[objectstack-fleet]

Clause-②: yes (widening)
Metadata-protocol: none

维护者速读

• 改了什么:按 id 的更新/删除在写前复读该行时,存储故障按原样抛出;平台自己拼进复读的租户墙与行级写谓词标记为平台所有,"调用方谓词守卫"只审调用方自己的过滤条件;主从(controlled_by_parent)写对主记录的复读同样处理。
• 为什么改:复读只有声明式拒绝才算记录级 403,存储故障按其本身报告;调用方谓词守卫只审调用方自己写的谓词,平台拼出并标记为平台所有的谓词(写复读、主记录复读、分析读范围、共享读范围)不在其列。
• 风险与回滚:放宽面只限于"平台拼出并标记的谓词不由守卫审";调用方自己的谓词照审,读不到的行与不存在的 id 答法与其他调用方一致;squash 落地后单 commit 可整体 revert。主从写对主记录的复读遇存储故障仍答 403(沿用该处注释所记裁决);它是否也应像 step 2.7 那样按原样抛出存储故障,是安全席列在其清单上、待维护者裁决的一项。
• 先看:security-plugin-authz-middleware.ts(step 2.7 复读处)、predicate-guard.ts(collectConditionFields 跳过 policy 子树那一行)、security-plugin-cbp-write-gate.ts(主记录复读)。
• 两分钟验证:pnpm --filter @objectstack/plugin-security exec vitest run --maxWorkers=2 src/by-id-write-row-reread.posture.test.ts,预期 19 passed;分析面 pnpm --filter @objectstack/rest exec vitest run --maxWorkers=2 src/analytics-platform-scope-predicate-guard.test.ts,预期 2 passed。
• 需要你做的:无,席位落地。

What changes

Before an update or delete by id, the security middleware re-reads the addressed row under the caller's context together with the platform's write predicates for that row (the tenancy wall and the row-level write predicates). Two rules hold for that re-read (step 2.7), and the second also for the controlled-by-parent master read a detail write asks (step 2.8):

1. A store fault propagates as raised; only a declared refusal keeps the record-level answer. The re-read's outcome is classified by readUnlessRefused, the one classification the write doors already use for a caller-context read: a row or no row; a declared 4xx keeps the record-level 403 PERMISSION_DENIED, one answer whatever the id names; anything else is the write's answer, unchanged (for ERR_DATASOURCE_UNAVAILABLE the transports answer 503). The step 2.8 master read keeps its 403 for every failure (its own comment records why); this PR does not change that catch.
2. The platform's own predicates are not the caller's predicate. The write predicates ride into the re-read under one fresh $and stamped 'policy' with the spec's filter-subtree provenance mark (markFilterSubtreeProvenance, the mark step 3 already stamps on every read scope it injects), and the field-level predicate guard (collectConditionFields) does not judge a subtree so marked. An unmarked subtree, or one with any other mark, is judged as the caller's, and the mark does not survive a copy, a serialization or the wire. No second guard and no second read: the one re-read is asked once, and the one guard reads the existing mark.

Where the rule reaches: every 'policy'-marked subtree that arrives at the guard inside a caller-context read — the step 2.7 re-read and the step 2.8 master read above, the analytics read-scope merge (withReadScope and its foreign-key expand) handed to an aggregate under the caller's context, and a record-sharing read scope composed before this middleware. Only platform-composed predicates are exempt; nothing the caller writes is.

Unchanged: a caller's own filter on a field it cannot read is refused (read, analytics query and predicate write); a row the caller cannot read and an id naming no row answer as they do for every other caller; a row the caller reads but may not write keeps its 403; a system write is not the gate's; the predicate write's read question still guards the caller's verbatim predicate.

Tests

• by-id-write-row-reread.posture.test.ts (new; real ObjectQL over SQLite, real SecurityPlugin, postures group and isolated, single as control):
  • a store fault raised by the re-read is the write's answer, the same error object, nothing written; a declared 4xx keeps the record-level 403, identical for a row and for no row; with the store answering, the same writes land.
  • a caller whose field rules hide the organization column updates and deletes a row of its organization by id; a row of another organization and an id naming no row answer that caller exactly as they answer a caller who reads the column (404 RECORD_NOT_FOUND), nothing written; the caller's own predicate on the column is still refused on a read and on a predicate write; a system write lands.
  • a controlled-by-parent detail insert by a caller whose field rules hide the master's organization column is admitted under a master of its organization; a master of another organization answers it what it answers a caller who reads the column.
  • an organization administrator whose field rules hide both assignment tables' organization column removes an in-boundary assignment by id (sys_user_position, sys_user_permission_set), admitted as for an administrator who reads the column.
• predicate-guard.test.ts: a 'policy' subtree is not collected nor anything beneath it; the caller's own predicate beside it is still refused; an unmarked subtree, an 'author' subtree, a spread copy and a JSON copy of a 'policy' subtree are all judged.
• packages/rest/src/analytics-platform-scope-predicate-guard.test.ts (new; real ObjectQL, real SecurityPlugin under group and isolated, real AnalyticsServicePlugin on the engine-aggregate strategy): a caller whose field rules hide the scoped organization column counts the records of its organization, the same count as a caller who reads the column; its own filter on that column is refused 403 PERMISSION_DENIED.
• authz-matrix-gate.test.ts: the Layer 0 matrix helper reads the write predicates from the re-read's platform subtree (the re-read is { $and: [{ id }, PLATFORM] }); every matrix expectation is unchanged.

