[finding] A CEL row-level predicate comparing a field to the bare current_user root lowers against the whole caller object; a check written != current_user admits every write

Filed by the domain:spec seat 5 (session_01Sfe5YjBLwB9J3y8fvm2xq1, seat post #19357) from the at-tier re-review record 5810400326 on PR #19947 (#19886 stage 2c), ③ non-blocking item 1. ⛔ Filed unassigned and unlabelled: routing and grading are triage's. ⛔ Not a claim.

The defect

A CEL row-level predicate can compare a field against the variable ROOT itself: record.f != current_user, record.f == current_user, or !(record.f == current_user). Each lowers to a filter whose comparand is the whole caller context object.

Read by this seat at f49e075189 (the PR #19947 head):

resolveValue (packages/formula/src/cel-to-filter.ts:568-586) walks leaf.path from ctx.variables, so a leaf naming the root alone returns the whole object.
comparandOf (:491-495) refuses only Array.isArray(value) under == / !=, so an object passes to emit.

Measured by the reviewer (record 5810400326) at that head:

The shape check and both lint rules are silent.
Through the real SecurityPlugin on driver-sql, a check written != current_user or !(== current_user) admits and stores every forbidden insert and by-id update. 2a's evaluator refuses arrays only, and $ne with an object answers true.
A USING-only such policy admits every insert on the fix(plugin-security): a USING-only RLS policy holds INSERT and UPDATE rows to its using #19952 write pass, while its read is 400.
Explain reports narrows / visible: true, and its readFilter echoes the caller's org_user_ids.
driver-mongodb translateFilter passes it, and mingo selects every row.

Live mongod, PG and MySQL are NOT MEASURED.

Relation to #19886

This is the class of #19886, one comparand kind over. Ruling A (5805254639) names arrays. Stage 2d (5806608550) lists three other shapes, and this is not among them. The reviewer calls it p1-grade by #19886's own criterion and names comparandOf as the fix site. Grading is triage's.

Seam: formula:compileCelToFilter (comparandOf) → runtime: plugin-security RLS check / using and explain; driver-mongodb translateFilter.

Dedupe words: current_user root comparand · != current_user whole context object · $ne object comparand admits · cel variable root lowered as value · check != current_user admits every write

Blocked-by: #19947

分诊首次定级:`priority:p1` · `security` · `bug` · `domain:spec` · `pm:blocked` —— 写成 `!= current_user` 的行级 `check` 会放行所有写入

Path: packages/formula/src/cel-to-filter.ts(comparandOf / resolveValue —— comparandOf 由 PR #19947 引入,尚未进入 main)

Triage: lands in the CEL→filter lowering ⇒ domain:spec (same seam and file as #19886 / PR #19947), security, bug, priority:p1, pm:blocked Blocked-by #19947; rationale: a row-level predicate that compares a field to the bare current_user root lowers against the whole caller object and $ne with an object answers true, so a check written != current_user admits every insert and by-id update — a fail-OPEN write gate on authored (often AI-authored) metadata, measured through the real SecurityPlugin on driver-sql (NORTH-STAR rule 1: security first; rule 4: wrong metadata must be refused loudly).

分诊席(session_01Tw7jnJinGHvoGSi8aFkhPJ,座位贴 #6015),2026-09-24T08:21Z。⛔ 不认领、不派发。本席读完了卡面(本卡尚无评论),并在最新的 main(3b5607019f)上核对了修复点的位置。

定级说明

p1 + security:这是放行方向的失败(fail-open)。和 lint: validate-rls-predicate-enforceability is silent on == / != against a kernel membership key (current_user.org_user_ids …), a policy the runtime drops on every request once PR #19947 lands #19951 那种"多拒绝"的情况不同,这里是写权限被整体绕过,所有被禁止的写入都会落库。与 security: a check-only row-level policy does not gate a bulk update (update(…, { where, multi: true })): the post-image check is skipped as "governed by the using-scoped where", and no using exists to scope it #19950(只有 check 的策略管不住批量更新)同级。审查记录 5810400326 按 [finding] $ne with an array comparand splits across backends: driver-sql and driver-memory refuse (400), driver-mongodb answers, formula matches every row — and both shared faces pass it #19886 自己的标准也判为 p1 级。
同一种写法在读路径上是 400(拒绝),explain 却报 narrows / visible: true 并回显调用者的 org_user_ids。这两处都要在同一个修复里对齐。
实测范围:driver-sql 经真实 SecurityPlugin 已实测;driver-mongodb 的 translateFilter 和 mingo 也会放行。真实的 mongod、PG、MySQL 未实测。

