[objectstack-fleet]

Requested by Elon · project thread

domain:server#4 · os-elon-musk · session_016WV4d1abDZNVe9GRYCpLEn

Fixes #30945

Claim: 6688172302 (full re-post with sys-audit-log.page.ts on the surface)

Clause-②: no (comment-only)
Metadata-protocol: none

维护者速读

• 改了什么：plugin-audit 三处注释。只改注释，不改任何代码行为。
• 为什么改：fix(service-settings): a settings change's audit row records the value before and after, with secrets as digests #30937 之后，非密钥设置的 config_change 审计行自己就带可读的改前值和改后值，旧注释还说它只有摘要、不带字段值。
• 风险与回滚：零运行时风险，单提交可整体回滚。
• 先看：audit-plugin.ts 第 277 行起；audit-log-read-visibility.ts 第 57 行起；sys-audit-log.page.ts 文件头第 14 行起。
• 需要你做的：无，席位落地。

What changes

Three comments in packages/plugins/plugin-audit/src/. No code line changes.

• audit-plugin.ts (the pages: comment, about :277). It said a config_change row's digest sits next to the CRUD mirror's row "that carries the value". After fix(service-settings): a settings change's audit row records the value before and after, with secrets as digests #30937, config-change-audit.ts writes old_value / new_value as { namespace, key, scope, value, digest }, with value omitted only for a secret-valued key. The comment now says the record page puts the config_change row beside the mirror's rows about the same settings row, that a non-secret key's row carries its readable before and after itself, and that a secret-valued key's row carries only the digest.
• audit-log-read-visibility.ts (the "Rows about no record" bullet, about :57). It said these rows carry no record's field values. A config_change row stored before its writer recorded the settings row has no record_id, but still names its store as object_name and still carries the setting's value and digest. The false clause is removed. A new sentence says what redactAuditLogRows does: it keys on object_name and action, not on record_id, so a config_change row naming sys_setting or sys_platform_setting has value and digest dropped on both sides for a reader whose field-level security masks that store's value, with or without a record_id.
• sys-audit-log.page.ts (module header, about :14-24). It said a config_change row's new_value is a DIGEST, never the value, and that the value is one row down. It now says the row carries a non-secret key's readable before and after and only the digest for a secret-valued key, and that the page lists the config_change row beside the mirror's rows as the settings row's history.

Why

PR #30937 (#30923) made the row readable and added the object_name-keyed narrowing in audit-log-field-redaction.ts. These three comments still described the earlier digest-only row. Found in that PR's contract review (6685638224), filed as #30945.

Verification

skip-changeset: comment-only, nothing publishes a different behaviour.

node scripts/pm/dispatch-gates.mjs --ran: 47 derived, 41 run with exit 0, 6 NOT MEASURED (exit 3, prerequisite not met), 0 unrun.

• NOT MEASURED, reason: they read dist/ of the whole workspace, which a fresh worktree has not built. check:dts-closure, check:dual-build-cjs-loads, check:i18n, check:lean-entry-closure, check:sourcemap-no-sources-content. CI runs them.
• NOT MEASURED, reason: shallow clone cannot reach the pinned positive-control commit. check-plugin-teardown-shape.mjs --self-test (checker health only). CI runs it.

No dogfood run, no unit test change: the diff touches no executable line.

Acceptance notes

• None.

Human Minimum

• 1. Schemas start as Zod; packages/spec holds no runtime logic.
• 2. Every name I added uses the casing for its kind.
• 3. No formatter ran; pnpm lint passes. (No formatter ran; lint not run locally, CI runs it.)
• 4. One issue, one branch off an up-to-date main, one pull request.
• 5. A change that publishes carries a changeset, and both declaration lines are filled in here and in the changeset.
• 6. (n/a, not touched) packages/spec touched: its generated artifacts are regenerated and committed.
• 7. No hand edits to content/docs/references/, packages/*/CHANGELOG.md or content/docs/releases/.
• 8. Title, body and comments are in English.
• The Before Submitting list in CONTRIBUTING.md is done.

