feat(lint,metadata-protocol,cli)!: RLS read scopes are admitted by the engine judge when authored, at the save door and at os validate / build / lint

[objectstack-fleet]

Fixes #20158

Clause-②: yes (narrowing)

yes because two published @objectstack/lint signatures gain an optional judgeFilter input, so @objectstack/lint is minor. (narrowing) because the metadata save door now refuses RLS policies it accepted before, so the release is BREAKING and the changeset carries the ADR-0087 marker. Route A, as ruled in seat answer 5856289438 on the card, following triage 5855733474 and ruling C on #19995 (comment 5852158605).

What changed

A row-level-security policy is permission-set metadata (rowLevelSecurity[]). Its read-scope using could lower cleanly and still be a filter the engine refuses to run: a text operator on a number field, a date field compared against a value its storage cannot read, a filter on a formula field, or a {…} placeholder string. Nothing refused any of these at authoring time. The metadata save door (Studio, REST /meta, MCP) also did not run the RLS predicate rule at all.

• The rule takes the engine's judge as an input. validateRlsPredicateEnforceability(stack, { judgeFilter }) judges the lowered using of every select / all policy with IObjectQLEngine.judgeFilter. It runs only when every existing pass left the clause clean, so one defect produces one finding. The finding keeps the existing id rls-predicate-unenforceable and quotes the engine's code, status and sentence verbatim. packages/lint holds no model of the engine's checks. Without the input, the pass is skipped and the rule answers exactly as before.
• The input is threaded through the run signatures: AuthoringRuleContext.judgeFilter (so AuthoringRuleRun.judgeFilter for runAuthoringRules) and the judgeFilter argument of runRuntimeAuthoringRules. The registry entry passes ctx.judgeFilter to the rule.
• Runtime door. assertRuntimeAuthoringRules (protocol.ts) probes typeof this.engine.judgeFilter === 'function'. It passes the method, bound to the engine, into evaluateRuntimeAuthoringGate, which is internal to the package and stays pure (a new judgeFilter argument, the same pattern as orgWallEnforced), and from there to runRuntimeAuthoringRules.
• CLI door. The new packages/cli/src/utils/authoring-filter-judge.ts builds an ObjectQL with no driver and no kernel, registers the stack's objects through its own registry (applySystemFields included), and returns its bound judgeFilter. It is built on the first judgement only, and objects are copied before registration so the rules that run later see the author's stack untouched. All five runAuthoringRules call sites pass it: commands/validate.ts, commands/compile.ts, commands/lint.ts, utils/artifact-packages.ts (the per-package pass, handed the union's judge) and utils/scaffold-validate.ts.
• The surfaces flip. The registry entry is now surfaces: CLI_AND_RUNTIME, runtimeTypes: ['permission']. The per-write snapshot has carried permissions and objects since [2 of #7891] permission/book wiring: TYPE_TO_STACK_KEY entries + the cross-collection snapshot the three comparison rules need #8309, and [3 of #7891] Flip the registration: runtimeTypes gains object + permission/book — whole rule families cross the publish door #8310 closed with no ruling that kept this rule CLI-only (0 matches for rls / RLS / rowLevelSecurity / validateRlsPredicate / CLI_ONLY across its body and 2 comments; control: the body names validateSecurityPosture).
• No spec change, no new error code, no new rule id.

The refusal text (new, quoted)

The message the rule builds for an engine refusal. Both doors carry it byte for byte:

RLS using `SOURCE` lowers, but the engine refuses to run the lowered filter on "OBJECT" (CODE / STATUS): ENGINE_MESSAGE This clause is part of the object's row-level READ SCOPE, and the analytics face hands the read scope to this same engine admission before it runs a query: every analytics query over the object that this policy scopes is refused.

The hint, chosen by the engine's code (never by its prose):

• FILTER_TOKEN_UNKNOWN / FILTER_TOKEN_UNRESOLVED: "A {…} placeholder is saved-filter syntax, and an RLS predicate does not use it: the predicate is CEL, and the caller's values are the current_user keys (… the kernel-resolved keys …). Write owner == current_user.id, not owner == '{current_user_id}'."
• INVALID_FIELD: "A row filter reaches only the stored columns of its own object. Denormalise the value the engine names onto this object (a stored field, written when the source changes) and test that column."
• any other code: "Rewrite the comparison the engine names so it can run: a text operator (startsWith / endsWith / contains) only on a field that holds a string, and a date or datetime field only against a value its storage can read." followed by the rule's existing lowerable-subset sentence.

At the save door the refusal is the gate's existing envelope, 422 INVALID_METADATA, whose issues[] entry carries the same rule, message and hint. The path is keyed by the set's name (permissions.sales.rowLevelSecurity[0].using). The text is the author's own, so nothing is withheld at authoring time. The runtime read-scope withhold (#5367) is untouched.

