[P0] Metadata property liveness audit: ~half of all spec properties are dead; a cluster of security props is parsed-but-unenforced

[xuyushun441-sys]

Summary

A protocol-level audit of every metadata type cross-referenced each schema property's spec definition against its actual consumers (file:line) in the runtime + renderers, to determine (1) does it take effect? and (2) is it necessary/reasonable? Liveness = code consumption, not browser observation.

Result: roughly half of all metadata properties are DEAD — defined in the protocol but read by neither the runtime nor the renderers, so authoring them is a silent no-op. The full evidence (17 per-type reports + cross-type synthesis, each with file:line) is in PR #1864 → docs/audits/ (README.md is the index).

This issue is the umbrella; the checklists below are scoped so they can be split into separate issues/ADRs.

---

🔴 P0 — Parsed-but-UNENFORCED security props (latent access-control gaps)

Properties that imply a security boundary but enforce nothing. Either enforce or remove — shipping them as-is is a compliance/security liability.

• PolicySchema is 100% dead — password complexity, session idle/absolute timeout, forceMfa, IP allow-list (trustedRanges/vpnRequired), audit retention/redaction all parsed, none enforced; not even registered as a metadata type. better-auth (auth-manager.ts:458) runs hardcoded defaults instead → false sense of compliance.
• Permission lifecycle ops ungated — allowTransfer / allowRestore / allowPurge omitted from OPERATION_TO_PERMISSION (permission-evaluator.ts:8-16); ownership transfer, undelete, and hard-delete/GDPR purge are not gated by RBAC.
• Agent access control is a no-op — agent.permissions / visibility / access never enforced; the chat route hardcodes ['ai:chat','ai:agents'] (agent-routes.ts:109). "Who can chat with this agent" enforces nothing.
• Flow runAs never switches execution identity (service-automation engine ignores it) — a flow declaring runAs: system does not elevate/de-elevate.
• Object apiEnabled / apiMethods not enforced by REST — an object cannot actually be hidden from the API via these flags.
• Action disabled (CEL form) silently ignored — renderers read a non-spec enabled (action-button.tsx:56); the predicate form of disabled has zero consumers.
• Role parent dead (team-graph.ts:27 does not walk it) — the documented "managers see subordinates' data" rollup is unimplemented.
• SharingRuleSchema disconnected from the live engine — runtime enforces a divergent sys_sharing_rule model (JSON criteria_json, recipient enum user/team/department/role/queue); the spec's CEL condition + role_and_subordinates/guest recipients are never compiled (unparsable CEL → "match nothing").

🔴 P1 — Finish the ADR-0021 analytics migration

Spec moved to dataset+values/dimensions, but renderers/Studio still read the removed legacy shape:

• Chart view variant dead-on-arrival — ListView.tsx:1413 / ObjectView.tsx:754 read legacy xAxisField/yAxisFields/aggregation; spec exposes dataset/dimensions/values → a spec-compliant chart renders nothing.
• Dashboard renderer + Studio WidgetConfigPanel still author/read legacy object/categoryField/valueField/aggregate while dashboard.zod.ts:153 declares dataset+values required → Studio emits widgets the spec rejects.
• Report chart dead on the dataset path; ReportColumnSchema/ReportGroupingSchema/ReportChartSchema are obsolete type-only re-exports.
• (Same debt that invalidated the showcase dashboard/report seeds.)

🟠 P2 — Spec hygiene

• Naming drift → silent no-ops: field maxLength/minLength/referenceFilters/maxRating; page type→pageType & label→title & visibility; dashboard title vs label; app reads accentColor/badgeVariant/separator not declared in spec; flow http vs deprecated http_request (Studio authors the alias); skill requiredPermissions vs permissions; agent knowledge.{topics→sources}; webhook object→object_name/isActive→active.
• Write-only / disconnected metadata: tool metadata is a one-way projection (can't author a working tool as metadata — no implementation/handler field, no executor loads it); EmailTemplateSchema is registered but the runtime reads a differently-shaped sys_email_template; the spec-bridge page/dashboard bridges are orphaned (their exclusive props dead).
• Aspirational config (rich spec, zero runtime) — prune or mark experimental: field enhanced-type configs (barcode/qr/slider/rating/color/location) + governance (encryption/masking/audit/dataQuality); object enable/versioning/partitioning/cdc/softDelete/search; agent autonomy (memory/guardrails/structuredOutput/lifecycle, except planning.maxIterations); tool outputSchema; job retryPolicy/timeout; theme spacing/breakpoints/logo/rtl/density; translation messageFormat:'icu' (no ICU engine), supportedLocales, cache; PortalSchema (entire — not registered, no route, no renderer).
• Renderer reads UNDECLARED props (inverse drift) — dashboard component/data/rowField/columnField; view ObjectView form-adapter keys; app accentColor/badgeVariant/separator. These break a strict Schema.parse().
• Designer authoring gaps (live prop, no Studio editor) — dataset filter/format/derived/dateGranularity; skill triggerConditions (the activation-critical field); flow notify (absent from the static palette).

