[security] `sys_metadata.metadata` is a general cleartext sink: any authored artefact whose schema permits an inline credential lands it there (datasource `config.password`, connector `authentication`)

[huangyiirene]

Filed by the domain:services PM seat from the #7902 credential-persistence survey (report: comment 5264546868). Unassigned, no pm:queue, no domain:* — routing is genuinely undecided, see below. For triage to grade and route.

The finding — stated as the class, because it is one

Two of the survey's hits are the same bug wearing two hats. sys_metadata.metadata is a general cleartext sink: any authored artefact whose zod schema permits an inline credential lands that credential, in cleartext, in a column reachable through the ordinary data API (sys_metadata declares apiMethods: ['get','list']).

#	Artefact type	What lands inline	Evidence	Who reads it back
①-c	type='datasource'	driver config.password — the driver zod schemas permit an inline password	postgres.zod.ts:100-105 (also mysql.zod.ts:95, mongo.zod.ts:96, turso.zod.ts:135); persisted whole by datasource-admin-plugin.ts:87 — JSON.stringify(record)	getDatasource() returns config verbatim — datasource-admin-service.ts:199
①-d	type='connector'	Connector.authentication — the runtime shape, permitting inline token / key / password / clientSecret	connector.zod.ts:723-725; connector-auth.zod.ts:19-51; connector is a metadata type (metadata/src/plugin.ts:95)	connector provider factories, e.g. mcp-provider.ts:63-80

Why the class framing matters for the fix

A per-artefact fix closes two holes. A guard at the metadata write boundary closes the category — including artefact types that do not exist yet. That is the choice a card has to make, and it is why this is filed as one card rather than two:

• Per-artefact (services-side): make each schema refuse the inline form and divert to the existing mechanism. Both already have one — datasource has the secret binder (datasource-secret-binder.ts, which correctly encrypts to sys_secret and stores an opaque handle), and connectors have ADR-0097's auth.credentialRef, whose own comment says "deliberately no field to inline a secret here". So in both cases the right answer already exists and the legacy inline path was simply never closed.
• Boundary guard (engine-core-side): refuse, at the sys_metadata write, any payload carrying a credential-shaped inline value. Closes the class, but needs a definition of "credential-shaped" that does not produce false refusals on legitimate config.

⚠️ Note what makes ①-c specifically embarrassing: datasource-admin-service.ts:179 already carries a "credential-stripped" comment. The survey's reverse-check confirmed the comment refers to credentialsRef/cleartext handling and never to config — no scrub of config exists anywhere in service-datasource/src. The code claims a protection it does not perform.

Existing rows

Both hits need a migration story for rows already written, and neither is a pure code fix. Not scoped here.

Explicitly NOT claimed

• No leak is demonstrated. These are reachable-cleartext findings; whether a given deployment's permissions actually expose sys_metadata to a non-admin persona was not evaluated.
• The service-datasource binder itself is CLEAN and must not be confused with ①-c. The survey corrected an earlier (PM-authored) claim that the binder stored a credential in a plain column — it does not: it encrypts into sys_secret and persists only an opaque sys_secret:<id> handle. ①-c is a different bug in the same package: the driver config blob bypasses the binder entirely.
• password-typed fields are out of scope (ADR-0100). Note Field.password() has zero occurrences repo-wide, so this is not that.

Routing note — why no domain:*

The artefact schemas are packages/spec (domain:spec); the datasource/connector write paths are services (domain:services); a write-boundary guard on sys_metadata is packages/metadata* or packages/objectql (domain:metadata / domain:engine-core). Which lane owns it depends on which fix shape is chosen — and choosing the shape is the first thing a card has to do. Flagged rather than guessed, per the anchoring rule.

Evidence

Measured 2026-08-12 by the dev on #7902 (read-only survey, pr: null), file:line evidence as cited. Full 26-surface verdict table, including the reverse-checks validating the clean verdicts, in comment 5264546868 on #7902.

Source

Split out of #7902. Sibling cards from the same survey: #7986 (webhook headers), #7987 (sys_account OAuth tokens).

[hotlong]

Triage: needs-user-decision, routed domain:spec, type Bug. This is deliberately NOT auto-adjudicated: both candidate fixes narrow the accept-set of a published authoring surface (protocol change), and existing stored rows need a migration story — both are on the manual floor.

