fix(driver-sql, driver-turso): four filter-refusal doors read the provenance mark before naming a read scope field or comparand (#20020)

[objectstack-fleet]

Part of #20020. This PR covers the four driver-sql refusal doors and their twins in the Turso remote transport. The three engine doors the card also names are not changed: measured, they see no provenance mark on any host except the analytics face, so applying the rule there would hide every CRUD caller's own diagnostic. That needs a decision; see "The engine half" below.

Clause-②: no

What changed

A read scope is the RLS, sharing or tenant predicate that plugin-security (ordinary reads) and service-analytics (ObjectQLStrategy.withReadScope) AND into the caller's where. Both merges mark the scope 'policy' and the caller's own predicate 'author' (#8220, packages/spec/src/data/filter-subtree-provenance.ts). The contract for 'policy': "A refusal raised from inside it keeps the #7929 redaction: identity (INVALID_FILTER / 400) and capability statement on the wire, operands in the server log." And the fail direction: "Unmarked or ambiguous ⇒ withheld."

Four SqlDriver refusal doors did not read the mark. They now go through the seam the cross-field (#7929) and target-field (#8197) refusals already use: withheldFilterError, resolved in applyFilters / withWithheldFilterLog with resolveFilterSubtreeProvenance.

• Retired or unknown operator (the emitter's default: arm): retiredFilterOperatorError and the new unsupportedFilterOperatorError hand over the field's operator map as the node.
• Non-boolean $null / $exists (classifyFilterKey): the field's operator map is the node.
• $and / $or whose operand is not a list (assertFilterNodeList): the operand is the node when it is an object. A primitive operand is judged by the node that carries the key. The shared walk in @objectstack/spec hands that hook only the operand, the key and the path, so sqlFilterVerdictHooks rebuilds the node from the path. It records every node the walk announces through assertNode, keyed by paths made only of combinator keys and list indices. The spec hook signature is unchanged.
• A WHERE column the table does not have (unresolvableFilterColumnRefusal, raised after the statement ran): the dialect reports only a column name. unresolvableColumnProvenance finds every node in the query's where whose key (as written, through mapSortField, or through an external column map) or { $field } names that column. The name reaches the wire only when there is at least one such node and every one resolves 'author'. Otherwise the refusal uses the unnamed wording the method already had for a dialect message it could not parse. The four callers (find, count, aggregate, distinct) now pass their where.

Code and status are unchanged on every path: INVALID_FILTER / 400. The set of refused filters is unchanged. An 'author'-marked subtree gets the text the door answered before. The source templates are the same literals, now passed as the diagnostic and the author text.

Turso remote transport (the claim's conditional arm). RemoteTransport has its own copies of three of these doors, and they did not read the mark either:

• unsupportedOperator, for a retired or unknown operator. The same method's arm for a non-operator key in an operator map names the target the same way and is converted with it.
• nonListCombinator.
• nonBooleanNullComparand / nonBooleanExistsComparand.

They now go through withheldInvalidFilterError, and the new withheldRefusal helper sends the diagnostic to the sink. The transport has no refusal for an unresolvable WHERE column: find answers []. That door is not touched here. pushLike is not touched.

Measured: what each 400 body carried, before → after

Probe (scratch, not committed): a real ObjectQL over SqliteWasmDriver (a SqlDriver subclass). The analytics face went through the real POST /api/v1/analytics/query route: AnalyticsService in ObjectQL-only mode, with getReadScope returning the scope. The CRUD face went through ql.find under a middleware that copies plugin-security's merge and marking code. Before = base 26550c660. After = this branch, with driver-sql dist rebuilt. The scope used distinctive names (policy_stage, PSECRET…), and a row counts as a leak when one of them appeared in the response message.

