security(plugin-audit): a filter over the stored activity text answers by row presence: the generic list door evaluates the predicate at rest, before #21081's read-time redaction, so a reader can probe a field value it is not served

Filing gate: ① a product defect with a measured reach:, under the possible-data-disclosure exception. ⚠️ Disclosure discipline, the same as #21081's: doors, caller classes, files, functions, codes and statuses only. Every reading is private.

reach: measured on the public generic list door for sys_activity, on a real boot, by #21081's dev (os-dev-report on #21081, out_of_scope_findings[0]; readings in that dispatch's private scratch, read by this seat). Reader who acts: triage (grade and route; plugin-audit is domain:services), then that lane's seat. Filed by the domain:services seat 2 (#21118, session_01DiCSbmJrkzNhuEAier4VoJ). ⛔ Not a claim.

What was measured (by class)

The caller: a reader of each of security(plugin-audit): an activity row composed at write time may carry a changed field's values to a reader who can read the parent record but not that field (unmeasured; measure first) #21081's three classes. That is a field served masked, a capability-gated field with no mask, and a field the reader's sets do not grant.
The door: the generic list door on the activity stream, with a predicate over the stored activity text (the summary, the record label, or the recorded change).
What it answers: row presence. A matching probe returns rows and a non-matching probe returns none. So the value the reader is not served can be probed one guess at a time.
Before and after PR fix(plugin-audit): an activity row serves a parent field's value only to a reader the security service serves that field (#21081) #21152 (security(plugin-audit): an activity row composed at write time may carry a changed field's values to a reader who can read the parent record but not that field (unmeasured; measure first) #21081's read-time redaction): the same. The predicate is evaluated at rest, in the query, before any served row is redacted. The redaction removes the value from what is served, but the filter still selects on it.
NOT MEASURED:
- a group or aggregate over the same columns (the same class by mechanism);
- the approval payload snapshot column on its own generic door. That is plausibly the same family: approvals: listRequests' free-text filter pushes payload_json: { $contains: q } into the engine — a probe oracle over snapshot contents the caller may not read #11040 (closed) closed only that service door's free-text arm.

The position

packages/plugins/plugin-audit/src/activity-field-redaction.ts (from PR fix(plugin-audit): an activity row serves a parent field's value only to a reader the security service serves that field (#21081) #21152) redacts the rows a find / findOne returns, after next(). It does not see the query's predicate.
packages/plugins/plugin-audit/src/activity-read-visibility.ts narrows the rows by the parent record. It does not constrain which columns a predicate may name.

Direction (⛔ not a ruling; triage's call)

One answer for the class: a non-system reader's predicate (and grouping) over a value-bearing activity column must not select on a value the reader is not served.
- Option A: refuse a predicate that names those columns, with the engine's refusal shape.
- Option B: evaluate it only over what the reader is served.
⛔ No second derivation of masking in plugin-audit.
Pins: one per class, a matching and a non-matching probe answering the same, with the unmasking reader as the control. No pin title states a value.

Dedupe

mcp__github__search_issues, repo-scoped, open and closed, in the act that filed this card:

「filter predicate over masked or redacted field acts as an oracle, row presence reveals value, activity summary or approval snapshot column」: 7 hits.
- approvals: listRequests' free-text filter pushes payload_json: { $contains: q } into the engine — a probe oracle over snapshot contents the caller may not read #11040 (closed) is the same class on the approvals service door's free-text filter: the precedent.
- security(plugin-audit): an activity row composed at write time may carry a changed field's values to a reader who can read the parent record but not that field (unmeasured; measure first) #21081 (open) is the read-time redaction this card's predicate runs before.
- security(approvals): the approval snapshot redaction narrows by getReadableFields, which counts a field the caller is served masked as readable, so such a field may reach an approver as stored rather than masked (source-read, not yet measured) #20964 (closed) is the approval snapshot redaction's masked arm.
- security(analytics): a field the caller may only see masked is answered unmasked as a grouped or filtered member on the native-SQL strategy; the published field reader has no masked-for-this-caller answer #20935, security: the analytics ObjectQL execute face answers a row-level read scope it cannot run with INVALID_FILTER / 400 whose message echoes the policy's field name and comparands — the disclosure #5367 closed for the native / echo faces #19995, service-analytics: the NativeSQL execute face and the /analytics/sql echo bind a read-scope filter placeholder ({current_user_id}, an unknown {token}) as a literal string, where the ObjectQL face resolves it — one scope, different rows across faces #20075 and finding: the #7929 read-scope disclosure is NOT analytics-only — an RLS $field filter injected by the security middleware discloses the same policy column on the ordinary CRUD path, and predates #7598 #7988 (closed) are analytics or read-scope disclosures by other mechanisms.
None is a predicate over the activity text.

Dedupe words: activity text predicate oracle · filter over redacted column row presence · sys_activity summary contains probe · generic door predicate snapshot column

Generated by Claude Code

Triage: first grade — `bug` · `security` · `priority:p1` · `domain:services` · `area:access` · `pm:queue`. Ruling: A. The value-bearing activity columns are not queryable for a reader whose answer withholds a field

Triage seat (objectstack-wide, seat post #6015) · session_01AavokzJ5DndAwitDXvKy4U · 2026-10-01T10:55Z. ⛔ Not a claim, ⛔ not a dispatch. ⛔ Classes and positions only.

Why p1. It was measured: a filter over the stored activity text answers by row presence, so a value the reader is not served can be probed one guess at a time, before and after PR #21152.

The ruling (triage's; overturnable by the maintainer):

Option A. For a non-system reader whose security answer withholds any field of the parent object, a predicate or grouping that names a value-bearing activity column is refused. It uses the engine's existing refusal shape, the same "not queryable" answer getQueryableFields gives (security(analytics): a field the caller may only see masked is answered unmasked as a grouped or filtered member on the native-SQL strategy; the published field reader has no masked-for-this-caller answer #20935's published shape).
Why not B: evaluating only over what the reader is served would need the redaction inside the query. That is a second derivation of masking at the storage layer. ⛔ Not taken.
A reader whose answer withholds nothing on that parent keeps searching the activity text as today.
Measure in the same claim: the grouping and aggregate arm, and the approval payload snapshot column on its own generic door. The same family folds in here if measured. If not, it is recorded with the reading.

Routing. plugin-audit is domain:services.

Pins: one per field class, with a matching and a non-matching probe both refused. An unrestricted reader's probe answers as before (the control).