🤖 Generated with Claude Code

https://claude.ai/code/session_016WV4d1abDZNVe9GRYCpLEn

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/plugin-audit, touching 1 documentable anchor(s). ⚠️ 2 changed file(s) yielded no anchor (packages/plugins/plugin-audit/src/audit-log-read-visibility.ts, packages/plugins/plugin-audit/src/sys-audit-log.page.ts), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files.

3 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/permissions/record-view-auditing.mdx (via AuditPlugin (symbol, a top-level class))
• content/docs/plugins/packages.mdx (via AuditPlugin (symbol, a top-level class))
• content/docs/protocol/kernel/index.mdx (via AuditPlugin (symbol, a top-level class))

⛔ 1 release-owned page(s) also name something this change touched. These are read-only:

• content/docs/releases/v17/17-1.mdx (via AuditPlugin (symbol, a top-level class))

content/docs/releases/ is RELEASE-OWNED (AGENTS.md "Documentation Guardrails"): release
notes are written centrally at release time, and a code PR that edits them is the exact PR
that guardrail exists to stop. They are still audited — read-only. If one of them is actually
wrong, file an issue or open a dedicated docs-only PR; do not edit it here.

What this run could not see

• 2 changed file(s) yielded no anchor (packages/plugins/plugin-audit/src/audit-log-read-visibility.ts, packages/plugins/plugin-audit/src/sys-audit-log.page.ts) — pages documenting those are invisible to this run
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 10 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 1aeeafd9d371be1fd5afa637c4f0ae6b6f4c1404 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 96cedd5c2bce66d8da6e70fba119c05571494564 — the merge of head ccdae06e847b699acd422c12aa519c1e45120f49 into base 1aeeafd9d371be1fd5afa637c4f0ae6b6f4c1404, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 96cedd5c2bce66d8da6e70fba119c05571494564 && git checkout 96cedd5c2bce66d8da6e70fba119c05571494564
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 1aeeafd9d371be1fd5afa637c4f0ae6b6f4c1404 ccdae06e847b699acd422c12aa519c1e45120f49 && git checkout -B drift-repro 1aeeafd9d371be1fd5afa637c4f0ae6b6f4c1404 && git merge --no-ff ccdae06e847b699acd422c12aa519c1e45120f49

node scripts/docs-audit/affected-docs.mjs --json 1aeeafd9d371be1fd5afa637c4f0ae6b6f4c1404

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 1aeeafd9d371be1fd5afa637c4f0ae6b6f4c1404 → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[objectstack-fleet]

domain:server#4 · os-elon-musk · session_016WV4czvZykUqhYxYXSSDt4

维护者速读

1. 改了什么:plugin-audit 三处注释改成 fix(service-settings): a settings change's audit row records the value before and after, with secrets as digests #30937 之后的真实行为：非密钥设置的 config_change 审计行自己带可读的改前值和改后值，密钥只带摘要。
2. 为什么改:plugin-audit: two comments still say a config_change row holds only a digest, after #30923 made non-secret rows carry readable before and after values #30945,旧注释说这行只有摘要。
3. 风险：零，只改注释。
4. 先看:sys-audit-log.page.ts 文件头。
5. 两分钟验证：读 diff 即可,35 行。
6. 需要你做的：无，席位落地。

席位意见:ACCEPT(#30945)。

席位核对

Head-sha: ccdae06e847b699acd422c12aa519c1e45120f49 · read 2026-11-06T15:46Z

Item	Reading
Shape	Draft → main, Fixes #30945, skip-changeset. 3 files, +21/−14. Branch claude/project-thread-x0zmsi, whole claim 6688172302 (the page header was added to the surface).
Seat diff read	Every hunk is inside a comment block; no code line moves. The three sentences match config-change-audit.ts and redactAuditLogRows as PR #30937 left them.
Evidence	os-dev-report 6688121053; derived gates 41 run with exit 0, and the 6 not measured are dist/shallow-clone prerequisites CI runs.
Gates (check-runs on this head)	34 success, 14 skipped, 0 failed.
Accepted deviations	The third file (same stale wording, folded in at the seat's ask).
Out of scope	None.
Semver	skip-changeset. Clause-②: no (comment-only), Metadata-protocol: none.
Landing	Not governed (check-governed-merges --pr 30981), 35 lines, not BREAKING. The seat lands it: pr_ready + automerge_enable.