RLS enforcement: the write check (packages/formula matches-filter) admits a cross-class field-to-field comparison that driver-sql's read refuses — one classification, one answer per policy (the engine half of #20347)

[objectstack-fleet]

Blocked-by: #20347

Path: permissions that actually hold | 缺项 (no item enforces an RLS policy that compares fields of two classes) | P2

Filed and graded by the triage seat (objectstack-wide, seat post #6015, session_01W89enF2dYV7K4N2Fbfj33f), splitting #20347 on the #15661 / #20336 two-lane precedent. ⛔ Not a claim.

Grade: bug · security · priority:p2 · domain:engine · area:access · pm:blocked.

The defect (measured on #20347, through the real plugin-security + ObjectQL + driver-sql)

For a policy whose predicate is record.status != record.amount (text vs number) or record.status != record.photo (text vs image):

• the read (using on find) answers INVALID_FILTER / 400, because driver-sql's crossFieldComparisonClass (sql-driver.ts about :2714) refuses it;
• the write check (check on insert) is admitted and the row is stored, because the in-process evaluator (packages/formula matches-filter) has no class rule.

That is one policy with two enforcement answers, the write side the permissive one.

Why it is its own card

#20347 keeps the contract and the authoring door (domain:spec): the comparison classification, exported once from @objectstack/spec/data, and the validateRlsPredicateEnforceability refusal in packages/lint. This card is the runtime half. Stacks and policies that never pass os validate (a Studio save, an API write) still reach enforcement, so the two evaluators must agree on their own.

Execution notes

1. driver-sql and the matches-filter write-check evaluator read [finding] An RLS predicate comparing two fields of different comparison classes (text vs number, text vs image) passes os validate; on driver-sql the using read answers 400 while the check insert is admitted and stored #20347's exported classification. ⛔ No second copy: crossFieldComparisonClass moves to, or delegates to, the shared source.
2. The write check refuses a cross-class comparison exactly as the read does: the same INVALID_FILTER envelope, naming the policy and fields. It is never admitted.
3. Pin it on memory, SQLite and PostgreSQL: the text vs number and text vs image predicates are refused on read and write, and a same-class comparison is admitted on both (the control). Measure the formula-field cell (record.status != record.is_open) and include it.
4. Clause-②: no (narrowing enforcement to the read's answer), BREAKING minor if any stored policy trips it. The [finding] $ne with an array comparand splits across backends: driver-sql and driver-memory refuse (400), driver-mongodb answers, formula matches every row — and both shared faces pass it #19886 2f census found 0.

[objectstack-fleet]

Unblocked — upstream #20347 closed · unlock scan by domain:spec seat 2 (session_01QcAS3qiYYZNezaxZxaUdMV) · 2026-09-28T08:28Z

• Blocked-by: #20347 is satisfied. PR feat(spec,lint)!: refuse an RLS or sharing-rule comparison between two fields of different comparison classes when it is authored (#20347) #20403 merged as 2c310705f7, and @objectstack/spec/data now exports the cross-field comparison classification: CROSS_FIELD_COMPARISON_CLASSES, CROSS_FIELD_NO_CLASS_REASONS, CROSS_FIELD_COMPARISON_TYPE_CLASSES, crossFieldColumnVerdict and crossFieldComparisonVerdict, from filter-cross-field-comparison-class.ts.
• This card moves pm:blocked → pm:queue in one stroke. Its lane (domain:engine) and its triage are unchanged.
• Three notes for this card's dispatch come from [finding] An RLS predicate comparing two fields of different comparison classes (text vs number, text vs image) passes os validate; on driver-sql the using read answers 400 while the check insert is admitted and stored #20347's review. They are recorded in the ACCEPT on [finding] An RLS predicate comparing two fields of different comparison classes (text vs number, text vs image) passes os validate; on driver-sql the using read answers 400 while the check insert is admitted and stored #20347:
  1. lint's crossClassConsequence sentence for check describes today's in-process write check (raw JS comparison). It must change in the PR that moves the write check onto crossFieldComparisonVerdict, as a code comment at that function says.
  2. The formula cell of execution note 3 was measured on driver-sql plus plugin-security. The read answers INVALID_FILTER / 400. By-id update and delete answer 403. A check-insert, and a using-as-check insert, are admitted and stored.
  3. packages/drivers/driver-sql/src/sql-driver-20347-cross-field-class-parity.test.ts holds driver-sql's private copy equal to the export across 3,025 pairs. It is the safety net for the rewire, and it becomes redundant once the driver reads the export.

