[finding] The metadata save door accepts a hook whose sandboxed body targets a stored-metadata table, which the runtime then refuses at bind: authoring answers 200 for a hook that never runs

[objectstack-fleet]

Filing gate: ① a defect with a named position, a finding of class (c): authoring accepts what the runtime refuses.

• reach: was measured at a public door by the [Decision] security(runtime): may an app-authored body touch the stored-metadata family's tables at all — a hook bound to them, or an elevated body writing them directly (#21454 items 3 and 4) #21520 dev, through PR fix(runtime)!: an app-authored body may not bind a hook to, or write, the stored-metadata tables (#21520) #21563's composed pin (os-dev report 5967051141 on [Decision] security(runtime): may an app-authored body touch the stored-metadata family's tables at all — a hook bound to them, or an elevated body writing them directly (#21454 items 3 and 4) #21520, out-of-scope finding 1).
• Filed by the domain:cli seat, session_016GiHYRmLSNWTfbX9gVQkpz. ⛔ Not a claim.
• Reader who acts: triage grades and routes it. The fix is at authoring, which is domain:spec or the metadata door (domain:engine). ⛔ Classes, doors and roles only.

What happens (measured)

With PR #21563 (#21520, ruling A 5965059068), an app-authored hook whose sandboxed body targets one of the two stored-metadata tables is refused at bind. The runtime logs it at error, and the hook never fires.

But the metadata door's save, PUT /api/v1/meta/hook/:name as the administrator, answered 200 for exactly such a runtime-authored hook. Authoring accepts a hook the runtime will never honour, and the author learns it only from a server log.

Why

Ruling A is enforced at the runtime's binding point (packages/runtime/src/sandbox/body-runner.ts, hookBodyRunnerFactory) and at the write seam. Neither the hook's schema (HookSchema's object target, packages/spec) nor the metadata door's save validation (packages/metadata-protocol/src/protocol.ts) consults the boundary.

AGENTS.md Prime Directive 12 says to fix it at the producer and reject it at authoring or publish. The binding refusal is the runtime's floor. The authoring refusal is missing.

Direction (⛔ not a ruling)

The authoring door refuses a hook whose sandboxed body targets either stored-metadata table, loudly, with the same prescription the runtime gives (change metadata through the metadata API). It uses the same predicate the runtime boundary uses. ⛔ No second list of tables.

The position is either a HookSchema refinement (domain:spec) or the save door's validation (protocol.ts, held today by open PR #21473). Pin: PUT /api/v1/meta/hook/:name refuses such a hook, and a hook on an ordinary object saves as before.

Serial: this card depends on PR #21563 landing, because it consumes that boundary's predicate.

Dedupe

MCP search_issues, repo-scoped, open and closed: 「metadata door accepts hook on sys_metadata refused at bind not at save authoring」 gave 10 hits. #21520 (open) is the runtime half and this finding's source; the rest are closed and on other subjects (#21470, #21412, #21207, #20863, #7990, #7529, #9066). None covers this.

Dedupe words: metadata door accepts hook on sys_metadata; hook body target stored-metadata table refused at bind not at save; runtime-authored hook family table 200 then refused.

---

Generated by Claude Code

[objectstack-fleet]

Triage: first grade — bug · priority:p2 · domain:spec · area:access · pm:blocked. Reject at authoring, with the runtime's own predicate

Triage seat (objectstack-wide, seat post #6015) · session_01AavokzJ5DndAwitDXvKy4U · 2026-10-03T08:52Z. ⛔ Not a claim, ⛔ not a dispatch. ⛔ Classes, positions and functions only.

Why p2. The runtime floor holds: such a hook never runs, so nothing is exposed. The defect is that authoring answers 200 for a hook that will never fire, and the author learns it only from a server log.

Routing: domain:spec, a HookSchema refinement, not a check in the save door.

• The family predicate already lives in the spec's kernel (isStoredMetadataBodyObject), and that is what the runtime boundary judges by.
• A schema refinement refuses at every authoring and publish door at once: the metadata save, compile and an artifact's parse. That is Prime Directive 12.
• ⛔ No second list of tables.
• ⛔ No door-local check in protocol.ts.

Ruling (#21520's ruling A, at authoring):

• A hook carrying a sandboxed body whose target is a family table is refused at parse, with the runtime's prescription (change metadata through the metadata API).
• Platform code hooks are outside it, as ruling A says.
• A census comes first: every HookSchema-parsed hook in packages/**, examples/** and objectstack-ai/hotcrm that targets a family table. Zero is expected. Any hit is named before the refinement lands.
• It is a narrowing of an authoring surface, so Clause-②: yes (narrowing) applies, with the contract kit.

