[Decision] DataScopeManager under ADR-0049: retire it, or canonicalise its operator vocabulary — the spec's real RLS vocabulary is a CEL predicate, not a RowLevelFilter #7750

Activity

1. claude

   added

   pm:queue

   finding

   priority:p2

   security

   domain:uiobjectui ui stream: fix lands on the published library or apps — objectui execution seatobjectui ui stream: fix lands on the published library or apps — objectui execution seat

   on Sep 5, 2026
2. os-steve

   added

   needs-user-decision

   and removed

   pm:queue

   on Sep 6, 2026
3. os-steve commented on Sep 6, 2026

   

   os-steve

   on Sep 6, 2026 – with Claude

   Collaborator

   More actions

   Half-state repaired + four-facet analysis — into the decision box

   domain:ui seat, session_01QnpvbdoRisQdRAczkLwnf5, R1, 2026-09-06T11:40Z.

   State transition, one stroke: pm:queue → needs-user-decision. finding · priority:p2 · security · domain:ui retained.

   ⚠️ Why this was a half-state: the card's own body says 「⛔ So this is a decision card, not an implementation card. Do not dispatch it as "add canonicalisation".」 — and it was sitting in pm:queue, the label that means a dev may take this. A card that says "do not dispatch me" wearing the dispatchable label costs every PM pass a re-derivation, and risks exactly the dispatch it forbids. Filed with the wrong label at birth (2026-09-05T14:46Z); no comment had touched it since.

   ⭐ A correction I owe this card, in the other direction: my seat post said "⛔ do not dispatch #7751 until #7750 is routed". That is wrong, and this card's own body says so: 「⛔ The two pre-existing hardening gaps … are objectui#7751 — split out deliberately, because they are independently actionable today whichever way this decision goes.」 #7751 is dispatchable now and is going back into the candidate pool. Corrected on the seat post.

   Governing text: ADR-0049 (enforce-or-remove) · objectstack packages/spec/src/security/rls.zod.ts:394 (the platform's real RLS is a CEL predicate lowered to an ObjectQL filter; anything that does not lower fails closed) · objectui AGENTS.md #0.1 (contract-first).

   ---

   四棱 — four-facet analysis

   ① 实际业务需求 — measured, not asserted. In-repo constructors of a RowLevelFilter: 0. objectstack: 0 (lit control canonicalAstOperator fires, 3 files). hotcrm: does not depend on @object-ui/core. Org-wide code search: every hit is inside objectui itself (control fires in both repos, 17 hits). No React provider wires DataScopeManager; @object-ui/types' DataScope / DataContext carry no filters at all. ⇒ No demonstrated pull. ⚠️ One hole, and it is the whole gate: cloud was not visible to the filing session — unmeasured, ⛔ not zero.

   ② 项目长远合理性. DataScopeManager is a third hand-written evaluator vocabulary, beside @object-ui/permissions' evaluateCondition and the spec's own CEL lowering. One rule with three drifting definitions is the defect shape this lane has been closing all week. Contract-first converges on the platform's lowering; canonicalisation would make objectui's copy a fourth spelling with its own semantics.

   ③ 防 AI 写错 — this facet is decisive, and it points hard at retirement. Canonicalising moves 44 of 53 VALID_AST_OPERATORS (and 18 of 20 VIEW_FILTER_OPERATORS) from refused to evaluated on a permission boundary, and three of those transitions are silent semantic changes, each measured on the card:

   • contains is case-sensitive here (DataScopeManager.ts:267) and case-insensitive in ValueDataSource (:125-129, which lowercases both sides) ⇒ copying the fix(core): teach ValueDataSource's matcher the filter vocabulary the wire already has #7377 precedent silently widens an existing permission rule.
   • operator: 'EQ' today takes the deny arm (probe → []); canonicalised it would evaluate, because canonicalAstOperator lowercases first.
   • is_empty / isempty lower onto is_null ⇒ emptiness answered as null-ness.

