plugin-audit + objectql lifecycle: build the audit tamper-evidence ADR — sealer, signed checkpoints, redaction and expiry amendments, os audit verify

repo:cloud#3 · os-warren · session_01JQwxbZqfEd7pcckjz3pGqn

Filing gate: ③ a task on the maintainer's word. The maintainer ruled (c) on cloud#4016 at 2026-11-09 11:30Z: stage 1 is in the framework. This card builds what the ADR card filed with it decides. Blocked until that ADR merges.

Cloud consumer: objectstack-ai/cloud#4016 (Enterprise stage 2 reads these checkpoints).

维护者速读

问题：同上一张 ADR 卡，审计日志被改被删时证明不了。
要做：按 ADR 实现封存器、检查点对象、脱敏和到期删除的修正记录、到期删除按检查点整块删除，以及 os audit verify。
需要你做的：无。ADR 合并前本卡保持阻塞。

Work

Implement the ADR in plugin-audit (canonical form, sealer, checkpoint object, amendments, verify command) and in objectql's lifecycle (prune aligned to whole checkpoints, with an expiry amendment). The design doc's §2.4 sets the cost bar: nothing on the insert path, about 20 µs per row to seal, 27 ms per 10,000-row checkpoint. A synchronous chain head cut throughput 13.8× at 8 writers per organization, so the sealer must stay asynchronous.

Done when

On a real kernel with the archive datasource, os audit verify reports:

a row edited through the system context as modified;
a deleted row as missing;
a redacted row as redacted, with its amendment;
a pruned window as expired by policy.

It reports an untouched window as unmodified, across the hot-to-archive move.

Who acts

The server lane, after the ADR merges.

Dedupe: as on the ADR card.

Related: cloud#4016, cloud PR #4025.

triage#1 · os-zhuang · session_01AavokzJ5DndAwitDXvKy4U

Path: none

Triage: p2 · `pm:on-hold` · waits on the maintainer's cloud#3823 call · 2026-11-09T12:01Z

⛔ Not a claim.

Lane: domain:server (the build for audit tamper-evidence: sealer and signed checkpoints). Per [Decision] repo:cloud is used in two senses: 6 open cards are the cloud PM's whole (with domain:cloud), 20 are objectstack-lane work that cloud asked for. Which one does the label mean? #31154 A, no repo:cloud.
Why on hold: this is cloud#3823 item 7. cloud/ROADMAP.md moved cloud#3823 off the roadmap on 2026-11-08 ("re-evaluated when a customer asks"), and under pm-dispatch：企业版相关卡的优先级以 cloud ROADMAP.md 为准，席位不另行排序；总监席每周复读并把不一致之处呈维护者（cloud#3835 子项 6） #31574 Enterprise work follows that table. Triage has put the keep-or-pause question for cloud#3823 to the maintainer.
Restart-when: the maintainer puts cloud#3823 back on the roadmap, or rules this item in on its own. The grade p2 is kept for then.

Generated by Claude Code

triage#1 · os-zhuang · session_01AavokzJ5DndAwitDXvKy4U

Path: none

Triage: hold lifted → `pm:queue` · `domain:server` · p2 · 2026-11-09T23:59Z

⛔ Not a claim.

The condition in triage's earlier note on docs/adr: audit ledger tamper-evidence — an asynchronous sealer, signed per-organization checkpoints, redaction and expiry amendments, and os audit verify #31907 is met: a recorded source for the cited rule.
- pm-dispatch lanes/cloud.md: the cloud lane dispatches its own security cards by priority, takes p3 after p1/p2, and mails the objectstack blockers of its cards to their lane (maintainer rulings 2026-11-09) #31991 quotes the maintainer verbatim (project chat, 2026-11-09): 「objectstack 阻塞卡，都应该邮箱通知对应的车道经理，优先处理。」
- Ruling (c) on cloud#4016 (11:30Z, build tamper-evidence in two stages) is also newer than the roadmap's 2026-11-08 "off the roadmap" row.
Waiter: cloud#4128 (stage 2). Order is docs/adr: audit ledger tamper-evidence — an asynchronous sealer, signed per-organization checkpoints, redaction and expiry amendments, and os audit verify #31907 (ADR) first, then plugin-audit + objectql lifecycle: build the audit tamper-evidence ADR — sealer, signed checkpoints, redaction and expiry amendments, os audit verify #31908 (build).
Roadmap drift: cloud/ROADMAP.md still lists tamper evidence under "Off the roadmap". The cloud lane owns that file, and repo:cloud#1 is mailed.

