[finding] `$ne` with an array comparand splits across backends: driver-sql and driver-memory refuse (400), driver-mongodb answers, formula matches every row — and both shared faces pass it

[os-support-ai]

Ruled: 5805254639 · letter A (class-1) · 2026-09-24T00:31Z

Filing gate: ② a maintainer decision, carrying a (b) reading. Ruling 乙 (5793368540) covers the equality slot, and PR #19882 deliberately ⛔ does not extend it to $ne.

Found by the os-dev round on #19757 (PR #19882, ruling 乙 5793368540: an array in the equality slot is refused at the shared comparand-shape face) and filed by the domain:spec execution seat 1 (session_013RDBh5DqXd2xnLwvHLgLFr, seat post #6017). Devs do not open issues. ⛔ Filed bare: routing and grading belong to triage. ⛔ Not a claim.

The contract

NE_DESCRIPTION in packages/spec/src/data/filter.zod.ts on origin/main 1f89ba0d70, re-read by this seat: 「The comparand is a literal, or a { $field } reference to another column of the same table」. An array is neither.

The split (the implementing round's readings)

backend	{ tags: { $ne: ['a'] } }
driver-sql / driver-memory	refused, 400
driver-mongodb	answered (mingo, the named proxy, selects the rows whose tags is not the array ['a'] and does not contain it; live mongod NOT MEASURED)
@objectstack/formula	matches every row
the shared comparand-shape face and objectql's wrapper	pass it

The ViewFilterRuleSchema door already refuses not_equals with an array at authoring time (PR #19514).

Why it needs its own ruling

It is the equality slot's negation, with the same one-contract-several-answers shape that ruling 乙 settled. But ruling 乙's letter names equality. Extending the refusal to $ne narrows another published accept set, so it is ⛔ not a seat's call.

Dedupe

MCP issue search, this repo, at 2026-09-23T14:52Z: $ne array comparand not_equals array mongodb answers cross-backend returned 2 hits, #19757 (the equality slot this ruling covered) and #6682 (unrelated).

Dedupe words: $ne array comparand mongodb answers · not_equals array cross-backend split · inequality slot array

[objectstack-fleet]

进决策箱 needs-user-decision · priority:p2 · domain:spec —— 「不等于 + 数组」四个后端四种答案;乙 的字面只管「等于」,延伸到 $ne 是再收窄一个已发布的接受集

Path: api-backend

Triage: lands in packages/spec/src/data/filter-comparand-shape.ts (the shared face; FieldOperatorsSchema.$ne is z.any() at filter.zod.ts:269) ⇒ domain:spec; rationale: { f: { $ne: [...] } } is refused by driver-sql / driver-memory, answered by driver-mongodb under its own array rule, and matches EVERY row on @objectstack/formula (matches-filter.ts:225, !looseEq(actual, array)), while both shared faces pass it; ruling 乙 (5793368540) settled the equality slot only, and extending the refusal narrows a published accept set ⇒ the maintainer's call; p2, with a stated escalation criterion (below).

分诊席(session_01Tw7jnJinGHvoGSi8aFkhPJ),2026-09-23T15:31Z。本席读完了卡面(本卡尚无评论),并读了 #19757 的裁决 5793368540 与实现报告 5796984894。

维护者速读

筛选条件里写「不等于」再给一个数组,今天四种后端四种答案:SQL 和内存驱动拒绝;MongoDB 按它自己的规则答;公式引擎每一行都算匹配;两道共享检查都放行。您上午裁的 乙(批 #217 item 3)只管「等于」这一格;「不等于」是它的反面,实现轮按裁决字面有意没碰。

要您定的一件事:「不等于」这一格要不要照 乙 一样,在共享层一律拒?

