@@ -0,0 +1,21 @@
+---
+'@objectstack/service-datasource': patch
+'@objectstack/cli': patch
+'@objectstack/spec': patch
+---
+
+feat(service-datasource): a datasource defined in code reads its credential at connect from `OS_DATASOURCE_<NAME>_PASSWORD`
+
+Clause-②: yes (widening) — `@objectstack/service-datasource` exports `datasourceEnvCredentialVar`, `resolveDatasourceEnvCredentialsSwitch`, `DATASOURCE_ENV_CREDENTIALS_SWITCH` and the `DatasourceEnvCredentialSource` type, and `DatasourceConnectionServiceConfig` gains the optional `envCredentials`; `@objectstack/spec/data` exports `CODE_DEFINED_CREDENTIAL_ROUTE`. Nothing an author writes is added or refused.
+Metadata-protocol: none
+
+A datasource declared in code (`defineDatasource`, or a package's `*.datasource.ts`) had no way to get its password: the driver contracts refuse `config.password` and a `user:password@` URL, the Setup → Datasources form cannot edit a code datasource, and nothing mints a `sys_secret:` handle for one. Now the credential stays out of the declaration and is read at connect from a variable derived from the datasource name: `warehouse` reads `OS_DATASOURCE_WAREHOUSE_PASSWORD` (upper-cased; every character outside `A-Z0-9` becomes `_`). The value is the connection's secret: the password for postgres, mysql and mongodb, the `authToken` for turso.
+
+- **A host switch.** `OS_DATASOURCE_ENV_CREDENTIALS` takes `on` or `off`; any other value refuses the boot with a sentence. `os serve` (and so `os start` and `os dev`) turns it on unless the operator set it. Every other composition leaves it off, so a host that loads several tenants' artifacts into one process never reads the variable.
+- **Code datasources only, by provenance.** The variable is read on the boot's declared connect, for a name in the host's code-datasource set: the booted artifact's datasources and those of a package installed locally. A datasource created through Setup or the API under the same name never reads it, and neither does the `default` datasource, which keeps `OS_DATABASE_URL`. A record's own `origin` is never consulted.
+- **A declared credential wins.** With `external.credentialsRef` or `external.connector` declared the variable is not read, and a reference that fails to resolve stays fail-closed.
+- **Unset.** The connect goes ahead without a secret as before; when the database then refuses, the reason names the variable to set.
+- **Two names deriving one variable** are refused at their connect.
+- **Who can read it.** Any code datasource the host registers under a name reads that name's variable, including one in an installed package. Install only packages you trust with the credentials in the process environment.
+
+The credential refusals (`config.password`, a URL userinfo password, a credential query parameter, the mongo `options` passthrough) and the two `password` guidance entries on `DatasourceSchema` / `ExternalDatasourceSettingsSchema` end with one shared sentence naming this route, after the Setup and `external.credentialsRef` routes they already name. `planCredentialMigration`'s remedy for a code-defined row names the row's variable.
@@ -0,0 +1,16 @@
+---
+'@objectstack/platform-objects': patch
+---
+
+feat(platform-objects): the platform identity actions an agent may reach declare it — additive acts exposed, destructive lifecycle acts exposed behind confirmation, credential and ownership acts human-only
+
+Clause-②: no
+Metadata-protocol: none
+
+The `sys_*` identity objects' actions now carry the ADR-0011 `ai` block by risk, as ADR-0011's 2026-10-30 addendum records (58 actions assessed, 38 declared):
+
+- **Exposed (21).** Additive or self-scoped acts declare `ai: { exposed: true, description }`: the four `invite_user` mirrors, resending and accepting an invitation, adding a member to an organization or a team, creating, editing and renaming a team or an organization, switching the active organization, re-enabling an OAuth application, enabling two-factor authentication, updating your own profile, resending the verification email, and requesting SSO domain verification.
+- **Exposed, confirmation required (17).** Destructive or privilege-changing lifecycle acts also declare `requiresConfirmation: true`, so MCP `run_action` refuses them `428 ACTION_CONFIRMATION_REQUIRED`, with nothing run, until the call carries `confirm: true`: banning, unbanning and unlocking a user, setting a user's manager, revoking an API key or a session, signing out other devices, cancelling or declining an invitation, removing a member or a team member, deleting a team, an OAuth application or an SSO provider, disabling an OAuth application, leaving an organization, and unlinking a sign-in provider.
+- **Human-only (20).** Acts that mint a credential or a session, change ownership, a role or a sign-in factor, or destroy an account or an organization (impersonating a user, setting a password, creating a user or an API key, transferring ownership, changing a member's role, deleting an organization, and the rest the addendum names) declare no `ai` block and are not listed over MCP. `sys_invitation.copy_invitation_link` declares none either; it was not part of the assessment.
+
+Over MCP these actions are listed and run behind every existing gate: the capability gate, the installation's action switch, the param contract, the confirmation gate and the identity route's own authorization. They are `type: 'api'` actions forwarded to identity routes that accept a signed-in session only, so an agent connected over OAuth sees them listed and is refused at the route when it runs one.
@@ -0,0 +1,11 @@
+---
+'@objectstack/skills': patch
+---
+
+docs(skills): the field-types guide names the backfill for an amount switched to record mode; the dashboards guide says a record-mode amount aggregate is served only grouped by its code field
+
+Clause-②: no
+Metadata-protocol: none
+
+- **`objectstack-data/rules/field-types.md`**: an amount field with stored rows that is switched to `currencyMode: 'record'` is backfilled with `os migrate record-currency-codes`. The derived-measure sentence moves out of this guide; it already sits in the dashboards guide, which the line now points to.
+- **`objectstack-ui/rules/dashboards.md`**: a record-mode amount refuses `sum` / `avg` / `min` / `max` unless grouped by its code field. The old "ungrouped" read as if any grouping would do.
@@ -261,6 +261,20 @@ can reach is the **default exposure policy (v1)**:
   The stored-metadata tables (`sys_metadata`, `sys_metadata_history`) stay
   refused even when flagged. Each action `list_actions` returns carries
   `aiExposed: true`, the server's attestation of that opt-in.
+- **The platform's own identity actions declare it by risk.** Additive acts
+  (inviting someone, adding a member to a team, creating or renaming a team or
+  an organization, re-enabling an OAuth application) are exposed. Destructive
+  lifecycle acts (banning a user, revoking a session or an API key, removing a
+  member, deleting a team, leaving an organization) are exposed with
+  `ai.requiresConfirmation: true`, so `run_action` refuses them until the call
+  carries `confirm: true`. Acts that mint a credential or a session, change
+  ownership or a sign-in factor, or destroy an account or an organization
+  (impersonating a user, setting a password, creating an API key, transferring
+  ownership, deleting an organization) declare nothing and are not listed. The
+  full list is ADR-0011's 2026-10-30 addendum. These actions forward to
+  identity routes that accept a signed-in session only, so an agent connected
+  over OAuth sees them listed, but a call that reaches the identity route is
+  refused there (`401`) and changes nothing.
 
