docs(data-modeling): drop the flowchart edge that routed secret values to password - #16865
Merged
Merged
Conversation
…s to `password` The Text? branch of the field-type decision-tree flowchart had `TEXT -->|Secret value| T8[password]`, contradicting the same page's quick-reference table (password: "masked on read; stored plaintext at rest ... prefer secret for real credentials"), ADR-0100, and the published skill rule — all of which say a secret value belongs in `secret`. The flowchart already has a correct edge for this (`STRUCT -->|Sensitive secret value| S5[secret]`), so rather than add a second edge into the same `secret` node (which would leave two differently-labeled paths converging on one answer), the wrong edge is dropped outright and its now-unused `T8`/`password` style line removed. The `password` type and its table row are untouched — it's a real, supported type, just not one the flowchart should route credentials to. Full flowchart audited edge-by-edge against the quick-reference table; no other edge disagrees with its table row. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012GKcPZbMoGq7WPzKLfRBTU
…`secret` Round-1 rework: deleting the Text-branch credential edge outright (previous commit) left readers who answer "Text? yes" for an api_key/db_password — the table's own `secret` examples — with no secret-value edge at all on the branch they actually walk; the only surviving `secret` edge hangs off `Structured Data?`, which that reader answers "no" to. Point the Text branch at `secret` instead: `TEXT -->|Sensitive secret value| S5[secret]`. The Structured-branch edge stays too — an api_key is text and a credential blob is structured, and a decision tree with two questions legitimately reaching one answer is ordinary, not ambiguous. `S5` already has a style rule from the Structured branch, so no new style line is needed. Re-ran the full A2 edge-vs-table audit (36 edges now): the new TEXT->secret edge matches the `secret` table row; zero disagreeing edges. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012GKcPZbMoGq7WPzKLfRBTU
baozhoutao
marked this pull request as ready for review
September 8, 2026 12:35
baozhoutao
enabled auto-merge
September 8, 2026 12:35
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #16366
What
content/docs/data-modeling/field-type-decision-tree.mdx's decision-tree flowchart had aText?-branch edge (TEXT -->|Secret value| T8[password]) that routed a secret value topassword, contradicting the same page's own quick-reference table, the flowchart's ownSTRUCT -->|Sensitive secret value| S5[secret]edge, ADR-0100, and the published skill rule.Round 1 (superseded): deleted the wrong edge outright rather than relabeling it, reasoning that pointing it at
secrettoo would create a second, differently-labeled edge into the same node. Reviewer correctly flagged this as wrong: the chart's root branches on shape (Text?vsStructured Data?), and anapi_key/db_password— the table's ownsecretexamples — is text. A reader who answers "Text? yes" for a credential found no secret-value edge at all after round 1; the only survivingsecretedge hung offStructured Data?, which that reader answers "no" to. That replaced "routes credentials to the wrong type" with "doesn't route credentials at all" on the branch a text-credential reader actually walks — worse for the reader who filed the card, and two legitimately-converging edges into one node is ordinary in a decision tree, not ambiguous.Round 2 (current): the Text branch now points at
secretinstead of being dropped —TEXT -->|Sensitive secret value| S5[secret]— so "Text? yes → is it a secret?" lands onsecret. The pre-existingSTRUCT -->|Sensitive secret value| S5[secret]edge stays too (kept both, per reviewer's recommendation): an api_key is text and a credential blob is structured, and both are true.S5already carries a style rule from the Structured branch, so no new style line was needed.passwordand its table row remain untouched — still a real, supported type, just no longer the flowchart's answer for a secret value.Audit (card's A2)
Every edge in the flowchart was checked against its corresponding quick-reference-table row, twice: once after round 1's delete (35 edges, one disagreement found and fixed, zero remaining), and again after round 2's add (36 edges — the new
TEXT -> secretedge matches thesecrettable row) — zero disagreeing edges either time. (codeandhtmleach appear in a table but have no flowchart edge at all — an omission, not a contradiction, a different defect class per repo scoping rules, so noted but not filed; see the terminal report'sout_of_scope_findings.)Testing
38 gate families derived via
node scripts/pm/dispatch-gates.mjs --commands content/docs/data-modeling/field-type-decision-tree.mdx, all run, all green at commit856264d8b8(--ranreconciliation: 38 derived, 38 run, 0 NOT-MEASURED, 0 UNRUN). Fresh worktree needed@objectstack/spec,@objectstack/lint,@objectstack/client,@objectstack/client-reactbuilt before 10 of the 38 (docs-registry / skill-example / formula / security-posture / transcript-drift checks) could run pastPREREQUISITE NOT MET; all 10 green after building.No changeset:
content/docs/**is part of the private@objectstack/docsapp; nothing published from any released package moves.Generated by Claude Code