[P0] Metadata property liveness audit: ~half of all spec properties are dead; a cluster of security props is parsed-but-unenforced

Summary

A protocol-level audit of every metadata type cross-referenced each schema property's spec definition against its actual consumers (file:line) in the runtime + renderers, to determine (1) does it take effect? and (2) is it necessary/reasonable? Liveness = code consumption, not browser observation.

Result: roughly half of all metadata properties are DEAD — defined in the protocol but read by neither the runtime nor the renderers, so authoring them is a silent no-op. The full evidence (17 per-type reports + cross-type synthesis, each with file:line) is in PR #1864 → docs/audits/ (README.md is the index).

This issue is the umbrella; the checklists below are scoped so they can be split into separate issues/ADRs.

🔴 P0 — Parsed-but-UNENFORCED security props (latent access-control gaps)

Properties that imply a security boundary but enforce nothing. Either enforce or remove — shipping them as-is is a compliance/security liability.

PolicySchema is 100% dead — password complexity, session idle/absolute timeout, forceMfa, IP allow-list (trustedRanges/vpnRequired), audit retention/redaction all parsed, none enforced; not even registered as a metadata type. better-auth (auth-manager.ts:458) runs hardcoded defaults instead → false sense of compliance.
Permission lifecycle ops ungated — allowTransfer / allowRestore / allowPurge omitted from OPERATION_TO_PERMISSION (permission-evaluator.ts:8-16); ownership transfer, undelete, and hard-delete/GDPR purge are not gated by RBAC.
Agent access control is a no-op — agent.permissions / visibility / access never enforced; the chat route hardcodes ['ai:chat','ai:agents'] (agent-routes.ts:109). "Who can chat with this agent" enforces nothing.
Flow runAs never switches execution identity (service-automation engine ignores it) — a flow declaring runAs: system does not elevate/de-elevate.
Object apiEnabled / apiMethods not enforced by REST — an object cannot actually be hidden from the API via these flags.
Action disabled (CEL form) silently ignored — renderers read a non-spec enabled (action-button.tsx:56); the predicate form of disabled has zero consumers.
Role parent dead (team-graph.ts:27 does not walk it) — the documented "managers see subordinates' data" rollup is unimplemented.
SharingRuleSchema disconnected from the live engine — runtime enforces a divergent sys_sharing_rule model (JSON criteria_json, recipient enum user/team/department/role/queue); the spec's CEL condition + role_and_subordinates/guest recipients are never compiled (unparsable CEL → "match nothing").

🔴 P1 — Finish the ADR-0021 analytics migration

Spec moved to dataset+values/dimensions, but renderers/Studio still read the removed legacy shape:

Chart view variant dead-on-arrival — ListView.tsx:1413 / ObjectView.tsx:754 read legacy xAxisField/yAxisFields/aggregation; spec exposes dataset/dimensions/values → a spec-compliant chart renders nothing.
Dashboard renderer + Studio WidgetConfigPanel still author/read legacy object/categoryField/valueField/aggregate while dashboard.zod.ts:153 declares dataset+values required → Studio emits widgets the spec rejects.
Report chart dead on the dataset path; ReportColumnSchema/ReportGroupingSchema/ReportChartSchema are obsolete type-only re-exports.
(Same debt that invalidated the showcase dashboard/report seeds.)

🟠 P2 — Spec hygiene

Naming drift → silent no-ops: field maxLength/minLength/referenceFilters/maxRating; page type→pageType & label→title & visibility; dashboard title vs label; app reads accentColor/badgeVariant/separator not declared in spec; flow http vs deprecated http_request (Studio authors the alias); skill requiredPermissions vs permissions; agent knowledge.{topics→sources}; webhook object→object_name/isActive→active.
Write-only / disconnected metadata: tool metadata is a one-way projection (can't author a working tool as metadata — no implementation/handler field, no executor loads it); EmailTemplateSchema is registered but the runtime reads a differently-shaped sys_email_template; the spec-bridge page/dashboard bridges are orphaned (their exclusive props dead).
Aspirational config (rich spec, zero runtime) — prune or mark experimental: field enhanced-type configs (barcode/qr/slider/rating/color/location) + governance (encryption/masking/audit/dataQuality); object enable/versioning/partitioning/cdc/softDelete/search; agent autonomy (memory/guardrails/structuredOutput/lifecycle, except planning.maxIterations); tool outputSchema; job retryPolicy/timeout; theme spacing/breakpoints/logo/rtl/density; translation messageFormat:'icu' (no ICU engine), supportedLocales, cache; PortalSchema (entire — not registered, no route, no renderer).
Renderer reads UNDECLARED props (inverse drift) — dashboard component/data/rowField/columnField; view ObjectView form-adapter keys; app accentColor/badgeVariant/separator. These break a strict Schema.parse().
Designer authoring gaps (live prop, no Studio editor) — dataset filter/format/derived/dateGranularity; skill triggerConditions (the activation-critical field); flow notify (absent from the static palette).