   ⇒ Widening an accept set on a security boundary, where three of the widenings are invisible, is the textbook case for tightening rather than tolerating. Retirement removes the surface; canonicalisation enlarges it and keeps the fail-closed default load-bearing either way (trap 2).

   ④ 创业阶段不扩散. Zero measured consumers ⇒ implementation-first. A published capability with zero consumption gets no sunk-cost exemption, and the 2026-08-27 ruling 「项目在创业阶段，用户也很少，短期不考虑渐进。」 forecloses a staged retirement window.

   四棱同向 ⇒ C（retire）. ⛔ And it is still yours to rule, not mine: this sits squarely on the manual floor twice over — a security / permission boundary, and the removal of a published capability. The auto-adjudication gate is therefore closed regardless of facet alignment. Recorded as a recommendation, ⛔ not a ruling.

   ---

   ⚠️ One reading must land before C can be executed — and this seat cannot take it

   cloud is not in this session's repository scope. Per the platform-reading rule, an unreachable repo is ⛔ never recorded as "checked and clean". Ready-made command for whoever holds the cloud seat — please post the output back on this card:

   git grep -nE 'DataScopeManager|registerScopeWithConfig|RowLevelFilter|setFilters\(|applyFilters\(' -- . 
   git grep -nc 'canonicalAstOperator' -- .    # lit control: MUST be non-zero, else the search proves nothing
   

   ⛔ If the control returns zero, the whole reading is NOT MEASURED and must be re-run — a zero on the target means nothing without it.

   ---

   维护者速读

   DataScopeManager 是 objectui 里一个自己手写的行级权限过滤器。问题是：平台真正的行级权限规格根本不长这样 —— spec 里是一条 CEL 谓词，降不下来就拒绝放行。所以这个类是同一件事的第三套写法。

   我们量过谁在用它：objectui 自己以外，一个都没有（objectstack 0、hotcrm 不依赖这个包、组织级代码搜索全部命中都在 objectui 内部；对照词能正常命中，所以这个零是真的零）。⚠️ 只有 cloud 仓没量到 —— 我这个会话看不见那个仓，所以是「没查」，不是「零」。

   两条路：

   • C：退役。 顺带把「操作符词表要不要对齐」这个问题一并消掉。
   • 对齐操作符词表。 代价是把 53 个操作符里的 44 个从「拒绝」变成「会真的去求值」，而这是一条权限边界。其中三处是静默变语义的：contains 会从区分大小写变成不区分（等于悄悄放宽了已有的权限规则）、'EQ' 会从「拒绝」变成「求值」、is_empty 会被当成 is_null 回答。

   四条评估轴全部指向 C。但这既是安全边界、又是删除已发布能力，两条都在人工地板上，所以我只给建议、不代裁。

   要你定一个字：C（退役），还是对齐词表？ 若选 C，我先去要 cloud 那份读数再动手。

   ---

   Generated by Claude Code
4. os-zhuang commented on Sep 7, 2026

   

   os-zhuang

   on Sep 7, 2026 – with Claude

   Contributor

   More actions

   Ruling recorded — option C, retire DataScopeManager under ADR-0049 (director seat, decision batch #66, 2026-09-07)

   Maintainer reply, verbatim: 「同意」 (all five batch #66 recommendations adopted).

   The one reading this card was waiting for — objectstack-ai/cloud, read by the director seat at origin/main a37ba7e7:

   probe	result
   DataScopeManager / registerScopeWithConfig / RowLevelFilter / setFilters( / applyFilters( over *.ts, *.tsx	0 files
   @object-ui/core (any import or dependency)	0 — cloud does not depend on the package at all (it does depend on other @object-ui/* packages: 16 files, so the @object-ui/ grep fires)
   positive control on the same instrument: ArtifactKernelFactory	36 files

   ⇒ Every population is measured: zero consumers in objectui, objectstack, hotcrm and cloud.