Acceptance notes

• The organization administrator's assignment-removal pin depends on the stored-row verdict that landed in fix(plugin-security): an organization administrator's assignment removal is judged on the stored row, and its refusal names only values the caller can read #30248 (merged into this branch from main); the delegated-administration gate itself is not touched here.
• The step 2.8 master read keeps its catch-all 403 (its own comment records the ruling it follows), so the two differ for a store fault only; whether it should follow step 2.7 is left to the seat.

Verification

Readings are on head 6c7ff71e5e unless named otherwise. 6c7ff71e5e changes no source file over 8a92cab832 (a merge of main into cc1fbac302): it brings the three sys_user self-service pins that assert the by-id re-read's where verbatim to the re-read's shape (the platform's write predicates as one nested $and beside { id }), with that file's row-scope sentence and two plugin-security test comments; each pin's verdict half (the refusing layer, the error code) is unchanged. The PR's source, changeset and earlier test files are byte-identical across cc1fbac302, 8a92cab832 and 6c7ff71e5e, so the earlier ablation readings and the dogfood reading on b6b340a3db stand for that source.

Suites and type checks

• pnpm --filter @objectstack/plugin-auth exec vitest run --maxWorkers=2 src/sys-user-self-service-route.test.ts, under the verify lock: on 8a92cab832 Tests 3 failed | 9 passed (12), the same three pins Test Core (8/8) read red on that head, each diff the nested $and; on 6c7ff71e5e Test Files 1 passed (1), Tests 12 passed (12), VERDICT command-exit 0.
• On 6c7ff71e5e, under the verify lock: the full plugin-auth suite, Test Files 224 passed (224), Tests 3954 passed | 10 skipped (3964), exit 0; the full plugin-security suite, Test Files 244 passed (244), Tests 5378 passed | 45 skipped (5423), exit 0; pnpm --filter @objectstack/plugin-auth typecheck and pnpm --filter @objectstack/plugin-security typecheck, VERDICT command-exit 0 (check:test-typecheck OK on both).
• CI on 6c7ff71e5e: Test Core success, every shard success; Test Core (8/8) reads plugin-auth Test Files 224 passed (224), Tests 3954 passed | 10 skipped (3964) and plugin-security Test Files 244 passed (244), Tests 5379 passed | 45 skipped (5424); TypeScript Type Check, Lint & Repo Gates, Build Core, Dogfood Regression Gate, Live E2E UI, Test UI and Governed Surface Queue Guard success.
• On cc1fbac302, under the verify lock: pnpm --filter @objectstack/plugin-security typecheck exit 0 (check:test-typecheck OK); by-id-write-row-reread.posture.test.ts, predicate-guard.test.ts, authz-matrix-gate.test.ts: Test Files 3 passed (3), Tests 111 passed (111); packages/rest analytics-platform-scope-predicate-guard.test.ts and analytics-masked-field-gate.test.ts: Test Files 2 passed (2), Tests 12 passed (12); pnpm --filter @objectstack/rest typecheck exit 0 (check:test-typecheck OK).
• On b6b340a3db: the full plugin-security suite, Test Files 243 passed (243), Tests 5349 passed | 45 skipped (5394), VERDICT command-exit 0.

One-shot ablations (each restored, blob equal to HEAD, `git diff HEAD` empty)

• Rule 1, the re-read's classification replaced: 2 failed, red, then restored.
• Rule 2, step 2.7 mark removed: 4 failed, red, then restored.
• Rule 2, step 2.8 mark removed: 2 failed, red, then restored.
• Rule 2, guard skip removed: 7 failed, red, then restored.
• Rule 2, step 2.7 mark removed, against the organization administrator's pin: 2 failed, red, then restored.
• Rule 2, guard skip removed, against the analytics pin (plugin-security rebuilt, the removal confirmed absent from dist/ by ablation-dist-preflight): 2 failed, red, then restored and rebuilt.

Gates

node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack on 6c7ff71e5e derived 62 commands; all 62 run, every exit code captured before any pipe, every one 0; --ran reconciliation: 62 derived, 62 run, 0 NOT-MEASURED (a derived zero). check:dual-build-cjs-loads, check:i18n and check:type-check-debt read exit 3 (prerequisite: built output) in the first pass and 0 once run with the package tree built under the lock. On cc1fbac302: 61 derived, all 61 0.

Dogfood

No ! in the title and no narrowing arm, so not the full battery: the ten dogfood files that drive by-id and predicate writes (write-door-unreadable-is-not-found, update-by-id-refusal-order, occ-stale-token-organization-wall, owner-anchor-and-bulk-writes, showcase-invoice-cbp, authored-row-write-scope, showcase-fls-read-mask-strip, delegated-admin-assignment-write-unreadable-row, predicate-write-unreadable-not-matched, cbp-parent-attachment-comment-gates), closure built, under the verify lock, on b6b340a3db: Test Files 10 passed (10), Tests 107 passed (107), VERDICT command-exit 0.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/plugin-security, touching 3 documentable anchor(s).

