fix(security): close out the stored-metadata-body family — project or refuse every further read/copy/evaluate exit (#21144)

Fixes #21120

Clause-②: no (narrowing)

> **Security boundary — human floor. This PR stays in DRAFT.** It
narrows a
> credential-disclosure surface; landing is the maintainer's. No AI seat
flips
> it ready, queues it or arms auto-merge.

## What this does

Stored metadata bodies (`sys_metadata` / `sys_metadata_history`'s
`metadata`
column — stored datasource credential material included) are declared
write-only and are already redacted on the `/meta` and datasource doors
and, as
of #21086, on the generic data door's reads. This PR closes out the
remaining
surfaces that can **serve, copy or evaluate** such a body, so each
either goes
through the one shared redaction seam or refuses — and adds an
enumeration pin
so a future surface fails the pin instead of joining the family
silently.

- **One seam, no second dialect.** The family-wide primitives — the
object set,
the body predicate, the column names and the per-type body redactor —
now live
once in `@objectstack/spec/kernel`, beside the redactor registry they
build
on. The data door's wrappers (projection, `dropType`, the groupBy and
the new
filter/sort refusals) consume that one definition, as do the audit,
analytics
and realtime exits — none of which depends on
`@objectstack/metadata-protocol`.

- **Audit / activity copy** (`@objectstack/plugin-audit`). The audit
writer
copies a stored-metadata row into `sys_audit_log.new_value` /
`old_value` and
`sys_activity.metadata` at write time — a second, admin-readable,
at-rest
store. The copy now projects the body through the shared redactor, so
the
  credential is withheld there too, and a one-off migration
(`os migrate audit-metadata-bodies`, dry-run by default, `--apply`,
idempotent)
rewrites the copies already at rest. Fail-closed: a body the redactor
cannot
  judge is dropped from the recorded copy.

- **Analytics** (`@objectstack/service-analytics`). A query naming the
stored
body column of these objects as a dimension, measure, filter or sort is
refused (`400 INVALID_FIELD`) at the service door, ahead of every
strategy —
  the posture analytics already takes for a member it will not evaluate.

- **Realtime** (`@objectstack/objectql`). A `data.record.*` event
projects its
`after` / `changes` body through the same redactor, so a subscriber to
these
objects' events receives no stored credential. (Predicate/bulk events
carry
  only a count, so they were already safe.)

- **Data door filter / sort** (`@objectstack/metadata-protocol`,
maintainer
ruling A). A filter or sort on the body column is refused (`400
INVALID_FIELD`),
the same family and shape as the merged groupBy refusal. This lands on
#21086's
  seam, now on `main` (merged in; no stacked branch).

What stays answerable on both tables: every scalar column — `type`,
`name`,
`scope`, `state`, timestamps — is still grouped, filtered, sorted,
counted and
served. Only the body column is affected, and only on these two objects.

## Enumeration pin


`packages/metadata-protocol/src/stored-metadata-body-family.pin.test.ts`
pins
the family: the object set is the boundary, every declared `apiMethods`
verb on
the two objects is a covered read verb (a new verb or a write verb fails
the
pin), and each family surface is enumerated with its disposition and
owning
per-package pin.

## Tests

- spec: the shared seam (register/lookup, fail-closed, by-reference) —
`metadata-type-redaction.test.ts`.
- metadata-protocol: the family enumeration pin; the merged #21086
data-door suite still green on the reconciled seam.
- plugin-audit: the writer redaction (create / update rotation / clean
body) in `audit-writers.test.ts`; the migration planners and driven
runner (dry-run, apply, idempotent) in
`stored-metadata-body-migration.test.ts`.
- service-analytics: the member refusal —
`stored-metadata-body-refusal.test.ts`.
- objectql: the realtime event redaction —
`engine-realtime-stored-metadata-body.test.ts`.