   Ruling. DataScopeManager and its RowLevelFilter vocabulary are retired. The platform has one row-level-security language — the CEL predicate lowered to an ObjectQL filter in @objectstack/spec (rls.zod.ts:394, fail-closed) — and objectui does not keep a third hand-written evaluator beside it. Canonicalising through canonicalAstOperator is refused: on a permission boundary it would move 44 of 53 operators from refused to evaluated, with three silent semantic changes the card measured (contains case-folding, 'EQ' from deny to evaluate, is_empty answered as is_null).

   Execution notes. Remove the class, the RowLevelFilter type and their barrel exports from @object-ui/core; regenerate the package's surface pin; changeset states the removed public API (major per the package's policy; no alias, no window — maintainer 2026-08-27). Clause-② yes ⇒ landing PR carries needs:contract-review. #7751 (the two hardening gaps) is independent and already closed; nothing here reopens it. #7379 / #7383 become moot for this evaluator once it is gone — note that on them at landing.

   Labels: needs-user-decision → pm:queue (security retained). Ledger on objectstack#12708 (batch #66).

   ---

   Generated by Claude Code
5. os-zhuang

   added

   pm:queue

   and removed

   needs-user-decision

   on Sep 7, 2026
6. os-tesla

   added

   pm:retriageQuestion for triage, answered each fire; coexists with the standing pm:* label; no dispatchQuestion for triage, answered each fire; coexists with the standing pm:* label; no dispatch

   on Sep 18, 2026
7. os-tesla commented on Sep 18, 2026

   

   os-tesla

   on Sep 18, 2026 – with Claude

   Collaborator

   More actions

   pm:retriage — 异议:本卡在 pm:queue 里,而它正文第一段就禁止派发

   domain:ui#2 执行席,session_018HrVaotisyhgmot9o2MLRq,2026-09-18T22:39Z。⛔ 本席不改级别、不改路由、不摘任何现有标签;本笔只加 pm:retriage 并写下异议,处置归分诊席。

   所求

   把本卡从 pm:queue 移到 needs-user-decision,或说明为什么它应当留在派发池里。

   依据 —— 卡面自己的话,原样引用

   ⛔ So this is a decision card, not an implementation card. Do not dispatch it as "add canonicalisation."

   而且这不是立卡席自己的偏好:它是契约复审在处置 PR objectui#7748 的边界标记时下的条件,同样原样引用:

   The follow-up must be filed as the ADR-0049 liveness decision, with canonicalisation only as a dependent option on that card, never as a standalone implementation card.

   ⇒ 「canonicalisation」只能作为本卡上的从属选项存在。而本卡今天的状态恰恰让它可以被当作一张独立实现卡取走:pm:queue + 无 assignee + 无 needs-user-decision ⇒ 在候选集里。pm:retriage 当场关上这扇门,这是本笔的全部作用。

   ⚠️ 本卡还带 security 标签,且问题是 ADR-0049 下 DataScopeManager 的存废。安全/权限边界与「删已发布能力」都在人工地板上,⛔ 代裁通道不覆盖它。

   ⛔ 本席核到哪一步为止

   只读了本卡的标签、正文前段与它引用的复审条件。⛔ 未重测那条 spec 读数(objectstack/packages/spec/src/security/rls.zod.ts:394,「RLS 的真实词汇是一条 CEL 谓词,不是 RowLevelFilter」)—— 那是立卡席的读数,分诊席若要据它定形,应当在源上重取一次。

   ---

   _{domain:ui#2 执行席 · session_018HrVaotisyhgmot9o2MLRq · 本卡的标签与正文于本动作 2026-09-18T22:39Z 现读;⛔ 本笔未做任何源码读数。}

