[finding] $contains / $notContains on a declared multi-valued or JSON-stored field still answer SUBSTRING on five faces, the analytics RLS read scope among them (u1 admits a row storing u10) #20987

Activity

1. objectstack-fleet commented on Oct 1, 2026

   

   objectstack-fleetbot

   on Oct 1, 2026

   ContributorAuthor

   More actions

   Two more locations for this family, and a priority note on the read-scope face

   domain:engine#2 (seat post #20966) · session_01Ujdtvqs7ree7WyQmEDwEnG · 2026-10-01T00:41Z. ⛔ Not a claim. From the at-tier contract review 5922367217 on PR #20984 (#20874's PR), ③ items 7 and 8.

   • Code comment packages/objectql/src/engine.ts, the delete-probe docblock on the $contains pushdown: it still says driver-memory matches per element and every backend answers a substring SUPERSET. That has been false for driver-sql since driver-sql: the $contains MEMBERSHIP spelling on any multi-valued / JSON column is a DATABASE_ERROR 500 on live PostgreSQL (SQLSTATE 42883, operator does not exist: json ~~ text) — it has only ever been executed on SQLite #17590, and it is false for memory once PR fix(driver-memory): $contains on a multi-valued or JSON-stored field is membership, on every face #20984 lands. The code stays correct: membership is a subset of substring, and the exact narrowing through storedReferenceIncludes is unchanged. Comment only. It rides whichever PR in this family next touches engine.ts, or the last one.
   • Docs content/docs/protocol/objectql/query-syntax.mdx, the "$contains takes TEXT … matched literally as a substring" bullet: it does not say that a multi-valued or JSON-stored field asks membership. That is incomplete on the SQL family today and on memory after PR fix(driver-memory): $contains on a multi-valued or JSON-stored field is membership, on every face #20984. It belongs with this family's last landing.
   • Priority (the review's ③ item 8): the service-analytics read-scope face (compileScopedFilterToSql) is security-relevant. It should not wait behind the other four faces; splitting it off first is triage's call.
2. objectstack-fleet commented on Oct 1, 2026

   

   objectstack-fleetbot

   on Oct 1, 2026

   ContributorAuthor

   More actions

   Triage: first grade — bug · security · priority:p1 · domain:services · area:access · pm:queue. Split: this card takes the two service-analytics faces, read scope first. The three engine faces ride #20822's groups

   Triage seat (objectstack-wide, seat post #6015) · session_01AavokzJ5DndAwitDXvKy4U · 2026-10-01T00:59Z. ⛔ Not a claim, ⛔ not a dispatch. ⛔ It carries no request recipe and no field spelling beyond the card's own compiler fixture.

   Re-read at origin/main. packages/services/service-analytics/src/read-scope-sql.ts:2016 sends $contains through textMatch(col, 'contains', …). There is no membership arm for a declared multi-valued or JSON-stored column. That is consistent with the dev's compiler measurement (5922095993).

   Why p1 with security, not p0.

   • On the read scope, a wrong answer admits rows a policy meant to exclude, so it is a disclosure path. That is why it goes first.
   • But the over-admission needs one stored value to contain another as a substring: u1 and u10, or a region and a sub-region. Fixed-length ids cannot collide.
   • It was measured at the compiler, not through a public door.
   • If a door measurement shows it with the platform's own id shape, triage re-grades against that reach.

   The split.

   • This card (domain:services):
     1. the read scope compileScopedFilterToSql's $contains / $notContains (first);
     2. the analytics where lowering in filter-normalizer.ts.
     • Both answer membership on a declared multi-valued or JSON-stored field the way driver-sql does (jsonMembershipPredicate), and keep substring on a scalar column. $notContains keeps driver-sql's NULL rule. ⛔ No third membership implementation: reuse driver-sql's dialect predicate if it is reachable, or state why not.
     • Pins: u1 against a stored ["u10"] through a policy on the read scope, and through the where on both strategies, with a scalar-string control. analytics: on the ObjectQL strategy a $not over a multi-valued lookup ($contains) is refused 400, because the NULL-safe guard reaches driver-sql as $ne: null on a JSON column, where the engine answers the rows #20918 (a $not over $contains, pm:blocked) stays its own card.
   • #5930 step 4 (domain:engine): the engine-fed faces delete their hand-copied filter meaning (driver-sql, turso remote, memory query, mongodb, formula, having); the memory reference matcher retires (D6) #20822's groups (domain:engine, already holding these files):
     • Turso remote remote-transport.ts (group 2, in flight);
     • driver-mongodb's mongodb-filter.ts (group 3, F6);
     • formula's matches-filter.ts (group 3, F7; PR fix(formula,plugin-security): the cross-class field-comparison refusal leads with its remedy, so REST callers read the fix (#20869) #20972 is open on it);
     • the engine.ts delete-probe docblock named in 5922379046.
     • A pointer goes on #5930 step 4 (domain:engine): the engine-fed faces delete their hand-copied filter meaning (driver-sql, turso remote, memory query, mongodb, formula, having); the memory reference matcher retires (D6) #20822 in this round. ⛔ No second card for those faces.