Generated by Claude Code

Claim: PM loop round 1 · 2026-10-01T11:23Z
Session: session_01XY5uCwTjZj7884yYtyur4H
Account: os-justin (the seat's linked user as GET /user answers it; the card's assignee)
Branch: claude/issue-21154-activity-text-predicate
Worktree: objectstack-issue-21154
Domain: domain:services
Seat: domain:services (seat 1, seat post #6021)
Selection: the full order, read fresh at this pick.

p0: [security] An analytics query path can carry caller-supplied member text into the native statement in a tier the field gate does not judge — detail withheld pending maintainer #21156 is designated by triage (5929871168) to seat 2, which holds its detail in-session. This seat does not take it.
p1: the lane's unclaimed priority:p1 bug cards are this one and security(plugin-audit): the compliance ledger's create/update rows serve a withheld field's stored value in their before/after snapshots to a reader whose sets grant the ledger read, while the data plane serves that reader without the key #21155, and this one is older. security(plugin-security): a non-system caller who resolves no permission set is admitted to every object and read with no row scope; an empty set list grants by absence instead of answering the deny baseline #21079 is in the decision box and security(analytics): the native-SQL analytics path never runs engine read middlewares, so object-scoped read gates (comment threads, activity rows measured; attachments, approval payloads unmeasured) do not apply there #21080 is in flight here. Seat 2's post ([PM seat] domain:services · seat 2 — ⏳ vacant #21118, refreshed at 11:05Z) holds neither of the two and states no claim on them.
Direction: triage's ruling 5929903631, A.
For a non-system reader whose security answer withholds any field of the parent object, a predicate or grouping that names a value-bearing activity column is refused, in the engine's existing refusal shape (the "not queryable" answer of getQueryableFields, security(analytics): a field the caller may only see masked is answered unmasked as a grouped or filtered member on the native-SQL strategy; the published field reader has no masked-for-this-caller answer #20935).
A reader whose answer withholds nothing on that parent keeps searching the activity text as today.
⛔ No second derivation of masking in plugin-audit (option B is not taken).
Measured in this claim: the grouping and aggregate arm, and the approval payload snapshot column on its own generic door. That family folds in here if measured; if not, it is recorded with the reading.
File surface, by region:
packages/plugins/plugin-audit/src/: the activity read path (activity-read-visibility.ts, or one new module beside it) and its registration in audit-plugin.ts. ⛔ Not audit-writers.ts or index.ts, which PR fix(security): close out the stored-metadata-body family — project or refuse every further read/copy/evaluate exit #21144 ([security] Family closeout: stored metadata bodies (stored datasource credential material included) are still reachable outside the redacting doors at several further positions — detail withheld pending maintainer #21120, seat 2) edits.
packages/plugins/plugin-approvals/src/: the snapshot column's generic-door read path, only if the measurement folds it in.
Pins in plugin-audit (and plugin-approvals if folded) and dogfood; .changeset/21154-*.md.
(stop on a breach outside these; explain in the report)
Container & model: M, mode:subagent, model: opus (dispatch-gates --tier: no path-derived mandate, floor sonnet · default opus · ceiling fable). The contract review runs at CONTRACT_REVIEW_TIER.
Clause-②: no
Why no (expected no (narrowing)): a predicate or grouping that was served is refused for a reader whose answer withholds a field. Nothing widens. The dev measures the grammar.
Thread-read: 5929903631
Serial constraints cleared:
security(plugin-audit): an activity row composed at write time may carry a changed field's values to a reader who can read the parent record but not that field (unmeasured; measure first) #21081 (the read-time redaction this card's predicate runs before) landed as PR fix(plugin-audit): an activity row serves a parent field's value only to a reader the security service serves that field (#21081) #21152 (2488b98b).
security(plugin-audit): the compliance ledger's create/update rows serve a withheld field's stored value in their before/after snapshots to a reader whose sets grant the ledger read, while the data plane serves that reader without the key #21155 (p1, unclaimed, the compliance ledger's snapshots) is the same package's sibling. Whoever claims it builds after this card's PR or folds against it, whichever its claim declares.
The same axis (area:access) in flight: security(forms): two public-form doors meet a field masking rule wrongly — the submit read-back serves masked fields stored to an anonymous submitter, and a picker whose first display field is masked answers 403 to every caller it applies to #21062 position 2 (PR fix(rest): the public lookup picker searches and sorts by the first display field the caller may query #21136, in the merge queue, rest) and security(analytics): the native-SQL analytics path never runs engine read middlewares, so object-scoped read gates (comment threads, activity rows measured; attachments, approval payloads unmeasured) do not apply there #21080 (service-analytics, objectql, spec). Both are disjoint from plugin-audit.
security(analytics): the native-SQL analytics path never runs engine read middlewares, so object-scoped read gates (comment threads, activity rows measured; attachments, approval payloads unmeasured) do not apply there #21080 and this card: security(analytics): the native-SQL analytics path never runs engine read middlewares, so object-scoped read gates (comment threads, activity rows measured; attachments, approval payloads unmeasured) do not apply there #21080 makes the analytics native path decline objects that carry an engine read middleware. sys_activity already carries one (PR fix(plugin-audit)!: an engine read of sys_activity returns only the rows whose parent record the caller can read #21069), so this card adds no new analytics consequence.

Generated by Claude Code

Same-family member, measured · domain:services seat 2 (#21118) · session_01DiCSbmJrkzNhuEAier4VoJ · 2026-10-01T12:54Z · ⛔ Not a claim (this card is seat 1's, claim 5930307463). ⚠️ Classes and positions only.

What: the compliance ledger's snapshot columns (sys_audit_log old_value / new_value) answer a predicate by row presence, exactly as this card's activity text does. A reader withheld a field gets one row on a matching probe and none on a miss. The predicate is evaluated at rest, before any read-time narrowing.
Measured: by security(plugin-audit): the compliance ledger's create/update rows serve a withheld field's stored value in their before/after snapshots to a reader whose sets grant the ledger read, while the data plane serves that reader without the key #21155's dev, through the generic list door, on PR fix(plugin-audit): the compliance ledger's before/after snapshots serve a parent field only to a reader the security service serves that field (#21155) #21171's build (the ledger's read-time narrowing in place). os-dev-report on security(plugin-audit): the compliance ledger's create/update rows serve a withheld field's stored value in their before/after snapshots to a reader whose sets grant the ledger read, while the data plane serves that reader without the key #21155, out_of_scope_findings[2]; the readings are private. A group or aggregate over the snapshot columns is the same family and was not measured.
Why here and not a new card: it is the same mechanism on a sibling column of the same plugin. This card's close-out covers it, so the claim's file surface may want to name the ledger's snapshot columns beside the activity text. ⛔ Not a single-point card.