 <Callout type="info">
 This is the default policy, not a ceiling. A finer, **metadata-declared** exposure
 
@@ -579,6 +579,7 @@ retry):
 | MCP server unreachable / `tools/list` fails; remote spec URL unreachable or transiently failing (408/429/5xx) | **Not fatal**: the instance registers **degraded** (visible on `GET /api/v1/automation/connectors` with the reason), dispatches fail with that reason, and the platform retries on a 5s→5min backoff — recovery is automatic |
 | A retry of a degraded instance reaches the upstream and meets a configuration fault (an `include` naming a tool or operation the upstream does not offer) | **Not fatal**: the instance stays **degraded**, now with the configuration reason, and is **not retried** — dispatches fail saying to edit its declaration; an edit of the entry (or a restart) re-attempts it |
 | Wrong spec URL (other 4xx) or unparseable document | Configuration fault — **hard boot error** |
+| A `connector_action` input that, once evaluated, breaks the action's `inputSchema` (a missing `required` parameter, a wrong `type`) | **The step fails before dispatch** with `VALIDATION_ERROR`, naming each parameter path, and nothing is sent; a `fault` edge or `try_catch` can route it. Supply the parameter or send the declared type: text is never converted, so cast it in a CEL envelope (`int()`, `double()`, `bool()`). `GET /api/v1/automation/connectors` lists the schema; `os validate` does not judge the input against the `inputSchema` yet |
 | A bad entry arrives via **runtime reload** (a Studio publish, a direct active save through `PUT /api/v1/meta/connector/:name`, or a delete, made on any replica — peers reconcile on [cluster lane 2](/docs/kernel/cluster#62-the-cluster-invalidation-family); or a dev reload) | Logged and **skipped**, never crashing the live server; a changed instance's old connector keeps serving until its replacement materializes |
 
