feat(formula,objectql): read one hop through a lookup in a validation predicate

[os-justin]

Fixes #18682

Clause-②: yes

⚠️ Rewritten short by the dispatching seat (2026-09-23T13:10Z). Its history, with each correction, is in this PR's comments. Three earlier review records were served below the contract-review tier and do not count (notice 5790480639); the next at-tier record judges the whole PR.

What changes

A script / cross_field validation rule can read one hop through a lookup: record.account.type on an opportunity resolves the related account's field. Before this change the expression faulted, and because a broken validation fails closed, every write on the object was refused.

• The engine finds the lookup fields a rule traverses and the related fields it names, loads those related rows before evaluation, and binds them on a copy of the record for that rule only. On an update, the related row is the one named by the foreign key the write stores, read after read-only fields are stripped. The foreign key the driver receives is unchanged.
• The related read runs under system authority, limited to the fields the expression names (intersected with the related object's declared fields) plus id. When the caller has an active organization, the read carries it: under isolated, a reference to another organization's row reads 0 rows (measured on driver-sql and driver-sqlite-wasm). Two bounds hold every caller that is not system (a user, a public-form submitter, or a caller with no principal); they never apply to a system caller. One consequence for system callers is stated rather than left implicit: a system context that carries a userId but no active organization now gets the system read under a walled posture, where it read nothing before round 17. Under a walled posture (group or isolated), such a caller with no active organization gets no related read, and every stored reference stays unresolved. A related object that no organization wall scopes (no tenant column, as sys_user behind a user field; tenancy.enabled: false; or external) is read only for the rows the caller's own read of that object returns; a reference to any other row refuses the write as not readable, whatever that row holds, and its columns are never read. A public-form submitter's grant admits a read of the form's own object only, so its own read of any other such object is refused; a caller with no principal reads through the security middleware's fall-open. The organization scope, the org-less no-read (user, public-form and principal-less callers) and the sys_user own-read bound (user and public-form callers) are pinned in packages/plugins/plugin-security/src/predicate-related-read-tenant-scope.test.ts, the user case against the shipped member_default wall; the principal-less own read and the tenancy.enabled: false / external arms are covered by reading, not by a pin.
• An unresolved relation (no id, no row found, or a failed read) leaves the field unbound, and the write is refused. The refusal states that the related record was not found, with the same text whether the id names a row in another organization or no row at all. On a related object no organization wall scopes, a row outside the caller's own read, stored or not, is refused as not readable (could not read 'sys_user'), with one text; so is a related read that is itself refused.
• Two shapes are refused when the rule is authored: reading a lookup both through the relationship and as a plain value, and reading more than one hop deep.

The write preview (ObjectQL.validate())

The preview resolves related rows only for a caller that @objectstack/plugin-security's canWriteObject admits; the checks it runs are listed in its docblock, and include the organization wall (ADR-0123 D2). can-write-object-admission.test.ts pins the method against the registered middleware on its equivalence block's cases, one D12 delegate UPDATE as a direction case, and the D12 arm receiving copies. write-preview-field-gate-parity.test.ts pins the preview against the write path for the field-level gate. ⛔ The preview does not promise that the write would succeed.

Cascade delete

The foreign-key clear a cascade delete issues does not resolve relations, which is main's behaviour. Known limit: a traversing rule on a child that clears its reference to the deleted parent refuses that delete, and the refusal's prescription points at the child object rather than the related one.

Not in this PR

• The field-level requiredWhen / readonlyWhen / option visibleWhen predicates and RLS predicates (the UI seams are [#18682 v1 切出] UI 谓词三缝(visibleWhen / readonlyWhen / requiredWhen)在关联字段不可读时 fail-open —— 父卡裁定的「不可读即响亮报错、⛔ 绝不静默为真」在这三缝上今天做不到 #19727). Depth is one hop.
• A stripped master-detail repoint unlocks a parent-scoped readonlyWhen: a by-id update judges the lock against the parent it names, not the parent it stores #19853 — the master-detail parent seam resolves a by-id update's parent before read-only strips. It is the same order this PR fixes on its own seam, predates this PR, and is filed separately.

Acceptance

docs/qa/platform-checklist/areas/records-forms.json gains records-forms.predicate-relationship-traversal. On the showcase app, showcase_invoice refuses an invoice against a churned account on the server.

Changeset

minor on @objectstack/formula, @objectstack/lint, @objectstack/objectql and @objectstack/plugin-security.

维护者速读

• 校验规则现在可以读关联记录上一层的字段(例如在商机上判断所属客户的类型)。以前这样写会出错,导致该对象的所有保存被拒。
• 关联记录以系统身份读取,只读表达式里点名的字段。调用者有当前组织时,读取带上该组织(isolated 下读不到别的组织的记录);在有组织墙的部署里,没有当前组织的非系统调用者(包括公开表单的匿名提交者)完全不做关联读取。两条都有测试钉住。
• 关联对象不分组织时(例如 user 字段指向的 sys_user),只读调用者自己读得到的那一行;读不到(比如别的组织的用户)就按「不可读」响亮拒绝,不管那一行存的是什么,也不读它的字段。这两条约束对所有非系统调用者都成立:登录用户、公开表单的匿名提交者、没有身份的内部调用;系统调用不受这两条约束(带 userId 但没有当前组织的系统调用,在有组织墙的部署里现在会做系统读取,之前不读)。
• 级联删除清空外键时不读关联记录,与 main 一致;已知局限:这时带关联读取的规则会拒绝那次删除,提示语指向的对象不对。
• 更新时按「去掉只读字段后真正要写入的外键」去读关联记录,堵住了先读后剥只读字段的绕过。

🤖 Generated with Claude Code

https://claude.ai/code/session_01Sfe5YjBLwB9J3y8fvm2xq1

[github-actions]

📓 Docs Drift Check

This PR changes 4 package(s): @objectstack/formula, @objectstack/lint, @objectstack/objectql, @objectstack/plugin-security, touching 44 documentable anchor(s). ⚠️ 3 changed file(s) yielded no anchor (packages/formula/src/index.ts, packages/objectql/src/core.ts, packages/objectql/src/index.ts), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files.

15 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/api/error-catalog.mdx (via rule_violation (literal, a string literal in checkPredicate))
• content/docs/automation/flows.mdx (via validateExpression (symbol, a top-level function))
• content/docs/automation/webhooks.mdx (via acc_1 (literal, a string literal in a comment in RelationshipTraversalAnalysis))
• content/docs/data-modeling/formulas.mdx (via validateExpression (symbol, a top-level function))
• content/docs/data-modeling/seed-data.mdx (via cross_field (literal, a string literal in collectPredicateRelationships))
• content/docs/data-modeling/validation.mdx (via cross_field (literal, a string literal in collectPredicateRelationships))
• content/docs/kernel/runtime-services/sharing-service.mdx (via evaluateRule (symbol, a top-level function))
• content/docs/permissions/field-level-security.mdx (via SecurityPlugin (symbol, a top-level class))
• content/docs/permissions/index.mdx (via SecurityPlugin (symbol, a top-level class))
• content/docs/permissions/sharing-rules.mdx (via /sharing/rules/:idOrName/evaluate (route, bridged from symbol evaluateRule — its route source's handler names it))
• content/docs/permissions/system-context.mdx (via canWriteObject (symbol, a method of class SecurityPlugin), resolvePredicateRelated (symbol, a method of class ObjectQL))
• content/docs/plugins/packages.mdx (via SecurityPlugin (symbol, a top-level class))
• content/docs/protocol/kernel/error-handling.mdx (via rule_violation (literal, a string literal in checkPredicate))
• content/docs/protocol/objectql/schema.mdx (via cross_field (literal, a string literal in collectPredicateRelationships))
• content/docs/ui/forms.mdx (via SecurityPlugin (symbol, a top-level class))

⛔ 3 release-owned page(s) also name something this change touched. These are read-only:

• content/docs/releases/implementation-status.mdx (via SecurityPlugin (symbol, a top-level class))
• content/docs/releases/v16.mdx (via evaluateValidationRules (symbol, a top-level function), validateStackExpressions (symbol, a top-level function))
• content/docs/releases/v17/17-0.mdx (via cross_field (literal, a string literal in collectPredicateRelationships))

content/docs/releases/ is RELEASE-OWNED (AGENTS.md "Documentation Guardrails"): release
notes are written centrally at release time, and a code PR that edits them is the exact PR
that guardrail exists to stop. They are still audited — read-only. If one of them is actually
wrong, file an issue or open a dedicated docs-only PR; do not edit it here.