   ---

   Generated by Claude Code
8. objectstack-fleet

   added

   pm:dispatched

   and removed

   pm:queue

   on Sep 25, 2026
9. objectstack-fleet

   assigned

   os-elon-musk

   on Sep 25, 2026
10. objectstack-fleet commented on Sep 25, 2026

    

    objectstack-fleetbot

    on Sep 25, 2026

    Last edited by objectstack-fleet

    Contributor

    More actions

    Claim: PM loop round 4 — domain:ui execution seat 2
    Session: session_014mXUNuFomfj24w7s1pZzhN
    Branch: claude/issue-7750-retire-datascopemanager
    Worktree: objectui-issue-7750
    Domain: domain:ui
    Seat: domain:ui#2
    File surface: packages/core/src/data-scope/DataScopeManager.ts and its two tests under data-scope/__tests__/ (deleted), packages/core/src/data-scope/index.ts (the DataScopeManager / defaultDataScopeManager / RowLevelFilter / DataScopeConfig export block only; ViewDataProvider and element-data-source stay), @object-ui/core's regenerated surface pin, packages/core/README.md (its DataScopeManager section), content/docs/guide/architecture-overview.md and scripts/check-doc-example-types.mjs only where they name the removed symbols, the two packages/permissions/src/evaluator.ts docblock pointers to the deleted file, packages/permissions/src/__tests__/evaluator.prototype-guard-8044.test.ts (its header docblock, same dangling pointer; added by the seat after the dev report 5826395491, no open PR touches it), one .changeset/7750-…md (stop on breach; explain in the report)
    Container & model: M, mode:subagent, model: opus — dispatch-gates --tier: 「no path-derived mandate … floor sonnet · default opus · ceiling fable」; executes ruling 5564753628 (option C)
    Clause-②: yes
    Thread-read: 5737038743
    Serial constraints cleared: the @object-ui/core barrel and surface pin were held by this seat's PR objectui#10426 (objectui#7508), merged 1237ae4. Open-PR file lists read 2026-09-25T02:56Z: draft PR objectui#10169 edits packages/core/src/utils/ only; no open PR touches data-scope/, the core barrel, the surface pin or packages/permissions/src/evaluator.ts. Seat 4's objectui#10301 claims packages/core/src/utils/date-display.ts only. pm:retriage objection 5737038743 is superseded: the card body now opens with the ruling banner, and the label is gone.

    Clause-②: yes — the ruling removes a published class and type from @object-ui/core. The changeset is minor with a BREAKING body (objectui AGENTS.md: changesets never declare major; check-changeset-no-major enforces it), so the ruling's "major per the package's policy" reads as minor here. needs:contract-review goes on the landing PR.

    ---

    Generated by Claude Code
11. objectstack-fleet commented on Sep 25, 2026

    

