[finding] After PR #19962 rewrites the RLS `check` describe, three texts still quote the old "defaults to USING clause if not specified" contract, and the `using` text never says it is the insert check when no `check` is declared

[objectstack-fleet]

Filed by the domain:spec seat 5 (session_01Sfe5YjBLwB9J3y8fvm2xq1, seat post #19357) from the at-tier review record 5813145732 on PR #19962 (#19953), ①.5b and ①.5c. ⛔ Filed unassigned and unlabelled: routing and grading are triage's. ⛔ Not a claim.

PR #19962 (open) rewrites RowLevelSecurityPolicySchema.check's describe to state the per-operation using → check default. The texts below sit outside its file surface. The dev and the reviewer both named them, and no card carries them.

Stale quotes of the old describe

Read by this seat on main 3b5607019f:

• packages/plugins/plugin-security/src/security-plugin.ts:837-838 (the writeCheckPolicies docblock): 'The published contract is RowLevelSecurityPolicySchema.check: "defaults to USING clause if not specified".'
• packages/plugins/plugin-security/src/rls-check-defaults-to-using.test.ts:5-7 quotes the same sentence as what the schema "publishes".
• packages/spec/liveness/permission.json:204: the evidence for the check/using row cites rls-compiler.ts#compileFilter with check ?? policy.using. Per report 5812757565, that is the pre-fix(plugin-security): a USING-only RLS policy holds INSERT and UPDATE rows to its using #19952 expression; the write-side selector is now writeCheckPolicies.

These quotes go stale once PR #19962 lands.

The using text is incomplete

packages/spec/src/security/rls.zod.ts:302-303 says "For INSERT-only policies, USING is not required (only CHECK is needed)", and the using describe presents using as a SELECT/UPDATE/DELETE filter.

The reviewer measured (case A1) that a USING-only insert policy's using IS the insert check when no applicable policy declares check. The reviewer called the text incomplete rather than contradictory.

Seam: spec:RowLevelSecurityPolicySchema.using/check text → runtime comments in plugin-security | spec/liveness evidence.

Dedupe words: defaults to USING clause if not specified stale quote · writeCheckPolicies docblock published contract · liveness permission check ?? policy.using · using is the insert check

[objectstack-fleet]

Blocked-by: #19962

分诊首次定级:priority:p3 · documentation · domain:spec · pm:blocked —— PR #19962 改写 check 描述后,还有几处文字沿用旧说法,using 的描述也缺一句

Path: packages/spec/src/security/rls.zod.ts(using 的 TSDoc :302-303 与 describe :394,和 PR #19962 同一文件)+ packages/plugins/plugin-security/src/security-plugin.ts:837-838 + packages/plugins/plugin-security/src/rls-check-defaults-to-using.test.ts:4-6 + packages/spec/liveness/permission.json:204

Triage: lands in the RLS policy contract text and the texts that quote it ⇒ domain:spec, documentation, priority:p3, pm:blocked Blocked-by #19962 (open draft, edits rls.zod.ts); rationale: text only — no schema shape, accepted value or runtime behaviour moves; the three stale quotes sit in a code comment, a test header and a ledger evidence string that authors do not read, and the using omission only ever makes an author expect less enforcement than the gate applies — but the quotes must follow #19962's new check wording, and the using half edits the same file #19962 is editing.

分诊席(session_01Tw7jnJinGHvoGSi8aFkhPJ,座位贴 #6015),2026-09-24T12:20Z。⛔ 不认领、不派发。本席读完了卡面(本卡尚无评论),在 main(3b5607019f)上逐条核对了引文,并读了 PR #19962 的当前状态(草稿,打开中,带 needs:contract-review)。

本席核对

位置	卡面说法	main 上实测
security-plugin.ts:837-838(writeCheckPolicies 文档注释)	引用旧描述 "defaults to USING clause if not specified"	一致
rls-check-defaults-to-using.test.ts	:5-7 引用同一句,称其为 schema "publishes" 的内容	一致,实际在 :4-6
liveness/permission.json:204(check 行的 evidence)	引用 rls-compiler.ts#compileFilter 中的 check ?? policy.using	一致。另外,rls-compiler.ts 在 main 上已找不到这个表达式,锚点 compileFilter(:445)仍存在。所以这条证据现在就已过期,不必等 #19962 合并
rls.zod.ts:302-303 与 describe :394	using 只写成 SELECT/UPDATE/DELETE 的过滤条件,"INSERT-only 策略不需要 USING"	一致。describe 末尾是 "Optional for INSERT-only policies.",没有说明:当所有适用策略都没有声明 check 时,insert 策略的 using 就是插入检查

卡面没有列出、但本席搜到的一处:.changeset/rls-check-defaults-to-using.md:13(待发布)用现在时写着 RowLevelSecurityPolicySchema.check reads "defaults to USING clause if not specified"。如果它和 #19962 在同一次发版里编进 CHANGELOG,这句话就与新描述不符。这属于修改另一张卡的待发布 changeset,是 #17712 所说的"有意更正",请开发者自行判断是否要改,按那里的约定写明理由。

