[objectstack-fleet]

Fixes #21081
Clause-②: no

An activity row now serves a parent record's field value only to a reader the security service serves that field unmasked. The full row stays at rest; the redaction is applied at read time, keyed on the reading caller.

Measured first, on a real boot

The measurement used bootStack with the real SecurityPlugin, ObjectQL, SQL driver, REST and auth layers, plus AuditPlugin. One synthetic object carried one field of each class, each tracked on the timeline and each named by a milestone template. Three more synthetic objects each had one label-candidate field, one per class. Rows were written by the CRUD mirror from REST writes. One reader per class was granted exactly what makes its own class apply, and the unmasking reader was the control. Readings stay private to the dispatch. This table gives classes only.

Reader class	Data plane (reference)	Activity rows before (list and by-id doors)	Activity rows after
Field served masked	replaced	stored value in summary, record label and recorded change	absent
Capability-gated field (no mask)	key absent	stored value in summary, record label and recorded change	absent
Field not granted by the reader's sets	key absent	stored value in summary, record label and recorded change	absent
Unmasking reader (control)	stored	stored	stored

In the "after" column, each reader is still served the values of the two other classes. A summary composed only from served fields is kept.

So the card's suspicion is confirmed: the value is served, for all three classes and at every position (tracked-change summary, milestone summary, record label and recorded change). Under the triage's raise rule this is the seat's p1 call; the measurement is in the dev report.

Why read time, not composition time

• The writer composes once, as the system. It cannot know the reader.
• A permission set that withholds a field is runtime state, so composition time cannot even see one of the three classes.
• Read time through the security service's own answer is the shape the approval payload snapshot took for this class (plugin-approvals/src/payload-redaction.ts).
• The fields served unmasked come from the security contract. They are getReadableFields intersected with getQueryableFields, which the contract defines as differing by exactly the masked-for-this-caller fields. Nothing in plugin-audit derives masking.

What changed

• packages/plugins/plugin-audit/src/activity-field-redaction.ts (new) holds installActivityFieldRedaction, a read middleware on the activity stream. It runs on find and by-id reads, under a non-system context.
  • Recorded change: every key the reader is not served is dropped, key by key.
  • Summary and record label: a text cannot be split back into fields, so each one is served whole or dropped whole. The basis is the writer's declaration of which parent fields that text was composed from.
  • The declaration itself: it is bookkeeping and is never served.
  • Projections: a projection that names a text column gets the parent and declaration columns for the read, and they are removed from what is served.
  • Fail closed: an unexpected failure strips the value-bearing columns. A reader the service cannot answer masking for is served no field. The service's own "no answer" passes rows through, as the approval snapshot and the data plane do.
• packages/plugins/plugin-audit/src/audit-writers.ts: each row now declares which parent fields its summary and record label carry.
  • The tracked-change and milestone renderers return the fields they actually rendered, from the same loop that renders the text, so the declaration cannot drift from it.
  • A milestone token can name a field the update never changed, so the change itself cannot answer this; only the renderer can.
  • The record label also returns the field it was read from.
• packages/plugins/plugin-audit/src/activity-read-visibility.ts: parseActivityParentObject is extracted, so both read seams share one definition of the parent a row names.
• packages/plugins/plugin-audit/src/audit-plugin.ts: the redaction is mounted beside the read gate. The security service is resolved on every read, because the security plugin may register later.
• Rows without a declaration:
  • A row in the mirror's earlier shape has text of unknown provenance. Its text is served only to a reader who is served every field of the parent (as the service enumerates them for the system). These rows age out with the stream's retention.
  • Any other row was written by an app, and its text is served as written.
• .changeset/21081-activity-field-values.md: patch.

Outside the claimed file surface, and why

• packages/qa/dogfood/test/activity-field-values.dogfood.test.ts is the per-class pin on a real boot. Only the real security plugin tells a capability-gated field from a field no set grants; a double cannot. This follows the approval precedent's dogfood pin.
• content/docs/permissions/system-context.mdx: the new middleware skips system-context reads, which is one more elevation read site. check-system-context-census requires its row, so it joins the sibling read gate's row, and the counts are regenerated by gen:system-context-census.

Pins

• packages/plugins/plugin-audit/src/activity-field-redaction.test.ts has 19 cases. It uses a real engine, a real SQLite driver and the real AuditPlugin wiring. A security-service double answers both contract members per reader.
  • Masked and not-served readers: values, the summary and record-label drop, and key-by-key narrowing.
  • Preservation: a summary built from served fields is kept, and the other class is still served.
  • Bookkeeping: the declaration is never served.
  • Doors: a projection naming only a text column, and the by-id door.
  • Row shapes: the earlier-shape row, and an app's row served as written.
  • Fail-closed reader, and system reads unredacted.
  • resolveServedFields: its fail-closed branches.
• packages/qa/dogfood/test/activity-field-values.dogfood.test.ts has 10 cases: three per class plus the control.
  • The scene is armed in beforeAll before anything is believed. The rows at rest carry every class, and the data plane serves each reader its class as the class says.
• No test title states a value.