refusal class	door	analytics face, policy scope	CRUD face, policy scope
column the table does not have	driver-sql	field → nothing	field → nothing
retired operator ($regex)	driver-sql	field, operator → nothing	field, operator → nothing
unknown operator	driver-sql	field, operator → nothing	field, operator → nothing
combinator, object operand	driver-sql	field, comparand → nothing	field, comparand → nothing
combinator, primitive operand	driver-sql	comparand → nothing	comparand → nothing
non-boolean $null	driver-sql	field, comparand → nothing	field, comparand → nothing
non-boolean $exists	driver-sql	field, comparand → nothing	field, comparand → nothing
text operator on a number field	engine	field → field (not changed)	no refusal: the door runs before the merge, and the scope matched 0 rows
unreadable temporal comparand	engine	field, comparand → same (not changed)	no refusal, 0 rows
unknown {placeholder}	@objectstack/core resolveFilterTokens via engine resolveWhereTokens	token → token (not changed)	no refusal: compared as a literal, 0 rows

• Every withheld row kept INVALID_FILTER / 400. The server log carried the field and the comparand.
• On the CRUD face, a caller's own filter vouched 'author' by the merge returned the same message before and after for all ten classes (first 220 characters compared). On the analytics face, the caller's own where answers were unchanged.
• With the real SecurityPlugin, a CEL rule policy_unsynced == 'PSECRET1u' on a field that is declared but has no column: before, a 400 naming policy_unsynced; after, the unnamed wording. A CEL rule on an undeclared field answered 0 rows with no refusal, before and after.

Host × mark: which marks a refusal door sees

How each column was read:

• Driver columns: measured with the real SecurityPlugin (a CEL using rule) over a real ObjectQL + SqliteWasmDriver, reading the where the driver received.
• Engine-doors column: measured with a recording middleware registered first on the simulated-merge engine. The doors run before any middleware, and the real-SecurityPlugin rows were not recorded separately at that stage.
• Analytics row: read from withReadScope, and consistent with the after-probe: the caller's arm discloses and the scope withholds.

host / path	engine doors see	driver: caller's where	driver: injected scope
no security plugin	no mark	unmarked	none
plugin-security, member, plain where	no mark	'author'	'policy'
plugin-security, member, no where	no mark	none	'policy'
plugin-security, system context	no mark	unmarked	none
plugin-security, anonymous	no mark	unmarked	none
plugin-security, where holding {current_user_id}	no mark	unmarked (the engine rewrote it before the merge)	'policy'
plugin-security, FilterArray where	no mark	'author' (the lowered copy is vouched)	'policy'
analytics withReadScope	caller arm 'author', scope 'policy'	'author'	'policy'
Turso REMOTE mode through TursoDriver	not measured	unmarked: toRemoteFilter rebuilds every node, measured by an 'author'-marked where getting the withheld text	unmarked

plugin-sharing was not measured end to end.

What an unmarked caller loses at the four driver doors: its own field, operator, comparand and path. It gets the withheld wording with the same code and status. Measured cases: no security plugin, system context, anonymous, a where holding a placeholder token, and Turso remote mode. A member's plain where under plugin-security keeps the full text.

The engine half: not in this PR

text-operator-declared-type-door.ts, temporal-comparand-door.ts and the unknown-placeholder refusal (UnknownFilterTokenError from packages/core/src/utils/filter-tokens.ts, called by the engine's resolveWhereTokens) all run on the caller's where before the middleware chain. The first column of the host table is the measurement: on every host except the analytics face, the where these doors see carries no mark at all. Under "unmarked ⇒ withheld", every REST, SDK and flow caller would lose what these three doors name for its OWN filter:

• the field and its declared type (the [Decision] refuse a text operator ($contains family) over a field whose DECLARED type is not textual — INVALID_FILTER 400 at the engine's field-aware door (option C of #14079); the textual-type vocabulary is the question #15661 ruling asks for both);
• the comparand and the remedy (An unparseable date comparand on a datetime filter is passed through and compares false — HTTP 200, zero rows, no diagnostic — while an unknown {placeholder} is correctly rejected 400 (17.0.0 GA) #8690);
• the placeholder and its "did you mean" suggestion.

On the CRUD face a read scope never reaches these doors (measured above), so they disclose policy content only on the analytics face. Options and a recommendation are in the os-dev-report on #20020. The seat took option C in claim amendment 5823437510: the analytics-face pre-judge belongs to the services lane (pointer 5823452098 on #19995), and this PR does not change these three doors.

