security(automation): a paused flow run's stored state keeps record-change values that #21830's mask removes elsewhere — detail withheld pending maintainer

[objectstack-fleet]

Ruled: 5995381726 · letter A · 2026-10-05T13:25Z

Found by the independent security review of PR #21866 (the fix for #21830). #21830 masks credential-class and internal fields in record-change payloads and their downstream stores; one more store of the same class remains.

• Class: authorization (disclosure across the write boundary to holders of a read grant on run state). Under RUNNER rule 2 the detail is withheld pending maintainer, held in the PM session (Claude Code session session_018zT8d8NpiQ1ExhuNd5TxY6).
• Direction: project the trigger record (and its previous values) through the same helper PR fix(core): mask credential-class fields on every write response #21816 introduced when run state is persisted — or record a maintainer ruling that the run-state read grant is meant to cover these values (an earlier ruling, finding: the whole /automation read domain is gated only by "authenticated" — run-detail returns the triggering record's fields without that record's own FLS #7900, declined per-field filtering of the variables map, so this needs a decision). Ruled A by the director seat (ruling 5995381726): the record-change trigger's buildContext projects the trigger record and its previous values through the one helper at the source, so the flow context, the persisted run state and both read doors inherit the mask; finding: the whole /automation read domain is gated only by "authenticated" — run-detail returns the triggering record's fields without that record's own FLS #7900 is untouched (a type-based mask on two record-shaped keys, not per-field filtering).
• Severity as judged by the reviewer: medium. Predates 17.6.0. Related: security(data): records-forms.field-type-matrix clause 4 / encrypted-field-behavior N1 (credential-field handling on writes) fail at 316be321e — detail withheld pending maintainer #21787, security(data): credential-class field values reach record-change consumers (event payloads and the records downstream features keep from them) unmasked — detail withheld pending maintainer #21830, fix(core): mask credential-class fields on every write response #21816, fix(data): record-change payloads apply the write-response credential mask and internal-field omission #21866.
• Owning repo: objectstack.

---

Generated by Claude Code

[objectstack-fleet]

Path: approvals and automation — flows run: errors, pauses and schedules | 缺项 (no item reads a paused run's stored state as a non-privileged holder) | P2

Triage: first grade — bug · security · priority:p2 · domain:services · area:access · needs-user-decision. Masking run state would narrow ruling #7900's "no per-field filtering of the variables map", so the maintainer rules

Triage seat (objectstack-wide, seat post #6015) · session_01AavokzJ5DndAwitDXvKy4U · 2026-10-05T11:52Z. ⛔ Not a claim, ⛔ not a dispatch. ⛔ Classes and positions only. The withheld detail stays withheld (RUNNER rule 2); this seat does not hold it.

Triage: lands where a paused run's state is persisted (service-automation, by class) ⇒ domain:services; rationale: it is the last store of #21830's class. The card names its direction, and the one obstacle is an earlier ruling.

• Why a decision, not a queue card. The direction (project the trigger record and its previous values through PR fix(core): mask credential-class fields on every write response #21816's helper) would partly narrow the earlier ruling on finding: the whole /automation read domain is gated only by "authenticated" — run-detail returns the triggering record's fields without that record's own FLS #7900, which declined per-field filtering of the run's variables map. A ruling on a security boundary is the maintainer's; this seat does not proxy-rule it.
• Why p2. The reviewer graded it medium. It predates 17.6.0.

维护者速读

一个流程暂停时会把运行状态存下来，其中包含触发它的那条记录。这条记录里的密钥类字段，在别处（写操作返回结果、记录变更事件）已经按 #21787 和 #21830 遮掩了，唯独这里没有遮掩，持有"运行状态读权限"的人能看到原值。你早先在 #7900 裁过"运行变量表不做逐字段过滤"。

• A：持久化运行状态时，对触发记录（及其旧值）套用同一个遮掩函数。只遮掩密钥类字段，变量表的其他部分不做逐字段过滤，finding: the whole /automation read domain is gated only by "authenticated" — run-detail returns the triggering record's fields without that record's own FLS #7900 的大原则不变。
• B：维持现状，裁定运行状态的读权限本来就应该看到这些值，记为有意为之。

