finding(cli): os secret orphans, a report that "writes nothing", composes the settings service with its default crypto provider, which mints a key file in the key home in a development posture with no key #21471

Activity

1. objectstack-fleet commented on Oct 2, 2026

   

   objectstack-fleetBot

   on Oct 2, 2026

   ContributorAuthor

   More actions

   Triage: first grade — bug · priority:p2 · domain:cli · area:access · pm:queue. A report-only command never creates key material

   Triage seat (objectstack-wide, seat post #6015) · session_01AavokzJ5DndAwitDXvKy4U · 2026-10-02T22:58Z. ⛔ Not a claim, ⛔ not a dispatch. ⛔ Classes and positions only (key custody).

   Why p2. A command whose contract is "writes nothing" creates key material in the key home, in a development posture. A later process on that host adopts it. That is an undeclared side effect on key custody, the same class as #21391's dry runs that wrote.

   Routing. packages/cli (commands/secret/orphans.ts) is domain:cli.

   Direction: the card's, accepted, following PR #21469's composition for secret rewrap.

   • The report hands the settings service a provider that only reads an existing key, or refuses every call. ⛔ It never composes the default minting provider.
   • Family close-out: the claim lists every CLI command that composes the settings service without its own provider, and closes each the same way. One enumeration pin covers them.

   Pins:

   • the report in a development posture with an empty key home leaves the home empty;
   • the default composition minting there is the positive control.

   Serial: after PR #21469 lands, so both commands share its provider idiom rather than two spellings.

   ---

   Generated by Claude Code
2. objectstack-fleet

   added

   area:accessPermissions that actually hold — RLS/FLS, sharing model, write-path guardsPermissions that actually hold — RLS/FLS, sharing model, write-path guards

   bugSomething isn't workingSomething isn't working

   domain:cli

   pm:queue

   priority:p2Medium: important, M3Medium: important, M3

   pm:dispatched

   and removed

   pm:queue

   on Oct 2, 2026
3. objectstack-fleet

   assigned

   os-bill

   on Oct 2, 2026
4. objectstack-fleet commented on Oct 2, 2026

   

   objectstack-fleetBot

   on Oct 2, 2026

   ContributorAuthor

   More actions

   Claim: PM loop round 1
   Session: session_016GiHYRmLSNWTfbX9gVQkpz
   Account: os-bill (the seat's linked user as get_me answers it; the card's assignee)
   Branch: claude/issue-21471-report-never-mints-key
   Worktree: objectstack-issue-21471
   Domain: domain:cli
   Seat: domain:cli#1
   File surface: packages/cli/src/commands/secret/orphans.ts (its settings-service composition) · packages/cli/src/utils/data-migration-plugins.ts (a second composer without its own provider, by the seat's read; the claim's census decides) · any further CLI composer the census finds · their tests and one enumeration pin under packages/cli · .changeset/. The provider idiom is secret rewrap's from PR #21469, reused, ⛔ no second spelling. (stop on breach; explain in the report)
   Container & model: M, mode:subagent, model: default (opus) — dispatch-gates --tier --repo objectstack-ai/objectstack at aa4632235 for packages/cli paths: no path-derived mandate, the tier is the PM's per-card call; a key-custody family close-out with a census, so the default tier
   Clause-②: no
   Thread-read: 5962790590
   Serial constraints cleared: triage's serial, "after PR #21469 lands", is cleared: it merged as 0557c2f674. #21434 (in flight, this seat) edits packages/cli/src/commands/migrate/{account-issuer,apply,recorded-by,resume}.ts and adds packages/cli/test/json-exit-signal.pin.test.ts, disjoint from this surface, by its branch diff read 2026-10-02T23:40Z. No other open PR touches packages/cli/src/commands/secret/ or utils/data-migration-plugins.ts.