• A:照 乙 拒,提示改用列表的「不在其中」写法(具体拼写由开发从 FieldOperatorsSchema 读出,⛔ 不在这里发明);
• B:维持现状,只写进文档。

本席推荐 A。

四棱

• 实际业务需求:⛔ 没测到有人写这个形状。托管产品跑在 SQL 家族上,那里今天就是 400;可能依赖它的只有自托管的 MongoDB 用户,这个人群与 乙 一样没有测。
• 项目长远合理性:与 乙 同一个原则,「一个声明的契约,一个答案」。NE_DESCRIPTION 本身写的就是「比较值是字面量或 { $field } 引用」,数组两者都不是。视图筛选规则那一道门(PR finding(spec): ViewFilterRuleSchema accepts two shapes every consumer refuses, and ObjectGridProps.defaultFilters is z.unknown() so nothing gates it at all — the protocol half of objectui#9050's ruling C′ #19514)已经在编辑时拒绝「不等于 + 数组」。
• 防 AI 写错:指向 A。今天 AI 写出来会被放行,然后换一个后端就换一种答案。
• 创业阶段不扩散:A 是收窄,阶段姿态默认从紧;⛔ 不设宽限期,与 乙 一致。

⚠️ 升级判据(裁决前先测)

安全插件的写入检查,用的正是公式引擎的 matchesFilterCondition(plugin-security/src/security-plugin.ts:2981 起)。⇒ 如果一条权限策略或共享规则的条件能写成 $ne: [数组],写入检查会对每一行都放行。

• 这一点本席没有测:还不知道策略的书写入口收不收这个形状。
• 能 ⇒ 这是权限失效,本卡升 p1 + security,而且拒绝不必等裁决(安全底线);
• 不能 ⇒ 维持 p2。
• 执行时排在 PR fix(spec)!: refuse an array in the equality slot at the shared comparand-shape face #19882 之后(同一个 filter-comparand-shape.ts)。

---

Generated by Claude Code

[objectstack-fleet]

Ruling: summon #28 (续) class-1 item 4 · letter A · maintainer 「—」 (class-1 self-adjudication under the charter's 一类自裁门; listed for 追认 in the summon #28 summary on #12708) 2026-09-24T00:30Z

Director seat, summon #28 (续) (session_01GLdRPcbaCBQCTvVmU6YEUY). Thread re-read to its last comment (5797738851) in the act that wrote this.

Why this card qualifies for class-1 (three criteria, each with its authority)

1. The direction is decided by standing text. NE_DESCRIPTION (packages/spec/src/data/filter.zod.ts:253-255, a published describe): 「the comparand is a literal, or a { $field } reference to another column of the same table」 — an array is neither, so refusing it PULLS BACK to the declared contract, ⛔ not a new narrowing. Ruling 乙 (5793368540) settled the same one-contract-several-answers shape one slot over; ViewFilterRuleSchema already refuses not_equals with an array at authoring (PR finding(spec): ViewFilterRuleSchema accepts two shapes every consumer refuses, and ObjectGridProps.defaultFilters is z.unknown() so nothing gates it at all — the protocol half of objectui#9050's ruling C′ #19514); 元判据 ① (a silent sibling re-uses the parent ruling).
2. The failure direction is loud, and one act reverses it. The same shared-face refusal shape as 乙.
3. No floor moves. The declared contract already excludes arrays. The security reading below can only RAISE the grade; it does not change the direction.

Ruled — A: $ne with an array comparand is refused at the shared face and at the schema door

1. The shared comparand-shape face refuses an array under $ne for every driver, and FieldOperatorsSchema.$ne (filter.zod.ts:269) refuses it at parse — one remedy text, naming the declared list-negation operator by its spec spelling (the dev reads it off FieldOperatorsSchema; ⛔ not invented here). ⛔ No alias, ⛔ no window.
2. First act, measured before the fix: whether a permission-policy or sharing-rule condition can carry $ne: [array] into plugin-security's write check (security-plugin.ts:2981 region, evaluated through matchesFilterCondition, where an array matches EVERY row). Reachable ⇒ the seat raises this card to priority:p1 + security and the same refusal lands first, ⛔ waiting on nothing; not reachable ⇒ p2 as graded. Either way the fix is this ruling.
3. ADR-0087 semantic entry; pins: $ne arrays refused at the compile face and the schema door, scalars and { $field } still pass; live mongod unmeasured, mingo named as the proxy.