What this run could not see

• 3 changed file(s) yielded no anchor (packages/formula/src/index.ts, packages/objectql/src/core.ts, packages/objectql/src/index.ts) — pages documenting those are invisible to this run
• 1 anchor(s) matched too much of the corpus to be a work list: ObjectQL (symbol, 69 pages)
• 8 name(s) were too generic to anchor anything (single lowercase words)
• the SDK route bridge reached 60 of 215 client-bound route-ledger rows — the other 155 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 155: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 55 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 100 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 34 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 615c0856efd26f42579bf7ff27297c05bdfd11fb → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 21c6bb3905239d2933ec4f31827cd370abfab67b — the merge of head 3e8b3c3a22a6a0b67e77668d9220d6cf7cce0c31 into base 615c0856efd26f42579bf7ff27297c05bdfd11fb, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 21c6bb3905239d2933ec4f31827cd370abfab67b && git checkout 21c6bb3905239d2933ec4f31827cd370abfab67b
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 615c0856efd26f42579bf7ff27297c05bdfd11fb 3e8b3c3a22a6a0b67e77668d9220d6cf7cce0c31 && git checkout -B drift-repro 615c0856efd26f42579bf7ff27297c05bdfd11fb && git merge --no-ff 3e8b3c3a22a6a0b67e77668d9220d6cf7cce0c31

node scripts/docs-audit/affected-docs.mjs --json 615c0856efd26f42579bf7ff27297c05bdfd11fb

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 615c0856efd26f42579bf7ff27297c05bdfd11fb → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[os-justin]

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 0065a406b822361bc81bc0c49a7fc5a6d9436f85

Read at 2026-09-22T13:48Z. Every reading below was re-derived from the diff fb7b74691f7d192430f6b3b457a858dc442ad0e0..0065a406b822361bc81bc0c49a7fc5a6d9436f85 (merge-base of the head and origin/main, 13 files, +1198/-10) and from origin/main, in a detached worktree at the head with a fresh install and build. The dev report, the PR body and the ruling 5776007340 were used only as the list of things to check. Where I could run code I ran it (the PR's own 23 + 15 tests pass; my own 8 engine-seam measurements and 7 cel-js probes are quoted by label below); where I could not, it says NOT MEASURED.

① Derived judgments

Q1-A (hydrate in place + refuse the mixed shape at authoring, prescription record.LOOKUP.id) — implemented at the two ruled points, but the refusal arm is on the wrong surface.

• Hydration: hydrateRelated (rule-validator.ts) overlays the related row onto a shallow COPY, per RULE, only for the reference fields that rule's own source traverses; checkPredicate evaluates the copy. A rule that does not traverse is handed the record byte-identical to before. Verified by reading and by the PR's sibling-rule test.
• Refusal: validateExpression (formula/validate.ts) now emits an error for bare-and-traversed and multi-hop on a REFERENCE-typed field, gated on fieldTypes; the message names record.FIELD.id. Verified: probe P10 shows that error is the ONLY error lint raises on the mixed shape, so lint accepted it before this diff and refuses it after.
• ⛔ The refusal exists ONLY in validateExpression. findTraversalConflicts has exactly one caller on the head (validate.ts); no runtime package imports @objectstack/lint, and nothing under packages/objectql, packages/metadata*, packages/rest or packages/runtime calls validateExpression. The comment the diff adds to formula/src/index.ts says "@objectstack/lint (and the engine's publish path) refuse the conflicting shapes" — there is no engine publish path that does. Measured consequence (M7, engine + hand driver, rule record.account.status == 'churned' && record.account == 'acc_churned', a row pointing at the churned account): BEFORE this diff the write is REJECTED as unevaluable; AFTER it the write is ACCEPTED — the bare compare is a map-vs-string false (probe P3 confirms cel-js answers false without faulting), so the rule silently stops firing. That is option B's harm, the one the ruling rejected on measurement, delivered on every path that authors a rule without running lint (Studio / sys_metadata, MCP-authored metadata, a stack built without lint).
• ⛔ The refusal arm also reaches seams the ruling carved OUT. Lint calls check(…, objectName, 'record') with fieldTypes for: field-level requiredWhen / readonlyWhen / conditionalRequired / visibleWhen (validate-expressions.ts:1570), per-option visibleWhen (:1595), action visible / disabled (:1743, :1745), sharing-rule conditions (:1795 — RLS, which the card marks ⛔ out of v1), hook conditions (:1805, :1829, :1838), flow node and edge conditions (:1355, :1480, and service-automation/engine.ts:9329 with fieldTypes), and formula-field values (:1710, role value; probe P11d shows the multi-hop refusal firing there with text about "reject the write"). On none of those seams does anything hydrate, so the prescription "write record.FIELD.id" is false where it is shown: it produces an expression that faults at evaluation, and on a fail-open seam that means the rule stops enforcing altogether. Q2-A said v1 is checkPredicate only; this diff moves the accepted set of nine other seams and hands their authors a repair that does not work there.

Q2-A (checkPredicate only; visibleWhen / readonlyWhen / requiredWhen OUT, carved to #19727) — hydration honours it; the refusal does not (above). The diff touches RuleContext, EvaluateRulesOptions, evaluateRule's script / cross_field arm, needsPriorRecord, and adds collectPredicateRelationships / hydrateRelated; evaluateOptionVisibility, the requiredWhen block and the readonlyWhen strip are untouched, and collectPredicateRelationships collects script / cross_field (including inside conditional) and nothing else. No UI seam is quietly covered.

The ruling's ground ("a mixed expression already throws today, so refusing it removes nothing that works") — verified with one nuance, and one consequence the ruling did not foresee. Probe P2: record.account == 'acc_1' && record.account.type == 'partner' with account = 'acc_1' faults (No such key: type). Probe P1: the same expression with account = 'acc_2' evaluates to false without faulting — CEL short-circuits, so a mixed expression DOES evaluate today on every row where the bare arm decides, and faults only on rows that reach the traversal. No mixed expression can therefore evaluate correctly across all rows, and the dev's corpus scan (1041 sources, positive controls) found none authored — so the lint refusal removes nothing that works CORRECTLY, and the ground holds for the lint layer. It does not describe the runtime after this diff: there the throw becomes a silent accept (M7 above).

Accept/reject delta, enumerated.

Accepted before, refused after:

• lint, any fieldTypes-bearing site, reference-typed field: record.FK.FIELD together with a bare record.FK (compare, != null, has(record.FK), ternary test, method receiver such as record.FK.startsWith(…) — probes P9, P13, P13b, P14). ⚠️ Every plain null-guard spelling is in this set; the only null-safe spelling lint still accepts is has(record.FK.FIELD) (see ④ for what that costs).
• lint, same sites: record.FK.FIELD.FIELD2 (multi-hop) on a reference-typed field.
• runtime checkPredicate: nothing newly refused.
• engine validate() dry-run (engine.ts:10692): a traversing rule is now REJECTED in preview where the real write is ACCEPTED — see ③.

Refused before, accepted after:

• runtime checkPredicate: record.FK.FIELD on a reference-typed field, when the acting user can read the related row and the row carries the key (M1, M2, M5 measured: accept when the parent does not trip the rule, refuse with the AUTHORED message when it does, on insert, on a repoint, and on a patch that does not carry the FK — the FK is read off the prior row).
• runtime checkPredicate: a MIXED expression that bypassed lint is now accepted with its bare arm silently false (M7) — the defect above, not a widening.

Unchanged: non-reference object-valued fields (record.address.city), previous.FK.FIELD (not analysed, faults as before), multi-value reference macros (record.accounts.exists(…), size(record.accounts), in — probes P7, P8, P8b: bare only, no traversal, no conflict), conditional.when (evaluated unhydrated by checkConditional, faults as before — note the changeset's headline "a validation rule can read one hop" is wider than what when gets).

Hard constraint (per-evaluation copy) — holds, at two layers, and the ruling's premise is inexact. evaluateValidationRules builds merged as { ...previous, ...data } (rule-validator.ts:2453) — a spread copy — so the object checkPredicate receives was never the write payload itself; hydrateRelated copies again per rule. Measured at the driver boundary (M1: create receives account: 'acc_ok', a string; M5: update receives { id, amount }, no expanded object). The PR's test "does NOT mutate the record it was handed" pins data only and would pass even under in-place hydration of merged; the test "leaves a sibling rule that compares the BARE foreign key untouched" is the pin that actually proves per-rule isolation. Adequate.

Permission semantics — read under the acting user: holds. Unreadable → loud: holds for a plain member access, with three real holes.

