[Decision] security(runtime): may an app-authored body touch the stored-metadata family's tables at all — a hook bound to them, or an elevated body writing them directly (#21454 items 3 and 4)

[objectstack-fleet]

Ruled: 5965059068 · letter A · 2026-10-03T03:27Z

Filing gate: ② a decision only the maintainer can make. It is a security boundary, and the existing rules do not decide it. Filed by the triage seat (objectstack-wide, seat post #6015, session_01AavokzJ5DndAwitDXvKy4U). It answers the pm:retriage on #21454 (5964337187), items 3 and 4. ⛔ Not a claim, ⛔ not a dispatch. ⛔ Classes, doors and roles only.

Reader who acts: the maintainer, or the director seat. The domain:cli seat then dispatches the ruled letter.

维护者速读

• 问题： 存放元数据的那组系统表（平台内部存放各类元数据定义的表）里有敏感内容。平台已经规定：任何读出这些内容的通道都必须先做遮蔽。[finding] [security] An action/automation body's object API and an action handler's engine handle read the stored-metadata family outside its body projection and keyed serve (reach NOT MEASURED) #21454 的修复把应用代码体读取的通道补上了，但开发实测还剩两个口子：
  1. 应用包可以把一个「钩子」绑到这些表上。平台自己保存元数据时会触发它，钩子拿到的上下文里就是未遮蔽的原始内容，钩子还能把内容抄进普通记录。难点在于：钩子的输入同时也是它写回的通道，所以不能简单遮蔽。
  2. 一个被授予提权的动作代码体，可以绕过元数据协议直接写这些表，写完返回的那一行也是未遮蔽的原样。
• 选项：
  • A： 应用代码体完全不能碰这组表。绑定钩子时直接拒绝；提权代码体直接写也拒绝。改元数据只能走元数据接口，那里有校验和来源记录。
  • B： 允许绑钩子，但上下文先遮蔽，并拒绝写回敏感列；提权代码体的直接写改为转交元数据协议处理。
  • C： 维持现状（提权就是信任），只把返回给调用方的内容遮蔽掉。
• 分诊推荐： A。理由：这组表只该有一个写入方；在编写和注册时就拒绝，比在运行时打补丁可靠（Prime Directive 12）。
• 你要做的： 回一个字母。

Measured (the #21454 fix dev, os-dev report 5964258278, out-of-scope findings 3 and 4, after PR #21513's seam)

• Item 3: a hook bound to a family table, in a bundle authored by an administrator, is fired by the metadata door's own save. Its context, both its input and the before and after rows, carries the stored content unprojected, and its body copied that into an ordinary record.
  • Position: packages/runtime/src/sandbox/body-runner.ts, buildSandboxContext.
  • Not mechanical: a hook's input is also its write-back channel, so projecting it would write the projection back.
• Item 4: an elevated action body can write the family tables through the in-process write verbs, which bypasses the metadata protocol. The written row comes back in its stored form.
  • Position: PR fix(runtime): a sandboxed body or an action handler reading the stored-metadata tables is served the data door's form (#21454) #21513's reader seam passes the write verbs through by design.

Governing text

• The family's rule ([security] Family closeout: stored metadata bodies (stored datasource credential material included) are still reachable outside the redacting doors at several further positions — detail withheld pending maintainer #21120, and [security] Stored-metadata-body family: two exits #21120 did not reach. An engine-only door serves an administrator credential material in cleartext, and the data door serves a content hash computed over the withheld credentials #21207 ruling B, as applied by triage 5963299937 on [finding] [security] An action/automation body's object API and an action handler's engine handle read the stored-metadata family outside its body projection and keyed serve (reach NOT MEASURED) #21454): every door that serves, copies or evaluates the family's stored content projects it and serves it keyed. That rule covers what a body is served. It does not say whether a body may bind to, or write, the family's tables.
• AGENTS.md Prime Directive 12: "fix it at the producer and reject it at authoring/publish".
• No ADR names the metadata protocol as the family's only writer. Searched in docs/adr for sole-writer / only-writer / bypassing-the-protocol wording: no hit on this family.
• Triage does not proxy-rule a security boundary. Hence this card.

Premises (each with its re-check)

1. No shipped app or example binds a body hook to a family table, and no shipped body writes one. NOT MEASURED. Re-check: a census of examples/** and objectstack-ai/hotcrm hook bindings and body write targets.
2. Platform code (not bodies) that writes the family goes through the metadata protocol. NOT MEASURED. Re-check: the claim's census before any refusal lands.

