[objectstack-fleet]

security#1 · os-tesla · session_01L9qibvynRbCtMndW8EHNGc

Clause-②: yes (narrowing) — the in-process handler of a hook bound from metadata is app-authored code, and its ctx.api now refuses delete(…, { permanent }) with any value but false, under every runAs, on every api derived from it; a handler that passed the key past HookDeleteOptions with a cast and purged the record is refused instead.
Metadata-protocol: none
Skills-docs: none — no skill or doc teaches permanent on a hook's delete; the refusal is the one sandboxed bodies already answer.

维护者速读

• 改了什么:经 hook binder 绑定、以进程内 handler 运行的 hook 属于应用编写的代码;它的 ctx.api(及由它派生的 sudo()、withRunAs、事务上下文)上的 delete(…, { permanent }) 现在与沙箱 body 一样被拒:400 VALIDATION_ERROR、param: 'permanent'、同一句话。拒绝逻辑移入 @objectstack/objectql,runtime 沙箱改为复用这一份。
• 为什么改:维护者裁决 A(记录 6691358077):应用编写的代码不能永久删除记录,删除一律进回收站,永久删除只属于持有 manageRecycleBin 的主体。feat(objectql,spec): purge and empty the recycle bin, and delete a record for good (ADR-0148) #30990 只在沙箱 body 上执行了这条;已弃用的进程内 handler 路线此前只有类型层面的约束。
• 风险与回滚:收窄只影响以类型转换传入 permanent 的应用 handler,仓内没有这种用法;平台代码(engine.delete、代码注册的 hook、createContext、purge/empty)不变。回滚即 revert 本 PR。
• 先看:① packages/objectql/src/recycle-bin/app-authored-delete.ts(拒绝本体与选项副本);② packages/objectql/src/engine-scoped-context.ts 的 object()(按 appAuthored 包装);③ packages/runtime/src/sandbox/body-runner.ts(删掉本地副本,改引共享拒绝)。
• 两分钟验证:pnpm --filter @objectstack/objectql exec vitest run src/recycle-bin/purge.test.ts,预期 Tests 39 passed (39)。
• 需要你做的:无,席位落地。

What changes

• The handler route is refused at run time. A hook bound through the hook binder is app-authored by the engine's own definition (APP_AUTHORED_HOOK_API, hook-run-as.ts), and its in-process handler receives a real ScopedContext. ScopedContext.object() on an app-authored api now returns its repository wrapped by refuseAppAuthoredPermanentDelete: delete(options) whose options.permanent is anything but false or absent answers 400 VALIDATION_ERROR with param: 'permanent', object: NAME, and the sentence a sandboxed body gets, with the face named hook handler: "A hook handler cannot delete a record permanently: app-authored code cannot purge; its deletes enter the recycle bin. Remove 'permanent' from the delete of 'NAME'." It is answered before the engine is called, so no middleware, hook or driver call runs.
• Every derived api keeps it. appAuthored is carried by derive(), the one constructor of sudo(), withRunAs(...), transaction(cb), beginTransaction() and the user-grant seeding, so the refusal holds under the triggering caller, runAs: 'user' and runAs: 'system'.
• One refusal. The refusal moved from packages/runtime/src/sandbox/body-runner.ts to packages/objectql/src/recycle-bin/app-authored-delete.ts and is exported from @objectstack/objectql; the sandbox's refuseBodyPermanentDeletes applies that function, so bodies and handlers share one code and one sentence. The developer message names the handler face beside the three body faces.
• The value judged is the value forwarded. The options are read once into a shallow copy, and the copy is what the repository's delete receives. A sandboxed body's options are plain JSON, for which the copy is the same value.
• Unchanged: engine.delete(…, { permanent: true }), engine.createContext(...), a hook registered in code with engine.registerHook (no metadata binding, so not app-authored), purge / empty, and every ordinary delete. deleteById(id) takes no options. ObjectRepository has no other delete verb.

Tests

New top-level describe in the recycle-bin harness, packages/objectql/src/recycle-bin/purge.test.ts ("an app-authored hook handler's permanent delete (ruling A)"): a real ObjectQL, a row-keeping driver, the bin registered as @objectstack/platform-objects declares it, and a middleware log of every dispatch. The hook is bound through bindHooksToEngine with an inline handler and fired by an insert from an organization user.