Compile surfaces (per references/compile-surfaces.md)

#	face	this PR
1	driver-sql applyFilterCondition (and driver-sqlite-wasm / Turso local, by inheritance)	CHANGED: four doors
2	Turso RemoteTransport buildWhereSQL	CHANGED: three door classes. pushLike is untouched, and unsupportedOperator's $between arm still names its target, which cannot be reached from a policy through TursoDriver
3	service-analytics compileScopedFilterToSql	not touched (outside the claim); its refusals are the withheld READ_SCOPE_COMPILE_FAILED / 500
4	service-analytics lowerAnalyticsWhere	not touched (outside the claim); its non-boolean $null / $exists is #20040
5	formula matchesFilterCondition	not touched, not measured
half	objectql applyHaving / matchesHaving	not touched, not measured
—	driver-memory / driver-mongodb	not touched. They do not read the mark (grep); disclosure there is not measured

Tests

• New: packages/drivers/driver-sql/src/sql-driver-refusal-door-provenance.test.ts (34 cases) and packages/drivers/driver-turso/src/remote-transport-refusal-door-provenance.test.ts (29 cases). Per door, they cover:
  • policy-marked: same code and status, and no secret in the message; the secrets are in the log or sink.
  • author-marked: the full text, equal to what the withheld case logged.
  • unmarked: byte-identical to policy.
  • both arm orders of a merged $and.
  • the column door's lookup by name, and the combinator door's node lookup under nesting and $not.
• Existing pins marked 'author': these pins read a door's author-facing text on an unmarked where, so their where (or a shallow copy of a shared case constant) is now marked 'author', as a merge boundary marks a caller's own predicate. driver-sql: 11541, 17857, backend-fault-envelope, boolean-identity, filter-no-silent-drop, filter-refusal-envelope, icontains-and-retired-operators, null-operators (two assertions moved to code and status), out-of-contract-filter-input, text-case-conformance, unresolvable-where-column-refusal. driver-turso: bare-date-routing, comparand-refusal, node-operator-refusal, not-operator, null-comparand-refusal, text-predicates. driver-sqlite-wasm: icontains-and-retired-operators, which is outside the claim's file list, because SqliteWasmDriver inherits these doors.
• Rewritten: sql-driver-target-field-provenance.test.ts "an UNDECLARED operator still names its operator and field". It stood so that this widening would be a deliberate act, and it now pins both halves.
• Turso remote mode: remote-transport-text-predicates.test.ts ($regex through TursoDriver remote) and turso-local-remote-text-parity.test.ts now assert the withheld wording on the remote face, because toRemoteFilter drops the mark. A withheld remote answer must name none of the case's mentions.

Suites at head 3bf7a68ce (after merging main, which brought #20019):

• driver-sql: 183 files passed, 11 skipped; 2771 tests passed, 170 skipped.
• driver-turso: 65 files, 1473 tests passed.
• driver-sqlite-wasm: 31 files, 582 tests passed.

Before that merge, at 2e36f756d (the same code as 8e3c49fbc, which only adds the changeset):

• service-analytics: 118 files, 2560 tests passed.
• plugin-security: 130 files, 2561 tests passed.
• plugin-sharing: 37 files, 913 tests passed.

typecheck exits 0 for all three driver packages at 3bf7a68ce. The two new pin files and the changed driver-sqlite-wasm file are in their packages' tsc programs (--listFiles, 1 each).

Consumer pin changed (patch round 1, 244f5321e): packages/plugins/plugin-auth/src/auth-contains-filter.test.ts, face 3 (#5893). It read the retired-operator door's full text through an unmarked engine.find on a real SqlDriver, and it went red at b6f40dc95 (CI Test Core 6/6). It is re-pinned to the production behaviour:

• Unmarked leg, renamed "… and withholds the operator from an unmarked caller": INVALID_FILTER / 400, the message contains "is RETIRED" and names neither $regex nor $icontains, and the spied driver log names both.
• New 'author'-marked leg: the full text, $regex and the $icontains prescription, is kept for a vouched caller.
• The file's header note is restated to match. No plugin-auth source changed.