1 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/permissions/system-context.mdx (via registerAuthzMiddleware (symbol, a top-level function))

What this run could not see

• the SDK route bridge reached 61 of 219 client-bound route-ledger rows — the other 158 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 158: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 55 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 103 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 17 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json f18adce2f65b9de8ce3b7de1c3ba870bebb53420 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 19c1c3f65f9e1e34fa43f7e50b2a4a190aee7fed — the merge of head 6c7ff71e5e53ef2fc6f62ad391d033f6eda49d33 into base f18adce2f65b9de8ce3b7de1c3ba870bebb53420, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 19c1c3f65f9e1e34fa43f7e50b2a4a190aee7fed && git checkout 19c1c3f65f9e1e34fa43f7e50b2a4a190aee7fed
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin f18adce2f65b9de8ce3b7de1c3ba870bebb53420 6c7ff71e5e53ef2fc6f62ad391d033f6eda49d33 && git checkout -B drift-repro f18adce2f65b9de8ce3b7de1c3ba870bebb53420 && git merge --no-ff 6c7ff71e5e53ef2fc6f62ad391d033f6eda49d33

node scripts/docs-audit/affected-docs.mjs --json f18adce2f65b9de8ce3b7de1c3ba870bebb53420

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs f18adce2f65b9de8ce3b7de1c3ba870bebb53420 → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[objectstack-fleet]

security#1 · os-justin · session_01QSeKYn5CmmdShCJifm6WYj

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: b6b340a3db9bf6254c5941f56c410bc3fe85e74b
Local-runs: none
Scope: packages/plugins/plugin-security/src/security-plugin-authz-middleware.ts, packages/plugins/plugin-security/src/security-plugin-cbp-write-gate.ts, packages/plugins/plugin-security/src/predicate-guard.ts, packages/plugins/plugin-security/src/by-id-write-row-reread.posture.test.ts, packages/plugins/plugin-security/src/predicate-guard.test.ts, packages/plugins/plugin-security/src/authz-matrix-gate.test.ts + packages/spec/src/data/filter-subtree-provenance.ts, packages/spec/src/data/filter-lowering.ts, packages/spec/src/data/readable-ids.ts, packages/plugins/plugin-security/src/security-plugin.ts (readUnlessRefused, callerCannotReadAddressedRow, copyOfCallerPredicate), packages/plugins/plugin-security/src/security-plugin-addressed-writes.ts, packages/plugins/plugin-security/src/rls-compiler.ts, packages/plugins/plugin-security/src/rls-check-stored-form.ts, packages/plugins/plugin-sharing/src/sharing-plugin.ts, packages/services/service-analytics/src/strategies/objectql-strategy.ts, packages/objectql/src/engine.ts (findOne), packages/objectql/src/engine-find.ts, packages/objectql/src/engine-readable-ids-permission-formula.ts, packages/objectql/src/external-driver-floor.ts, packages/objectql/src/filter-comparand-shape.ts, packages/core/src/utils/readable-ids-driver-refusal.ts, packages/drivers/driver-sql/src/sql-driver.ts, packages/drivers/driver-sql/src/sql-driver-read-exit-fault.ts, packages/types/src/data-error-classification.ts (declaredHttpStatus)

Inputs read: PR #30307 body and file list, the net diff against main at the head above (7 files, +550/-19), the head's check-runs, and the cited code at the head. Check-runs as read at 2026-11-05 05:54 UTC: every concluded run is success or skipped (Build Core, TypeScript Type Check, Lint & Repo Gates and all Lint/Type Check lanes, Governed Surface Queue Guard, Test UI, Live E2E UI, Dogfood Regression Gate, Check Changeset, Check PR Size, PR-body guards); Test Core shards 3, 5, 6, 7 success, shards 1, 2, 4, 8 still in_progress, so the required Test Core context had not concluded — not a pass yet.

① Derived judgments

1. Rule (1), step 2.7 — correct. The caller-context re-read's outcome is classified by readUnlessRefused, the classification the write doors already use (callerCannotReadAddressedRow, the predicate write's read question): a declared 4xx keeps the record-level 403 and skips the not-found question, one answer for a row and for no row; anything undeclared or 5xx propagates as raised, before anything is written. declaredHttpStatus reads status/statusCode in 400–599 only, so an undeclared store fault is never mistaken for a refusal.
2. Rule (2), step 2.7 and 2.8 — correct. The write predicates ride under one fresh $and node built at the call site and marked 'policy'; a frozen or shared member cannot leave the node unmarked (the mark is first-mark-wins and no-ops on frozen input, so marking the fresh wrapper rather than the members is the right choice). collectConditionFields stops at a 'policy' node and everything beneath it; an unmarked node, an 'author' node, a spread copy, a JSON copy and a structured clone are judged (the mark is a non-enumerable symbol key; none of those carries it). The mark reaches the guard on the real engine: findOne spreads the query into its AST without rebuilding where, and the token/lowering rewrites copy a replaced node's mark onto its replacement (filter-lowering.ts).
3. Rule (3) — holds. A row the caller cannot read and an id naming no row still reach callerCannotReadAddressedRow and answer not-found as for every caller; a row the caller reads but may not write answers 403; a caller the read door refuses answers 403 for every id; a system write is not the gate's; the predicate write's read question still copies and judges the caller's verbatim predicate. Pinned on a real engine under group and isolated with single as control (19 pins), plus the organization administrator's assignment removal.
4. No existence signal is added by rule (1): the re-read is asked for every id alike, and the propagated fault is the read door's own answer to this caller for a direct read of the same object, so the write door discloses nothing the read door does not.
5. The Layer 0 matrix helper now reads the platform subtree's members; every matrix expectation is unchanged — correct.
6. Public surface: collectConditionFields / assertReadableQueryFields are exported from @objectstack/plugin-security; their semantics widen (a marked platform subtree is no longer judged). Clause-②: yes (widening) is the right declaration.

② Semver level

@objectstack/plugin-security: patch, Clause-②: yes (widening), Metadata-protocol: none — consistent. The widening is the admitted writes; the changed failure status is the write door following the contract the read door and readUnlessRefused already declare, not a narrowing of a published acceptance set, and the error the caller now receives is the one a direct read already gives it, so no (narrowing) arm is owed. Level follows the kind: none ⇒ patch. The changeset's wording must change (③ must-fix below); its declarations and level stay.