    objectstack-fleetbot

    on Sep 25, 2026

    Contributor

    More actions

    os-dev-report
    {
    "issue": 7750,
    "status": "done",
    "branch": "claude/issue-7750-retire-datascopemanager",
    "pr": "#10467",
    "session": "session_014mXUNuFomfj24w7s1pZzhN — mode:subagent, so this is the parent PM session's id (container CLAUDE_CODE_REMOTE_SESSION_ID cse_014mXUNuFomfj24w7s1pZzhN)",
    "premise_still_valid": true,
    "summary": "Ruling 5564753628 (option C) is implemented in draft PR #10467 at head ee616cc (base ab50ccc). @object-ui/core no longer exports DataScopeManager, defaultDataScopeManager, type RowLevelFilter or type DataScopeConfig. The class file and its two test files are deleted, and the four-name block is gone from data-scope/index.ts. ViewDataProvider, the element data-source exports and the core barrel line export * from './data-scope/index.js' are kept. DataScopeConfig was read only by the class's registerScopeWithConfig, so it went with the class. The core README's Data Scope section is now Expressions (evaluateExpression alone), the architecture overview's data-scope line names what is left, the doc-example ledger row for the deleted @example is removed, and the evaluator.ts docblock pointers now cite only issues and keep their point about the guard. The changeset is '@object-ui/core': minor with a BREAKING body (no replacement, CEL-policy migration, and one paragraph reconciling the three pending entries that describe the class). The PR is assigned to os-elon-musk (read back) and stays draft. The card's assignee was not written.",
    "hypotheses": [
    "H1 CONFIRMED: the removal set was exactly the class, its two tests and the data-scope/index.ts export block; the core barrel re-exports ./data-scope/index.js wholesale (line 60) and stays. DataScopeConfig has no reader outside the class, so it goes with it (word grep: class, its tests and barrel only).",
    "H2 PARTLY FALSIFIED: besides the listed hits, packages/permissions/src/tests/evaluator.prototype-guard-8044.test.ts (header docblock: the deleted file's path and the class name) and a third pending changeset, .changeset/permissions-evaluator-prototype-guard-8044.md, also named the class. The test docblock is repaired in place (see deviations); the changeset is reconciled in the new changeset's paragraph, not edited. On the head the grep hits only the three pending changesets. DataContext (@object-ui/types) has no implementer and no consumer left in-repo (declaration plus types barrel only); DataScope is read only by DataContext. Neither was removed.",
    "H3 FALSIFIED: no surface pin exists for @object-ui/core. PR #10426 (1237ae4) regenerated no artefact: its 25-file diff has no generated file. scripts/dump-public-manifest.mjs dumps the SDUI component registration manifest from a browser build, not package exports. No committed json, snap or api file lists core's exports (control composeElementDataSource: 0 hits there). Nothing to regenerate. The instruments that read core's export set are check:readme-exports (TS getExportsOfModule on the built dist/index.d.ts) and check:doc-examples (its UNGATED_EXAMPLES ledger); both shown red on the removal commit, green on head.",
    "H4 CONFIRMED in-repo: zero consumers outside the class, its tests, docs and changesets; lit control ViewDataProvider = 16 files. cloud not re-measured (per order)."
    ],
    "files_changed": [
    "D packages/core/src/data-scope/DataScopeManager.ts",
    "D packages/core/src/data-scope/tests/DataScopeManager.test.ts",
    "D packages/core/src/data-scope/tests/DataScopeManager.hardening.test.ts",
    "M packages/core/src/data-scope/index.ts",
    "M packages/core/README.md",
    "M content/docs/guide/architecture-overview.md",
    "M scripts/check-doc-example-types.mjs",
    "M packages/permissions/src/evaluator.ts",
    "M packages/permissions/src/tests/evaluator.prototype-guard-8044.test.ts",
    "A .changeset/7750-retire-datascopemanager.md"
    ],
    "tests": "RED on removal-only commit 094a2bd (core dist rebuilt clean): check-readme-exports exit 1 '1 README import name(s) NO package exports' naming packages/core/README.md import { DataScopeManager } from '@object-ui/core' (export symbols 3379 on base, 3375 here); check-doc-example-types exit 1 'STALE LEDGER ROW packages/core/src/data-scope/DataScopeManager.ts DataScopeManager #1'; scripts/tests/check-doc-example-types.test.ts '1 failed | 60 passed' (the real ledger / every row names a block that is actually in the compiled tier). BASE ab50ccc: both gates exit 0. GREEN at head ee616cc: check-readme-exports exit 0 '543 real, 0 wrong-path, 0 fabricated', 3375 symbols; check-doc-example-types exit 0, 123 blocks, 88 rows, 'Every covered @example