A repo-wide sweep found no other consumer pin on these four doors' wording. The old-wording grep over packages/, examples/ and apps/ tests gave 101 files, 19 of which reference a SQL-family driver, each read at its hit line. A trigger-token grep over the 311 test files outside the three drivers that use a real SQL driver found nothing more.

Patch-round suites (244f5321e, the same code as 5fb4b25b1, which only edits the changeset), each with its own exit code 0:

• plugin-auth: 114 files, 2440 tests passed.
• service-storage: 40 files, 627 tests passed.
• cli unit project: 224 files; 3129 tests passed, 29 skipped. Two published-subpath pin files needed cli built first, and passed after the build.
• cloud-connection 29/374, plugin-dev 8/80, connector-mcp 3/23 and hono 5/122.
• At 5fb4b25b1: driver-sql, driver-turso and driver-sqlite-wasm give the same counts as above.

These are the rest of CI Test Core shard 6/6, which may not have run once plugin-auth failed, because the step runs turbo without --continue. example-embed-objectql is NOT MEASURED: it depends only on driver-memory, objectql and spec.

Changeset (patch round 1, 5fb4b25b1): the frontmatter gains '@objectstack/driver-sqlite-wasm': patch, and one sentence states the inheritance: "SqliteWasmDriver (@objectstack/driver-sqlite-wasm) and TursoDriver in local mode extend SqlDriver, so they inherit this change from it: the same four doors answer the same way there."

Ablations (committed state, restored and proved by blob hash plus an empty git diff HEAD):

1. sql-driver.ts reverted to base: the new driver-sql pin file had 32 of 34 failing. The 2 that passed are author-disclosure cases that base satisfies by disclosing to everyone.
2. The combinator door's node lookup replaced with undefined (through scripts/ablation-replace.mjs, anchor 1 → 0): 4 failing, exactly the primitive-operand author cases.
3. remote-transport.ts reverted to base: 29 of 29 failing.

Gates

• dispatch-gates --commands derived 62 families from this diff at 3bf7a68ce. All 62 exited 0. check:dual-build-cjs-loads and check:type-check-debt first exited 3 (PREREQUISITE NOT MET) and exited 0 after turbo run build --filter=./packages/* --filter=./packages/*/*. --ran reconciliation: 62 derived, 62 run, 0 NOT-MEASURED, derived from recorded exit codes.
• After the last changeset edit (b6f40dc95), the changeset and prose gates were re-run and exited 0: ADR-0087 registration, no-major, empty-changeset, deadline census, objectui-changeset, nul-bytes, doc-authoring.
• check-issue-citations --base 9d81af714: exit 0, 28 citations resolve.
• check:driver-conformance: "50 covered cell(s), 0 in the DEBT ledger, 0 exempt" before and after.
• ESLint on the 24 changed .ts files: 24 files, 0 errors, 0 warnings. eslint.config.mjs sets no parserOptions.project, so this diff cannot change a verdict on an untouched file. The repo-wide run is CI's.

Acceptance notes

• Eight more driver-sql doors relay policy content on the CRUD face. Measured with the same probe and a policy-marked scope, at head:

  • an empty $icontains;
  • a non-string $like;
  • a $like pattern with a trailing escape;
  • an object $contains comparand;
  • an object $in member;
  • an undefined comparand;
  • a non-node element of $or;
  • an undeclared node combinator.

  Each 400 named the field or the comparand. They are outside this card's seven and the claim's file surface, so they are reported to the seat as a finding rather than fixed here. The seat filed them as driver-sql: eight more filter-compile refusal doors ignore the #8220 provenance mark, so a policy read scope refused there relays its field or comparand in the 400; close the class so every compile refusal goes through the withheld seam #20039.

• Analytics caller where. On POST /api/v1/analytics/query, a caller's { f: { $null: 'x' } } or { f: { $exists: 'x' } } answered 200. The driver received { f: { $ne: null } }. Reported to the seat, which filed it as service-analytics: the caller-where lowering reads $null / $exists flags by identity, so a non-boolean flag ({ $null: "x" }) is answered 200 as IS NOT NULL where every other face refuses it (#5347 / #5369) #20040 (services lane).