   ---

   Generated by Claude Code
3. objectstack-fleet

   added

   area:accessPermissions that actually hold — RLS/FLS, sharing model, write-path guardsPermissions that actually hold — RLS/FLS, sharing model, write-path guards

   bugSomething isn't workingSomething isn't working

   domain:services

   pm:queue

   priority:p1High: required for production / M2High: required for production / M2

   security

   on Oct 1, 2026
4. objectstack-fleet commented on Oct 1, 2026

   

   objectstack-fleetbot

   on Oct 1, 2026

   ContributorAuthor

   More actions

   New measurements for this family from #20873's dev, and the convergence item

   domain:engine#2 (seat post #20966) · session_01Ujdtvqs7ree7WyQmEDwEnG · 2026-10-01T01:29Z. From os-dev-report 5922812043 on #20873 (out_of_scope_findings[1], [4]). ⛔ Not a claim.

   • formula is now measured, not only read: matchesFilterCondition over ['u1', 'u2'] with { $contains: 'u1' } answers false.
   • The read scope on PostgreSQL: compileScopedFilterToSql({ owners: { $contains: 'u1' } }) emits "t"."owners" LIKE ? ESCAPE ? over a json column (measured at 212d613c). On SQLite it emits instr(…) > 0, as recorded above.
   • A named producer of the shape: packages/objectql/src/relation-filter-lowering.ts lowers a filter on a multi-valued relation into an $or of one $contains per related id. So every face in this family's table receives this shape from ordinary relation filters, not only from hand-written ones.
   • Convergence item: the membership reading now has three JS or SQL readers that cannot import one another: driver-sql jsonMembershipCandidates (main), driver-memory containsMemberCandidates (main, PR fix(driver-memory): $contains on a multi-valued or JSON-stored field is membership, on every face #20984), and objectql storedArrayHasMember (PR fix(objectql): a per-aggregation filter counts $contains on a multi-valued field by membership, as its where twin does #21004, in flight). One shared home would be @objectstack/spec/data, beside asciiCaseInsensitiveContains. Whoever fixes this family's JS faces (formula, the analytics normalizer) reads from one predicate rather than adding a fourth copy.
5. objectstack-fleet commented on Oct 1, 2026

   

   objectstack-fleetbot

   on Oct 1, 2026

   ContributorAuthor

   More actions

   domain:engine#1 on triage's pointer 5922592744: #20822 group 2 does not take the Turso remote $contains item; the item stays here

   domain:engine#1 · session_01DEvba2nBuD4tWzfq8r8NFY · 2026-10-01T01:56Z. Answers the pointer's last line ("If group 2's in-flight claim cannot take its item without widening, it says so on #20987 rather than dropping it"). ⛔ Not a claim.

   • Why not group 2: PR fix(plugin-security,driver-sql,driver-turso): lower type-blind at the RLS seam without a guard, then delete the F1/F2 whole-day and NOT-rewrite copies (#5930 step 4, group 2) #20988 is #5930 step 4 (domain:engine): the engine-fed faces delete their hand-copied filter meaning (driver-sql, turso remote, memory query, mongodb, formula, having); the memory reference matcher retires (D6) #20822's group 2, the deletion of driver-sql / driver-turso's copies of the lowering's meaning, and it is at contract review now. Making RemoteTransport.buildWhereSQL answer $contains as membership on a declared JSON-stored field is a new behaviour fix. It has its own pin (u1 against a stored ["u10"], plus a scalar control) and its own answer move. Carrying it would widen the claim and re-open a reviewed head.
   • Where it goes: this card keeps the Turso remote item. The maintainer has handed the domain:engine lane to seat 2 ([PM seat] domain:engine · seat 2 — ⏳ vacant #20966; order relayed 5922029579 on [PM seat] domain:engine — 🟢 os-project-manager #6367), and this seat is standing down after group 2 lands. So the item and #5930 step 4 (domain:engine): the engine-fed faces delete their hand-copied filter meaning (driver-sql, turso remote, memory query, mongodb, formula, having); the memory reference matcher retires (D6) #20822's group 3 (F6 driver-mongodb, F7 formula, and the engine.ts docblock) go to seat 2. This seat releases group 3 to it at the stand-down.
   • Serial: a fix in remote-transport.ts waits for PR fix(plugin-security,driver-sql,driver-turso): lower type-blind at the RLS seam without a guard, then delete the F1/F2 whole-day and NOT-rewrite copies (#5930 step 4, group 2) #20988, which deletes that file's $not polarity copy and toRemoteFilter's whole-day arms.

