fix(security): resolve current_user.accessible_org_ids into the RLS variable bag (#17200)

* test(security): pin `current_user.accessible_org_ids` plumbing end to end (#16518)

The measurement first, red, before any source change. Same rig, same caller
context, same rows, same driver — differing only in which key the predicate
names:

  employer_org IN (current_user.my_org_ids)          4 of 6 rows  PASS
  employer_org IN (current_user.accessible_org_ids)  0 of 6 rows  FAIL

So an app CAN rename around the defect, and the documented spelling is the one
that does not work. The second line is also this file's positive control:
without it the first would read the same on a tree where nothing was broken.

13 failed | 18 passed. The 18 are the cells that must not move — the
fail-closed paths, #16119's non-existent-variable face, and the pre-existing
`current_user.*` variables.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012zTkyNHJ7TkuN2oXtP5x37

* fix(security): resolve `current_user.accessible_org_ids` into the RLS variable bag (#16518)

`RLSUserContext` named `id`, `organization_id`, `positions`, `org_user_ids` and
`email`, and nothing copied `accessible_org_ids` out of `ExecutionContext` —
while `packages/spec` declared the key's SHAPE, named CORE as its resolver, and
refused an app from supplying it. A slot with a declared shape and no filler.

Route 1, following `org_user_ids`' precedent exactly: both are core-resolved
membership sets the runtime pre-resolves so this compiler never issues a
subquery. The producer already existed and is unconditional —
`resolve-authz-context.ts` types the set as required and
`assemble-execution-context.ts:343` copies it in every posture ("in `single`
posture the set is resolved but no wall consumes it"). Only the consuming line
was missing.

31 of 31 green, from 13 failed | 18 passed on the same file one commit ago. The
18 did not move: the fail-closed paths, #16119's non-existent-variable face, and
every pre-existing `current_user.*` variable.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012zTkyNHJ7TkuN2oXtP5x37

* chore(changeset): patch @objectstack/plugin-security for #16518

A bug fix in a released package takes a `patch` (AGENTS.md). No API signature
change, no exported symbol added, no spec or ADR edit.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012zTkyNHJ7TkuN2oXtP5x37

---------

Co-authored-by: Claude <noreply@anthropic.com>

Author: Trump

.changeset/rls-accessible-org-ids-resolved-into-variable-bag.md

@@ -0,0 +1,78 @@
+---
+"@objectstack/plugin-security": patch
+---
+
+fix(security): resolve `current_user.accessible_org_ids` into the RLS variable bag (#16518)
+
+`patch` — a bug fix in a released package. No API signature changes, no exported
+symbol added, no spec or ADR edit: the contract already promised this, and only
+the line that delivers it was missing.
+
+## What was wrong
+
+`packages/spec/src/contracts/rls-membership-resolver.ts` does not merely reserve
+the name `accessible_org_ids`. It declares the field's SHAPE (`:53`,
+`accessible_org_ids?: string[]`), states at `:35` that the key is CORE-resolved
+and not an app resolver, and lists it at `:70` in
+`RESERVED_RLS_MEMBERSHIP_KEYS` — so an app's membership resolver is refused when
+it tries to supply the set itself. `ExecutionContext.accessible_org_ids` goes
+further and names the RLS spelling outright: *"RLS policies may reference it as
+`organization_id IN (current_user.accessible_org_ids)`"*.
+
+`RLSUserContext` declared `id`, `organization_id`, `positions`, `org_user_ids`
+and `email`, and nothing copied `accessible_org_ids` out of the execution
+context. So the key was reserved on the grounds that core resolves it, and core
+did not resolve it — a slot with a declared shape and no filler, which is the
+ADR-0049 "declared but unenforced" shape.
+
+**The cost is the invisible one.** A predicate such as
+`employer_org IN (current_user.accessible_org_ids)` compiled to an unresolved
+variable, every applicable policy dropped out, and `RLS_DENY_FILTER` returned
+**zero rows with no error raised**. Nothing failed. An empty list is
+indistinguishable from "this user really has no data", which is how the shape
+survived three green static gates and, in the reporting app, left ten policies
+across six objects inert — the entire multi-tenant isolation model.
+
+The failure direction is **closed**: zero rows, never a cross-tenant read. This
+is a usability and declared-means-enforced defect on a security surface, not a
+leak.
+
+## What it does now
+
+`RLSCompiler.compileFilter` copies `ExecutionContext.accessible_org_ids` into
+`RLSUserContext`, following `org_user_ids`' precedent exactly — both are
+core-resolved membership sets the runtime **pre-resolves**, precisely so this
+compiler never has to issue a subquery. The compiler is unchanged otherwise; it
+already handled the value correctly once present.
+
+The producer already existed and is unconditional: `resolve-authz-context.ts`
+types the set as required and `assemble-execution-context.ts` copies it on every
+face, in every posture (*"in `single` posture the set is resolved but no wall
+consumes it"*). Only the consuming line was missing.
+
+One consequence worth naming: **reserved now means reserved at the compiler
+too.** `stageRlsMembership` screens reserved keys out of a *resolver's* answer,
+but a bag already present on the context was spread through unscreened, and
+landed in the variable bag because nothing named the field. Now that the kernel
+names it, the compiler's own "a membership key never clobbers a named field"
+rule covers it and the kernel's value wins.
+
+## Measured, end to end
+
+A rig on real drivers (`driver-sql`, `driver-sqlite-wasm`), six rows across
+three organizations, a caller holding membership in two of them:
+
+| predicate | before | after |
+|:--|--:|--:|
+| `employer_org IN (current_user.accessible_org_ids)` | **0 of 6** | **4 of 6** — the rows of both orgs |
+| same, caller scoped to ONE org | 0 of 6 | 2 of 6 — that org only |
+| same, caller with no set / an empty set / an org with no rows | 0 of 6 | 0 of 6 — unchanged, still fails closed |
+| a predicate naming a NON-EXISTENT variable | 0 of 6 | 0 of 6 — unchanged (#16119's face, untouched) |
+| `org_user_ids`, `organization_id`, `email`, `id`, an app membership key | — | byte-identical |
+
+An app **could** work around the defect by supplying the same set under its own
+unreserved key through `rlsMembership` and rewriting its predicates to
+`current_user.my_org_ids`; that reads 4 of 6 on the same rig, before and after.
+The workaround costs every app a membership-resolver registration it should not
+need and moves every predicate off the documented spelling — and it is no longer
+necessary.