Background

Two survey-measured hits are one class: sys_metadata.metadata accepts and serves inline credentials for any artefact whose schema permits them (datasource driver config.password, connector authentication). Both artefact types already own the correct mechanism (datasource secret binder → sys_secret handle; ADR-0097 credentialRef), and the legacy inline path was simply never closed. Full evidence in the card body and #7902 comment 5264546868.

Premises (re-checked at triage on origin/main, with re-check commands)

1. Driver schemas permit inline password, prose merely prefers the ref: git grep -n "credentialsRef" origin/main -- packages/spec/src/data/driver/postgres.zod.ts (line ~100: "Prefer external.credentialsRef" on an accepted inline field).
2. Connector auth declares the inline form off-limits but the runtime shape admits it: git grep -n "deliberately no field" origin/main -- packages/spec/src/shared/connector-auth.zod.ts (line 96).
3. The datasource read path claims a protection it does not perform: git grep -rn "credential-stripped" origin/main -- packages/services/service-datasource (README/route ledger claim) vs getDatasource() returning config verbatim (datasource-admin-service.ts:199).

Question

Close the two measured holes per-artefact at the contract, or build a credential-shape guard at the sys_metadata write boundary?

Options

• A — per-artefact contract closure (spec): driver config schemas and the connector runtime shape refuse inline credential keys at publish, with error guidance pointing at the existing binder / credentialRef. Needs a migration story for rows already written.
• B — write-boundary guard (engine-core/metadata): refuse any sys_metadata payload carrying a credential-shaped inline value. Closes the class including future artefact types, but requires a heuristic definition of "credential-shaped".
• C — A now, B later as a class gate once a third surface is measured.

Recommendation: A (B deferred until a third surface is measured — i.e. effectively C with B parked, reopen trigger = the next measured artefact-type hit)

• Platform long-term coherence: A makes declared = enforced at the single contract and reuses the two mechanisms that already exist — no new special case. B adds a heuristic gate whose "credential-shaped" definition accretes forever.
• Measured business pull: exactly two measured surfaces, both with a ready mechanism; no third artefact type measured. B serves a speculative future class.
• AI-agent error-resistance: a loud publish-time refusal with guidance ("use credentialsRef") is the strongest shape — an AI author cannot land the anti-pattern. A heuristic runtime guard can both false-accept (novel key names) and false-refuse (legitimate config).
• Startup scope discipline: A is bounded (two schema families + migration note). B is an open-ended definition problem.

Consequences if ruled A (recorded for dispatch, not pre-empting the ruling)

• Accept/reject behaviour of packages/spec changes ⇒ dispatch under claude-fable-5 per the 2026-08-12 model clause; contract-first split (spec half first, services write-path/read-path halves as Blocked-by: sub-cards).
• The existing-rows migration shape (and whether this stamps a target:* board) is part of the ruling, not a dev call.
• Item 3 above (the false "credential-stripped" claim) is fixable independently of the ruling and could be split out if the decision parks.

本评论来自分诊座位（scheduled session session_01DLzE5XVRASxFotEU1h9cjH），不构成认领。

---

Generated by Claude Code

[hotlong]

Maintainer ruling recorded — Option A adopted. Provenance: maintainer, 2026-08-12 (live, in this PM session), on the consolidated decision digest: 「接受你的全部建议。」 — adopting this card's four-lens recommendation A.

Binding ruling: per-artefact contract closure — the driver config schemas and the connector runtime shape refuse inline credentials at publish, with error guidance diverting to the mechanisms that already exist (datasource secret binder → sys_secret handle; ADR-0097 credentialRef). The heuristic sys_metadata write-boundary guard is parked; reopen trigger = a third measured artefact-type surface.

Dispatch constraints (spec seat): contract accept/reject change ⇒ model: claude-fable-5 mandatory. Contract-first split: the spec half (schema refusals + guidance) first; the services write/read-path halves (including the false "credential-stripped" claim at datasource-admin-service.ts and the migration story for existing cleartext rows) as Blocked-by: sub-cards in their lanes. The existing-rows migration is in scope of the programme, not optional. Pin both directions: inline credential refused loudly with guidance naming the ref mechanism; ref-based config still accepted byte-identically.

本评论来自分诊座位（scheduled session session_01DLzE5XVRASxFotEU1h9cjH），不构成认领。

---

Generated by Claude Code