• Stale prose, not pins: two test comments still say driver-sql refuses $regex "by name", which is now true only for an 'author'-marked where: plugin-auth auth-where-operator-coverage.test.ts (header note) and runtime undeclared-field-write-driver-split.integration.test.ts. Neither asserts that wording.

• Turso remote mode. TursoDriver.toRemoteFilter rebuilds every filter node, so no mark reaches RemoteTransport in remote mode, and every mark-reading refusal there withholds for every caller. This fails closed and discloses nothing.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 2 package(s): @objectstack/driver-sql, @objectstack/driver-turso, touching 25 documentable anchor(s).

8 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/data-modeling/drivers.mdx (via SqlDriver (symbol, a top-level class))
• content/docs/data-modeling/index.mdx (via SqlDriver (symbol, a top-level class))
• content/docs/permissions/tenant-audit-census.mdx (via SqlDriver (symbol, a top-level class))
• content/docs/plugins/packages.mdx (via SqlDriver (symbol, a top-level class))
• content/docs/protocol/kernel/index.mdx (via SqlDriver (symbol, a top-level class))
• content/docs/protocol/kernel/lifecycle.mdx (via SqlDriver (symbol, a top-level class))
• content/docs/protocol/objectql/query-syntax.mdx (via SqlDriver (symbol, a top-level class))
• content/docs/protocol/objectql/types.mdx (via SqlDriver (symbol, a top-level class))

⛔ 1 release-owned page(s) also name something this change touched. These are read-only:

• content/docs/releases/v17/17-0.mdx (via SqlDriver (symbol, a top-level class))

content/docs/releases/ is RELEASE-OWNED (AGENTS.md "Documentation Guardrails"): release
notes are written centrally at release time, and a code PR that edits them is the exact PR
that guardrail exists to stop. They are still audited — read-only. If one of them is actually
wrong, file an issue or open a dedicated docs-only PR; do not edit it here.

What this run could not see

• 1 name(s) were too generic to anchor anything (single lowercase words)
• the SDK route bridge reached 60 of 215 client-bound route-ledger rows — the other 155 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 155: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 55 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 100 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 13 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 246314dffef9af072b6172d0f1f9678fb7363dec → packageMentionDocs.

Which tree this was computed on

This run read content/docs from e3beb770363735732f0f51dfb0ab28082b6a6e53 — the merge of head 5fb4b25b1218a23759a2d7d45e55bd5d553da899 into base 246314dffef9af072b6172d0f1f9678fb7363dec, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin e3beb770363735732f0f51dfb0ab28082b6a6e53 && git checkout e3beb770363735732f0f51dfb0ab28082b6a6e53
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 246314dffef9af072b6172d0f1f9678fb7363dec 5fb4b25b1218a23759a2d7d45e55bd5d553da899 && git checkout -B drift-repro 246314dffef9af072b6172d0f1f9678fb7363dec && git merge --no-ff 5fb4b25b1218a23759a2d7d45e55bd5d553da899

node scripts/docs-audit/affected-docs.mjs --json 246314dffef9af072b6172d0f1f9678fb7363dec

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 246314dffef9af072b6172d0f1f9678fb7363dec → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[objectstack-fleet]

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: b6f40dc9564de59ef4962fbb4c9484cc07afa916

The merge base with origin/main is 9d81af714; the branch merged main at 3bf7a68ce. The diff against it is 25 files, +1033/−115, as the PR states. Reviewed in the reviewer's own detached worktree at head, removed afterwards. Base-vs-head readings were taken with the two door files reverted to the merge base by blob and restored by blob.