• refused by id and in bulk under runAs inherit, user and system (6): the envelope (code, status, param, object), the message's first sentence, no dispatch on the target object, the row still present, the bin empty. The bulk legs assert the sentence because the engine already refuses a permanent delete by filter, with another sentence;
• refused on the api sudo() derives and on the one transaction(cb) hands its callback (2);
• a permanent that answers differently on a second read is read once, and the delete that runs is the ordinary one (1);
• controls: no permanent key and permanent: false, under inherit and system, are the ordinary delete: one delete dispatch, the row gone, one bin entry (4);
• platform: a hook registered in code and engine.createContext({ isSystem: true }) keep the permanent delete: two purge dispatches, no bin entry (1).

The runtime's existing body pins (packages/runtime/src/sandbox/body-runner.test.ts: job, hook and action bodies refused; false and absent keys pass; host purge kept) run unchanged against the shared refusal, which the runtime reaches through objectql's dist/.

Ablations (each committed first; restore proven by blob hash and an empty `git diff HEAD`)

1. The handler refusal, packages/objectql/src/engine-scoped-context.ts: anchor return this.appAuthored ? refuseAppAuthoredPermanentDelete(name, repo, 'hook handler') : repo; x1 to x0 (return repo;), blob 91de02fe to 969ca039. purge.test.ts: Tests 8 failed | 31 passed (39), exactly the six refused legs and the two derived-api legs; the controls, the platform leg and the 25 earlier cases stay green. The by-id legs fail because the record is purged; the bulk legs because the engine's own filter-delete refusal answers another sentence. Restored, blob 91de02fe equals HEAD.
2. The judged copy, packages/objectql/src/recycle-bin/app-authored-delete.ts: anchor return value.apply(target, [judged, ...rest]); x1 to x0 (forward the original args), blob 7aa3fa4e to 4418631c. Tests 1 failed | 38 passed (39), the read-once leg alone. Restored, blob 7aa3fa4e equals HEAD.
3. The shared refusal through dist/ (the runtime reaches it there): anchor throw appAuthoredPermanentDeleteRefusal(objectName, face); x1 to x0, blob 7aa3fa4e to f42cd278; objectql rebuilt; ablation-dist-preflight found the marker in 4 built files. packages/runtime body-runner.test.ts: Tests 3 failed | 39 passed (42), exactly the three body-refusal cases (job refused, job uncaught, hook and action body). Restored, objectql rebuilt, preflight --absent over 14 built files, tree clean.

Acceptance notes

• Route usage in the repository: two shipped example hooks bind an in-process handler (examples/app-crm/src/hooks/opportunity.hook.ts, examples/app-todo/src/objects/task.hook.ts), plus test fixtures (packages/qa/dogfood/test/fixtures/hook-runas-fixture.ts, packages/cli/test/fixtures/option-b-collection-zoo.ts). None of them passes permanent, and no production code in the repository passes permanent: true to any delete. Retiring the deprecated route would touch those two examples; this PR leaves the route in place and refuses at run time.
• Scope: the refusal is on the ctx.api the route hands its handler and on every api derived from it.
• test:repo (the vitest repo project) is CI's, in Test Core; not run locally.

Verification

Local runs

All readings on the head 5f8df60f19 (the merge of main at 23cf11a4b) unless a line names 743fff85e3 (the same diff before that merge, which brought in three commits touching neither package).