• Measured (M1): the related read is find('account', { where: { id: { $in: ['acc_ok'] } }, fields: ['id', 'status'], context }) with context = { userId: 'u1', positions: ['rep'] } and no isSystem — unlike resolveMasterDetailParent, which reads { isSystem: true }. The step-4 FLS mask in security-plugin.ts DELETES a non-readable key from a find result, so the hydrated map lacks it and record.FK.FIELD faults. Measured (M6, middleware deleting status after the read): the write is REJECTED as unevaluable, never accepted.
• Hole 1 — the loud fault carries the wrong prescription. M3/M4/M6 all return: "The predicate reads 'status', which this object does not declare — fix the rule's condition, or declare the field." The field is declared — on the RELATED object; an author following this declares a bogus status on the referencing object. The card's ruled outcome 3 is "faults loudly"; a fault whose prescription points at the wrong object is not the prescription discipline this repo holds refusals to.
• Hole 2 — absence is overloaded. resolvePredicateRelated's docblock: "No id, row gone, refused by the security layer, read threw: all four leave the field unbound." Add a fifth the docblock does not name: a readable column the driver did not echo. driver-memory's projectFields skips undefined values (its own docblock: "a value of undefined means the key is not emitted"), so under the projection ['id','status'] a stored row without status comes back without the key. Measured (M4, a related row lacking status): the write is REJECTED as unevaluable. This is the parent 表头绑定也是稀疏的 —— #4953 修完 record 之后,同一个作者陷阱在 parent 根上原样留着 #6457 trap ("whether a declared lock enforced depended on which columns a driver happened to return") re-opened one root over, on a fail-CLOSED seam — a valid write refused for a readable, legitimately-empty parent field. The engine already has the TOTAL-ising helper for parent and did not apply it here; applying it naively would turn an FLS-deleted key into null and defeat the permission rule, so the fix has to let the ENGINE decide readability (catch the security refusal; security.getReadableFields(target, context) exists) rather than delegate it to CEL's key-absence.
• Hole 3 — has() and optional selection defeat "never silently true". Probe P4: has(record.account.status) returns false on a null FK, on a bare id string AND on a hydrated map that lacks the key; probe P12: record.account.?status.orValue('') evaluates on all three. Since every plain null-guard is refused by the new lint arm (P13/P13b/P14), has(record.FK.FIELD) && record.FK.FIELD == … is the spelling an author of an optional lookup will reach for — and with it an FLS-stripped field makes the rule silently not fire. The guarantee holds only for expressions that touch the field with a plain member access.
• Collateral, measured by the PR's own CI: required context Dogfood Regression Gate is RED on this head. packages/qa/dogfood/test/showcase-d3-d4-capabilities.dogfood.test.ts:138 — a member whose permission set grants showcase_invoice CRUD and showcase_contact read and NOTHING on showcase_account — owns an invoice (account status prospect) and PATCHes { name }; expected below 300, got 400. That is the diff's no_invoice_for_churned_account rule: it runs on every invoice write, its related read is refused for this persona, the rule faults, and an owner's rename is rejected. The checklist item's knownGaps asserts "no seeded persona fails to read" showcase_account; CI measured one. The PR body's dogfood claim was authored (checklist item), not run — no run record exists and no showcase test names the rule. Reproduced locally at this head over HTTP with the same permission set: the engine logs predicate relationship lookup failed with PERMISSION_DENIED — "operation 'find' on object 'showcase_account' is not permitted for positions [everyone]", permission sets member_default + showcase_d34_member — then Validation rule 'no_invoice_for_churned_account' predicate failed to evaluate (runtime: No such key: status), and the PATCH answers 400 VALIDATION_FAILED with constraint.reason: 'unevaluable', missingKey: 'status' and the prescription "The predicate reads 'status', which this object does not declare — fix the rule's condition, or declare the field." So member_default does not grant showcase_account read either; the checklist's "public_read_write, no persona fails to read it" is false under the security plugin's CRUD gate for this composition.

Changeset honesty. .changeset/18682-predicate-relationship-traversal.md: @objectstack/formula: minor, @objectstack/objectql: minor, Clause-②: yes (widening), no ADR-0087 marker. Packages named are exactly the two whose source changes and publishes; @objectstack/spec is imported (REFERENCE_VALUE_TYPES, referenceTargetOf) and untouched, correctly omitted; examples/app-showcase is private. @objectstack/lint's published behaviour changes through its formula dependency (the new refusal at ten sites) without a line of lint changing — no changeset is owed under the convention, but the refusal's reach (①) is what makes the (widening)-only arm inexact today.

Model identifier (AGENTS.md:446). PR title, PR body, all 6 commit messages (trailer pair Claude-Session: + Co-authored-by: Claude), the changeset, the checklist JSON, both locales, every code comment in the diff: grep for model names and ids returns no match. Clean.

Also red, and caused by the diff: required context Lint & Repo Gates fails at check-adr-anchors --self-test: ADR-0136 is cited by docs/qa/platform-checklist/areas/records-forms.json and packages/objectql/src/validation/rule-relationship-traversal.test.ts and names no record under docs/adr/ (origin/main has 0135 and 0137; nothing else on origin/main cites 0136). The number was copied from the card body ("Acceptance (ADR-0136 D2.4)"), which is dangling there too — the card needs the same correction. ADR-0137 (predicate fault semantics are contract, D2: a faulting field-rule predicate refuses the submit and names the field and the rule) is the record that actually governs the fault this diff adds a new cause to, and the diff does not cite it.

② Semver level

minor on @objectstack/formula and @objectstack/objectql is the right level for the ruled scope (Clause-② yes takes at least minor), and the ruling's basis for (widening) alone holds at the lint layer for checkPredicate conditions (no correctly-working expression is refused). It becomes exactly true only once the refusal is scoped to the validation-rule sites (① F-scope) — until then the same diff narrows nine seams the ruling did not put in scope. Not BREAKING as ruled; no ADR-0087 disposition owed.

③ Boundary flags

Blocking (the FAIL rests on these; each names its fix):

1. Dogfood Regression Gate red at this head, caused by the showcase rule's collateral on a persona that cannot read showcase_account (④). Needs a ruling: either the showcase's own permission model must guarantee account read to every invoice writer (and the test's local set is not the showcase's), or the semantics "unreadable parent rejects every write on the child, FK touched or not" is what the maintainer wants and the test moves — the PM decides; the reviewer only records that the required context is red on the diff's own change and the PR body's dogfood claim was not run.
2. Lint & Repo Gates red at this head: dangling ADR-0136 citation in two diff files. Cite the record that exists or drop the number; correct the card body in the same stroke.
3. The engine validate() seam (engine.ts:10692) is not wired: M3 measured preview valid: false (unevaluable) against an ACCEPTED write on the same row. The seam's own contract is "the same posture as the real write" and validate-only.test.ts pins that a dry run ASKS the write's verdict; the import dry run rides it. Resolve related there (insert mode at minimum; update-mode preview without a prior is a pre-existing limit to name, not widen).
4. No runtime refusal of the mixed shape (M7), and a code comment that claims one exists. Refuse in the engine too: in hydrateRelated / checkPredicate, a bare-and-traversed conflict on a reference field returns unevaluableRuleError with the same prescription instead of hydrating — that keeps today's fail-closed verdict for the shape, removes nothing that works, and closes the silent flip on every lint-bypassing path. Correct the formula/src/index.ts comment to name lint alone until then.
5. The refusal arm reaches ten lint sites outside Q2-A's seam with a prescription that is false there. Gate the traversal-conflict pass on an explicit caller opt-in in the schema hint (set by lint at validate-expressions.ts:1521 / :1523 only) rather than on the mere presence of fieldTypes, and keep value-role sources out of it entirely.
6. The unevaluable fault's prescription names the wrong object (④ hole 1). A traversal fault must say which RELATED object and field could not be read under the acting user.
7. Absence collapses "cannot read", "row gone", "no id" and "column not echoed" (④ hole 2, M4), and has() / .? tolerate absence (④ hole 3, P4 / P12). Make the readability decision in the engine before evaluation — a refused or FLS-stripped traversed field yields the unevaluable refusal directly, a readable-but-empty field is materialised to null over the target's declared fields (parent 表头绑定也是稀疏的 —— #4953 修完 record 之后,同一个作者陷阱在 parent 根上原样留着 #6457's helper generalised) — so the permission verdict never depends on which CEL operator the author picked.
8. No engine-level pin: acting-user context, projection, update-seam prior-FK read and driver-boundary payload are asserted only by this review's scratch measurements; the PR's tests hand related in by hand. Add one engine test in the shape of engine-required-when-parent.test.ts (capture the find context with registerMiddleware, assert no isSystem, assert the driver's create payload carries the id).