The judge-pass binding (as ruled)

The judge sees the reference pass's probe with one change: a current_user.* key the kernel does NOT resolve (an app-staged §7.3.1 membership set) is bound to [] for the judge pass only. Kernel keys keep their runtime-typed probe (a user id or an email is never a date, so the probe stands in faithfully). An app-staged set holds app data this rule cannot know. The measured artefact: close_date in current_user.holidays lowered with the probe string reaches the engine as { close_date: { $in: ['__objectstack_lint_probe__'] } }, and the temporal door refuses it (INVALID_FILTER). Lowered with [], the engine admits it. Pinned at both doors: that clause is accepted, and close_date in current_user.holidays && amount.startsWith('5') is still refused (the binding does not switch the judge off). At the lint layer, a recording judge shows it is handed { close_date: { $in: [] } } for the app key and { owner: { $in: ['__objectstack_lint_probe__'] } } for current_user.org_user_ids.

The fail-open edge (named, not closed)

At the runtime door, the judge reads the live engine's registry, not the per-write snapshot. An object that exists only in the same publish batch (publishPackageDrafts pending declarations), or only in an organization overlay row, is one that registry does not hold, so it gets the engine's unknown-object answer: the field-map doors (text operator, temporal, formula, dotted) answer nothing, while the schema-free doors (placeholders, comparand shape and type) still judge. The runtime read-scope withhold (#5367) stays the backstop there. As ruled, no snapshot-based second registry is added to close it. The CLI door gives the same answer for an object the stack does not define (another package's, or a platform object), and for an object the registry itself refuses to register (refused at boot by that same registry).

What the judge does not see

It judges only using clauses that belong to the read scope: select and all, the two getApplicablePolicies matches for a read. A check is matched in memory against a post-image and never reaches the engine's where admission. A using on an insert / update / delete-only policy is not part of the read scope either. Both are pinned (a recording judge counts 0 calls for them).

The fifteen classes, both doors (packages/cli/test/rls-policy-authoring-admission.test.ts)

One table. Each row runs os validate's own composition in process (normalizeStackInput → lowerCallables → ObjectStackDefinitionSchema → union fold → runAuthoringRules('validate', …) with stackFilterJudge) and saveMetaItem({ type: 'permission' }) over a real ObjectQL host (in-memory driver, the real sys_metadata objects from @objectstack/metadata-core) holding the same objects. It asserts one verdict and one sentence (issues[0].message === cliFinding.message), plus the envelope INVALID_METADATA / 422 and the path.

#	Class (#19995)	Family	CEL as written	Rule at both doors	Engine code quoted	Before (805af4f2): os validate / save
1	list in the implicit equality slot	comparand shape	region == ['emea', 'apac']	rls-predicate-unenforceable	—	refused / accepted
2	list under $eq	comparand shape	region == current_user.org_user_ids	rls-predicate-unenforceable	—	refused / accepted
3	scalar under $in	comparand shape	region in 'emea'	rls-predicate-unenforceable	—	refused / accepted
4	scalar under $nin	comparand shape	!(region in 'emea')	rls-predicate-unenforceable	—	refused / accepted
5	one-bound $between (no CEL spelling; nearest: a range with a null bound)	comparand shape	amount >= 1 && amount <= null	rls-predicate-unenforceable	—	refused / accepted
6	null member in $in	comparand shape	region in ['emea', null]	rls-predicate-unenforceable	—	refused / accepted
7	plain-object member in $in	comparand type	region in [{'a': 1}]	rls-predicate-unenforceable	—	refused / accepted
8	plain-object comparand under $eq	comparand type	region == {'a': 1}	rls-predicate-unenforceable	—	refused / accepted
9	undefined comparand (no CEL spelling; nearest: a key nothing resolves)	comparand type	region == current_user.nope	rls-predicate-unknown-user-variable	—	refused / accepted
10	unknown placeholder	placeholder	owner == '{current_usr_id}'	rls-predicate-unenforceable	FILTER_TOKEN_UNKNOWN	accepted / accepted
11	known placeholder, no context	placeholder	owner == '{current_user_id}'	rls-predicate-unenforceable	FILTER_TOKEN_UNRESOLVED	accepted / accepted
12	text operator on a non-text field	schema door	amount.startsWith('5')	rls-predicate-unenforceable	INVALID_FILTER	accepted / accepted
13	temporal comparand the platform cannot read	schema door	close_date > 'soon'	rls-predicate-unenforceable	INVALID_FILTER	accepted / accepted
14	filter on a virtual (formula) field	schema door	is_open == true	rls-predicate-unenforceable	INVALID_FIELD	accepted / accepted
15	dotted path through a lookup	schema door	account.region == 'emea'	rls-predicate-unenforceable	—	refused / accepted

Controls, accepted at both doors: owner == current_user.id, owner in current_user.org_user_ids (the pre-resolved IN form) and name.startsWith('A') (a text operator on a text field).