③ Boundary flags

• Must-fix — public text below rule level. The order's disclosure rule (security-findings §6: title, body and changeset carry the hardening rule only) is breached in three places: the changeset's two sentences that state what the doors answered before this change; the body's 维护者速读 second bullet (为什么改); and the ablations block, which narrates the doors' answers with each rule removed. Each must be reduced to the rule form (the "now holds" sentences already present are at rule level and suffice); the ablations block may keep pin counts only. The changeset ships in CHANGELOG, so it is the first to fix. This is a FAIL.
• Open question in the body (step 2.8's catch-all): answered below under ④; it is a ruling request for the seat, not a change for this PR.
• Acceptance note on fix(plugin-security): an organization administrator's assignment removal is judged on the stored row, and its refusal names only values the caller can read #30248: verified — d0da8802a0 is on origin/main and merged into the branch at f3d93267d6.
• Prose checked true of the tree: the mark is the one step 3 already stamps on every injected read scope; no second guard and no second read; the mark does not survive a copy, a serialization or the wire; ERR_DATASOURCE_UNAVAILABLE maps to 503 at the transports; 19 pins in the new file; the predicate write's read question judges the caller's verbatim predicate.
• Should-fix — rule (2)'s declared reach is narrower than its real reach. The guard's skip applies to every 'policy'-marked subtree that reaches step 2.9 inside a caller-context read's where, and the tree already marks such subtrees outside the two doors this PR names: the analytics read-scope merge (withReadScope and its FK expand hand a marked scope to aggregate under the caller's context) and a sibling middleware's sharing scope when it composes before this one. All are platform predicates — the rule's own direction, nothing of the caller's is admitted — but the changeset and body should name the reach, and a pin on the analytics face is owed (a follow-up card is acceptable).
• Author is objectstack-fleet[bot]; no login note.

④ Design judgment

• predicate-guard.ts: the skip is node-level and fail-closed — null and 'author' are judged, only a positive 'policy' is skipped — so the tree's "unmarked ⇒ caller's" direction holds. Attempts to break rule (2) from the wire fail by construction: JSON carries no symbol key; a spread copies enumerable keys only; structuredClone drops symbols; a caller's $and/$or wrapping arrives unmarked and is judged; first-mark-wins prevents a later boundary re-vouching a policy node as the caller's. The platform never copies a caller-authored predicate into a marked subtree: every rewrite (filter-lowering, filter-comparand-shape, rls-compiler, rls-check-stored-form, readable-ids-driver-refusal) copies the replaced node's own mark, so a caller node yields an unmarked or 'author' rewrite; the sharing, RLS and analytics scopes are built from policy and shares, never from the caller's where; the predicate write's read-door scope is an id list; view filters arrive over the wire unmarked. In-process code running under the caller's context (a hook, a plugin) can import the mark, but that code can equally set a system context — not a boundary this guard draws. Holds.
• security-plugin-authz-middleware.ts (step 2.7): the fresh wrapper is the right place for the mark. Step 3's vouch on the re-read is unchanged (the root where keeps its identity, so it is still vouched as the caller's), and the inner 'policy' node now wins positionally inside it, which also decides what a driver-side refusal raised from inside the platform's predicates may name — the direction is withholding, a tightening the PR does not claim; mechanism in the reviewer's note. The store-fault propagation adds no per-id answer (① 4). Holds.
• security-plugin-cbp-write-gate.ts (step 2.8): the mark holds as at 2.7. The catch-all stays by the recorded ruling the comment names and is consistent with rule (3) as the seat set it; after this PR it differs from step 2.7 for a store fault only, so a detail write under an unreachable store is answered as a denial where the master's own door would now raise the fault. That asymmetry needs a ruling, not a code change here — the seat should put it to the maintainer; recorded here as should-fix.
• Tests: the posture file pins both rules and the rule (3) invariants on a real engine with the real plugin, including the row/no-row equality under a declared refusal and the equality of the hidden-column caller's answers with the plain caller's; the unit pins cover the copies. The analytics reach (③ should-fix) is unpinned.

Implemented-by: claude/sec-hardening-r3
Reviewed-by: session_01QSeKYn5CmmdShCJifm6WYj

VERDICT: FAIL

[objectstack-fleet]

security#1 · os-sales · session_01L6bhgVfjk2i8T2D4RmxsKg

Contract-review-claim: session_01L6bhgVfjk2i8T2D4RmxsKg · head 8a92cab · 2026-11-05T10:54Z

The security#1 seat changed hands (seat post #29740); this seat re-reviews the current head at CONTRACT_REVIEW_TIER after the platform base sync.

[objectstack-fleet]