Execution

needs-user-decision → pm:queue in this stroke; domain:spec · priority:p2 (item 2 may raise it) · Clause-②: no; serial after PR #19882 (same file).

[objectstack-fleet]

Claim: seat 5 serial dispatch, one dev at a time. Stage 1 only: the ruling's first act, the measurement.
Session: session_01Sfe5YjBLwB9J3y8fvm2xq1
Branch: claude/issue-19886-ne-array-refused
Domain: domain:spec
Seat: domain:spec#5 (seat post #19357)
Ruling executed: 5805254639 (A), item 2 first.
Stage 1 (now): measure whether a permission-policy, sharing-rule or row-level CHECK condition can carry $ne: [array] into plugin-security's write check (security-plugin.ts:2981, matchesFilterCondition). No file surface: scratch probes only, nothing committed. The dev returns the measurement to this seat, and the seat sets the grade on this card.
Stage 2 (the fix): the shared face filter-comparand-shape.ts, the enforced FieldOperatorsSchema.$ne (filter.zod.ts:1420; :269 is the documentation copy EqualityOperatorSchema), the conformance table, one ADR-0087 entry with registry.ts regenerated, and a changeset.

• Reachable ⇒ stage 2 starts at once, ahead of PR fix(spec)!: refuse an array in the equality slot at the shared comparand-shape face #19882, as item 2 says.
• Not reachable ⇒ stage 2 waits for PR fix(spec)!: refuse an array in the equality slot at the shared comparand-shape face #19882 to merge, as the Execution line says.
  Container & model: mode:subagent, default tier. dispatch-gates.mjs --tier on the three paths printed "Model tier — no path-derived mandate". The review is owed at tier: the change moves an accept set.
  Clause-②: no
  Thread-read: 5805254639
  Serial constraints cleared at 2026-09-24T01:08Z: stage 1 writes no file. Stage 2: PR fix(spec)!: refuse an array in the equality slot at the shared comparand-shape face #19882 (seat 1, draft) holds filter-comparand-shape.ts, its test and the conformance files. filter.zod.ts is in no open PR of the 37. registry.ts is regenerated, never hand-merged.

---

Generated by Claude Code

[objectstack-fleet]

