Repository navigation
skills + ADR-0015/0062: teach the code-defined datasource credential route (OS_DATASOURCE_<NAME>_PASSWORD) once #28208 lands #28209
Description
domain:spec#3 · os-support-ai · session_01WGufzgbJhFoXYsLSe5WSPP
Filing gate: ② governed text made stale by in-flight work. PR #28208 (#27687, the maintainer's option 5 ruling 6525963988) adds a code-defined datasource's credential route: OS_DATASOURCE_<NAME>_PASSWORD, read at connect, behind the host switch OS_DATASOURCE_ENV_CREDENTIALS. The dev named these governed texts and did not edit them, because they are governed paths. Filed by domain:spec seat 3 and not dispatched. Blocked-by: #28208. Start only after it merges, and teach exactly what landed.
Stale texts (as named by the #28208 dev)
skills/objectstack-data/rules/datasources.md~:63, "Credentials — fail-closed": teaches onlyexternal.credentialsRefand the secret store. It should add the code author's route and the switch, with its default on inos serve/os startand off in library compositions. It should also carry the trust note: any installed package can declare a datasource of any name and so read the matching variable.- ADR-0015 §10 and its D7 note: the credential binding prose.
- ADR-0062 D3, "Credentials resolved at connect via
SecretBinder/ICryptoProvider": the derived env slot is a second resolution source at that same point, between the connector borrow and the factory.
Wanted
One PR that brings these three texts in line with what #28208 shipped, with no #NNNN in skills text. Both skills/** and docs/adr/** are governed (Tier H), and the skills token ratchet applies: pay by deleting duplicate text in the same file.
Blocked-by: #28208
Activity
objectstack-fleet commentedon Oct 30, 2026
triage#1 · os-zhuang · session_01AavokzJ5DndAwitDXvKy4U
Path: 写给 AI 的文档与 skills 说错一句，等于产品缺陷 | none | P①
Triage: p2 ·
domain:skills·area:data·pm:blockedon #28208 · 2026-10-30T16:57Z⛔ Not a claim.
Blocked-by: #28208line is added at line start; the inline bold one does not reach the unlock scan.pm:blocked.Generated by Claude Code
objectstack-fleet commentedon Oct 31, 2026
triage#1 · os-zhuang · session_01AavokzJ5DndAwitDXvKy4U
Path: none
Triage: unblocked · p2 ·
pm:queue· 2026-10-31T03:59Z⛔ Not a claim.
pm:blockedis removed, and the card is back inpm:queueat p2. Teach exactly what landed.Generated by Claude Code
objectstack-fleet commentedon Oct 31, 2026
domain:server#2 · os-project-manager · session_0186vfjHHMsRXC9EUT9hTFMo
Claim: PM loop round 3 · card thread · cross-lane · 2026-10-31T15:13Z
Session:
session_0186vfjHHMsRXC9EUT9hTFMo(the seat); the card thread issession_01FEkQ5phX4SAaFQKww3TfKbAccount:
os-project-manager(the seat's linked user; the card's assignee)Branch:
claude/project-thread-c92hml(the card thread's harness-pinned branch; it names no issue, so this claim is the identity record)Worktree: the card thread's own container checkout
Domain:
domain:skills(the card's lane, kept); dispatched cross-lane bydomain:server#2Seat:
domain:server#2Ruling-ref: cross-lane dispatch under the maintainer's 「座位之间可以协调，你有空你就可以派」 (2026-10-31), with no
domain:skillsseat online. Triage6528463851/6538723756(p2, Tier H: teach exactly what landed, including the trust note, within the token ratchet).File surface:
skills/objectstack-data/rules/datasources.md, ADR-0015 §10 and its D7 note, ADR-0062 D3. ⛔ No code. ⛔ No credential value or connection string anywhere.Container & model:
M,mode:thread,model: fable(--tierMANDATORY from the surface),effort: xhigh. Tier H: the PR stays draft for the maintainer's approval, and a contract review atCONTRACT_REVIEW_TIERis owed.Clause-②: no (governed prose only, no accept set moves; the dev declares)
Metadata-protocol: none
Responsibility: the code is the published datasource skill and two ADRs · no platform path covers it (Skills-docs owed by PR #28208, and PR #28325 changed the failure text) · reached by every agent that writes a code-defined datasource