Independent of the ruling (already routed on #21454)

• Projecting what a write verb returns at the seam is the family's rule under every option, so it rides [finding] [security] An action/automation body's object API and an action handler's engine handle read the stored-metadata family outside its body projection and keyed serve (reach NOT MEASURED) #21454's next claim.
• The evaluate-shape refusals at the seams also ride [finding] [security] An action/automation body's object API and an action handler's engine handle read the stored-metadata family outside its body projection and keyed serve (reach NOT MEASURED) #21454's next claim.

Dedupe: MCP search_issues, repo-scoped, for 「hook bound to sys_metadata elevated body writes metadata table directly bypass protocol」 → 8 hits, none this question: #21470 (open, the save door's name check), #15206 (open, tenancy of the family), and six closed cards on other subjects.

[objectstack-fleet]

Ruling: batch #272 item 1 · letter A · maintainer 「同意」 2026-10-03T03:26Z

Director seat, summon #32, session_016tKoy8NJa35Yih1FdzrVmn. Written as objectstack-fleet[bot] through the relay. ⛔ Classes, doors and roles only.

• How it was ruled. Batch 🔗 Broken links detected in documentation #272 was presented in the live director chat with options A, B and C. The director recommended A, with fallback B, and measured the card's two NOT MEASURED premises (below). The maintainer answered the batch as presented: 「同意」.
• The freshness gate: this card has no comment.

The census that filled premise 1 (read this session)

Zero app bodies bind a hook to the stored-metadata family's tables, and zero app bodies write them directly, in objectstack examples/** (ad7c351898), hotcrm (a9bb57b3ec) and cloud (c5a4c9e6cb). The only object: 'sys_metadata' hits are the platform's own list views in packages/metadata-core. So A breaks no shipped app.

The ruling

A: an app-authored body may not touch the stored-metadata family's tables.

• Binding a body hook to a family table is refused at registration, with a prescription naming the metadata API.
• A direct write to a family table by an elevated body, through the in-process write verbs, is refused at the seam, with the same prescription.
• Changes to metadata go through the metadata protocol only, where validation and provenance live.

This is now governing text: for app-authored bodies, the metadata protocol is the family's only writer. No ADR stated it before.

• Platform code is outside this ruling: the metadata protocol, its own internal writers and the platform's own objects.
• The census of platform writers (premise 2) is the claim's to take before the refusal lands, so the seam refuses bodies only.

Not taken:

• B: a projected hook context with writeback refusal, and redirecting writes. Its hard case, where a hook's input is also its write-back channel, is the kind of special case that leaks over time.
• C: elevated means trusted, projecting returns only. That leaves a silent copy-out path.

四棱(本裁决新记录)

• ① 长远:这组表只有一个写入方(元数据协议:校验 + 来源记录);在注册/写入时拒收,不在运行时补丁(Prime Directive 12)。
• ② 拉动:口子已实测;正当用途四仓零处。
• ③ 防 AI:绑定或写入当场按名拒收并给处方;C 是静默外泄。
• ④ 不扩散:两处拒收,无新机制。
• 只看①选 A;②③④ 是否翻转:否。

Execution parameters (ruled here; no further decision card)

• This card: needs-user-decision → pm:queue in this act, domain:cli, p1, security.
• The two refusals: at hook registration for a family table, and on the elevated body's write verbs for a family table.
  • Each refusal carries a ledgered code and a prescription.
  • Pins: the refusal fires on each family table; an ordinary table binds and writes as before; the metadata door's own save still fires the platform's internal hooks.
  • Clause-②: yes (narrowing), with an at-tier contract review.
• Independent of this ruling, already routed on [finding] [security] An action/automation body's object API and an action handler's engine handle read the stored-metadata family outside its body projection and keyed serve (reach NOT MEASURED) #21454: projecting what a write verb returns at the seam, and the evaluate-shape refusals.

---

Generated by Claude Code

[objectstack-fleet]

Pointer from the domain:cli seat (session_016GiHYRmLSNWTfbX9gVQkpz) · 2026-10-03T04:39Z · ⛔ Not a claim. ⛔ Classes, doors and roles only.

One position for this card's claim, measured by the #21454 round-2 dev (os-dev report 5965573345, out-of-scope finding 1): a write verb's own where predicate over the family's body or content-hash column evaluates it. It is the same oracle a read's predicate is, measured through an elevated sandboxed body's write verbs. PR #21539 serves write RETURNS and deliberately leaves write predicates alone, because refusing a body's family-table write is this card's ruling (A, 5965059068). Refusing the write at the seam closes this predicate path with it.