Generated by Claude Code

domain:server#4 · os-steve · session_01ADHkmP8JJo4zF2sjTBRwnX

Claim: PM loop round 14 · #31908 · 2026-11-10T04:56Z
Session: session_01ADHkmP8JJo4zF2sjTBRwnX (seat); dev = card thread session_01ADHkmR91XAgACaLbYX476P
Account: os-steve
Branch: claude/project-thread-vs4lnh
Worktree: the card thread's checkout of objectstack-ai/objectstack
Domain: domain:server
Seat: domain:server#4
File surface (provisional; Step 0 fixes it per slice and the seat amends this claim): packages/plugins/plugin-audit/** (canonical form, sealer, the three new objects, signer, amendment writer, the three migrations, AUDIT_EXCLUDED_OBJECTS), packages/objectql/src/lifecycle/** (the expiry seam beside registerReapGuard), packages/cli/** (os audit verify), and in packages/spec only src/data/object.zod.ts (lifecycle.seal and its authoring refusals), src/contracts/crypto-provider.ts (the audit_seal scope) and the two seam contracts, with their regenerated references and docs; root .changeset/. Never docs/adr/** (stop on breach)
Container & model: L, mode:thread, model: default tier, effort: high
Clause-②: yes (narrowing) (provisional: P1 widens the object schema with lifecycle.seal and refuses three lifecycle policies beside it at authoring; Step 0 re-reads each slice against scripts/pm/clause2-line.mjs and amends through the seat)
Metadata-protocol: added (P1: the authorable lifecycle.seal key; @objectstack/spec minor)
Responsibility: build ADR-0154 (adopted 2026-11-10, 6e766012f5) D1–D11 in four serial PRs from one thread: P1 sealing core (spec key with its reader as an ADR-0049 pair), P2 os audit verify, P3 redaction amendments, P4 expiry amendments (Fixes #31908) · today nothing can prove the audit log was not changed or deleted · read by Enterprise stage 2 (cloud#4128)
Thread-read: none
Premise: holds. ADR-0154 is on main; the ADR card #31907 is closed (landing note 6759357073).
Serial constraints: P1 → P2 → P3 → P4 on this seat. New public names beyond ADR-0154's table are nominated in Step 0 and ruled by the seat before code.

domain:server#4 · os-steve · session_01ADHkmP8JJo4zF2sjTBRwnX

Claim amendment · #31908 · 2026-11-10T05:04Z · amends claim 6759393778 · slice plan, File surface, Clause-② and Metadata-protocol for slice P1a (Branch claude/project-thread-vs4lnh unchanged)

Seat rulings on Step 0:

Five serial slices on this branch's thread, one PR each: P1a pure core, P1b lifecycle.seal with signer and sealer, P2 os audit verify, P3 redaction amendments, P4 expiry amendments. The default lifecycle.seal on sys_audit_log lands in P4, so no release between slices holds sealed rows that a later slice would read as modified or missing. P1a–P3 say Part of #31908; P4 says Fixes #31908. Each slice stays at or under 3000 lines.
Spec carrier: the three packages/spec additions ride on this card. ADR-0154 D2, D10 and D11 name plugin-audit + objectql lifecycle: build the audit tamper-evidence ADR — sealer, signed checkpoints, redaction and expiry amendments, os audit verify #31908 as their builder, and ADR-0049 needs the key and its reader in one PR. The protocol:data label on P1b is expected and is not a stop (precedents feat(audit): record the administrator on writes made while impersonating a user #30800, feat(audit): AI service accounts, O4 of ADR-0151 — principalKind reaches hooks and explain, so an account is attributed as itself #31740).
Handle id: under scope audit_seal, rotateKey MUST return the input's id. This is pinned against every provider shipped in this repository and against the rewrap writer. Out-of-tree providers are a carrier: cloud question.
Gaps ADR-0154 left to the build, all ruled in:
- a fourth sys_secret reference family audit-seal, so os secret rewrap re-wraps seeds and signing keys;
- explicit host composition through AuditPluginOptions.cryptoProvider;
- a non-null chain_key column for the (sealed_object, chain_key, sequence) unique index; the signed body keeps ADR-0154's NULL tenant_id for the deployment chain;
- seed and private-key sys_secret rows written below the hooks, so the sealer never seals its own writes.
Names:
- the columns nominated in Step 0;
- AUDIT_SEAL_WINDOW_MS, AUDIT_SEAL_SETTLE_MS, AUDIT_SEAL_LATE_HORIZON_MS (constants; there is no operator knob);
- the audit-seal reference family;
- registerExpiryPrefix (P4);
- the bundle format objectstack.audit.proof-bundle.v1.

This claim now covers slice P1a only. The seat amends it before each later slice.

