Split from the #2657 coverage audit (#6234, 2026-08-07) as the unconditional first step — restore-invariant class, compatible with whichever way the maintainer later rules the admission question (B/C) on #2657.
The hole (today, on main)
webhook, connector and sharing_rule stack collections are already writable through PUT /meta with zero schema validation — a spec-invalid webhook body stores and answers success: true. Proven by the repo's own test: packages/objectql/src/protocol-meta.test.ts:1461-1469 saves an invalid webhook and expects success (that pin flips with this fix). This is the same enforced-but-undeclared shape #5271 closed for api.
The fix (size S)
Bind the three kinds' Zod schemas via registerMetadataTypeSchema (metadata-type-schemas.ts:183) — exactly the #5271 mechanism — without registering them as metadata kinds (no registry entries, no new capability surface, no authorization change). Effects:
Caveats (from the audit, follow the precedents)
Release-board note: criterion ① (an authoring surface that stores arbitrary invalid bodies today) — same class as #5961, which is on the board; target:v17 applied accordingly, triage seat may veto.
Related
#2657 (admission ruling B/C, pending) · #6234 (the audit) · #5271 / #5312 (the api precedent pair) · #6242 (enumeration-drift finding, adjacent)
Split from the #2657 coverage audit (#6234, 2026-08-07) as the unconditional first step — restore-invariant class, compatible with whichever way the maintainer later rules the admission question (B/C) on #2657.
The hole (today, on main)
webhook,connectorandsharing_rulestack collections are already writable throughPUT /metawith zero schema validation — a spec-invalid webhook body stores and answerssuccess: true. Proven by the repo's own test:packages/objectql/src/protocol-meta.test.ts:1461-1469saves an invalid webhook and expects success (that pin flips with this fix). This is the same enforced-but-undeclared shape #5271 closed forapi.The fix (size S)
Bind the three kinds' Zod schemas via
registerMetadataTypeSchema(metadata-type-schemas.ts:183) — exactly the #5271 mechanism — without registering them as metadata kinds (no registry entries, no new capability surface, no authorization change). Effects:Caveats (from the audit, follow the precedents)
sharing_rule's schema is.strict()with no envelope — stamped/stored rows would fail a naive parse; follow the [spec]api补进 DEFAULT_METADATA_TYPE_REGISTRY 与 BUILTIN_METADATA_TYPE_SCHEMAS(#5206 第 1 步,拆单) #5271/feat(spec):api补进 DEFAULT_METADATA_TYPE_REGISTRY 与 BUILTIN_METADATA_TYPE_SCHEMAS (#5271) #5312 lesson (validate the author shape at the write door; do not reject stamped rows).ConnectorSchemavsDeclarativeConnectorEntrySchema) and record why in the PR.protocol-meta.test.ts:1461pin to assert the 422 (it currently pins the hole).Release-board note: criterion ① (an authoring surface that stores arbitrary invalid bodies today) — same class as #5961, which is on the board;
target:v17applied accordingly, triage seat may veto.Related
#2657 (admission ruling B/C, pending) · #6234 (the audit) · #5271 / #5312 (the
apiprecedent pair) · #6242 (enumeration-drift finding, adjacent)