Non-blocking:

• collectPredicateRelationships reads condition.source without checking dialect; a non-CEL source that happens to parse as CEL is analysed and hydrated. Check the dialect.
• conditional.when is not hydrated and still faults; the changeset headline says "a validation rule". Say script / cross_field conditions, or hydrate when too.
• Partial field masking (spec/security: field masking is all-or-nothing — no partial masking (phone last-4, ID middle-8), and maskingRule was pruned as dead in 2026-06 #8993) hands a masked VALUE to the predicate, which then evaluates silently against the mask. Name it in the docblock or treat masked-for-caller fields as unreadable here.
• The diff adds a new fault cause under ADR-0137 D2 without citing the record (PD [WIP] Add Chinese version of the documentation #13 corollary).
• The unevaluableRuleError text is reached with missingKey: 'status' on a traversal; the records-forms.json acceptance clause "rejected with the unevaluable-rule envelope" is satisfied literally by a misleading envelope — tighten the clause once 6 lands.

Implemented-by: claude/issue-18682-predicate-relationship-traversal
Reviewed-by: session_01Sfe5YjBLwB9J3y8fvm2xq1 (at-tier contract-review subagent of the dispatching seat)

VERDICT: FAIL

---

Generated by Claude Code

[os-justin]

席位改写了本 PR 正文的三处 —— 谁改的、改了什么、为什么,写在这里

domain:spec seat 5(session_01Sfe5YjBLwB9J3y8fvm2xq1,座位贴 #19357),2026-09-22T15:26Z。施工轮按契约只在开 PR 时写一次正文,之后的更正点名交席位办;它点了三处,本席核过后照办。

为什么必须改,而不是留一条评论了事

本 PR 是契约面 PR。正文里那三处在返工后已经为假,而正文是复核者、队列记录与将来读 CHANGELOG 的人都会读的东西。⇒ 留着假陈述、另发一条更正,等于让最权威的那份文本继续说错话。

#	原文说的	现在的事实
1	关联行「read under the acting user」,被引对象的 CRUD / RLS / FLS 全部生效	系统权限读,范围受投影约束(表达式点名字段 ∩ 被引对象已声明字段 + id)。维护者裁决,全文在卡 #18682 的 5778121976
2	## Scope 里「the seam that is fail-closed, and therefore the only one where an unreadable related field can produce the loud refusal」	改为「系统权限读被限制在这一条缝」—— 原措辞的因果在裁决之后不再成立
3	## Verification 整张表与两条 NOT MEASURED	整节重写

⭐ 第 3 处为什么单独说:它曾经断言了一件没有发生过的事

上一轮的正文把 dogfood 用例写成已验证,而那个门根本没跑;同一时刻该 head 上有三条必需检查是红的。施工轮这一轮主动认了这件事,⛔ 没有辩解。

⇒ 新的 ## Verification 做了两件旧版没做的:① 区分谁测的 —— 本席对 GitHub 亲自核到的(Dogfood Regression Gate 及其三个分片 completed / success、该 head 0 红)与施工轮本地跑的,分开列;② 保留「NOT MEASURED 与 pass / fail 分开报」这条规矩,并写明本轮该列为空、以及此前在该列的两项各自是怎么变成真读数的。

⛔ 本席没有动正文的任何其它部分:技术方案叙述、两种被拒形状、Acceptance、Acceptance notes、以及施工轮自己的署名页脚,一字未改。

状态

needs:contract-review 挂在卡 #18682 与本 PR 两边。新一轮在档复核已派(head 995266cea04facfc44da01bab85140fbb1632a40)—— 上一份 FAIL 记录 5777701356 只管 0065a406b,已随 head 前移作废,⛔ 不沿用。PASS 后本席先从两边摘标、引记录,然后才 ready + 入队。

---

Generated by Claude Code

[os-justin]

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 995266cea04facfc44da01bab85140fbb1632a40

Read at 2026-09-22T15:41Z. This record replaces 5777701356, which governed 0065a406b and is void with that head. Nothing below inherits a verdict from it: every reading was re-derived from the diff fb7b74691f7d192430f6b3b457a858dc442ad0e0..995266cea04facfc44da01bab85140fbb1632a40 (the merge-base of the head and origin/main; 12 commits, 16 files, +2020/-14) and from origin/main, in two detached worktrees with a fresh install and build — one at the head, one at the merge-base for the before/after transition. The PR body, the implementing round's report 5779163549 and the ruling 5778121976 were used only as the list of things to check. Probe labels (A-series: analyser, 48 spellings; E-series: engine, real driver double, 12 cases) are quoted where a reading came from code I ran. ADR-0137 (D1/D2/D3), ADR-0124 and ADR-0078 were read before judging.

① Derived judgments

The maintainer's ruling — 「校验规则在读关联记录时改用系统权限,但只读规则表达式自己点名的字段」 — bound by bound, from the code.

1. Validation rules only — HOLDS. resolvePredicateRelated (engine.ts:6924) is private and has exactly four callers, all validation seams: the dry run (:10741), insert (:11473), single update (:12805), bulk update (:13091). Its result flows only into EvaluateRulesOptions.related, which evaluateValidationRules hands to evaluateRule, whose script / cross_field arm alone calls checkPredicate. conditional.when (checkConditional), field requiredWhen / readonlyWhen, option visibleWhen, the sharing plugin's evaluateRule and every RLS path are untouched; plugin-security is byte-identical to origin/main. collectPredicateRelationships reads objectSchema.validations and nothing else. The elevation is unreachable from an RLS or UI predicate.

2. Only the named fields — HOLDS. The read set is computed in the engine before the query is built: named from the static analysis, checked against the related object's registry field map, and any undeclared name aborts the read entirely — no query is issued (E4c: rule naming nope, zero reads of crm_account). The projection actually issued is id plus the union of what every traversing rule on the object names (E5: two rules naming status and name+status produced ONE read, fields: ['id','status','name'], where: {id: {$in: [...]}}, context {userId:'u1', positions:['rep'], isSystem:true}). The elevated read stays tenant-scoped: buildDriverOptions threads tenantId independently of isSystem, so isSystem adds only the audit-warn mute.

3. The refusal does not echo the related value — HOLDS, including logs. The authored refusal carries the rule's own message; the four traversal refusals name the reference field, the related object, the named column(s) and the rule. Ten CEL fault shapes over a related row holding churned / TOPSECRET (E3: int(), double(), timestamp(), +, string index, matches with a bad pattern, startsWith(1), comparison overloads) produced fault text naming types, keys or the author's own pattern — never an operand value. The engine's warn lines on the fault path carry the message and stack, no value (E10). The 'unresolved' vs 'no-reference' pair lets a caller distinguish an id that exists from one that does not, but assertReferencesResolve already answers existence unscoped by design, so that is not new width.

4. Negative pin — EXISTS and re-measured. never smuggles an UNDECLARED field into the system read set in engine-predicate-relationship.test.ts; E4c confirms the refusal 'crm_account' declares no 'nope' with no related read issued.

5. The accepted channel is not reported as a finding. ⚠️ Something that makes it WIDER is — flag 2 below.

Engine-side fail-closed for the mixed shape (prior finding 4) — CLOSED, transition re-measured on both sides. Rule record.account.status == 'churned' && record.account == 'acc_churned', row pointing at the churned account, through the real engine and a driver double:

• merge-base fb7b74691: REJECTED — runtime: No such key: status, with the wrong-object prescription (E1-base);
• head 995266cea: REJECTED — reads a reference field both through the relationship and as a value, with the record.account.id prescription; the rule's own message is never reached (E1).
  REJECTED → REJECTED. The refusal lives in resolveTraversalScope (rule-validator.ts), reached from checkPredicate before evaluation, judged with referenceTargetOf — the same arbiter the engine's $expand gate asks. Lint is not on the path: no runtime package imports it (grep for findTraversalConflicts / traversalHydration outside formula and lint: zero hits). The false formula/src/index.ts claim is gone; the replacement text names lint and the engine separately and cites ADR-0124.

The refusal arm does not leak past the validation seam (prior finding 5) — HOLDS, both directions. traversalHydration is set at exactly one site, validate-expressions.ts:1533 (rule condition); the sibling when check at :1540 does not set it, nor does any field / option / action / sharing / hook / flow / formula site, nor service-automation's schemaHint, nor mcp's hint. validateExpression additionally requires role === 'predicate' and fieldTypes (validate.ts:891). The PR pins both directions (checks NOTHING when the caller has not opted in, checks nothing in the value role).

Fault prescription (prior finding 6) — HOLDS. Four reasons, each naming the related object: 'crm_account' declares no 'nope' ... declare 'nope' on 'crm_account' — ⛔ not on the object carrying this rule (E4c), no related record (E6, E11), the related record was not found (E11), could not read 'crm_account'. The wrong-object text is off the traversal path. Under ADR-0137 D2 the refusal names the rule; the envelope's field is _record for every authored rule, which the PR's acceptance note correctly records as a pre-existing spec gap.