---

Healthiest vs worst (from the audit)

• Healthiest (near-total liveness): hook, validation.
• Worst: policy (100% dead), portal (100% dead), tool (write-only).

Evidence + per-property recommendations: PR #1864, docs/audits/*.md.

🤖 Generated with Claude Code

[os-zhuang]

Split into sub-issues

This umbrella has been decomposed into tracked sub-issues (each links back here, labeled by priority):

🔴 P0 — security enforcement (priority:p0 + security)

• [P0][security] PolicySchema is 100% dead — enforce or remove #1882 — PolicySchema is 100% dead — enforce or remove
• [security][立项位] M2 权限生命周期(undelete/purge)功能与 allowRestore/allowPurge RBAC 同批建设(evaluator 已 fail-closed,allowTransfer 已 enforced) #1883 — Permission lifecycle ops ungated (allowTransfer/allowRestore/allowPurge)
• [P0][security] Agent access control is a no-op (permissions/visibility/access) #1884 — Agent access control is a no-op (permissions/visibility/access)
• [P0][security] Flow runAs never switches execution identity #1888 — Flow runAs never switches execution identity
• [P0][security] Object apiEnabled/apiMethods not enforced by REST #1889 — Object apiEnabled/apiMethods not enforced by REST
• [P0][security] Action disabled (CEL form) silently ignored #1885 — Action disabled (CEL form) silently ignored
• [P0][security] Role parent dead — manager-rollup unimplemented #1886 — Role parent dead — manager-rollup unimplemented
• [P0][security] SharingRuleSchema disconnected from the live engine #1887 — SharingRuleSchema disconnected from the live engine

🔴 P1 — analytics (priority:p1)

• [P1] Finish ADR-0021 analytics migration (chart view / dashboard+Studio / report) #1890 — Finish ADR-0021 migration (chart view / dashboard+Studio / report)

🟠 P2 — spec hygiene (priority:p2)

• [P2] Naming drift → silent no-ops (spec key ≠ consumed key) #1891 — Naming drift → silent no-ops
• [P2] Write-only / disconnected metadata (tool, email, sharing, spec-bridge) #1892 — Write-only / disconnected metadata
• [P2] Aspirational config — prune or mark experimental #1893 — Aspirational config — prune or mark experimental
• [P2] Inverse drift — renderers read undeclared props #1894 — Inverse drift — renderers read undeclared props
• [P2] Designer authoring gaps (live prop, no Studio editor) #1895 — Designer authoring gaps (live prop, no Studio editor)

The audit's suggested 3-ADR grouping maps to: Security enforcement (the P0 set), Finish ADR-0021 (#1890), Spec hygiene (the P2 set).

[os-zhuang]

Staged plan for the P0 security cluster — ADR-0049

Decision recorded in ADR-0049 (docs/adr/0049-no-unenforced-security-properties.md): a spec property naming a security boundary must be enforced, explicitly experimental, or absent — never parsed-but-silently-unenforced (that's a false sense of compliance).

Given the platform's pre-MVP stage, the cluster splits by whether the feature already exists — we do not build enforcement for features that don't exist yet:

Disposition	Items	Action now
Feature absent → mark experimental / remove	#1882 Policy · #1883 lifecycle bits · #1887 SharingRule (spec form) · #1888 flow runAs	stop the spec from promising; re-introduce with the feature at M2
Feature live, gate missing → enforce	#1884 agent access · #1889 object apiEnabled · #1885 action disabled	localized route/renderer check now
No-regret correctness fix	evaluator fail-open	fail CLOSED for destructive ops

PR A (no-regret, shipped on branch fix/p0-unenforced-security-props-1878)

• PermissionEvaluator fails closed for the destructive op class (transfer/restore/purge) instead of default-allow.
• allowTransfer/allowRestore/allowPurge marked [EXPERIMENTAL — not enforced] ([security][立项位] M2 权限生命周期(undelete/purge)功能与 allowRestore/allowPurge RBAC 同批建设(evaluator 已 fail-closed,allowTransfer 已 enforced) #1883).
• Covers ADR-0049 + the [security][立项位] M2 权限生命周期(undelete/purge)功能与 allowRestore/allowPurge RBAC 同批建设(evaluator 已 fail-closed,allowTransfer 已 enforced) #1883 disposition. Tests green (68 plugin + 152 spec).

PR B (next) — real gaps where the feature is live

• [P0][security] Agent access control is a no-op (permissions/visibility/access) #1884 agent route hardcoded perms → enforce permissions/visibility/access.
• [P0][security] Object apiEnabled/apiMethods not enforced by REST #1889 object apiEnabled/apiMethods → gate REST routes.
• [P0][security] Action disabled (CEL form) silently ignored #1885 action disabled CEL → evaluate predicate in renderer.