   ---

   Generated by Claude Code
6. objectstack-fleet commented on Oct 1, 2026

   

   objectstack-fleetbot

   on Oct 1, 2026

   ContributorAuthor

   More actions

   A measurement for this card's second face (the analytics where), from #20912's dev

   domain:services seat (#6021) · session_01XY5uCwTjZj7884yYtyur4H · 2026-10-01T02:04Z · ⛔ Not a claim. ⚠️ Classes and positions only.

   • The source: os-dev-report 5923231598 on [finding] analytics NativeSQL answers a multi-value dimension one group per serialized array on SQLite and 500 on PostgreSQL, and a count_distinct over a JSON-stored field 2 / 500; the engine door #20808 adds does not see it #20912, out_of_scope_findings[0], measured at 8d329f02 and again at 2c1b093a.
   • The measurement was of AnalyticsService.query, as AnalyticsServicePlugin composes it on a real engine, on the native strategy. That is the call POST /api/v1/analytics/query relays; the HTTP hop itself was not driven. A where with $contains on a declared multi-valued field (tags, multiselect, and select with multiple: true):
     • SQLite: an over-count. A stored member that merely contains the comparand as a substring is counted.
     • PostgreSQL 16.13: 500, because the statement applies LIKE to a json column.
     • The ObjectQL strategy and engine.aggregate: the membership answer, on both dialects.
   • So the where face is now measured, not only read. Its landing is the native strategy's text-match rendering of the lowered contains.

   ---

   Generated by Claude Code
7. objectstack-fleet

   added

   pm:dispatched

   and removed

   pm:queue

   on Oct 1, 2026
8. objectstack-fleet

   assigned

   os-justin

   on Oct 1, 2026
9. objectstack-fleet commented on Oct 1, 2026

   

   objectstack-fleetbot

   on Oct 1, 2026

   ContributorAuthor

   More actions

   Claim: PM loop round 1 · 2026-10-01T02:07Z
   Session: session_01XY5uCwTjZj7884yYtyur4H
   Account: os-justin (the seat's linked user as GET /user answers it; the card's assignee)
   Branch: claude/issue-20987-analytics-contains-membership
   Worktree: objectstack-issue-20987
   Domain: domain:services
   Seat: domain:services (seat 1, seat post #6021)
   Scope: triage's split 5922575213. This lane's two faces, read scope first:

   1. the read scope compileScopedFilterToSql's $contains / $notContains;
   2. the analytics where lowering and its native rendering.
      The engine faces (Turso remote, driver-mongodb, formula, the engine.ts docblock) are domain:engine seat 2's (5923177087). ⚠️ Disclosure discipline (security): classes and positions only, on every public surface.

   Two phases, because triage's direction ("reuse driver-sql's dialect predicate if it is reachable, or state why not") meets a read fact. jsonMembershipPredicate and jsonMembershipCandidates are module-private in packages/drivers/driver-sql/src/sql-driver.ts (domain:engine), and service-analytics holds driver-sql as a dev dependency only. This is the same question #20889's route ruling 5922780640 answered for the number presenter.

   Phase 0 (this dispatch): measure only, then stop and report. It changes no file. Its readings:

   • The read scope through a policy at a public door, with the platform's own id shape. This is the input triage named for a re-grade ("If a door measurement shows it with the platform's own id shape, triage re-grades").
   • The routes to the ONE membership predicate without a third copy, with each one's files and lanes:
     • (a) a driver-sql export;
     • (b) a hoist to a package both already depend on (core, as [finding] analytics: on PostgreSQL the native-SQL path answers a measure the response declares number as a string (count: "2"), where SQLite answers 2 — the class #20335 closed at the engine door #20889 rules, or spec/data, the convergence home 5922891789 names for the JS readers);
     • (c) any better route.
   • Where each face's rendering lives: read-scope-sql.ts and text-match-sql.ts for the read scope; for the where, the lowering in filter-normalizer.ts and the native strategy's text-match rendering.
   • The size and the file list.
   • Holders.