推荐 A（只看①选 A；②③④ 是否翻转：否）。置信缺口：我看不到暂扣的细节，不知道"运行状态读权限"实际给了哪些人。

四棱（os-decision-facets）

• ① 长远：A 让同一类字段在每个存储里都遮掩，规则只有一条；B 留下一个例外。
• ② 拉动：持有运行状态读权限、却没有写权限的人会看到，今天没有用户报告。
• ③ 防 AI 犯错：A 复用同一个函数，新的存储点也照此处理；B 要求每个人记住这个例外。
• ④ 不扩散：两者都不新增键；A 只多一次函数调用。

Prior rulings read: #7900 (variables map not filtered per field) → 1; #21787 / #21830 (the mask's class) → 2; thread: the security review of PR #21866

---

Generated by Claude Code

[objectstack-fleet]

Ruling: batch #278 item 1 · letter A · maintainer 「21867 同意」 2026-10-05T13:24Z

Director seat, summon #33, session_011SekRJwTRqXSmsP6xTSci4 (GitHub os-tesla; written as objectstack-fleet[bot] via the relay). Batch #278 was presented in chat with options A, A′ and B; the maintainer answered 「21867 同意」, which takes the recommendation, A. Freshness gate: the body (last edited 2026-10-05T11:53Z) and the one comment (triage 5993882228) were re-read before this record; nothing newer exists. ⛔ Classes, positions and functions only; the withheld detail (RUNNER rule 2) stays in the holding session and is not on this record.

The ruling

A — mask at the source: the record-change trigger builds the flow's trigger record already masked. RecordChangeTrigger.buildContext (packages/triggers/trigger-record-change/src/record-change-trigger.ts, the one place the flow's record and previous are built from the engine hook's ctx.result / ctx.previous) projects both through the one helper PR #21816 landed and PR #21866 reused — omitInternalFieldsFromWriteResponse (@objectstack/core, packages/core/src/utils/internal-write-response.ts:169-204), with the object definition of the trigger's object — so credential-class fields carry SECRET_MASK (or null when unset) and internal: true fields are omitted. Everything downstream inherits it without a second copy: the variables map (record, $record, previous, service-automation/src/engine.ts:12463-12469), SuspendedRun.context (record / previous, packages/spec/src/contracts/automation-service.ts:26-33), the persisted variables_json / context_json (suspended-run-store.ts:988-990), the /automation/:name/runs/:runId answer and the /data/sys_automation_run columns, and the run a flow resumes with, in-process and after a restart alike.

• Not taken. A′ (mask only at persistSuspendedRun): the in-memory SuspendedRun and the rehydrated one would differ, and the live flow would still hold clear values before the pause. B (declare the run-state read grant covers the values): keeps the last store of security(data): credential-class field values reach record-change consumers (event payloads and the records downstream features keep from them) unmasked — detail withheld pending maintainer #21830's class in clear for every holder of sys_automation_run read, and variables_json is a plain readable column.
• finding: the whole /automation read domain is gated only by "authenticated" — run-detail returns the triggering record's fields without that record's own FLS #7900 stands, untouched. Its ruling (5264128844) rejected per-field FLS filtering of the variables map because the map's keys are not decidably record fields. This ruling filters nothing by field-level security: it applies the type-based credential mask (ADR-0100; isMaskedOnReadFieldType, packages/spec/src/data/masked-field-types.ts:116) to the two record-shaped entries of a known object, and leaves every other variable as it is.
• One rule, one helper. ⛔ No second mask, no mask in service-automation or in the store; the trigger is the record-change consumer that masks, as the engine's publish, the approval snapshot, the webhook body and the knowledge document do after PR fix(data): record-change payloads apply the write-response credential mask and internal-field omission #21866 (merged 2026-10-05T12:47Z).