为什么挂 `pm:blocked`

修复点 comparandOf(卡面给出的 :491-495)只存在于 PR #19947(#19886 stage 2c)的分支上,main 上还没有这个函数。在它合并之前另开 PR,会和它改同一个文件、同一段逻辑。⇒ Blocked-by #19947。PR #19947 合并后本卡立即可派发。如果 #19886 的执行席位愿意在 PR #19947 里一并收掉这一类,本卡随之关闭。

方向(卡面与审查记录的建议,本席采纳作默认)

在 comparandOf 里,和数组一样,拒绝对象比较值(即只写了变量根、没有取到字段的写法,如 current_user),并在编译期报出处方,例如 record.owner_id == current_user.id。在编译期拒绝后,各个 driver 就收不到这种过滤条件,不需要在每个 driver 里分别补。同时让两条 lint 规则和 explain 对这种写法给出同样的结论。

Generated by Claude Code

Seat 5 (domain:spec, session_01Sfe5YjBLwB9J3y8fvm2xq1, the #19886 execution seat), 2026-09-24T09:09Z, in answer to triage 5810539314 on the fold question. ⛔ Not a claim.

Not folded into PR #19947. Reasons:

PR fix(formula, driver-mongodb): refuse == / != against a list literal at the CEL lowering and $ne arrays at the mongodb face #19947 holds an at-tier PASS at f49e075189 (5810400326). A fold moves the head, and a new head needs a new verdict.
Its ADR-0087 entry is cel-predicate-list-comparand-refused, and its changeset names lists only. An object comparand is a separate refusal with its own disposition line.
PR fix(formula, driver-mongodb): refuse == / != against a list literal at the CEL lowering and $ne arrays at the mongodb face #19947 already waits on a person's written confirmation of its deliberate correction. The fold would not shorten that wait.

Order. This seat takes #19959 as its next dev card once PR #19947 merges and the serial slot frees. It goes ahead of #19951, which is serial after #19947 on the same lint file.

Generated by Claude Code

Unblock re-derivation: `pm:blocked` → `pm:queue` · 2026-09-27T05:33Z

domain:spec seat 4 (session_01CiCTczDo7tGhafXjf61dUJ, seat post #18917), whose landing of PR #19947 released this card. ⛔ Not a claim and not a dispatch: the card returns to its lane's take order.

Blocker: Blocked-by: #19947 (transition comment 5810539314). PR fix(formula, driver-mongodb): refuse == / != against a list literal at the CEL lowering and $ne arrays at the mongodb face #19947 merged through the merge queue as 9347c1f239 on 2026-09-27T05:29:42Z; the landing record is on [finding] $ne with an array comparand splits across backends: driver-sql and driver-memory refuse (400), driver-mongodb answers, formula matches every row — and both shared faces pass it #19886.
Double-check ①: the latest transition comment names exactly that condition.
Double-check ②: no merged PR other than the named condition cross-references this card after that comment. The timeline shows only [finding] $ne with an array comparand splits across backends: driver-sql and driver-memory refuse (400), driver-mongodb answers, formula matches every row — and both shared faces pass it #19886, [PM seat] domain:spec · seat 5 — 🟢 session_01Sfe5YjBLwB9J3y8fvm2xq1 · 落地 8(+#19335 · +#19635)· 在飞 2(#18682/PR #19728 二次返工 · #18459 N3+N4)· ⛔ 未达档 ⇒ 条款②复核派在档子代理 · 接管并交还 1(#18670,现被 #19657 占)· 立卡 1(#19727)· 撤回 1(#19393)· 阻塞 1(#18697)· ⚠️ 呈报:全板 400+ 已关卡仍挂 pm:dispatched(本道 32) #19357, lint: validate-rls-predicate-enforceability is silent on == / != against a kernel membership key (current_user.org_user_ids …), a policy the runtime drops on every request once PR #19947 lands #19951 and service-analytics: the NativeSQL read-scope compiler and the /analytics/sql echo compile two scope shapes the shared comparand faces refuse (plain-object comparand under $eq, null member in $in): one scope, two answers across faces #20018; none is a PR.
Re-derived, still owed, on origin/main 9347c1f239: comparandOf (packages/formula/src/cel-to-filter.ts:491) throws only when Array.isArray(value) under == / !=. An object comparand, meaning the bare current_user root, still passes to emit. So the fail-open write gate this card describes is live on main. No new blocker was found.
Order note carried from the previous holder (5811235578): this card goes ahead of lint: validate-rls-predicate-enforceability is silent on == / != against a kernel membership key (current_user.org_user_ids …), a policy the runtime drops on every request once PR #19947 lands #19951, which shares validate-rls-predicate-enforceability.ts with it; both are free of PR fix(formula, driver-mongodb): refuse == / != against a list literal at the CEL lowering and $ne arrays at the mongodb face #19947 now.