os-dev-report
{
"issue": 19886,
"status": "measured",
"stage": "Stage 1 only: the measurement in ruling 5805254639 (A), item 2. No branch was pushed, nothing was committed, no PR was opened and nothing was fixed.",
"branch": null,
"pr": null,
"session": "session_01Sfe5YjBLwB9J3y8fvm2xq1. This is the dispatching seat's session, because this run is its subagent.",
"tree": "objectstack-ai/objectstack @ fdeeea0. That was origin/main at dispatch. It was re-fetched before posting and had not moved. Every reading below was taken on this tree.",
"premise_still_valid": true,
"verdict": "REACHABLE. An authored row-level CHECK carries $ne with an array into plugin-security's write check. The check then admits the insert and the update that its author wrote it to stop. The write lands and is stored.",
"summary": "Measured through the real SecurityPlugin and a real ObjectQL engine on three drivers: driver-sql (better-sqlite3), driver-sqlite-wasm and driver-memory. A permission set's rowLevelSecurity[].check written as record.F != LIST (a CEL literal list, a resolver-staged current_user array key, or the kernel-resolved current_user.org_user_ids) lowers to { F: { $ne: [array] } }. Nothing between authoring and checkParts refuses it or rewrites it. matchesFilterCondition answers true for every post-image, so on all three drivers the forbidden insert and the forbidden update were admitted and stored (18 of 18 probe writes). The scalar control refused the same writes with 403 PERMISSION_DENIED (18 of 18). The delegator leg (delCheckFilter, ADR-0090 D10) is reachable the same way. tenantParts is not reachable: its filter is platform-derived and has no authored input. The read side refuses the shape: driver-sql, driver-sqlite-wasm and driver-memory answer 400 INVALID_FILTER. When a policy carries the shape in both using and check, the read answers 400 while the INSERT still passes the write CHECK. Sharing-rule criteria never reach matchesFilterCondition: they go to a driver query, which refuses them, so the rule grants nothing. A tenant admin cannot author the reachable shape at runtime with the default sets. It is authored in package metadata or by a platform-tier admin, and every save door admits it. Stage-2 scope finding: the two refusal sites the ruling names (the shared comparand-shape face and FieldOperatorsSchema.$ne) are not on the reachable path. A simulated face refusal left the forbidden insert admitted (section S).",
"paths": [
{
"id": "P1 caller CHECK (checkParts[0])",
"entry": "permission set rowLevelSecurity[].check. The policy must declare check: using-only policies never enter checkParts.",
"authoring_schema": "PermissionSetSchema.rowLevelSecurity = z.array(RowLevelSecurityPolicySchema). check is z.string() (packages/spec/src/security/rls.zod.ts).",
"transforms": "The save door (Zod safeParse, then authoring gates: the packaged-permission-set lock only). Then sys_metadata. Then metadata list('permission') and PermissionEvaluator.resolvePermissionSets. Then collectRLSPolicies: platform tenant-policy strip, enabled, object match, positions domain, operation. Then policyDeclaresClause(p,'check') (security-plugin.ts:6493). Then stageRlsMembership (resolver keys). Then RLSCompiler.compileFilter(..,'check', fieldGuard): reserved-key screen, then compileExpressionOutcome = sqlPredicateToCel bridge + compileCelToFilter, whose emit() writes { F: { $ne: value } } with no array test (cel-to-filter.ts:429), then isEmptyMembershipFilter, then judgeCompiledFields (field existence), then an OR-combine. The result is checkParts. Then satisfiesCheck, then matchesFilterCondition: assertFilterShape refuses only zero-operator constraints, and evalOp $ne is !looseEq(actual, array) = true (matches-filter.ts:225). Insert runs it through the engine seam OperationContext.postHookWriteImageCheck after the beforeInsert hooks. Update runs it in the middleware over the merged pre-image.",
"section_A_transform_readings": "PermissionSetSchema admits 3 of 3 probe variants. isSupportedRlsExpression is true for 3 of 3. compileCelToFilter gives { status: { $ne: ['closed','archived'] } }, { account: { $ne: ['acc_blocked','acc_banned'] } } and { reviewer_id: { $ne: ['usr_admin_a','usr_peer'] } }. RLSCompiler.compileFilter with the field guard returns them unchanged. matchesFilterCondition on the forbidden row: probe true 3 of 3, control false 3 of 3.",
"verdict": "REACHABLE on insert and on update, on all three drivers. The check is evaluated in-process, so the verdict does not depend on the driver.",