Absence vs null (prior finding 7) — genuinely distinguishable. A declared column the driver did not echo is materialised to null and evaluates: rule record.account.status == null FIRES with the authored message on that row (E4a) and is ACCEPTED on a row carrying status (E4b). An undeclared column refuses with declares no and no read (E4c). The verdict is decided in the engine before CEL sees the row, so has() and .? cannot turn a fault into false — the PR's three-spelling pin passes and the analyser sees every spelling (next).

⭐ Optional-access re-measurement — VERIFIED, no hole found. The raw AST was inspected: ., .?, [] (key {op:'value'}), [?], rcall for method calls, call for has(). 48 adversarial spellings (A-series), each classified as traversal / bare / multi-hop / conflict:

• traversal detected for ., .?, ['x'], [?'x'] on the SECOND hop and on the FIRST (record['account'].type, record.?account.?type, record[?'account'].type), for escaped and raw string keys ('type', r'type'), inside has(), size(), in, a list literal, a macro body ([1].exists(x, record.account.type == 'p')), a comprehension variable that shadows the root, after a method (record.account.type.startsWith('p'), .lowerAscii().size()), and through parentheses;
• a non-literal key ([record.k], [dyn('type')], ['ty' + 'pe'], [b'type']) is BARE, so the field is not hydrated, the id string cannot be indexed, the predicate faults and the write is refused — fail-closed;
• multi-hop is refused in every spelling (.?owner.?email, ['owner']['email'], [?'owner'].email, three hops);
• mixed shapes are caught whichever way the bare use is spelled (.?type + bare, index + has(record.account), bare via method receiver, via in, via a ternary arm, via dyn(), via a dynamic index);
• a ternary RECEIVER (c ? record.account : record.account).type is not a traversal and is bare — unhydrated, faults, refused. Fail-closed, and an author is told nothing useful; noted, not a hole.
  The implementing round's own account of the hole it found is accurate, and the fix is complete for the surface cel-js exposes.

engine.validate() dry run (prior finding 3) — insert-mode agreement holds (PR pin + E9); the stated update-mode limit is accurate, not convenient: validate() passes no previous in update mode for ANY rule, so a traversing rule refusing on a patch that omits the FK behaves exactly as a previous-reading rule already does there, and a patch that carries the FK resolves (E9b). What wiring it did to the channel is flag 2.

Body vs code. The rewritten body's claims about the seam, the read authority, the projection, the accepted cost and Verification hold. Three passages contradict the code: the repair column of the "Two shapes refused" table (record.account.id — flag 1); "the read set is ... plus id" (the projection carries id, the accept-set refuses a NAMED id — flag 1); and "an unresolved row is left absent ... refused by the security layer" (the mechanism is now a discriminated binding decided before evaluation, and a security-layer refusal cannot occur under isSystem). The header "Two deliberate differences from the parent precedent" is stale for its first bullet, which is now the SAME as parent.

CI, read at the head against GitHub, not from the report: 42 check runs, every one of the seven required contexts completed / success, 0 failures; Dogfood Regression Gate and shards 1/3, 2/3, 3/3 green. Locally at the head: the PR's three test files pass (29 + 36), and the two dogfood files this diff touches pass 51/51 — the persona the previous head faulted now writes and the churned-account rule still refuses.

Model identifier (AGENTS.md:446): title, body, 12 commit messages (trailer pair Claude-Session: + Co-authored-by: Claude), changeset, checklist, both locale entries and every code comment in the diff — no match.

② Semver level

minor on @objectstack/formula and @objectstack/objectql, Clause-②: yes (widening), no ADR-0087 disposition — correct for those two: at the engine the accept-set moves only from refused (fault) to accepted (plain one-hop traversal), and the mixed shape stays refused with a better message; at lint the ruled ground (a mixed expression cannot evaluate correctly on any row today) holds and the arm is now confined to the one seam that hydrates. One omission, non-blocking: @objectstack/lint's source changes (validate-expressions.ts, +19/-1) and its published behaviour at validation-rule condition sites narrows by two shapes, yet the changeset names it nowhere. It versions anyway through the fixed group, but its CHANGELOG will carry no sentence for the new refusal an upgrading author greps for. Add '@objectstack/lint': minor to the same changeset; the Clause-② arm is unchanged.

③ Boundary flags

Blocking — the FAIL rests on these; each names its fix:

1. The engine's own prescription is a dead end. The ruled repair for the mixed shape (Q1-A: point the author at record.LOOKUP.id) is emitted by findTraversalConflicts, repeated in the changeset table and the PR body — and the engine refuses it. Measured on both registration paths (E2 raw registerObject, E12 ObjectSchema.create): record.account.status == 'churned' && record.account.id == 'acc_churned' is REJECTED with 'crm_account' declares no 'id', followed by a second false prescription, declare 'id' on 'crm_account'. The registry's field map carries the injected organization_id / audit / owner_id / owning_business_unit_id columns and never id, and resolvePredicateRelated judges declaredness against that map. ADR-0078 §6: a false prescription is worse than a missing rule; here two are chained, and the first is the one the ruling specified. Fix: admit the primary-key spelling to the declared set (it is already unconditionally in the projection, so the read set widens by nothing), and pin the ruled repair end to end through the engine.

2. The dry-run seam widens the accepted channel beyond writers. engine.validate() runs no middleware for the target object (E9c: a principal with no positions receives the rule's verdict; the only middleware operation observed is the isSystem find on crm_account), and its one network ingress — POST .../data/:object/import with dryRun: true — is gated by enforceAuth (authentication) and enforceApiAccess (the object's enable exposure flags), never by the caller's CRUD on the object. On the real write path the security plugin's CRUD gate refuses before any rule runs, so the channel the ruling accepted — a caller inferring a value from which WRITES are refused — reaches only principals permitted to attempt the write. Wiring the elevated read into validate() (the previous round's finding 3) hands the same verdict, computed from a system-authority read, to any authenticated caller with no permission on the child object and no write attempted. That is wider than accepted, and it is new on this head: before it the preview evaluated only the caller's own payload. The validate() docblock's "no driver is touched" (engine.ts:10683) is also false now. Fix: resolve related in validate() only for a caller who passes the object's create / update gate (or leave the traversal unresolved there for a non-system caller, which refuses as the prior head did), correct the docblock, and pin that a caller without write permission gets no verdict from a traversing rule.

3. The superseded acting-user semantics survive in the diff's own prose — in a published contract docblock and in the example app. EvaluateRulesOptions.related (rule-validator.ts:396, an exported interface that ships in the .d.ts) says the rows are "read under the ACTING USER so the referenced object's RLS and FLS apply. A field the user may not read therefore arrives ABSENT"; resolvePredicateRelated's header (engine.ts:6901, "Read as the ACTING USER, deliberately unlike parent") contradicts its own body ninety lines down; the insert site says "Read under the CALLER's context, not system" (:11472); the preview site says the "permission answer is the caller's own" (:10734); RelatedUnavailableReason (rule-validator.ts:537) lists "the acting user may not read it"; the unresolved refusal text offers "outside this caller's visibility" as a cause that cannot occur under isSystem; a detached docblock for hydrateRelated (a function that no longer exists) sits above TraversalScope (rule-validator.ts:2907) and is {@link}ed twice (:295, :404); both test headers state acting-user while the tests assert isSystem (engine-predicate-relationship.test.ts:12, rule-relationship-traversal.test.ts:133); the checklist item's source cites hydrateRelated and its history records "faults loudly on an unreadable parent" as a ruled outcome the same item now inverts; and the showcase rule (invoice.object.ts:176) tells every reader of the reference app that "a rep who cannot read the account ... the rule faults and the write is rejected" — the dogfood on this very head measures the opposite. The PM rewrote the PR body because three passages had become false; the same three falsehoods stand in the code. On a security-relevant elevation, in-code authority that states the reversal beside the decision is the trap PD [WIP] Add Chinese version of the documentation #13 names, and a published docblock that overstates enforcement is what ADR-0124 D4 calls a defect. Fix: bring every location above to the ruling's wording (the ⭐ SYSTEM authority block at engine.ts:6968 and the RelatedFieldBinding docblock already have it), delete the orphaned docblock and its links, and correct the checklist source / history.

Non-blocking:

• The no-reference sentence ("this record stores no reference there") is also reached by a multi-valued reference (E7) and by an expanded object supplied in the FK slot (E6); both refuse — correctly fail-closed — but the sentence does not describe what happened. Reword per cause.
• Add @objectstack/lint to the changeset (see ②).
• Body: correct the three passages named under "Body vs code".
• The (c ? record.a : record.a).type receiver shape is refused with a bare No such key and no prescription; acceptable, but the analyser could name it as a shape it will not serve.