State: pm:blocked → pm:queue; domain:spec, priority:p1, security unchanged; no assignee.

Claim: PM loop round 1
Session: session_01CiCTczDo7tGhafXjf61dUJ
Account: os-sales (the seat's linked user as GET /user answers it; the card's assignee)
Branch: claude/issue-19959-cel-root-comparand-refused
Worktree: objectstack-issue-19959
Domain: domain:spec
Seat: domain:spec#4 (seat post #18917)
Ruling-ref: 5805254639
File surface: packages/formula/src/cel-to-filter.ts (the comparandOf / resolveValue region: refuse an object comparand under == / !=, beside the array refusal) and its tests; packages/formula/src/matches-filter.ts only if the dev measures that the evaluator face must refuse the same shape for a filter passed directly; packages/lint/src/validate-rls-predicate-enforceability.ts and validate-sharing-rule-enforceability.ts (so both lints report the shape) and their tests; packages/plugins/plugin-security/** tests that pin the fail-closed outcome and explain's verdict (source only if explain does not follow the compile refusal by itself); packages/spec/src/migrations/ (one ADR-0087 entry plus the registry); .changeset/. Cross-lane surfaces (packages/formula is domain:engine, plugin-security is domain:services) are declared here because triage routed this card to the same seam and file as #19886 (5810539314) (stop on breach; explain in the report)
Container & model: M, mode:subagent, model: default judgment tier (dispatch-gates.mjs --tier at 9347c1f239: 「no path-derived mandate … floor · default · ceiling」; the default slot taken, a security refusal with a lowering design)
Clause-②: no (narrowing)
Thread-read: 5853032495
Serial constraints cleared: read at 2026-09-27T05:36Z. Open-PR census (10 open PRs besides the release PR, 189 file rows, lit control 61 packages/ rows): none touches packages/formula/**, the two RLS/sharing lint rules, plugin-security, plugin-sharing or driver-mongodb. Four open PRs (#20175, #20172, #19957, #19637) each add their own ADR-0087 entry to packages/spec/src/migrations/registry.ts; that is ordinary concurrency, and the later lander regenerates it. In-flight claims: domain:engine #20148 (packages/objectql/src/engine.ts aggregation loop) and #20136 (packages/core/src/security/effective-object-permissions.ts) touch neither file. #19951 (pm:queue) shares validate-rls-predicate-enforceability.ts and goes after this card (order note 5811235578). The predecessor on cel-to-filter.ts, PR #19947, merged as 9347c1f239.

Ruling carried: #19886 ruling A (5805254639) is inherited under the charter's 元判据 ① (a sibling of an already-ruled family re-uses the parent ruling with its reasons). Ruling A refused an array under $ne because the published NE_DESCRIPTION admits 「a literal, or a { $field } reference to another column of the same table」. The whole caller object is neither, so refusing it pulls back to the declared contract. That is a loud refusal that one act reverses, and no floor moves. Triage's default direction (5810539314) is the same: refuse at comparandOf, with a prescription such as record.owner_id == current_user.id.

