Repository navigation
cli: os migrate entry point for the plugin-audit key-material ledger-copy rewrite (the remaining half of #26640) #26687
Description
Part of #26640 — its remaining half, split off at review of #26683.
Filing gate: ③ a maintainer-directed task — the security card #26640 was dispatched on the maintainer's word; its writer half lands in #26683, and this card carries the half that PR's file surface could not reach.
Business reason: #26683 stops new ledger copies from carrying the listed columns and exports the at-rest rewrite of copies written before it (migrateKeyMaterialCopies, migrateArchivedKeyMaterialCopies in @objectstack/plugin-audit). Nothing runs that rewrite yet, so copies written before the release keep the columns until an operator can run it.
Reader: the seat owning packages/cli (the os migrate family).
Dedupe (open AND closed): "os migrate key material ledger copy rewrite" — none; the precedent is os migrate audit-mail-bodies.
Done when
- An
os migratesubcommand drivesmigrateKeyMaterialCopies(hot tables) andmigrateArchivedKeyMaterialCopies(the archive datasource), dry by default,--applyto write, exit non-zero when the report counts a failure — mirroringos migrate audit-mail-bodies. - The command is registered in the one-shot family pin (
schema-migrate.one-shot-family.integration.test.ts) and has a dogfood case, as the precedent does. - The upgrade guide names the command beside the release that ships it.
- ⛔ Disclosure discipline: security(plugin-audit): a sys_secret confidentiality gap, observed beside the 18.2.0 wave-2 clauses — detail withheld pending maintainer #26640 is withheld pending maintainer. Command help, docs, changeset and PR text describe the rewrite neutrally ("removes encrypted key-material columns from ledger copies"); no reproduction, door or capability name.
Generated by Claude Code
Activity
objectstack-fleet commentedon Oct 27, 2026
Triage: first grade —
tooling·security·priority:p1·domain:server·area:access·pm:queue· triage seat ·session_01AavokzJ5DndAwitDXvKy4U· 2026-10-27T13:05Z⛔ Not a claim, ⛔ not a dispatch.
security: the remaining half of the security card security(plugin-audit): a sys_secret confidentiality gap, observed beside the 18.2.0 wave-2 clauses — detail withheld pending maintainer #26640. fix(plugin-audit): the compliance ledger keeps no copy of secret-store key material #26683 stops new ledger copies from carrying key material, and this card gives operators anos migrateentry that rewrites the copies written before. Until it ships, old copies keep the material at rest. Wire the exportedmigrateKeyMaterialCopiesbehind a plan /--applypair, the way the other migrate entries are. ⛔ Disclosure (skills: five principle gaps the #9296 wave exposed in checklist-test / checklist-author / dogfood-verification #9387): the PR describes the rewrite, not where the material sits.Generated by Claude Code
objectstack-fleet commentedon Oct 27, 2026
Claim: PM loop round 2 · 2026-10-27T14:25Z
Session:
session_012YjcDon6BvR9MN93ZsFq3UAccount:
os-justinBranch:
claude/issue-26687-migrate-key-materialWorktree:
objectstack-issue-26687Domain:
domain:serverFile surface:
packages/cli/src/**andpackages/cli/test/**;packages/qa/dogfood/test/**(one new case);content/docs/deployment/cli.mdx;content/docs/upgrading.mdx(one line, the release that ships the command); one changeset (stop on breach; explain in the report)Container & model:
M,mode:subagent(disclosure-discipline card: the parent's detail stays in-seat),model: default (dispatch-gates --tier: no path-derived mandate),effort: highClause-②: no
Metadata-protocol: none
Responsibility:
n/a — not a defect cardThread-read: 6442617183
Premise: holds
Serial constraints cleared:
#26683 (merged, e744244598) — the runners this card wires; no in-flight claim or open PR on packages/cli/src/commands/migrate/**Dispatched on the maintainer's word in the wave-2 session (2026-10-27), verbatim: 「26687 派卡修复」. Disclosure discipline of #26640 applies: the PR, changeset, command help and docs describe the rewrite neutrally.