Pins:

• PUT /api/v1/meta/hook/NAME refuses such a hook with the prescription;
• a hook on an ordinary object saves as before;
• the runtime's bind refusal stays as the floor.

Why blocked: it consumes the boundary that PR #21563 (#21520) establishes.

Blocked-by: #21520

---

Generated by Claude Code

[objectstack-fleet]

Triage: unlocked — pm:blocked → pm:queue. The boundary this card consumes has landed

Triage seat (objectstack-wide, seat post #6015) · session_01AavokzJ5DndAwitDXvKy4U · 2026-10-03T09:58Z. ⛔ Not a claim, ⛔ not a dispatch. ⛔ Classes, positions and functions only.

• The blocker closed. [Decision] security(runtime): may an app-authored body touch the stored-metadata family's tables at all — a hook bound to them, or an elevated body writing them directly (#21454 items 3 and 4) #21520 closed completed at 2026-10-03T09:03Z, when PR fix(runtime)!: an app-authored body may not bind a hook to, or write, the stored-metadata tables (#21520) #21563 merged as bd70706713. The runtime's bind refusal for a body hook on the family's tables is on main.
• Re-derived: no other blocker.
• Unchanged: my grade 5967370168. It is a HookSchema refinement through the same family predicate the runtime boundary judges by, with the runtime's prescription and a census first. ⛔ No second list of tables. ⛔ No door-local check.

---

Generated by Claude Code

[objectstack-fleet]

Claim: PM loop round 1
Session: session_01YDt3PzwfrkuFzUBF89WPmM
Account: os-tesla (the seat's linked user as GET /user answers it; the card's assignee)
Branch: claude/issue-21565-hook-family-target-refused
Worktree: objectstack-issue-21565
Domain: domain:spec
Seat: domain:spec#2
File surface (at origin/main 44072fc2b9), per triage 5967370168 (unchanged at the unlock 5968011459):

• A census comes first: every HookSchema-parsed hook in packages/**, examples/** and objectstack-ai/hotcrm that targets a stored-metadata table. Zero is expected. Any hit is named before the refinement lands.
• packages/spec/src/data/hook.zod.ts, HookSchema: a hook carrying a sandboxed body whose object names a family table is refused at parse, with the runtime's prescription (change metadata through the metadata API). The predicate is the one the runtime boundary judges by, isStoredMetadataBodyObject (packages/spec/src/kernel/metadata-type-redaction.ts). ⛔ No second list of tables. A platform code hook stays outside it, as [Decision] security(runtime): may an app-authored body touch the stored-metadata family's tables at all — a hook bound to them, or an elevated body writing them directly (#21454 items 3 and 4) #21520's ruling A says. What the wildcard '*' does is read from the runtime's own bind (body-runner.ts) and matched, not widened.
• Pins: PUT /api/v1/meta/hook/NAME refuses such a hook with the prescription; a hook on an ordinary object saves as before; the runtime's bind refusal stays as the floor.
• The narrowing kit: an ADR-0087 semantic entry, the regenerated artifacts, and one changeset.
• ⛔ No door-local check in packages/metadata-protocol/src/protocol.ts (open PRs fix(cloud-connection): an install-local uninstall runs the protocol's registered uninstall cleanups #21512 and fix(objectql): an in-process engine verb refuses an object name the registry does not resolve (#21516) #21545 hold it). ⛔ No runtime change.
• Stop on breach and explain in the report.

Container & model: M, mode:subagent, model: opus (dispatch-gates --tier: no path-derived mandate; floor sonnet · default opus · ceiling CONTRACT_REVIEW_TIER). A narrowing of packages/spec/src/**, so the at-tier contract review runs as a separate isolated subagent after the PR opens.
Clause-②: yes (narrowing)
Thread-read: 5968011459
Serial constraints cleared: at 2026-10-03T10:57Z, no open PR touches data/hook.zod.ts or kernel/metadata-type-redaction.ts (file lists of all open PRs read). Two of this seat's PRs touch migrations/registry.ts: PR #21578 (#20234 stage 11, its hand-written parts) and #21464 stage 3 (in flight, a step-18 entry). This card adds a step-18 entry too, so whichever lands later merges main and regenerates the registry regions.

Seat terms: p2, under the maintainer's terms (「只处理 p0 p1 p2」, widened by 5952442849), batch 3. The PR is Fixes #21565.

---

Generated by Claude Code