feat(spec): the RLS deny sentinel and the composed ReadableIds leaf, declared once in the data entry; getReadFilter answers the one object (ADR-0139 D2) by objectstack-fleet[bot] · Pull Request #23144 · objectstack-ai/objectstack

feat(spec): the RLS deny sentinel, the composed ReadableIds leaf and its driver case-set, declared once in the data entry (ADR-0139 D2, D3)

claude

committed

7bb4207

fix(plugin-security): every getReadFilter deny is the spec's RLS_DENY_FILTER by reference, and the tenant-wall recogniser decides by identity (ADR-0139 D2 step 2)

claude

committed

d61c34e

test(spec): the ReadableIds conformance oracle reads the fixture through typed copies (test-typecheck)

claude

committed

3b7b7ea

chore(spec): regenerate api-surface and export-origins for the new data-entry exports

claude

committed

9e0bd3b

refactor(spec): park READABLE_IDS_CASES off this change — the driver-conformance gate makes it land with the driver suites or a maintainer-agreed ledger

claude

committed

5e292f4

chore(spec): regenerate api-surface and export-origins after parking the case-set

claude

committed

4150172

chore: changeset for the spec-declared RLS deny sentinel and composed ReadableIds leaf; plugin-security binds the sentinel under its published type

claude

committed

8393517

test(plugin-security): the tenant wall's deny projection is pinned to the sentinel's reference, not a copy (ADR-0139 D2 step 2)

claude

committed

41ce7b8

docs(spec): the deny sentinel's provenance anchor names its file from the repo root (check-spec-docblock-symbol-anchors)

claude

committed

ea300e1

test(plugin-security): the identity pins' engine double carries no findOne — no deny path reads a row

claude

committed

828798a

chore: the changeset's headline and identity bullet say which getReadFilter answers are the sentinel, and that a composed $and and the sharing layer's own deny are not

claude

committed

e7221cb

fix(spec): isComposedReadableIds refuses a value that also carries the uncomposed brand, and the scope wording says non-null, non-array object (contract review A1, A2)

claude

committed

2b176bd

Navigation Menu

Repository navigation

feat(spec): the RLS deny sentinel and the composed ReadableIds leaf, declared once in the data entry; getReadFilter answers the one object (ADR-0139 D2) - #23144

feat(spec): the RLS deny sentinel and the composed ReadableIds leaf, declared once in the data entry; getReadFilter answers the one object (ADR-0139 D2)#23144
objectstack-fleet[bot] merged 12 commits into
mainfrom
claude/issue-23009-rls-deny-sentinel

Commits on Oct 13, 2026

feat(spec): the RLS deny sentinel, the composed ReadableIds leaf and its driver case-set, declared once in the data entry (ADR-0139 D2, D3)

fix(plugin-security): every getReadFilter deny is the spec's RLS_DENY_FILTER by reference, and the tenant-wall recogniser decides by identity (ADR-0139 D2 step 2)

test(spec): the ReadableIds conformance oracle reads the fixture through typed copies (test-typecheck)

chore(spec): regenerate api-surface and export-origins for the new data-entry exports

refactor(spec): park READABLE_IDS_CASES off this change — the driver-conformance gate makes it land with the driver suites or a maintainer-agreed ledger

chore(spec): regenerate api-surface and export-origins after parking the case-set

chore: changeset for the spec-declared RLS deny sentinel and composed ReadableIds leaf; plugin-security binds the sentinel under its published type

test(plugin-security): the tenant wall's deny projection is pinned to the sentinel's reference, not a copy (ADR-0139 D2 step 2)

docs(spec): the deny sentinel's provenance anchor names its file from the repo root (check-spec-docblock-symbol-anchors)

test(plugin-security): the identity pins' engine double carries no findOne — no deny path reads a row

chore: the changeset's headline and identity bullet say which getReadFilter answers are the sentinel, and that a composed $and and the sharing layer's own deny are not

fix(spec): isComposedReadableIds refuses a value that also carries the uncomposed brand, and the scope wording says non-null, non-array object (contract review A1, A2)