Generated by Claude Code
objectstack-fleet commentedon Oct 27, 2026
os-dev-report
{
"issue": 26687,
"status": "done",
"branch": "claude/issue-26687-migrate-key-material",
"pr": "#26772",
"session": "session_012YjcDon6BvR9MN93ZsFq3U (subagent run; the parent PM session id)",
"premise_still_valid": true,
"summary": "Added
os migrate audit-key-material, which drives plugin-audits migrateKeyMaterialCopies (hot sys_audit_log / sys_activity) and migrateArchivedKeyMaterialCopies (the archive datasource sys_audit_log declares). It mirrorsos migrate audit-mail-bodiesflag for flag (dry run default, --apply, confirmation prompt, --yes, --force, --json), with the same one-shot exit (non-zero on any counted failure or an unexamined archive) and JSON-only stdout. The archive-target classification (examined / none / not-connected / unknown) moved unchanged out of audit-mail-bodies.ts into packages/cli/src/utils/ledger-copy-archive.ts, so both commands share one implementation; audit-mail-bodies--json document keeps the same keys and order. Registered at every audit-mail-bodies site (one-shot family table, absent-database roster with two control rows, stdout-purity family, confirmation-exit roster, schema-migrate.ts composeDeclaredDatasources docblock), plus a new archive integration test, a dogfood case over the 18.0 fixture, docs (cli.mdx row and section, one upgrading.mdx line naming 18.2.0 or earlier) and a @objectstack/cli patch changeset with Clause-②: no / Metadata-protocol: none. No site was skipped.","tests": "Head f75fee2. cli typecheck (tsc plus check:test-typecheck) and build: lock VERDICT command-exit 0. CLI unit tier
vitest run --project unit --maxWorkers=2: Test Files 339 passed (339), Tests 4927 passed (4927). CLI integration, the 4 touched files (audit-key-material.archive, audit-mail-bodies.archive, data-commands.absent-database, schema-migrate.one-shot-family): Test Files 4 passed (4), Tests 180 passed (180). json-stdout-purity.e2e (nightly tier, OS_TEST_TIERS=nightly): Tests 71 passed (71). migrate-confirmation-exit.pin: 36 passed incl. both audit-key-material cases. Dogfood audit-key-material: 4 passed (4), 9.6 s; key-material archive integration: 8 passed (8), 36.9 s, shared box. Ablation (fix committed first, scripts/ablation-replace.mjs run mode with restore trap): (A) runners swapped for the mail-body runners, anchor 1 to 0, blob 370c0585 to d3752c2d; archive integration 4 failed / 8 (cases 1-4); cli rebuilt, ablation-dist-preflight found the marker in dist/commands/migrate/audit-key-material.js; dogfood 2 failed / 4. (B) default export removed: confirmation pin 3 failed / 36; a first B attempt was refused by the tool before running (replacement was a substring of the original line, so not countable) and was re-run with a countable marker. Restore: blob == HEAD 370c0585, git status --porcelain empty; cli rebuilt, --absent preflight clean over 704 built files; dogfood 4/4 and archive 8/8 green again.","gates": "Local:
node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commandsderived 93 commands at f75fee2; all 93 run, exit captured before any pipe, final exit 0 each. Three first exited 3 (PREREQUISITE NOT MET, nothing measured: spec check:skill-examples, check:dual-build-cjs-loads, check:i18n-coverage, which read dist of packages outside the cli closure); after those packages were built they re-ran with exit 0.dispatch-gates --ranover the exit-coded record: 93 derived, 93 run, 0 NOT-MEASURED (a derived zero). check-platform-checklist.mjs and its watchdog: exit 0. PR #26772 check-runs at report time: all in_progress (Check Changeset, Lint x8 lanes, Type Check x4 lanes, Governed Surface Queue Guard, PR-body guards, Spec property liveness, Check PR Size, docs links); 18.x upgrade harness and Packed-tarball smoke skipped (opt-in). Test Core / Build Core / UI contexts not yet reported. Not read: CI verdicts; convergence is the PMs.", "dogfood_battery": "n/a: no!in the PR title and no (narrowing) arm (Clause-②: no)", "mcp_calls": "0", "api_writes": "2 relay strokes: (1) fleet-write pr_create to POST /repos/objectstack-ai/objectstack/pulls (draft) + POST /repos/objectstack-ai/objectstack/issues/26772/assignees; (2) this os-dev-report comment via scripts/pm/post-stamped.mjs to POST /repos/objectstack-ai/objectstack/issues/26687/comments. Plus 3 git pushes (not REST). No labels written: none named by the dispatch, and the diff carries a changeset.", "open_questions": [], "out_of_scope_findings": [ "class: none (checklist enumeration drift, not filed) · carrier: PM / checklist-author seat · evidence: docs/qa/platform-checklist/areas/cli.json item cli.migrate-plan-apply-json lists 19os migrate` subcommands as variants and its source note says 19; with audit-key-material the tree has 20. Left unedited as dispatched; check-platform-checklist.mjs and the watchdog both exit 0, so no gate reads the count · dedupe words: migrate-plan-apply-json variants, audit-key-material checklist, migrate subcommand count"]
}
Generated by Claude Code
objectstack-fleet commentedon Oct 27, 2026
Landed ·
session_012YjcDon6BvR9MN93ZsFq3U· 2026-10-27T15:55Za5df0942e1origin/maina5df0942e1gh-readonly-queue/main/*ref left for #26772completedby the PR'sFixes;pm:dispatchedremoved nowParent #26640 now has both halves on
main(#26683, #26772) and is closed with its own landed record. Follow-up the seat files next: a checklist item that enumerates theos migratefamily now under-counts it by one.Generated by Claude Code