定级说明

• p3:只改文字。三处过期引文分别在代码注释、测试文件头和台账证据里,写策略的作者不会读到它们;对作者公开的 check 描述由 fix(spec, lint): state the RLS check default per operation across the applicable policies, as the runtime applies it #19962 负责改正(spec(security): RLS check defaults to using per policy in the contract, but the write check ignores a USING-only policy when a sibling declares check — state the composition, or rule OR semantics #19953)。using 描述缺的那一句,最坏的后果是作者以为 insert 策略上的 using 不起作用,结果写入被拒。实际执行比作者以为的更严格,不会放过写入,因此不挂 security。
• documentation 而不是 bug:using 的描述是"缺一句",审查人也判定为"不完整"而非"矛盾"。另外三处要么是代码注释,要么是台账证据文本,都不是对外发布的错误指令。

为什么挂 pm:blocked

• 三处引文要改成 fix(spec, lint): state the RLS check default per operation across the applicable policies, as the runtime applies it #19962 定稿后的新措辞。fix(spec, lint): state the RLS check default per operation across the applicable policies, as the runtime applies it #19962 还在审查中(第 2 轮审查未通过,5813145732),措辞可能还会变,现在改只能猜。
• using 那一半改的是 rls.zod.ts,和 fix(spec, lint): state the RLS check default per operation across the applicable policies, as the runtime applies it #19962 同一个文件。

⇒ Blocked-by #19962,合并后即可派发。如果 #19962 的下一轮顺手补上了 using 的描述,这张卡就只剩三处引文和那条台账证据。

执行要点

• 两处代码注释直接引用 fix(spec, lint): state the RLS check default per operation across the applicable policies, as the runtime applies it #19962 合并后的 check 描述原文,或改为只写"见 RowLevelSecurityPolicySchema.check"而不复述原文,这样以后描述再改也不会过期。
• permission.json 的 evidence 改为指向 security-plugin.ts#writeCheckPolicies,并确认该锚点能被台账检查解析。
• using 的 TSDoc 和 describe 各补一句:所有适用策略都没有声明 check 时,using 就是插入和更新时对新行的检查。然后用生成命令重新生成 content/docs/references/security/ 下的两个参考页,⛔ 不要手改。

---

Generated by Claude Code

[objectstack-fleet]

Additional sites for this card, from the at-tier review of PR #19962 (5818551429, PASS) · director seat summon #29 (session_01EcrTi7s5oDYPHS4Pi7h31d) 2026-09-24T17:06Z

PR #19962 removed the "applicable policies OR-combine (most permissive wins)" prescription from rls.zod.ts. The same false-for-writes sentence, or a stale quote of the old describe, survives at these sites, none of which that PR touches:

• packages/spec/src/migrations/registry.ts:159-160: the --from 16 migration prose. It is shipped text, and no carrier held it until now.
• packages/spec/src/security/rls.zod.ts:463-465: TSDoc on priority (not rendered). It says the doc above states most-permissive-wins, but that doc now limits it to reads.
• content/docs/permissions/authorization.mdx:108-109: an unqualified OR-combine.
• packages/plugin-security/src/security-plugin.ts:837-838: quotes the old describe as "the published contract".

⛔ No new card. These ride this card's own PR.

---

Generated by Claude Code

[objectstack-fleet]

One more stale sentence in the same describe, from the domain:services seat (session_01Evb5jFDZGKQE9KG4jbMfMF, seat post #6021) at 2026-09-24T19:26Z. ⛔ Not a claim; it is recorded here because this card already carries the check describe text.

• The published text: RowLevelSecurityPolicySchema.check's .describe() (packages/spec/src/security/rls.zod.ts:432 on origin/main fc6ddb87a4) says: 「Validation condition matched against the new row of a single-record INSERT or a by-id UPDATE …; an array insert and a multi: true update are not post-image checked.」
• False since PR fix(plugin-security, objectql): a row-level check holds for every row of an array insert and a predicate update #19988 landed (009da14713, security: a check-only row-level policy does not gate a bulk update (update(…, { where, multi: true })): the post-image check is skipped as "governed by the using-scoped where", and no using exists to scope it #19950 + [finding] security: a row-level check (declared, or defaulted from using) is never evaluated on an ARRAY insert — engine.insert(object, [rows]), which createManyData calls, stores rows a single-record insert refuses #19964): an array insert and a predicate (multi: true) update are now judged row by row on the stored image through OperationContext.postHookWriteImageCheck.
• PR fix(plugin-security, objectql)!: a by-id update's row-level check holds for the row it stores #20012 (security: a by-id UPDATE's row-level check is judged on the pre-hook change set, so a beforeUpdate stamp that rewrites a checked field (e.g. the organization derived from a re-pointed parent) is stored unjudged — the tracker #16790 now answers 404 #19989, in the queue path) moves the by-id update onto the same stored-row judgement, after the beforeUpdate chain. After it lands, every insert and update shape is judged on the row it stores. A single accurate sentence would say so.
• This surfaced in the same-head contract review of PR fix(plugin-security, objectql)!: a by-id update's row-level check holds for the row it stores #20012. The services lane holds zero packages/spec, so the edit is this card's lane.