The "Before" column was measured on 805af4f2 with a scratch probe (not committed). The rule was run directly for os validate, and saveMetaItem for a permission write on a stub host. Rows 5 and 9 were not in that probe. Their os validate reading was taken at this head with no judge passed, which runs exactly the passes 805af4f2 ran: the rule's diff only adds the judge pass, and packages/formula changed no production file between the two. Rows 1–4, 7, 8 and 15 are CEL shapes the pushdown compiler refuses, so the existing shape pass already reports them. Rows 5 and 6 are the existing shared-face pass, and row 9 is the existing unknown-variable pass. The five rows the engine alone refuses (10–14) were accepted at both doors. Every row was accepted at the save door, because the rule did not run there.

Placeholder semantics are as 5855081099 records them: a known placeholder judged with no context answers FILTER_TOKEN_UNRESOLVED, an unknown one FILTER_TOKEN_UNKNOWN. No authored policy in the census uses a {…} token, so no mode change is needed and none is added.

Measurements

• Producer census, with the real rule and a real judge (scratch probe, not committed; tree cb223b1e). A driverless ObjectQL held every object definition the tree ships (packages/**/src/**/*.object.ts: 75 files, 75 objects, 0 imports failed, 0 refused by the registry). The run was validateRlsPredicateEnforceability(stack, { judgeFilter }):
  • plugin-security defaultPermissionSets: 107 clauses, 104 read-scope using, 104 judge calls, 0 findings. 28 of its 29 policy objects are known to that engine; the 29th is the '*' wildcard, which gets the unknown-object answer.
  • packages/metadata hotcrm fixture: 4 clauses, 2 read-scope using, 2 judge calls, 0 findings.
  • Positive control, same run: a planted user_id.startsWith('{current_user_id}') on sys_session produced 1 finding (FILTER_TOKEN_UNRESOLVED).
  • examples/app-showcase (allPermissionSets over its 24 objects, judged by an engine holding those objects, 0 refused by the registry): 3 clauses, 2 read-scope using, 2 judge calls, 0 findings.
• Placeholder spelling: in examples/** and packages/** (non-test), 63 of 88 using: / check: lines name current_user. (CEL variables), and 0 carry a {token}. cloud origin/main 96eb092 has 0 authored policies (control: rowLevelSecurity 1 comment hit). objectui at pin f8a9d0fb has 0 authored policies (control: rowLevelSecurity 10 hits, the Studio RLS editor PermissionAdvancedFacets.tsx, a real producer of save-door writes).

Tests

All heavy runs went through scripts/pm/os-verify-lock.sh. Each verdict below is the run's own tally.

Final head a8102979 (origin/main 443b2f4f merged; the post-merge re-verification ran after pnpm install --frozen-lockfile and a @objectstack/cli... closure build, Tasks: 56 successful, 56 total):

• The two-door pin (packages/cli/test/rls-policy-authoring-admission.test.ts; the tier file places it in integration, run locally because this diff adds it): Tests 21 passed (21).
• Runtime door (packages/metadata-protocol/src/protocol.runtime-authoring-gate.test.ts, the new #20158 block on the file's existing pinned stub host): Tests 39 passed (39).
• Lint contract with the judge (packages/lint/src/validate-rls-predicate-enforceability.engine-judge.test.ts, 11 cases) runs inside the lint suite below.
• Consumer suites (each package's whole suite):
  • pnpm --filter @objectstack/lint test: Test Files 111 passed (111), Tests 4273 passed (4273).
  • pnpm --filter @objectstack/cli exec vitest run --project unit: Test Files 229 passed (229), Tests 3250 passed (3250). The integration tier is left to CI, except the new pin above.
  • pnpm --filter @objectstack/plugin-security test (read-only consumer): Test Files 139 passed (139), Tests 2839 passed (2839).
  • pnpm --filter @objectstack/metadata-protocol test at cb223b1e: Test Files 189 passed | 3 skipped (192), Tests 2707 passed | 19 skipped (2726). The second merge brought no metadata-protocol source change (one new test file on main), and the gate file was re-run at the final head (above).
• Typecheck at the final head: pnpm --filter @objectstack/lint typecheck, @objectstack/metadata-protocol and @objectstack/cli all exit 0.
• An earlier red, fixed in this PR: the first CLI unit run (9df0a6f5) failed test/validate-build-gate-parity.test.ts with compile.ts / validate.ts call 1 name(s) this file has not classified: stackFilterJudge. The name is now classified in that file's NOT_A_GATE ledger as an input to the registry. Two published-subpath-* files failed in the same run only because the CLI itself was not built; after the build they passed (Tests 29 passed (29)).

Reverse verification (ablations)

The pin reads @objectstack/lint and @objectstack/metadata-protocol through exports, which resolve to dist/, and no alias points them at source. So every leg was: scripts/ablation-replace.mjs in wrap mode (the anchor hits exactly once, the blob changes, the restore is proven blob == HEAD with an empty git diff HEAD); rebuild the package; scripts/ablation-dist-preflight.mjs shows the marker in dist/; run the pin; then rebuild after the restore and preflight --absent.