compiles, or fails exactly as its ledger row declares'; vitest check-pending-changeset-literals + check-changeset-no-major + check-doc-example-types tests 'Test Files 3 passed (3) / Tests 83 passed (83)', lock VERDICT command-exit 0. At 9bb75c6 (its tree differs from ee616cc only in 4 changeset lines, git diff --stat): vitest packages/core/ packages/permissions/ + two script tests 'Test Files 179 passed (179) / Tests 3663 passed (3663)', lock VERDICT command-exit 0; pnpm --filter core --filter permissions type-check both Done, VERDICT command-exit 0; check-doc-example-ids + check-doc-example-types tests 87 passed and type-check:scripts exit 0, VERDICT command-exit 0. Builds: full packages build at base 39/39 (VERDICT 0); core and permissions rebuilt after each change (dist-completeness OK). No ablation: the red/green legs above are the gates' own, read from the rebuilt dist.",
    "gates": [
    "ee616cc check-changeset-presence exit 0: '6 source file(s) of 2 released package(s) changed, and this change declares 1 changeset(s)'",
    "ee616cc check-changeset-fixed exit 0; check-changeset-no-major exit 0 'No changeset declares a major bump'; check-changeset-overwrite exit 0 'No pre-existing changeset was modified or deleted'; check:changeset-claims exit 0 'No pending changeset names a file this change touches' (report-only)",
    "ee616cc check:new-line-citations exit 0 'VERDICT new-cross-file-line-citations: 0 new citation(s), enforcement report-only'",
    "ee616cc check:control-bytes exit 0 'scanned 8513 tracked text file(s)'",
    "ee616cc check:readme-exports exit 0; check:doc-examples exit 0; docs:check-links exit 0 'Links are valid across 17 scan roots'; check:doc-snippets exit 0",
    "9bb75c6 check:doc-fences exit 0; check:doc-types exit 0; check:unreferenced-sources exit 0; check:doc-example-readers exit 0; check:esm-specifiers exit 0",
    "9bb75c6 eslint --no-inline-config --format json on the 4 touched lintable files: 4 files, 0 errors, 0 warnings. eslint.config.js has no parserOptions.project or projectService (no type-aware linting), so this diff cannot change a verdict on an untouched file. Repo-wide pnpm lint: NOT MEASURED, reason: CI-owned.",
    "governed-queue-guard --test on the 10 paths: NOT GOVERNED",
    "Consumer closure type-check (every @object-ui/core importer): NOT MEASURED locally, reason: left to CI Type Check; the tree-scoped absence grep with lit control is the local evidence"
    ],
    "deviations": [
    "File surface: packages/permissions/src/tests/evaluator.prototype-guard-8044.test.ts is outside the claim's list. Its header docblock cited the deleted file's path and the class, the same dangling-pointer class as the two evaluator.ts pointers. Repaired in place, comment only: all four conditions hold (same defect class, mechanical, the 12 open PRs' file lists read with no overlap, same gate family). Named in the PR body. The claim's file-surface line needs this path added by the seat.",
    "Surface pin: none exists (H3), so nothing was regenerated. The export-set readers are shown red then green instead.",
    "Trailers: the first local commit carried a model-named Co-Authored-By copied from the harness reminder. It was amended before any push, so every pushed commit carries the model-free pair Claude-Session + Co-authored-by: Claude. The PR footer uses the role file's session-URL form, not the harness's.",
    "Draft PR objectui#10169, which the order names as off-limits, is now closed; no open PR touches this surface."
    ],
    "seat_at_landing": [
    "Set the label needs:contract-review on PR #10467 (Clause-② yes). Not written by dev.",
    "Note on objectui#7379 and objectui#7383 that they are moot for this evaluator once #10467 lands (ruling 5564753628). Not written by dev.",
    "Add the permissions test path to the claim's file surface (deviation 1)."
    ],
    "mcp_calls": "0 — no MCP GitHub tool called, read or write",
    "api_writes": "3 relayed writes, each sent as one POST /repos/objectstack-ai/objectstack/dispatches (fleet-write relay): (1) pr_create = POST /repos/objectstack-ai/objectui/pulls (draft #10467, run 36091958244 success); (2) label-write assign = POST /repos//issues/10467/assignees os-elon-musk (run 36092009714 success, read back MATCHES); (3) this os-dev-report = POST /repos//issues/7750/comments via post-stamped.mjs. Zero label writes. git push (not REST): empty-branch probe, 094a2bd, 9bb75c6, ee616cc.",
    "open_questions": [],
    "out_of_scope_findings": [
    "carrier: 承接者:无 · DataContext and DataScope in @object-ui/types have no implementer or consumer left in this repo after this PR (observation, zero pull, not ruled). Noted in the PR's Acceptance notes, not filed."
    ]
    }

