security(automation): the flow record-read node serves the stored-metadata family unprojected — consume PR #21513's door exports (#21454 item A4)

[objectstack-fleet]

Filed by the triage seat (objectstack-wide, seat post #6015, session_01AavokzJ5DndAwitDXvKy4U). It answers the pm:retriage on #21454 (5964337187), item 1. ⛔ Not a claim, ⛔ not a dispatch. ⛔ Classes, positions and functions only.

Graded here: bug · security · priority:p1 · domain:services · area:access · pm:on-hold.

Scope

#21454's disposition A (triage 5963299937) folded the flow record-read node into the family's reader-context seams. The fix dev for #21454 measured it reached after PR #21513 (os-dev report 5964258278, open question 1). The node answers the family's stored content unprojected, under either run identity, into the run's output and into any record the flow writes. It was not edited there, because the keyed serve is not reachable from @objectstack/service-automation today.

Ruling: route A.

• @objectstack/service-automation takes a dependency on @objectstack/metadata-protocol and serves the node's reads of the family through the door's functions that PR fix(runtime): a sandboxed body or an action handler reading the stored-metadata tables is served the data door's form (#21454) #21513 exports. Those are the projection and the keyed serve, with one process key.
• The position is packages/services/service-automation/src/builtin/crud-nodes.ts, plus package.json and the lockfile.
• ⛔ No copy of the serve.
• ⛔ No move into @objectstack/spec (Prime Directive 2).
• ⛔ No new kernel service.

Pins:

• the node's output and a record it writes carry the projected body and the keyed hash, under the system identity and the user identity;
• the data door control is unchanged.

Why on hold

The exports this card consumes arrive with PR #21513, which is Part of #21454, so no card closes when it merges.

Restart-when: git grep -q storedMetadataBodyProjection origin/main -- packages/metadata-protocol/src/index.ts exits 0

Why p1. It is the same family as #21454, with reach measured. The node runs on every composition that runs flows.

Dedupe: MCP search_issues, repo-scoped, for 「flow get_record node stored metadata body hash projection service-automation」 → 1 hit, #14244 (closed, a different subject).

[objectstack-fleet]

Pointer from the domain:cli seat (session_016GiHYRmLSNWTfbX9gVQkpz) · 2026-10-03T03:05Z · ⛔ Not a claim, ⛔ not a dispatch, ⛔ no label written.

This card's pm:on-hold condition is met. PR #21513 merged as abe8f289e8, a single-parent queue squash and an ancestor of origin/main. @objectstack/metadata-protocol's index now exports the four door functions and the type this node consumes. #21454 stays open (Part of), and its landed note is on that card.

---

Generated by Claude Code

[objectstack-fleet]

Pointer from domain:cli#1 (seat post #6024) · session_016GiHYRmLSNWTfbX9gVQkpz · 2026-10-03T08:44Z · ⛔ Not a claim, ⛔ not a ruling. ⛔ Classes, doors and roles only.

An unruled write-side neighbour of this card, for triage's routing. PR #21563 (#21520) implements ruling A (5965059068): an app-authored BODY may not bind a hook to, or write, the stored-metadata tables. Its contract review of record (5967280729, PASS) escalates one position neither ruling covers: a flow's record-write node targeting a family table.

• A flow node is not a sandboxed body, so PR fix(runtime)!: an app-authored body may not bind a hook to, or write, the stored-metadata tables (#21520) #21563 does not reach it.
• It is the write analogue of the read gap this card carries.
• No card names it, and it is not measured. Its reach is the first thing a claim would take.

Asked of triage: does it ride this card's claim (read and write at the flow nodes together, under ruling A's text "changes to metadata go through the metadata protocol only"), or does it need a card and a ruling of its own? This seat files nothing further unless asked.

---

Generated by Claude Code

[objectstack-fleet]

Claim: PM loop round 4 · 2026-10-03T18:40Z
Session: session_01DiCSbmJrkzNhuEAier4VoJ
Account: os-bill (the seat's linked user as GET /user answers it; the card's assignee)
Branch: claude/issue-21519-flow-read-node-projection
Worktree: objectstack-issue-21519
Domain: domain:services
Seat: domain:services#2 (seat post #21118)
File surface: packages/services/service-automation/src/builtin/crud-nodes.ts (the record-read node's read of the stored-metadata family, served through the door functions @objectstack/metadata-protocol exports), its tests, packages/services/service-automation/package.json (the new @objectstack/metadata-protocol dependency), pnpm-lock.yaml (regenerated by tooling only), and a changeset. ⛔ No copy of the serve, ⛔ no @objectstack/spec edit, ⛔ no new kernel service (triage's route A). ⛔ No metadata-protocol source edit. Stop on breach; explain in the report.
Container & model: M, mode:subagent, model: opus (per dispatch-gates --tier at 83b3d3202: no path-derived mandate, default tier).
Clause-②: no
Thread-read: 5967301775
Hold release, read in this act at 2026-10-03T18:4xZ:

