os verify mints a data key file in the key home: the verify harness composes the settings service and the engine with the default minting provider (the packages/verify half of #21471's family)

[objectstack-fleet]

This card is derived from the in-flight #21471. It carries that family's packages/verify member. #21471 keeps the packages/cli compositions, which PR #21497 closes.

Filing gate: ① a defect with a named position. reach: was measured at a public door by the #21471 dev (os-dev report on #21471, out-of-scope finding 1). Filed by the domain:cli seat, session_016GiHYRmLSNWTfbX9gVQkpz. Reader who acts: the domain:cli seat (packages/verify is in this lane) dispatches it as a derived sub-issue, with the parent's priority. ⚠️ Key custody: classes and positions only.

What happens (measured once)

The built CLI ran os verify --json in examples/app-todo in a development posture, with no env key and an empty key home. After the run, the key home held a key file.

Why (read from source at origin/main)

• packages/verify/src/harness.ts:498 composes new SettingsServicePlugin() with no cryptoProvider.
• packages/verify/src/harness.ts:694 binds engine.setCryptoProvider(new LocalCryptoProvider()).
• In a development posture with no key, both are default-posture providers that mint.
• packages/cli/src/commands/verify.ts calls bootStack, and BootOptions offers no crypto option.

Why it is not folded into PR #21497

#21471's fix hands one-shot commands a provider that reads an existing key or refuses. That shape would break os verify on a keyless host, because the harness seals and opens secret fields in its in-memory database. The fix here needs a different provider shape, for example an ephemeral in-process key, or a provider the harness takes as an option. It must never persist key material.

Direction (the parent's rule, carried): a one-shot command never creates key material in the key home. Pin: os verify in a development posture leaves an empty key home empty, with the default composition minting there as the positive control.

Dedupe

MCP search_issues, repo-scoped, open and closed: 「os verify mints key file in key home, verify harness default crypto provider LocalCryptoProvider SettingsServicePlugin」 gave 2 hits. One is this card; the other is its parent, #21471. No other card covers it.

Dedupe words: os verify mints dev key; verify harness default crypto provider key file; bootStack SettingsServicePlugin no cryptoProvider.

---

Generated by Claude Code

[objectstack-fleet]

Claim: PM loop round 1
Session: session_016GiHYRmLSNWTfbX9gVQkpz
Account: os-bill (the seat's linked user as get_me answers it; the card's assignee)
Branch: claude/issue-21499-verify-never-mints-key
Worktree: objectstack-issue-21499
Domain: domain:cli
Seat: domain:cli#1
File surface: packages/verify/src/harness.ts (the settings-service composition at ~:498 and the engine's provider at ~:694), BootOptions if a crypto option is the measured shape, packages/cli/src/commands/verify.ts only if it must pass that option, their tests and a pin, and .changeset/. (stop on breach; explain in the report)
Container & model: M, mode:subagent, model: default (opus) — dispatch-gates --tier --repo objectstack-ai/objectstack at aa4632235 for packages/verify paths: no path-derived mandate, the tier is the PM's per-card call; a key-custody fix that needs a different provider shape from its parent, so the default tier
Clause-②: no
Thread-read: none
Serial constraints cleared: no open PR touches packages/verify/ or packages/cli/src/commands/verify.ts (8 open PRs' file lists read 2026-10-03T00:36Z). Soft-serial behind PR #21497 (#21471, this seat, accepted): its enumeration pin refuses any packages/cli/src module naming SettingsServicePlugin or LocalCryptoProvider outside the one-shot helper and serve.ts. So this claim merges main after #21497 lands and runs that pin. In flight on this seat: #21454 (packages/runtime) and #21490 (packages/cloud-connection), both disjoint.

_{domain:cli seat · session_016GiHYRmLSNWTfbX9gVQkpz · 2026-10-03T00:36Z}

---

Generated by Claude Code

[objectstack-fleet]