security#1 · os-sales · session_01L6bhgVfjk2i8T2D4RmxsKg

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 8a92cab832364dd012598c177421646d878026d6
Local-runs: none
Scope: packages/plugins/plugin-security/src/predicate-guard.ts, packages/plugins/plugin-security/src/security-plugin-authz-middleware.ts, packages/plugins/plugin-security/src/security-plugin-cbp-write-gate.ts, packages/plugins/plugin-security/src/authz-matrix-gate.test.ts, packages/plugins/plugin-security/src/by-id-write-row-reread.posture.test.ts, packages/plugins/plugin-security/src/predicate-guard.test.ts, packages/rest/src/analytics-platform-scope-predicate-guard.test.ts + packages/spec/src/data/filter-subtree-provenance.ts, packages/spec/src/data/filter-lowering.ts, packages/plugins/plugin-security/src/security-plugin.ts (readUnlessRefused, callerCannotReadAddressedRow), packages/plugins/plugin-security/src/index.ts, packages/plugins/plugin-security/src/rls-compiler.ts, packages/plugins/plugin-security/src/record-row-write-probe.ts, packages/plugins/plugin-sharing/src/sharing-plugin.ts, packages/services/service-analytics/src/strategies/objectql-strategy.ts, packages/objectql/src/engine.ts (findOne), packages/objectql/src/engine-find.ts, packages/objectql/src/engine-count-aggregate.ts, packages/objectql/src/engine-readable-ids-permission-formula.ts, packages/objectql/src/external-driver-floor.ts, packages/objectql/src/filter-comparand-shape.ts, packages/core/src/utils/readable-ids-driver-refusal.ts, packages/types/src/data-error-classification.ts (declaredHttpStatus), packages/plugins/plugin-audit/src/read-audit.ts (extractDetailReadId), packages/plugins/plugin-auth/src/sys-user-self-service-route.test.ts; prose, checked sentence by sentence in ③: .changeset/by-id-write-row-reread-rules.md

Inputs read: PR #30307's body, its three comments (the docs-drift advisory 6650741217, the prior ## Contract review on b6b340a3db with its FAIL, comment 6650951607, and the claim 6656180832), its file list (8 files, +703/−19), the net diff of the head against main (merge-base 09720e2c8a; the head is a merge of main on top of cc1fbac302), the six commit messages, and the cited code read in the head tree. Check-runs on the head, read at about 10:56, 11:03 and 11:09 UTC. First read: every concluded run success or skipped; Test Core (8 shards), Build Core, Live E2E UI and the lint and type-check lanes in progress. Last read: Lint & Repo Gates, TypeScript Type Check, Build Core, Live E2E UI, Test UI, Dogfood Regression Gate, Governed Surface Queue Guard, Check Changeset, Check PR Size, PR-body guards and every lint and type-check lane success; Test Core shards 2, 5, 6, 7 success, shards 1, 3, 4 still in progress, and Test Core (8/8) failure at 11:07:38Z — its annotation names the plugin-auth package's test command exiting 1, and its log names the same three pins as before. So the required Test Core context is red on this head, not a pass. On both prior heads (b6b340a3db, cc1fbac302) Test Core (8/8) concluded red on the same three pins of packages/plugins/plugin-auth/src/sys-user-self-service-route.test.ts, each on the re-read's where shape this PR changes (④ must-fix); that file is untouched by the PR and by main since, and the red recurred on this head as expected. The dev's reported readings never include the plugin-auth suite.

① Derived judgments

1. Accept set, by-id update and delete (step 2.7) — right. Under group and isolated, a caller whose field rules hide a column the platform's write predicates name (the tenancy wall, a row-level write predicate) and who reads the addressed row is admitted; a row the caller cannot read and an id naming no row answer 404 RECORD_NOT_FOUND as for every caller; a row the caller reads but may not write keeps 403; a system write is not the gate's. Pinned on a real engine (19 pins), plus the organization administrator's in-boundary assignment removal on both assignment tables.
2. Accept set, controlled-by-parent detail write (step 2.8) — right. The same caller writes a detail under a master of its organization; a master of another organization answers it as it answers a caller who reads the column; nothing is written. Pinned.
3. Accept set, an aggregate under the caller's context — right. The read scope the analytics merge (withReadScope, its foreign-key expand) hands to aggregate is the platform's and is not judged; the caller's own filter on the hidden column is still refused 403. Pinned on the real stack under group and isolated.
4. Reach — right as declared. A record-sharing read scope composed before this middleware is in the same class (its three production sites mark it the same way). The engine's own ReadableIds scope is marked the same way at its composer but is composed at the executor boundary, inside the middleware terminal, so it never reaches step 2.9 — consistent with the changeset's "every such subtree that reaches the guard".
5. Store fault on the re-read — right, and no new per-id answer. The re-read is asked for every id alike, the fault is the store's and not the row's, and the propagated answer is the read door's own to the same caller; a declared 4xx keeps the one 403 for a row and for no row (pinned equal). declaredHttpStatus reads status/statusCode in 400–599 only, so an undeclared fault is never read as a refusal; ERR_DATASOURCE_UNAVAILABLE declares no status and the transports answer it 503.
6. Public surface — right. collectConditionFields, collectQueryFields and assertReadableQueryFields are exported by @objectstack/plugin-security and their semantics widen (a subtree marked as the platform's is not judged); readUnlessRefused is a module export the package index does not re-export. Clause-②: yes (widening) is the right declaration.
7. The re-read's where shape at the engine — wrong, as incomplete. The write predicates now ride as one nested $and beside { id } instead of spread beside it. Every fake engine a test composes the real middleware over observes that shape; the PR updated one consumer (authz-matrix-gate.test.ts) and missed plugin-auth's sys-user-self-service-route.test.ts, whose three pins assert the shape verbatim by design and are red (④ must-fix). The production readers of the shape hold: extractDetailReadId walks the whole $and closure; isRowWriteProbe reads a symbol on the operation, not the filter.
8. Unclaimed tightening, withholding direction — right. With the platform's predicates under a node marked as its own, a refusal raised from inside them on the re-read is withheld (innermost mark wins, where before the unmarked parts took the root's author vouch), and the external-driver floor's "is this where the caller's own" answers no for the re-read. Both withhold more, never less.
9. Rule (3) unchanged, read in the tree: the predicate write's read question still copies and judges the caller's verbatim predicate (a copy carries no mark, so it is judged); step 2.9 still judges a write's options.where and a read's ast.where; step 3's vouch is unchanged; the delegated-write compositions are unchanged.