Leg	Mutation	Marker in dist/	Pin under mutation	Failing cases	Restore
A1B	protocol.ts passes the gate NO judge (… && ('ABLATION_20158_A1B' in globalThis) ? { judgeFilter } : {})	present in 2 built files	6 failed | 15 passed (21)	rows 10–14 and the binding-refusal case: expected true to be false (the save door ACCEPTED; the CLI door still refused)	rebuilt, marker absent, pin 21 passed
A2B	the rule never asks the judge (const refused = ('ABLATION_20158_A2B' in globalThis) && …)	present	6 failed | 15 passed (21)	the same six, failing first at the CLI door: expected [] to deeply equal [ { severity: 'error', … } ]	rebuilt, marker absent, pin 21 passed

Direction as predicted: red, and red only where the engine alone refuses. The ten rows owned by earlier passes and the three controls stayed green under both legs.

⚠️ The first pair of legs did not measure anything, and their readings are discarded:

• A1's replacement read !('…' in globalThis), which is true, so the judge was still handed through. The mutation was semantically a no-op, and the pin stayed 21 passed.
• A2's replacement still contained its own anchor, so ablation-replace refused it (the anchor count moved 1 → 1) and restored the file. Nothing ran.

Both were redone as A1B and A2B above. The tree was clean after every leg (git status --porcelain empty).

Gates

Derived at the final head a8102979 with node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack: 74 families. Every line was run and recorded as command :: exit N before any pipe, then reconciled:

Run reconciliation — 74 derived, 74 run, 0 NOT-MEASURED, 0 UNRUN.
dispatch-gates --ran: 74 derived famil(ies) accounted for — 74 run, 0 NOT-MEASURED (a DERIVED zero — all 74 recorded an exit code and none of them is 3).

• check:dual-build-cjs-loads first answered PREREQUISITE NOT MET (exit 3: studio, client-react, embedder-openai, knowledge-ragflow, organizations and service-cluster-redis had no dist/). After those six were built it exited 0 (104 published require entry point(s) across 66 package(s) load), and the record carries that re-run.
• check:i18n, check:i18n-coverage and check:i18n-walk-parity answered exit 3 on the first pass (the CLI was not built). After their named closure build they exited 0.
• Fixed by this PR on the way:
  • check:test-source-alias asked for an anchored @objectstack/driver-sqlite-wasm source alias for the new pin.
  • check:driver-memory-census refused a new driver-memory test consumer, so the pin stores on a :memory: SQLite driver instead.
  • check:doc-authoring asked for the shrink-only prose-id ledger burn-down.
• Lint, narrowed and proven. pnpm lint is CI's. The population comes from eslint.config.mjs itself (files: ['**/*.{ts,tsx,mts,cts,js,jsx,mjs,cjs}'] minus NEVER_LINTED). eslint --no-inline-config --format json over the 16 TypeScript files this diff touches read 16 files, with 0 errors and 0 warnings. The resolved parserOptions for these files is {"ecmaVersion":"latest","sourceType":"module"}, with no project and no projectService, so type-aware linting is off and this diff cannot move a verdict on any untouched file.
• Not local, by the dispatch tooling's own accounting: the CI job steps and the wide-population and roster families the derivation lists outside its 74 (Test Core shards, Dogfood, Build Core, Temporal Conformance, the workspace type-check lanes). CI runs them on this PR.

Acceptance notes

• Fences respected. Not touched: packages/objectql/src/engine.ts, plugin-security/src/rls-compiler.ts, security-plugin.ts (RLS: a policy's compiled filter skips the shared comparand-shape faces, so a null list member or null ordering bound reaches driver-sql, and the read and the write check disagree (the read hides a row its own check admits) #20212); protocol.ts's convertStoredItemDetailed / migrateStoredMetadata (decision: should the losslessly mappable subset of the record-form filter get a real D2 conversion, or is "stored rows keep loading, re-saving is refused" the final answer? #17321; only assertRuntimeAuthoringRules and one type import changed); service-analytics (security: the analytics ObjectQL execute face answers a row-level read scope it cannot run with INVALID_FILTER / 400 whose message echoes the policy's field name and comparands — the disclosure #5367 closed for the native / echo faces #19995); packages/spec/src/contracts/objectql-engine.ts (consumed, never reshaped); packages/core/src/artifact-packages.ts (packages: null on a release artifact: the schema and composeStacks refuse it, while every reader reads it as absent #19926). No pin here asserts the composed-filter null behaviour.

• File-surface additions, each measured as needed:

  • packages/lint/src/runtime-gate.ts: runRuntimeAuthoringRules is the one published path from the runtime gate to the rules.
  • packages/cli/vitest.config.ts: one anchored @objectstack/driver-memory source alias, which check:test-source-alias demanded for the new pin.
  • scripts/doc-authoring-prose-id.baseline.json: shrink-only burn-down. The old surfaceReason citing [2 of #7891] permission/book wiring: TYPE_TO_STACK_KEY entries + the cross-collection snapshot the three comparison rules need #8309 / [3 of #7891] Flip the registration: runtimeTypes gains object + permission/book — whole rule families cross the publish door #8310 is gone, and check:doc-authoring asked for the regenerated ledger.