Ablations (lane commitment: every negative pin)

• Tooling: each leg goes through scripts/ablation-replace.mjs. The anchor must hit once, and the mutation is proven landed by anchor count and blob hash. The restore is proven by blob equal to HEAD and an empty git diff HEAD.
• Unit suite (it reads plugin-audit from source). The red/total counts below are identical at the final head eec3115f.
  • Mount removed: 10/19 red.
  • Query-side intersection removed: 7 red, the masked class only.
  • Text check disabled: 8 red.
  • Key-by-key narrowing disabled: 7 red.
  • Earlier-shape recognition disabled: 1 red.
  • Projection augmentation removed: 1 red.
  • Milestone provenance removed: 4 red.
  • Tracked-change provenance removed: 6 red.
  • Label provenance removed: 1 red.
  • Fail-closed branch falls open: 2 red.
  • Declaration strip removed: 1 red.
  • Each leg's other cases stayed green.
• Dogfood suite (it resolves plugin-audit through dist/). Each leg rebuilt and proved the marker live in dist/ with scripts/ablation-dist-preflight.mjs. The restore leg rebuilt and proved it absent with --absent, on a clean whole tree.
  • Mount removed: 6/10 red, all six per-class negatives; the control and the preservation cases stayed green.
  • Query-side intersection removed: 2/10 red, the masked class only.
  • A first attempt at the mount leg was a void leg and is not counted. Its mutation left an import unread, the declaration build refused it, and nothing ran. It was re-run with a buildable mutation, with the result above.

Verification (at eec3115f, after merging current main)

• pnpm --filter @objectstack/plugin-audit test: 29 files, 411 tests passed.
• pnpm --filter @objectstack/plugin-audit typecheck: clean, including check:test-typecheck OK.
• Dogfood: activity-field-values and the sibling activity-parent-read-gate pin, 16/16. pnpm --filter @objectstack/dogfood typecheck is clean.
• Gates: node scripts/pm/dispatch-gates.mjs --commands derived 95 families on this head, and all 95 exited 0. The --ran reconciliation reads 95 derived, 95 run, 0 NOT-MEASURED, with every exit code recorded.
  • On the way, two gates were red on this diff and were fixed, not waived. check-system-context-census wanted the new row. check:query-options-erasure had grown by four cast sites in the new test; the options are now typed and the ratchet is back at its ceiling.
• Lint: a proven narrowing; the repo-wide run is CI's.
  • Population: eslint --no-inline-config --format json over the six changed TypeScript files reported all six, none ignored, with 0 errors and 0 warnings.
  • Invariance: eslint.config.mjs enables no type-aware linting (no parserOptions.project or projectService), so this diff cannot move a verdict on an untouched file.
• Integration layer: none touched here. The kernel boot paths exercised are the dogfood suite's own.

Acceptance notes

• Legibility: a restricted reader's dropped summary leaves the row with its type, actor and time, and no text. A value-free rendering, such as "N fields changed" or naming only served fields, would read better. It would need new localized vocabulary and is not part of this fix.
• One composition, two consumers: the served-unmasked composition (read projection intersected with the query-side answer, failing closed) now exists in two consumers: the approval snapshot and this one. Hoisting both into one shared helper would remove a drift seam. Carrier: none.
• Adjacent mechanisms: two were measured on the same boot and are outside this change. One is query-side, over the stored activity text; the other is on the compliance ledger. Both are reported to the seat with their measurements for filing. This PR closes what an activity row serves, not what a query over it can infer.
• Gate runs touched a governed file: with the dev-dependency group bump now on main, a turbo-backed command run by an agent writes a managed block into AGENTS.md. It happened once in this worktree during the gate union, and was restored to HEAD and proven, not committed. It is reported to the seat.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/plugin-audit, touching 34 documentable anchor(s).

20 hand-written doc(s) name something this change touched — list omitted above 15 rows. Re-derive on the tree named below: node scripts/docs-audit/affected-docs.mjs --json e952cff578cc936daab3241570c4c2c36804bbd6.

⛔ 6 release-owned page(s) also affected — read-only, see AGENTS.md Documentation Guardrails.

What this run could not see

• 3 name(s) were too generic to anchor anything (single lowercase words)
• the SDK route bridge reached 54 of 206 client-bound route-ledger rows — the other 152 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 152: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 55 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 97 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 9 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json e952cff578cc936daab3241570c4c2c36804bbd6 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 9e004d49db904b26de8de3c1db377345de480659 — the merge of head eec3115faa14f9dbbca11aca3cbf3488b1031cd2 into base e952cff578cc936daab3241570c4c2c36804bbd6, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 9e004d49db904b26de8de3c1db377345de480659 && git checkout 9e004d49db904b26de8de3c1db377345de480659
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin e952cff578cc936daab3241570c4c2c36804bbd6 eec3115faa14f9dbbca11aca3cbf3488b1031cd2 && git checkout -B drift-repro e952cff578cc936daab3241570c4c2c36804bbd6 && git merge --no-ff eec3115faa14f9dbbca11aca3cbf3488b1031cd2

node scripts/docs-audit/affected-docs.mjs --json e952cff578cc936daab3241570c4c2c36804bbd6

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs e952cff578cc936daab3241570c4c2c36804bbd6 → pass the list as
args.docs, on the commit named under Which tree this was computed on.