Deferred to M2/production (heavy, feature + enforcement together)

• [P0][security] PolicySchema is 100% dead — enforce or remove #1882 PolicySchema registration + enforcement points.
• [P0][security] SharingRuleSchema disconnected from the live engine #1887 SharingRule engine reconciliation (depends on [P0][security] Role parent dead — manager-rollup unimplemented #1886 role parent).
• [P0][security] Flow runAs never switches execution identity #1888 flow runAs identity switching.

[os-zhuang]

PRs open for the P0 cluster (ADR-0049)

• P0 security: enforce-or-remove unenforced security props (ADR-0049) #1899 — PR A (evaluator fail-closed + allowTransfer/Restore/Purge marked experimental, [security][立项位] M2 权限生命周期(undelete/purge)功能与 allowRestore/allowPurge RBAC 同批建设(evaluator 已 fail-closed,allowTransfer 已 enforced) #1883) + PR B ([P0][security] Agent access control is a no-op (permissions/visibility/access) #1884 agent access enforcement, [P0][security] Object apiEnabled/apiMethods not enforced by REST #1889 object apiEnabled/apiMethods enforcement).
• fix(action): consume spec disabled (boolean|CEL) in action button (framework#1885) objectui#1743 — [P0][security] Action disabled (CEL form) silently ignored #1885 action disabled (CEL) now consumed by the renderer.

Deferred to M2 (feature + enforcement together): #1882 Policy, #1887 SharingRule, #1888 flow runAs, #1886 role parent.

[os-zhuang]

Closing the umbrella — audit delivered, disposition fully split out

The audit this issue tracked is done and has been operationalized into a standing system, and every checklist item has been split into its own labeled, independently-tracked sub-issue. Keeping this umbrella open now only duplicates that tracking, so closing it.

What the audit became (standing system, not a one-off)

• Spec-liveness gate — packages/spec/liveness/*.json ledgers + packages/spec/scripts/liveness/check-liveness.mts, wired as the blocking Spec property liveness CI check. Every authorable property of 10 governed types is classified live/experimental/dead with evidence; the ratchet blocks new undeclared surface. This is the living source of truth that replaces the static audit docs.
• Cross-repo correctness — the original audit missed objectui's metadata-admin authoring layer; a cross-repo re-audit corrected ~25 props dead→live (fix(spec): cross-repo liveness re-audit — 16 props dead→live (objectui authoring UI) #1956 et al.). A monthly drift re-audit cron now catches dead→live drift the completeness gate can't.
• Author-side loop closed (feat(cli): liveness author-warning lint — close the spec-liveness loop #1966) — objectstack compile now warns when an author/AI sets a misleading dead/experimental property (enable.feeds, field.columnName, …) with a corrective hint. Measurement → gate → drift-cron → author-prevention.

Shipped against the checklist

• ✅ Object apiEnabled/apiMethods enforced by REST (feat(rest): enforce object enable.apiEnabled / apiMethods (ADR-0049 #1889) #1937) — enforceApiAccess, 404/405.
• ✅ Agent access control — already enforced via evaluateAgentAccess at the chat route; ledger corrected (the audit predated it).
• ✅ Record clone productized — enable.clone was dead; now a real runtime (feat: record clone — wire object.enable.clone to a real runtime #1961), reclassified live.
• ✅ Aspirational prune (partial) — orphaned recordTypes + cdc removed (chore(spec): cut orphaned object.recordTypes and object.cdc stubs #1960).

Remaining items — each tracked in its own open issue (nothing orphaned)

• 🔴 P0 security: PolicySchema [P0][security] PolicySchema is 100% dead — enforce or remove #1882 · permission lifecycle ops [security][立项位] M2 权限生命周期(undelete/purge)功能与 allowRestore/allowPurge RBAC 同批建设(evaluator 已 fail-closed,allowTransfer 已 enforced) #1883 · role parent [P0][security] Role parent dead — manager-rollup unimplemented #1886 · SharingRule [P0][security] SharingRuleSchema disconnected from the live engine #1887 · flow runAs [P0][security] Flow runAs never switches execution identity #1888
• 🟠 P1 analytics migration [P1] Finish ADR-0021 analytics migration (chart view / dashboard+Studio / report) #1890
• 🟡 P2: naming drift [P2] Naming drift → silent no-ops (spec key ≠ consumed key) #1891 · write-only metadata [P2] Write-only / disconnected metadata (tool, email, sharing, spec-bridge) #1892 · aspirational prune-or-experimental [P2] Aspirational config — prune or mark experimental #1893 · inverse drift [P2] Inverse drift — renderers read undeclared props #1894 · designer authoring gaps [P2] Designer authoring gaps (live prop, no Studio editor) #1895
• Action disabled CEL — objectui renderer side.

Closing as completed (deliverable shipped + operationalized); execution continues in the sub-issues above.