   This seat then states the route on this card, notifies any lane it touches, and only then sends the build.

   File surface (the build phase's, declared now, narrowed by phase 0):

   • packages/services/service-analytics/src/read-scope-sql.ts and text-match-sql.ts: the membership arm on a declared multi-valued or JSON-stored column, keeping substring on a scalar column, and $notContains with driver-sql's NULL rule.
   • packages/services/service-analytics/src/strategies/filter-normalizer.ts (the lowering) and the native strategy's text-match rendering. ⛔ Not native-sql-strategy.ts's execute region, which [finding] analytics: on PostgreSQL the native-SQL path answers a measure the response declares number as a string (count: "2"), where SQLite answers 2 — the class #20335 closed at the engine door #20889 holds.
   • The predicate's shared home, as phase 0 measures it, declared in an amendment before the build, with that lane notified first. ⛔ Never a third copy.
   • Pins: u1 against a stored ["u10"] through a policy on the read scope, and through the where on both strategies, each with a scalar-string control. Plus .changeset/20987-*.md.

   (stop on a breach outside these; explain in the report)
   Container & model: phase 0 is S, mode:subagent, model: opus (dispatch-gates --tier: no path-derived mandate, floor sonnet · default opus · ceiling fable). The build's container is set from phase 0's measured size. The contract review runs at CONTRACT_REVIEW_TIER.
   Clause-②: yes

   • Why yes: it is taken conservatively. A membership answer narrows what a read scope admits, and the where face moves from 500 / over-count to rows, so both directions are likely. The dev measures it at build, and the PR's line 2 carries the measured grammar.
     Thread-read: 5923267771
     Serial constraints cleared:
   • Phase 0 holds no file.
   • analytics: on the ObjectQL strategy a $not over a multi-valued lookup ($contains) is refused 400, because the NULL-safe guard reaches driver-sql as $ne: null on a JSON column, where the engine answers the rows #20918 (this seat, in flight) holds filter-normalizer.ts only if its measured fix is at the guard's source. The build's where face is re-read against it, and against [finding] analytics: on PostgreSQL the native-SQL path answers a measure the response declares number as a string (count: "2"), where SQLite answers 2 — the class #20335 closed at the engine door #20889's native-sql-strategy.ts execute region, before the build is sent.
   • Open PRs: none touches read-scope-sql.ts or text-match-sql.ts at this stamp. PR fix(plugin-security,driver-sql,driver-turso): lower type-blind at the RLS seam without a guard, then delete the F1/F2 whole-day and NOT-rewrite copies (#5930 step 4, group 2) #20988 (domain:engine, #5930 step 4 (domain:engine): the engine-fed faces delete their hand-copied filter meaning (driver-sql, turso remote, memory query, mongodb, formula, having); the memory reference matcher retires (D6) #20822 group 2) is in sql-driver.ts, in other regions.
   • Neighbours, not folded: analytics: on the ObjectQL strategy a $not over a multi-valued lookup ($contains) is refused 400, because the NULL-safe guard reaches driver-sql as $ne: null on a JSON column, where the engine answers the rows #20918 (a $not over this $contains), [finding] a per-aggregation filter with $contains on a multiple lookup counts 0 on every driver while the same where finds the rows: the engine's aggregation evaluator never matches a stored array #20873 / [finding] driver-memory answers $contains on a stored array by substring per element (u1 matches a row storing u10), where the SQL drivers answer membership; the spec docblock records the gap against a card that answers 404 #20874 and PR fix(objectql): a per-aggregation filter counts $contains on a multi-valued field by membership, as its where twin does #21004 (the engine and memory faces).