os-dev-report

{
"issue": 21499,
"status": "done",
"branch": "claude/issue-21499-verify-never-mints-key",
"pr": "#21507",
"session": "session_016GiHYRmLSNWTfbX9gVQkpz (subagent of the dispatching PM session)",
"premise_still_valid": true,
"summary": "bootStack (packages/verify/src/harness.ts) now holds one LocalCryptoProvider over an explicit random key, created once per process and never persisted, and hands that same instance to new SettingsServicePlugin({ cryptoProvider }) and to engine.setCryptoProvider. It never reads OS_SECRET_KEY, OS_DEV_CRYPTO_KEY or the key file, and never writes. Secret fields and encrypted settings still seal and open on a keyless host, which is why the parent's read-or-refuse shape was not used. A1 confirmed at base 6f17d1d (harness.ts:498 and :694; cli verify.ts:195 and :219 call bootStack with no crypto option). A2 measured: no caller needs a key, so no public option; BootOptions and every export are unchanged, Clause-2 stays no, and packages/cli/src/commands/verify.ts is untouched. Public door, built CLI, examples/app-todo, os verify --json, development posture, empty key home: the base harness left dev-crypto-key in the key home plus 1 stderr line announcing the mint; this PR leaves the home empty with 0 such lines. stdout is byte-identical (764 B) and the exit is 1 on both, from a pre-existing tags fidelity gap (finding below). Cleanup done: worktree removed without --force, scratch ref deleted.",
"tests": "Pin packages/verify/src/harness.key-custody.test.ts. Every boot runs in a beforeAll; the cases only assert. It covers the control (default provider -> generated-file in this posture and home), an empty home through boot + secret field + encrypted setting + stop, a pre-existing key file never used, OS_SECRET_KEY never used, and a two-boot restart over one databaseFile. RED FIRST at 465c220 (test only, unfixed harness): 4 failed / 3 passed. The empty home got ['dev-crypto-key']; rows opened under the key-file key [true, true]; rows opened under OS_SECRET_KEY [true, true]; the restart home got ['dev-crypto-key']; the control stayed green. GREEN at 7c3a184: 7 passed. ABLATION of per-process to per-boot key via scripts/ablation-replace.mjs: anchor x1 -> x0, blob 6edabfac1b8c -> 4348b6b36bb8; the restart hook fails 'Unsupported state or unable to authenticate data', 6 passed / 1 skipped, file red; restored blob == HEAD 6edabfac1b8c and git diff HEAD empty. The pin imports ./harness.js from source, so no dist leg. DOOR BEFORE LEG: harness restored from base 6f17d1d (tree only, blob 01fd2633 == base blob) with trap; @objectstack/verify rebuilt; ablation-dist-preflight --absent passed; then restored (blob == HEAD, git diff HEAD empty), rebuilt, preflight default mode: marker present in 2 built files, tree clean. AT HEAD e8a0914: pnpm --filter @objectstack/verify exec vitest run -> 17 files, 127 tests passed. pnpm --filter @objectstack/verify typecheck -> exit 0 (tsc + check:test-typecheck); tsc --listFiles -p tsconfig.test.json holds the new test, 17 of 17 test files. Integration tier of packages/cli not run: no cli file touched, declared to CI.",
"gates": "At e8a0914: node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack derived 62; all 62 run. --ran reconciliation: '62 derived, 62 run, 0 NOT-MEASURED, 0 UNRUN' (exit codes recorded, a derived zero). check:dual-build-cjs-loads first exited 3 (PREREQUISITE NOT MET, 9 packages without dist); after a cache-replay build (71/71 cached) it exited 0. pnpm lint over the whole repository, unnarrowed: LINT_EXIT=0. The derivation flagged its tree as 3 commits behind origin/main (stale file: scripts/doc-authoring-prose-id.baseline.json); not merged, see deviations. CI on #21507: in_progress at report time.",
"line_budget": "n/a",
"files_changed": [
".changeset/21499-verify-never-mints-key.md",
"packages/verify/src/harness.key-custody.test.ts",
"packages/verify/src/harness.ts"
],
"deviations": [
"origin/main not merged: PR #21497 was open and unmerged (draft false, merged false) at three reads, the last right before pr_create. This diff touches no packages/cli file, so the one-shot-settings enumeration pin's population is unchanged. The seat merges main and re-runs that pin at landing, per zone 2 A3.",
"PR labels: none written. The dispatch named no specific label, and skip-changeset fails its criterion (@objectstack/verify publishes the change). So the one label-write carried only the PR assignee os-bill. Read-back: assignees [os-bill], labels [size/m], the latter from the size labeler and not this write.",
"PR body footer: the AGENTS.md session-URL form, not the harness reminder's form (role file precedence)."
],
"mcp_calls": "0 (card, comments and PR reads went through REST gh api GET; no MCP tool used)",
"api_writes": "3 REST writes, each as one fleet-write relay stroke (POST /repos/objectstack-ai/objectstack/dispatches). (1) pr_create -> POST /repos/objectstack-ai/objectstack/pulls, #21507 draft; body 5451 B sent, 5451 stored, identical. (2) label-write assign -> POST /repos//issues/21507/assignees [os-bill]. (3) post-stamped os-dev-report -> POST /repos//issues/21499/comments. Not REST: 4 git pushes of the branch.",
"open_questions": [],
"out_of_scope_findings": [
"class: a · reach: public door, os verify --json in examples/app-todo at base 6f17d1d (same bytes on this branch) exits 1 with hardFailures 1. The fidelity gap is todo_task.tags: wrote 'important', read ['important']. Position: packages/verify/src/derive.ts:88, where case 'select' writes options[0] as a scalar with kind 'equal' and ignores multiple: true; case 'multiselect' writes [opt] with kind 'set'. So a select declared multiple: true always reads back as a false fidelity gap, and the shipped example fails os verify. · dedupe words: os verify fidelity gap multiple select; derive scalar write select multiple true; app-todo verify exit 1 tags; verify derive select multiple set compare",
"carrier: none (承接者:无) · noted in PR #21507 Acceptance notes, not filed: every bootStack under vitest also stopped minting into the runner's key home (harness forces a development posture); observation only, no separate defect"
]
}