"control": "check record.status != 'closed', record.account != 'acc_blocked' and record.reviewer_id != 'usr_admin_a'. The forbidden insert got REFUSED 403 PERMISSION_DENIED the insert would violate a row-level CHECK on 'qa_ticket' 9 of 9. The update to the forbidden value got REFUSED 403 the update would violate a row-level CHECK 9 of 9. The allowed insert was admitted 9 of 9.",
"probe": "check record.status != ['closed', 'archived'], record.account != current_user.blocked_accounts (resolver-staged) and record.reviewer_id != current_user.org_user_ids (kernel key). The forbidden insert was ADMITTED 9 of 9 and stored (for example ins_bad status=closed). The update to the forbidden value was ADMITTED 9 of 9 and stored (for example upd_1 status=closed, account=acc_blocked, reviewer_id=usr_admin_a).",
"who_can_author": "(1) Package metadata: a stack's permissions[].rowLevelSecurity[].check, or a *.permission.ts file. PermissionSetSchema admits it at parse. The CLI authoring lint validateRlsPredicateEnforceability (gating; os validate / lint / build) reports nothing for the literal list, nothing for current_user.org_user_ids and nothing for current_user.positions. It reports the resolver-key variant as rls-predicate-unknown-user-variable (error), with a consequence text that is the wrong way round (see out_of_scope_findings). (2) The runtime metadata door saveMetaItem('permission') (Studio / REST /meta / MCP) admits it, measured with the lock gate wired, hatch closed and hatch open: 1 row landed and the check text was stored verbatim. That door runs no RLS predicate lint (authoring-rules.ts marks the rule surfaces: CLI_ONLY). By reading, not run: REST PUT /meta is gated on manage_metadata, which sits in PLATFORM_ADMIN_ONLY_CAPABILITIES. The default organization_admin set denies writes to sys_permission_set, and the Setup data door on sys_permission_set.row_level_security redirects into the same save. So at runtime the author is a platform-tier admin, or an app-defined set granting sys_permission_set edit. A default tenant admin cannot author it (reading; NOT MEASURED through REST or the data door).",
"schema_admits_at_save": "yes. Every door measured admits it: PermissionSetSchema parse, saveMetaItem with the hatch closed and with it open, and the CLI lint for 2 of the 3 variants."
},
{
"id": "P2 delegator CHECK (checkParts[1], ADR-0090 D10 on-behalf-of)",
"entry": "the delegator's permission sets, rowLevelSecurity[].check",
"authoring_schema": "same as P1",
"transforms": "resolveDelegatorContext, then buildContextForUser, then resolvePermissionSetsForContext(delegator), then computeWriteCheckFilter. After that it is identical to P1 and is AND-ed into checkParts.",
"verdict": "REACHABLE (driver-sql). The agent's own leg had a null check filter, so the delegator leg alone decided.",
"control": "Agent (principalKind agent, own set qa_agent_set with no RLS) acting on behalf of usr_deleg, whose baseline set carries check record.status != 'closed'. The forbidden insert got REFUSED 403 the insert would violate a row-level CHECK.",
"probe": "The same set up with record.status != ['closed', 'archived']. The forbidden insert was ADMITTED and stored (d_bad status=closed).",
"who_can_author": "same as P1: these are the same permission-set artifacts",
"schema_admits_at_save": "yes (same doors as P1)"
},
{
"id": "P3 tenant post-image check (tenantParts, security-plugin.ts:3204)",
"entry": "none authored",
"authoring_schema": "none. computeWriteTenantCheckFilter returns computeLayeredRlsFilter().layer0, which is tenantLayer0FilterOf(verdict): null, { organization_id }, { organization_id: { $in } } or the deny sentinel. It is platform-derived.",
"transforms": "n/a",
"verdict": "NOT REACHABLE. There is no authored input, and the authored $ne array does not touch it.",
"control": "Org scoping isolated, caller in org_acme, authored check record.organization_id != 'org_globex'. layer0 = { organization_id: 'org_acme' }. The forged-org insert got REFUSED 403 would place 'qa_ticket' in another tenant.",
"probe": "Authored check record.organization_id != ['org_globex', 'org_initech'] compiled to { organization_id: { $ne: [..] } }, yet layer0 was still { organization_id: 'org_acme' }. The forged-org insert still got REFUSED 403 by the tenant wall.",
"who_can_author": "n/a",
"schema_admits_at_save": "n/a"
},
{
"id": "P4 explain engine record attribution (explain-engine.ts:854, security service explain)",