• Stored rows. A stored permission row carrying a refused predicate keeps being read ([runtime/metadata] 作者时规则只存在于 CLI:Studio/REST/MCP 的运行时授权面是第四扇门,26 条规则一条不跑——#4409 修完后最大的敞口 #4463 D4); a re-save is judged like any publish. OS_ALLOW_UNLINTED_METADATA_WRITES=1 is the existing migration hatch.

• A throwing judge (corrected by the seat from the at-tier review, 2026-09-27). judgeFilter re-throws only a fault that carries no envelope (a bug, by its own contract), and the rule lets it propagate. The two doors then answer differently:

  • at os validate / os compile, the command fails loudly;
  • at the runtime save door, the pre-existing runRules catch in runtime-gate.ts ("a rule that throws … must not take the write down") turns the throw into a warning-tier authoring-rule-threw advisory on the 2xx, and the write lands unjudged.

  The runtime behaviour is not silent, but it is not a refusal either. It is gate-wide policy that predates this PR, and it is not pinned here. analytics dataset 路由的 message 正则兜底没有退休时间表:六族拒收仍靠措辞分类,改一个字就换一个 HTTP 码 #5367 still backstops the read scope.

• ADR-0087 disposition: not-required (no-migration-prescription). No key, schema, export or stored representation moves; what is refused is a predicate value the engine already refuses whenever it is asked to run it.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 3 package(s): @objectstack/cli, @objectstack/lint, @objectstack/metadata-protocol, touching 32 documentable anchor(s). ⚠️ 1 changed file(s) yielded no anchor (packages/cli/vitest.config.ts), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files.

42 hand-written doc(s) name something this change touched — list omitted above 15 rows. Re-derive on the tree named below: node scripts/docs-audit/affected-docs.mjs --json a9fb83ef06a079a938c97d1ea5e364705e1bc13b.

⛔ 8 release-owned page(s) also affected — read-only, see AGENTS.md Documentation Guardrails.

What this run could not see

• 1 changed file(s) yielded no anchor (packages/cli/vitest.config.ts) — pages documenting those are invisible to this run
• 1 anchor(s) matched too much of the corpus to be a work list: os validate (command, 51 pages)
• 3 name(s) were too generic to anchor anything (single lowercase words)
• the SDK route bridge reached 54 of 206 client-bound route-ledger rows — the other 152 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 152: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 55 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 97 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 35 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json a9fb83ef06a079a938c97d1ea5e364705e1bc13b → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 7ce7f5491a88404f418ea13c4ec6c2b7c55cbec6 — the merge of head a81029795938139498932f60b317305be065275d into base a9fb83ef06a079a938c97d1ea5e364705e1bc13b, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 7ce7f5491a88404f418ea13c4ec6c2b7c55cbec6 && git checkout 7ce7f5491a88404f418ea13c4ec6c2b7c55cbec6
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin a9fb83ef06a079a938c97d1ea5e364705e1bc13b a81029795938139498932f60b317305be065275d && git checkout -B drift-repro a9fb83ef06a079a938c97d1ea5e364705e1bc13b && git merge --no-ff a81029795938139498932f60b317305be065275d

node scripts/docs-audit/affected-docs.mjs --json a9fb83ef06a079a938c97d1ea5e364705e1bc13b

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs a9fb83ef06a079a938c97d1ea5e364705e1bc13b → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[objectstack-fleet]

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: a81029795938139498932f60b317305be065275d

