finding: the ADR-0010 envelope-declaration gate cannot see `UNREGISTERED_KIND_SCHEMAS` — the blind spot that let #6362 survive #6245

[os-zhuang]

Split out of #6362 (PR #6900). Recording only — not claimed, not queued.

The observation

metadata-type-schemas.test.ts holds the ADR-0010 invariant that every metadata
type either declares ...MetadataProtectionFields or is named on an explicit
debt list. UNDECLARED_ENVELOPE is currently empty, and its own comment
calls that "the end state", so the gate reads as total coverage.

It is not. The gate iterates listMetadataTypeSchemaTypes(), which returns
Object.keys(BUILTIN_METADATA_TYPE_SCHEMAS) plus runtime extras — and
deliberately not UNREGISTERED_KIND_SCHEMAS. That exclusion is documented
and intentional (the trailing comment in metadata-type-schemas.ts explains
that enrolling webhook / connector / sharing_rule there would claim a KIND
status #6245 was careful not to grant, leaving #2657's B/C decision open).

The side effect was not intended, though: those three names are bound as real
parse doors — #6245 wired them to PUT /api/v1/meta/:type/:name — while the
invariant that exists to catch "declares no envelope" never runs over them.

Evidence that this is the actual cause, not a theory

connector sat in exactly that gap and the gate stayed green throughout:

• sharing_rule was .strict(), so its undeclared envelope produced a hard 422
  and meta: bind Zod schemas for webhook / connector / sharing_rule WITHOUT registering the kinds — close the unvalidated PUT /meta write hole (#2657 audit, option A) #6245 caught it by hitting the failure, not by the gate reporting it.
• connector is a plain z.object, so it silently stripped all seven keys —
  no 422, no gate finding, nothing. It needed a separate hand-written card
  (finding: ConnectorSchema 容忍但不保留 ADR-0010 保护信封 —— package-load 的 connector 每次 round-trip 静默丢 _packageId 一族 #6362) and a hand-written probe to surface, roughly a day later.
• webhook happened to be fine, but only because 未知键静默剥离仍是全仓默认:把 #3405 的 strict 收紧从一个 schema 推广到整个可授权面(ADR-0078 完整性闸门) #4001 batch 11 had given it
  the spread for unrelated reasons. Nothing verified that; finding: ConnectorSchema 容忍但不保留 ADR-0010 保护信封 —— package-load 的 connector 每次 round-trip 静默丢 _packageId 一族 #6362 had to measure
  it by hand to find out, which is precisely what a gate is for.

So all three were judged one at a time, by hand, for a property the repo already
has an automated structural walker for.

Why this is observation-class, not a defect

Nothing a user hits today: as of PR #6900 all three bound kinds declare the
envelope, so the gap is currently empty of bugs. The exposure is prospective —
a fourth entry added to UNREGISTERED_KIND_SCHEMAS inherits the same
silence, and the next one may be non-strict too, in which case the failure is
again a silent strip rather than a 422.

Possible directions (deliberately not chosen here)

1. Give the existing suite a second it.each over Object.keys(UNREGISTERED_KIND_SCHEMAS)
   asserting only the envelope-declaration property — without enrolling them
   in listMetadataTypeSchemaTypes(), so none of the other KIND obligations
   (create seeds, MetadataTypeSchema membership, the campaign count) attach and
   Studio metadata coverage gaps: surface remaining types + promote un-typed concepts #2657 stays unprejudged.
2. Export the bound-kind names so the walk derives the set rather than
   hand-listing it.
3. Leave as-is and rely on review, if the set is expected to stay at three.

Direction 1 looks like the cheap one and appears to preserve every boundary
#6245 drew, but it is a decision about a contract surface's coverage rules, so
it should be triaged rather than assumed.

Refs: #6362 / PR #6900 (connector, the silent-strip case), #6245 (bound the three
doors; fixed sharing_rule's 422 case), #4001 batch 11 (webhook's spread),
#2657 (the open B/C kind-promotion decision), ADR-0010.

[os-project-manager]

Triage (maintainer-authorized one-off pass, 2026-08-09, registered on #6015): promoted finding → pm:queue (domain:spec kept). Three real parse doors (webhook/connector/sharing_rule, wired to PUT /meta by #6245) sit outside the ADR-0010 envelope invariant while the gate's empty debt list reads as total coverage — a gate that overstates its own reach. Scope fence: the fix enrolls them in the test's iteration only (assert envelope posture or an explicit debt entry); it must NOT grant them KIND status — #2657's B/C decision stays open, exactly as the schemas file's comment intends.

---

Generated by Claude Code