① Derived judgments

• A. Accept set: unchanged, RIGHT. 9 door variants × find / count (18 cells) are refused INVALID_FILTER / 400 in every cell at base and at head. The four doors' trigger conditions are untouched. Clause-②: no holds.
• B. The wire message at each converted driver-sql door.
  • 'policy' and unmarked are withheld: RIGHT.
    • The pin file is 34/34 at head.
    • The reviewer's own dump of unmarked wheres shows zero occurrences of the field, comparand or operator across 18 cells.
    • Measured through a real ObjectQL + SqlDriver under five hosts: no security plugin; a plugin-security-shaped merge with the door in the 'policy' arm; the real SecurityPlugin in system context; the same in anonymous context; and a member where holding {current_user_id}. Every row answered INVALID_FILTER / 400 with zero leaks, and every secret appeared in the server log line.
  • 'author' keeps today's text byte for byte: RIGHT. The base dump and head's author dump are identical in all 18 cells. A member's plain where under the real SecurityPlugin gets the full text.
  • The column door through a real CEL policy on a declared-but-dropped column is withheld; a member where naming the same column beside that policy is also withheld (the both-arms rule). RIGHT.
• C. Mark resolution: RIGHT.
  • The innermost mark wins, and the refusing arm decides. Both arm orders, nesting under $or / $and / $not, and the path-to-node index are sound.
  • Hunted disclosure paths: the thrown error's own keys are exactly code and status (no details, constraint or cause, and REST never relays cause). The wire carries no arm order, index, nesting, path or dialect text. The only per-door variant is the class statement, the contract's "which class fired", the same shape driver-sql: the #7929 withhold covers the cross-field family only — every other INVALID_FILTER refusal still names the target field, which is admin-authored on a read-scope predicate #8197 ships.
• D. The Turso RemoteTransport twins: RIGHT.
  • 29/29 pins at head, and 29/29 red with the file at base.
  • TursoDriver.toRemoteFilter rebuilds each node from Object.entries, so no mark reaches the transport in remote mode and every mark-reading refusal withholds there (code + pin).
  • The sink is wired to logger.warn.
  • The remote unresolvable column answers [], untouched.
• E. Public surface: RIGHT. No export is added or removed. Two protected methods gain a trailing optional parameter, which is compatible and declared.
• F. Caller populations that lose their own diagnostic at these four doors.
  • Measured by this review: no security plugin, system context, anonymous, a where holding a placeholder token (rewritten before the merge), and Turso remote mode. The changeset and body state this cost truthfully.
  • WRONG / undeclared: an in-repo consumer in exactly this population, packages/plugins/plugin-auth/src/auth-contains-filter.test.ts:309-310 (auth-contains-filter.test.ts 的见证后端迁 sqlite 排在 #5702 之后 —— #5830 裁决 C 的到期单 #5893 face 3: an unmarked engine.find('sys_user', { where: { name: { $regex } } }) asserting $regex and $icontains in the message), is red at this head. Reproduced locally: 1 failed | 8 passed (9).
• G. Suites in the reviewer's worktree:
  • with the doors reverted: driver-sql 32 of 34 red (the 2 passes are author cases base satisfies by disclosing to all), and turso 29/29 red;
  • at head: driver-sql 2771 / 170 skipped, driver-turso 1473, sqlite-wasm 582, equal to the PR body.
• H. CI at this head: 34 runs.
  • Test Core FAILURE (Test Core (6/6): @objectstack/plugin-auth#test, auth-contains-filter.test.ts › [#5893] … refuses a bare $regex …, naming its replacement, "expected 'A filter operator in this filter is R…' to contain '$regex'").
  • At the merge base, Test Core (6/6) is success, so the red is caused by this diff.
  • Every other required context is success.

② Semver level

patch for @objectstack/driver-sql and @objectstack/driver-turso, with Clause-②: no: RIGHT. The accept set does not move, message text is outside the published accept set, and no export changes. The closest precedent, #8197, shipped as a patch. driver-sqlite-wasm needs no entry (one fixed group; only a test file changed). Wording note: the changeset does not say that SqliteWasmDriver and Turso local mode inherit the change.

③ Boundary flags

Changeset: every sentence is TRUE, including the four door bullets, "reads the mark on the node it refused", the withheld and 'author' semantics, the lookup rules, "What an unmarked caller loses" and its four measured cases, the member case, the remote-transport paragraph, "Not changed" and the engine-door disclaimer. The analytics HTTP half of "Measured on both faces" is UNMEASURED by this review; its code path is consistent.