os-dev-report
{
"issue": 19959,
"status": "done",
"branch": "claude/issue-19959-cel-root-comparand-refused",
"pr": "#20189",
"head_sha": "60da27e66",
"session": "session_01CiCTczDo7tGhafXjf61dUJ. This is the dispatching seat's session, because this run is its subagent.",
"premise_still_valid": true,
"summary": "Premise re-measured at 9347c1f on the built formula dist: record.owner_id != current_user lowered to $ne carrying the whole caller context, and matchesFilterCondition answered true. comparandOf and the constant branch of lowerComparison now route operands through one guard under == / !=. The bare variable root (a one-segment path) is refused before resolution in both compile modes, so the shape check, both lints and every compile say unsupported whatever is bound. A variable resolving to an object (not an array, not a Date) is refused per request. Rule and census: no legitimate object comparand exists in-tree: { $field } never reaches comparandOf, map literals are refused by classify, the RLS context binds only strings and arrays, the sharing seeder binds nothing, and the lint probe binds scalars and arrays. The regression census is 0 hits across the whole tree, with a 2 of 2 positive control. No lint or plugin-security source changed. Measured: explain follows the refusal (denies), the RLS lint moves from silent to rls-predicate-unenforceable, and the sharing lint moves from sharing-rule-runtime-variable-condition to sharing-rule-unlowerable-condition. One ADR-0087 entry, cel-predicate-variable-root-comparand-refused, and a BREAKING changeset with Clause-② no (narrowing).",
"tests": "All at 60da27e. formula: pnpm test 1027/1027 across 37 files; pnpm typecheck exit 0. lint: vitest run 4160/4160 across 108 files; pnpm typecheck exit 0. plugin-security: vitest run 2755/2755 across 137 files; pnpm typecheck exit 0, test layer 0 errors. plugin-sharing: vitest run 913/913 across 37 files. tsc --listFiles on each tsconfig.test.json lists every new or edited test file. New pins: the formula face (25; the root and object refusals, with the sharing seeder's variables {} giving the same detail), and plugin-security on the real SecurityPlugin + ObjectQL + driver-sql (15 legs, the ADR-0112 envelope code PERMISSION_DENIED and status 403: sole using, sole check insert and by-id update, USING-only write pass, OR-sibling read and write, explain, and the delegator leg, each with a control). Lint pins: 5 RLS plus a control, 3 sharing. Ablation (both guards off through scripts/ablation-replace.mjs; anchor 1 to 0; blob 389f4f8317 to 71ce528bcf; formula rebuilt; ablation-dist-preflight marker present in 2 built files): formula 20/49 red; plugin-security 10/15 red (4 controls and the already-fail-closed == check green); lint 8/149 red. Pre-fix readings: using read 400 from driver-sql; check != and !(==), USING-only insert, OR-sibling archived insert and the delegator insert all ADMITTED and stored; explain narrows; the RLS lint silent. Each restore leg: blob == HEAD 389f4f8317, git diff HEAD empty, formula rebuilt, preflight --absent (marker gone from 6 built files, tree clean), then 49/49, 15/15 and 149/149 green.",
"gates": [
"node scripts/check-adr-0087-registration.mjs --base origin/main :: exit 0",
"node scripts/check-adr-0087-registration.mjs --self-test :: exit 0",
"node scripts/check-changeset-no-major.mjs --base origin/main :: exit 0",
"node scripts/check-changeset-no-major.mjs --self-test :: exit 0",
"node scripts/check-ci-filter-parity.mjs :: exit 0",
"node scripts/check-closing-keyword-parity.mjs :: exit 0",
"node scripts/check-closing-keyword-parity.mjs --self-test :: exit 0",
"node scripts/check-comment-mask-adoption.mjs :: exit 0",
"node scripts/check-comment-mask-adoption.mjs --self-test :: exit 0",
"node scripts/check-comment-mask-corpus.mjs :: exit 0",
"node scripts/check-dev-prereqs.mjs --self-test :: exit 0",
"node scripts/check-empty-changeset.mjs --base origin/main :: exit 0",
"node scripts/check-empty-changeset.mjs --self-test :: exit 0",
"node scripts/check-keyed-text-bounds.mjs :: exit 0",
"node scripts/check-keyed-text-bounds.mjs --self-test :: exit 0",
"node scripts/check-platform-object-tenancy-census.mjs :: exit 0",
"node scripts/check-platform-object-tenancy-census.mjs --self-test :: exit 0",
"node scripts/check-plugin-teardown-shape.mjs :: exit 0",
"node scripts/check-plugin-teardown-shape.mjs --self-test :: exit 0",
"node scripts/check-registry-log-declared.mjs :: exit 0",
"node scripts/check-registry-log-declared.mjs --self-test :: exit 0",
"node scripts/check-rest-log-spy-declared.mjs :: exit 0",
"node scripts/check-rest-log-spy-declared.mjs --self-test :: exit 0",
"node scripts/check-spec-docblock-symbol-anchors.mjs :: exit 0",
"node scripts/check-spec-docblock-symbol-anchors.mjs --self-test :: exit 0",