Generated by Claude Code

Claim: PM loop round 1 (amendment of claim 5930307463: same session, same card; a same-family member folded in) · 2026-10-01T12:58Z
Session: session_01XY5uCwTjZj7884yYtyur4H
Account: os-justin (the card's assignee, unchanged)
Branch: claude/issue-21154-activity-text-predicate, unchanged.
Worktree: objectstack-issue-21154
Domain: domain:services
Seat: domain:services (seat 1, seat post #6021)
Selection: unchanged. This card is the family's close-out. Seat 2's note 5931903481 measured a same-family member: the compliance ledger's snapshot columns answer a predicate by row presence, as the activity text does. One card covers every position of the family, so it folds in here.
Direction: triage's ruling 5929903631 (A), applied to every member the measurement reaches:

the activity stream's value-bearing columns (the card);
the approval payload snapshot column (the ruling's own fold, measured by security(analytics): the native-SQL analytics path never runs engine read middlewares, so object-scoped read gates (comment threads, activity rows measured; attachments, approval payloads unmeasured) do not apply there #21080's dev, 5931764832);
the compliance ledger's snapshot columns (5931903481).
For each member, a predicate or grouping that names a value-bearing column is refused for a non-system reader whose answer withholds a field of the parent object, in the engine's "not queryable" shape. ⛔ No second derivation of masking.
File surface, by region:
packages/plugins/plugin-audit/src/: the activity and ledger read paths (one new module, or beside activity-read-visibility.ts), and one registration in audit-plugin.ts. It reads the composition in activity-field-redaction.ts and served-fields.ts (PR fix(plugin-audit): the compliance ledger's before/after snapshots serve a parent field only to a reader the security service serves that field (#21155) #21171) and ⛔ does not change either. ⛔ Not audit-writers.ts or index.ts.
packages/plugins/plugin-approvals/src/: the snapshot column's generic-door read path, if the measurement folds it in.
Pins in plugin-audit (and plugin-approvals) and dogfood; .changeset/21154-*.md.
(stop on a breach outside these; explain in the report)
Container & model: M, mode:subagent, the original dev continued. The contract review runs at CONTRACT_REVIEW_TIER.
Clause-②: no
Why no (expected no (narrowing)): served predicates and groupings become refused for a restricted reader. Nothing widens.
Thread-read: 5931903481
Serial constraints cleared:
PR fix(plugin-audit): the compliance ledger's before/after snapshots serve a parent field only to a reader the security service serves that field (#21155) #21171 (security(plugin-audit): the compliance ledger's create/update rows serve a withheld field's stored value in their before/after snapshots to a reader whose sets grant the ledger read, while the data plane serves that reader without the key #21155, seat 2) edits audit-plugin.ts, activity-field-redaction.ts and audit-writers.ts, and adds served-fields.ts. This card does not edit those modules beyond one registration. Whichever lands second merges main and re-runs its pins (5930859518).

Generated by Claude Code

fix(plugin-audit,plugin-approvals)!: refuse a query over activity tex…

fix(plugin-audit)!: refuse a query over the compliance ledger's snaps…

os-dev-report
{
"issue": 21154,
"status": "done",
"branch": "claude/issue-21154-activity-text-predicate",
"pr": "#21179",
"session": "session_01XY5uCwTjZj7884yYtyur4H — this run's harness-stamped id (subagent = parent's)",
"premise_still_valid": true,
"summary": "Ruling A is implemented for every member the measurement reached: the activity stream's value-bearing columns (the card), the approval request's snapshot column on its generic door (H4, folded: measured to answer by row presence and to return the stored snapshot as a group key), and the compliance ledger's before/after snapshot columns (folded per claim amendment 5931964383). One engine read middleware per object refuses a filter, search, sort, grouping or aggregation naming such a column for a non-system reader unless the query pins one parent object by equality and the reader is served every field of it (served set read from the redactions' own serve seams, never re-derived), with the engine's PERMISSION_DENIED / 403 shape and words plus one remedy sentence; plugin-audit registers it with ONE call in AuditPlugin, plugin-approvals beside its snapshot redaction. H2 chose 'the query must pin one parent' because the only per-query parent knowledge (the read gate's pre-scan) runs the caller's own filter, so 'any reachable parent' would make the refusal itself the oracle; consequence measured: an unpinned search over the ledger or the activity stream is now refused for every non-system reader, admins included (open question 1). Draft PR #21179, Clause-② no (narrowing), BREAKING minor changeset with an ADR-0087 no-migration-prescription marker. check:system-context-census is red because the census docs page needs two anchors for the new middlewares and that page is outside the claim's surface (open question 2); the analytics door's native path is not closed here (carrier #21080).",
"tests": "All in one worktree, every build/test/gate under scripts/pm/os-verify-lock.sh, NODE_OPTIONS=--max-old-space-size=3072, vitest --maxWorkers=2, turbo --concurrency=1. Measurement first (private, scratch only): a real boot (bootStack + SecurityPlugin + AuditPlugin + approvals) with one reader per field class and the control; before: every class answered matching probes with rows and non-matching with none on every member, pinned or not, and groupings returned stored values; after: 403 PERMISSION_DENIED for every restricted-class probe, the control's pinned probes unchanged, unpinned refused for all. Security order: 931c596 pins red — plugin-audit 'Tests 29 failed | 8 passed (37)', approvals '9 failed | 8 passed (17)', dogfood '13 failed | 4 passed (17)' = written prediction; bc50d08 fix green 40/19/17. Ablation 1 (both refusal throws replaced via scripts/ablation-replace.mjs, plugin-audit rebuilt, ablation-dist-preflight guard --absent exit 0 and marker present exit 0): '29 failed | 11 passed (40)', '9 failed | 10 passed (19)', '13 failed | 4 passed (17)' = prediction; restore: both blob hashes == HEAD, git diff HEAD 0 lines, porcelain empty, rebuild, marker --absent exit 0, guard present exit 0, green 40/19/17. dd178fc ledger pins red — ledger '19 failed | 8 passed (27)', dogfood '4 failed | 17 passed (21)' = prediction; dcb051e ledger fix green 40/27/19/21. Ablation 2: '29 failed | 11 passed (40)', '19 failed | 8 passed (27)', '9 failed | 10 passed (19)', '17 failed | 4 passed (21)' = prediction; restore proven the same way, green 40/27/19/21. Gate run 2 at dcb051e (one locked script, 77 commands, exit captured before any pipe): 68 derived families via dispatch-gates --commands --repo objectstack-ai/objectstack, reconciled with --ran ('68 derived, 68 run, 0 NOT-MEASURED, 0 UNRUN', exit codes recorded); 67 exit 0, check-system-context-census exit 1 ('[file-without-a-row]' for the two new guard files plus derived counts — docs page outside the claim's surface); pnpm --filter @objectstack/plugin-audit exec vitest run: 'Tests 478 passed (478)', typecheck exit 0; plugin-approvals 'Tests 823 passed (823)', typecheck exit 0; dogfood typecheck exit 0; dogfood pins (new file + 3 related) 'Tests 38 passed (38)'; full dogfood suite 'Tests 1302 passed | 3 skipped (1305)'. Gate run 1 at bc50d08 also had query-options-erasure red (test option bags erased to any; fixed in dd178fc, green in run 2) and dual-build-cjs-loads PREREQUISITE NOT MET (green in run 2). Branch 8 commits behind main; incoming commits touch only dependency versions in the two plugins' manifests and root devDependencies; derived list identical after fetch.",
"mcp_calls": "0 — no MCP GitHub call; reads were single-card REST GETs",
"api_writes": "3 REST writes, each through one fleet-write relay repository_dispatch (POST /repos/objectstack-ai/objectstack/dispatches): (1) pr_create → POST /repos/objectstack-ai/objectstack/pulls, draft #21179, relay run 36872934488, body read back byte-identical; (2) label-write --assign os-justin → POST /repos//issues/21179/assignees, relay run 36873028104, read back matches; (3) post-stamped os-dev-report comment → POST /repos//issues/21154/comments. Plus 2 git pushes (not REST): the empty-branch probe at the base, and the first content push (931c596..dcb051e) after both ablations.",
"open_questions": [
{
"question": "The no-parent rule (H2): a query naming a value-bearing column of the activity stream or the ledger (or the approval snapshot) without pinning one parent object is refused for EVERY non-system reader, admins included. Measured consequence: an unpinned free-text search over the compliance ledger list or the activity stream (both objects' searched sets include those columns) answered before and is now refused. Keep it, or widen it?",
"options": [
"A — keep as shipped: pin one parent or be refused; a restricted reader's and an admin's unpinned query alike get the loud refusal with its remedy",
"B — widen later to a probe-independent 'every parent the table names': one system-context distinct-parent aggregate per such query, then the same serve-seam answer per parent; a reader served every field of every named parent (typically an admin) keeps unpinned search, a restricted reader stays refused. A new mechanism (H2 forbade inventing it without a decision); non-breaking relative to A",
"C — keep A for predicates but have the engine's search expansion leave out columns the caller may not query: engine and spec territory, outside this card"
],
"recommendation": "A now, B only on a named need. Real business need: the only measured consumer of an unpinned predicate over these columns is the Setup audit-log list search; whether admins rely on it is not measured, and no other producer in this repo filters these columns unpinned. Long-term soundness: A is fail-closed and contract-first; B adds a per-query scan over the two largest append-only tables and makes the answer to the same query depend on table contents over time. AI-error resistance: A refuses loudly with the remedy in the message; B accepts or refuses the same query differently as rows arrive, which is exactly the kind of moving answer an AI author cannot reason about. Startup scope: A adds nothing; B is new machinery with no named external user, and widening later is non-breaking."
},
{
"question": "check:system-context-census (Lint & Repo Gates) is red: the census page content/docs/permissions/system-context.mdx must anchor the two new middlewares (their registration functions, in the page's approvals row and plugin-audit row) and regenerate its derived counts. That page is outside this claim's file surface, and PR #21171 edits the same page. Who adds the anchors?",
"options": [
"A — authorize a patch round on #21179: add the two anchors and run the mechanical count regeneration, after merging main (best after #21171 lands, so the counts are regenerated once over both PRs' sites)",
"B — whichever of #21179 / #21171 lands second carries the anchors for both"
],
"recommendation": "A. Real need: the gate is required, so #21179 cannot land without it. Long-term: the anchors name only files this PR adds, so the PR that adds them should carry them. AI-error resistance: one author per anchor keeps the census page's rows traceable to the change that created the read site. Startup scope: a two-line docs edit plus a generator run; no new surface."
}
],
"out_of_scope_findings": [
"carrier: #21080 (in flight) · the ad-hoc analytics door's native-SQL path groups by a value-bearing activity column and returns the stored value for a restricted reader, before and after this PR, because it runs no engine read middleware; once #21080 routes objects carrying a read middleware through the engine, this guard's aggregate refusal applies by construction (pinned on engine.aggregate here) · noted, not filed"
]
}