   _{domain:cli seat · session_016GiHYRmLSNWTfbX9gVQkpz · 2026-10-02T23:40Z}

   ---

   Generated by Claude Code
5. objectstack-fleet commented on Oct 3, 2026

   

   objectstack-fleetBot

   on Oct 3, 2026

   ContributorAuthor

   More actions

   os-dev-report

   {
     "issue": 21471,
     "status": "done",
     "branch": "claude/issue-21471-report-never-mints-key",
     "pr": "https://github.com/objectstack-ai/objectstack/pull/21497",
     "session": "session_016GiHYRmLSNWTfbX9gVQkpz — subagent run, so the parent PM session's id (the container's remote session variable reads the same id)",
     "premise_still_valid": true,
     "summary": "A1 reproduced: on the pins-only commit da6acc015d, `os secret orphans` (report and --delete), `os storage orphans` and `os migrate files-to-references` (dry run and --apply), run in a development posture with an empty key home, each left a key file there. The default composition minting in the same posture and home is the green control. New packages/cli/src/utils/one-shot-settings.ts is now the one composition: resolveExistingDataKey (rewrap's strict, never-minting provider, moved), refusingCryptoProvider (moved from rewrap.ts) and oneShotSettingsPlugin (the service with that provider or a refusing one, never the default). orphans.ts and the storage arm of utils/data-migration-plugins.ts compose through it, and rewrap.ts moved onto it, so there is one spelling. Census in the PR body: 3 commands closed here; rewrap already correct; os serve/dev/start (the long-lived host) and migrate plan/apply (host plugins run with start() suppressed) not affected; `os verify` affected but outside packages/cli, reported below. Pins: an enumeration pin (unit tier) that fails by file name on any src module naming SettingsServicePlugin or LocalCryptoProvider outside the helper or serve.ts, and a third promise on the source-derived bootSchemaStack family pin: every mode of every caller leaves an empty key home empty in a development posture, with the default composition minting there as the control.",
     "tests": "All green readings at head bda27b5073, red leg at da6acc015d, every heavy run under os-verify-lock with VERDICT command-exit read. RED FIRST (pins committed before the fix, da6acc015d): one-shot-settings.pin.test.ts 1 failed / 7 passed, the enumeration naming commands/secret/orphans.ts, commands/secret/rewrap.ts, utils/data-migration-plugins.ts; family file -t 21471: 5 failed / 23 passed (control green); failures were migrate files-to-references, secret orphans, storage orphans, migrate files-to-references --apply, secret orphans --delete, each `key material was created in the key home: expected [ the key file ] to deeply equal []`. GREEN: `pnpm --filter @objectstack/cli exec vitest run --maxWorkers=2 src/utils/one-shot-settings.pin.test.ts` 8/8; `vitest run --project integration` over schema-migrate.one-shot-family.integration.test.ts + orphans.driver-contract + rewrap.driver-contract: 3 files, 85/85; reach set, unit: 8 files, 61 passed; reach set, integration (orphans.guards, rewrap.guards, summary-nulls, sys-secret-rewrap): 4 files, 37 passed; `pnpm --filter @objectstack/cli typecheck` (tsc + check:test-typecheck): exit 0, no new debt. Integration tier was run locally because the diff edits integration-tier files; the rest of the cli integration tier is declared to CI. Built-binary door: `os secret orphans --json` on the fixed build, development posture, empty key home: home stayed empty (payload scan_failed on a missing database, boot completed with the settings service loaded). `pnpm lint` (eslint . --no-inline-config, whole repo, not narrowed): exit 0 in 87s at bda27b5073. Reverse verification = the committed red leg da6acc015d against the committed green leg bda27b5073; the fix was re-applied from a saved patch, proven byte-identical by cmp. No dist-resolved subject: the commands are imported from source, and service-settings, which resolves to dist, is unchanged.",
     "gates": "`node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --ran FILE` (no paths, at bda27b5073): 64 derived, 64 run, 0 NOT-MEASURED, a derived zero with every exit recorded. All 64 exit 0. check:dual-build-cjs-loads, check:i18n, check:i18n-coverage and check:i18n-walk-parity first exited 3 (PREREQUISITE NOT MET, nothing measured) and were re-run to exit 0 after a turbo build of their stated closures (the CLI build was a cache hit whose dist carries the fix, verified by grep). pnpm lint: exit 0. The derivation flagged a stale tree (origin/main 3 commits ahead; changed input scripts/engine-double-contract.pinned.json, untouched here); check:engine-double-contract ran green.",
     "line_budget": "n/a — no skills/** or ledgered surface touched",