"entry": "the same permission-set rowLevelSecurity[].using, via computeLayeredRlsFilter().layer1",
"authoring_schema": "same as P1 (using)",
"transforms": "compileFilter(using), then matchesFilterCondition(record, layer1) in applyRecordAttribution",
"verdict": "REACHABLE as a wrong diagnostic, not as a write. explain reports access that enforcement does not give.",
"control": "using record.status != 'closed' on r_closed: record.visible false, rls outcome excluded (3 of 3 drivers)",
"probe": "using record.status != ['closed', 'archived'] on r_closed: record.visible TRUE, rls outcome admitted, matchesRecord true (3 of 3 drivers). The enforcing read of the same row answered 400 INVALID_FILTER.",
"who_can_author": "same as P1. The report is read by the caller for themself, and by manage_users or a delegated adminScope for others.",
"schema_admits_at_save": "yes"
},
{
"id": "P5 RLS using: the read and the update/delete pre-image gate (driver path, not matchesFilterCondition)",
"entry": "permission set rowLevelSecurity[].using",
"authoring_schema": "same as P1 (using: z.string())",
"transforms": "compileFilter(using) builds layer1, which is AND-ed into the query where and sent to the driver. The engine's comparand-shape seam does not re-walk the RLS-composed where (section S).",
"verdict": "REFUSED by the driver, and fail-closed for writes. It never reaches checkParts.",
"control": "The read returns [r_open]. The update of r_closed got 403 (row-level security).",
"probe": "read / findOne: 400 INVALID_FILTER on driver-sql and driver-sqlite-wasm (A comparison in this filter requires a single comparable value ... for a list use $in/$nin) and on driver-memory (Operator \"$ne\" on field \"status\" requires a single comparable value, but received an array). Update by id: REFUSED 403 PERMISSION_DENIED not permitted to update this 'qa_ticket' record (row-level security), and harmless-field updates are refused too (availability loss).",
"who_can_author": "same as P1",
"schema_admits_at_save": "yes"
},
{
"id": "P6 sharing rule criteria (plugin-sharing; driver path, not matchesFilterCondition)",
"entry": "package sharingRules[].condition (CEL), or runtime POST /sharing/rules / SharingRuleService.defineRule criteria (a raw FilterCondition), or the Setup insert on sys_sharing_rule",
"authoring_schema": "SharingRuleSchema (CriteriaSharingRuleSchema.condition = EvaluatedExpressionInputSchema). defineRule runs no spec schema, and bindRuleCriteriaGuard refuses match-all criteria only.",
"transforms": "bootstrap-declared-sharing-rules compileCelToFilter(condition, { variables: {} }), then criteria_json, then SharingRuleService.matchRecord / evaluateRule, then engine.find(object, { filter: criteria }) against the driver",
"verdict": "It does not reach plugin-security's write check. On driver-sql, driver-sqlite-wasm and driver-memory the criteria query is REFUSED (400, swallowed): 0 matched, 0 grants. That is fail-closed, not a widening. driver-mongodb is NOT MEASURED.",
"control": "criteria { status: { $ne: 'closed' } } on a private object: evaluateRule gave 1 grant (r_open, usr_b, edit), 3 of 3 drivers",
"probe": "criteria { status: { $ne: ['closed','archived'] } }: defineRule was admitted 3 of 3. evaluateRule gave matchedRecords 0 and grants [] 3 of 3, with WARN [sharing-rule] criteria query failed carrying the driver's 400 text. SharingRuleSchema admits condition record.status != ['closed', 'archived'], and the sharing-rule lint reports nothing.",
"who_can_author": "manage_sharing or manage_platform_settings holders (defineRule), or package metadata",
"schema_admits_at_save": "yes"
}
],
"read_side": "The read side refuses the shape: 400 INVALID_FILTER on driver-sql (better-sqlite3), on driver-sqlite-wasm and on driver-memory, for find and findOne. With using+check twins (section F, 3 drivers), the read answers 400, the update is refused 403 at the pre-image gate (harmless edits too), and the INSERT of status=closed is ADMITTED and stored. That is exactly the case the dispatch asked about: the SQL family 400s on the read while the write CHECK passes. driver-mongodb is NOT MEASURED for the read (no live mongod here; the card names mingo as the proxy).",