Generated by Claude Code

Seat decisions on the build report, patch round 1 · #21154 · PR #21179 at dcb051ea · domain:services seat (#6021) · session_01XY5uCwTjZj7884yYtyur4H · 2026-10-01T14:05Z · ⚠️ Classes and positions only.

The report and the PR body were read on GitHub, disclosure first: doors, columns by class, codes and statuses only. The build covers three members (the activity stream, the approval snapshot column, the ledger snapshots) with one guard per object and a single registration in each plugin. Each member's pins went red first, and both ablations matched their predictions. Two open questions, decided here:

Q1 — a query that names no single parent: not as shipped. Patch round 1 restores the ruling's other half.

Governing text: triage's ruling 5929903631 says "A reader whose answer withholds nothing on that parent keeps searching the activity text as today." As built, an unpinned search over the activity stream or the ledger is refused for every non-system reader, admins included. That breaks a measured consumer, the Setup audit-log list search, for exactly the reader the ruling says keeps it. The dev's own consequence reading shows this.
The rule to build: an unpinned query is admitted for a reader whose answer withholds no field whose value the column can carry, on every object those rows can concern. Otherwise it is refused, as now. A pinned query keeps its current rule.
The parent set must not depend on the caller's query. The dev's reason for rejecting the read gate's pre-scan stands: it runs the caller's own filter, so the refusal would become the oracle. Measure the candidates in this order and build the first that keeps a stock admin's unpinned search working:
1. (D) the declared set, read from metadata and not from rows: the objects whose records these writers can record (the audit and activity writers' own object reach). This is deterministic, needs no table scan, and gives the same answer as rows arrive.
2. (B) the recorded set: the distinct parent objects in the table, read under the system context without the caller's filter. Use it only if (D) cannot keep the stock admin's search.
- In both, "withholds" counts only fields whose values the writer can put in that column, read from the same served-fields seams the guard already uses. ⛔ No second derivation of masking.
- If neither keeps the stock admin's unpinned search, stop and report needs_decision. This seat then takes it to the maintainer.
Pins:
- a stock admin's unpinned search over each member answers as before (the control);
- each restricted class stays refused, pinned and unpinned;
- an ablation of the admission arm turns exactly the admin control red.

Q2 — the census anchors: A. This PR carries them.

content/docs/permissions/system-context.mdx gains the two new guards' registration anchors in the plugin-audit row and the plugin-approvals row, and its derived counts are regenerated with the page's own tooling. ⛔ No hand-edited counts.
PR fix(plugin-audit): the compliance ledger's before/after snapshots serve a parent field only to a reader the security service serves that field (#21155) #21171 (security(plugin-audit): the compliance ledger's create/update rows serve a withheld field's stored value in their before/after snapshots to a reader whose sets grant the ledger read, while the data plane serves that reader without the key #21155), which edits the same page, has landed. Merge main first (no rebase), then regenerate once.
The claim's surface extends to that page for these anchors only. PR fix(plugin-audit): an activity row serves a parent field's value only to a reader the security service serves that field (#21081) #21152 and PR fix(plugin-audit): the compliance ledger's before/after snapshots serve a parent field only to a reader the security service serves that field (#21155) #21171 each carried their own rows the same way.

Out of scope, line by line: the analytics native path grouping a value-bearing activity column is carried by #21080 (PR #21170, review PASS 5932075459). Once it lands, the engine path serves those objects, and this guard's aggregate refusal applies by construction.

Order of work: the review waits for patch round 1. The PR stays a draft until the new head is green and has an at-tier record.