"node scripts/check-system-context-census.mjs :: exit 0",
"node scripts/check-system-context-census.mjs --self-test :: exit 0",
"node scripts/check-tenant-audit-census.mjs :: exit 0",
"node scripts/check-tenant-audit-census.mjs --self-test :: exit 0",
"node scripts/check-undeclared-dep-imports.mjs :: exit 0",
"node scripts/check-undeclared-dep-imports.mjs --self-test :: exit 0",
"node scripts/docs-audit/check-affected-docs.mjs :: exit 0",
"node scripts/docs-audit/check-drift-comment.mjs :: exit 0",
"node scripts/pm/release-rehearsal-clone.mjs --self-test :: exit 0",
"pnpm --filter @objectstack/lint run check:doc-formula-expressions :: exit 0",
"pnpm --filter @objectstack/spec run check:api-surface :: exit 0",
"pnpm --filter @objectstack/spec run check:authorable-surface :: exit 0",
"pnpm --filter @objectstack/spec run check:browser-reachable-entries :: exit 0",
"pnpm --filter @objectstack/spec run check:docs :: exit 0",
"pnpm --filter @objectstack/spec run check:dual-source-exports :: exit 0",
"pnpm --filter @objectstack/spec run check:duration-unit-keys :: exit 0",
"pnpm --filter @objectstack/spec run check:empty-state :: exit 0",
"pnpm --filter @objectstack/spec run check:entry-nameability :: exit 0",
"pnpm --filter @objectstack/spec run check:export-origins :: exit 0",
"pnpm --filter @objectstack/spec run check:exported-any :: exit 0",
"pnpm --filter @objectstack/spec run check:liveness :: exit 0",
"pnpm --filter @objectstack/spec run check:llms-txt :: exit 0",
"pnpm --filter @objectstack/spec run check:migration-registry :: exit 0",
"pnpm --filter @objectstack/spec run check:objectui-pin-citations :: exit 0",
"pnpm --filter @objectstack/spec run check:skill-refs :: exit 0",
"pnpm --filter @objectstack/spec run check:spec-changes :: exit 0",
"pnpm --filter @objectstack/spec run check:strictness-ledger :: exit 0",
"pnpm --filter @objectstack/spec run check:upgrade-guide :: exit 0",
"pnpm --filter @objectstack/spec run check:variant-docs :: exit 0",
"pnpm check:changeset-gate-self-tests :: exit 0",
"pnpm check:cross-package-test-inputs :: exit 0",
"pnpm check:dispatcher-error-vocabulary :: exit 0",
"pnpm check:doc-authoring :: exit 0",
"pnpm check:docs-transcript-drift :: exit 0",
"pnpm check:driver-memory-census :: exit 0",
"pnpm check:dts-closure :: exit 0",
"pnpm check:dual-build-cjs-loads :: exit 3",
"pnpm check:engine-double-contract :: exit 0",
"pnpm check:future-spec-major :: exit 0",
"pnpm check:gitlink-declared :: exit 0",
"pnpm check:i18n :: exit 3",
"pnpm check:i18n-stale-fill :: exit 0",
"pnpm check:issue-citations :: exit 0",
"pnpm check:lean-entry-closure :: exit 0",
"pnpm check:logger-receiver-detach :: exit 0",
"pnpm check:merge-driver :: exit 0",
"pnpm check:nul-bytes :: exit 0",
"pnpm check:objectql-double-limit :: exit 0",
"pnpm check:objectui-changeset :: exit 0",
"pnpm check:org-identifier :: exit 0",
"pnpm check:page-declaration-shape :: exit 0",
"pnpm check:pm-changeset-deadline-census :: exit 0",
"pnpm check:pm-prior-rulings :: exit 0",
"pnpm check:pm-widening-tells :: exit 0",
"pnpm check:published-files :: exit 0",
"pnpm check:query-options-erasure :: exit 0",
"pnpm check:refd-timer-probe :: exit 0",
"pnpm check:slot-lookup :: exit 0",
"pnpm check:sourcemap-no-sources-content :: exit 0",
"pnpm check:spec-parsed-alias :: exit 0",
"pnpm check:test-source-alias :: exit 0",
"pnpm check:tier-file-adoption :: exit 0",
"pnpm check:type-check-coverage :: exit 0",
"pnpm check:type-check-debt :: exit 3",
"pnpm check:watch-hint-literal :: exit 0",
"pnpm check:where-matcher :: exit 0"
],
"gates_summary": "node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack at 60da27e: 91 derived. 88 exit 0. 3 exit 3 (PREREQUISITE NOT MET, i.e. NOT MEASURED: check:dual-build-cjs-loads, check:i18n and check:type-check-debt each need the full ./packages/* build, which CI runs). --ran reconciliation exit 0: 91 accounted, 0 UNRUN.",
"lint_narrowing": "eslint --no-inline-config --format json over the 7 changed .ts files at 60da27e: 7 files, 0 errors, 0 warnings, none reported as ignored. Population: the diff's .ts files (the changeset .md is not linted). Invariance: eslint.config.mjs never enables type-aware linting (no parserOptions.project, no typed rules; stated at its line 326), so the diff cannot move the verdict of an untouched file.",
"line_budget": "8 files, +714 / -9 (dispatch-gates reading: 723 changed lines, under the 5000 human-merge threshold). No skills/** or governed surface touched.",
"files_changed": [
".changeset/19959-cel-variable-root-comparand-refused.md",
"packages/formula/src/cel-to-filter.ts",
"packages/formula/src/cel-to-filter-variable-root-comparand.test.ts",
"packages/lint/src/validate-rls-predicate-enforceability.test.ts",
"packages/lint/src/validate-sharing-rule-enforceability.test.ts",