Changed lines well under the 5,000 human-merge threshold.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

https://claude.ai/code/session_01MRdbfpy4sQT8bUjmMhxsN7

---------

Co-authored-by: Claude <noreply@anthropic.com>

Author: objectstack-fleet[bot]

.changeset/21120-stored-metadata-body-closeout.md

@@ -0,0 +1,23 @@
+---
+'@objectstack/metadata-protocol': minor
+'@objectstack/service-analytics': minor
+'@objectstack/plugin-audit': minor
+'@objectstack/objectql': minor
+---
+
+fix(security)!: stored metadata bodies are projected or refused at the audit, analytics, realtime and data-door filter/sort exits too
+
+Clause-②: no (narrowing)
+
+<!-- adr-0087: not-required (no-migration-prescription) further read/copy/evaluate exits for a stored metadata body (sys_metadata / sys_metadata_history), each routed through the one shared redactor or refused: the audit/activity write-time copy is projected, a data-door filter or sort on the body column is refused (the sibling of the already-registered-as-not-required groupBy refusal), an analytics query member on the body column is refused, and a data.record.* realtime event body is projected. No authorable key, spelling, export or stored shape moves, and no stored row is read differently by any metadata consumer; the published surfaces gain and lose nothing. The other categories are closed on facts: the packages publish (not `unpublished`); no ADR-0087 id covers a filter/sort target, an analytics member or an event body (not `registered` / `already-registered`); and the change is runtime behaviour, not a declaration (not `runtime-interface-only` / `type-surface-only`). -->
+
+**BREAKING**: this narrows what three doors accept or serve for the two stored-metadata tables — the generic data door refuses a filter or sort on the body column, the analytics door refuses it as a dimension / measure / filter / sort member, and the realtime event and the audit/activity copy now carry the body as its type's read projection instead of the stored bytes. It ships as `minor` under the launch-window convention for accept-set narrowings. No export or published type changes.
+
+**What changes.**
+
+- **Audit / activity copy (`@objectstack/plugin-audit`).** The audit writer copies a `sys_metadata` / `sys_metadata_history` row into `sys_audit_log.new_value` / `old_value` and `sys_activity.metadata`. That copy now projects the body through the shared redactor, so stored credential material is withheld from the second store too. A new `os migrate audit-metadata-bodies` command rewrites the copies already at rest (dry run by default, `--apply` to write, idempotent).
+- **Analytics (`@objectstack/service-analytics`).** A query naming the stored body column of these objects as a dimension, measure, filter or sort is refused with `400 INVALID_FIELD`, before any strategy runs — the posture analytics already takes for a member it will not evaluate.
+- **Realtime (`@objectstack/objectql`).** A `data.record.*` event projects its `after` / `changes` body through the same redactor, so a subscriber to these objects' events receives no stored credential.
+- **Data door filter / sort (`@objectstack/metadata-protocol`).** A filter or sort on the body column is refused with `400 INVALID_FIELD`, the same family and shape as the existing groupBy refusal.
+
+**What stays answerable.** Every scalar column of these objects — `type`, `name`, `scope`, `state`, timestamps — is still grouped, filtered, sorted, counted and served; only the body column is affected. Every other object is unchanged.

.changeset/21120-stored-metadata-body-seam.md

@@ -0,0 +1,21 @@
+---
+'@objectstack/spec': minor
+'@objectstack/cli': minor
+---
+
+feat(spec,cli): shared seam for projecting stored metadata bodies, and the audit rewrite command
+
+Clause-②: no
+
+`@objectstack/spec/kernel` gains the family-wide primitives for the
+stored-metadata-body security invariant, beside the per-type redactor registry
+they build on: `STORED_METADATA_BODY_OBJECTS` / `isStoredMetadataBodyObject`,
+the `STORED_METADATA_BODY_COLUMN` / `STORED_METADATA_TYPE_COLUMN` names, and
+`redactStoredMetadataBody` / `redactStoredMetadataRow` / `redactStoredMetadataRows`.
+These project a stored row's body through the one `getMetadataTypeRedactor`
+definition, so every surface that serves, copies or evaluates such a body shares
+one rule rather than a copy per package. Additive — no existing export changes.
+
+`@objectstack/cli` gains `os migrate audit-metadata-bodies`, the one-off rewrite
+of at-rest metadata-body copies in `sys_audit_log` / `sys_activity` (dry run by
+default, `--apply` to write, idempotent).

content/docs/permissions/tenant-audit-census.mdx

@@ -122,7 +122,7 @@ are reported as `undecidable` rather than assumed either way.
 