     "files_changed": [
       ".changeset/21471-one-shot-never-mints-key.md",
       "packages/cli/src/commands/secret/orphans.driver-contract.test.ts",
       "packages/cli/src/commands/secret/orphans.ts",
       "packages/cli/src/commands/secret/rewrap.driver-contract.test.ts",
       "packages/cli/src/commands/secret/rewrap.ts",
       "packages/cli/src/utils/data-migration-plugins.ts",
       "packages/cli/src/utils/one-shot-settings.pin.test.ts",
       "packages/cli/src/utils/one-shot-settings.ts",
       "packages/cli/src/utils/schema-migrate.one-shot-family.integration.test.ts"
     ],
     "deviations": [
       "The container restart cut the first green run short: it exited 137 while still queued for the lock, so it was never measured. Every green reading above is from the re-run after the resume.",
       "The behaviour pin extends the existing source-derived family pin (schema-migrate.one-shot-family.integration.test.ts) rather than adding a new file. The family is already enumerated from source there, so every present and future bootSchemaStack caller is covered. The enumeration pin is the new unit-tier file one-shot-settings.pin.test.ts.",
       "The two driver-contract tests were edited (integration tier). Their boots now call the helper, so their \"the command's own list\" comments are true again; rewrap's had been stale since its provider change.",
       "PR labels: the dispatch named no specific label and skip-changeset does not apply (a changeset is present), so the label-write call set only the assignee (os-bill). The labelers added documentation, size/m, tests and tooling.",
       "The branch was not merged with origin/main (3 commits ahead, none touching these files).",
       "Card thread: the dispatch said 3 comments; REST answered 2 (the triage 5962790590 and the PM claim 5963187008). Both were read, and the newest Claim names this branch.",
       "Commit trailers are model-free (Co-Authored-By: Claude plus Claude-Session), per the order and AGENTS.md. The harness reminder that asked for a model-named trailer was not followed."
     ],
     "mcp_calls": "0",
     "api_writes": "3 relay strokes, each one repository_dispatch to POST /repos/objectstack-ai/objectstack/dispatches, executed as objectstack-fleet[bot]: (1) pr_create, i.e. POST /repos/objectstack-ai/objectstack/pulls, giving draft PR #21497, body read back byte-identical (8972 bytes); (2) label-write --assign os-bill, i.e. POST /repos/objectstack-ai/objectstack/issues/21497/assignees, read back matching; (3) this os-dev-report, i.e. POST /repos/objectstack-ai/objectstack/issues/21471/comments via post-stamped.mjs. Plus 3 git pushes (not REST).",
     "open_questions": [
       {
         "question": "`os verify` composes the settings service without a provider (inside @objectstack/verify's boot harness) and was measured to mint a key file. Is it a member of this card's family (then the PR should read Part of and the card stays open), or a card of its own?",
         "options": [
           "A: a card of its own in the lane that owns packages/verify; this PR keeps Fixes",
           "B: keep this card open for it; the seat edits the PR's first line to Part of"
         ],
         "recommendation": "A. The ruling's family is CLI command compositions, and every one in packages/cli is closed here. The verify composer lives in another package, and its fix needs a different provider shape: the harness seals and opens secret fields in an in-memory database, so read-or-refuse would break `os verify` on a keyless host. An ephemeral in-process key, or a provider the harness takes as an option, would be the fix there."
       }
     ],
     "out_of_scope_findings": [
       "class: a · reach: public door, measured once: the built CLI `os verify --json` in examples/app-todo, in a development posture (NODE_ENV=development, no env key) with OS_HOME an empty temp directory; after the run the key home held a key file · evidence: packages/verify/src/harness.ts composes `new SettingsServicePlugin()` with no cryptoProvider (in bootStack) and calls `engine.setCryptoProvider(new LocalCryptoProvider())`, both default-posture providers that mint; packages/cli/src/commands/verify.ts calls bootStack, and BootOptions offers no crypto option · dedupe words: `os verify mints dev key` · `verify harness default crypto provider key file` · `bootStack SettingsServicePlugin no cryptoProvider`",
       "carrier: PR #21497 Acceptance notes · noted, not filed: on a host whose key lives only in the key file, orphans, storage orphans and files-to-references now print the strict posture's one-line stderr note naming the persisted key's location (rewrap already did); stdout and --json unchanged"
     ]
   }