① Derived judgments

• 1. One judge, two doors, one answer — RIGHT. Re-ran the enumerating pin on a fresh detached worktree at the head (pnpm install --frozen-lockfile, turbo build --filter=@objectstack/cli... 56/56, lint and metadata-protocol resolved through dist/): packages/cli/test/rls-policy-authoring-admission.test.ts 21 passed (21); it asserts per row one CLI finding (severity/rule/path), the runtime 422 INVALID_METADATA with the same rule at the name-keyed path, and saved.issues[0].message === cli[0].message, with the engine code quoted for rows 10–14. Beyond the pin: (a) the driverless judge's every recorded question over the whole producer census (see item 5) was replayed into a live ObjectQL (sqlite driver, init(), all 83 shipped *.object.ts definitions registered, 0 refused) and JSON.stringify of the verdicts differed in 0 of 110 calls; (b) registry-injected system columns are byte-identical between the driverless and live registries (created_at:datetime, created_by:lookup, organization_id:lookup, owner_id:lookup, owning_business_unit_id:lookup, updated_at:datetime, updated_by:lookup), and multiTenant only changes the index (registry.ts:540–545), so created_at gt 'soon' (gt spells the greater-than operator, kept out of this record for the sanitizer), created_at.startsWith('2'), created_by.name == 'x', owner_id == current_user.id, organization_id == current_user.organization_id all agree at both doors; (c) an object held under a package namespace in the live registry yields the same sentence (find('deal'): …); (d) plugin field types cannot diverge: a non-member type is refused by ObjectStackDefinitionSchema before the CLI rule runs and by registerObject (ObjectFieldTypeRefusedError, [finding] driver-sql and both migration generators default an absent or unknown field type to DIFFERENT families — string versus text, so the unvalidated authoring door produces two different columns #16319) in both registries. The only disagreement class is the declared one: a policy on an object the CLI stack does not define (another package's, a platform object, '*') gets the schema-free verdict only at os validate (other_pkg_obj/'*' with amount.startsWith('5')/close_date gt 'soon' → clean; with '{current_user_id}' → FILTER_TOKEN_UNRESOLVED) while the save door judges the full field map. Named in the body and the changeset.
• 2. No second admission — RIGHT. git grep over packages/lint/src (non-test) for judgeWhereAdmission|lowerWhereFilterArray|filter-comparand-shape|temporal-comparand-door|text-operator-declared-type-door|assertFilterIsMaterializable|assertTextOperatorTargetsAreStringCapable|assertTemporalComparandsInterpretable|from '@objectstack/objectql → 0 code hits (4 docblock mentions in unrelated rules). The rule imports only @objectstack/formula, @objectstack/spec/{contracts,data,kernel} and ./object-graph.js; packages/lint/package.json depends on formula/sdui-parser/spec only. The new pass is engineRefusal → judge(object, where, { operation: 'find' }) and nothing else (validate-rls-predicate-enforceability.ts:1071–1095); the pre-existing lint: validate-rls-predicate-enforceability is silent on == / != against a kernel membership key (current_user.org_user_ids …), a policy the runtime drops on every request once PR #19947 lands #19951 shared faces (assertListComparandShapes/normalizeFilterComparandTypes from spec) are the engine's own functions, not a model, and predate this PR. The CLI judge is a real ObjectQL instance's bound judgeFilter (authoring-filter-judge.ts:98).
• 3. Fail direction — RIGHT with one misstatement. (a) Judge absent: options.judgeFilter undefined → judge undefined → referenceFindings runs the pre-existing passes unchanged (lines 1240–1246 gate the new pass on judge && filter && findings.length === 0); pinned at lint (without a judge … stays clean), at the pure gate (without judgeFilter the runtime gate still runs the rule) and at the protocol door (a host engine WITHOUT the member keeps its answer, which also pins that the surfaces flip alone now refuses rls-predicate-unparseable there). assertRuntimeAuthoringRules probes typeof this.engine.judgeFilter === 'function' (protocol.ts:5131). (b) Judge throws a non-envelope fault, probed with a live host whose judgeFilter throws Error('boom'): CLI runAuthoringRules propagates (command fails loudly); the runtime door does NOT 500 and does NOT fail loudly — the pre-existing runRules catch in runtime-gate.ts converts it to a warning-tier authoring-rule-threw advisory, saveMetaItem returns success with that advisory on the 2xx and console-warns, and the row is stored (accepted: true, stored: 1). Not silent, and by the judge's contract a non-envelope throw is a bug not a refusal, so no ruled requirement is broken; but the PR body's Acceptance note "the publish or the command fails loudly instead of skipping the judgement" is wrong for the save door — that door skips the judgement and lands the write. Not pinned. See ③. (c) Runtime unknown-object edge, probed through runRuntimeAuthoringRules with the live judge and pending_obj only in context.objects: amount.startsWith('5') → accepted (fail-open, field-map doors answer nothing), owner == '{current_user_id}' → refused (schema-free door). Exactly as declared in the body ("The fail-open edge (named, not closed)"), the changeset and the protocol.ts comment; analytics dataset 路由的 message 正则兜底没有退休时间表:六族拒收仍靠措辞分类,改一个字就换一个 HTTP 码 #5367 stays the backstop.