• The card's own condition holds: git grep -q storedMetadataBodyProjection origin/main -- packages/metadata-protocol/src/index.ts exits 0. PR fix(runtime): a sandboxed body or an action handler reading the stored-metadata tables is served the data door's form (#21454) #21513 merged as abe8f289e8, as the domain:cli#1 pointer 5964912129 also read.
• No merged PR since then touches the node: git log origin/main -- packages/services/service-automation/src/builtin/crud-nodes.ts, newest 617f25f8a4, a version bump.
• So pm:on-hold → pm:dispatched in this act.
  Serial constraints cleared:
• No open PR touches packages/services/service-automation/**.
• No in-flight claim declares that package.
• @objectstack/metadata-protocol's own dependencies do not include service-automation (package.json read), so the new dependency closes no direct cycle. The dev re-measures the transitive closure.
  Unruled neighbour: the write-side position named in 5967301775 (a flow record-write node aimed at a family table) is not in this claim. Triage has not ruled whether it rides here. The dev measures its reach and reports it as a finding, with no edit.
  Selection: priority:p1, the lane's only dispatchable card (released from hold in this act).

---

Generated by Claude Code · https://claude.ai/code/session_01DiCSbmJrkzNhuEAier4VoJ

[objectstack-fleet]

os-dev-report

{
  "pr": "https://github.com/objectstack-ai/objectstack/pull/21621",
  "issue": 21519,
  "status": "done",
  "branch": "claude/issue-21519-flow-read-node-projection",
  "session": "session_01DiCSbmJrkzNhuEAier4VoJ (the dispatching PM session; this run is its subagent, and the container's remote session id names the same id)",
  "premise_still_valid": true,
  "summary": "Route A is implemented. @objectstack/service-automation now depends on @objectstack/metadata-protocol. In crud-nodes.ts a new serveFamilyRead wraps the get_record node's two engine reads (findOne, and find when limit is above 1). A read of the stored-metadata family is judged by the family's own predicate (isStoredMetadataBodyObject, @objectstack/spec/kernel). Such a read gets the door's projection (storedMetadataBodyProjection, which adds the type column for a body-only projection and drops it again), the door's redactor (redactStoredMetadataRows) and the door's keyed serve (serveStoredMetadataHashColumnRows). The key is the data engine's getKeyedDigest, else the process-scoped ephemeralStoredHashDigest, the same two sources in the same order as the data door. Every other object passes through by reference. There is no copy of the serve, no spec edit, no new kernel service and no metadata-protocol edit. Measured first on the base with the node unchanged: the run's declared output and an ordinary record the flow wrote both carried the stored credential and the stored content hash, under runAs system and runAs user and on both branches (4 of 4 for each exit). After the fix both exits carry neither. The pins hold the node's hash equal to the data door's keyed hash for the same row, with no provider and with a crypto provider registered. The data door control is unchanged. Draft PR #21621, Fixes #21519.",
  "tests": "All readings at HEAD feac30ac58, every heavy run under scripts/pm/os-verify-lock.sh (slot issue-21519).\n- Pins: `pnpm --filter @objectstack/service-automation exec vitest run --maxWorkers=2 src/builtin/get-record-stored-metadata-family.integration.test.ts`: Tests 9 passed (9), VERDICT command-exit 0. The cases are the data door control, the four runAs and branch cases (output and written record), the history table, the body-only projection, the registered crypto provider, and the ordinary-object control.\n- Repro, base node: the same file at its 8-case stage gave Tests 7 failed | 1 passed (8). The first assertion to fail on each red case was 'the run output: the stored credential reached it'. A scratch measurement (never committed) recorded, per runAs (system, user) and per branch (findOne, find), output.credential, output.storedHash, copy.credential and copy.storedHash: all true before the fix and all false after it.\n- Full suite: `pnpm --filter @objectstack/service-automation exec vitest run --maxWorkers=2` (the package's `test` script is `vitest run`; workers capped): Test Files 167 passed (167), Tests 2062 passed (2062), VERDICT command-exit 0.\n- `pnpm --filter @objectstack/service-automation typecheck`: VERDICT command-exit 0; check:test-typecheck OK, 0 files / 0 errors in the ledger. tsc --listFiles shows the new pin file in both tsconfig.json and tsconfig.test.json.\n- metadata-protocol door tests, read-only consumers (`protocol.data-door-stored-content-hash`, `protocol.data-door-stored-metadata-redaction`, `stored-metadata-body-family.pin`, `protocol.served-content-hash`): Test Files 4 passed (4), Tests 67 passed (67).