Thread-read: none
Premise: holds (PR #28208 and PR #28325 merged; the dev measures the shipped route first)
Serial constraints cleared: no open PR touches these three files at this read
Resume-from: none — fresh from
origin/mainState:
pm:queue→pm:dispatched, assigned toos-project-manager, recorded by this claim.Generated by Claude Code
objectstack-fleet commentedon Oct 31, 2026
domain:server#2 · os-project-manager · session_01FEkQ5phX4SAaFQKww3TfKb
os-dev-report
{
"issue": 28209,
"status": "done",
"branch": "claude/project-thread-c92hml",
"pr": "#28432",
"session": "session_01FEkQ5phX4SAaFQKww3TfKb",
"premise_still_valid": true,
"summary": "The three texts the card names now teach the route PR 28208 shipped, with PR 28325's failure text and released claim. skills/objectstack-data/rules/datasources.md: the credential section says a code-declared datasource reads its password at connect from OS_DATASOURCE_NAME_PASSWORD (the name upper-cased) while the host switch OS_DATASOURCE_ENV_CREDENTIALS is on (os serve/start/dev default it on, a library composition is off, on/off only), a declared credentialsRef or connector still wins with no fallback, and the operator's caution that an installed package may declare a datasource of any free name and so read that variable; paid under the ratchet by deleting five restatements that each have a home elsewhere in the bundle, landing at 910 of 911 tokens (file 84 to 83 lines, 909 to 910 tokens; bundle 219807 to 219808; SKILL.md sum unchanged). ADR-0015: Amended-by entry, an inline dated correction of the D7 note's 'that stays true for a database', the section 10 bullet, and a dated section 10 note with the route, the guards, the failure text and the trust consequence. ADR-0062 D3: a dated amendment placing the slot after credentialsRef and the D7 borrow and before the factory, with its five conditions. Every fact is cited by file and line on origin/main 5da3a8c in the PR body. Deviation from the order, named not chosen silently: the order ruled skip-changeset, but skills/** ships in @objectstack/skills (dist/skills via sync-catalog) and AGENTS.md plus check-empty-changeset.mjs GREEN 3 say such a PR owes a patch changeset and never the label; os-dev.md says its text wins over an order and the conflict is reported, so the PR carries .changeset/28209-skills-code-datasource-env-credential.md (patch, both declaration lines) and zero labels were sent at pr_create. The seat relabels if the maintainer rules otherwise.",
"tests": "No code; the gates are the tests. pnpm --filter @objectstack/skills build under os-verify-lock: sync-catalog self-test 9 cases pass; 95 file(s) across 11 skill(s) copied from skills/** into dist/skills and read back byte-identical; VERDICT command-exit 0. node scripts/check-skills-token-ratchet.mjs exit 0: skills/objectstack-data/rules/datasources.md is 910 tokens (ceiling 911; headroom 1); 56 authored bundle file(s) within their ceilings. pnpm check:pm-skill-id-lint exit 0: 105 file(s) clean. pnpm check:doc-authoring exit 0: 70 published skill files clean. No ablation (no tested behaviour changed).",
"gates": "node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack on the diff: 49 families, each run as timeout 900 bash -c CMD with EXIT captured before any pipe. --ran: 49 derived famil(ies) accounted for, 47 run, 2 NOT-MEASURED (2 DERIVED from a recorded exit 3). The 47 exit 0 include check:adr-anchors, check:adr-index, check:adr-symbol-anchors, check-adr-links (962 links resolve), check-adr-0087-registration, check-changeset-no-major, check-empty-changeset (1 declaring changeset added), check:pm-governed-merges, check:pm-changeset-deadline-census, check:pm-prior-rulings, check:published-files, check:skill-compatibility, check:skill-frame-sync, check:skill-identifier-liveness, check:dts-closure, check:nul-bytes, and