• pnpm --filter @objectstack/objectql test (743fff85e3): Test Files 563 passed (563), Tests 11372 passed (11372).
• pnpm --filter @objectstack/runtime test (743fff85e3): Test Files 553 passed (553), Tests 8869 passed | 19 skipped (8888). Lock VERDICT command-exit 0 for both.
• After the merge: typecheck of @objectstack/objectql and @objectstack/runtime (each tsc --noEmit plus check:test-typecheck OK); src/recycle-bin/purge.test.ts Tests 39 passed (39); src/sandbox/body-runner.test.ts Tests 42 passed (42); lock VERDICT command-exit 0.
• Dogfood battery, pnpm --filter @objectstack/dogfood test after building its closure: Test Files 431 passed | 3 skipped (434), Tests 3580 passed | 41 skipped (3621), lock VERDICT command-exit 0.
• node scripts/pm/dispatch-gates.mjs --commands: 62 commands, every one exit 0; --ran reconciliation: 62 derived famil(ies) accounted for — 62 run, 0 NOT-MEASURED. Among them check:adr-0087-registration (the changeset's not-required (no-migration-prescription) disposition accepted), check:empty-changeset, check:changeset-no-major, check:engine-double-contract, check:doc-authoring, check:nul-bytes, check:dual-build-cjs-loads (116 entry points across 71 packages load).
• test:repo and the full lint farm: CI's.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 2 package(s): @objectstack/objectql, @objectstack/runtime, touching 9 documentable anchor(s). ⚠️ 2 changed file(s) yielded no anchor (packages/objectql/src/hook-run-as.ts, packages/objectql/src/index.ts), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files.

27 hand-written doc(s) name something this change touched — list omitted above 15 rows. Re-derive on the tree named below: node scripts/docs-audit/affected-docs.mjs --json cad764d3e2d71210bce48653aa823a3b940071d7.

⛔ 6 release-owned page(s) also affected — read-only, see AGENTS.md Documentation Guardrails.

What this run could not see

• 2 changed file(s) yielded no anchor (packages/objectql/src/hook-run-as.ts, packages/objectql/src/index.ts) — pages documenting those are invisible to this run
• 1 name(s) were too generic to anchor anything (single lowercase words)
• the SDK route bridge reached 63 of 224 client-bound route-ledger rows — the other 161 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 161: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 57 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 104 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 38 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json cad764d3e2d71210bce48653aa823a3b940071d7 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 6245e5141392d86f033f691694fb82d5a093a50d — the merge of head 5f8df60f19477bdd337f21eb7dea23f936b8b6d7 into base cad764d3e2d71210bce48653aa823a3b940071d7, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 6245e5141392d86f033f691694fb82d5a093a50d && git checkout 6245e5141392d86f033f691694fb82d5a093a50d
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin cad764d3e2d71210bce48653aa823a3b940071d7 5f8df60f19477bdd337f21eb7dea23f936b8b6d7 && git checkout -B drift-repro cad764d3e2d71210bce48653aa823a3b940071d7 && git merge --no-ff 5f8df60f19477bdd337f21eb7dea23f936b8b6d7

node scripts/docs-audit/affected-docs.mjs --json cad764d3e2d71210bce48653aa823a3b940071d7

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs cad764d3e2d71210bce48653aa823a3b940071d7 → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[objectstack-fleet]

security#1 · os-tesla · session_01L9qibvynRbCtMndW8EHNGc

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 5f8df60f19477bdd337f21eb7dea23f936b8b6d7
Local-runs: none
Scope: packages/objectql/src/engine-scoped-context.ts, packages/objectql/src/engine.ts, packages/objectql/src/hook-run-as.ts, packages/objectql/src/index.ts, packages/objectql/src/recycle-bin/app-authored-delete.ts, packages/objectql/src/recycle-bin/purge.test.ts, packages/runtime/src/sandbox/body-runner.ts, .changeset/sec-hardening-r18-hook-handler-permanent-delete.md + packages/objectql/src/hook-binder.ts, packages/objectql/src/hook-wrappers.ts, packages/objectql/src/engine-object-repository.ts, packages/objectql/src/engine-scoped-hosts.ts, packages/objectql/src/engine-top-level.ts, packages/objectql/src/recycle-bin/purge.ts, packages/runtime/src/stored-metadata-reader-seam.ts, packages/runtime/src/sandbox/quickjs-runner.ts, packages/spec/src/data/hook-api.ts, packages/spec/src/contracts/scoped-context.ts, packages/spec/src/data/hook.zod.ts, packages/runtime/src/app-artifact-handlers.ts, packages/objectql/src/plugin.ts

Reviewed at 2026-11-07T00:55Z, read-only: the PR body, its file list, the three-dot diff against the merge base 23cf11a4b on main, the check-runs on the head, and the cited code on main. Ruling of record: maintainer ruling A in record 6691358077 (app-authored code cannot erase past the recycle bin; the permanent delete belongs only to a principal holding manageRecycleBin), implementing ADR-0148 D3 / Q3 = A.