 ## Catalog descriptors: entries without a `provider`
 
@@ -944,11 +944,13 @@ export default defineStack({
 ```
 
 Each `url` must be credential-free when the stack is published: a
-`user:password@` URL is refused, like an inline `config.password`. Bind the
-password through `external.credentialsRef` instead, keeping the user in the URL
-(`mongodb://svc@host/db`): the bound secret is injected beside it at connect. The
-[read-only example](#read-only-grant-it-at-the-database-not-in-metadata) below
-shows the binding.
+`user:password@` URL is refused, like an inline `config.password`. Keep the user
+in the URL (`mongodb://svc@host/db`) and supply the password at runtime: a
+datasource declared in code reads it at connect from `OS_DATASOURCE_<NAME>_PASSWORD`
+(`OS_DATASOURCE_ANALYTICS_PASSWORD` here), which `os serve` / `os start` honour by
+default, and the value is injected beside the user. A datasource created through
+Setup binds it through `external.credentialsRef` instead. See
+[Credentials](/docs/data-modeling/external-datasources#4-credentials).
 
 Then in your object definition:
 
@@ -990,19 +992,21 @@ export const Analytics = defineDatasource({
   driver: 'postgres',
   // The connection itself cannot write. Nothing in the app can talk past it.
   config: { host: 'db.internal', database: 'analytics', username: 'analytics_ro' },
-  // The account's password, bound through the secret store (see below).
-  external: { credentialsRef: 'sys_secret:9f2c…' },
+  // The account's password is read at connect from OS_DATASOURCE_ANALYTICS_PASSWORD.
   active: true,
 });
 ```
 
 The read-only account's password never goes in `config`: the driver contract
-refuses `config.password`, and a `user:password@` URL, at publish. Bind it
-instead. The Setup → Datasources connection form's secret field encrypts it into
-`sys_secret` and stores the opaque handle at `external.credentialsRef`, or you
-write a handle the secret store minted there yourself. `credentialsRef` is the
-one `external` key a `managed` datasource may carry; every federation key is
-still refused there. See
+refuses `config.password`, and a `user:password@` URL, at publish. Because this
+datasource is defined in code, the runtime reads the password at connect from
+`OS_DATASOURCE_ANALYTICS_PASSWORD`, derived from its name. The CLI host
+(`os serve` / `os start`) reads it by default; elsewhere the host turns it on
+with `OS_DATASOURCE_ENV_CREDENTIALS=on`. The same datasource created through
+Setup → Datasources binds the password instead: the connection form's secret
+field encrypts it into `sys_secret` and stores the opaque handle at
+`external.credentialsRef`. `credentialsRef` is the one `external` key a `managed`
+datasource may carry; every federation key is still refused there. See
 [Credentials](/docs/data-modeling/external-datasources#4-credentials).
 
 Note that a read-only account also refuses **DDL**, so such a datasource cannot
 
@@ -258,7 +258,9 @@ const policy: DatasourceConnectPolicy = {
 Never inline a password. Put a reference in `external.credentialsRef` and store the
 secret in the secret store (the same `SecretBinder` / `ICryptoProvider` the
 runtime-admin "Add Datasource" wizard uses). The credential is resolved to
-cleartext **at connect, before the driver is built**.
+cleartext **at connect, before the driver is built**. A datasource defined in code
+reads an environment variable instead; see
+[A datasource defined in code](#a-datasource-defined-in-code-the-environment-variable).
 
 The shipped binder encrypts the cleartext into a `sys_secret` row and mints an
 **opaque** handle — `sys_secret:<id>` — as the `credentialsRef`; that is the only
@@ -274,6 +276,77 @@ for the datasources listed under [When auto-connect fails](#when-auto-connect-fa
 and degrades with a warning otherwise. (Credential-less drivers such as SQLite
 simply have no `credentialsRef`.)
 