Settled in the same stroke:

• Clause-②: no. No Zod or ADR-0100 table change. A flow author's visible value changes (a credential-class field read off the trigger record is now the mask), so the changeset carries the ! banner, FROM → TO and the one-line handling, and an ADR-0087 semantic entry, sibling of 18.by-id-write-unreadable-row-not-found.ts, carries the changed answer to the upgrade guide: a flow that needs a credential uses a privileged binder, never the trigger record (ADR-0100 A, "privileged read").
• Execution parameters. This card continues (no new card): needs-user-decision → pm:queue; domain:services, priority:p2, security, area:access stay. At-tier contract review before landing (security boundary). The PR text stays at classes and positions. The claiming seat obtains the withheld consumers and mechanism from the holding session session_018zT8d8NpiQ1ExhuNd5TxY6 on this word; ⛔ the detail goes on neither the card nor the PR.
• Pins. On a flow paused after a record-change trigger on an object with a secret and a password field: the paused row's variables_json and context_json carry SECRET_MASK for both and omit internal: true fields; GET /automation/:name/runs/:runId shows the same; a node after the pause reading record.<credential field> sees the mask, in-process and after a restart; a node reading an ordinary field sees its value; a privileged resolveSecret path is unchanged; the QA path "approvals and automation — flows run: errors, pauses and schedules" gains the item triage named as missing.

Premises the dev verifies before writing (third-tier ruling: a failed premise is reported as fork on this card — do not force A, do not fall back to A′ or B silently)

1. The object definition is reachable in buildContext. The trigger already materialises the record over the object's declared fields (materializeDeclaredFields, since #4649 的「记录对已声明字段全量」只落在两个接缝上 —— 另外三处求值仍是稀疏绑定 #4953), so the definition is in hand or one registry read away. Re-check: git grep -n "materializeDeclaredFields\|hydrateComputedFields" origin/main -- packages/triggers/trigger-record-change/src/record-change-trigger.ts.
2. The projection is the last overlay. buildContext layers ctx.result over the prior row and re-reads computed fields; the mask must be applied after the last overlay so no later layer re-introduces a clear value. Re-check: read buildContext from record-change-trigger.ts:333 to its return.
3. No shipped flow reads a credential-class field off its trigger record. Re-check: git grep -n -E "record\.(.*)(password|secret|api_key|token)" origin/main -- 'examples/**/*flow*' 'examples/**/flows/**'; a hit is a fork, not a reason to leave that field clear.
4. Only the trigger's own record enters here. Records a flow reads later through get_record / CRUD nodes come through the engine's generic read path and are masked by ADR-0100 already; nothing in this ruling touches those nodes. Re-check: packages/services/service-automation/src/builtin/crud-nodes.ts:438-497.

Readings behind it (each taken this summon at origin/main 9f9510f25e, or marked)

• ADR-0100 A/B/C (docs/adr/0100-credential-field-channels.md:47-115): masked on the generic read path, plaintext only through privileged dereference; the rule declared once in masked-field-types.ts.
• security(data): records-forms.field-type-matrix clause 4 / encrypted-field-behavior N1 (credential-field handling on writes) fail at 316be321e — detail withheld pending maintainer #21787 → PR fix(core): mask credential-class fields on every write response #21816 (a0176efe85, write responses, the helper); security(data): credential-class field values reach record-change consumers (event payloads and the records downstream features keep from them) unmasked — detail withheld pending maintainer #21830 → PR fix(data): record-change payloads apply the write-response credential mask and internal-field omission #21866 (merged, record-change payloads and the stored-snapshot, webhook and knowledge producers; "the engine's own write result is untouched, so privileged in-process callers are unchanged" — which is why the trigger must mask).
• finding: the whole /automation read domain is gated only by "authenticated" — run-detail returns the triggering record's fields without that record's own FLS #7900 ruling 5264128844 and its landing packages/runtime/src/domains/automation.ts:249-300 (run-state reads require the sys_automation_run read grant; "⛔ deliberately NOT a per-field filter of the run's variables map").
• The store: sys-automation-run.object.ts:314-333 (variables_json, context_json: plain textarea columns); suspended-run-store.ts:988-990 (verbatim JSON.stringify); engine.ts:1090-1130 (ExecutionLogEntry.variables, published for paused runs since finding: a suspended flow run's variables are unreadable on run-detail — the paused recordLog omits them while the continuation keeps them #7639) and :1462-1490 (SuspendedRun).
• The source: record-change-trigger.ts:333-345 — "The new record comes from ctx.result (after-hooks) … the old record from ctx.previous".
• Default grants: default-permission-sets.ts names sys_automation_run nowhere (0 hits); who holds its read grant is deployment-specific — unverified this summon.
• Prior rulings read: variables map, run state, credential, mask, secret field, paused run, automation run, internal field → 13 hits; ADR-0100 §A/B/C (the rule itself), ADR-0106 D1 (FLS masking, not this), ADR-0128 D1 (unrelated); finding: the whole /automation read domain is gated only by "authenticated" — run-detail returns the triggering record's fields without that record's own FLS #7900 (FLS per-field filtering rejected, not touched); thread: none before this record.
• Not verified this summon: premises 1–4 (the dev's first act); the withheld detail (not read by this seat; the positions above are read by class); the objectui console does not render a run's variables at origin/main (grep found none), so the read surfaces are the two doors named.

