feat(platform-objects): secure-by-default posture for sensitive system objects (ADR-0066 ④)

[os-zhuang]

What & why

Lands the system-object slice of ADR-0066 ④ (secure-by-default rollout) from the authorization gap map (umbrella #2561). The D2 access: { default: 'private' } primitive has been enforced since #2690's predecessors — but no production object used it: the platform's raw secret/credential stores were still covered by member_default's wildcard '*': allowRead. This PR flips the clearly-sensitive, flip-safe ones.

Change

6 objects → access: { default: 'private' }

Object	What its rows are
sys_secret	encrypted settings/datasource secrets
sys_jwks	JWT signing private keys
sys_verification	live password-reset / verify tokens (reading one = account takeover)
sys_oauth_access_token	live bearer tokens (reading one = session hijack)
sys_oauth_refresh_token	live long-lived credentials
sys_device_code	pending device-grant codes (reading one = CLI-login hijack)

An ordinary member's generic data-layer access now 403s; platform admins retain access via the posture-gated viewAllRecords/modifyAllRecords superuser bypass.

Flip-safety — every runtime consumer verified

• better-auth reads/writes all identity tables via its adapter with isSystem: true → middleware short-circuits; auth flows unaffected.
• engine.resolveSecret reads sys_secret at driver level (below the middleware).
• SettingsService / datasource secret-binder read principal-less → middleware falls open for internal calls.
• API-key auth (core/security/api-key.ts) reads with isSystem: true.

Deliberately excluded (member self-service)

sys_session, sys_api_key, sys_oauth_application, sys_two_factor keep the public posture: the Account app ("My Sessions" / "My API Keys" / "My Apps" / 2FA "My Enrollment") reads them through the generic data layer as the member — flipping them would break self-service. Row scoping (owner/tenant RLS + _self carve-outs) remains their guard. A test asserts the exclusion so it's a documented decision, not an oversight.

Also

• sys_scim_provider (SCIM bearer-token config) gains requiredPermissions: ['manage_platform_settings'] — mirrors its sibling sys_sso_provider's D3 gate.
• Setup nav nav_jwks is capability-gated like nav_api_keys (UX: non-admins no longer see a menu entry that can only 403).

Regression pinning

• platform-objects.test.ts — "secure-by-default posture" suite asserts each flip and the self-service exclusions.
• ADR-0056 D10 conformance matrix — new row secure-by-default-posture (dropping the flag from a secret store fails CI, not review).
• ADR-0066 ④ + content/docs/permissions/authorization.mdx updated: system-object slice landed; still open = Studio posture surfacing (objectui) and the explicit-public reference-data convention (no such objects ship in framework today).

Tests / verification

• platform-objects: 71 passed (incl. new posture suite)
• plugin-auth: 230 passed (auth flows unaffected by the flips)
• dogfood: conformance-matrix test ✓, showcase-anonymous-deny + two-doors-permission e2e (real kernel boot + login) 8 passed
• service-settings 129 + service-datasource 93 passed (the sys_secret consumers)
• Full workspace turbo build green

Refs #2561

🤖 Generated with Claude Code

https://claude.ai/code/session_0187GeNqezxV6g5jiLiggfbt

---

Generated by Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
spec	Ready	Preview, Comment	Jul 8, 2026 3:49pm

[github-actions]

📓 Docs Drift Check

This PR changes 2 package(s): @objectstack/dogfood, @objectstack/platform-objects.

3 hand-written doc(s) reference the affected code and may need an implementation-accuracy re-verification:

• content/docs/permissions/authorization.mdx (via packages/dogfood)
• content/docs/plugins/packages.mdx (via @objectstack/platform-objects)
• content/docs/ui/setup-app.mdx (via @objectstack/platform-objects)

Advisory only. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs origin/main → pass the list as args.docs.