① Derived judgments

1. An app-authored hook's in-process handler is refused delete(…, { permanent }) with any value but false or absent, on ctx.api.object(name) — RIGHT. The published hook-author contract already omits the key (HookDeleteOptions is EngineDeleteOptions minus context and minus permanent, packages/spec/src/data/hook-api.ts, with the drift pin), and the IScopedObjectRepository a HookContext.api is typed through declares no delete member at all (packages/spec/src/contracts/scoped-context.ts). The engine now answers the omission at run time instead of leaving it to the type layer: 400 VALIDATION_ERROR, param: 'permanent', object, before any middleware, hook or driver call. This is the spec's own refusal made real, not a capability withdrawn from a declared face.
2. The refusal is carried to every api derived from the app-authored one — RIGHT. appAuthored is set only by ScopedContext[APP_AUTHORED_HOOK_API]() (reached only through wrapDeclarativeHook({ appAuthored: true }), which only the hook binder sets), and copied only by derive(). On main, sudo(), withRunAs('system'), withRunAs('user'), transaction(cb) (joined, owned and the no-driver fallback, which hands this), beginTransaction() and the SEED_USER_GRANTS seeding all go through derive() or return this; no other constructor of a child exists. withRunAs('user') with no trigger user yields UnscopedHookApi, which refuses every data door already. The test pins inherit, user, system, sudo() and transaction(cb).
3. permanent: false and an absent key stay the ordinary delete into the bin — RIGHT, pinned under inherit and system.
4. Platform apis keep the permanent delete — RIGHT. createContext(...) and buildHookApi(...) construct a plain ScopedContext (appAuthored = false); a hook registered in code with engine.registerHook carries no meta and takes no wrap; ObjectQL.purge / empty and engine.delete(…, { permanent: true }) are not touched. Pinned by the platform leg of the new describe.
5. One refusal, exported from @objectstack/objectql as refuseAppAuthoredPermanentDelete, consumed by the runtime's refuseBodyPermanentDeletes — RIGHT, and this is the public-surface widening the Clause-②: yes half declares. The sandbox's accept set is unchanged: the wrapper's get trap is the removed local one line for line, apart from the forwarded copy (item 6). A sandboxed body's options arrive as vm.dump plain values (quickjs-runner.ts), for which the copy is the same value, so body-runner.test.ts runs unchanged.
6. The options are read once into a shallow copy and the copy is forwarded — RIGHT, and consumer-neutral on this route. On main, ObjectRepositoryFacet.delete already forwards { ...options, context: this.context } to the engine, so no consumer of this route ever received the caller's object: option identity, non-enumerable keys and the prototype chain were already dropped one frame down, and the engine reads context, where, multi, permanent and the driver passthrough keys as own string keys only (ENGINE_DELETE_OPTION_KEYS), folds filter into a new object, and refuses every other key. An inherited or getter-served permanent is now judged and forwarded as one value; the direction of that change is always towards the bin.
7. Every other repository member and property is handed through — RIGHT. ObjectRepository on main has no member returning this or another repository; deleteById(id) takes no options; the Proxy keeps instanceof (default prototype trap) and own-key enumeration; every function is bound to the target, which is load-bearing because the #30052 facets look the instance up by identity (objectRepositoryHost.of(this)) — bound to the Proxy, every method would have missed its host. The PR binds to the target.
8. No alias reaches the key. The delete option fold is filter to where only; permanent has no second spelling in the engine's key set.
9. Consumer hunt, every path that obtains an app-authored api or one derived from it, and every platform path that might sit under one:
   • Binder callers on main: bindAppArtifactHandlers (runtime, an app's own hooks and functions), ObjectQLPlugin's metadata-service binds (stored metadata hooks, body-only). No platform package (platform-objects, services/*, plugins/*, runtime, cloud-connection) ships a hook through the binder; every platform hook is engine.registerHook without meta. Unaffected.
   • Services or plugins running under a hook's ctx.api: none reads ctx.api in packages/services/*/src or packages/plugins/*/src. Flows invoked from hooks establish their own run identity (service-automation resolveRunContext), not the hook's api. Unaffected.
   • Recycle-bin purge / empty: engine verbs on the engine, not through a scoped api. Unaffected.
   • Cascade deletes and retention / cleanup: engine-internal this.delete with engine-built options, and lifecycle work through the engine and driver. Unaffected.
   • ctx.api.object(x).execute(action): builds a fresh, non-app-authored ScopedContext for the action (engine-object-repository.ts), so the action path's own seam governs it — as on main.
   • Transaction wrappers: the objectql faces derive natively (item 2); the runtime's deriveThroughSeam wraps beginTransaction().ctx as well. Covered.
   • In-repo callers passing permanent: true outside tests: none. The four in-process handler users the dev names (two examples, two fixtures) issue no delete at all. The sibling consumer repository's in-process hooks issue no .delete( call either. The Console issues no delete through a hook api.
   • Tests on main that pass permanent through a bound hook: none besides the two harness files the PR names.