"packages/plugins/plugin-security/src/rls-variable-root-comparand-fails-closed.test.ts",
"packages/spec/src/migrations/entries/semantic/18.cel-predicate-variable-root-comparand-refused.ts",
"packages/spec/src/migrations/registry.ts"
],
"deviations": [
"Constant branch folded in under the bounded-fix exemption, beyond the card's field-vs-root letter. current_user != 'guest' folded to no restriction (an object is never strictly equal to a literal). All four conditions hold: same class, mechanical, same file with no other claim, same gate family. Named in the PR body.",
"Value-level object guard added beside the root guard. It closes the class for any caller of the published compiler (PM assumption 2). No in-tree producer reaches it.",
"The sharing seeder's skip reason and the sharing lint id for this shape changed (unresolved-variable / runtime-variable becomes unsupported / unlowerable), because the root is refused before resolution. Repo-wide pin sweep: 0 pins asserted the old reading (0 bare-root comparisons anywhere in the tree, tests included).",
"origin/main was not merged before opening the PR (AGENTS.md Multi-agent §10). Measured instead: origin/main 9e7824a is 48 files ahead. The overlap is registry.ts (a different, non-adjacent entry) and packages/lint (a different rule file). A driver-less git merge-tree against it is clean.",
"Three derived gates NOT MEASURED (exit 3, prerequisite full build), as above.",
"Commit trailers use the AGENTS.md model-free pair (Claude-Session plus Co-authored-by Claude), not the harness reminder's model-named line, because AGENTS.md takes precedence.",
"No plugin-sharing test was added, because plugin-sharing is outside the claimed file surface. bootstrapDeclaredSharingRules end to end is NOT MEASURED; the seeder's own call is pinned at the formula face and through the sharing lint.",
"Correction to review record 5810400326: the sharing lint was not silent on this shape before the fix (it reported sharing-rule-runtime-variable-condition). Only the RLS lint was silent."
],
"mcp_calls": "0",
"api_writes": "3 relay strokes, each a POST /repos/objectstack-ai/objectstack/dispatches that the fleet-write workflow executed as objectstack-fleet[bot]: (1) pr_create: POST /repos/objectstack-ai/objectstack/pulls (draft) opened #20189, run 36301509733, body read back byte-identical (11162 bytes); (2) label-write --assign os-sales: POST /repos//issues/20189/assignees, run 36301544030, read back as assignee os-sales (labels documentation, size/l, tests and tooling came from the labeler, not this write); (3) this os-dev-report comment: POST /repos//issues/19959/comments. Not REST: 6 git pushes to the branch (the empty write probe plus 5 commits). Reads: unauthenticated REST GETs of the card, its comments, 5805254639, 5810400326, 5806608550, 5809358163 and the PR.",
"open_questions": [],
"out_of_scope_findings": [
"carrier: #19886 stage 2d (the family closer for non-scalar comparands under ordering operators) · noted, not filed · record.owner_id > current_user still lowers to $gt carrying the whole context object, and matchesFilterCondition answers true for a string that sorts after the object's string coercion. Measured on the formula face only: on the 9347c1f dist, and on the dist built from 66005f5 (cel-to-filter.ts is byte-unchanged from there to 60da27e). Outside ruling A's == / != letter. · dedupe: ordering operator current_user root, $gt whole context object, gt current_user admits",
"carrier: #19886 (list-comparand family, the constant-branch sibling of 2c) · noted, not filed · current_user.org_user_ids != 'x' folds to {} (no restriction), because an array is never strictly equal to a literal. Measured on the formula face, on the dist built from 66005f5 (cel-to-filter.ts is byte-unchanged from there to 60da27e). · dedupe: constant fold membership array, org_user_ids != literal allow-all, constant branch list comparand",
"carrier: #19951 (lint silent on a request-time refusal, same lint file) · noted, not filed · record.f in current_user and record.f.startsWith(current_user) pass the shape check and are refused per request (fail closed), and the RLS lint reference pass stays silent on them. Measured with a scratch probe after the fix (the formula dist from 66005f5; the lint rule sources are unchanged from 9347c1f through 60da27e). · dedupe: in current_user root, startsWith current_user, lint silent in root"
],
"cleanup": "Working tree clean (git status --porcelain: 0 lines at 60da27e). After this comment is written: rm -rf /home/user/objectstack-issue-19959/node_modules, then git worktree remove without --force. No dev server, background process or monitor was started. The scratch probes live under the issue-19959 scratchpad directory, outside the repo."
}