四棱(本裁决新记录)

• ① 长远:密钥离开引擎的每条通道都遮掩,流程是记录变更消费者之一;A 把流程并入 fix(core): mask credential-class fields on every write response #21816/fix(data): record-change payloads apply the write-response credential mask and internal-field omission #21866 已收拢的一条规则,缩小特例。
• ② 拉动:零用户报告;security(data): credential-class field values reach record-change consumers (event payloads and the records downstream features keep from them) unmasked — detail withheld pending maintainer #21830(p1)类别的最后一个存储,列为普通可读。
• ③ 防 AI:AI 写的流程不可能再把 record.<密钥字段> 静默送进 HTTP 节点。
• ④ 不扩散:不加键、不加门、不加第二个助手;A′ 反而加一种状态分叉。
• 只看①选 A;②③④ 是否翻转:否。

---

Generated by Claude Code

[objectstack-fleet]

Ruled, recorded by the PM seat from the maintainer's answer in Claude Code session session_018zT8d8NpiQ1ExhuNd5TxY6, 2026-10-05: when a paused run's state is persisted, mask credential-class fields in the trigger record and its previous values with the same helper PR #21816 introduced. Do not filter the variables map per field, which keeps this consistent with #7900. Chosen option 「持久化时遮盖凭据字段」. The withheld detail stays withheld (RUNNER rule 2); the dispatching session holds it.

---

Generated by Claude Code

[objectstack-fleet]

Alignment note from the PM seat (session_018zT8d8NpiQ1ExhuNd5TxY6). My ruling note above (6005739672) and the director's ruling (5995381726) record the same answer from the maintainer: mask credential-class fields, with no per-field filtering of the variables map. Where the two differ on where the mask is applied, the director's ruling governs. The mask is applied at the source: RecordChangeTrigger.buildContext projects record and previous through omitInternalFieldsFromWriteResponse. Persisted run state inherits the mask, so a separate mask at persistence time (option A′) is not added. This card is dispatched on that ruling, including its premises and pins.

---

Generated by Claude Code

[objectstack-fleet]

Claim: PM loop round 1 (17.7 pre-release follow-up, dispatched on the maintainer's direct order)
Session: session_018zT8d8NpiQ1ExhuNd5TxY6
Account: hotlong (the seat's linked user as GET /user answers it; always the card's assignee)
Branch: claude/issue-21867-run-state-trigger-record-mask
Worktree: objectstack-issue-21867
Domain: domain:services (card label, as triage set it)
File surface: packages/triggers/trigger-record-change/src, packages/spec/src/migrations (ADR-0087 semantic entry), docs/qa/platform-checklist/ (the missing item), .changeset/
Container & model: M, mode:subagent, model: opus (default tier; no path-derived mandate)
Clause-②: no
Thread-read: 6005739672
Serial constraints cleared: none named

Provenance: the maintainer, in Claude Code session session_018zT8d8NpiQ1ExhuNd5TxY6, 2026-10-05, verbatim: 「持久化时遮盖凭据字段 (推荐)」, which matches the director's ruling A (5995381726, 「21867 同意」); dispatch per 「只有不能公开的才需要你派发处理」. This card withholds detail; this session holds it, and the dispatch carries it privately.

---

Generated by Claude Code