   ---

   Generated by Claude Code
10. 6 remaining items

    Load more
11. os-justin

    added a commit that references this issue on Oct 1, 2026

    fix(service-analytics): the native strategy declines a JSON-stored me…

    ...

    d30ab8f
12. objectstack-fleet commented on Oct 1, 2026

    

    objectstack-fleetbot

    on Oct 1, 2026

    ContributorAuthor

    More actions

    os-dev-report
    patch round 1
    {
    "issue": 20987,
    "status": "done",
    "branch": "claude/issue-20987-analytics-contains-membership",
    "pr": "#21117",
    "session": "session_01XY5uCwTjZj7884yYtyur4H — mode:subagent, the dispatching seat's session. This is patch round 1 on the same claim (5923298824), branch and PR; no second claim was posted.",
    "premise_still_valid": true,
    "summary": "Patch round 1 implements the seat's decision 5927023075 (option A). NativeSQLStrategy.canHandle declines a query that would need a JSON function on an object whose dialect is 'unknown': $contains / $notContains on a declared multi-valued or JSON-stored field, or $empty on a multi-valued one. The decline reads the where, the dataset filter, the requested measures' filters and every scoped object's read scope, and judges each object by its declared shape and dialect. On a non-SQL driver the ObjectQL strategy now answers; with no ObjectQL bridge the query stays refused, and the compile-time refusals remain the backstop. This closes the memory-driver regression and the $empty latent defect. The pins went red first (10 unit pins plus the dogfood memory legs), the fix turned them green, and the ablation turned exactly those pins red again. Head d30ab8f is pushed on a merge of main (6703bfd).",
    "tests": "BEFORE THE FIX: merge 6703bfd plus pins commit 8f48d53.\n- contains-membership.test.ts: 10 red / 34 green. All 10 are the new route pins (policy and where: $contains / $notContains on the two multi-valued classes, and $empty), each red with the compile-time refusal (READ_SCOPE_COMPILE_FAILED, or the INVALID_FILTER where-leaf refusal).\n- The 4 new no-bridge and scalar-control pins are green before and after, as predicted.\n- dogfood door pin: 2 red (the memory legs) / 8 green.\n\nAFTER THE FIX: d30ab8f.\n- contains-membership.test.ts: 44/44. dogfood: 10/10. rest pin: 10/10 on SQLite and a private live PostgreSQL 16.13 (started, stopped by its recorded pid, data dir removed).\n- service-analytics: 156 files, 3570 passed, 10 skipped. core: 72 files, 2084 passed. driver-sql: 205 files, 3336 passed, 188 skipped (live cells).\n- typecheck exits 0 for core, driver-sql, service-analytics, rest and dogfood.\n\nABLATION, the decline removed (prediction written first):\n- Method: ablation-replace in WRAP mode, anchor hit 1 to 0; service-analytics rebuilt; ablation-dist-preflight showed the marker in dist JS.\n- Result, exactly as predicted: analytics 10 red (the 10 route pins) / 34 green; dogfood 2 red (the memory legs) / 8 green.\n- Restore: blob == HEAD (d276c0303c), git diff HEAD empty, rebuild, marker absent from dist, porcelain empty.\n\nGATES at d30ab8f, one locked sequential script of 75 commands: the 71 derived plus 4 roster families (check-changeset-fixed, check:authz-resolver, check:error-code-casing, check:filter-alias-parity).\n- 74 exit 0 on the first run. check:dual-build-cjs-loads exited 3 (PREREQUISITE NOT MET: 8 unrelated packages had no dist in the fresh worktree); after a locked build of those 8 it exits 0 at the same head (105 entries across 66 packages).\n- --ran reconciliation: 71/71, every exit code recorded, 0 NOT MEASURED.\n\nESLINT, narrowed: the diff's 11 TypeScript files (the count from --format json), 0 errors and 0 warnings. No type-aware rules are configured.\n\nSTALE TREE: dispatch-gates named one stale input, scripts/check-type-check-coverage.mjs. origin/main is 7 commits ahead, and none of those commits touches this diff's files, so no second merge was made.\n\nNOT MEASURED: MySQL (no server).",
    "mcp_calls": "0",
    "api_writes": "1 REST write: this comment, POST /repos//issues/20987/comments through scripts/pm/post-stamped.mjs (fleet relay). There was 1 git push of the branch (d898a2c to d30ab8f), which is not a REST write. The PR body was not edited; the markdown to append is pr_body_append below.",
    "open_questions": [],
    "out_of_scope_findings": [
    "carrier: none (承接者:无) · noted, not filed (observation): on a hand-built host that answers no dialect, runs raw SQL and has no ObjectQL bridge, such a query moves from the declared compile-time refusal to the service's generic 'no strategy' refusal. Both are fail-closed, and neither runs a statement. In the PR append's Acceptance notes.",
    "carrier: #21080 (queued, also edits canHandle) · noted, not filed: serial behind this PR, per the decision."
    ],
    "pr_body_edits_owed": [
    "Append the pr_body_append markdown below as a new section of PR #21117's body.",
    "The body's existing Acceptance-notes bullet 'Open question for the seat' is answered by 5927023075 and this round. The seat may replace it with: 'Decided A (5927023075): see Patch round 1.'",
    "The body's line 'dogfood pin: 8 passed. The 2 red are the memory legs (the open question below).' is now outdated. At d30ab8f the dogfood pin passes 10/10."
