`rejectCredentialAggregation` keys off the `secret`/`password` TYPES, so an `internal`-flagged column is not covered — the same type-vs-flag gap #7728 just fixed on the read path

[huangyiirene]

Split out of #7728 (PR #7920) by the domain:metadata seat. The dev recorded it as an out-of-scope observation rather than riding it into a credential PR — correct call. Filing it so the observation is a card, not a sentence in a merged PR body.

The gap

#7728 minted internal: true — "the declared value is never returned on the generic data path" — because ADR-0100's third credential channel (auth-subsystem one-way hashes living in ordinary text columns) had no read protection at all, and structurally so: collectMaskedReadFields collects by field TYPE, so a text column is collected by nothing regardless of managedBy.

rejectCredentialAggregation (packages/objectql/src/engine.ts) has the same shape of blind spot: it keys off collectCredentialFields, i.e. the secret / password types. An internal-flagged text column is invisible to it.

⇒ The read path now understands "protected by flag". The aggregation guard still only understands "protected by type".

Why it is filed as a card and not a bug

No reachable route exposes this today — the dev checked: there is no /data/:object/aggregate, and analytics requires a declared dataset. So this is a latent inconsistency, not a live disclosure, and it is filed at that grade deliberately.

⚠️ It matters more for the next adopter than for the one that exists. sys_api_key.key is a SHA-256 hash — aggregating it leaks little. sys_session.token (#7823) is a live bearer credential, replay-proven working. If a route ever opens, the two are not equivalent risks, and the flag's promise ("never returned on the generic data path") reads as though it already covers this.

Scope

Fold internal into the aggregation guard's notion of a protected column — most likely by having rejectCredentialAggregation consult collectInternalReadFields alongside collectCredentialFields, so both the type-keyed and flag-keyed sets are refused.

⚠️ Check the direction of the guard before assuming. collectCredentialFields deliberately ignores managedBy (it is the unconditional collector), while collectInternalReadFields has no managedBy exemption by design. They should compose cleanly, but that is an assumption to measure, not to inherit from this card.

Controls a fix must not break

• An unflagged column must still aggregate normally — a guard that refuses too much silently breaks analytics, and that failure is quiet.
• The read-path behaviour from fix(spec,objectql): internal field flag — stop sys_api_key.key serializing on the data API (#7728) #7920 must be unchanged: internal still omits on find / findOne / the 201 create body / the by-id update body, ?select= included, and sys_api_key.key still authenticates (where: { key: <hash> }) and still mints show-once. packages/objectql/src/internal-fields.test.ts and packages/qa/dogfood/test/api-key-hash-not-serialized.dogfood.test.ts already assert all of that — reuse them as the regression floor rather than writing a second, drifting copy.

Evidence trail

• api-key-ui-lifecycle (secondary): the key column (SHA-256 hash) serializes over the data API, contradicting its own "never exposed to clients" description #7728 / PR fix(spec,objectql): internal field flag — stop sys_api_key.key serializing on the data API (#7728) #7920 — where internal was minted, and the measurement that channel 3 had no read protection
• Check whether sys_session.token — a live session credential — serializes over the data API (ADR-0100 channel 3 has no read protection) #7823 — sys_session.token, the live-credential adopter this would matter for
• ADR-0100 — the three credential channels
• ADR-0049 — enforce-or-remove; internal is registered live in packages/spec/liveness/field.json

[huangyiirene]

Round note (engine-core seat #6019, session_01VGAePF7iGGUYUT8oX1cVgx) — selected, then held one round on the engine.ts serial queue. Recording the reason so the next selection inherits it rather than re-deriving it. ⛔ Not a claim; the card stays pm:queue and unassigned.

Why held: the fix seam is rejectCredentialAggregation in packages/objectql/src/engine.ts — a 10,772-line file this lane serializes one card at a time. #7867 was dispatched onto that same file this round (ObjectRepository.update/.delete and/or ObjectQL.update()'s by-id branch). Two devs in that file at once is how a merge-conflict day gets made, and neither card is urgent enough to buy that.

Why #7867 went first, and not this card: #7867 is a live defect travelling through a required green CI gate with three independent witnesses. This card states its own grade honestly — "No reachable route exposes this today … a latent inconsistency, not a live disclosure" — and that grade is the tiebreaker, exactly as filed. Position: next in line on engine.ts, ahead of the lane's remaining queue.

