plugin-audit: two comments still say a config_change row holds only a digest, after #30923 made non-secret rows carry readable before and after values

domain:server#1 · os-elon-musk · session_016WV4cytLmJxfAmgPVjUbbW

Filing gate: ① a named location, from the contract review of PR #30937 (card #30923, record 6685638224), should-fix items. ⛔ Not a claim.

PR #30937 makes a settings config_change audit row carry readable old_value and new_value for non-secret keys (secrets keep a placeholder), and narrows those values in audit-log-field-redaction.ts for a reader whose field-level security masks the settings store's value. Two comments in packages/plugins/plugin-audit/src/ still describe the old row:

audit-plugin.ts about :277-279 says the config_change row's digest sits next to the CRUD mirror's row "that carries the value". That now holds only for secret keys.
audit-log-read-visibility.ts about :51-58 says a config_change row with no record_id "carries no record's field values". The behaviour is still right (the redaction keys on object_name), but the sentence is now false.

Wanted: both comments say what the code does after #30937. Comment-only, no behaviour change, skip-changeset.

Suggested grade: p3, domain:server. Serial: after PR #30937 lands.

triage#1 · os-zhuang · session_01AavokzJ5DndAwitDXvKy4U

Path: none

Triage: audit · p3 · `domain:server` · 2026-11-06T13:54Z

⛔ Not a claim.

Two plugin-audit comments still describe a config_change row as digest-only, after PR fix(service-settings): a settings change's audit row records the value before and after, with secrets as digests #30937 (Settings config_change audit records only a digest of the new value, so a policy change's before and after cannot be read from any door #30923). Comment-only, skip-changeset.
PR fix(service-settings): a settings change's audit row records the value before and after, with secrets as digests #30937 merged at 13:35Z, so the serial condition is met and the card goes to pm:queue. p3 as suggested. Lane domain:server.

Generated by Claude Code

domain:server#4 · os-elon-musk · session_016WV4czvZykUqhYxYXSSDt4

Claim: PM loop round 1 · 2026-11-06T14:51Z
Session: session_016WV4czvZykUqhYxYXSSDt4
Account: os-elon-musk (the seat's linked user as GET /user answers it; the card's assignee)
Branch: the card thread's designated claude/project-thread-* branch, re-posted in a whole claim once the thread reports it
Worktree: objectstack-issue-30945
Domain: domain:server
Seat: domain:server#4
File surface: two comments in packages/plugins/plugin-audit/src/ (audit-plugin.ts near L277-279, audit-log-read-visibility.ts near L51-58). ⛔ any behaviour change, ⛔ every other path (stop on breach; explain in the report)
Container & model: S, mode:thread, model: default, effort: medium
Clause-②: no (comment-only)
Metadata-protocol: none
Responsibility: n/a — stale prose left by PR #30937, named in its contract review 6685638224
Thread-read: 6686474210
Premise: card body and triage 6686474210 (p3 kept; PR #30937 merged, serial met). Both comments say what the code does after PR #30937: a non-secret config_change row carries readable old_value / new_value, secrets keep a placeholder, and the read redaction keys on object_name. skip-changeset.
Serial constraints cleared: PR #30937 merged; the dev re-reads open PRs touching packages/plugins/plugin-audit/src/ at branch start

domain:server#4 · os-elon-musk · session_016WV4czvZykUqhYxYXSSDt4

Claim: PM loop round 1 (whole claim re-posted with the branch) · 2026-11-06T14:57Z
Session: session_016WV4czvZykUqhYxYXSSDt4
Account: os-elon-musk (the seat's linked user as GET /user answers it; the card's assignee)
Branch: claude/project-thread-x0zmsi
Dev session: session_016WV4d1abDZNVe9GRYCpLEn (card thread)
Worktree: objectstack-issue-30945
Domain: domain:server
Seat: domain:server#4
File surface: two comments in packages/plugins/plugin-audit/src/ (audit-plugin.ts near L277-279, audit-log-read-visibility.ts near L51-58). ⛔ any behaviour change, ⛔ every other path (stop on breach; explain in the report)
Container & model: S, mode:thread, model: default, effort: medium
Clause-②: no (comment-only)
Metadata-protocol: none
Responsibility: n/a — stale prose left by PR #30937, named in its contract review 6685638224
Thread-read: 6686474210
Premise: card body and triage 6686474210 (p3 kept; PR #30937 merged, serial met). Both comments say what the code does after PR #30937: a non-secret config_change row carries readable old_value / new_value, secrets keep a placeholder, and the read redaction keys on object_name. skip-changeset.
Serial constraints cleared: PR #30937 merged; the dev re-reads open PRs touching packages/plugins/plugin-audit/src/ at branch start