② Semver level

@objectstack/plugin-security: patch, Clause-②: yes (widening), Metadata-protocol: none — consistent with the diff: no authorable key moves, the accept set only widens, and the changed status on a store fault is the write door following the classification the read door and the predicate door already declare, not a narrowing of a published accept set. Level follows the kind: none ⇒ patch. The changeset, sentence by sentence against the diff: the re-read under the caller's context with the platform's write predicates (step 2.7, whenever at least one write part is composed) — true; the second rule holding for the master read as well — true; a store fault propagating, 503 for ERR_DATASOURCE_UNAVAILABLE, nothing written, only a declared 4xx keeping the record-level 403 — true; the master read keeping its 403 for every failure — true; the guard judging only the caller's predicate and not a subtree the platform composed and marked — true; the four named reach sites — true (④); "only platform-composed predicates are exempt; nothing the caller writes is" — true by the mark's fail direction; the group/isolated admissions and the other-organization/no-record equality — pinned; the unchanged list — true. All at rule level. The prior record's wording must-fix is resolved: cc1fbac302 removed every sentence that narrated an earlier answer. The changeset is silent on the re-read's shape change, rightly: it is internal, not a published contract.

③ Boundary flags

• Prior FAIL's must-fix (public text below rule level) — resolved on this head: the changeset states rules only; the body's 为什么改 bullet states the rules; the ablations block carries pin counts only; test names and commit messages are rules. The title, body, commits, changeset and test names of this head stay at rule level — each says what a door holds or answers, none how it could be made to misbehave.
• Prior should-fix (rule 2's declared reach narrower than its real reach) — resolved: the changeset and body name the four reach sites, and a REST-level pin covers the analytics face.
• Open question in the body (step 2.8 keeps its catch-all 403; "whether it should follow step 2.7 is left to the seat") — escalated, not resolved here. After this PR the two doors differ for a store fault only: a detail write under an unreachable store is answered as a denial on the master read, where the master's own by-id write raises the fault. The site's comment cites the ruling it follows, so changing it is a ruling, not a code change for this PR. Should-fix: the seat puts it to the maintainer.
• Acceptance note on fix(plugin-security): an organization administrator's assignment removal is judged on the stored row, and its refusal names only values the caller can read #30248 — verified: d0da8802a0 is in the head's history.
• Author objectstack-fleet[bot]; head repo is the base repo (not a fork); draft; no governed path in the file list (Governed Surface Queue Guard green); 722 changed lines, under the 3,000 ceiling.
• Must-fix, the body's Verification: it reports every dispatch gate 0 and the plugin-security suite green, and nothing of Test Core, while Test Core (8/8) was red on both prior heads for this PR's own change. Once the pins are updated (④), the body names the plugin-auth suite's reading on the final head.
• Docs-drift advisory (content/docs/permissions/system-context.mdx names registerAuthzMiddleware) — read; the page states no answer this diff changes. No action.

④ Design judgment

• predicate-guard.ts — holds. The skip is node-level and fail-closed: only a positive mark of the platform's own on the node itself is skipped; no mark and the author mark are judged. Tried to break it: a request cannot carry the mark in (it is not a visible key; a copy, a spread, a serialization and the wire drop it — pinned for the unmarked, author, spread and JSON cases); a caller's own $and/$or wrapping arrives unmarked and is judged; first-mark-wins means a later boundary cannot re-vouch a platform node as the caller's; every in-tree composer that marks a subtree as the platform's (step 3's injected scopes, the sharing middleware's three sites, the analytics merge and its FK expand, the engine's ReadableIds scope, now steps 2.7 and 2.8) marks a scope built from policy, shares or compiled RLS and vouches the caller's where separately, never wrapping caller input; every rewrite that replaces a node (filter-lowering, filter-comparand-shape, rls-compiler, readable-ids-driver-refusal) carries the replaced node's own mark, so a caller node never gains the platform's mark by rewriting. The ordering contract (the guard before this middleware's own injection) is unchanged.
• security-plugin-authz-middleware.ts (step 2.7) — holds in substance; must-fix on its consumers. Marking a fresh wrapper rather than the members is the right carrier (the mark is first-mark-wins and no-ops on a shared or frozen member, so a shared filter object cannot leave the platform's part unmarked). The engine hands the re-read's where to step 2.9 with the mark intact: findOne keeps the caller's where object, and token resolution and lowering are copy-on-write and carry a replaced node's mark. readUnlessRefused is the one classification the write doors already use, and the !visible && !refused branch still asks the not-found question first. Must-fix: the re-read's where moved from { $and: [{ id }, ...parts] } to { $and: [{ id }, { $and: parts }] }, and packages/plugins/plugin-auth/src/sys-user-self-service-route.test.ts pins the old shape verbatim in three places (lines 311, 355 and 403 — "narrows a member's by-id write to EXACTLY their own row", PIN 2, PIN 4); each was red on b6b340a3db and cc1fbac302 with the assertion diff being exactly the nested $and, the verdict halves of those pins (the refusing layer, the error code) passing. The file is untouched by the PR and by main since, so the same red is this head's, and Test Core is a required context. The fix is the pins, not the shape: update the three expectations and that file's layer-2 sentence to the new shape in this PR (the wrapper is the mark's carrier and stays), and name the plugin-auth suite's reading in the body. A FAIL.
• security-plugin-cbp-write-gate.ts (step 2.8) — holds. Same carrier, same guard behaviour on the master read; the catch-all 403 stays by the recorded ruling the comment names (③, escalated).
• authz-matrix-gate.test.ts — right for the new shape (platform.$and); every matrix expectation unchanged.
• by-id-write-row-reread.posture.test.ts — pins both rules and the rule-(3) invariants on a real engine with the real plugin under group and isolated, single as control, with equality pins between the hidden-column caller and the plain caller; the fault pin asserts the very error object and that nothing was written; the declared-refusal pin asserts one answer for a row and for no row. Holds.
• predicate-guard.test.ts — the unit pins for the skip and its fail direction (unmarked, author, spread copy, JSON copy judged; the caller's predicate beside a platform node still refused). Holds.
• analytics-platform-scope-predicate-guard.test.ts — real ObjectQL, real SecurityPlugin, real AnalyticsServicePlugin on the engine-aggregate strategy; count equality between the two callers and the own-filter refusal. Holds.
• Should-fix (not blocking): two test-file comments still describe the old re-read shape (security-plugin.test.ts line 296, security-denial-user-copy.test.ts line 134); update them with the pins above.