File surface (P1a):

packages/spec: src/contracts/crypto-provider.ts, a new src/contracts/audit-checkpoint.ts, the contracts barrel, and api-surface/**.
packages/plugins/plugin-audit:
- src/audit-seal/** (canonical form, commitments, seed salts, Merkle tree, signed-body builder);
- the three new object files and objects/index.ts;
- audit-writers.ts, with the excluded-object set literal only;
- regenerated translations.
packages/cli: src/utils/secret-reference-union.ts and src/utils/sys-secret-rewrap.ts.
packages/services/service-settings: the rotateKey id pin.
Root .changeset/.

Never docs/adr/**, never packages/spec/src/data/** in this slice (stop on breach).

Clause-②: yes (widening) (new exported contracts, a new crypto scope member and three platform objects; nothing main accepts is refused)
Metadata-protocol: none (platform objects and contracts; no authorable key in this slice)

domain:server#4 · os-steve · session_01ADHkmR91XAgACaLbYX476P
os-dev-report

{
 "issue": 31908,
 "status": "done",
 "slice": "P1a of 5 (P1a, P1b, P2, P3, P4); stops at the slice boundary per seat 4, P1b not started",
 "branch": "claude/project-thread-vs4lnh",
 "pr": "https://github.com/objectstack-ai/objectstack/pull/32100",
 "head": "335c18cb4ac760433165e35a9d675dbbe8e683c1",
 "session": "session_01ADHkmR91XAgACaLbYX476P",
 "premise_still_valid": true,
 "summary": "ADR-0154 slice P1a. spec gains the audit_seal crypto scope (with rotateKey's keep-the-id MUST under it) and the IAuditCheckpointSigner / IAuditCheckpointSink contracts. plugin-audit gains the pure core in src/audit-seal (RFC 8785 JCS, canonical row form, salted commitments, seed salts and sealing contexts, RFC 6962 Merkle tree, signed bodies of checkpoints and amendments) and three exported, NOT yet registered objects, kept out of the audit writer. cli's sys_secret reference union gains the fourth family audit-seal (enumerated-empty without evidence, gap with evidence, references with their minted pair when registered), and rewrap maps it to scope audit_seal. Nothing seals in this slice.",
 "tests": "New pins: plugin-audit audit-seal-core.test.ts 23/23; audit-writers.test.ts tamper-evidence describe (4); cli secret-reference-union.audit-seal.test.ts 7/7; sys-secret-rewrap.test.ts KEEPS THE ROW ID; service-settings local-crypto-provider.test.ts rotateKey-keeps-id-per-scope. Full suites: plugin-audit 82 files / 1293 tests passed; service-settings 75 / 1443 passed; cli src/utils+src/commands/secret+src/commands/db 149 files passed, 1 skipped / 2336 tests passed, 1 skipped. Ablations via scripts/ablation-replace.mjs, each red then restored with git diff HEAD empty: (1) date-before-datetime in canonicalValue, (2) the second salt separator (rerun on the Buffer.concat shape), (3) the canonical-spelling check in isAuditSealSecretCoordinate, (4) the three SKIP_OBJECTS entries, (5) the evidence gap in the audit-seal family, (6) the registered-holder read, (7) the rewrap next.id check, (8) LocalCryptoProvider.rotateKey keeping the id. A real bug was found by the pins before the first push: a date column handed back as a Date canonicalised as a full instant (fixed in canonicalValue).",
 "gates": "Final head 335c18cb: `dispatch-gates --commands` derived 106; all 106 run under os-verify-lock with exit codes recorded before any pipe; `dispatch-gates --ran` -> '106 derived, 106 run, 0 NOT-MEASURED, 0 UNRUN' (exit 0). Every one of the 106 exited 0. Fixed on the way (earlier heads): check-tenant-audit-census (chained Hash.update -> one update), check:keyed-text-bounds (3 keyed columns bounded), check:platform-object-tenancy-census / spec check:api-surface / check:export-origins (artefacts regenerated), check-issue-citations (dangling #N in a comment), check:test-source-alias (preloads in an edited test). Environment-only reds of round 1, green on the final head: check-plugin-teardown-shape --self-test (shallow clone, fixture commit fetched), check:dual-build-cjs-loads and check:i18n-coverage (unbuilt foreign packages; built). Root eslint per touched dir: packages/spec 0, packages/plugins/plugin-audit 0, packages/cli 0, packages/services/service-settings 0. Typecheck: spec 0, plugin-audit 0, cli 0, service-settings 0 (spec and cli test-layer halves with NODE_OPTIONS=--max-old-space-size=8192 after an OOM on the default heap). Offline PR-body check: check-changeset-no-major --event -> LEVEL AXIS yes (widening) / none at patch, exit 0. CI not awaited.",
 "dogfood_battery": "n/a — no `!` in the PR title and no (narrowing) arm",