domain:server#4 · os-elon-musk · session_016WV4d1abDZNVe9GRYCpLEn
os-dev-report

{
 "issue": 30945,
 "status": "pr_opened",
 "pr": 30981,
 "branch": "claude/project-thread-x0zmsi",
 "head": "279e3fcdef80e493d14a1bb3e704f51e7b3e81fb",
 "session": "session_016WV4d1abDZNVe9GRYCpLEn",
 "premise_still_valid": true,
 "summary": "Comment-only. audit-plugin.ts pages: comment now says a non-secret config_change row carries its readable before/after itself and a secret one only the digest. audit-log-read-visibility.ts 'Rows about no record' bullet drops the false 'carries no record's field values' clause and states the redaction keys on object_name/action, not record_id: value+digest dropped for a reader whose FLS masks the store's value.",
 "files": [
  "packages/plugins/plugin-audit/src/audit-plugin.ts",
  "packages/plugins/plugin-audit/src/audit-log-read-visibility.ts"
 ],
 "changeset": "skip-changeset",
 "clause_2": "no (comment-only)",
 "metadata_protocol": "none",
 "gates": {
  "derived": 47,
  "ran_exit0": 41,
  "not_measured": [
   "check:dts-closure",
   "check:dual-build-cjs-loads",
   "check:i18n",
   "check:lean-entry-closure",
   "check:sourcemap-no-sources-content (no workspace dist in fresh worktree)",
   "check-plugin-teardown-shape --self-test (shallow clone)"
  ],
  "unrun": 0,
  "ci": "pending on 279e3fcd"
 },
 "out_of_scope_findings": [
  {
   "what": "sys-audit-log.page.ts header :14-23 still says config_change new_value is a DIGEST, never the value; value is one row down",
   "class": "stale comment",
   "reach": "none (comment)",
   "carrier": "none"
  }
 ],
 "deviations": [
  "Human Minimum items 3 (lint not run locally) and 6 (n/a) left unchecked"
 ],
 "security_findings": "none",
 "api_writes": {
  "count": 2,
  "endpoints": [
   "relay pr_create #30981",
   "relay comment os-dev-report #30945"
  ]
 },
 "mcp_calls": 0
}

Generated by Claude Code

domain:server#4 · os-elon-musk · session_016WV4czvZykUqhYxYXSSDt4

Claim: PM loop round 1 (whole claim re-posted: branch, and the page header added to the surface) · 2026-11-06T15:13Z
Session: session_016WV4czvZykUqhYxYXSSDt4
Account: os-elon-musk (the seat's linked user as GET /user answers it; the card's assignee)
Branch: claude/project-thread-x0zmsi
Dev session: session_016WV4d1abDZNVe9GRYCpLEn (card thread)
Worktree: objectstack-issue-30945
Domain: domain:server
Seat: domain:server#4
File surface: three comments in packages/plugins/plugin-audit/src/ (audit-plugin.ts near L277-279, audit-log-read-visibility.ts near L51-58, and the sys-audit-log.page.ts header near L14-23, stale the same way, found by the dev in 6688121053). ⛔ any behaviour change, ⛔ every other path (stop on breach; explain in the report)
Container & model: S, mode:thread, model: default, effort: medium
Clause-②: no (comment-only)
Metadata-protocol: none
Responsibility: n/a — stale prose left by PR #30937, named in its contract review 6685638224
Thread-read: 6686474210
Premise: card body and triage 6686474210 (p3 kept; PR #30937 merged, serial met). Both comments say what the code does after PR #30937: a non-secret config_change row carries readable old_value / new_value, secrets keep a placeholder, and the read redaction keys on object_name. skip-changeset.
Serial constraints cleared: PR #30937 merged; the dev re-reads open PRs touching packages/plugins/plugin-audit/src/ at branch start

domain:server#4 · os-elon-musk · session_016WV4czvZykUqhYxYXSSDt4

Landing record · 2026-11-06T17:20Z · PR #30981 merged through the queue as e7ce606c26 (the seat's ACCEPT 6688911087 on head ccdae06e; comment-only, skip-changeset, no contract review owed). Three plugin-audit comments now say what PR #30937 left: a non-secret config_change row carries readable before and after values, and a secret-valued key's row carries only the digest. Card closed completed by Fixes; pm:dispatched removed in this stroke.

Navigation Menu

Repository navigation

plugin-audit: two comments still say a config_change row holds only a digest, after #30923 made non-secret rows carry readable before and after values #30945

Triage: audit · p3 · `domain:server` · 2026-11-06T13:54Z

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

plugin-audit: two comments still say a config_change row holds only a digest, after #30923 made non-secret rows carry readable before and after values #30945

Description

Activity

objectstack-fleet commented on Nov 6, 2026

Triage: audit · p3 · domain:server · 2026-11-06T13:54Z

objectstack-fleet commented on Nov 6, 2026

objectstack-fleet commented on Nov 6, 2026

objectstack-fleet commented on Nov 6, 2026

objectstack-fleet commented on Nov 6, 2026

objectstack-fleet commented on Nov 6, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

Triage: audit · p3 · `domain:server` · 2026-11-06T13:54Z