Shipped strings: every sentence of the four driver-sql withheld messages and the five [RemoteTransport] messages is TRUE. None carries a tracker number.

PR body:

• TRUE: "Code and status are unchanged", "The set of refused filters is unchanged", the byte-identical author text, the per-door CRUD rows, the engine rows (the doors run before the merge on CRUD, and ignore the mark on the analytics-shaped tree), and the host × mark table rows measured.
• FALSE by omission: the Tests section presents the changed pins as complete while a dependent's pin on this exact wording (plugin-auth auth-contains-filter.test.ts 的见证后端迁 sqlite 排在 #5702 之后 —— #5830 裁决 C 的到期单 #5893 face 3) is red, and "Suites at head" does not list plugin-auth.

The dev's open questions and out-of-scope findings, judged for truth:

• The engine doors relay policy content on the analytics face and see no mark on CRUD hosts: REAL (measured; the ordering was verified in engine.ts).
• Eight more driver-sql doors relay on the CRUD face: REAL, all eight measured under a 'policy'-marked arm through real ObjectQL + SqlDriver.
• The analytics caller-where non-boolean $null / $exists is answered and coerced: REAL by code reading (filter-normalizer.ts reads the flags by identity and lowers everything else to IS NOT NULL). The HTTP measurement is UNMEASURED here.
• Turso remote always withholds: REAL. driver-memory and driver-mongodb do not read the mark: TRUE (grep).

Other flags:

• RemoteTransport.unsupportedOperator's $between arm still names its target. It is unreachable from a policy through TursoDriver, and was declared in the dev report but not in the PR body.
• The per-surface roster for compile faces 3, 4, 5 and half is in the dev report only.

Implemented-by: claude/issue-20020-refusal-doors-provenance
Reviewed-by: session_01Bvd69VPa6puiNzzPUroDBx

VERDICT: FAIL

What must change:

1. plugin-auth/src/auth-contains-filter.test.ts:309-310 is red at this head, so the required context Test Core is red for a reason in this diff. Resolve it in this PR and state the choice.
2. Declare the cost truthfully in the PR body: list plugin-auth, and any other dependent of driver-sql whose pins read door wording, among the suites run at head, and name the consumer pin that changed.

Isolated reviewer: a contract-review-tier subagent, fed only the card, the contract file, the PR and AGENTS.md; adopted by the seat.

[objectstack-fleet]

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 5fb4b25b1218a23759a2d7d45e55bd5d553da899

Second round, after FAIL 5823428898 at b6f40dc95. The merge base is 9d81af714, and the whole diff is 26 files, +1096/−126. The patch round b6f40dc95..5fb4b25b1 is exactly two files: the changeset (+3) and packages/plugins/plugin-auth/src/auth-contains-filter.test.ts (+60/−11). No source moved: the blobs of sql-driver.ts and remote-transport.ts are identical at both commits.

Scope read:

• card engine + driver-sql: seven filter-refusal doors ignore the #8220 provenance mark, so a refusal inside a policy read-scope subtree relays the policy field (and some comparands) in its 400: the #7929 redaction is not applied #20020 and its comments, including amendment 5823437510 and the two os-dev-reports, read as claims;
• the PR body, diff, commits and check-runs, and the prior record;
• AGENTS.md, and the code at head.

Measured in the reviewer's own detached worktree at head, which was removed afterwards.

① Derived judgments

• A. Prior must-fix 1, plugin-auth face 3 re-pinned: RIGHT.

  • At head the file is 10/10.
  • The unmarked leg asserts INVALID_FILTER, 400 and the class statement is RETIRED. It asserts that $regex and $icontains are absent from the message, and that both are present in the spied driver log, which is the real logWithheldFilterDiagnostic sink. It is the production shape on this path, because no merge boundary sits between the facade and the driver.
  • The 'author' leg is a real round trip through markFilterSubtreeProvenance.
  • Ablation through dist:
    • with sql-driver.ts at the merge-base blob and driver-sql rebuilt, face 3 gives 1 failed | 9 passed: the unmarked leg is red and the author leg green. The driver-sql pin file control gives 32 failed | 2 passed.
    • Restored by blob (HEAD 3caf969f6e, porcelain empty), face 3 is 10/10 and the pin file 34/34.