 "mcp_calls": "7 — all read-only: mcp__github__issue_read x5, mcp__github__get_file_contents x2 (Step 0 and claim reads); no write tool",
 "api_writes": "2 so far — relay pr_create (fleet-write run 42777485419, #32100, 11544 bytes sent = stored), and this os-dev-report comment via post-stamped.mjs; the seat-4 thread message is not a GitHub write",
 "files_changed": [
  ".changeset/31908-audit-seal-core.md",
  "packages/cli/src/commands/secret/orphans.guards.test.ts",
  "packages/cli/src/commands/secret/rewrap.driver-contract.test.ts",
  "packages/cli/src/commands/secret/rewrap.guards.test.ts",
  "packages/cli/src/commands/secret/rewrap.ts",
  "packages/cli/src/utils/secret-reference-union.audit-seal.test.ts",
  "packages/cli/src/utils/secret-reference-union.test.ts",
  "packages/cli/src/utils/secret-reference-union.ts",
  "packages/cli/src/utils/sys-secret-holder-report.test.ts",
  "packages/cli/src/utils/sys-secret-orphan-sweep.test.ts",
  "packages/cli/src/utils/sys-secret-orphan-sweep.ts",
  "packages/cli/src/utils/sys-secret-rewrap.test.ts",
  "packages/cli/src/utils/sys-secret-rewrap.ts",
  "packages/plugins/plugin-audit/src/audit-seal/audit-seal-core.test.ts",
  "packages/plugins/plugin-audit/src/audit-seal/canonical.ts",
  "packages/plugins/plugin-audit/src/audit-seal/index.ts",
  "packages/plugins/plugin-audit/src/audit-seal/jcs.ts",
  "packages/plugins/plugin-audit/src/audit-seal/merkle.ts",
  "packages/plugins/plugin-audit/src/audit-seal/seed.ts",
  "packages/plugins/plugin-audit/src/audit-seal/signed-body.ts",
  "packages/plugins/plugin-audit/src/audit-writers.test.ts",
  "packages/plugins/plugin-audit/src/audit-writers.ts",
  "packages/plugins/plugin-audit/src/index.ts",
  "packages/plugins/plugin-audit/src/objects/index.ts",
  "packages/plugins/plugin-audit/src/objects/sys-audit-amendment.object.ts",
  "packages/plugins/plugin-audit/src/objects/sys-audit-checkpoint.object.ts",
  "packages/plugins/plugin-audit/src/objects/sys-audit-signing-key.object.ts",
  "packages/services/service-settings/src/local-crypto-provider.test.ts",
  "packages/spec/api-surface/contracts.json",
  "packages/spec/export-origins/contracts.json",
  "packages/spec/src/contracts/audit-checkpoint.ts",
  "packages/spec/src/contracts/crypto-provider.ts",
  "packages/spec/src/contracts/index.ts",
  "scripts/platform-object-tenancy-census.json"
 ],
 "line_budget": "34 files changed, 2194 insertions(+), 28 deletions(-) (<= 3000)",
 "deviations": [
  "Outside the claimed P1a file surface: packages/cli/src/utils/sys-secret-orphan-sweep.ts (the 'of 3 families' text now reads SECRET_REFERENCE_FAMILIES.length) and packages/cli/src/commands/secret/rewrap.ts (human render prints the audit_seal count). Both follow from the fourth family.",
  "Outside the claimed surface: scripts/platform-object-tenancy-census.json, the generated artefact check:platform-object-tenancy-census requires for three new out-of-reach objects (regenerated with --write, not hand-edited).",
  "Forced test files outside the claim, all named in the PR body: secret-reference-union.test.ts, sys-secret-holder-report.test.ts, sys-secret-orphan-sweep.test.ts, sys-secret-rewrap.test.ts, commands/secret/rewrap.guards.test.ts, commands/secret/rewrap.driver-contract.test.ts, commands/secret/orphans.guards.test.ts (the last also gained the check:test-source-alias preloads, no assertion changed).",
  "The claim lists 'regenerated translations' for P1a; none were regenerated. The three objects are not registered in this slice, and the extract config plus the bundle-ownership test own the translated object list, so translations land with registration in P1b.",
  "The pin 'deployment chain gets no extra ledger rows from the sealer's own writes' (ruling 3d) needs the sealer and lands in P1b; P1a pins only that the three objects are excluded from the writer.",
  "Changeset covers spec, plugin-audit and cli at patch (Metadata-protocol none); service-settings has a test-only change and no changeset entry."
 ],
 "open_questions": [
  {
   "question": "LocalCryptoProvider is the only provider this repository ships, so the rotateKey keep-the-id MUST is pinned once. Should a cloud-side KMS provider get a matching conformance pin?",
   "options": [
    "A: a carrier: cloud note on the card, the pin lives in cloud",
    "B: export a provider conformance helper from spec in P1b"
   ],
   "recommendation": "A, because the seat already ruled out-of-tree providers carrier: cloud"
  }
 ],
 "security_findings": "none",
 "out_of_scope_findings": []
}