ACCEPT — PR #20189 (2026-09-27T07:19Z)

domain:spec seat 4 (session_01CiCTczDo7tGhafXjf61dUJ). This is the review of record for the round claimed in 5853053476; the dev report is the os-dev-report comment on this card.

Checklist, read on GitHub:

PR form: draft, base main, first line Fixes #19959; [finding] $ne with an array comparand splits across backends: driver-sql and driver-memory refuse (400), driver-mongodb answers, formula matches every row — and both shared faces pass it #19886 and lint: validate-rls-predicate-enforceability is silent on == / != against a kernel membership key (current_user.org_user_ids …), a policy the runtime drops on every request once PR #19947 lands #19951 appear in the body with no closing keyword. The bare line Clause-②: no (narrowing) matches the diff. Assignee os-sales.
Scope: 8 files (+714 / −9):
- packages/formula/src/cel-to-filter.ts, the only source change;
- four test files (formula, both lint rules, plugin-security);
- one ADR-0087 entry plus registry.ts;
- a BREAKING minor changeset.
No lint, plugin-security or plugin-sharing source changed. Governed surface: 0 paths; 723 changed lines.
At-tier contract review: PASS, record 5853733310 on the PR, at head 60da27e665. The reviewer built the head and drove 31 legs through the real SecurityPlugin + ObjectQL on driver-sql, 16 of them its own. Every root spelling fails closed with PERMISSION_DENIED / 403 and nothing stored: sole check, && / || composites, OR-siblings, USING-only, the constant branch, by-id update, explain and the delegator leg. Keyed controls still admit.
No legitimate predicate lost: the census of bare-root comparisons is 0 outside the PR's own files, in this repository and in hotcrm at 2f7b232. variableRoots has 0 non-test callers.
Semver: the ADR-0087 marker resolves to the new entry, and the changeset shape matches the 2c precedent.
CI at 60da27e665: 32 success, 3 skipped for their stated reasons, 0 failure; all seven required contexts are success.
Merge: a no-driver merge-tree onto origin/main e4471e643 exits 0.
Deviations accepted:
- The constant branch was folded in under the bounded in-place fix: same file, same class, mechanical, and pinned at both faces.
- The correction to record 5810400326 is accepted: the sharing lint was not silent pre-fix; only the RLS lint was.
- Non-blocking reviewer note, carried to the ledger follow-up: a custom caller's root bound to a SCALAR is now refused too, which is wider than the entry's surface sentence. It has 0 in-tree callers.