check:doc-formula-expressions after building @objectstack/formula... and @objectstack/lint... under the lock (first exit 3 PREREQUISITE NOT MET, then exit 0). NOT MEASURED, left to CI's full build: pnpm check:dual-build-cjs-loads (needs pnpm build) and pnpm check:lean-entry-closure (needs built entry points); neither reads a file in this diff. The three diff-reading gates that ran before the commit were re-run on head 17988ad: exit 0. node scripts/pm/check-governed-merges.mjs --test on the three paths: exit 3, 3 of 3 hit the register, Tier H (docs/adr/** x2, skills/** x1): the PR stays draft, no seat readies, queues or arms it. CI: the PR's check-runs are the seat's to read; none re-run locally. pnpm lint scoped: nothing to scope to (no package source in the diff; @objectstack/skills has no lint script).",
"dogfood_battery": "n/a — no ! in the PR title and no (narrowing) arm",
"mcp_calls": "0 — no GitHub MCP tool was called; every GitHub read was a gh api REST GET (card, comments, PR 28208, PR 28325 and their files, PR 28432), every write went through scripts/pm",
"api_writes": "2 REST relay writes — (1) scripts/pm/fleet-write/dispatch.mjs pr_create, request fw-20261031T153745Z-d9ed4f, run 41215766447, read back identical (17697 bytes), no assignees, no labels sent (the documentation, size/m and tooling labels on the PR are the labeler's, not mine); (2) this os-dev-report comment through scripts/pm/post-stamped.mjs. Plus git push -u origin claude/project-thread-c92hml (head 17988ad; not a REST write). Write budget: 3 of 3 (push, pr_create, report).",
"open_questions": [],
"out_of_scope_findings": [
"class: c · reach: named producer: skills/objectstack-data/evals/hooks-security-seeds-datasources.json case id 3 expected_output still answers 'A defineDatasource entry (credentialsRef, never inline credentials)' for a code datasource exposing a Postgres table, the same stale teaching this card corrects; a code datasource has no sys_secret handle to point at, so an agent graded against it writes a reference the connect leaves failed-credentials · evidence: the eval's must_contain list does not require credentialsRef, so it stays green · dedupe words: eval credentialsRef datasource expected_output code-defined · carrier: this card's family (skills lane, domain:skills) — the seat folds it into this PR after amending the claim's file surface, or files it; not edited here because the card and the claim name only the three texts"
]
}
Generated by Claude Code
objectstack-fleet commentedon Oct 31, 2026
domain:server#2 · os-project-manager · session_0186vfjHHMsRXC9EUT9hTFMo
Landing record · #28209 · PR #28432
domain:serverseat 2 ·session_0186vfjHHMsRXC9EUT9hTFMo· 2026-10-31T21:00Zgit ls-remote origin 'refs/heads/gh-readonly-queue/main/pr-28432-*'git merge-base --is-ancestor 22663cab origin/maingit grep -c OS_DATASOURCE_ENV_CREDENTIALS origin/main -- skills/objectstack-data/rules/datasources.md22663cabafter the maintainer's approval (Tier H). The datasources skill rule teaches the environment route for a code-declared datasource: one password at connect from the per-name environment variable, while the host switch is on. ADR-0015 and ADR-0062 carry dated amendment notes recording that nothing mints asys_secret:handle for a code datasource.@objectstack/skillspatch. The order'sskip-changesetruling was wrong; the seat corrected its order template.hooks-security-seeds-datasources.jsoncase 3 still answerscredentialsReffor a code-declared datasource, which this landing's rule now contradicts. It waits for triage to grade it, and is now unblocked.Release: claim
6545227271(session_0186vfjHHMsRXC9EUT9hTFMo, branchclaude/project-thread-c92hml) · landed.pm:dispatchedremoved; the card is closed.Generated by Claude Code