• 4. The [] binding — RIGHT, confined to the judge pass. engineJudgeProbe (lines 1049–1061) rebinds only keys outside RESERVED_RLS_MEMBERSHIP_KEYS (id, organization_id, positions, org_user_ids, accessible_org_ids, email); the rebound probe feeds a local compileWithProbe whose output is passed to the judge and discarded (engineRefusal). The reference passes keep PROBE_ARRAY; the runtime RLSCompiler never sees it. Probed: after a judged save of close_date in current_user.holidays, the sys_metadata.metadata row holds using: "close_date in current_user.holidays" verbatim and getMetaItem reads it back unchanged; the CLI judge leaves the author's stack byte-identical (JSON.stringify before/after equal). What it hides: a refusal that depends on the MEMBERS of an app-staged set — concretely a date/datetime field tested with in current_user.APP_KEY whose staged members the temporal door cannot read (INVALID_FILTER at request time). That is app data the rule cannot know; a kernel key keeps its typed probe (close_date in current_user.org_user_ids still reaches the door), a non-kernel key in a scalar position is already rls-predicate-unknown-user-variable so the judge never runs, and a virtual field under in current_user.APP_KEY is still refused (INVALID_FIELD judges the field, not the members). The binding does not switch the judge off (pinned: close_date in current_user.holidays && amount.startsWith('5') refused at both doors).
• 5. Placeholder semantics and the census — RIGHT, nothing real is refused. Per 5855081099: known without context → FILTER_TOKEN_UNRESOLVED, unknown → FILTER_TOKEN_UNKNOWN; pinned as rows 10/11 and reproduced. Census through both doors with the real rule, the real driverless judge and the live-engine replay: plugin-security securityDefaultPermissionSets 8 sets / 107 clauses / 104 read-scope using / 104 judge calls / 27 policy objects all known → 0 findings; examples/app-showcase allPermissionSets 9 sets / 3 clauses / 2 judged → 0; packages/metadata hotcrm fixture 6 sets / 4 clauses / 2 judged (objects not in tree, unknown-object answer) → 0. Total 114 clauses, 0 refused, sentences identical at both doors, 0 replay differences. Positive control fires at both doors with one sentence (user_id.startsWith('{current_user_id}') on sys_session → FILTER_TOKEN_UNRESOLVED; created_at gt 'soon' on sys_user → INVALID_FILTER). git grep over packages/**/src, examples/** (non-test): 0 using/check strings carry a {token}; cloud 48d70663 has 0 authored policies (3 hits are a comment, a test assertion of ?? [], a design doc); objectui 5c61e524 has 0 authored policies (the Studio editor's default policy is object: '*', operation: 'all', using: '' and its placeholder text is organization_id == current_user.organization_id, CEL not a token).
• 6. The published lint surface — RIGHT. Diff of exported declarations across lint/metadata-protocol/cli: only validateRlsPredicateEnforceability(stack, options?) (optional second parameter) and the new CLI-internal stackFilterJudge (packages/cli exports ., ./console, ./hook-body only; utils/ is not published). Built dist/: AuthoringRuleContext.judgeFilter? and the runRuntimeAuthoringRules args' judgeFilter? in runtime-BdcNALoi.d.ts:180,559, the rule's options? in index.d.ts:2431; AuthoringRuleRun extends AuthoringRuleContext, so it inherits the member. All optional; a caller passing nothing gets the prior verdicts. No lint api-surface baseline exists in the tree (packages/spec/api-surface/* covers spec only), so the delta is measured from the .d.ts, not a gate. Consumers of runAuthoringRules/runRuntimeAuthoringRules/evaluateRuntimeAuthoringGate: the 5 CLI sites + metadata-protocol in this repo; 0 in cloud, 0 in objectui.
• 7. Scope — consistent with ruling C; one gap noted, not ruled. Only select/all using reaches the judge (READ_SCOPE_OPERATIONS, line 1034; getApplicablePolicies maps reads to select plus all), pinned with a recording judge (0 calls for check, insert/update/delete using). Ruling C says "judge the lowered read-scope filter"; the judge contract itself says RLS predicates middleware composes after admission are not judged, so the engine's where admission is reached by an RLS predicate only on the analytics read scope. check is matched in memory (post-image). The fifteen ruled classes are all read-scope. ADR-0058 D2 names using/check on every operation as compile surfaces; the compile-lowering half of this rule already runs on both clauses and all operations — only the engine field-type pass is read-scope-only. Consequence (③): an update/delete-only using or a check with a text operator on a number field is judged at neither door and is answered at request time by the driver doors / in-memory evaluator.
• 8. Pins — substance at both doors; nothing flipped silently. Enumerating pin: verdict + envelope + path + sentence equality + engine code per row, 3 controls, the binding pair. Lint contract test (11): call shape (object, lowered where, { operation: 'find' }), verbatim message, hints keyed by code, read-scope-only, one-defect-one-finding, [] vs typed probe where-shapes, both run signatures, registry entry ['cli','runtime-publish']/['permission'], no-judge behaviour. Protocol test (4 new): bound-this probe, 422 envelope with the sentence and no row written, no-member host, draft not judged. Per-file deletions are confined to source (authoring-rules.ts 8 = the retired surfaceReason, rule file 4, runtime-gate 1, protocol 1, compile/validate 1 each, baseline JSON 2); no test file loses a line. Existing surface pins re-run green: authoring-rule-wiring, rule-id-barrel-exports, runtime-gate.inert-type-writes 71 passed (71); validate-rls-predicate-enforceability.engine-judge.test.ts 11/11; protocol.runtime-authoring-gate.test.ts 39/39. Ablations in the body (A1B/A2B, six engine-only cases red each) match the pin's structure. CI at this head at review close: 31 success / 6 skipped / 1 in progress (Lint & Repo Gates), 0 failing; Check Changeset, both Type Check source/consumer lanes and Test Core 1–6 green.