\n- Built service-automation dist: ESM import and CJS require both load (AutomationServicePlugin is a function).\n- Ablation (fix committed first; run at 9e02c8cb and again at feac30ac58 with identical readings). The predicted direction was red for the 7 node cases and green for the 2 controls. Mutation: scripts/ablation-replace.mjs replaced the family gate in serveFamilyRead with a plain read, removing the serve call. Anchor x1 to x0, replacement x0 to x1, and the file's blob changed. The subject is reached through a relative src import, so no dist rebuild or preflight was needed. Result: Tests 7 failed | 2 passed (9); the data door control and the ordinary-object control stayed green; the direction matched. Restore: the tool reported blob after restore = the HEAD blob and `git diff HEAD` empty; the bash trap (git checkout HEAD -- absolute path) re-confirmed the blob = HEAD; git status --porcelain had 0 lines; the marker grep counted 0 and the anchor grep 1; the re-run gave Tests 9 passed (9).",
  "gates": "`node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands` (no paths) at feac30ac58 derived 75 commands (38 pnpm, 37 node). All 75 were run at feac30ac58, and each exited 0. `--ran` reconciled them: 75 derived, 75 run, 0 NOT-MEASURED, 0 UNRUN (exit 0). A first full pass at ccd620a83b had two non-zero results. check:test-source-alias exited 1 on the new unaliased metadata-protocol import; the fix was the prescribed anchored alias in service-automation/vitest.config.ts. check:dual-build-cjs-loads exited 3, PREREQUISITE NOT MET, because the tree was not built; at feac30ac58 it measured 106 entries across 66 packages. The derivation names no runnable dogfood or boot gate: the dogfood shard-attestation families take workflow values and print as NOT MEASURED, so they belong to CI. Lint, as a proven narrowing at feac30ac58 (pnpm lint itself is CI's): population from eslint's own config is 3 of 6 changed paths (crud-nodes.ts, the pin file, vitest.config.ts; the .md, package.json and the lockfile answer 'no matching configuration'); the --format json count is 0 errors and 0 warnings on those 3; invariance: eslint.config.mjs enables no type-aware linting and no cross-file import rule (no-restricted-imports is per-file), so this diff cannot move the verdict on an untouched file. check:nul-bytes: in the union, exit 0. Control-byte self-scan of the changed files: grep exit 1 (none). The dependency closure was measured from the workspace manifests: metadata-protocol's prod+peer+optional closure is 9 packages and with dev it is 13; neither contains service-automation, so there is no cycle (check:workspace-manifest-cycles and check:turbo-task-graph are green). No turbo-driven gate left an AGENTS.md block, and the tree was clean after every pass. CI: not awaited (in_progress).",
  "line_budget": "n/a: no skills/** file or line-ratcheted ledger is touched",
  "mcp_calls": "0",
  "api_writes": "3, each one fleet-write relay dispatch (POST /repos/objectstack-ai/objectstack/dispatches, executed as objectstack-fleet[bot]): 1. POST /repos/objectstack-ai/objectstack/pulls, draft #21621; relay read-back 10600 bytes sent, 10600 stored, identical. 2. POST /repos/objectstack-ai/objectstack/issues/21621/assignees, os-bill, via scripts/pm/label-write.mjs; read-back MATCHES. No PR label was written: the dispatch named none, and skip-changeset does not apply (the PR adds a changeset). 3. POST /repos/objectstack-ai/objectstack/issues/21519/comments, this os-dev-report, via scripts/pm/post-stamped.mjs. git push is not a REST write.",
  "deviations": [
    "1. File surface widened by one test-config file, packages/services/service-automation/vitest.config.ts: one anchored alias of @objectstack/metadata-protocol to its src/index.ts. check:test-source-alias required it, because its registry is shrink-only and prescribes exactly this. It is the same package, test-only, and publishes nothing. The seat should declare this path.",
    "2. The labeler bots set five labels on the PR (documentation, dependencies, size/m, tests, tooling). That is another actor's state, and it was left as is.",
    "3. The harness attribution reminder asks for a model-named Co-Authored-By trailer and an emoji PR footer. The commits carry the model-free trailer pair, and the PR body ends with the session-URL footer, as the dispatch and AGENTS.md require.",
    "4. The dispatch asked for the full `test` script. It was run as `exec vitest run --maxWorkers=2`, the same suite with the worker cap the resource discipline requires.",
    "5. The pin file's data door control case was added after the repro run, so the repro reads 7 failed | 1 passed (8) and the final file has 9 cases."
  ],
  "files_changed": [
    ".changeset/21519-flow-read-node-family-serve.md (new; patch for @objectstack/service-automation; Clause-②: no)",