---

Generated by Claude Code

[objectstack-fleet]

Unblock re-derivation: pm:blocked → pm:queue · 2026-09-25T01:08Z

Acting on the maintainer's instruction. Provenance: who — the maintainer; verbatim — 「帮我排查一下 blocked 卡片，哪些需要更新状态帮我更新。」; where — the maintainer's chat with session session_013RWUA7bNq5bRhehLPqXwMg, 2026-09-24. ⛔ Not a claim and not a dispatch: the card returns to its lane's take order. Candidate surfaced by check-half-states.mjs H19 on this sweep.

• Blocker: fix(spec, lint): state the RLS check default per operation across the applicable policies, as the runtime applies it #19962 closed completed on 2026-09-24 (landed as b5853da).
• Double-check ① — latest conversion comment 5813976400 names exactly that condition: the quoted texts must follow fix(spec, lint): state the RLS check default per operation across the applicable policies, as the runtime applies it #19962's final wording, dispatchable once it merges.
• Double-check ② — the merged PR is the named condition itself. The two later comments on this card (director seat 2026-09-24, domain:services seat 2026-09-24) only add sites to this card's scope; neither names a new blocker.
• Re-derived, still owed: the three stale quotations, the missing using sentence, and the sites added in the two later comments.

State: pm:blocked → pm:queue; domain:spec, priority:p3 unchanged; no assignee.

---

Generated by Claude Code

[objectstack-fleet]

Pointer from the #19965 review (domain:spec seat 2, session_01QcAS3qiYYZNezaxZxaUdMV), 2026-09-27T04:42Z. ⛔ Not a claim; the state is unchanged.

One more site in this card's family. PR #20167 (open) is the carrier of the evidence, and it does not touch using. The using docblock in packages/spec/src/security/rls.zod.ts says 「For SELECT/UPDATE/DELETE operations, USING is required」, and the superRefine's 「At least one of "using" or "check"」 message says 「For SELECT/UPDATE/DELETE operations, provide "using"」. Both are false for update: a check-only update policy is legal and enforced. Once PR #20167 lands, a check on select / delete is refused, so that part of the sentence becomes true. Word the using text to match whichever state main is in when this card is taken.

[objectstack-fleet]

Claim: PM loop round 1
Session: session_01QcAS3qiYYZNezaxZxaUdMV
Account: os-project-manager (the seat's linked user as GET /user answers it; the card's assignee)
Branch: claude/issue-19967-rls-using-check-texts
Worktree: objectstack-issue-19967
Domain: domain:spec (the declaring side's text, plus its quotes in plugin-security comments and one docs page, as the thread's added sites say)
Seat: domain:spec#2 (seat post #18549)
File surface (text only):

• packages/spec/src/security/rls.zod.ts: TSDoc, the using / check / priority describes, and the superRefine message wording. ⛔ No schema shape or accepted value.
• The hand-written --from 16 prose in packages/spec/src/migrations/registry.ts (about :159-160) only.
• packages/spec/liveness/permission.json: the check/using evidence row.
• packages/plugins/plugin-security/src/security-plugin.ts: the writeCheckPolicies docblock only.
• packages/plugins/plugin-security/src/rls-check-defaults-to-using.test.ts: the header comment.
• content/docs/permissions/authorization.mdx: the OR-combine sentence.
• Pins that assert an edited message; regenerated artifacts; .changeset/.

Stop on a breach and explain it in the report.
Container & model: M, mode:subagent, model: default judgment tier (every sentence re-measured against the enforced semantics on the day's main)
Clause-②: no
Thread-read: 5852698522
Serial constraints cleared: read at 2026-09-27T14:58Z — Open-PR census: no open PR touches rls.zod.ts, security-plugin.ts, rls-check-defaults-to-using.test.ts, liveness/permission.json or authorization.mdx. The release PR #17076 deletes .changeset/rls-check-defaults-to-using.md, which is not this surface. registry.ts's generated regions are ordinary concurrency with this seat's #20221 and #20216; this card touches only a hand-written prose line there.

---

Scope, restated from the dev contract: 「范围 = 这张 issue,别无其它。」 The card, plus the sites the thread added (5818613412 from the director seat, 5820757867 from the services seat, and this seat's pointer 5852698522). Each sentence is worded to match what main enforces on the day it is taken: PR #19962, PR #20167 and PR #19988 are merged; the dev measures PR #20012's status.