Stamped 2026-11-10T07:46Z.

domain:server#4 · os-steve · session_01ADHkmP8JJo4zF2sjTBRwnX

Claim amendment · #31908 · 2026-11-10T07:56Z · amends claim 6759393778 (after amendment 6759503769) · File surface for slice P1a (Branch claude/project-thread-vs4lnh, Clause-② yes (widening) and Metadata-protocol none unchanged)

The P1a file surface adds four files the build needed:

packages/cli/src/utils/sys-secret-orphan-sweep.ts: the fourth reference family's unregistered-holder rule.
packages/cli/src/commands/secret/rewrap.ts: its text names the families.
packages/plugins/plugin-audit/src/index.ts: named exports only, limited to what is used outside the package.
The generated scripts/platform-object-tenancy-census.json.

Names ruled by the seat for PR #32100:

AUDIT_CHECKPOINT_SIGNER_SERVICE and AUDIT_CHECKPOINT_SINK_SERVICE, the constants for ADR-0154's slots audit.checkpointSigner and audit.checkpointSink, following CRYPTO_PROVIDER_SERVICE.
AuditCheckpointSignature and AuditCheckpointSinkEntry, the types of the ruled seam shapes.

No other new public name.

domain:server#4 · os-steve · session_01ADHkmR91XAgACaLbYX476P
os-dev-report

{
 "issue": 31908,
 "status": "done",
 "slice": "P1a of 5 (P1a, P1b, P2, P3, P4); stops at the slice boundary per seat 4, P1b not started",
 "branch": "claude/project-thread-vs4lnh",
 "pr": "https://github.com/objectstack-ai/objectstack/pull/32100",
 "head": "423407419085518fac74efa7795433119aea5b81",
 "session": "session_01ADHkmR91XAgACaLbYX476P",
 "premise_still_valid": true,
 "summary": "ADR-0154 slice P1a. spec gains the audit_seal crypto scope (with rotateKey's keep-the-id MUST under it) and the IAuditCheckpointSigner / IAuditCheckpointSink contracts. plugin-audit gains the pure core in src/audit-seal (RFC 8785 JCS, canonical row form, salted commitments, seed salts and sealing contexts, RFC 6962 Merkle tree, signed bodies of checkpoints and amendments) and three exported, NOT yet registered objects, kept out of the audit writer. cli's sys_secret reference union gains the fourth family audit-seal (enumerated-empty without evidence, gap with evidence, references with their minted pair when registered), and rewrap maps it to scope audit_seal. Nothing seals in this slice.",
 "tests": "Round 1: plugin-audit full suite 82 files / 1299 tests passed (core file 29/29); cli src/utils+src/commands/secret+src/commands/db 149 files passed, 1 skipped / 2336 passed, 1 skipped. Ablations 9 and 10 via scripts/ablation-replace.mjs, each red then restored with git diff HEAD empty; ablations 1-8 from the first report stand (8 re-run against the earlier shape, 2 re-run on the Buffer.concat shape).",
 "gates": "Head 42340741: dispatch-gates --commands derived 106 (same list as 335c18cb); all 106 run under os-verify-lock, exit codes recorded before any pipe, every one 0; dispatch-gates --ran -> '106 derived, 106 run, 0 NOT-MEASURED, 0 UNRUN' (exit 0). Typecheck plugin-audit 0, cli 0 (NODE_OPTIONS=--max-old-space-size=8192); root eslint packages/plugins/plugin-audit 0, packages/cli 0 (spec and service-settings untouched this round: their round-0 typecheck/lint 0 stand). Offline check-changeset-no-major --event on the revised body: exit 0. CI not awaited.",
 "dogfood_battery": "n/a — no `!` in the PR title and no (narrowing) arm",
 "mcp_calls": "7 — all read-only: mcp__github__issue_read x5, mcp__github__get_file_contents x2 (Step 0 and claim reads); no write tool",
 "api_writes": "4 total — pr_create (#32100), the first os-dev-report comment 6761943000, issue_patch of the #32100 body (run 42784754509, 13571 bytes sent = stored), and this comment",
 "files_changed": [
  ".changeset/31908-audit-seal-core.md",
  "packages/cli/src/commands/secret/orphans.guards.test.ts",
  "packages/cli/src/commands/secret/rewrap.driver-contract.test.ts",
  "packages/cli/src/commands/secret/rewrap.guards.test.ts",
  "packages/cli/src/commands/secret/rewrap.ts",
  "packages/cli/src/utils/secret-reference-union.audit-seal.test.ts",
  "packages/cli/src/utils/secret-reference-union.test.ts",
  "packages/cli/src/utils/secret-reference-union.ts",
  "packages/cli/src/utils/sys-secret-holder-report.test.ts",
  "packages/cli/src/utils/sys-secret-orphan-sweep.test.ts",
  "packages/cli/src/utils/sys-secret-orphan-sweep.ts",
  "packages/cli/src/utils/sys-secret-rewrap.test.ts",
  "packages/cli/src/utils/sys-secret-rewrap.ts",
  "packages/plugins/plugin-audit/src/audit-seal/audit-seal-core.test.ts",
  "packages/plugins/plugin-audit/src/audit-seal/canonical.ts",
  "packages/plugins/plugin-audit/src/audit-seal/index.ts",
  "packages/plugins/plugin-audit/src/audit-seal/jcs.ts",
  "packages/plugins/plugin-audit/src/audit-seal/merkle.ts",
  "packages/plugins/plugin-audit/src/audit-seal/seed.ts",
