A connector auth key drained on save (#28640 ②B) still sits in cleartext at rest in sys_metadata_history snapshots #29484

Activity

1. objectstack-fleet

   added

   findingRecorded observation — held, not dispatchable until the findings triage round grades itRecorded observation — held, not dispatchable until the findings triage round grades it

   on Nov 2, 2026
2. objectstack-fleet commented on Nov 2, 2026

   

   objectstack-fleetBot

   on Nov 2, 2026

   ContributorAuthor

   More actions

   triage#1 · os-zhuang · session_01AavokzJ5DndAwitDXvKy4U

   Path: none

   Triage: p2 · domain:server · needs-user-decision · 2026-11-02T17:03Z

   ⛔ Not a claim.

   • Read fresh. The choice between (a), (b) and (c) is the maintainer's: rewriting stored history is a data change at a security boundary. Routed to domain:server, the history writer, with the domain:spec redaction owner. The maintainer has been told directly. ⛔ Seats add no further detail about stored secrets to this card. Per pm-dispatch(security): one fleet-wide rule for security findings — never a card, never a public mechanism; tracked as a GitHub draft security advisory, fixed by a no-card pm-dispatch order #29111, a security finding's specifics go through the advisory channel, not a public card.

   ---

   Generated by Claude Code
3. objectstack-fleet

   added

   domain:serverDomain lane — seat card indexed by label:pm:seatDomain lane — seat card indexed by label:pm:seat

   needs-user-decisionBlocked on a maintainer decision — do not dispatch; decision cards only, never on a PRBlocked on a maintainer decision — do not dispatch; decision cards only, never on a PR

   priority:p2Medium: important, M3Medium: important, M3

   and removed

   findingRecorded observation — held, not dispatchable until the findings triage round grades itRecorded observation — held, not dispatchable until the findings triage round grades it

   on Nov 2, 2026
4. objectstack-fleet commented on Nov 6, 2026

   

   objectstack-fleetBot

   on Nov 6, 2026

   ContributorAuthor

   More actions

   director#2 · os-tesla · session_01L9qibxdiybU8ehPKBroYE3

   Brief-claimed-by: session_01L9qibxdiybU8ehPKBroYE3 · batch #437 · 2026-11-06T04:58Z

   Director seat (the maintainer's decisions thread). Presented to the maintainer in batch #437 (two items: #29594 customization-pair namespace for shared sys, and #29484 drained connector keys at rest in history snapshots) with the latest analysis on this card as the seat's reading; the maintainer's letter follows in a ruling comment. Rule level only on the security item.
5. objectstack-fleet commented on Nov 6, 2026

   

   objectstack-fleetBot

   on Nov 6, 2026

   ContributorAuthor

   More actions

   director#2 · os-tesla · session_01L9qibxdiybU8ehPKBroYE3

   Ruling: batch #437 item 2 · letter d (c, then b) · maintainer 「29484 同意」 2026-11-06T05:26Z

   Director seat (the maintainer's decisions thread). Presented in batch #437 (brief-claimed here at 6677323648; detailed letter in the project's decision doc, batch 6, rule level). The maintainer answered at 2026-11-06T05:26Z, verbatim: 「29484 同意」 = the seat's recommendation, d = (c) first, then (b).

   What the ruling binds (rule level):

   • (c) first: a sys_metadata_history snapshot written from now on withholds the same undeclared auth keys the [Decision] connector credential follow-ups after #28596: header-value advisory, legacy auth keys at rest, whole-map withholding #28640 ②B save drains from the live row, so no new history row carries such a value. Clause-②: no (narrowing) for what history stores; Metadata-protocol: none; the history read exit (redactStoredMetadataRow(s)) is unchanged.
   • (b) second: a one-time scrub of those keys from existing connector history snapshots. Rewriting stored history is a data change at a security boundary, so it runs in two steps: a read-only count first, reported to the maintainer through the advisory channel (pm-dispatch(security): one fleet-wide rule for security findings — never a card, never a public mechanism; tracked as a GitHub draft security advisory, fixed by a no-card pm-dispatch order #29111), and the rewrite only after his confirmation of that count. Not taken: (a) leave it documented (a security boundary is not bounded by retention); (b) alone (does not stop the next drain from writing history).

   Workload: domain:server (history writer) with the domain:spec redaction owner · 1–2 PRs · S–M · contract review on (c) · the scrub rehearsed on a copy before it runs anywhere.

   Execution: the server lane dispatches (c) with Ruling-ref: naming this comment, the count + scrub script following; ⛔ no stored-secret specifics on this card. Label strokes are the dispatching seat's.