    ---

    Generated by Claude Code
12. objectstack-fleet commented on Sep 25, 2026

    

    objectstack-fleetbot

    on Sep 25, 2026

    Contributor

    More actions

    ✅ ACCEPT: objectui#10467 at ee616cc; ready + auto-merge in this act

    domain:ui seat #2, session_014mXUNuFomfj24w7s1pZzhN. I checked this against the diff and CI, not against the report's own account. It executes ruling 5564753628 (option C, retire DataScopeManager under ADR-0049).

    Implemented-by:  claude/issue-7750-retire-datascopemanager
    Reviewed-by:     session_014mXUNuFomfj24w7s1pZzhN
    

    item	reading
    removal	DataScopeManager, defaultDataScopeManager, RowLevelFilter and DataScopeConfig are gone from @object-ui/core. The class file and its two tests are deleted. DataScopeConfig was read only by the class's registerScopeWithConfig (at head and in the published 17.6.0 typings), so it goes with it
    nothing else moved	the core barrel is unchanged (export * from './data-scope/index.js' kept). The ViewDataProvider block (4 names) and the element-data-source block (14 names) are byte-identical at base and head
    consumers	zero at head outside .changeset/ (the reviewer's grep, with lit control ViewDataProvider at 18 files). Main has moved 6 commits since the base and added no new reader
    "regenerate the surface pin"	moot, with evidence. @object-ui/core has no committed export pin (dist pins exist only for components and types), and PR objectui#10426 regenerated no artefact. The instrument that reads core's export set is check-readme-exports: the dev showed it red on the removal-only commit and green on the head. The ruling and this seat's claim both assumed an artefact that does not exist ⇒ Acceptance notes
    @object-ui/permissions	comment-only docblock rewrites in evaluator.ts and the 8044 test header, so no pointer names the deleted file. No exported declaration changes. The test path was added to the claim after the report (claim 5825926928, edited)
    Clause-②: yes	a published class and three types leave @object-ui/core
    contract review	PASS at CONTRACT_REVIEW_TIER on this head, record 5826508852 (the seat read the reviewer transcript: every turn at tier)
    semver	'@object-ui/core': minor with a BREAKING body. objectui AGENTS.md §9 says changesets never declare major, and check-changeset-no-major enforces it. Precedent: 0348bc9. The migration sentence holds: @object-ui/core@17.5.0 is on npm and its git tag still carries the class. The spec's RowLevelSecurityPolicySchema.using is the CEL predicate that fails closed
    governed	NOT GOVERNED (10 paths)
    CI	43 check-runs on ee616cc: 40 success, 3 skipped by design, 0 red. Type Check covers the consumer closure
    closing keywords	the body's only closing reference is Fixes #7750

    Findings, each with its disposition

    • The ruling asks for a note on objectui#7379 and objectui#7383 at landing. Both are already closed (core: ValueDataSource's contains is case-INSENSITIVE, so it executes icontains semantics — the spec keeps the two operators deliberately distinct #7379 completed, finding(core): like / ilike are spec-valid AST operators that ValueDataSource's in-memory matcher does not implement — now refused loudly instead of matching every row #7383 not_planned), and both concern ValueDataSource, not this class ⇒ no note written.
    • Observation: DataContext and DataScope in @object-ui/types have no implementer or consumer left in objectui after this PR. There is no pull and no ruling, so it is not filed ⇒ Acceptance notes.
    • needs:contract-review is not hung: a same-head PASS is on file at ACCEPT (contract-review.md).

    State

    ready and auto-merge (squash) go through the relay ops pr_ready + automerge_enable in this act. The PR assignee is already the card's.

    ---

    Generated by Claude Code
13. objectstack-fleet

    closed this as completedin #10467on Sep 25, 2026
14. objectstack-fleet

    removed

    pm:dispatched

    on Sep 25, 2026
15. akarma-synetal

    added a commit that references this issue on Sep 28, 2026

    feat(core)!: retire DataScopeManager and its row-level filter types (…

    ...

    93fea2e