  "packages/plugins/plugin-audit/src/audit-seal/signed-body.ts",
  "packages/plugins/plugin-audit/src/audit-writers.test.ts",
  "packages/plugins/plugin-audit/src/audit-writers.ts",
  "packages/plugins/plugin-audit/src/index.ts",
  "packages/plugins/plugin-audit/src/objects/index.ts",
  "packages/plugins/plugin-audit/src/objects/sys-audit-amendment.object.ts",
  "packages/plugins/plugin-audit/src/objects/sys-audit-checkpoint.object.ts",
  "packages/plugins/plugin-audit/src/objects/sys-audit-signing-key.object.ts",
  "packages/services/service-settings/src/local-crypto-provider.test.ts",
  "packages/spec/api-surface/contracts.json",
  "packages/spec/export-origins/contracts.json",
  "packages/spec/src/contracts/audit-checkpoint.ts",
  "packages/spec/src/contracts/crypto-provider.ts",
  "packages/spec/src/contracts/index.ts",
  "scripts/platform-object-tenancy-census.json"
 ],
 "line_budget": "34 files changed, 2251 insertions(+), 28 deletions(-) (<= 3000)",
 "deviations": [
  "Out-of-surface files now named in claim amendment 6762115714 and in the PR body: cli/src/utils/sys-secret-orphan-sweep.ts, cli/src/commands/secret/rewrap.ts, plugin-audit/src/index.ts, scripts/platform-object-tenancy-census.json (generated).",
  "Forced test files outside the claim, named in the PR body: secret-reference-union.test.ts, sys-secret-holder-report.test.ts, sys-secret-orphan-sweep.test.ts, sys-secret-rewrap.test.ts, commands/secret/rewrap.guards.test.ts, commands/secret/rewrap.driver-contract.test.ts, commands/secret/orphans.guards.test.ts (+ check:test-source-alias preloads, no assertion changed).",
  "Deferred to P1b and stated in the PR body: ruling 3d's pin (needs the sealer) and the objects' translations (land with registration).",
  "Changeset covers spec, plugin-audit and cli at patch (Metadata-protocol none); service-settings has a test-only change and no entry."
 ],
 "open_questions": [
  {
   "question": "canonicalValue passes number and JSON columns through as the driver hands them back. A driver that returns a JSON column as text on one read and parsed on another, or a decimal as a string, would hash the same value two ways. Harmless for sys_audit_log: its three value columns are textarea and its clear columns are text, textarea, select, lookup or datetime, so no number or json column reaches canonicalValue there. It must be decided before any other object opts in.",
   "options": [
    "A: in P1b, normalize by declared type — number/currency/percent to a JS number (refusing a non-finite or unsafe value), json to its parsed value — and pin both spellings per type",
    "B: refuse to seal an object that declares a clear number/json column until a later card decides"
   ],
   "recommendation": "A in P1b, because lifecycle.seal is the first place another object can opt in, and the normalizer belongs beside the key that enables it"
  },
  {
   "question": "LocalCryptoProvider is the only provider this repository ships, so the rotateKey keep-the-id MUST is pinned once. Should a cloud-side KMS provider get a matching conformance pin?",
   "options": [
    "A: a carrier: cloud note on the card, the pin lives in cloud",
    "B: export a provider conformance helper from spec in P1b"
   ],
   "recommendation": "A, because the seat already ruled out-of-tree providers carrier: cloud"
  }
 ],
 "security_findings": "none",
 "out_of_scope_findings": [],
 "round": "review round 1 (asks /mnt/project-files/server-seat4/32100-review-r1-asks.md, against head 335c18cb)",
 "round_changes": [
  "Names: the plugin-audit root no longer re-exports the whole core; it exports AUDIT_SEAL_SECRET_HOLDERS, checkpointSeedContext, isAuditSealSecretCoordinate, signingKeyContext (the four the cli reads). The cli family test now takes holder names from AUDIT_SEAL_SECRET_HOLDERS and mints a seed with node:crypto. The PR body lists the four.",
  "Ask 1: the PR body section 'Outside the claimed file surface' names sys-secret-orphan-sweep.ts, commands/secret/rewrap.ts, plugin-audit/src/index.ts and scripts/platform-object-tenancy-census.json, one reason each (claim amendment 6762115714).",
  "Ask 2: the PR body section 'Deferred to P1b' names ruling 3d's pin and the translations.",
  "Ask 3: no refusal on the canonical-form/commitment path echoes a value (jcs.ts non-finite number, canonical.ts datetime/boolean/row id; seed.ts sequence for consistency): column and type only. Pin 'a refusal never echoes the value it refused' (5 cases); ablation 9 (echo restored) red.",
  "Ask 4: pin 'the deployment chain signs a NULL organization' — signed bytes read back from the stored row contain \"tenant_id\":null and no chain_key/deployment; ablation 10 (NULL read back as 'deployment') red.",
  "Ask 5: canonicalValue's number/JSON normalization recorded in open_questions for P1b."
 ]
}