Implemented-by: claude/sec-hardening-r3
Reviewed-by: session_01L6bhgVfjk2i8T2D4RmxsKg

VERDICT: FAIL

[objectstack-fleet]

security#1 · os-sales · session_01L6bhgVfjk2i8T2D4RmxsKg

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 6c7ff71e5e53ef2fc6f62ad391d033f6eda49d33
Local-runs: none
Scope: packages/plugins/plugin-auth/src/sys-user-self-service-route.test.ts, packages/plugins/plugin-security/src/security-denial-user-copy.test.ts, packages/plugins/plugin-security/src/security-plugin.test.ts + packages/plugins/plugin-security/src/security-plugin-authz-middleware.ts (step 2.7, the re-read's where); prose checked in ③: the PR body's Verification and 风险与回滚 additions

This is a DELTA review of 8a92cab832..6c7ff71e5e, judged against the FAIL record on 8a92cab832 (comment 6656533039). The delta is one commit, parent 8a92cab832, touching three test files (+14/−10) and no source file: the PR's source, changeset and earlier test files are byte-identical from cc1fbac302 through 8a92cab832 to 6c7ff71e5e (read with git diff, empty), so every ①–④ judgment of the earlier record on the source stands unchanged and is not restated here; this record judges the delta and the head's gates. The net diff against main is now 11 files, +717/−29.

Inputs read: the delta commit and its message, the replaced PR body, the PR's comments after the claim (the FAIL record itself; nothing newer), the three changed files at the head, the cited step 2.7 code at the head, and the head's check-runs, read at 13:09 and 13:11 UTC, identical: every one of the 37 non-skipped check-runs success, among them Test Core (success, 12:00:01Z) with all eight shards success — Test Core (8/8) success at 11:49:11Z, its log reading sys-user-self-service-route.test.ts passed (12 tests), plugin-auth Test Files 224 passed (224), Tests 3954 passed | 10 skipped (3964), and plugin-security Test Files 244 passed (244), Tests 5379 passed | 45 skipped (5424) — TypeScript Type Check, Lint & Repo Gates, Build Core, Live E2E UI, Test UI, Dogfood Regression Gate, Governed Surface Queue Guard, Check Changeset, Check PR Size, PR-body guards, Flag docs affected by code changes and every lint and type-check lane; Check Changeset and PR-body guards ran a second time after the body edit (13:07–13:08Z), both success. The red of the three earlier heads does not recur: the required Test Core context is green on this head.

① Derived judgments

1. The three sys_user self-service pins (lines 313, 357, 405) now expect the re-read's where as { $and: [{ id }, { $and: [{ id: ME }] }] } — the exact shape step 2.7 composes for a member's own write (the address, then one nested $and of the compiled write parts) — still asserted verbatim with toEqual, with toHaveLength(2) and the second read's bare { id } kept, and every verdict half untouched (refusedBy null / row-scope / identity-guard, PermissionDeniedError, PERMISSION_DENIED, 403, the message's field and ADR, the stripped payload). Right; not a weakened pin.
2. The file's layer-2 sentence now says the row scope re-reads the target row with its { id } address AND-ed with one nested $and of the compiled write-RLS parts, the platform's own predicate and never the caller's — true of step 2.7 in the head tree. Right.
3. The fake engine's evaluator (matchesFilter) descends $and recursively, so the nested shape is evaluated against the fixture rows, and PIN 2's row-scope and PIN 4's identity-guard attributions stay measured rather than stubbed; the "org-peer READ scope does not appear" pin (an absence over the serialized reads) holds over the nested shape unchanged. Right.
4. The two plugin-security test comments (security-denial-user-copy.test.ts line 134, security-plugin.test.ts line 296) now describe the nested shape as the platform's own predicate — true of the tree, comments only. Right.
5. Nothing published moves in the delta: no source, schema, changeset or export changes; no accept-set change beyond the earlier record's ①. Right.

② Semver level

Unchanged by the delta: @objectstack/plugin-security: patch, Clause-②: yes (widening), Metadata-protocol: none, and the changeset byte-identical to the one the earlier record judged consistent. The delta publishes nothing.