Implemented-by: claude/issue-18682-predicate-relationship-traversal
Reviewed-by: session_01Sfe5YjBLwB9J3y8fvm2xq1 (at-tier contract-review subagent of the dispatching seat)

VERDICT: FAIL

---

Generated by Claude Code

[objectstack-fleet]

Contract review

Served-tier: 149/149 CONTRACT_REVIEW_TIER
Head-sha: 1e487ef1108a7eb6fd52cf173ddf80f364e307f7

Isolated at-tier reviewer subagent, run by the domain:spec seat-4 session; every one of its 149 transcript turns served at the tier the constant names. Round 16 (ruling A) at this head. The seat adopts the FAIL and orders round 17 on the blocking item ①(b); the Test Core (5/6) red is answered on the next head. Adopted by the seat 2026-09-24T16:20Z. The record below is the reviewer's, unedited except the two header lines.

Read: card #18682 body plus all 42 comments (rulings 5778121976, 5794029084, takeover 5814444837, letter A 5815452038; newest os-dev-report 5817378756, whose JSON equals scratchpad report.json exactly); PR body, 22 files, diff, 15 issue comments (review threads: none), previous PASS 5795813514; check-runs at the head, 53f960f7a, 1d6866b26, 2c1011b01; actions runs 36012376955 and 36009378803; AGENTS.md, scripts/check-adr-0087-registration.mjs, scripts/check-changeset-no-major.mjs at origin/main. Git reads on refs/review/pr-19728 (== head), 53f960f7a, 3b9c5f2fca, 2c1011b01 (merge-base with origin/main ccccdcc35e), 6eaa0f4a8. NOT RUN: any suite, gate family or ablation. Job log: actions/jobs/107676450261/logs answered CONNECT 403, NOT MEASURED.

① Derived judgments

Round shape. git diff --stat 53f960f7a refs/review/pr-19728: 4 files, +113/−13 (engine.ts +22/−6, rule-validator.ts +2/−2, predicate-related-read-tenant-scope.test.ts +83/−5, changeset +6). Merge 53f960f7a (parents 3b9c5f2fca, 2c1011b01): the diff-of-diffs of git diff 6eaa0f4a8 3b9c5f2fca against git diff 2c1011b01 53f960f7a (index and hunk headers stripped) differs in exactly one CONTEXT line main changed (resolveMasterDetailParents(…, opCtx.context)); both read 22 files +4663/−69. (f) Nothing from round 15 is undone by the merge; the existing pin ['could not read', "'crm_account'"] is untouched; the round diff adds no isSystem: true literal (engine.ts:7409 is pre-existing context); the six pre-existing pins (test file 218–299) keep every assertion, only helpers were generalised.

(a) Gate set — RIGHT. engine.ts:7399 at head: caller?.userId && (targetSchema?.external != null || resolveTenantFieldName(targetSchema) === null). resolveTenantFieldName (packages/objectql/src/tenancy/system-write-organization.ts:196–210) is null iff tenancy.enabled === false, no fields, or neither the declared tenantField nor organization_id is a field; it is documented as, and I verified it to be, the twin of SqlDriver.computeTenantField (packages/drivers/driver-sql/src/sql-driver.ts, same three arms). buildDriverOptions (engine.ts:4505–4508) withholds tenantId for isTenancyDisabled and federated objects, and the driver scopes only when computeTenantField is non-null — so the gate fires exactly for the objects the system read leaves unscoped by organization; nothing the ruling covers is left out on that axis. sys_user: managedBy: 'better-auth' (packages/platform-objects/src/identity/sys-user.object.ts:51), no injected organization_id (registry.ts:308–312), census reach: out, tenantField: null (scripts/platform-object-tenancy-census.json:634–640), so the gate fires. The ruling's parenthetical spelled sys_user as tenancy.enabled: false; the gate covers the real mechanism plus that spelling plus external. A tenant-scoped object whose RLS is narrower than the wall is NOT gated and evaluates on the org-scoped system read: RIGHT against the rulings as written — letter A's last sentence ("The organization-scope rule for tenant-scoped objects is unchanged (already pinned)") and the maintainer's 5778121976 (system read, named columns only, inference cost accepted) govern that class; only the platform-global class was put to the maintainer. Swept in beyond the named case: external objects (no wall by construction) — a harmless narrowing under the governing clause.

(b) Own read — RIGHT for a caller carrying userId, ⛔ WRONG for one reachable caller class.
Right: engine.ts:7400–7402 this.find(target, { where id $in ids, fields ['id'], context: caller }) with caller = context (7314); every call site hands the caller's raw options context (insert 11334–11339 and update 12340–12345 context: options?.context; validate 11235 options?.context; bulk update 13632). find() dispatches through executeWithMiddleware with mergeReadContext(query.context, options.context) (10717–10721); plugin-security's only total bypass is opCtx.context?.isSystem (security-plugin.ts:1880). No system flag reaches the own read. The system read of the named columns is limited to $in (ownRead ?? ids) (7407) and is skipped entirely when ownRead.size === 0 (7404).
Wrong: both the org-less gate (7315 readsNothing = !!caller?.userId && …) and the own-read gate (7399) key on caller?.userId. A non-system caller with no userId gets the bare system read: no row bound (gate off) and no organization bound (7409 spreads the caller context; 4505–4506 send no tenantId because it has none). Such a caller reaches the insert executor from the wire on main today: the public-form route builds { publicFormGrant: { object }, permissions: ['guest_portal'], anonymous: true } with no userId (packages/rest/src/rest-server.ts:10750–10752); the middleware's public-form arm admits insert on that object and ends in return next() past every downstream gate (security-plugin.ts:1890–1929); the form's allowedFields is whatever its sections declare, a lookup or user field included (rest-server.ts:10678). A principal-less context with no positions, no permission sets and no userId falls open outright (security-plugin.ts:2032–2038). Consequence at the head: a form target with a traversing rule — the PR's own showcase example record.account.status == 'churned' (examples/app-showcase/src/data/objects/invoice.object.ts:187) — lets an unauthenticated submitter choose the FK and read one bit of the related row per submission, 422-versus-201, across every organization for a tenant-scoped object and for any sys_user row. That caller's own read of the related object returns nothing (the grant arm allows find only on the form's own object, 1893–1896; guest_portal otherwise resolves closed), so letter A's "⛔ It never evaluates on a row the user could not read" is not met, and it is the round-14 leak class (org-less caller, cross-organization) with the userId spelling as the hole. Not introduced by this round — the userId gate dates from round 14 and round 15's PASS considered only "a system context that carries a userId" — but this record judges the whole PR against the ruling's words, and the maintainer rejected landing an unmeasured cross-organization inference. Source-read only; NOT MEASURED at runtime (⛔ no suites here); every link is a line above. The property owed: a caller that is not isSystem is bound by its own read (or reads nothing) whether or not it carries userId; system callers unchanged.

(c) Refusal identity — RIGHT for userId callers. On a gated object every id outside ownRead binds 'unreadable' (7452), stored or not; a thrown own read binds blocked then 'unreadable' (7426–7430, 7443); traversalRefusal (rule-validator.ts:3343–3348) emits one text — could not read 'OBJECT' … "and that row could not be read" — never the value. Rule evaluation precedes assertReferencesResolve on insert (11973 before 11974) and update (13415 before 13418), so the pre-existing existence probe (on main at 2c1011b01, 11 hits) cannot split "exists elsewhere" from "nowhere" ahead of the rule. validate() reuses the same resolver (11235), so insert, preview and update refuse alike.

(d) Pins — weight-bearing by reading. predicate-related-read-tenant-scope.test.ts:309–345: pin (a) asserts clear.seen equals banned.seen over refusal, committed, preview and update, with u_y.banned = (kind === 'secret') (164–168), NOT_READABLE on refusal, update and preview, committed 0, and userColumnsRead never carrying banned; CONTROL (b) has peer u_x2 hit RULE_MESSAGE on all three doors with banned projected, and self commit. Harness: real SysUser, shipped member_default sys_user grant and RLS read from defaultPermissionSets (89–101), real SecurityPlugin + SqlDriver, posture isolated; banned is a declared field (sys-user.object.ts:647). The ablation readings G/H/I/K/A/B are the report's claims; each is consistent with the code by reading (G/H drop the gate so u_y is read unscoped; I yields the "not found" text; K makes the peer unreadable). None covers the (b) class above.

(e) Prose. Changeset lines 61–65, RelatedUnavailableReason docblock (rule-validator.ts:546), engine docblock 7277–7278 ("also bounds the ROWS") and the runtime text are true for a userId caller. body-edits.md: bullet-2 replacement sentences 1–3 true; sentences 4–5 ("read only for the rows the user caller's own read … whatever that row holds, and its columns are never read") true for a caller carrying userId, false for the public-form caller in ①(b); "All three are pinned … the sys_user case against the shipped member_default wall" true (roster 218/246/277/309). Bullet-3 append and the 维护者速读 bullet: true with the same caveat.