 The same holds twice over for the context. An options argument spelled as a
 literal can be read; one spelled `options`, `{ ...opts }`, or handed through a
-forwarding shim cannot, and **67 of the 218 sites are spelled that way**. A
+forwarding shim cannot, and **67 of the 219 sites are spelled that way**. A
 context resolved from an inline literal or a local `const` can be tested for
 `isSystem`; one arriving from a helper call cannot.
 
@@ -187,10 +187,10 @@ reproduce them. Where it disagrees, it disagrees on the page:
 
 | carried figure | where it survives | this census |
 | :--- | :--- | ---: |
-| 175 write call sites | quoted in the merged changeset | **218** |
+| 175 write call sites | quoted in the merged changeset | **219** |
 | 24 carrying no tenant context | quoted in the merged changeset | **9** provable and tenancy-enabled; **34** more whose options argument is unreadable |
-| 127 of 175 statically decidable, 48 runtime-parameter-name sites | restated on the `isSystem`-scoping card | **144 of 218** decidable, **74** undecidable |
-| 135 (77%) silenced by the `isSystem` guard before the posture gate | the lost issue body — **no surviving corroboration** | **not reproduced**: 99 decidably elevated, 0 decidably not, 102 undecidable |
+| 127 of 175 statically decidable, 48 runtime-parameter-name sites | restated on the `isSystem`-scoping card | **144 of 219** decidable, **75** undecidable |
+| 135 (77%) silenced by the `isSystem` guard before the posture gate | the lost issue body — **no surviving corroboration** | **not reproduced**: 100 decidably elevated, 0 decidably not, 102 undecidable |
 | 141 and 132, two independent re-derivations | the card that filed this work | — |
 
 **The differences are not reconciled, and deliberately so.** The old census's
@@ -207,11 +207,11 @@ would report a smaller number and would not say so.
 
 The fourth row is the one worth flagging to anyone citing it. **The 135 / 77%
 figure has no surviving corroboration anywhere in the tree.** This census reads
-99 of 218 (45%) as decidably elevated, with 102 more whose elevation is a
+100 of 219 (46%) as decidably elevated, with 102 more whose elevation is a
 run-time fact — so the claim is neither confirmed nor refuted, and the honest
 answer is that a static reading cannot settle it.
 
-⇒ **Cite `9 / 218`, and say what it is**: the sites whose options argument was
+⇒ **Cite `9 / 219`, and say what it is**: the sites whose options argument was
 READ and holds no tenant context, against a decidably tenancy-enabled object.
 That is the control's provable yield surface. ⛔ Do not cite it as "the sites
 without tenant context" — **34 further sites** have an options argument this
@@ -223,31 +223,31 @@ cannot read, and they are neither in nor out.
 
 | what | count |
 | :--- | ---: |
-| write call sites on the application surface | **218** |
+| write call sites on the application surface | **219** |
 | …whose object name is statically decidable | 144 |
-| …whose object name is chosen at run time | 74 |
+| …whose object name is chosen at run time | 75 |
 | …against an object with tenancy ENABLED | 143 |
 | …against an object that declares tenancy off | 1 |
-| threading a tenant context | 134 |
+| threading a tenant context | 135 |
 | PROVABLY carrying none (options read, no context key) | **17** |
 | …of those, against a decidably tenancy-enabled object | **9** |
 | options argument UNREADABLE — may or may not carry one | 67 |
 | …of those, against a decidably tenancy-enabled object | 34 |
-| threading a decidably ELEVATED (`isSystem`) context | 99 |
+| threading a decidably ELEVATED (`isSystem`) context | 100 |
 | threading a context that is decidably NOT elevated | 0 |
 | threading a context whose elevation is a run-time fact | 102 |
 
 | how the instrument reached the site | count |
 | :--- | ---: |
-| receiver carried a readable engine type | 174 |
+| receiver carried a readable engine type | 175 |
 | receiver erased, placed by the object NAME | 24 |
 | receiver erased, placed by an `object: string` PARAMETER | 15 |
 | receiver erased, placed by an `UNTYPED_RECEIVERS` row | 5 |
 
 | object name spelled inline | 101 |
 | object name spelled through a `const` | 43 |
 | object name is an `object: string` parameter | 17 |
-| object name is some other run-time expression | 57 |
+| object name is some other run-time expression | 58 |
 
 ### Subtractions the census could NOT defend — enforced
 
@@ -297,13 +297,13 @@ holds still. They are required to be HERE and to say WHEN they were true;
 their values are not compared. The reasoning, and the measurement behind it,
 are in `scripts/check-tenant-audit-census.mjs`.
 