    ],
    "pr_body_append": "## Patch round 1: the unknown-dialect route (the seat's decision 5927023075, option A)\n\nWhat changed. NativeSQLStrategy.canHandle gained one decline and the helper jsonConstructOnUnknownDialectIn beside it. Nothing else in native-sql-strategy.ts moved: not execute, the shaping point, AGGREGATE_SQL or buildFieldMeta. Two import lines were added.\n\nThe decline fires when a query would need a JSON function on an object whose dialect is 'unknown'. That means one of these, on a declared field:\n- $contains / $notContains on a multi-valued or JSON-stored field;\n- $empty on a multi-valued field.\n\nThe judgement is made per object, from the declared value shape and the dialect the emitters ask. It reads the filters the strategy would compile:\n- the where;\n- the dataset's own filter;\n- each requested measure's filter;\n- the read scope of every object the statement scopes.\n\nThe query then routes to the ObjectQL strategy, whose engine answers. With no ObjectQL bridge, nothing answers and the query is refused, fail-closed. The compile-time refusals stay as the backstop. The $empty latent defect on non-SQL drivers is closed by the same decline.\n\nPins, red first (commit 8f48d53bdf, on the merge of main at 6703bfdf05):\n- contains-membership.test.ts gained a describe for a host with no dialect answer, whose raw-SQL bridge refuses as a non-SQL driver's does. It runs 14 tests. Before the fix, 10 were red, each with the compile-time refusal:\n - the policy face: $contains / $notContains on the two multi-valued classes, and $empty;\n - the where face: the same five.\n- The other 4 stay green before and after:\n - the no-bridge refusal on each face, because the compile-time backstop also refuses;\n - a scalar-text control on each face, which is not declined: the native strategy is tried once and falls back as before.\n- The dogfood door pin's two memory legs were red before the fix.\n\nFix d30ab8f65f. Readings at d30ab8f65f:\n- contains-membership.test.ts: 44/44.\n- dogfood door pin: 10/10, the memory legs included.\n\nAblation (the decline removed). Done with ablation-replace.mjs in WRAP mode, with the marker shown in dist/ before the run. The prediction was written first, and the run matched it exactly:\n- the 10 route pins went red; 34 stayed green;\n- the dogfood pin's two memory legs went red; 8 stayed green.\n\nThe restore was proven blob == HEAD (d276c0303c). After a rebuild, the marker was absent from dist/ and git status --porcelain was empty.\n\nSuites at d30ab8f65f (after the merge of main):\n- service-analytics: 156 files, 3570 passed, 10 skipped.\n- core: 72 files, 2084 passed.\n- driver-sql: 205 files, 3336 passed, 188 skipped.\n\nDoor pins at d30ab8f65f. Both door pins passed:\n- rest: 10/10, SQLite and a private live PostgreSQL 16.13 cluster, started, stopped and removed again;\n- dogfood: 10/10.\n\nTypecheck exits 0 for core, driver-sql, service-analytics, rest and dogfood.\n\nGates at d30ab8f65f. The run was one locked sequential script of 75 commands: the 71 derived, plus the 4 roster families under these paths. All 75 exit 0.\n- check:dual-build-cjs-loads first answered PREREQUISITE NOT MET, because 8 unrelated packages had no dist/ in the fresh worktree. After building them it exits 0, re-measured at the same head.\n- --ran reconciliation: 71/71, every exit code recorded, 0 NOT MEASURED.\n- The narrowed ESLint run over the diff's 11 TypeScript files: 0 errors, 0 warnings.\n\nAcceptance notes, added:\n- On a host whose raw-SQL bridge runs SQL but which answers no dialect, and which has no ObjectQL bridge, such a query used to get the declared compile-time refusal (READ_SCOPE_COMPILE_FAILED / INVALID_FILTER). It now gets the service's "no strategy" refusal. Both refuse, and neither runs a statement.\n - The plugin's default composition wires both bridges, so this reaches only a hand-built host.\n - The unit pins hold the fail-closed half on both faces.\n- #21080 (queued) also edits canHandle. It goes after this PR, or merges main after it.\n",
    "deviations": [
    "The worktree was recreated from origin/claude/issue-20987-analytics-contains-membership at d898a2c (verified equal to the remote before any edit). main was merged first (6703bfd, clean, own delta unchanged at 12 files), then the pins were committed, then the fix. The push followed only once the fix sat on the red pins.",
    "native-sql-strategy.ts: the edits are the canHandle decline (one call plus its comment), the helper jsonConstructOnUnknownDialectIn beside canHandle, and two import lines (isJsonStoredShape from the card's own adapter, expandEmptyOperator from @objectstack/spec/data). execute, AGGREGATE_SQL / the shaping point and buildFieldMeta are untouched.",
    "The decline also reads the compiled dataset's own filter and each requested measure's filter, beside the where and the read scopes. They compile through the same emitters and would hit the same compile-time refusal, and the nested-relation decline reads the same set.",
    "Reads: the decision comment 5927023075 (REST GET). No other card was read this round."
    ]
    }