② Semver level

.changeset/18682-predicate-relationship-traversal.md at head: minor on @objectstack/formula, @objectstack/lint, @objectstack/objectql, @objectstack/plugin-security; Clause-②: yes (widening); no major, no BREAKING banner, no ADR-0087 marker. Correct: against the merge-base the capability is new (a widening), and this round's narrowing lives inside the unreleased PR, so neither the launch-window BREAKING banner (check-changeset-no-major.mjs:47–74) nor the HTML-comment marker adr-0087: registered … / adr-0087: not-required (category) why (check-adr-0087-registration.mjs:60–63) is owed. Consistent with AGENTS.md §3 (yes takes at least minor).

③ Boundary flags

Blocking:

• ①(b): a non-system caller without userId (public-form context rest-server.ts:10750–10752; fall-open arm security-plugin.ts:2032–2038) bypasses both the org-less gate (engine.ts:7315) and the own-read gate (engine.ts:7399) and evaluates a traversing rule on rows it could not read, unbounded by organization or row.

CI, stated plainly: Test Core (5/6) FAILURE at the head; annotation "packages/client pnpm run test exited (1)"; failing test NOT MEASURED (log CONNECT 403). Green at the merge-only 53f960f7a (run 36009378803) and red at 1e487ef110 (run 36012376955), both with recorded base 2c1011b01, so the tree delta between green and red is exactly this round's four files. Can the diff reach packages/client? By source, no: client declares no validation rule (git grep over packages/client for validations or a traversing condition: 0), no platform-objects object carries a traversing rule (0 hits), and every changed runtime line sits behind collectPredicateRelationships(schema).size == 0 then unbound (7311–7312) and then caller?.userId && …; the rule-validator change is text inside the 'unreadable' arm only. Not ruled a flake; the red must be answered by a re-run or the log before landing. TypeScript Type Check failure at 1d6866b26 is the aggregator over cancelled sub-jobs of a superseded push; success at the head.

Non-blocking:

• Dev-declared deviations (5817378756): frozen-lockfile install skipped then redone on zod 4.6.1 with a forced rebuild; merge message amended before first push; deepen fetch advanced shared origin/*; no second merge of main (origin/main now ccccdcc35e, merge-base still 2c1011b01; PR diff 22 files +4763/−69 = 4832, at most 5000, headroom 168); dangling ids on gated objects now 'unreadable' not 'unresolved' (deliberate, one text). All within the claim's 22 files; governed surfaces: none.
• RelatedFieldBinding docblock (rule-validator.ts:561–567, shipped through the exported RelatedRecordBinding) still names only the projection as the bound, and row still says "readable declared fields" — omission, not false.
• Changeset "for a user caller … refuses the write as not readable": an org-less user under a walled posture is refused as "not found" (readsNothing precedes the gate); the body's bullet says so, the changeset stays silent (carried from round 15).
• Ablations not re-run here (⛔); readings are the report's.
• Out of scope, noted by the dev and not filed: sys_scim_user / sys_scim_group blanket read; referenceExists platform-global existence probe (pre-existing on main).
• The driver-sqlite-wasm half of "measured on driver-sql and driver-sqlite-wasm" remains a dev reading (carried from round 15).
• Model identifiers: the three round commits carry the model-free trailer pair; round diff 0.

Implemented-by: claude/issue-18682-predicate-relationship-traversal
Reviewed-by: session_019c3Hi6ZMU1p6m6aA6Bz45d

VERDICT: FAIL
Blocking item: ①(b) — a reachable non-system caller class (public-form and principal-less contexts, no userId) gets the bare system read for a traversing rule, unbounded by organization or row, so letter A's "never evaluates on a row the user could not read" is not met at 1e487ef1108a7eb6fd52cf173ddf80f364e307f7.

---

Generated by Claude Code

[objectstack-fleet]

Contract review

Served-tier: 76/76 CONTRACT_REVIEW_TIER
Head-sha: 3e8b3c3a22a6a0b67e77668d9220d6cf7cce0c31

Isolated at-tier reviewer subagent, run by the domain:spec seat-4 session; every one of its 76 transcript turns served at the tier the constant names. Round 17 at this head; it closes the round-16 FAIL 5817932927 ①(b). The seat wrote the PR body from the round-17 report with both non-blocking corrections under ③ applied (the system-caller sentence now states the one system-side move; the pin sentence is narrowed to what is pinned). Adopted by the seat 2026-09-24T17:16Z. The record below is the reviewer's, unedited except the two header lines.

Read: card #18682 body plus all 43 comments (maintainer ruling 5778121976, order 5792704279, seat ruling 5794029084, landing state 5795844077, takeover 5814444837, letter A 5815452038, round-16 report 5817378756, round-17 report 5818517157, whose JSON equals scratchpad/pr-19728/report-r17.json in substance); PR body, pulls/19728/files (22), the diff, all 16 issue comments (review threads: 0, reviews: 0), the round-15 PASS 5795813514 and the round-16 FAIL 5817932927; check-runs at the head, 5b11234f94, 11ddc2dc0a; body-edits-r17.md; AGENTS.md, scripts/check-adr-0087-registration.mjs, scripts/check-changeset-no-major.mjs, .github/workflows/lint.yml at origin/main (now e8f163fc3a). Git reads on refs/review/pr-19728 (== head), 1e487ef110, 5b11234f94, 11ddc2dc0a, 3b9c5f2fca, 2c1011b01 (merge-base with origin/main, unchanged). NOT RUN: any suite, gate family or ablation. Branch-protection endpoint answered 403 to this token, so "required" below is by the earlier records' naming.

① Derived judgments

Round shape. git diff --numstat 1e487ef110 refs/review/pr-19728: 5 files, +71/−21 (engine.ts +9/−6, predicate-related-read-tenant-scope.test.ts +43/−2, changeset +6/−3, rule-validator.ts +5/−3, system-context.mdx +8/−7). Per commit: 11ddc2dc0a engine.ts + test file only; 5b11234f94 changeset + rule-validator docblock only; 3e8b3c3a22 the mdx only. All five inside the PR's 22; no new file.

(a) Round-16 ①(b) — CLOSED. engine.ts:7317 at head const bound = !caller?.isSystem; feeds 7318–7319 (readsNothing = bound && !carriesOrganization(caller?.tenantId) && postureEnforcesWall(...)) and 7402 (if (bound && (targetSchema?.external != null || resolveTenantFieldName(targetSchema) === null))). At 1e487ef110 both keyed on caller?.userId (7315, 7399). Caller classes, each traced:

• Public-form submitter: rest-server.ts:10750–10753 at origin/main builds { publicFormGrant, permissions: ['guest_portal'], anonymous: true }, no isSystem, no tenantId. Walled posture: readsNothing, byId empty with no ownRead (7375), binding 'unresolved' (7455), text "the related record was not found" (rule-validator.ts:3340). No wall: own read at 7403–7405 under the caller's context; the grant arm admits find only when opCtx.object === grantObject (security-plugin.ts:1892–1897 at the PR ref) and otherwise throws PermissionDeniedError (1931–1932); the catch at 7429–7433 sets blocked, 7446 binds 'unreadable', one text "could not read 'OBJECT'" (3346–3348). Update/bulk: the grant arm refuses before the engine — identical for both values.
• Principal-less context (no userId, positions, permissions, isSystem): the middleware's fall-open (security-plugin.ts:2031–2038, !opCtx.context?.userId) makes its own read return whatever the driver holds; under a walled posture readsNothing precedes it. Consistent with letter A by the letter ("answered by what the acting user could read themselves").
• Author code with no context: caller undefined, bound true — same two arms.
• Spurious or non-boolean isSystem: every wire context is assembled with isSystem: false (core assemble-execution-context.ts:316; 'isSystem' at 121 is a server-decided entry field, never copied from a request); the schema is z.boolean().default(false) (spec execution-context.zod.ts:318); git grep over packages/examples/apps non-test sources finds no producer other than the literals true/false, pass-throughs and === true normalisations. runAs: 'user' hooks whose trigger has no user never reach the seam (engine.ts:16539 UnscopedHookApi, hook-run-as.ts:97–130). Action bodies ({ ...base, isSystem: true }, action-execution.ts:1485), hook/flow runAs: 'system', seeds and service self-writes are declared elevations, in scope of the maintainer's system-authority ruling. No caller class the census missed reaches a traversing rule with the bare read and no bound.