---

Generated by Claude Code

[objectstack-fleet]

ACCEPT — PR #21507 at e8a091457c

_{domain:cli seat · session_016GiHYRmLSNWTfbX9gVQkpz · review of record, read on GitHub 2026-10-03T01:26Z · ⛔ classes and positions only}

Shape. Draft, base main, first line Fixes #21499; that is the only closing keyword next to a card number. Clause-②: no is line-initial and bare. Not governed. 3 files, +411 / −5.

Against the card's rule ("never persists key material, never reads a real persisted key it does not need"), read from the diff of packages/verify/src/harness.ts:

• harnessCryptoProvider() builds one LocalCryptoProvider({ key: randomBytes(32) }) per process.
• That same instance goes to new SettingsServicePlugin({ cryptoProvider }) and to engine.setCryptoProvider(cryptoProvider).
• No env key and no key file is read, and nothing is written.
• BootOptions and every export are unchanged, so A2's public-surface question answers no. packages/cli is untouched.

Pin and reverse verification. packages/verify/src/harness.key-custody.test.ts boots in beforeAll, and its cases only assert.

• Committed red first (465c22036a), 4 failed / 3 passed:
  • the empty home got a key file;
  • the rows opened under the key-file key;
  • the rows opened under OS_SECRET_KEY;
  • the restart home got a key file;
  • the minting control stayed green.
• Green at the fix: 7 passed.
• Ablation, per-process key → per-boot key: the restart case fails to authenticate. Restored to the HEAD blob.
• The public door: os verify --json in examples/app-todo leaves the key home empty, where the base minted a key file. stdout is byte-identical.

Changeset (@objectstack/verify, patch). Each sentence was checked against the diff:

• "One LocalCryptoProvider over a random key held in this process's memory only" matches harnessCryptoProvider;
• "The settings service and the engine get the same instance" matches the two call sites;
• "One key per process, not per boot" matches the module-scoped ??=;
• "BootOptions … unchanged" matches the diff.

Gates. The dev derived 62 families with no paths and ran all 62, all exit 0. pnpm lint ran over the whole repository, unnarrowed, and exited 0. CI at review time: 20 success, 3 skipped, 8 in progress. The landing waits for every check to be green.

Soft serial behind PR #21497. That PR is still queued. This diff touches no packages/cli file, so the one-shot enumeration pin's population is unchanged, and the merge queue runs it on the merged base either way.

Out of scope:

• (a), measured at the public door: os verify --json on the shipped examples/app-todo exits 1 with a false fidelity gap on todo_task.tags, a select declared multiple: true. packages/verify/src/derive.ts:88 writes a scalar with kind: 'equal' for select and ignores multiple. → filed as [finding] os verify fails the shipped examples/app-todo: a select declared multiple: true is written as a scalar and compared as equal, so its array read-back is reported as a fidelity gap #21509 for triage's first grade.
• Every bootStack under vitest also stops minting into the runner's key home → Acceptance notes (carrier: none).

---

Generated by Claude Code

[objectstack-fleet]

Landed: PR #21507 → 2df621af39

_{domain:cli seat · session_016GiHYRmLSNWTfbX9gVQkpz · read 2026-10-03T02:15Z}

• Merged 2026-10-03T02:14Z through the merge queue (added_to_merge_queue 01:47:47Z) at head e8a091457c, the head the ACCEPT 5964095775 read.
• Shape: git rev-list --parents -n 1 2df621af39 gives 2 fields, so it is a single-parent squash. The commit is an ancestor of origin/main.
• Content reading on origin/main:
  • packages/verify/src/harness.ts carries harnessCryptoProvider, the one in-process provider every bootStack hands to the settings service and the engine;
  • the pin packages/verify/src/harness.key-custody.test.ts is present.
• The card closed completed via Fixes #21499, and pm:dispatched is stripped in this act.
• Not closed here: the select-multiple fidelity gap this dev measured is [finding] os verify fails the shipped examples/app-todo: a select declared multiple: true is written as a scalar and compared as equal, so its array read-back is reported as a fidelity gap #21509, which triage has graded p2 and queued for this lane.

---

Generated by Claude Code