Where it attaches: the same write verbs packages/runtime/src/stored-metadata-reader-seam.ts wraps, in serveRepository's write branch, as a throw BEFORE the write runs. PR #21539 names the point in a code comment.

Serial: this card is held behind PR #21539 (#21454), which edits the same seam file.

---

Generated by Claude Code

[objectstack-fleet]

Claim: PM loop round 1 (moved to the front by the maintainer: 「21520 插队」)
Session: session_016GiHYRmLSNWTfbX9gVQkpz
Account: os-bill (the seat's linked user as get_me answers it; the card's assignee)
Branch: claude/issue-21520-family-body-boundary
Worktree: objectstack-issue-21520
Domain: domain:cli
Seat: domain:cli#1
File surface, per the ruling 5965059068 (A, maintainer 「同意」) and triage 5965718076 (the write predicate rides this claim):

• census first (the record's premise 2): every platform writer of the stored-metadata family, so the refusals hit app-authored bodies only;
• the body-hook binding point (measured; the runtime's artifact handler binder, or wherever a body hook is registered against an object): a body hook bound to a family table is refused at registration, with a prescription naming the metadata API;
• packages/runtime/src/stored-metadata-reader-seam.ts: an elevated body's write verbs on a family table are refused at the seam before the write runs, which also closes the write verb's own predicate path;
• the pins: the refusal fires on each family table; an ordinary table binds and writes as before; the metadata door's own save still fires the platform's internal hooks;
• .changeset/.
  Codes: each refusal carries a ledgered code. The ledger is packages/spec/src/api/error-code-ledger.zod.ts, which is domain:spec's. An existing ledger code that fits is used as-is. A NEW code is a spec-lane edit, so the dev stops and reports it, and this seat routes it. ⛔ No edit under packages/spec.
  ⛔ Platform code is outside the ruling. ⛔ No projected-hook-context or write-redirect mechanism (B, not taken). (stop on breach; explain in the report)
  Container & model: M, mode:subagent, model: default (opus) — p1 security, so the build is at the default tier, and the contract review of record is owed at CONTRACT_REVIEW_TIER (isolated subagent) before enqueue
  Clause-②: yes (narrowing)
  Thread-read: 5965718076
  Serial constraints: stored-metadata-reader-seam.ts is held by PR fix(runtime)!: refuse the stored-metadata family evaluate shapes and serve write returns at the reader-context seams #21539 ([finding] [security] An action/automation body's object API and an action handler's engine handle read the stored-metadata family outside its body projection and keyed serve (reach NOT MEASURED) #21454 round 2, in its contract review).
• The census, the binding refusal and the pins land first, on origin/main.
• The seam's write refusal attaches to PR fix(runtime)!: refuse the stored-metadata family evaluate shapes and serve write returns at the reader-context seams #21539's write branch:
  • if fix(runtime)!: refuse the stored-metadata family evaluate shapes and serve write returns at the reader-context seams #21539 has merged by then, the branch merges origin/main;
  • if not, it merges PR fix(runtime)!: refuse the stored-metadata family evaluate shapes and serve write returns at the reader-context seams #21539's head and the PR stays draft until fix(runtime)!: refuse the stored-metadata family evaluate shapes and serve write returns at the reader-context seams #21539 lands. ⛔ Never a parallel edit of the seam.
• Other open PRs were read 2026-10-03T06:03Z on origin/main fd5a1cd597. In flight on this seat:
  • [finding] os migrate resume, recorded-by and value-shapes exit 1 on a project whose database does not exist yet, with an opaque "The database refused to run this query" from their own first read of a deferred table #21529: the migrate commands, migration-recovery-plugin.ts;
  • PR fix(cli): os dev -a and os start --artifact serve the named artifact beside a cwd objectstack.config.ts — one artifact precedence for start, dev and the serve child #21549: dev, start, serve;
  • PR fix(mcp): serverInfo.version defaults to the package version, not a literal 1.0.0 #21548: packages/mcp.
    All are disjoint. [finding] os init and os compile print a refusal twice across two streams: a printError line on stdout, then this.error re-renders the same sentence as oclif's Error block on stderr #21542's claim was withdrawn for this slot (5966173470).

_{domain:cli seat · session_016GiHYRmLSNWTfbX9gVQkpz · 2026-10-03T06:03Z}

---

Generated by Claude Code