-Measured on 2026-09-25 at `62171c25e`.
+Measured on 2026-10-01 at `752173845`.
 
 | corpus scale (not enforced) | count |
 | :--- | ---: |
-| tracked non-test sources scanned | 572 |
-| engine-shaped types recognised | 61 |
+| tracked non-test sources scanned | 586 |
+| engine-shaped types recognised | 64 |
 | declared objects in the registry | 115 |
-| same-named calls subtracted as non-engine | 144 |
+| same-named calls subtracted as non-engine | 145 |
 
 {/* END GENERATED: tenant-audit-census */}

docs/audits/2026-08-tenant-audit-write-call-sites.counts.md

@@ -33,17 +33,17 @@ silent, and `node scripts/tenant-audit-census.mjs --write` is the resolution.
 
 | Measure | Value |
 |---|---:|
-| Write call sites | 218 |
+| Write call sites | 219 |
 | Object name statically decidable | 144 |
-| Object name chosen at run time | 74 |
+| Object name chosen at run time | 75 |
 | Against a tenancy-enabled object | 143 |
 | Against an object declaring tenancy off | 1 |
-| Threading a tenant context | 134 |
+| Threading a tenant context | 135 |
 | Provably carrying none | 17 |
 | …and decidably tenancy-enabled | 9 |
 | Options argument unreadable | 67 |
 | …and decidably tenancy-enabled | 34 |
-| Threading a decidably elevated context | 99 |
+| Threading a decidably elevated context | 100 |
 | Threading a decidably non-elevated context | 0 |
 | Threading a context of undecidable elevation | 102 |
 
@@ -90,14 +90,14 @@ holds still. They are required to be HERE and to say WHEN they were true;
 their values are not compared. The reasoning, and the measurement behind it,
 are in `scripts/check-tenant-audit-census.mjs`.
 
-Measured on 2026-09-25 at `62171c25e`.
+Measured on 2026-10-01 at `752173845`.
 
 | corpus scale (not enforced) | count |
 | :--- | ---: |
-| tracked non-test sources scanned | 572 |
-| engine-shaped types recognised | 61 |
+| tracked non-test sources scanned | 586 |
+| engine-shaped types recognised | 64 |
 | declared objects in the registry | 115 |
-| same-named calls subtracted as non-engine | 144 |
+| same-named calls subtracted as non-engine | 145 |
 
 ## Every site
 
@@ -116,6 +116,7 @@ Measured on 2026-09-25 at `62171c25e`.
 | `packages/plugins/plugin-approvals/src/backfill-platform-row-organizations.ts` | `update` | `objectPlan.object` | undecidable | context, elevation undecidable | 1 |
 | `packages/plugins/plugin-audit/src/auth-event-audit.ts` | `insert` | `sys_audit_log` | enabled | options unreadable | 1 |
 | `packages/plugins/plugin-audit/src/read-audit.ts` | `insert` | `sys_audit_log` | enabled | options unreadable | 1 |
+| `packages/plugins/plugin-audit/src/stored-metadata-body-migration.ts` | `update` | `object` | undecidable | elevated | 1 |
 | `packages/plugins/plugin-auth/src/admin-import-users.ts` | `insert` | `sys_audit_log` | enabled | options unreadable | 1 |
 | `packages/plugins/plugin-auth/src/admin-import-users.ts` | `update` | `sys_user` | enabled | options unreadable | 2 |
 | `packages/plugins/plugin-auth/src/admin-set-user-manager.ts` | `update` | `sys_user` | enabled | context, elevation undecidable | 1 |