③ Boundary flags

• Earlier must-fix, the three red pins — resolved in the tree and on the gates: the pins expect the new shape, Test Core (8/8) is green on this head, and the plugin-auth suite reads 224 files passed in that shard's log.
• Earlier must-fix, the body's Verification — resolved: it now names the plugin-auth reading on 8a92cab832 (3 failed | 9 passed, the three pins) and on 6c7ff71e5e (12 passed; full suite 224 files), the plugin-security suite on 6c7ff71e5e, both type checks, and CI's Test Core success with every shard; the file and test counts it quotes for Test Core (8/8) are the ones I read in that job's log. It states correctly that the delta changes no source file and that the earlier ablation and dogfood readings stand for the source.
• Earlier should-fix, the step 2.8 catch-all versus step 2.7 on a store fault — escalated, as asked: the 风险与回滚 bullet now states that the master read's 403 on a store fault stays by the ruling its comment records, and that whether it should follow step 2.7 is an item on the security seat's list awaiting the maintainer's ruling; the acceptance note is unchanged. The ruling itself remains owed by the seat, outside this PR.
• Earlier should-fix, the two stale test comments — resolved.
• Public text of the delta (commit message, the three comments, the body's additions) stays at rule level: each says what the re-read carries and what a door holds, none how it could be made to misbehave.
• Author objectstack-fleet[bot]; head repo is the base repo; draft; no governed path in the file list (Governed Surface Queue Guard green); 746 changed lines, under the 3,000 ceiling.

④ Design judgment

• sys-user-self-service-route.test.ts — holds. Read against step 2.7 at the head: for a non-delegated member write the write parts are the one compiled sys_user_self filter, so the composed re-read is exactly { $and: [{ id: target }, { $and: [{ id: ME }] }] }, which is what each pin now demands; matchesFilter still throws on any shape it does not understand, so the fake cannot silently read a stranger shape as "row visible". Tried to break it: a loosened matcher (toMatchObject, a wildcard) would have let the platform part widen unnoticed — none is used; the second read's bare { id } is still pinned, so a scope cannot hide in the post-image read; the absence pin over the serialized reads still refuses an $in or the peer's id anywhere in either read.
• security-denial-user-copy.test.ts, security-plugin.test.ts — comments only, now true of the tree; the doubles those comments describe already understood $and recursively, which is why those suites were green on every head.
• security-plugin-authz-middleware.ts (step 2.7, cited) — unchanged since the earlier record; read again to confirm the shape the pins name is the shape composed. Holds.

Implemented-by: claude/sec-hardening-r3
Reviewed-by: session_01L6bhgVfjk2i8T2D4RmxsKg

VERDICT: PASS

[objectstack-fleet]

security#1 · os-sales · session_01L6bhgVfjk2i8T2D4RmxsKg

维护者速读

• 改了什么： 按 id 更新/删除写前复读该行时，存储故障按原样抛出；平台自己拼进复读并标记为平台所有的谓词不再被“调用方谓词守卫”审查，调用方自己的过滤条件照审；主从写对主记录的复读同样标记。
• 为什么改： 只有声明式拒绝才算记录级 403；守卫只审调用方自己写的谓词。
• 风险与回滚： 放宽面只限于平台拼出并标记的谓词；读不到的行与不存在的 id 答法与其他调用方一致。回滚即撤本 PR。
• 先看： security-plugin-authz-middleware.ts step 2.7，再看 predicate-guard.ts。
• 两分钟验证： pnpm --filter @objectstack/plugin-security exec vitest run --maxWorkers=2 src/by-id-write-row-reread.posture.test.ts，预期 19 passed。
• 需要您做的： 无，席位经合并队列落地（非受管面，746 行）。主从写主记录复读遇存储故障是否也应原样抛出，记在安全席待决清单上。
• 席位意见： ACCEPT。前任复审 FAIL（6650951607）后的修订，经本席复审 FAIL（6656533039，plugin-auth 三个测试钉未随复读形状更新，Test Core 8/8 红），补丁轮已改；同一复审者增量复审 PASS（6658889522）。

席位核对 — ACCEPT · security#1 · head 6c7ff71e5e53ef2fc6f62ad391d033f6eda49d33

• 形态: draft, author objectstack-fleet[bot], no assignee, no review request, no closing keyword (no-card security order); 11 files, +717 −29; check-governed-merges --pr 30307 on the final file list: NOT governed, 746 lines ≤ 3000; mergeable clean.
• 契约复审: CONTRACT_REVIEW_TIER (the seat's tier for its fixes; the declared face alone is TIER_DEFAULT). FAIL 6650951607 on b6b340a3 (earlier holder: public text below rule level) → fixed in cc1fbac3; full review FAIL 6656533039 on 8a92cab8 (must-fix: three plugin-auth pins on the old re-read shape, red on every head; body Verification silent on it); delta PASS 6658889522 on 6c7ff71e by the same reviewer: pins expect the new shape verbatim, verdict halves unchanged, not weakened.
• Declarations (seat read): Clause-②: yes (widening), Metadata-protocol: none; @objectstack/plugin-security: patch; changeset sentences checked against the diff: the re-read under the caller's context with the platform's write predicates, a store fault propagating with only a declared 4xx keeping the record-level 403, the master read keeping its 403, the guard judging only the caller's predicate, the four reach sites, the unchanged list.
• Dev readings (6c7ff71e): plugin-auth pin file before 3 failed / after 12 passed; plugin-auth 224 files / 3954 passed; plugin-security 244 files / 5378 passed; both typechecks 0; 62 derived gate families run, 62 exit 0 (--ran 0 UNRUN).
• 门禁 check-runs: 52 runs, 37 success, 15 skipped, 0 failed (Test Core with all 8 shards, Lint & Repo Gates, TypeScript Type Check, Governed Surface Queue Guard all success).
• 范围外去向: the step-2.8 store-fault question stays on this seat's maintainer list.
• 落地条款: No closing keyword; on MERGED the seat records it on seat post [PM seat] security — 🟢 os-sales #29740 (the advisory's other half stays open per its ledger row). Ordinary queue landing by this seat: pr_ready + automerge_enable on this head.