(b) Regressions — none against the rulings; one undeclared behaviour move. FK clear: buildReferentialFieldClear returns unbound at 7310, before both bounds; the pin file delete-reference-cleanup-system-identity.test.ts is byte-identical to 3b9c5f2fca. Tenant-scoped and round-16 pins: the test-file diff's −2 are the two posture type annotations (lines 121, 188); every assertion at 218–345 unchanged. No new isSystem: true literal in engine.ts (28 at both heads); the system read stays 7410–7412 with the caller's context spread, so a tenantId still scopes it (buildDriverOptions 4506–4509, 4524–4526). ⚠ Moved: a SYSTEM context carrying userId and no tenantId under a walled posture read nothing at 1e487ef110 (readsNothing keyed on userId) and now gets the bare system read (bound false). Reachable only through declared elevations over an org-less user (action body, hook runAs: 'system'); the r14 order's "do not change system callers" was spelled for callers with no userId, and the r15 PASS recorded the r14 behaviour as a functional deviation. Consistent with ruling 5778121976; not a widening for any untrusted principal. It is not declared: the report, commit 11ddc2dc0a and the body edit say "system callers are unchanged". Non-blocking.

(c) Census row 29b — TRUE and complete. The one new ExecutionContext.isSystem read is 7317; the row names both effects (no own-read row bound; a related read with no organization under a walled posture) and its parenthetical (tenantId still scopes) holds by buildDriverOptions. Anchor engine.ts#resolvePredicateRelated exists. Counts: 110 at the merge-base, 111 after the PR's own row 6b, 112 now; the gate runs inside Lint & Repo Gates (lint.yml:348–349), success at the head and failure at 5b11234f94, as the dev states. origin/main still reads 110 on that page and did not touch it since the merge-base.

(d) Pins — weight-bearing by reading. New describe at test file 352–384. Pin (a) 355–366: both callers under isolated on qa_note (tenancy disabled, so the org wall admits the write) against qa_line (tenant-scoped, so the own-read gate is off): ablation L (readsNothing back on userId) gives the bare read of line_y, so secret refuses with RULE_MESSAGE and public commits — open.seen differs, red. Pin (b) 368–377 under single (readsNothing false, own-read arm exercised): ablation M gives the system read of u_y, banned diverges and userColumnsRead gains 'banned' — red. CONTROL 379–383: ablation N (bound = true) makes the system caller read nothing, open.seen.committed 0 against the asserted 1 — red. Pin (a) is held to refusal by VALIDATION_FAILED, committed 0, preview invalid and readsOfLine [], not by equality alone. Ablation readings are the dev's; consistent with the code.

(e) Prose. Changeset 61–68: true (any non-system caller; "not found" under a walled posture). Engine docblock 7277–7278 and comments 7313–7315, 7397–7400: true. rule-validator.ts:546 (unreadable names both causes), 579–583 (row bound beside the projection), 590–591 (row no longer says "readable"): true — the round-16 non-blocking notes are closed. Body edits, sentence by sentence: bullet-2 S1 (system authority, named fields plus id) TRUE; S2 (org carried; 0 rows under isolated) TRUE for driver-sql, the driver-sqlite-wasm half carried unverified as the dev declares; S3 ("Two bounds hold every caller that is not system ... leave system callers unchanged") TRUE as "the bounds do not apply to a system caller", with the (b) move undeclared; S4 (walled + no org: no read, references unresolved) TRUE at 7318–7319, 7375, 7455; S5 (unwalled related object: only the own read's rows, others not readable, columns never read) TRUE at 7402–7410, 7455; S6 (public-form grant admits the form's own object only; principal-less reads through the fall-open) TRUE at security-plugin.ts:1892–1897, 1931–1932, 2031–2038; S7 ("All of these are pinned ...") OVERCLAIMS: pinned are the org scope (218–243), the org-less no-read for a user (246–307), for the public-form and principal-less callers (355–366), the sys_user own-read bound for a user (309–348) and the public-form refusal (368–377); NOT pinned are the principal-less fall-open own read (a deleted probe only) and the tenancy.enabled: false / external arms of the gate as RELATED objects (every pin's related object is qa_line or sys_user); "against the shipped member_default wall" is true for the user case (89–101), while the public-form case is decided by the grant arm. Bullet-3 append TRUE (7455 for any id outside ownRead, stored or not; 7429–7446 for a refused read; one text at 3346–3348). 维护者速读 bullet-2 replacement TRUE. New bullet TRUE with S3's caveat on 「系统调用不变」; 「没有身份的内部调用 ... 只读调用者自己读得到的那一行」 is true by the letter (under single the fall-open returns every row).

(f) Budget. git diff --numstat 2c1011b01 refs/review/pr-19728: 22 files, +4813/−69 = 4882, at most 5000 (headroom 118); the file list equals the PR API's 22 exactly; merge-base still 2c1011b01.

CI at the head, stated plainly: 35 check-runs, 35 names, 33 success, 2 skipped (Console Pin Gate; Packed-tarball smoke (opt-in)), 0 failure, 0 cancelled. Lint & Repo Gates, TypeScript Type Check, Test Core (all six shards), Dogfood Regression Gate, Build Core, Temporal Conformance (live PG + MySQL), Governed Surface Queue Guard: success. Matches the dev's 33/2/7. Intermediate heads: 11ddc2dc0a superseded (19 cancelled, aggregator failure); 5b11234f94 Lint & Repo Gates failure and the TypeScript aggregator over cancelled shards. The round-16 Test Core (5/6) red did not recur; its failing test name stays NOT MEASURED by anyone.

② Semver level

.changeset/18682-predicate-relationship-traversal.md at head: minor on @objectstack/formula, @objectstack/lint, @objectstack/objectql, @objectstack/plugin-security; Clause-②: yes (widening); no major, no BREAKING banner, no ADR-0087 marker. Correct: against the merge-base the capability and canWriteObject are additive, and this round's narrowing lives inside the unreleased PR. AGENTS.md:1072–1073 (yes takes at least minor; (narrowing) is BREAKING) and 1083–1085 (marker only for a breaking changeset, forms adr-0087: registered ... / adr-0087: not-required (...) per check-adr-0087-registration.mjs:60–63); check-changeset-no-major.mjs:5–9 forbids major in the launch window. packages/spec untouched, so no spec changeset is owed; the other touched packages are private or docs. Check Changeset: success.

③ Boundary flags

Blocking: none.

Non-blocking:

• Undeclared behaviour move (①(b)): a system context with userId and no tenantId under a walled posture now gets the bare system read instead of no read. Within the maintainer's system-authority ruling; the report and the body-edit sentence "leave system callers unchanged" should say "the bounds never apply to a system caller".
• Body-edit S7 "All of these are pinned" overclaims as itemised in ①(e); suggested: "The organization scope, the org-less no-read (user, public-form and principal-less callers) and the sys_user own-read bound (user and public-form callers) are pinned in ...". PR body is not shipped prose.
• Dev-declared deviations (5818517157): pushed before the gate run (5b11234f94 red on the census, fixed at the head); the mdx moved because the census gate forces an anchor; pins on qa_note rather than qa_inspection (an org-less non-system insert into a walled object is refused before any rule, ERR_SYSTEM_WRITE_ORGANIZATION_REQUIRED — out-of-scope finding, not filed); full suites at 5b11234f94 (the later commit touches only the mdx — verified); no merge of main this round. All accepted as stated.
• Landing note: origin/main moved to e8f163fc3a; engine.ts, rule-validator.ts and security-plugin.ts also changed on main since 2c1011b01; git merge-tree --write-tree origin/main refs/review/pr-19728 is clean; the head's CI ran on the merge ref as of 16:36Z.
• Pre-existing, disclosed by the dev, not filed: sys_scim_user / sys_scim_group blanket read; referenceExists platform-global existence probe; the public-form grant admits find on the form's own object with no row filter, so a self-referencing traversing rule on an unwalled form object is answered by that grant (by reading, not measured).
• Within-organization reads of a tenant-scoped related object still evaluate on the org-scoped system read even where the caller's RLS is narrower — letter A's last sentence keeps that rule; the accepted channel of 5778121976.
• system-context.mdx intro "the other hundred-and-four" was already stale at main (110 sites, same phrase); the PR moved the number and left the phrase.
• Debts carried: the FK-clear prescription follow-up (round-11 Q1 option D) and the optional-lookup authoring trap, still unfiled.
• Ablations not re-run here; readings are the dev's. The driver-sqlite-wasm half of "measured on" remains a dev reading.
• Model identifiers: none in the round diff, the changeset or the body edits; the three commits carry the model-free trailer pair AGENTS.md:451–455 requires.

Implemented-by: claude/issue-18682-predicate-relationship-traversal
Reviewed-by: session_019c3Hi6ZMU1p6m6aA6Bz45d

VERDICT: PASS

---

Generated by Claude Code