Healthiest vs worst (from the audit)

Healthiest (near-total liveness): hook, validation.
Worst: policy (100% dead), portal (100% dead), tool (write-only).

Evidence + per-property recommendations: PR #1864, docs/audits/*.md.

🤖 Generated with Claude Code

Split into sub-issues

This umbrella has been decomposed into tracked sub-issues (each links back here, labeled by priority):

🔴 P0 — security enforcement (priority:p0 + security)

[P0][security] PolicySchema is 100% dead — enforce or remove #1882 — PolicySchema is 100% dead — enforce or remove
[security][立项位] M2 权限生命周期(undelete/purge)功能与 allowRestore/allowPurge RBAC 同批建设(evaluator 已 fail-closed,allowTransfer 已 enforced) #1883 — Permission lifecycle ops ungated (allowTransfer/allowRestore/allowPurge)
[P0][security] Agent access control is a no-op (permissions/visibility/access) #1884 — Agent access control is a no-op (permissions/visibility/access)
[P0][security] Flow runAs never switches execution identity #1888 — Flow runAs never switches execution identity
[P0][security] Object apiEnabled/apiMethods not enforced by REST #1889 — Object apiEnabled/apiMethods not enforced by REST
[P0][security] Action disabled (CEL form) silently ignored #1885 — Action disabled (CEL form) silently ignored
[P0][security] Role parent dead — manager-rollup unimplemented #1886 — Role parent dead — manager-rollup unimplemented
[P0][security] SharingRuleSchema disconnected from the live engine #1887 — SharingRuleSchema disconnected from the live engine

🔴 P1 — analytics (priority:p1)

[P1] Finish ADR-0021 analytics migration (chart view / dashboard+Studio / report) #1890 — Finish ADR-0021 migration (chart view / dashboard+Studio / report)

🟠 P2 — spec hygiene (priority:p2)

[P2] Naming drift → silent no-ops (spec key ≠ consumed key) #1891 — Naming drift → silent no-ops
[P2] Write-only / disconnected metadata (tool, email, sharing, spec-bridge) #1892 — Write-only / disconnected metadata
[P2] Aspirational config — prune or mark experimental #1893 — Aspirational config — prune or mark experimental
[P2] Inverse drift — renderers read undeclared props #1894 — Inverse drift — renderers read undeclared props
[P2] Designer authoring gaps (live prop, no Studio editor) #1895 — Designer authoring gaps (live prop, no Studio editor)

The audit's suggested 3-ADR grouping maps to: Security enforcement (the P0 set), Finish ADR-0021 (#1890), Spec hygiene (the P2 set).

Staged plan for the P0 security cluster — ADR-0049

Decision recorded in ADR-0049 (docs/adr/0049-no-unenforced-security-properties.md): a spec property naming a security boundary must be enforced, explicitly experimental, or absent — never parsed-but-silently-unenforced (that's a false sense of compliance).

Given the platform's pre-MVP stage, the cluster splits by whether the feature already exists — we do not build enforcement for features that don't exist yet:

Disposition	Items	Action now
Feature absent → mark `experimental` / remove	#1882 Policy · #1883 lifecycle bits · #1887 SharingRule (spec form) · #1888 flow `runAs`	stop the spec from promising; re-introduce with the feature at M2
Feature live, gate missing → enforce	#1884 agent access · #1889 object apiEnabled · #1885 action disabled	localized route/renderer check now
No-regret correctness fix	evaluator fail-open	fail CLOSED for destructive ops

Deferred to M2 (feature + enforcement together): #1882 Policy, #1887 SharingRule, #1888 flow runAs, #1886 role parent.

P0 security: enforce-or-remove unenforced security props (ADR-0049) (#…

docs(spec): mark feature-absent security props EXPERIMENTAL — Policy,…

Closing the umbrella — audit delivered, disposition fully split out

The audit this issue tracked is done and has been operationalized into a standing system, and every checklist item has been split into its own labeled, independently-tracked sub-issue. Keeping this umbrella open now only duplicates that tracking, so closing it.