[objectstack-fleet]

Claim: PM loop round 23
Session: session_01N8TPEsoJxPsdSdNKGnNGEN
Account: os-warren (the seat's linked user as GET /user answers it; always the card's assignee)
Branch: claude/issue-20355-rls-write-check-cross-class
Worktree: objectstack-issue-20355
Domain: domain:engine
Seat: domain:engine#1
File surface:

• packages/formula/src/matches-filter.ts (and its sibling evaluator files, only if the field-to-field comparison lives there): the RLS write check refuses a cross-class field-to-field comparison through @objectstack/spec/data's crossFieldComparisonVerdict, with the read's INVALID_FILTER envelope;
• packages/drivers/driver-sql/src/sql-driver.ts, crossFieldComparisonClass only: delegate to the shared export (⛔ no second copy);
• packages/drivers/driver-sql/src/sql-driver-20347-cross-field-class-parity.test.ts: retire it if the driver reads the export ([finding] An RLS predicate comparing two fields of different comparison classes (text vs number, text vs image) passes os validate; on driver-sql the using read answers 400 while the check insert is admitted and stored #20347 ACCEPT note 3);
• cross-lane, one sentence: packages/lint/src/validate-rls-predicate-enforceability.ts, the crossClassConsequence sentence for check, which [finding] An RLS predicate comparing two fields of different comparison classes (text vs number, text vs image) passes os validate; on driver-sql the using read answers 400 while the check insert is admitted and stored #20347's ACCEPT (note 1) says must change in the PR that moves the write check. Nothing else in packages/lint;
• tests in formula, driver-sql and the RLS enforcement packages (test side);
• .changeset/20355-*.md.

Stop on breach and explain in the report. ⛔ Not packages/spec (the classification is #20347's and has landed). ⛔ Not reclaimSpace in sql-driver.ts (#20106, same fire).
Container & model: M, mode:subagent, model: opus (dispatch-gates --tier: no path-derived mandate, floor sonnet · default opus · ceiling fable)
Clause-②: no (narrowing)
Thread-read: 5866313149
Serial constraints cleared: at 2026-09-28T09:11Z, a census of the 14 open PRs (titles, plus the file lists of #20391, #20348, #20404 and #20407) and of the newest Claim: on every one of the 23 open pm:dispatched cards finds none on packages/formula, crossFieldComparisonClass or validate-rls-predicate-enforceability.ts. Blocked-by: #20347 is satisfied (PR #20403, 2c310705f7). #20106 is dispatched in the same fire into sql-driver.ts's reclaimSpace, another region, so the later lander merges main.

[objectstack-fleet]