② Semver level

• Clause-②: yes (narrowing) is coherent per scripts/pm/clause2-line.mjs ("a diff that widens one surface and narrows another. Both facts are true and both are read"): the widening is the optional judgeFilter inputs on published @objectstack/lint types; the narrowing is the save door's new refusals for permission writes.
• minor for lint is right: the LEVEL axis of check-changeset-no-major.mjs ([finding] No gate answers whether a changeset's LEVEL fits the surface — Check Changeset is green on patch and on minor for the same diff #16055) requires a Clause-② yes PR to grade at least one package whose published source it moves minor or above; precedents packageScope (runtime gate: full runtime-safe rule snapshot for the publish door — the expensive half split out of the object-gating card #9612) and datasets (The metadata door accepts a dashboard widget dataset binding that names nothing — 200 on both save and publish, referential integrity enforced only at runtime #7529) shipped Minor. minor + BREAKING for metadata-protocol and cli is right: the same script's header ("During the launch window we ship breaking changes as minor") and ADR-0087's [Decision] 两条裁决援引同一个 launch-window convention，却给出相反的 changeset 等级（minor vs major）—— 退役一个可写键到底发哪一级？ #18003 amendment ("Pre-GA, a metadata-facing … break ships minor, carrying the **BREAKING** banner and its ADR-0087 disposition entry"). The changeset carries the banner, the marker, and no major; Check Changeset passed. No other package's published source moves (objectql, plugin-security, spec untouched).
• ADR-0087 not-required (no-migration-prescription) — defensible, admitted by the gate, matches the nearest precedent. Stored rows stay loadable: the gate runs only on an active publish (D1), convertStoredItemDetailed/migrateStoredMetadata are untouched, and the runtime RLSCompiler reads row_level_security off the row with no gate. A re-save IS judged (probe: a hatch-stored amount.startsWith('5') re-saved unchanged, relabelled, or with the predicate changed → 422; fixed → accepted), because buildRuntimeWriteSnapshots drops the written item's own old entry from the baseline. No key, schema, export or stored shape moves, so objectstack migrate meta has nothing to rewrite, and no lossless conversion exists (which rewrite is intended is the author's decision, the same reasoning 18.rls-predicate-array-comparand-refused records). The refused values were already non-functional at request time (the analytics face pre-judges the read scope with this same member since security: the analytics ObjectQL execute face answers a row-level read scope it cannot run with INVALID_FILTER / 400 whose message echoes the policy's field name and comparands — the disclosure #5367 closed for the native / echo faces #19995; the plain read path composes after admission and hits the driver doors or matches nothing). fix(plugin-security)!: a row-level policy whose compiled filter carries a null list member or null ordering bound fails closed on both clauses, so its read and its write check agree (#20212) #20243, the runtime RLS narrowing merged into this branch, took the identical disposition with the same argument. Weaker point, non-blocking: fix(formula, driver-mongodb): refuse == / != against a list literal at the CEL lowering and $ne arrays at the mongodb face #19947 and feat(spec)!: refuse a check on a select / delete row-level security policy #20167 registered semantic entries for their refused predicate classes, so the generated upgrade guide will not name the five newly refused classes here — the changeset body does, with the per-class hint.

③ Boundary flags

• Runtime door on a throwing judge is fail-open with an advisory, and the body says otherwise. runRules's pre-existing catch (runtime-gate.ts, "a rule that throws … must not take the write down") turns any rule throw into authoring-rule-threw (warning) and the write lands; probed at the real saveMetaItem door: accepted, stored, advisory on the 2xx. Only the CLI door propagates. The Acceptance note "the publish or the command fails loudly" should be corrected to name the runtime advisory; a one-line pin at the protocol door would fix the direction in the record. Gate-wide policy, not introduced here; analytics dataset 路由的 message 正则兜底没有退休时间表:六族拒收仍靠措辞分类,改一个字就换一个 HTTP 码 #5367 still backstops the read scope.
• The runtime unknown-object edge (object only in the publish batch or an org overlay): declared and measured fail-open for the field-map doors, fail-closed for placeholders/comparand shape; not pinned. As ruled, no snapshot registry is added.
• The CLI unknown-object answer (a policy on another package's or a platform object at os validate) is the one place the two doors answer differently; declared. A stack that names the same object in two packages: the driverless registry re-registers under __runtime__ and holds the LAST definition (probed), while a booted engine's cross-package collision is error unless OS_METADATA_COLLISION=warn (registry.ts:1873); contrived, unmeasured at a public door.
• Object writes that retype a field an existing policy names are not re-judged (declared; runtimeTypes: ['permission']); os validate over the whole stack catches it.
• Non-read-scope predicates (update/delete-only using, every check) never reach the engine's field-type doors at either door; consistent with ruling C, outside the fifteen classes; a follow-up would need the driver/evaluator faces, not this judge.
• The [] binding hides member-dependent temporal refusals on app-staged membership sets (named in ①.4).
• [finding] $ne with an array comparand splits across backends: driver-sql and driver-memory refuse (400), driver-mongodb answers, formula matches every row — and both shared faces pass it #19886 remainder (the lint arm for field-vs-multi-valued-field comparison) is serial after this PR, per the seat ACCEPT.
• The authoring-rule-threw and unknown-object behaviours are the two untested edges; everything the body claims about verdicts, sentences, the hatch (OS_ALLOW_UNLINTED_METADATA_WRITES=1 → loud warn, write lands), draft-then-publish (draft accepted unjudged, publishMetaItem refused 422) and the re-save differential was reproduced.

Implemented-by: claude/issue-20158-rls-policy-authoring-admission
Reviewed-by: session_01Rjy9MeetSfq34PKn81CRiN

VERDICT: PASS

---

Generated by Claude Code