What the audit became (standing system, not a one-off)

Spec-liveness gate — packages/spec/liveness/*.json ledgers + packages/spec/scripts/liveness/check-liveness.mts, wired as the blocking Spec property liveness CI check. Every authorable property of 10 governed types is classified live/experimental/dead with evidence; the ratchet blocks new undeclared surface. This is the living source of truth that replaces the static audit docs.
Cross-repo correctness — the original audit missed objectui's metadata-admin authoring layer; a cross-repo re-audit corrected ~25 props dead→live (fix(spec): cross-repo liveness re-audit — 16 props dead→live (objectui authoring UI) #1956 et al.). A monthly drift re-audit cron now catches dead→live drift the completeness gate can't.
Author-side loop closed (feat(cli): liveness author-warning lint — close the spec-liveness loop #1966) — objectstack compile now warns when an author/AI sets a misleading dead/experimental property (enable.feeds, field.columnName, …) with a corrective hint. Measurement → gate → drift-cron → author-prevention.

Shipped against the checklist

✅ Object apiEnabled/apiMethods enforced by REST (feat(rest): enforce object enable.apiEnabled / apiMethods (ADR-0049 #1889) #1937) — enforceApiAccess, 404/405.
✅ Agent access control — already enforced via evaluateAgentAccess at the chat route; ledger corrected (the audit predated it).
✅ Record clone productized — enable.clone was dead; now a real runtime (feat: record clone — wire object.enable.clone to a real runtime #1961), reclassified live.
✅ Aspirational prune (partial) — orphaned recordTypes + cdc removed (chore(spec): cut orphaned object.recordTypes and object.cdc stubs #1960).

Remaining items — each tracked in its own open issue (nothing orphaned)

🔴 P0 security: PolicySchema [P0][security] PolicySchema is 100% dead — enforce or remove #1882 · permission lifecycle ops [security][立项位] M2 权限生命周期(undelete/purge)功能与 allowRestore/allowPurge RBAC 同批建设(evaluator 已 fail-closed,allowTransfer 已 enforced) #1883 · role parent [P0][security] Role parent dead — manager-rollup unimplemented #1886 · SharingRule [P0][security] SharingRuleSchema disconnected from the live engine #1887 · flow runAs [P0][security] Flow runAs never switches execution identity #1888
🟠 P1 analytics migration [P1] Finish ADR-0021 analytics migration (chart view / dashboard+Studio / report) #1890
🟡 P2: naming drift [P2] Naming drift → silent no-ops (spec key ≠ consumed key) #1891 · write-only metadata [P2] Write-only / disconnected metadata (tool, email, sharing, spec-bridge) #1892 · aspirational prune-or-experimental [P2] Aspirational config — prune or mark experimental #1893 · inverse drift [P2] Inverse drift — renderers read undeclared props #1894 · designer authoring gaps [P2] Designer authoring gaps (live prop, no Studio editor) #1895
Action disabled CEL — objectui renderer side.

Closing as completed (deliverable shipped + operationalized); execution continues in the sub-issues above.

chore: bump objectui to a515c8181c76

fix(security): enforce flow runAs execution identity (#1888)

fix(security): enforce flow runAs execution identity (#1888) (#2302)

fix(identity): reconcile managedBy:'better-auth' apiMethods with the …

SharingRule loose end from the recheck (#3503) closed by #3557: authoring ShareRecipientType reconciled with the enforced runtime — group renamed → team (wired to the live TeamGraphService expansion), business_unit added, guest pruned (anonymous access = public-form grant / share links), and the never-enforced owner-type rules removed (return if membership-reactive re-materialisation is designed). Every authorable recipient/rule type now enforces (ADR-0078); proven on a real boot — the migrated showcase rule seeds (ruleCount 4→5) with criteria_json {done:false}. Remaining from the recheck: AuditConfig-cluster prune decision (needs an owner call on dead-vs-roadmap) and per-org IP allow-list (#2571).

feat(spec)!: remove the dead AuditConfig cluster from @objectstack/sp…

feat(spec)!: remove the dead static capabilities-descriptor cluster (#…

2026-07 dead-cluster sweep — disposition record (8 PRs)

Follow-through of the recheck above: the report slice, the security-props cluster, and three chained dead-config clusters are now fully dispositioned. Recording here so triage of the remaining audit sections doesn't re-excavate.