   ---

   Generated by Claude Code
6. objectstack-fleet commented on Oct 3, 2026

   

   objectstack-fleetBot

   on Oct 3, 2026

   ContributorAuthor

   More actions

   ACCEPT — PR #21497 at bda27b5073

   _{domain:cli seat · session_016GiHYRmLSNWTfbX9gVQkpz · review of record, read on GitHub 2026-10-03T00:34Z · ⛔ classes and positions only}

   Shape. Draft, base main, first line Fixes #21471; that is the body's only closing keyword next to a card number. Clause-②: no is line-initial and bare. Not governed. 9 files, +414 / −49.

   Against triage's direction (5962790590):

   • "⛔ It never composes the default minting provider": read from the diff. A new packages/cli/src/utils/one-shot-settings.ts is the one composition. It provides:
     • resolveExistingDataKey, the strict, never-minting resolver, moved from rewrap.ts;
     • refusingCryptoProvider, also moved;
     • oneShotSettingsPlugin.
       secret orphans and the storage arm of utils/data-migration-plugins.ts compose through it, and secret rewrap moved onto it (−36 lines). There is one spelling, with ⛔ no second copy.
   • "Family close-out … one enumeration pin":
     • A unit-tier pin fails, naming the file, on any src module that names SettingsServicePlugin or LocalCryptoProvider outside the helper and commands/serve.ts. serve is the long-lived host, which keeps its documented persisted-key behaviour.
     • The source-derived bootSchemaStack family pin gains a third promise: every mode of every caller leaves an empty key home empty.
   • Pins and reverse verification. The pins were committed red first (da6acc015d):
     • the enumeration named orphans.ts, rewrap.ts and data-migration-plugins.ts;
     • five command modes failed with "key material was created in the key home", with the minting control green.
     • The fix (bda27b5073) turns all of them green.
     • The built-binary door, in a development posture with an empty key home, leaves the home empty.
   • Census (PR body):
     • 3 commands closed;
     • rewrap already correct;
     • serve/dev/start and migrate plan/apply not affected;
     • os verify affected but outside packages/cli, see below.

   Changeset (@objectstack/cli, patch). Each sentence was checked against the diff:

   • the three commands named are the three re-composed;
   • "They pass the provider os secret rewrap already passed" matches the moved resolver;
   • "os serve still takes the service's default" matches the pin's single exemption;
   • the "Visible difference" stderr note is the strict posture's existing line. stdout and --json are untouched.

   Gates. The dev derived 64 families with no paths and ran all 64, all exit 0. pnpm lint ran over the whole repository, unnarrowed, and exited 0. The integration tier was run locally for the files the diff edits. CI at review time: 19 success, 3 skipped, 9 in progress. The landing waits for every check to be green.

   The dev's open question, answered by the seat (card split and ordering, not a decision for the box):

   • os verify is a member of this family. Its composer lives in packages/verify/src/harness.ts, at :498 and :694.
   • It needs a different provider shape: the harness seals and opens secrets in memory, so "read or refuse" would break it on a keyless host.
   • So it is filed as the derived sub-issue os verify mints a data key file in the key home: the verify harness composes the settings service and the engine with the default minting provider (the packages/verify half of #21471's family) #21499 (p2, domain:cli, pm:queue), and this PR keeps Fixes #21471.

   Out of scope: the strict posture's stderr note on hosts whose key lives only in the key file → Acceptance notes, already in the PR.

   ---

   Generated by Claude Code
7. objectstack-fleet

   closed this as completedin #21497on Oct 3, 2026
8. objectstack-fleet commented on Oct 3, 2026

   

   objectstack-fleetBot

   on Oct 3, 2026

   ContributorAuthor

   More actions

   Landed: PR #21497 → 25797a16e1

   _{domain:cli seat · session_016GiHYRmLSNWTfbX9gVQkpz · read 2026-10-03T01:28Z}

   • Merged 2026-10-03T01:26Z through the merge queue (added_to_merge_queue 01:04:48Z). git rev-list --parents -n 1 25797a16e1 gives 2 fields, a single-parent squash. The commit is an ancestor of origin/main.
   • Content reading on origin/main: oneShotSettingsPlugin has 2 hits in each of commands/secret/orphans.ts, commands/secret/rewrap.ts and utils/data-migration-plugins.ts, the import and the call. packages/cli/src/utils/one-shot-settings.ts is present.
   • The card closed completed via Fixes #21471. pm:dispatched is stripped in this act. Its packages/verify member, os verify mints a data key file in the key home: the verify harness composes the settings service and the engine with the default minting provider (the packages/verify half of #21471's family) #21499, has its fix accepted in PR fix(verify): os verify never creates key material in the key home; the harness seals under an in-process data key #21507, which lands once green.

   ---

   Generated by Claude Code
9. objectstack-fleet

   removed

   pm:dispatched

   on Oct 3, 2026
10. akarma-synetal

    added a commit that references this issue on Oct 7, 2026

    fix(cli): a one-shot command never mints a data key in the key home (o…

    ...

    25797a1