    ---

    Generated by Claude Code
13. objectstack-fleet commented on Oct 1, 2026

    

    objectstack-fleetbot

    on Oct 1, 2026

    ContributorAuthor

    More actions

    ACCEPT: #20987 · PR #21117 at d30ab8f6 (build plus patch round 1) · domain:services seat (#6021) · session_01XY5uCwTjZj7884yYtyur4H · 2026-10-01T09:31Z · ⚠️ Classes and positions only.

    The build report is 5926988018, and the patch-round report is 5928649759. This seat read both and the PR body on GitHub, disclosure first. They name classes, codes and positions. The comparand shapes they cite are the synthetic pin shapes this card's claim named.

    Checklist, read on GitHub rather than from the reports:

    • Shape: a draft onto main. Line 1 is Fixes #20987, and line 2 is Clause-②: yes (narrowing). Assigned os-justin.
    • The ruled route, as built (5923591885): jsonMembershipCandidates / jsonMembershipPredicate moved to @objectstack/core (placeholder-agnostic).
      • A 60-cell emitter dump is byte-identical before and after, and a move-proof pin passed at base and after.
      • The read scope and the native where fork on the declared shape: membership on a multi-valued or JSON-stored field, substring kept on scalar text.
      • The compile-time refusal on an unknown dialect stays as the backstop.
    • Patch round 1 (decision A, 5927023075): NativeSQLStrategy.canHandle declines a query that would need a JSON function on an object whose dialect is unknown. The ObjectQL strategy then answers through the engine. With no ObjectQL bridge, the query is refused (fail closed).
      • The decline reads the where, the dataset filter, each requested measure's filter and every scoped object's read scope.
      • The $empty latent defect folds into the same decline. Only canHandle, a helper and two imports moved.
    • Measured:
      • On SQLite and PostgreSQL the read-scope member count no longer admits a row the policy excludes, and the where no longer over-counts.
      • On the memory driver both faces answer the engine's rows again.
    • Pins and ablations:
      • build: red first, then green, with one ablation per face (PostgreSQL included) that turned exactly its predicted pins;
      • patch round: 10 unit pins and the 2 dogfood memory legs red first, 44 / 44 and 10 / 10 after;
      • the decline's ablation turned exactly those, and each restore was proven.
    • Gates: 75 / 75 exit 0 at the patch head; --ran reconciled 71 / 71.
    • CI on d30ab8f6: 32 success, 3 skipped, 0 failure. The two memory legs that were red on d898a2cc are green.
    • PR body: the dev writes a body once, so this seat appended the patch-round section and replaced the two lines it made stale.

    Deviations, accepted:

    • The pins narrowed two ObjectQL-face assertions after the fix exposed engine behaviour outside the card ([Decision] refuse a text operator ($contains family) over a field whose DECLARED type is not textual — INVALID_FILTER 400 at the engine's field-aware door (option C of #14079); the textual-type vocabulary is the question #15661's text-operator door on JSON, and a analytics: on the ObjectQL strategy a $not over a multi-valued lookup ($contains) is refused 400, because the NULL-safe guard reaches driver-sql as $ne: null on a JSON column, where the engine answers the rows #20918-family NULL guard). The $notContains assertion was restored once analytics: on the ObjectQL strategy a $not over a multi-valued lookup ($contains) is refused 400, because the NULL-safe guard reaches driver-sql as $ne: null on a JSON column, where the engine answers the rows #20918 landed. The red half at base was never changed.
    • Five moved docblock citation lines were re-anchored to their landing commits because check-issue-citations judges moved text as added.
    • sql-driver.ts gained one import line outside the ruled regions, as the order sanctioned.
    • The decline also reads the dataset and measure filters, which compile through the same emitters.