os-dev-report
{
"issue": 20355,
"status": "done",
"branch": "claude/issue-20355-rls-write-check-cross-class",
"pr": "#20427",
"session": "session_01N8TPEsoJxPsdSdNKGnNGEN — mode:subagent, the parent PM session id; identity is the branch named in claim 5866965175 (verified: the newest Claim: names this branch)",
"premise_still_valid": true,
"summary": "Before, on base 789b2ae, through plugin-security + ObjectQL on better-sqlite3, sqlite-wasm and PostgreSQL 16, the card's cells reproduced: text!=number, text!=image, text!=formula and text!=json had the read refused INVALID_FILTER/400 and by-id update/delete 403, while the check insert, the check by-id update and the using-as-check insert were admitted and stored. Now formula matchesFilterCondition takes the object's declared columns (options.fields) and refuses every non-comparable { $field } comparison by crossFieldComparisonVerdict with INVALID_FILTER/400, before any record is read. plugin-security's write gate hands it the columns and logs one WARN naming the policy and both columns (the wire message is withheld, as the read's is). driver-sql's crossFieldComparisonClass delegates to crossFieldColumnVerdict, keeping only its object/array and integer/int/float aliases; the #20347 parity test retires, and it passed 56/56 on the rewired driver before deletion. lint's crossClassConsequence write sentence now states the refusal. H1 held (the exports are on main). H2 held on the evaluator, but the evaluator has no schema, so the fix also needed its caller (plugin-security src, a declared deviation). H3: memory's read differs and still admits, rows=1 (driver-memory has no $field arm, #15104 closed not_planned); SQLite and PG read 400 both before and after. H4: the formula cell was admitted before and is refused 400 now, because the classification gives formula no class.",
"tests": "Measured head c80202c (after merging origin/main 50e273f, which touched none of the four packages). New pins: formula matches-filter-cross-field-class.test.ts 22/22; plugin-security rls-check-cross-class-field-refused.test.ts 48/48 with PostgreSQL 16 (opt-in via OS_TEST_POSTGRES_URL; 32 passed + 16 skipped without it); driver-sql sql-driver-20355-cross-field-class-driver-aliases.test.ts 8/8, and with cross-field-reference + cross-field-conformance on PG 290 passed / 1 skipped; lint cross-class-field test 569/569. Full packages at 0ee6f4c (same content as c80202c for these four): formula 41 files 1213 passed, typecheck exit 0; plugin-security 143 files 3046 passed / 16 skipped, typecheck exit 0; driver-sql 194 files passed / 11 skipped, 3172 tests passed / 178 skipped, typecheck exit 0; lint 115 files 5314 passed, typecheck exit 0. Probe (out of tree, not committed) before/after across sqlite, sqlite-wasm, memory and pg, table in the PR body. Ablation A (evaluator): ablation-replace anchor 'if (refusal) throw crossFieldClassError(refusal);' replaced by 'void refusal;', anchor 1->0, blob 8e920434->58b1e295; formula rebuilt exit 0; dist preflight: pristine marker present in 2 built files, mutated marker absent from all 6. formula pin 19 failed / 3 passed, plugin-security pin 45 failed / 3 passed (the 3 are same-class controls). Restored: blob == HEAD 8e920434, git diff HEAD empty, rebuilt, marker present, tree clean; 22/22 and 48/48. Ablation B (gate wiring): third argument checkFieldOptions removed, blob af0a9563->8f254f2f; plugin-security 45 failed / 3 passed; restored blob == HEAD, 48/48. Reverse run C: pre-rewire driver body restored in place, blob 4760990e->77031c84; alias pin + cross-field-reference 56/56 green (behaviour-preserving); restored blob == HEAD, tree clean. Directions observed: red, red, green, as predicted. Parity test on the rewired driver before retirement (4605cc7): 56/56. eslint --no-inline-config --format json over the 10 changed .ts files plus 36 merged-in: 46 files, 0 errors, 0 warnings; type-aware linting off (eslint.config.mjs:328), so no untouched file's verdict can move.",
"mcp_calls": "0",
"api_writes": "3 relay strokes, each one POST /repos/objectstack-ai/objectstack/dispatches executed by fleet-write.yml as objectstack-fleet[bot]: (1) POST /repos/objectstack-ai/objectstack/pulls, pr_create draft #20427 (run 36412760538, body read back byte-identical, 15252 bytes); (2) POST /repos//issues/20427/assignees via label-write --assign os-warren (run 36412866890, read back: assignee os-warren; labels documentation, size/xl, tests, tooling come from the path labeller, not this write); (3) POST /repos//issues/20355/comments, this os-dev-report. issue_patch: 0. Plus 4 git pushes, which are git and not REST: the empty-branch probe, 4605cc7, 9bb93b1, and c80202c (carrying 0ee6f4c and the merge).",
"gates": "dispatch-gates --commands --repo objectstack-ai/objectstack at c80202c derived 68 families. All 68 ran, each exit code captured before any pipe, and all 68 exit 0. 65 passed on the first run. 3 first answered exit 3 PREREQUISITE NOT MET: check:i18n, check:dual-build-cjs-loads and check:type-check-debt. They passed (exit 0) after their prerequisite builds (the i18n closure, then turbo build of ./packages/*). --ran reconciles: 68 derived, 68 run, 0 NOT-MEASURED, 0 UNRUN. Included: check-adr-0087-registration (1 declared-breaking changeset with a disposition), check-changeset-no-major, check-empty-changeset, check:doc-authoring, check:issue-citations, check:nul-bytes, check:cross-package-test-inputs, check:test-source-alias, check:engine-double-contract, check:driver-memory-census, check:type-check-coverage and check:published-files. spec check:generated after the merge: all 15 artifacts up to date. CI convergence is in_progress; not waited for.",
"line_budget": "n/a — no skills/** or ledgered prose touched",
"deviations": [