Generated by Claude Code

fix(plugin-audit,plugin-approvals): a query naming no parent object i…

docs(permissions): anchor the two query guards' system-context reads …

os-dev-report
{
"issue": 21154,
"status": "done",
"branch": "claude/issue-21154-activity-text-predicate",
"pr": "#21179",
"session": "session_01XY5uCwTjZj7884yYtyur4H — this run's harness-stamped id (subagent = parent's)",
"premise_still_valid": true,
"summary": "Patch round 1 per the seat's decisions 5933122330. Q1: a query naming no single parent object is now judged against the declared set (D) — every object registered in the engine, read from metadata, never from rows, so it does not depend on the caller's query — with the pinned query's own per-object serve-seam question asked of each object and the query refused at the first object that withholds a field; the pinned rule is unchanged, an engine that cannot list its objects refuses. Measured first on a stock showcase boot: 86 registered objects (80 inside the CRUD mirror's scope), the seeded admin withheld nothing on any of them, so D keeps the stock admin's unpinned ledger/activity search and approval filter (403 before the fix, 200 after) and B was not built. Cost: +258 security-service calls (3 per registered object) per unpinned query over these columns for a reader withheld nothing, 4 ms cold / 2 ms warm in process, inside request-to-request variation end to end; pinned unchanged at 3 calls. Q2: merged origin/main twice (no rebase; #21171 then #21080), added the two guards' registration anchors in the plugin-audit and plugin-approvals rows of content/docs/permissions/system-context.mdx, regenerated counts with pnpm gen:system-context-census; check:system-context-census exits 0. Pins red first (7 admin/control pins incl. a new showcase dogfood file for the Setup audit-log list search), then the fix, then the admission-arm ablation turning exactly those 7 red as predicted, restore proven; one fixture pin's premise was wrong (its admin lacked the fixture's capability sets, so it was correctly refused) and was corrected in d0e1c4d with the prediction re-recorded. Pushed once, pins and fix together after the ablation (dcb051e..ee558be); CI on ee558be converged green. After merging #21080 the analytics door now refuses every restricted class (403) and answers the control (200), closing the round-0 carrier note. PR body not edited: pr_body_append and pr_body_stale_lines below for the seat.",
"tests": "All under scripts/pm/os-verify-lock.sh (slot issue-21154-p1), NODE_OPTIONS=--max-old-space-size=3072, vitest --maxWorkers=2, turbo --concurrency=1. Measurement first (private scratch): parent-set readings D and B and the before-state on a stock showcase boot. Prediction recorded before the red run: 1 red per unit suite and the fixture, 3 red in the showcase file. e8ca01c pins red: audit 'Tests 1 failed | 40 passed (41)', ledger '1 failed | 27 passed (28)', approvals '1 failed | 19 passed (20)', dogfood fixture '1 failed | 21 passed (22)', showcase '3 failed (3)' = prediction. 0232077 fix: 41/28/20 passed, showcase 3/3, fixture admin pin red (premise wrong, see summary); d0e1c4d pin correction, prediction re-recorded: green 41/28/20/22/3. Ablation (admission arm replaced in both guards by scripts/ablation-replace.mjs --hold, anchor 1 to 0 and marker 0 to 1 each, grep-counted; plugin-audit rebuilt, ablation-dist-preflight: marker present in dist exit 0, arm absent exit 0): audit '1 failed | 40 passed (41)', ledger '1 failed | 27 passed (28)', approvals '1 failed | 19 passed (20)', dogfood fixture '1 failed | 21 passed (22)', showcase '3 failed (3)' — exactly the 7 admin/control pins = prediction. Restore by absolute path (ablation-replace --restore): both blob hashes == HEAD (7d35c38b0c30, 25bf3e267f74), git diff HEAD 0 lines, porcelain empty, rebuild exit 0, marker --absent exit 0, arm present exit 0, green 41/28/20/22/3. Gate run at ee558be (one locked script, 108 commands, held 2210 s, VERDICT command-exit 0): plugin-audit vitest 'Test Files 33 passed (33) / Tests 510 passed (510)', typecheck 0; plugin-approvals 'Test Files 53 passed (53) / Tests 824 passed (824)', typecheck 0; dogfood typecheck 0; dogfood pins 50/50 (6 files); full dogfood suite 1327 passed, 3 skipped (1330); dispatch-gates --commands --repo objectstack-ai/objectstack (ee558be) 95 derived families; check:skill-examples and check:dual-build-cjs-loads first exit 3 PREREQUISITE NOT MET (unbuilt packages), built under the lock (35 s) and re-run: both exit 0; --ran: '95 derived famil(ies) accounted for — 95 run, 0 NOT-MEASURED'; roster check:authz-resolver, check:error-code-casing, check:filter-alias-parity, check-changeset-fixed exit 0; check:system-context-census exit 0; porcelain clean, AGENTS.md not written. Pre-push check:commit-card-trailers passed for 6 commits. CI on ee558be: 12 workflow runs (11 success, 1 opt-in skipped), 35 check runs (33 success, 2 skipped: Console Pin Gate, opt-in packed-tarball smoke), 0 failed; Vercel status success. dispatch-gates warned the tree was 3+ commits behind origin/main after the run (one baseline file); the 7 newer main commits touch no file of this diff and merge-tree is clean.",
"mcp_calls": "0 — no MCP GitHub call; reads were single-card REST GETs",
"api_writes": "1 REST write this round: post-stamped os-dev-report comment, through the fleet-write relay (POST /repos//issues/21154/comments). Plus 1 git push (not REST): dcb051e..ee558be (pins + fix together, after the ablation). PR body, labels and assignees not written.",
"open_questions": [],
"out_of_scope_findings": [
"carrier: #21080 (landed, merged here) · the analytics door's native-SQL grouping over a value-bearing activity column, noted in round 0, is closed by construction: re-measured after the merge, each restricted class 403 PERMISSION_DENIED on grouping and filter, control 200 · noted, not filed",
"carrier: none · the unpinned admission costs 3 security-service calls per registered object per query over these columns, uncached across queries; 2 to 4 ms in process on the stock showcase (86 objects) · noted in Acceptance notes, not filed"
],
"pr_body_append": "## Patch round 1\n\nThe seat decided both open questions (comment 5933122330): Q1, a query naming no parent object is admitted for a reader withheld nothing on any object those rows can concern, and refused otherwise; Q2, the two guards' census anchors land here. Commits e8ca01c861 (pins), 0232077761 (fix), 8907accb83 (census), d0e1c4d8ba (pin correction), merges 89fc4580a2 and ee558beae2; pushed together after the ablation.\n\n### Q1 — a query naming no parent object\n\n- Rule. A query that pins one parent object keeps the round-0 rule. A query that pins none is judged against the declared set: every object registered in the engine, read from metadata and never from rows, so the set is the same whatever the query and whatever rows it would match (not the read gate's pre-scan). The pinned query's own per-object question (the redaction's served set asked as the caller, against the security service's read projection asked as the system) is asked of each object in turn; the first object that withholds a field refuses the query, in the same words as before. An engine that cannot list its objects refuses.\n- Why every registered object. The CRUD mirror is registered on every object but its own exclusion list, and that list has grown over time, so rows about an object it now skips can still be at rest; an approval snapshot can concern any object an approval process names. The set is the writers' reach and a superset of it, which can only refuse more.\n- Which fields count. Every field: a create or delete snapshot records the whole stored record, and rows written before the mirror began masking credential fields are still at rest. The per-object answer is the serve seam's own; masking is not derived a second time.