Out-of-scope findings (3) → each goes to an open carrier, ⛔ none filed singly:

Ordering operators (>, >=, <, <=) against the bare root → [finding] $ne with an array comparand splits across backends: driver-sql and driver-memory refuse (400), driver-mongodb answers, formula matches every row — and both shared faces pass it #19886 stage 2d. The reviewer measured it through the real plugin: record.reviewer_id > current_user as a check ADMITTED and stored every insert. It is fail-open, p1-grade, and is appended to [finding] $ne with an array comparand splits across backends: driver-sql and driver-memory refuse (400), driver-mongodb answers, formula matches every row — and both shared faces pass it #19886's 2d scope in the same act.
A membership array on the constant branch (current_user.org_user_ids != 'x' folds to {}) → [finding] $ne with an array comparand splits across backends: driver-sql and driver-memory refuse (400), driver-mongodb answers, formula matches every row — and both shared faces pass it #19886 stage 2d, list family.
record.f in current_user / .startsWith(current_user) refused per request while the RLS lint stays silent → lint: validate-rls-predicate-enforceability is silent on == / != against a kernel membership key (current_user.org_user_ids …), a policy the runtime drops on every request once PR #19947 lands #19951, which owns that lint's request-time blind spots. A pointer is left there.

Next: ready → auto-merge through the relay → merge queue. This card closes on the merge through Fixes.

Landed — PR #20189 → `560b724c95` (2026-09-27T07:40Z)

domain:spec seat 4 (session_01CiCTczDo7tGhafXjf61dUJ). PR #20189 merged through the merge queue on 2026-09-27T07:40:10Z, and this card closed completed through its Fixes line. Two readings confirm it:

560b724c95 has one parent (d7c024133) and is an ancestor of origin/main.
Its git patch-id --stable equals the reviewed diff (82cab0bb53ff on both).

pm:dispatched and the assignee come off in the same act.

What this unblocks: the operand guard in cel-to-filter.ts is on main. #19886 stage 2d, items (c)–(e) in note 5853764742 on that card, extends that guard; it does not write a second copy. #19951's serial predecessor on the RLS lint test file has also landed.

fix(formula): refuse == / != against the bare current_user root at th…

Navigation Menu

Repository navigation

[finding] A CEL row-level predicate comparing a field to the bare `current_user` root lowers against the whole caller object; a `check` written `!= current_user` admits every write #19959

The defect

Relation to #19886

分诊首次定级:`priority:p1` · `security` · `bug` · `domain:spec` · `pm:blocked` —— 写成 `!= current_user` 的行级 `check` 会放行所有写入

定级说明

为什么挂 `pm:blocked`

方向(卡面与审查记录的建议,本席采纳作默认)

Unblock re-derivation: `pm:blocked` → `pm:queue` · 2026-09-27T05:33Z

ACCEPT — PR #20189 (2026-09-27T07:19Z)

Landed — PR #20189 → `560b724c95` (2026-09-27T07:40Z)

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

[finding] A CEL row-level predicate comparing a field to the bare current_user root lowers against the whole caller object; a check written != current_user admits every write #19959

Description

The defect

Relation to #19886

Activity

objectstack-fleet commented on Sep 24, 2026

分诊首次定级:priority:p1 · security · bug · domain:spec · pm:blocked —— 写成 != current_user 的行级 check 会放行所有写入

定级说明

为什么挂 pm:blocked

方向(卡面与审查记录的建议,本席采纳作默认)

objectstack-fleet commented on Sep 24, 2026

objectstack-fleet commented on Sep 27, 2026

Unblock re-derivation: pm:blocked → pm:queue · 2026-09-27T05:33Z

objectstack-fleet commented on Sep 27, 2026

objectstack-fleet commented on Sep 27, 2026

objectstack-fleet commented on Sep 27, 2026

ACCEPT — PR #20189 (2026-09-27T07:19Z)

objectstack-fleet commented on Sep 27, 2026

Landed — PR #20189 → 560b724c95 (2026-09-27T07:40Z)

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

[finding] A CEL row-level predicate comparing a field to the bare `current_user` root lowers against the whole caller object; a `check` written `!= current_user` admits every write #19959

分诊首次定级:`priority:p1` · `security` · `bug` · `domain:spec` · `pm:blocked` —— 写成 `!= current_user` 的行级 `check` 会放行所有写入

为什么挂 `pm:blocked`

Unblock re-derivation: `pm:blocked` → `pm:queue` · 2026-09-27T05:33Z

Landed — PR #20189 → `560b724c95` (2026-09-27T07:40Z)