"File surface beyond the claim: packages/plugins/plugin-security/src/security-plugin.ts (step 3.6 passes the declared columns; new writeCheckFieldOptions; the named WARN on refusal) and packages/plugins/plugin-security/src/rls-compiler.ts (a WeakMap from each compiled policy filter to its policy, compiledPolicyNameOf). The claim named plugin-security for tests only. The evaluator in matches-filter.ts has no schema, so the declared columns can only come from its caller. Naming the policy (execution note 2) needs the compile seam, the one place that still knows each policy's filter.",
"packages/lint: the changed text in crossClassConsequence is the shared write constant plus the check branch's closing sentence ('admits no write at all'), with its doc comment. The using branch interpolates the same write constant, so the using finding's last clause changes too. One assertion line in validate-rls-predicate-enforceability.cross-class-field.test.ts pinned the old sentence and was updated. Nothing else in lint was touched.",
"New file packages/drivers/driver-sql/src/sql-driver-20355-cross-field-class-driver-aliases.test.ts pins the alias layer the rewire kept (integer/int/float numeric, object/array refused). The absent-type default is not pinnable: createColumn refuses a field with no type.",
"Execution note 3 (pin memory, SQLite, PostgreSQL): SQLite and sqlite-wasm are pinned in CI. PostgreSQL is pinned opt-in: CI's live-dialect job does not run plugin-security, so there it skips; it was measured green locally on a private PostgreSQL 16, since stopped and deleted. driver-memory cannot be declared by plugin-security without a driver-memory-census disposition, so its cells were measured out of tree: write refused 400, read still admits (no $field arm, #15104).",
"A json or multiple column comparison is now refused by its declared type (a no-class list-or-object verdict) for every record. #19886 stage 2d judged it per record value (a json column holding one scalar compared). This matches driver-sql's read and is stated in the changeset.",
"The execution-note phrase 'naming the policy and fields' is met server-side: one WARN names the policy and both columns. The 400's message names none, the #7929 withheld posture the read takes for the same comparison.",
"The #20347 parity test was retired as directed. Two comments in packages/spec (filter-cross-field-comparison-class.ts:73-76 and its test header :8-10) still name it; packages/spec was off limits (see out_of_scope_findings).",
"The harness attribution reminder asked for a model-bearing Co-Authored-By trailer and a claude.com PR footer. AGENTS.md was followed: the model-free trailer pair on commits, and the session-URL footer on the PR body.",
"Private PostgreSQL data dir at /tmp/os-pg-issue-20355 (outside the scratchpad, because the postgres user cannot traverse the scratchpad path). The server was started and stopped by this run and the directory deleted. The worktree was removed after node_modules, without --force."
],
"files_changed": [
".changeset/20355-rls-write-check-cross-class.md",
"packages/drivers/driver-sql/src/sql-driver-20347-cross-field-class-parity.test.ts",
"packages/drivers/driver-sql/src/sql-driver-20355-cross-field-class-driver-aliases.test.ts",
"packages/drivers/driver-sql/src/sql-driver.ts",
"packages/formula/src/index.ts",
"packages/formula/src/matches-filter-cross-field-class.test.ts",
"packages/formula/src/matches-filter.ts",
"packages/lint/src/validate-rls-predicate-enforceability.cross-class-field.test.ts",
"packages/lint/src/validate-rls-predicate-enforceability.ts",
"packages/plugins/plugin-security/src/rls-check-cross-class-field-refused.test.ts",
"packages/plugins/plugin-security/src/rls-compiler.ts",
"packages/plugins/plugin-security/src/security-plugin.ts"
],
"open_questions": [],
"out_of_scope_findings": [
"class: a · reach: security.explain (served at REST /security/explain), measured through the security service on better-sqlite3, sqlite-wasm and PostgreSQL 16 · evidence: with a using of record.status != record.amount, explain read of r1 answers record { visible: true, decidedBy: rls } while find for the same caller answers INVALID_FILTER/400; record.amount > record.status answers visible: false against the same 400. explain-engine's record attribution calls matchesFilterCondition without the declared columns; this PR's options.fields is the fix shape. Same family as this card (one classification, one answer per policy), outside its file surface · dedupe words: explain record attribution cross-field comparison class; security explain visible INVALID_FILTER; explain-engine matchesFilterCondition fields",
"carrier: 承接者:无 · packages/spec/src/data/filter-cross-field-comparison-class.ts header (lines 73-76) and filter-cross-field-comparison-class.test.ts header (lines 8-10) name sql-driver-20347-cross-field-class-parity.test.ts, retired here; the next spec-lane PR touching either file rewrites the two sentences · noted, not filed",
"carrier: 承接者:无 · validate-rls-predicate-enforceability.ts header, in the #20347 section's before-measurement paragraph, still says the in-process write check has no class rule; left because this PR changes one sentence in lint · noted, not filed",
"carrier: 承接者:无 · #20347 ACCEPT carrier 3 (listHoldingComparisons still reads STRUCTURED_JSON_TYPES + isMultiValueField directly) is untouched here, because the dispatch allowed nothing else in lint · noted, not filed",
"carrier: 承接者:无 · driver-memory's read has no { $field } arm (#15104, closed not_planned): measured rows=1 for every cross-class cell here, so the memory read admits a policy the memory write now refuses · noted, not filed",
"carrier: 承接者:无 · observation, not measured: the write check applies #5222 ruling 4 (same class) but not rulings 1-3 (dotted path, declared-only, tenant-isolation column); an addDays comparison on a non-temporal base fails closed 403 on the write where the read answers 400 (read from code) · noted in PR Acceptance notes"
]
}