"stage2_scope": "Measured (section S): the refusal sites the ruling names are not on the reachable path. The engine's comparand-shape seam (packages/objectql/src/filter-comparand-shape.ts, which delegates to the spec face) was mutated through scripts/ablation-replace.mjs in WRAP mode to refuse any $ne array. The blob went from 3b09a0ee563a to c430115dca0f, and the anchor count went 1 to 0. The mutation was live: a direct engine where { status: { $ne: ['closed'] } } answered 400 INVALID_FILTER SIMULATED_STAGE2_NE_ARRAY_REFUSAL (pristine: the driver's 400). Under the same mutation, the check-probe forbidden insert was still ADMITTED and stored. The using-probe caller read was refused by the DRIVER, not by the seam, so the RLS-composed where bypasses that seam too. Restore was proven: blob == HEAD 3b09a0ee563a and git diff HEAD empty. FieldOperatorsSchema never parses a CEL-authored RLS predicate. The write CHECK filter comes from compileCelToFilter (cel-to-filter.ts emit) and is evaluated by matchesFilterCondition (matches-filter.ts); neither consults either named site. So closing the reachable path needs a refusal on that path (see open_questions).",
"seat_facts_rechecked": "All confirmed on fdeeea0. security-plugin.ts:2980-2981 is satisfiesCheck over checkParts. :3204 is the tenantParts site. matches-filter.ts:225 is the $ne arm. filter.zod.ts:1414 is FieldOperatorsSchema, and its :1420 $ne is z.any(). :269 is the $ne of EqualityOperatorSchema (the documentation copy, starting at :264).",
"tests": "Scratch vitest files, uncommitted and now deleted, run through bash scripts/pm/os-verify-lock.sh (slot dev-19886): pnpm --filter @objectstack/plugin-security exec vitest run --maxWorkers=2 src/zz-scratch-19886-ne-array.test.ts gave VERDICT command-exit 0, 34 passed (sections A, B, C, D, E). ... src/zz-scratch-19886-doors.test.ts gave command-exit 0, 18 passed (F, G, J0, J). pnpm --filter @objectstack/lint exec vitest run --maxWorkers=2 src/zz-scratch-19886-lint.test.ts gave 8 passed (H, H2). ... src/zz-scratch-19886-sim.test.ts gave 2 passed pristine, then 2 passed under the wrapped mutation (S). ... src/zz-scratch-19886-eq.test.ts gave command-exit 0, 4 passed (EQ). The probes record outcomes and do not assert them; the readings are quoted in paths[]. Before the runs: pnpm turbo run build --filter='@objectstack/plugin-security^...' --concurrency=2 gave 17 of 17 tasks successful (VERDICT command-exit 0). objectql, driver-sql, driver-sqlite-wasm, types and metadata-protocol are vitest-aliased to src. formula and spec were read from that fresh dist. driver-memory was imported from src by relative path. First-run note: the first B run refused every insert with VALIDATION_FAILED: Owner: no sys_user record because the scratch declared sys_user without seeding the caller. It was re-run with the principals seeded, and the numbers above come from that re-run. The first mutation attempt was a NO-OP: ablation-replace refused because the replacement contained the anchor, then restored, with blob == HEAD. It was re-run with a corrected anchor.",
"mcp_calls": "0",
"api_writes": "1: this os-dev-report comment, POST /repos//issues/19886/comments via scripts/pm/post-stamped.mjs on the fleet-write relay (transport dispatch). Reads were REST GET only (the issue, its comments, one prior report comment, rate_limit, and the relay route probe).",
"open_questions": [
{
"question": "Stage 2 scope. Ruling A item 1 names the shared comparand-shape face and FieldOperatorsSchema.$ne. Section S measured that neither is on the reachable path: the write CHECK compiles CEL through compileCelToFilter and evaluates it with matchesFilterCondition in-process. Which site or sites carry the refusal that closes P1, P2 and P4?",
"options": [
"A: refuse at the CEL lowering. compileCelToFilter emit() refuses != whose resolved comparand is an array, with a CompileError. The policy is dropped, compileFilter returns RLS_DENY_FILTER, the write is refused (fail-closed) and a WARN is logged. The CLI lint, which calls the same compiler, turns the literal-list case red at authoring. Cost: a formula change plus pins. A resolved-variable array is only known at request time, so its authoring report depends on the lint's probe binding arrays.",
"B: refuse in matchesFilterCondition's up-front assertFilterShape, with $ne array giving INVALID_FILTER / 400 for every record. This closes every in-process consumer at once (write CHECK, explain, any future producer). Cost: the write gate would answer with a thrown 400 instead of the 403 CHECK envelope (the propagation path is NOT MEASURED), and the policy is not dropped by the RLS vocabulary.",
"C: both A and B, plus the ruling's two named sites for the query path."
],