Cluster	PRs	Disposition
Report dead exports (`ReportColumn`/`ReportGrouping` + objectui `SpecReport*` re-exports, `chart.groupBy`, legacy `ReportViewer` chart fallback)	#3488 / objectui#2816 (#3463)	removed; live path = dataset-bound `DatasetReportRenderer`
Report `aria`/`performance` + chart dogfood + stale audit refresh	#3496	pruned; `report.chart` confirmed live (audit's "dead" claim corrected); showcase chart report added
Security-props recheck + ledger fix	#3503, #3506	cluster largely closed (see comment above); `flow-run-as` reclassified enforced
`AuditConfig` cluster (`system/audit.zod.ts`, whole module)	#3593	removed — live audit = plugin-audit always-on capture + `trackHistory` + lifecycle `audit` retention + settings overrides
Static capabilities descriptor (`ObjectQL`/`ObjectUI`/`Kernel`/`ObjectStack`/`ObjectOS CapabilitiesSchema`)	#3605 / objectui#2860	removed — defaults contradicted the live platform (FLS/RLS/audit `default(false)` while enforced); live discovery = `GET /api/v1/discovery` (declared===enforced) + `/.well-known`
Orphaned `FeatureFlagSchema` module (`kernel/feature.zod.ts`)	#3630	removed — protocol home died with #3605; live toggles = `feature_flags` settings manifest + `PUBLIC_AUTH_FEATURES`

Pattern note for the remaining sections (§3 naming drift, §4 aspirational, §5 write-only): these clusters chain — each removal exposed the next orphan (AuditConfig → auditLogging boolean → capabilities descriptor → FeatureFlagSchema). Worth pulling each thread to its end rather than pruning single symbols. All removals shipped as minor per the launch-window policy, each changeset carrying a dead-knob → live-surface migration table.

Next confirmed actionable from the recheck: the objectui action.disabled wire-rename (spec declares disabled CEL; the renderer reads non-spec enabled — authored predicates silently no-op).

docs(audits): recheck the §3 naming-drift list; fix the os doctor loo…

feat(showcase): nav separator + badge specimens; correct the §3 item-…

docs(liveness): stop counting authoring/preview renderers as runtime …

feat(spec)!: remove SkillSchema.permissions — it never gated anything (…

feat(spec): cover all three fold-and-drop aliases, not just `execute` (…

docs(ui): correct the navigation item type count and document `separa…

feat(spec): fail CI when a schema variant is missing from its hand-wr…

docs(permissions,protocol): owner-type sharing rules are rejected at …

fix(spec)!: TimeUpdateInterval retires its three sub-day intervals an…

fix(core,app-shell): the two runtime strings that cite an objectstack…

Navigation Menu

Repository navigation

[P0] Metadata property liveness audit: ~half of all spec properties are dead; a cluster of security props is parsed-but-unenforced #1878

Summary

🔴 P0 — Parsed-but-UNENFORCED security props (latent access-control gaps)

🔴 P1 — Finish the ADR-0021 analytics migration

🟠 P2 — Spec hygiene

Healthiest vs worst (from the audit)

Split into sub-issues

Staged plan for the P0 security cluster — ADR-0049

PR A (no-regret, shipped on branch `fix/p0-unenforced-security-props-1878`)

PR B (next) — real gaps where the feature is live

Deferred to M2/production (heavy, feature + enforcement together)

PRs open for the P0 cluster (ADR-0049)

Closing the umbrella — audit delivered, disposition fully split out

What the audit became (standing system, not a one-off)

Shipped against the checklist

Remaining items — each tracked in its own open issue (nothing orphaned)

25 remaining items

2026-07 dead-cluster sweep — disposition record (8 PRs)

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

[P0] Metadata property liveness audit: ~half of all spec properties are dead; a cluster of security props is parsed-but-unenforced #1878

Description

Summary

🔴 P0 — Parsed-but-UNENFORCED security props (latent access-control gaps)

🔴 P1 — Finish the ADR-0021 analytics migration

🟠 P2 — Spec hygiene

Healthiest vs worst (from the audit)

Activity

os-zhuang commented on Jun 15, 2026

Split into sub-issues

os-zhuang commented on Jun 15, 2026

Staged plan for the P0 security cluster — ADR-0049

PR A (no-regret, shipped on branch fix/p0-unenforced-security-props-1878)

PR B (next) — real gaps where the feature is live

Deferred to M2/production (heavy, feature + enforcement together)

os-zhuang commented on Jun 15, 2026

PRs open for the P0 cluster (ADR-0049)

os-zhuang commented on Jun 16, 2026

Closing the umbrella — audit delivered, disposition fully split out

What the audit became (standing system, not a one-off)

Shipped against the checklist

Remaining items — each tracked in its own open issue (nothing orphaned)

25 remaining items

os-zhuang commented on Jul 27, 2026

os-zhuang commented on Jul 27, 2026

2026-07 dead-cluster sweep — disposition record (8 PRs)

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

PR A (no-regret, shipped on branch `fix/p0-unenforced-security-props-1878`)