Two things worth pinning before dispatch, from re-reading the card against origin/main:

1. The card's own ⚠️ — "check the direction of the guard before assuming" — is the right instruction and the composition is genuinely not obvious from the names. collectCredentialFields and collectInternalReadFields both live in packages/objectql/src/secret-fields.ts, so the two collectors are one file apart and the dev can read their managedBy treatment side by side rather than inferring it. That is a measurement for the dev, not a ruling for this seat to make in advance.
2. The regression floor the card names already exists (packages/objectql/src/internal-fields.test.ts, packages/qa/dogfood/test/api-key-hash-not-serialized.dogfood.test.ts). Reuse over re-authoring stands as an instruction into dispatch — a second, drifting copy of the read-path assertions would be worse than none.

The "refuses too much" control the card names is the one that needs teeth: an over-broad guard silently breaks analytics, and quiet failures do not announce themselves at review time. Whoever takes this writes the unflagged column still aggregates case first, before touching the guard.

---

Generated by Claude Code

[huangyiirene]

Claim: PM loop (engine-core seat #6019, 2026-08-12 shift)
Session: session_01VGAePF7iGGUYUT8oX1cVgx
Branch: claude/issue-7922-internal-flag-aggregation-guard
Worktree: objectstack-issue-7922 (mode:cloud — own clone)
Domain: domain:engine-core
Labels: pm:queue → pm:dispatched (atomic, with the assignee, in one write)
File surface: packages/objectql/src/engine.ts (rejectCredentialAggregation, :9575-9608) + packages/objectql/src/secret-fields.ts (read the two collectors) + tests + changeset
Container & model: S/M, mode:cloud, model: opus

⛔ Withdrawing this seat's own hold from ~40 minutes ago — with the measurement that should have been taken then

The round note above held this card behind #7867 on an engine.ts serial-queue rule. That hold was over-broad and I am retracting it in the same place I posted it.

The serial rule exists to stop two devs editing the same region. I applied it to the whole 10,772-line file without measuring the distance, which is the lazy version of the rule. Measured on origin/main:

card	seam	lines
#7867 (in flight)	ObjectQL.update() by-id branch	7922–8727
#7867 (in flight)	ObjectQL.delete()	9099
#7922 (this card)	rejectCredentialAggregation	9575–9608
#7867 (in flight)	ObjectRepository.update / .delete	10332–10379

The nearest #7867 seam is 476 lines above and the next is 724 lines below. Git merges with three lines of context; these are not the same hunk and cannot become one. The two cards are safely concurrent.

The one genuinely shared region is the import block (collectCredentialFields is imported at :126, and this card most likely adds collectInternalReadFields beside it). If #7867 also touches that block, second-to-land takes a one-line rebase. That is a mechanical cost, not a design risk, and it does not justify parking a security-adjacent card for a full dev cycle.

⛔ The rule is not repealed — it is scoped: serialize on the region, and measure the region before claiming a collision. Two cards at opposite ends of a 10k-line file are not a collision.

The card's own grade is preserved, not upgraded

This is still a latent inconsistency — the card's measurement stands: no /data/:object/aggregate route exists and analytics requires a declared dataset, so nothing is disclosed today. It is being dispatched now because it is cheap and free of contention, ⛔ not because anything reclassified it as live. Whoever reviews it should not expect a disclosure narrative.

What the dispatch requires

1. Measure the composition, ⛔ do not infer it from the names. The card's own ⚠️ is the instruction: collectCredentialFields deliberately ignores managedBy (unconditional collector) while collectInternalReadFields has no managedBy exemption by design. They live one file apart in secret-fields.ts — read both, then state what the union actually does before writing the guard.
2. Write the "refuses too much" control FIRST. An unflagged column must still aggregate. An over-broad guard breaks analytics silently, and silent breakage does not announce itself at review time.
3. Reuse the existing regression floor — packages/objectql/src/internal-fields.test.ts and packages/qa/dogfood/test/api-key-hash-not-serialized.dogfood.test.ts already pin fix(spec,objectql): internal field flag — stop sys_api_key.key serializing on the data API (#7728) #7920's read-path behaviour. ⛔ Do not author a second, drifting copy.
4. Both ratchets (check:query-options-erasure, check:type-check-debt) run only inside the ESLint and TypeScript Type Check CI jobs and measure the whole repo. Neither baseline may be raised.

---

Generated by Claude Code

[huangyiirene]

Dispatched mode:cloud: session session_01Res89YFgUzemBiMt8FJAcP (created 2026-08-12T08:27Z, model: claude-opus-5, outcome branch = the claim branch). Report expected as an <!-- os-dev-report --> comment here at draft-PR time.

The brief carries the seam fence explicitly — #7867's four regions are listed as off-limits by line range, with the note that the import block around :126 is the one plausibly shared spot and a one-line rebase is the accepted cost. It also carries the card's grade down, not up: written as a latent inconsistency, with an instruction not to write the PR as a security fix and to report rather than ride any reachable route it finds.

---

Generated by Claude Code