Stamped 2026-11-10T08:43Z.

domain:server#4 · os-steve · session_01ADHkmP8JJo4zF2sjTBRwnX

Claim amendment · #31908 · 2026-11-10T08:53Z · amends claim 6759393778 (after amendments 6759503769 and 6762115714) · File surface and names for slice P1a (Branch claude/project-thread-vs4lnh, Clause-② yes (widening) and Metadata-protocol none unchanged)

File surface adds packages/spec/src/system/constants/platform-object-names.ts. Its PLATFORM_OBJECTS_BY_PACKAGE['plugin-audit'] group gains the three new object names, as the registry test requires of every platform object.
Correction to 6762115714: sys-secret-orphan-sweep.ts changes only the family count in one message. The unregistered-holder rule lives in packages/cli/src/utils/secret-reference-union.ts, which is already on the surface.
Names ruled by the seat: @objectstack/plugin-audit's root exports exactly four names, all consumed by the CLI: AUDIT_SEAL_SECRET_HOLDERS, checkpointSeedContext, isAuditSealSecretCoordinate and signingKeyContext. The root has no star export.

domain:server#4 · os-support-ai · session_01WGufzi1tLRTEYwYGtbNCyk

Takeover · #31908 · 2026-11-10T10:00Z

① Release (cross-account): claim 6759393778 (with amendments 6759503769, 6762115714, 6763152203) of domain:server#4 · os-steve · session_01ADHkmP8JJo4zF2sjTBRwnX, dev thread session_01ADHkmR91XAgACaLbYX476P, is released. Provenance: the maintainer, verbatim, 「接手 server 车道，前任没token了，这是留言，你应该接手他们的所有工作。」, in the os-support-ai account's project chat ("objectstack spec") at 2026-11-10T09:46Z. Seat post #27737, opening mark 6764280400.

④ Hand-over record: claude/project-thread-vs4lnh last pushed 423407419085518fac74efa7795433119aea5b81 = draft PR #32100, slice P1a, contract review 6763138129 VERDICT FAIL (M1 must-fix: PLATFORM_OBJECTS_BY_PACKAGE['plugin-audit'] out of date, CI Test Core (2/8) red; S1–S5 should-fix). The new dev resumes from that sha on its own branch; #32100 is closed as superseded when the new PR opens. P1b–P4 not started.

Seat rulings for round 2 (the review's asks; the dev's two open questions):

M1, S2, S4, S5 as the review states them.
S1: keep the ruled sign() shape; the contract documents the caller's duty (compare the returned keyId with the bytes', rebuild and re-sign when they differ). The loop is pinned in P1b.
S3: a redaction amendment references the checkpoint by its signed checkpoint_sequence (chain already in the body), not checkpoint_id; body, builder, normaliser, sys_audit_amendment column and pins change. Inside ADR-0154 D7 ("the checkpoint that sealed the row"); no ADR edit.
Nits taken now: isAuditSealSecretCoordinate answers false instead of throwing; nullableText refuses an absent tenant_id (NULL stays the deployment chain); an empty-string sequence is malformed, not 0; canonicalDatetime jsdoc names epoch milliseconds. Carried to P1b: the jcs.ts error path, the sys-secret.object.ts producer count.
Open question 1 (canonicalValue pass-through): A, widened. In P1b beside lifecycle.seal, every declared column type has a normalisation rule (number family → finite safe JS number; json → parsed) with both spellings pinned, or sealing an object with a clear column of a type with no rule is refused.
Open question 2 (KMS rotateKey pin): A, carrier: cloud; the note also names the widened CryptoContextScope union.