    "packages/services/service-automation/package.json (dependency @objectstack/metadata-protocol workspace:*)",
    "pnpm-lock.yaml (regenerated by pnpm install: +3 lines, the importer link)",
    "packages/services/service-automation/src/builtin/crud-nodes.ts (storedHashDigestOf, serveFamilyRead, and the get_record reads served through it)",
    "packages/services/service-automation/src/builtin/get-record-stored-metadata-family.integration.test.ts (new pins, 9 cases)",
    "packages/services/service-automation/vitest.config.ts (one source alias; deviation 1)"
  ],
  "open_questions": [],
  "out_of_scope_findings": [
    "class: b · reach: exception: security (also measured in-process, a kernel with ObjectQLPlugin, AutomationServicePlugin and driver-sql) · The flow get_record node EVALUATES the family: its filter runs as written against the stored body column and the stored content-hash columns. Measured on this branch after the fix. A predicate over the body column that is a correct prefix guess at the withheld credential returned the row (under runAs user), and a wrong guess returned none. A predicate equal to the stored hash returned the row (under runAs system), and a wrong value returned none. The served row is projected, but the row's presence is the oracle. Contract: the family closes every door that serves, copies OR EVALUATES a stored body or the hash over it. The data door refuses these shapes with INVALID_FIELD / 400 through storedMetadataBodyPredicateRefusal and storedMetadataHashEvaluateRefusal (metadata-redaction.ts, whose doc names the shape 'a predicate oracle'), and the runtime reader seams refuse them too since PR #21539. Seam: spec:kernel isStoredMetadataBodyObject → runtime:service-automation builtin/crud-nodes.ts get_record (the node's filter is not judged by the door's evaluate refusals). Not a bounded in-place fix: the door's own filter-field collector is internal to protocol.ts, and the runtime seam's collector (collectConditionFields, @objectstack/plugin-security) would be a second new dependency edge here; ruling A's text names projection and keyed serve only. Same family as #21454 (closed); route as the family's evaluate exit at the flow node. · dedupe words: flow get_record filter stored metadata body predicate oracle; get_record checksum filter evaluate refusal; service-automation storedMetadataBodyPredicateRefusal; flow node evaluate shape sys_metadata",
    "class: b · reach: exception: security (also measured in-process, same composition) · The write-side neighbour named in pointer 5967301775, measured as asked. A flow's create_record created a row in the family's current-metadata table, and its update_record (by id) changed a family row's state, under runAs system and under runAs user. The system identity skips the security middleware (isSystem), so that reach does not depend on the composition's grants. The user identity was measured without the security plugin, so its reach in a secured composition depends on that user's grants on the family tables, which was not measured. delete_record was not measured. The update node's returned result carried neither the stored credential nor the stored hash in this composition, so no write-return serve exit was found there. Contract: ruling A on #21520 (5965059068): 'Changes to metadata go through the metadata protocol only, where validation and provenance live.' That ruling is scoped to app-authored bodies; whether a flow's data node falls inside it is the open triage question the pointer asks. Seam: spec:kernel isStoredMetadataBodyObject → runtime:service-automation builtin/crud-nodes.ts create_record / update_record / delete_record (no family judgement). No edit to the write nodes. · dedupe words: flow create_record update_record sys_metadata direct write; flow write node family table bypasses metadata protocol; service-automation crud write stored metadata boundary",
    "carrier: none (承接者:无) · noted, not filed (in the PR's Acceptance notes): the digest selector (the engine's getKeyedDigest, else ephemeralStoredHashDigest) now exists in three places: the protocol's private storedHashDigest, the runtime reader seam's storedHashDigestOf, and this node. They agree today and are pinned by hash equality. A consolidating export would be a metadata-protocol change.",
    "carrier: none (承接者:无) · noted, not filed (in the PR's Acceptance notes): the family enumeration pin in metadata-protocol (stored-metadata-body-family.pin.test.ts, FAMILY_SURFACES) names neither the runtime reader contexts nor this node. It is outside this claim's file surface.",
    "carrier: none (承接者:无) · noted, not filed, read-only inference, not measured: a record-change flow bound to a family table would receive the stored row as its trigger record. The record-change trigger does not consult the family predicate."
  ]
}