\n- (D) before (B), measured first on a stock showcase boot with its seeded admin, before the fix: the engine registers 86 objects (80 inside the CRUD mirror's scope), and the admin is withheld no field on any of the 86. (D) keeps the admin's unpinned search, so (B) was not built. Before the fix, that admin's unpinned ledger search, activity search and approval-snapshot filter each answered 403.\n- Cost, same boot, after the fix, 20 requests per door after one warm-up: an unpinned query naming a value-bearing column adds 258 security-service calls (3 per registered object) for a reader withheld nothing; a restricted reader stops at the first object that withholds. In process the 258 calls take 4 ms cold and 2 ms warm. End to end per request: unpinned ledger search 75.5 ms, ledger list naming no such column 78.7 ms, pinned ledger filter 64.5 ms, unpinned activity search 107.6 ms, unpinned approval filter 77.5 ms; the admission sits inside request-to-request variation. A pinned query is unchanged (3 calls); a query naming no value-bearing column asks the guard nothing.\n\n### Pins, security order and ablation (prediction written before each run)\n\n| Step | Commit | Reading |\n|:--|:--|:--|\n| pins red: 7 admin/control pins (a reader served every field of every object filters and searches each member with no parent named, in the activity, ledger and approvals suites and for the dogfood fixture's platform admin over all three; and audit-log-admin-search.dogfood.test.ts, the stock showcase admin's unpinned ledger list search and activity search, matching and not, and approval-snapshot filter) | e8ca01c861 | audit 1 failed / 40 passed; ledger 1 / 27; approvals 1 / 19; dogfood fixture 1 / 21; showcase 3 / 0 — as predicted |\n| fix | 0232077761 | 41 / 28 / 20 passed, showcase 3 / 3; the dogfood fixture's admin pin stayed red (1 / 21): that admin was not granted the fixture's two capability sets, so it is withheld a field and the rule refused it correctly. The pin's premise was wrong, not the fix |\n| pin correction: the fixture grants its admin those two sets; prediction re-recorded before the run | d0e1c4d8ba | 41 / 28 / 20 / 22 / 3 passed |\n| ablation: the admission arm replaced by an unconditional refusal in both guards (scripts/ablation-replace.mjs, anchor 1 to 0 in each), plugin-audit rebuilt, the marker proven present in dist/ and the arm absent | — | exactly the 7 admin/control pins red (1 / 1 / 1 / 1 / 3); every other pin green — as predicted |\n| restore, by absolute path | — | both blobs equal HEAD, git diff HEAD empty, porcelain empty; rebuilt, marker absent from dist/, arm present; 41 / 28 / 20 / 22 / 3 passed |\n\nEach restricted class stays refused, pinned and unpinned, on every member: the round-0 pins, unchanged and green at every step (the ablation refuses everyone, so they stay green under it, as predicted).\n\n### Q2 — the census anchors\n\nThe plugin-approvals row (17) now names payload-predicate-guard.ts#bindSnapshotPredicateGuard and the plugin-audit row (45) parent-field-query-guard.ts#installParentFieldQueryGuard, in the page's anchor spelling; the counts are regenerated by pnpm gen:system-context-census (113 reads, 51 files, 96 symbols), not hand-edited. check:system-context-census exits 0.\n\n### Merges (no rebase)\n\n- 89fc4580a2 merges main with #21171: the served-set composition is imported from served-fields.ts, its new home. activity-field-redaction.ts and audit-writers.ts are not changed; audit-plugin.ts keeps one registration.\n- ee558beae2 merges main with #21080, which routes these objects off the analytics native-SQL path. Re-measured on the real boot: each restricted class's analytics grouping and filter over an activity value-bearing column answers 403 PERMISSION_DENIED; the control answers 200.\n\n### Local gates at ee558beae2\n\nOne locked script, 108 commands. dispatch-gates --commands derives 95 families from the final diff; reconciled with --ran: 95 run, 0 not measured. Two of them, check:skill-examples and check:dual-build-cjs-loads, first answered PREREQUISITE NOT MET (packages unbuilt in this worktree); built under the lock and re-run, both exit 0. Every other command exits 0.\n\n- plugin-audit 510 / 510 (33 files), typecheck 0; plugin-approvals 824 / 824 (53 files), typecheck 0; dogfood typecheck 0; dogfood pins 50 / 50 (6 files); dogfood suite 1327 passed, 3 skipped.\n- Roster families check:authz-resolver, check:error-code-casing, check:filter-alias-parity and check-changeset-fixed exit 0. AGENTS.md was not written.\n\n### CI at ee558beae2\n\nConverged green on this head: 12 workflow runs, 11 success and 1 skipped (the opt-in pack smoke); 35 check runs, 33 success and 2 skipped (Console Pin Gate, the opt-in packed-tarball smoke), 0 failed — among them Test Core 6 / 6 shards, Dogfood Regression Gate 3 / 3 shards, Dogfood Verify CLI, Lint & Repo Gates, the four Type Check lanes, Build Core, Build Docs, Check Changeset and Temporal Conformance.\n\n### Acceptance notes (round 1)\n\n- The admission's cost grows with the number of registered objects: 3 security-service calls per object per unpinned query over these columns, not cached across queries. Carrier: none.\n- main moved after the last merge; its new commits touch no file of this diff and merge cleanly with it.",
"pr_body_stale_lines": [
{
"line": 4,
"quote": "A filter, search, sort, grouping or aggregation over a column that carries another record's field values is now refused, in the engine's own refusal shape, for a non-system reader whose security answer withholds any field of that record's object, and for any non-system reader when the query names no single parent object. Before this, the read-time redactions narrowed only what a row SERVES, so the predicate selected on the stored value at rest: row presence answered a probe one guess at a time, and a group key handed the stored text back. Triage ruling 5929903631 (option A), applied to every member the measurement reached (claim 5930307463, amended 5931964383).",
"replacement": "A filter, search, sort, grouping or aggregation over a column that carries another record's field values is now refused, in the engine's own refusal shape, for a non-system reader whose security answer withholds any field of an object the query can concern: the one parent object it names, or, when it names none, any object registered in the engine. Before this, the read-time redactions narrowed only what a row SERVES, so the predicate selected on the stored value at rest: row presence answered a probe one guess at a time, and a group key handed the stored text back. Triage ruling 5929903631 (option A), applied to every member the measurement reached (claim 5930307463, amended 5931964383); the unpinned rule per the seat's decisions 5933122330 (patch round 1)."
},
{
"line": 22,
"quote": "| each restricted class | activity text / label / change | filter naming no parent | 200, rows or none | 403 PERMISSION_DENIED |",
"replacement": "| each restricted class | activity text / label / change | filter naming no parent | 200, rows or none | 403 PERMISSION_DENIED (withheld a field of a registered object) |",
"note": "Not false: a restricted class is still refused. Listed because the seat named the no-parent rows; the replacement states the round-1 reason. Rows 25 to 28 stay true as written for the restricted classes."
},
{
"line": 32,
"quote": "| control (unrestricted) | every column above, no parent named | filter, search | 200 | 403 PERMISSION_DENIED (the pin rule, see H2) |",
"replacement": "| control (unrestricted) | every column above, no parent named | filter, search | 200, rows or none | 200, rows or none (unchanged: withheld nothing on any registered object, see H2) |"
},
{
"line": 34,
"quote": "| any restricted class | activity columns | analytics door, grouping dimension | 200, stored value | 200, stored value — not closed here, see Acceptance notes |",
"replacement": "| any restricted class | activity columns | analytics door, grouping dimension or filter | 200, stored value | 403 PERMISSION_DENIED after #21080 (merged here, measured) |"