③ Claim

Claim: PM loop round 1 · #31908 · 2026-11-10T10:00Z
Session: session_01WGufzi1tLRTEYwYGtbNCyk (seat); dev = card thread session_01WGufzgZ1XkMJRqn9raHQ4e
Account: os-support-ai
Branch: claude/project-thread-8ykewa
Worktree: the card thread's checkout of objectstack-ai/objectstack (objectstack-issue-31908)
Domain: domain:server
Seat: domain:server#4
File surface: slice P1a as claim 6759393778 amended by 6759503769, 6762115714 and 6763152203, plus the sys_audit_amendment column change of S3 (already in packages/plugins/plugin-audit/src/objects/**). Never docs/adr/**, never packages/spec/src/data/**, nothing of P1b (stop on breach)
Container & model: L, mode:thread, model: default tier (dispatch-gates --tier: no path-derived mandate), effort: xhigh
Clause-②: yes (widening)
Metadata-protocol: none
Responsibility: build ADR-0154 slice P1a (pure core, contracts, three unregistered objects, the audit-seal secret family) · today nothing can prove the audit log was not changed or deleted · read by Enterprise stage 2 (cloud#4128) through P1b–P4
Thread-read: 6763152203
Premise: holds. ADR-0154 on main 45f0f81f; #32100's review names the remaining defects.
Serial constraints cleared: P1a → P1b → P2 → P3 → P4 on this seat; no other in-flight claim on packages/plugins/plugin-audit/**.
Resume-from: claude/project-thread-vs4lnh@423407419085518fac74efa7795433119aea5b81

triage#1 · hotlong · session_01Q4EjjMnyLqJdzuktEmRPXH

Path: none

Triage: H14 · `pm:blocking` derived · 2026-11-13T12:16Z

⛔ Not a claim; grade and state unchanged. Open card(s) #32737 name this card on a line-leading Blocked-by:, so the derived cache is added. It comes off when they close or drop the line.

domain:server#5 · os-elon-musk · session_016WV4czXwx6JtQPvacrzzUw
Seat ruling on P4b (2026-11-14T21:33Z), reviewed once before posting. Slicing P4a / P4b / P4c approved. P4a goes ahead with no ruling ("Part of #31908"). P4c waits for P4b.

S7: bound, amended. A chain's window seals into consecutive checkpoints of at most N = 10,000 leaves. N is a fixed constant, not a knob. Ids are sorted, and late checkpoints are capped the same way.
- The signed body carries a part index and a final flag, so a crash mid-window resumes as window and the rest is never mislabelled late.
- Sealer S1 ("not sealed twice") relaxes to allow parts of the same window.
- The verifier faults any row id listed by two checkpoints.
- This changes ADR-0154 D4 ("one root per chain per window") and its cost line, so it ships with an ADR-0154 amendment in its own governed PR, which the seat lands.
S4: isolate, amended. Only chain-local faults skip a chain. Lock lapse, signer, crypto and storage faults still abort the whole pass.
- A skipped chain stays out for the rest of the pass and resumes from its own oldest unsealed window. That needs a per-chain cursor, since today's cursor is object-wide.
- sealed_through never advances past a window that has a skipped chain, because D3 signs it as covering every chain.
- Verify stays loud: the skipped rows read unsealed and ok is false. Pin that with a test; a log line alone is not enough.
App-supplied AuditPlugin: hand it the host provider, amended. Serve injects hostCrypto.provider and armSealer only into an instance of the real AuditPlugin class whose cryptoProvider is unset.
- It never overrides an explicit provider and never feeds a same-named lookalike.
- It keeps D3's once-at-error report and does not refuse boot.
- This matches the existing requires: ['audit'] path in serve.
Verify bootStack: amended. Pass harnessCryptoProvider(), the same instance that settings and the engine get. Never pass a bare new LocalCryptoProvider(), which would read the host key or mint a key file (os verify mints a data key file in the key home: the verify harness composes the settings service and the engine with the default minting provider (the packages/verify half of #21471's family) #21499 custody).
- os audit verify is a separate path. It keeps the serve provider via oneShotCrypto and must never get a local key.
- Premise: on main bootStack builds no AuditPlugin, so this applies only where P4 adds one.

No legacy-data migration (maintainer, 2026-11-14: no production customers yet).