feat(platform-objects,service-settings,verify): sys_secret 密文库改由平台基础设施注册 (#4270)

[os-zhuang]

Closes #4270

改了什么

按 #4258(sys_migration,closes #4243)确立的「平台系统对象由平台层注册」落脚点,把 sys_secret 的注册从 service-settings 挪到 PlatformObjectsPlugin:

• PlatformObjectsPlugin.init 现在注册 [SysMigration, SysSecret](经 manifest 服务,scope: system)。os serve 本就自动注入该插件,所以每个被服务的内核都带密文库,与是否装 settings 无关。
• settingsObjects 摘除 SysSecret,只剩 [SysSetting, SysSettingAudit]——移除而非并存(sys_migration 由 service-storage 持有，但它是平台级账本 —— 第二个消费者出现后这层耦合该解开 #4236 提醒过双注册问题),settings 服务仍是 sys_secret 的生产者/消费者(经其 secret store),只是不再是注册者。
• verify harness 补上 PlatformObjectsPlugin,与 serve 的装配对齐(harness 自 feat(platform-objects,service-storage,cli): sys_migration 账本改由平台基础设施注册 (#4243) #4258 起就漂移了:serve 有该插件、harness 没有)。这也让 harness 内核首次带上 sys_migration 账本 + 空库 attestation——dogfood 全套在该姿态下通过。
• 两处失真注释修正:sys-secret.object.ts 的「All writes flow through SettingsService」(实际引擎 encryptSecretFields 绕过 SettingsService 直写 driver)与 manifest.ts 的「Objects owned by service-settings」;serve.ts 5c 注释同步提及 sys_secret。

为什么

sys_secret 有三类生产者,只有一类是 settings:SettingsService(加密设置项)、ObjectQL 引擎自身(encryptSecretFields/resolveSecret——任何带 Field.secret() 的业务对象的通用写路径)、service-datasource(凭证 binder)。且失败姿态是 fail-closed:没这张表时任何 secret 字段写入直接抛错,而报错文案说「Ensure the platform-objects (sys_secret) are registered」——指认的责任方此前并不注册它。本次改完,这句报错成为真话。

验证

• packages/platform-objects/src/plugin.test.ts:注册断言更新为 [SysMigration, SysSecret],并加 sys_secret 由 service-settings 注册，但它有三类生产者且引擎自己就是其一 —— 而且是 fail-closed #4270 pin。
• packages/services/service-settings/src/manifest.test.ts(新增):pin settingsObjects 恰为 K/V + audit,且不含 sys_secret(防双注册回归)。
• 全仓 turbo run test:132 任务全绿(含 dogfood field-zoo 的 secret 字段 HTTP 往返——现在走的就是 platform-objects 注册的表);合并最新 main 后复跑。
• 真实 serve 冒烟:pnpm dev -- --fresh 起 showcase,REST 写 showcase_field_zoo.f_secret 成功、读回为掩码 ••••••••、sys_secret 恰有一行 {namespace: showcase_field_zoo, key: f_secret, alg: aes-256-gcm, kms_key_id: local:v1}。

语义变化面

手工组装 SettingsServicePlugin 而不组 PlatformObjectsPlugin 的嵌入式内核不再获得 sys_secret 表(secret 写入将 fail-closed 抛错,永不落明文)。changeset 已写明迁移句:补组 PlatformObjectsPlugin 即可——所有仓内受支持装配路径(serve / data-migration / verify)均已自带。

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
objectstack	Ignored		Jul 31, 2026 2:34am

[github-actions]

📓 Docs Drift Check

This PR changes 4 package(s): @objectstack/cli, @objectstack/platform-objects, @objectstack/service-settings, @objectstack/verify.

23 hand-written doc(s) reference the affected code and may need an implementation-accuracy re-verification:

• content/docs/ai/skills-reference.mdx (via packages/cli)
• content/docs/api/client-sdk.mdx (via @objectstack/cli)
• content/docs/api/data-flow.mdx (via @objectstack/cli)
• content/docs/api/environment-routing.mdx (via @objectstack/cli)
• content/docs/api/error-catalog.mdx (via @objectstack/cli)
• content/docs/automation/hook-bodies.mdx (via packages/cli)
• content/docs/deployment/backup-restore.mdx (via @objectstack/cli)
• content/docs/deployment/cli.mdx (via @objectstack/cli)
• content/docs/deployment/self-hosting.mdx (via @objectstack/cli)
• content/docs/getting-started/your-first-project.mdx (via @objectstack/cli)
• content/docs/kernel/runtime-services/audit-service.mdx (via packages/services/service-settings)
• content/docs/kernel/runtime-services/data-service.mdx (via packages/cli)
• content/docs/kernel/runtime-services/index.mdx (via packages/cli, packages/services/service-settings)
• content/docs/kernel/runtime-services/settings-service.mdx (via packages/services/service-settings)
• content/docs/permissions/authentication.mdx (via @objectstack/cli)
• content/docs/plugins/packages.mdx (via @objectstack/cli, @objectstack/platform-objects, @objectstack/service-settings)
• content/docs/protocol/kernel/plugin-spec.mdx (via @objectstack/cli)
• content/docs/protocol/kernel/realtime-protocol.mdx (via @objectstack/cli)
• content/docs/releases/implementation-status.mdx (via @objectstack/cli, @objectstack/service-settings, @objectstack/verify)
• content/docs/releases/v15.mdx (via @objectstack/verify)
• content/docs/releases/v16.mdx (via @objectstack/cli)
• content/docs/releases/v9.mdx (via @objectstack/service-settings)
• content/docs/ui/setup-app.mdx (via @objectstack/platform-objects)

Advisory only. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs origin/main → pass the list as args.docs.