security: externalSharingModel is declared and authored but has no runtime reader — an object's externalSharingModel: private changes no answer for any principal (ADR-0090 D11 declared-not-enforced) #23268

Ruled: 6159300530 · letter A · 2026-10-14T02:08Z

Filing gate ①, class (b): a declared key with no runtime reader (ADR-0049 enforce-or-remove).

reach: a named producer: examples/app-showcase's showcase_announcement declares externalSharingModel: private. On a real dogfood boot, ADR-0138 E1's dev measured a guest with a bound read set reading every row of a public_read object whether or not it declares externalSharingModel: private or public_read (2/2 either way; hand-off 6145588579, row_scope_measured). The dev's source reading: the key's only reader is the authoring posture gate.

Filed by domain:engine seat 1 (#6367) · os-support-ai · session_01P88ehrZ6hM19hBzdpsQTTo, from E1's hand-off (the second entry of out_of_scope_findings). ⛔ Not a claim; grading and routing are triage's.

Reader who acts: the lane that owns the key. packages/spec declares it (ADR-0090 D11), and its enforcement would live in the row pipeline (plugin-security / core). Triage routes it. Its direction depends on #23266: option B there gives the key a guest reader, while A or C leave it with no reader for the guest. Either way the question for external principals stays open: enforce or remove.

Governing text

• ADR-0090 D11: "OWD gains an external dimension: optional externalSharingModel, default …" and "sharingModel stays scalar and internal; an optional externalSharingModel is added …".

Re-check

• git grep -n "externalSharingModel" origin/main -- 'packages/*/src/**/*.ts' ':!*.test.ts' ':!packages/spec/**' lists the runtime readers outside spec.
• Positive control, same pathspec: git grep -c "sharingModel" origin/main -- packages/plugins/plugin-security/src.

Unverified by this seat; the dev's reading.

Dedupe

MCP search_issues on this repo, closed included: "externalSharingModel runtime reader declared not enforced external sharing model enforcement" gives 8 hits.

• [Decision] 访客（guest）的行可见范围：沿用对象的内部共享模型（A，现状，公开对象全部行可见）、按 externalSharingModel 判（B）、还是只经分享链接（C） #23266 is open; it is the guest row-scope decision that names this key's option.
• The other 7 are closed and adjacent: fix(sharing): publicSharing.eligibility is declared-but-unenforced — a draft or internal record mints a public share link and is served anonymously #7861 (publicSharing.eligibility), app-showcase: two sharing rules declared on objects without record sharing enabled — boot backfill fails, rules never take effect #9237, plugin-sharing: a manage_sharing holder whose session has no ACTIVE organization reads every tenant's sharing rules (adminOrgScope falls open) #8158, Publish-time lint: sharingModel: controlled_by_parent with no master_detail relation is statically detectable and unreported #7503, [1 of #7891] METADATA_CREATE_SEEDS.object gains an authored sharingModel — or an explicit default-OWD ruling (blocker A) #8308, SharingRuleSchema is .strict() but declares no ADR-0010 protection envelope, while the metadata read path stamps _packageId onto stored bodies type-blind #7404 and plugin-sharing: INFO line when isSystem writes cover an active sharing rule but materialise zero grants (demand 3 of #4707, maintainer-ruled 2026-08-06) #6783.

None has this shape. Dedupe words: externalSharingModel no runtime reader; external OWD declared not enforced; D11 external dimension enforcement.

Generated by Claude Code