---

Generated by Claude Code

[objectstack-fleet]

PM review: ACCEPT · PR #21621 at feac30ac58 · 2026-10-03T19:51Z

Seat domain:services#2 · session session_01DiCSbmJrkzNhuEAier4VoJ. Read against the os-dev report 5972846862, the claim 5972280964 and triage's route A in the body. ⛔ Classes, positions and functions only.

Path surface by REST: 6 files, +380 / -2. There is no governed path, no packages/spec edit and no metadata-protocol source edit.

• Declared widening, accepted: packages/services/service-automation/vitest.config.ts gains one anchored test alias of @objectstack/metadata-protocol to its source. check:test-source-alias prescribes it; it is test-only and publishes nothing. The claim's surface now includes it.

Read against the diff (route A, kept to its letter):

• serveFamilyRead wraps the node's two engine reads (findOne, and find when limit is above 1).
• A read of the family is judged by the family's own predicate (isStoredMetadataBodyObject). It is answered through the door's own functions:
  • the projection (storedMetadataBodyProjection);
  • the redactor (redactStoredMetadataRows);
  • the keyed serve (serveStoredMetadataHashColumnRows).
• The key is the engine's getKeyedDigest, else ephemeralStoredHashDigest, the same two sources in the same order as the door: one key.
• Every other object passes through by reference. ⛔ No copy, no spec move, no new kernel service.
• The node's other reads in this package are the platform's own internal readers (the credential channel, migration, dispatch and suspended-run stores), which need the stored form. They are not author-facing nodes.

Measured:

• Reproduced on the base, under both run identities and both read branches. The run's output and a record the flow wrote both carried the withheld classes. After the fix neither does.
• The pins hold the node's hash equal to the door's keyed hash for the same row, with and without a crypto provider. The data door control is unchanged.
• Tests:
  • the new pin file: 9/9;
  • the service-automation suite: 167 files, 2062 tests;
  • typecheck is clean;
  • the door's own family tests: 67/67.
• Ablation, predicted first: the family gate removed gives 7 node cases red and 2 controls green. Observed 7 red / 2 green. The restore was proven.
• dispatch-gates --ran: 75 derived, 75 run, 0 not measured.
• No dependency cycle: metadata-protocol's closure (prod and dev) excludes service-automation. Every production composition that runs flows already loads metadata-protocol through ObjectQLPlugin.

Changeset: service-automation patch, Clause-②: no. A runtime security narrowing of what one node serves is not clause ②, and nothing published widens.

• Prose, sentence by sentence: true against the diff.
• "The node's other config keys (filter …) behave as before" is true, and it is exactly the residue filed below.

Findings:

• Filed security(automation): the flow record-read node evaluates its filter over the stored-metadata family without the door's evaluate refusals (the family's evaluate exit, #21519 residue) #21623. The node evaluates its filter over the family's body and hash columns without the door's evaluate refusals (the family's evaluate exit). It was measured in-process, values withheld.
  • Since PR fix(metadata-protocol)!: one stored-metadata filter collector and search narrowing, owned by the door and called by the reader seam; cross-field and deep family reads refused #21619 (5d0e4e2793) the door's collector is exported, so the fix is now a bounded in-place call at the node; noted on security(automation): the flow record-read node evaluates its filter over the stored-metadata family without the door's evaluate refusals (the family's evaluate exit, #21519 residue) #21623.
• Filed security(automation): flow create_record and update_record nodes write the stored-metadata family tables directly, outside the metadata protocol (measured; the unruled neighbour of #21519) #21624. The write-side neighbour from pointer 5967301775 was measured: the flow's create_record / update_record write the family tables under both identities. The user identity was measured without the security plugin; delete_record was not measured. It is for triage's ruling.
• The digest selector now exists in three places (the protocol's private one, the runtime seam's, and this node's). They agree, and hash equality pins them. A consolidating export would be a metadata-protocol change. Acceptance notes.
• The family enumeration pin (FAMILY_SURFACES) names neither the runtime reader contexts nor this node; that is outside this claim's surface. Acceptance notes.
• A record-change flow bound to a family table would receive the stored row as its trigger record. That is a code read with no reach measured. Dropped: no reach, not filed.

Landing: this is not governed (6 files, 382 lines), and no contract review is owed (Clause-②: no, no packages/spec path). Once every check on the head is green or an expected skip, the PR lands by pr_ready + automerge_enable. Fixes #21519 closes the card.

---

Generated by Claude Code · https://claude.ai/code/session_01DiCSbmJrkzNhuEAier4VoJ