+### A datasource defined in code: the environment variable
+
+The handle above is minted by the Setup → Datasources form, which cannot edit a
+datasource defined in code (`defineDatasource`, or a `*.datasource.ts` file in a
+package). A code author leaves the credential out of the declaration entirely,
+and the runtime reads it **at connect** from an environment variable whose name
+the platform derives from the datasource name:
+
+| Datasource name | Variable read at connect |
+| :--- | :--- |
+| `warehouse` | `OS_DATASOURCE_WAREHOUSE_PASSWORD` |
+| `crm_replica` | `OS_DATASOURCE_CRM_REPLICA_PASSWORD` |
+
+The name is upper-cased and every character outside `A-Z0-9` becomes `_`. The
+value is handed to the driver as the connection's secret: the password for
+`postgres`, `mysql` and `mongodb`, the `authToken` for `turso`. It is never
+logged, stored or answered.
+
+```typescript
+import { defineDatasource } from '@objectstack/spec/data';
+
+export const Warehouse = defineDatasource({
+  name: 'warehouse',
+  driver: 'postgres',
+  // No password here: it is read from OS_DATASOURCE_WAREHOUSE_PASSWORD at connect.
+  config: { host: 'db.internal', database: 'warehouse', username: 'svc_app' },
+});
+```
+
+```bash
+OS_DATASOURCE_WAREHOUSE_PASSWORD='…' os start
+```
+
+What the slot does and does not do:
+
+- **It is a host switch, `OS_DATASOURCE_ENV_CREDENTIALS`, which takes `on` or
+  `off`.** `os serve`, `os start` and `os dev` turn it on unless you set it
+  yourself. Every other composition (a host that builds its own kernel, a cloud
+  runtime) leaves it off, so the variable is never read there. Any other value
+  is refused at boot.
+- **It only serves datasources the host registers from code.** That means the
+  ones in the booted artifact and in packages installed locally. A datasource
+  created through Setup or the API under the same name never reads the
+  variable. Nor does the `default` datasource, which keeps `OS_DATABASE_URL`.
+- **A declared credential wins.** With `external.credentialsRef` or
+  `external.connector` declared, the variable is not consulted. If that
+  reference fails to resolve, the datasource stays unconnected (fail-closed, as
+  above) and does not fall back to the environment.
+- **An unset variable leaves the connect as it was.** The driver connects
+  without a secret; if the database refuses, the datasource is unconnected and
+  its reason names the variable to set.
+- **Two datasources that derive one variable are refused.** Valid datasource
+  names are lower-case, so this cannot happen between two declarations that
+  pass the schema; the guard covers a host that hands `connect()` other names.
+- **A plugin driver that resolves its credential per request** (the OData
+  driver resolves `credentialsRef` that way) does not read this slot: it feeds
+  only the secret a driver receives when its connection is built.
+
+<Callout type="warn">
+**Who can read the variable.** The derived name is the only key, so any code
+datasource the host registers under that name reads it. Under `os serve` that
+includes every package installed into the environment: **a package can declare
+a datasource of any free name and so read the matching
+`OS_DATASOURCE_<NAME>_PASSWORD`**. Install only packages you trust with the
+credentials in that process's environment. On a host where several tenants'
+artifacts share one process, a process-wide variable would be readable by every
+tenant artifact that declares the name. That is why the switch is off outside the
+CLI host; turn it on there only when one operator owns every artifact the process
+loads.
+</Callout>
+
 ### Borrowing a connector instance's credential
 
 An **API-backed** datasource, one served by a plugin driver such as the
 
@@ -47,7 +47,7 @@ MongoDB Connection Configuration
 | **host** | `string` | optional (default: `"localhost"`) | Host address |
 | **port** | `integer` | optional (default: `27017`) | Port number |
 | **username** | `string` | optional | Authentication user |
-| **password** | `never` | optional | Set through the connection form's secret field or `external.credentialsRef` — encrypted into `sys_secret`, never stored in `config` |
+| **password** | `never` | optional | Set through the connection form's secret field or `external.credentialsRef` — encrypted into `sys_secret`, never stored in `config`. A datasource defined in code (`defineDatasource`) leaves the credential out of the declaration: it is read at connect time from the runtime environment variable derived from the datasource name (`OS_DATASOURCE_WAREHOUSE_PASSWORD` for a datasource named `warehouse`), which `os serve` / `os start` honour by default (`OS_DATASOURCE_ENV_CREDENTIALS=on`). |
 | **authSource** | `string` | optional | Authentication database |
 | **options** | `Record<string, any>` | optional | Extra MongoClient options (replicaSet, tls, timeouts, …). Credential-spelled keys (`password`, `authToken`, and their former aliases) are refused inline at any depth — bind the secret via the connection form / external.credentialsRef. `proxyPassword`, `tlsCertificateKeyFilePassword`, `key`, and `passphrase` are accepted and stored at rest in cleartext; they're redacted only when the datasource is read back, not refused at write. |
 
 
@@ -48,7 +48,7 @@ MySQL / MariaDB connection configuration
 | **port** | `integer` | optional (default: `3306`) | Port number |
 | **database** | `string` | optional | Database name |
 | **username** | `string` | optional | Authentication user |
-| **password** | `never` | optional | Set through the connection form's secret field or `external.credentialsRef` — encrypted into `sys_secret`, never stored in `config` |
+| **password** | `never` | optional | Set through the connection form's secret field or `external.credentialsRef` — encrypted into `sys_secret`, never stored in `config`. A datasource defined in code (`defineDatasource`) leaves the credential out of the declaration: it is read at connect time from the runtime environment variable derived from the datasource name (`OS_DATASOURCE_WAREHOUSE_PASSWORD` for a datasource named `warehouse`), which `os serve` / `os start` honour by default (`OS_DATASOURCE_ENV_CREDENTIALS=on`). |
 | **ssl** | `boolean` | optional | Enable TLS. Certificates go in the datasource-level `ssl` block. |
 | **autoMigrate** | `Enum<'off' \| 'safe'>` | optional | Dev-only non-destructive schema self-heal |