② Semver level

• Changeset: @objectstack/objectql: patch, @objectstack/runtime: patch, fix(objectql,runtime)!: title, **BREAKING** accept-set narrowing banner, one ADR-0087 marker not-required (no-migration-prescription) — matches what the diff publishes: a narrowed accept set on an already-undeclared key and one new named export, no authorable key moved, nothing for a migration to rewrite. Check Changeset is green on the head. RIGHT.
• Clause-②: yes (narrowing) on both carriers, line-initial, the one spelling — the recogniser reads the (narrowing) arm as the narrowing face at CONTRACT_REVIEW_TIER (a diff that widens the public face by one export and narrows an accept set owes the narrowing review). RIGHT.
• Metadata-protocol: none — HookDeleteOptions already omits permanent; no key is added, removed, renamed or re-shaped and no metadata value changes meaning. RIGHT; patch follows.
• Skills-docs: none — no skill and no doc on main teaches permanent on a hook's ctx.api delete (content/docs/automation/hooks.mdx, hook-bodies.mdx, skills/**, the data-engine reference documents the engine's own option). RIGHT.

③ Boundary flags

• Dev flag: the deprecated in-process handler route has two shipped example users and in-process code holds other engine references this PR does not change; recommends carding the route's retirement separately. Answer: a separate step, not a block on this PR. Rule: this PR narrows the accept set of ctx.api and the apis derived from it, which is the face the published hook-author contract already omitted the key from; retiring the route is the removal of an authorable key (Hook.handler), its own breaking changeset with a FROM-to-TO migration and a tombstone through the spec-property-retirement kit, touching the two examples — a different kind of change, carded on its own. Neither example passes permanent, so neither is affected by this PR. The other engine references an in-process handler holds are the route's trust posture, not a gap this narrowing opens or widens; they are closed by the retirement, not by a second wrapper. Card it with the retirement.
• Same family, not flagged by the dev: an in-process action handler's api is built by the action path and is not derived through the app-authored key, so this narrowing does not reach it; a sandboxed action body is already refused by the runtime seam. Ruling A speaks of app-authored bodies generally. Separate card beside the route retirement; at rule level, the in-process action handler is the same deprecated posture.
• Should-fix, prose only (PD chore: version packages #10, claim as narrow as the enforcement): the shared refusal's developer message says the in-process handler "cannot erase a record past the recycle bin, under any execution context"; the enforcement is on ctx.api and the apis derived from it. Keep the sentence to the api the message already names.
• Author: objectstack-fleet[bot]; head repo is the base repo; draft; 274 + 61 changed lines; no governed path in the file list.
• Check-runs on the head as they stand at 2026-11-07T00:55Z: green — Lint & Repo Gates and its lanes, Governed Surface Queue Guard, Check Changeset, Check PR Size, PR-body guards, Dogfood Regression Gate, Test UI, Live E2E UI, Type Check · debt ledger, Type Check · source gates, Plan Test Core shards; still running — Build Core, Test Core (1/8 to 8/8), Type Check · workspace, Type Check · consumer gates. This record judges the diff; the landing waits for every check to conclude green, as the Tier S rule reads.