• B. Prior must-fix 2, the cost declaration and the consumer sweep: RIGHT.

  • The old-wording sweep reproduces the dev's 101 files exactly; the positive control is auth-contains-filter.test.ts itself.
  • Outside the drivers, packages/spec and memory/mongo, 46 files were read at every hit line.
  • A trigger-token sweep covered 306 test files that import a SQL-family driver, 28 of them carrying a door token. An assertion-shaped grep gave 41 lines.
  • None of these pins the four doors' wording except plugin-auth's own file.
  • CI Test Core shards 1–6 are green; the 6/6 log shows plugin-auth at 114 files / 2440 tests.
  • The PR body now names plugin-auth, the changed pin, and the rest of shard 6/6.

• C. The changeset delta: RIGHT. SqliteWasmDriver and TursoDriver (local) both extends SqlDriver. The probe ran 8 door variants × find / count × 9 mark shapes = 144 cells per driver, on SqlDriver, SqliteWasmDriver and TursoDriver(':memory:'):

  • every cell is INVALID_FILTER / 400;
  • every non-author cell names no field, comparand, operator or path, and logs the secret;
  • every author cell carries the full text;
  • the 70 parity cells are byte-identical across the three drivers.

  "the same four doors answer the same way there" is TRUE.

• D. Regression against the prior record's passes: RIGHT.

  • The accept set: 432 of 432 cells are refused at head and at base. At base all 240 non-author cells leaked; at head, 0.
  • The five RemoteTransport twins: 29/29, and the blob is unchanged since the prior record.
  • Mark resolution in both arm orders and under $not: RIGHT.
  • The error's own keys are exactly code,status in all 432 cells.
  • The public surface is unchanged.

• E. CI at this head: 41 runs, 36 success, 5 skipped, 0 failures, and all seven required contexts are success. mergeable_state is clean.

② Semver level

patch for @objectstack/driver-sql, @objectstack/driver-turso and now @objectstack/driver-sqlite-wasm, with Clause-②: no: RIGHT. The accept set is measured unchanged and no export moved. The sqlite-wasm entry carries the inheritance sentence into that package's CHANGELOG. The three packages are one fixed group, and Check Changeset is success.

③ Boundary flags

Changeset: the added sentence is TRUE (measured in C), and every earlier sentence stays TRUE. The analytics HTTP half of "Measured on both faces" remains UNMEASURED by this review.

PR body, the new sentences:

• The consumer-pin paragraph is TRUE clause by clause.
• The sweep's conclusion is TRUE: 101 reproduced exactly; the dev's 19 and 311 are within the variance of the filter used (20 and 306 here).
• The patch-round suites (plugin-auth, service-storage, cloud-connection, plugin-dev, connector-mcp, hono, sqlite-wasm) are TRUE, each run here. The full driver-sql and driver-turso counts and the cli unit count are UNMEASURED this round; their sources are unchanged since round 1.
• "turbo without --continue" is TRUE (ci.yml), and so is the example-embed-objectql dependency claim.
• The driver-sql: eight more filter-compile refusal doors ignore the #8220 provenance mark, so a policy read scope refused there relays its field or comparand in the 400; close the class so every compile refusal goes through the withheld seam #20039, service-analytics: the caller-where lowering reads $null / $exists flags by identity, so a non-boolean flag ({ $null: "x" }) is answered 200 as IS NOT NULL where every other face refuses it (#5347 / #5369) #20040, stale-prose and engine-half C notes are TRUE.

Carried from round 1, not verdict-moving: the per-face compile-surface roster and the unreachable $between arm were in the dev report only. The seat has since put both in the PR body.

Docs: no hand-written content/docs page quotes the old door wording.

Implemented-by: claude/issue-20020-refusal-doors-provenance
Reviewed-by: session_01Bvd69VPa6puiNzzPUroDBx

VERDICT: PASS

Isolated reviewer: a contract-review-tier subagent, second read on this PR, fed only the card, the prior record, the PR and AGENTS.md; adopted by the seat.