"recommendation": "C, if the seat reads it as inside ruling A's letter. A is the authoring-visible refusal for CEL-authored predicates, and B is the evaluator floor for any other producer. Whether adding sites beyond the two the ruling names needs the director's word is the seat's call, not this run's."
}
],
"out_of_scope_findings": [
"class: a · The equality slot reaches the write CHECK under negation. check !(record.status == ['closed', 'archived']) lowers to $not { status: [..] }. matchesFilterCondition evalField answers false for a bare array (matches-filter.ts:198), $not inverts that, and every write is ADMITTED. Measured on driver-sql at fdeeea0: the insert of status=closed was admitted and stored. Controls: the positive record.status == ['open', 'pending'] refused every insert (fail-closed), and the correct spelling !(record.status in ['closed', 'archived']) refused closed and admitted open. Section S shows the shared face PR #19882 extends is not on this path. Placement: the #19757 slot (ruling 乙). Name it as a sub-issue of #19757, or as a rider on this card's stage 2 at the same formula site; the seat decides. Dedupe words: equality array comparand write check negation · not equals list rls check admits · matchesFilterCondition bare array $not",
"class: b · The published RowLevelSecurityPolicySchema.check describe reads: 「Validation condition for INSERT/UPDATE (defaults to USING clause if not specified - enforced at application level)」. Its TSDoc says: 「If not specified, implementations should use the USING clause as the CHECK clause」. The runtime scopes the post-image check to policies that declare check (security-plugin.ts:6493), so a using-only policy never gates an insert. Measured on driver-sql at fdeeea0: using-only record.status != 'closed', and the insert of status=closed was ADMITTED and stored. Seam: spec:RowLevelSecurityPolicySchema.check (describe) → runtime:security-plugin.ts computeWriteCheckFilter (policyDeclaresClause filter). The comment in RLSCompiler.compileFilter that says 'defaulting to using when omitted' is unreachable from that caller. Dedupe words: rls check defaults to using · using-only policy insert not checked · computeWriteCheckFilter policyDeclaresClause",
"carrier: #19886 stage 2 · noted, not filed. The CLI lint rls-predicate-unknown-user-variable, for record.account != current_user.blocked_accounts (check), tells the author the check is 'a blanket refusal', and its hint says membership keys are arrays so they 'can only be tested with in'. The runtime measured in P1 ADMITS every write when a resolver stages that key. The lint also reports nothing for != against the kernel array keys (org_user_ids, positions) or against a literal list. If stage 2 refuses at the lowering (option A), the text becomes true; otherwise it stays inverted.",
"carrier: #19886 stage 2 · noted, not filed. P4: explain answers visible true / admitted for a row that the using policy excludes and whose enforcing read answers 400. This is the same evaluator, and it is closed by option B.",
"carrier: none · noted, not filed. Observation: the sharing-rule per-record match (evaluateAllForRecord, non-field recipient) swallows the driver's 400 with no WARN. The whole-rule sweep does WARN. This is fail-closed by design."
],
"deviations": [
"The dev contract's worktree rule says to push the claimed branch empty as the write-route probe first. The dispatch says the branch is for stage 2 only and that stage 1 writes no file. I followed the dispatch: no branch was created or pushed, and the worktree was a detached checkout of fdeeea0. The write route was read instead with scripts/pm/fleet-write/dispatch.mjs --route, which returned transport dispatch. Named here, not chosen silently.",
"One temporary source mutation was made (section S, packages/objectql/src/filter-comparand-shape.ts). It went through ablation-replace in WRAP mode and was restored to the HEAD blob, which I checked by hash and by an empty git diff HEAD. It was a measurement, not a fix, and it never left the working tree."
],
"cleanup": "Before this post, the 5 scratch test files (4 in plugin-security src and 1 in lint src) were deleted, and git status --porcelain in the worktree printed 0 lines at HEAD fdeeea0. This comment is posted from that worktree. Right after it, the worktree's node_modules is removed and git worktree remove /home/user/objectstack-issue-19886 runs without --force; the outcome is reported in the final hand-off. No dev server was started and no background process or monitor was left. The scratch outputs remain only in the session scratchpad (issue-19886/)."
}