④ Design judgment

The narrowing is the ruling made real at the right seam. The one place every app-authored in-process handler gets its api is ScopedContext.object() on an api that carries the appAuthored provenance the engine already draws for #25653, and the one place every sandboxed body gets its api is the runtime's buildSandboxApi; the PR puts the refusal in one function in objectql's recycle-bin module and applies it from both, so the two faces share one code, one status and one sentence, and the sandbox's own accept set does not move. It takes nothing a consumer was promised: the published HookDeleteOptions omits the key, the published IScopedObjectRepository declares no delete, the data-engine reference documents permanent as the engine's own by-id option authorized as purge, and ADR-0148 keeps the permanent delete available to the principal that holds manageRecycleBin. A capability declared on the engine for platform code stays on the engine for platform code.

Attempts to break it, each held: a derived api under every runAs, sudo(), both transaction faces and the user-grant seeding keep the provenance (one child constructor); an inherited, getter-served or ownKeys-hidden permanent is judged and forwarded as one value and only ever towards the bin; the key has no alias in the engine's accept set; a non-boolean value is refused as the engine itself refuses it; the repository exposes no member that returns an unwrapped repository, and deleteById carries no options; nested hooks fired by the handler's own delete get a fresh engine api and are re-wrapped by their own binding; a fire-and-forget after-hook keeps the derived api on its detached context; this is bound to the target so the codemod facets resolve their host. The one route around it is the in-process route's own posture (the engine reference a HookContext carries), which is the retirement step in ③, not a defect of this seam.

No must-fix. Should-fix: the developer-message sentence in ③; and a pin on beginTransaction().ctx keeping the refusal would close the one derived face the new describe does not exercise.

Implemented-by: claude/sec-hardening-r18
Reviewed-by: session_01L9qibvynRbCtMndW8EHNGc

VERDICT: PASS

[objectstack-fleet]

security#1 · os-tesla · session_01L9qibvynRbCtMndW8EHNGc

席位核对

ACCEPT · 2026-11-07T01:04Z · head 5f8df60f19477bdd337f21eb7dea23f936b8b6d7

• Contract review: PASS at this head, CONTRACT_REVIEW_TIER on the narrowing face (the changeset's Clause-②: yes (narrowing) line), record 6699955759. No must-fix. Its should-fixes go into this seat's follow-up list: keep the handler face's developer sentence to the api it names, add a beginTransaction() leg, and card the in-process action handlers together with the retirement of the deprecated in-process hook handler route. None changes what lands here.
• What lands: maintainer ruling A (record 6691358077) made real on the in-process handler of a hook bound from metadata. Its ctx.api, and every api derived from it, refuses a delete whose permanent is anything but false or absent, with the code and sentence sandboxed bodies already get. The refusal now lives once in @objectstack/objectql and the sandbox uses it. Platform deletes, code-registered hooks, createContext, purge and empty are unchanged.
• Consumer hunt (record ①): the only source of an app-authored api is the hook binder; no platform package ships hooks through it, no service or plugin reads a hook's ctx.api, and no in-repo code (including the example apps and hotcrm) deletes through one with permanent.
• Checks: every check-run on this head is success (35) or skipped (13, by their own conditions). git merge-tree against current main is clean.
• Gates (dev, at this head): dispatch-gates --commands 62 derived / 62 run / 0 NOT-MEASURED; objectql and runtime suites green; the dogfood battery passed (431 files); three ablations, including a dist leg for the sandbox, red as predicted and restored.
• Shape: base main, no closing keyword. Patch for @objectstack/objectql and @objectstack/runtime, with Clause-②: yes (narrowing) and Metadata-protocol: none.
• Governed: check-governed-merges.mjs --pr 31065: not governed; 335 changed lines ≤ 3000 ⇒ Tier S.
• Landing authority: the maintainer's standing approval for this seat's security PRs at Tier S (2026-11-06 card answer in the seat's thread) and 「你应该是使用 pm-dispatch 技能自主审核和落地 pr」.
• Next: relay pr_ready + automerge_enable.

---

Generated by Claude Code