thread their own scope.
  • Release: minor for @objectstack/spec and @objectstack/service-settings with the BREAKING banner, and patch for @objectstack/objectql and @objectstack/service-datasource.
• Stage 2 is the rest of this card: the at-rest rewrap through rotateKey. It must be resumable, safe against a live deployment, and fail closed on any row it cannot read. Record 5959407278 lists what it must carry. Above all, it must attribute each stored row's scope from the row's holder, and leave a row with no reachable holder as it is, never resealed under a guessed scope.
• Filed from this stage: finding(objectql): a system-write-organization.test.ts case loads the whole package barrel inside vitest's default 5 s window, and timed out twice under load #21457, an @objectstack/objectql test outside this diff that loads the package barrel inside a 5 s window.
• State: pm:dispatched → pm:queue, and the assignee is removed in this act. This seat has no free slot for stage 2 now, so the card goes back to the queue for whichever domain:spec seat claims it next. Domain, area, type and security labels stay.

⛔ Security family: comments on this card name classes and positions only.

Edited for wording only: the stage-2 sentence first said "unsealed", which could read as decrypted. It means left as it is.

---

Generated by Claude Code