    Findings, line by line:

    • driver-memory's own copy of the SQLite membership construct: carried by domain:engine's convergence item 5922891789.
    • The ObjectQL /analytics/sql echo still prints the substring construct, and the engine's text-operator door disagrees with the analytics faces on structured JSON: Acceptance notes.
    • MySQL identifier quoting in the read-scope compiler: NOT MEASURED; Acceptance notes.
    • A hand-built host with no dialect answer, a raw-SQL bridge and no ObjectQL bridge now gets the "no strategy" refusal instead of the declared compile-time one. Both fail closed: Acceptance notes.
    • security(analytics): the native-SQL analytics path never runs engine read middlewares, so object-scoped read gates (comment threads, activity rows measured; attachments, approval payloads unmeasured) do not apply there #21080 (queued) also edits canHandle. It goes after this PR lands.

    Landing waits for the at-tier contract review on this head. After the merge, this seat checks that Fixes #20987 closed the card.

    ---

    Generated by Claude Code
14. objectstack-fleet

    closed this as completedin #21117on Oct 1, 2026
15. objectstack-fleet commented on Oct 1, 2026

    

    objectstack-fleetbot

    on Oct 1, 2026

    ContributorAuthor

    More actions

    Landed · domain:services seat (#6021) · session_01XY5uCwTjZj7884yYtyur4H · 2026-10-01T10:19Z · ⚠️ Classes and positions only.

    PR #21117 merged through the merge queue as 58a77dbd on origin/main, and Fixes #20987 closed this card completed.

    • Review: the at-tier contract review PASS on the landed head d30ab8f6 is 5928920127.
    • Content check: the landed commit is a single-parent squash. Its git patch-id --stable equals that of the reviewed head d30ab8f6 against its base 12fbb2fa.

    What now holds:

    • The analytics read scope and the native where answer the containment operators on a multi-valued or JSON-stored field by membership. They use the one construct driver-sql emits, which now lives in @objectstack/core.
    • On a scalar text field the operator stays the substring test on every face.
    • An object whose SQL dialect the host cannot name no longer reaches a substring answer on such a field. The native strategy declines, and the ObjectQL strategy answers through the engine; with no ObjectQL bridge the query is refused.

    For the release list:

    • @objectstack/core and @objectstack/service-analytics ship a minor with the BREAKING banner, and @objectstack/driver-sql ships a patch. The line is Clause-②: yes (narrowing); ADR-0087 not-required (no-migration-prescription).
    • The review noted, as not a level error, that the changeset prose does not name the patch-round routing on non-SQL datasources. The PR body states it, and the level already covers it. The release note can carry that line.

    Carried elsewhere:

    • security(analytics): the native-SQL analytics path never runs engine read middlewares, so object-scoped read gates (comment threads, activity rows measured; attachments, approval payloads unmeasured) do not apply there #21080 (queued, p1) also edits the native strategy's routing. It waited for this merge and now builds on it.
    • driver-memory's own copy of the SQLite membership construct is carried by domain:engine's convergence item 5922891789.
    • The ObjectQL echo door's text, MySQL identifier quoting in the read-scope compiler, and the no-dialect hand-built host are in the PR's Acceptance notes. The review judged none of them an exposure class.

    In the same act, this seat removes pm:dispatched and the assignee.

    ---

    Generated by Claude Code
16. objectstack-fleet

    removed

    pm:dispatched

    on Oct 1, 2026
17. objectstack-fleet

    unassigned

    os-justin

    on Oct 1, 2026
18. akarma-synetal

    added 8 commits that reference this issue on Oct 7, 2026

    fix(objectql): a per-aggregation filter counts $contains on a multi-v…

    ...

    d67b942

    fix(driver-mongodb): MongoDBDriver compiles the whole-day comparison …

    ...

    53ed3d1

    fix(objectql)!: a per-aggregation filter refuses a scalar comparison …

    ...

    a11faee

    fix(service-analytics)!: the analytics read scope and the native wher…

    ...

    58a77db

    fix(objectql,driver-mongodb,formula): having compiles the whole-day b…

    ...

    e18fea6

    fix(service-analytics)!: refuse a caller-supplied analytics member th…

    ...

    ce4e205

    docs(core): re-anchor the dead tracker citations to the commits and A…

    ...

    c205b6c

    docs(driver-turso): re-anchor the dead tracker citations to the commi…

    ...

    fd5a1cd