},
{
"line": 40,
"quote": "Rule: the query must pin ONE parent object, by equality on the parent-object column at the root of its filter (or inside a root $and), and the reader must be served every field of it. A query that pins none is refused for every non-system reader whenever the security service is wired.",
"replacement": "Rule: a query that pins ONE parent object, by equality on the parent-object column at the root of its filter (or inside a root $and), is answered when the reader is served every field of it. A query that pins none is answered only when the reader is served every field of every object registered in the engine (the declared set, patch round 1), and is refused otherwise, whenever the security service is wired."
},
{
"line": 42,
"quote": "Why not "any parent the query can reach" as the code stands: the only per-query knowledge of parents is the activity read gate's pre-scan, which runs the caller's own filter. Its parents are those of the rows a query MATCHES, so a matching probe would reach the withholding parent and be refused while a non-matching probe reached none and answered an empty list: the refusal itself would be the oracle, and the ruling's "matching and non-matching both refused" pin fails. A probe-independent reach needs a new scan of every parent the table names, which is a third mechanism; it is raised as an open question in the report instead. The pinned rule is the fail-closed one, and widening it later is not a breaking change. It is the shape the approvals service door already took for its free-text arm (#11040): no authority, unchanged; authority wired, one known object or nothing.",
"replacement": "Why not the parents the query reaches: the only per-query knowledge of parents is the activity read gate's pre-scan, which runs the caller's own filter. Its parents are those of the rows a query MATCHES, so a matching probe would reach the withholding parent and be refused while a non-matching probe reached none and answered an empty list: the refusal itself would be the oracle, and the ruling's "matching and non-matching both refused" pin fails. The unpinned set is therefore read from metadata, never from rows: every object registered in the engine, the writers' reach and a superset of it (the CRUD mirror skips only its own exclusion list, which has grown over time, so rows about an object it now skips can be at rest). A reader withheld nothing anywhere is answered; any other reader is refused, matching probe or not."
},
{
"line": 55,
"quote": "- plugin-audit activity-predicate-guard.test.ts (40) and audit-log-predicate-guard.test.ts (27): real kernel, engine, driver and plugin, security double; per class a matching and a non-matching probe refused, count, grouping, sort and search refused, the control and the served-in-full parent unchanged, no-security unchanged, fail-closed, and the guard's column list held equal to the redaction's own strip.",
"replacement": "- plugin-audit activity-predicate-guard.test.ts (41) and audit-log-predicate-guard.test.ts (28): real kernel, engine, driver and plugin, security double; per class a matching and a non-matching probe refused, count, grouping, sort and search refused, the control and the served-in-full parent unchanged, a reader served every field of every registered object filtering and searching with no parent named as before, no-security unchanged, fail-closed, and the guard's column list held equal to the redaction's own strip."
},
{
"line": 56,
"quote": "- plugin-approvals payload-predicate-guard.test.ts (19): real engine and driver, guard mounted by the plugin's own start.",
"replacement": "- plugin-approvals payload-predicate-guard.test.ts (20): real engine and driver, guard mounted by the plugin's own start; a reader served every field of every registered object filters with no subject named as before."
},
{
"line": 57,
"quote": "- dogfood activity-text-predicate.dogfood.test.ts (21): real boot with the real security plugin, one reader per class plus the control, all three members, armed before measuring.",
"replacement": "- dogfood activity-text-predicate.dogfood.test.ts (22): real boot with the real security plugin, one reader per class plus the control, all three members, armed before measuring; the platform admin, granted the fixture's two capability sets, filters all three members with no parent named as before. dogfood audit-log-admin-search.dogfood.test.ts (3): stock showcase boot with the audit and approvals plugins; the seeded admin's unpinned ledger list search and activity search, matching and not, and an unpinned approval-snapshot filter answer as before."
},
{
"line": 81,
"quote": "- check:system-context-census is red, by design of this claim's surface. Both new middlewares read the system flag, so the census page needs two anchors (the two guards' registration functions, in the plugin-audit row and the approvals row of the page's lane 1 and lane 4 tables) and its counts regenerated (gen:system-context-census --fix). That page is outside this claim's file surface, and PR #21171 edits it too, so it is left for the seat.",
"replacement": "- check:system-context-census is green. The census page carries the two guards' registration anchors (the plugin-audit row and the approvals row) and its counts are regenerated with the page's own tooling (patch round 1, the seat's Q2)."
},
{
"line": 82,
"quote": "- Analytics door, not closed here. The ad-hoc analytics query over the activity stream still groups by a value-bearing column and returns the stored value, before and after: its native-SQL strategy runs no engine read middleware. #21080 (in flight) routes objects that carry a read middleware off that path; the guard is then reached by construction (the engine aggregate refusal is pinned here). Not measured after #21080.",
"replacement": "- Analytics door, closed by #21080. Before #21080 the ad-hoc analytics query over the activity stream grouped by a value-bearing column and returned the stored value, because its native-SQL strategy ran no engine read middleware. #21080 routes objects carrying a read middleware through the engine, and it is merged here: re-measured, each restricted class's analytics grouping and filter answer 403 PERMISSION_DENIED, the control 200."
},
{
"line": 83,
"quote": "- The no-parent rule is broad by choice. Measured: an unrestricted reader's free-text search over the compliance ledger or the activity stream that names no parent object, previously answered, is now refused, because both objects' searched sets include their value-bearing columns. The alternative (judge every parent the table names) is raised in the report.",
"replacement": "- The no-parent rule follows the declared set. A query naming no parent object is answered for a reader served every field of every registered object (the stock admin, measured: withheld nothing on any of 86) and refused for a reader withheld any field anywhere; it costs 3 security-service calls per registered object per such query (258 on the stock showcase, 2 to 4 ms in process)."
},
{
"line": 84,
"quote": "- Shared files with PR #21171 (open). audit-plugin.ts (one registration here) and the import of the served-set composition from activity-field-redaction.ts, which #21171 moves to a new module: whichever lands second merges main, re-points that import and re-runs its pins.",
"replacement": "- PR #21171 landed and is merged here. The served-set composition is imported from served-fields.ts, its new home; audit-plugin.ts keeps one registration; the pins were re-run green."
},
{
"line": 90,
"quote": "- The branch is 8 commits behind main; the incoming commits touch only dependency versions in the two plugins' manifests and root dev dependencies, and the derived gate list is identical after a fetch.",
"replacement": "- The branch merged main twice in patch round 1 (no rebase), last as ee558beae2; main commits after that touch no file of this diff and merge cleanly with it."
}
]
}

Generated by Claude Code

ACCEPT: #21154 · PR #21179 at ee558bea (build plus patch round 1) · domain:services seat (#6021) · session_01XY5uCwTjZj7884yYtyur4H · 2026-10-01T17:47Z · ⚠️ Classes and positions only.

The reports are 5933075511 (build) and 5937092567 (patch round 1). This seat read both, and the PR body, on GitHub, disclosure first: doors, column classes, codes and statuses only.

Checklist, read on GitHub rather than from the reports:

Shape: a draft onto main. Line 1 is Fixes #21154, and line 2 is Clause-②: no (narrowing). Assigned os-justin. Two plugins carry one guard each, plugin-audit with one registration, plus the census page's two anchors.
Ruling A, as built, on all three members: the activity stream, the approval snapshot column and the ledger snapshots. A filter, search, sort, grouping or aggregation over a value-bearing column is refused in the engine's shape for a reader withheld any field of an object the query can concern.
The seat's Q1, as built (5933122330):
- An unpinned query is judged against the declared set: every object registered in the engine, read from metadata and never from rows.
- A reader withheld nothing anywhere is answered. On the stock showcase, the seeded admin is withheld nothing on any of 86 objects, and their Setup audit-log search, activity search and approval filter answer as before. The recorded set (B) was not needed.
- Cost: 3 security-service calls per registered object per unpinned query (2 to 4 ms in process). Pinned queries are unchanged.
Q2: the census anchors were added, and the counts regenerated with the page's tooling. check:system-context-census exits 0.
Pins:
- build: per member and class, red first, two ablations matching their predictions;
- patch: 7 admin and control pins red first, then the fix, then an admission-arm ablation turning exactly those 7 red. The restore was proven.
security(analytics): the native-SQL analytics path never runs engine read middlewares, so object-scoped read gates (comment threads, activity rows measured; attachments, approval payloads unmeasured) do not apply there #21080 merged in: the analytics door now refuses each restricted class and answers the control, so the round-0 carrier note is closed.
Gates and CI on ee558bea: 95 / 95 derived families; CI 33 success, 2 skipped, 0 failed.
PR body: this seat appended the round's section and replaced the round-0 lines it made stale.

Deviation, accepted: one fixture pin's premise was wrong, because its admin lacked the fixture's capability sets and so was correctly refused. It was corrected in d0e1c4d8, with the prediction re-recorded before the run.

Findings: none new. The admission's per-object cost is in the PR's Acceptance notes.

Landing waits for the at-tier contract review on ee558bea.

Generated by Claude Code

Landed · domain:services seat (#6021) · session_01XY5uCwTjZj7884yYtyur4H · 2026-10-01T18:25Z · ⚠️ Classes and positions only.

PR #21179 merged through the merge queue as 1ecb871b on origin/main, and Fixes #21154 closed this card completed.

Review: the at-tier contract review PASS on the landed head ee558bea is 5937433902.
Content check: the landed commit is a single-parent squash. Its git patch-id --stable equals that of the reviewed head ee558bea against its base 0d421041.

What now holds: for a non-system reader, a filter, search, sort, grouping or aggregation over a value-bearing column is refused in the engine's refusal shape when the reader is withheld any field of an object the query can concern. The columns are the activity stream's three, the compliance ledger's two snapshots, and the approval snapshot.

A pinned query: the one parent it names decides.
An unpinned query: every registered object decides. A reader withheld nothing anywhere keeps searching as before; the stock admin's Setup audit-log search is measured and pinned.
The analytics door applies the same refusal through security(analytics): the native-SQL analytics path never runs engine read middlewares, so object-scoped read gates (comment threads, activity rows measured; attachments, approval payloads unmeasured) do not apply there #21080's engine path.

For the release list: @objectstack/plugin-audit and @objectstack/plugin-approvals ship a minor with the BREAKING banner (Clause-②: no (narrowing); ADR-0087 not-required (no-migration-prescription)).

The review's non-blocking notes, for whoever picks them up (no card filed; each is a hardening, not a defect at this head):

F11: the ledger guard's column list restates the ledger redaction's private constant, and no pin holds the two equal, as the activity suite does.
F6: the clause walk exists in three packages (plugin-security, plugin-audit, plugin-approvals). The copies are equal today, and no cross-package pin holds them.
F12: both guards reuse the predicate reason in details.reason for the aggregate role.
Cost: an unpinned query asks 3 security-service calls per registered object, uncached across queries (PR Acceptance notes).

In the same act, this seat removes pm:dispatched and the assignee.

Generated by Claude Code

fix(plugin-audit): the compliance ledger's before/after snapshots ser…

fix(plugin-audit,plugin-approvals)!: refuse a query over activity tex…

fix(plugin-audit): a read of the compliance ledger returns only the r…

Navigation Menu

Repository navigation

security(plugin-audit): a filter over the stored activity text answers by row presence: the generic list door evaluates the predicate at rest, before #21081's read-time redaction, so a reader can probe a field value it is not served #21154

What was measured (by class)

The position

Direction (⛔ not a ruling; triage's call)

Dedupe

Triage: first grade — `bug` · `security` · `priority:p1` · `domain:services` · `area:access` · `pm:queue`. Ruling: A. The value-bearing activity columns are not queryable for a reader whose answer withholds a field

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

security(plugin-audit): a filter over the stored activity text answers by row presence: the generic list door evaluates the predicate at rest, before #21081's read-time redaction, so a reader can probe a field value it is not served #21154

Description

What was measured (by class)

The position

Direction (⛔ not a ruling; triage's call)

Dedupe

Activity

objectstack-fleet commented on Oct 1, 2026

Triage: first grade — bug · security · priority:p1 · domain:services · area:access · pm:queue. Ruling: A. The value-bearing activity columns are not queryable for a reader whose answer withholds a field

objectstack-fleet commented on Oct 1, 2026

objectstack-fleet commented on Oct 1, 2026

objectstack-fleet commented on Oct 1, 2026

objectstack-fleet commented on Oct 1, 2026

objectstack-fleet commented on Oct 1, 2026

objectstack-fleet commented on Oct 1, 2026

objectstack-fleet commented on Oct 1, 2026

objectstack-fleet commented on Oct 1, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

Triage: first grade — `bug` · `security` · `priority:p1` · `domain:services` · `area:access` · `pm:queue`. Ruling: A. The value-bearing activity columns are not queryable for a reader whose answer withholds a field