Repository navigation
plugin-security: a controlled_by_parent child's read loads every readable master id with no limit (twice per request), so its CPU grows with the master table and the read answers 500 "too many SQL variables" past ~32.8k masters #24932
Description
Ruled: 6342223675 · letter fork 1 A / fork 2 A · Tier H approval in words · 2026-10-22T13:43Z
Ruled: 6329027469 · letter Q1 C / Q2 A · 2026-10-21T23:44Z
Ruled: 6303721609 · letter B · 2026-10-20T23:08Z
Filing gate ①: class (a), measured. A public door answers 500 and its cost grows unbounded with data. Filed by repo:cloud#1 (seat post #6026, session session_01FSg7JRUiTPo8GrgT38tAWP) from the cloud#3053 round 4 dev report (objectstack-ai/cloud#3053, comment 6295337145). ⛔ Not a claim.
Reader who acts: triage grades and routes it (expected domain:services, plugin-security); the lane's execution seat fixes it. Cloud consumes the fix at its next framework pin move.
Dedupe: objectstack issues of both states (444 read) grepped for controlled_by_parent, computeControlledByParent, too many SQL variables, master ids and master-detail … $in. 1 hit: #24291 (closed, a spec docblock about forceCbpMasterDetailRequired, a different subject). No duplicate.
Where (read at objectstack main 74fcec1e; same code at 9d13b5fc)
packages/plugins/plugin-security/src/security-plugin.ts, computeControlledByParentFilter (:8535; the scan at :8615-8626):
const rows = await this.ql.find(rel.master, {
where: masterFilter ?? {},
fields: ['id'],
context: { isSystem: true },
});
masterIds = rows.map((r) => r?.id).filter(…);
return { [rel.fk]: { $in: masterIds } };There is no limit. When the caller's master scope is unrestricted, masterFilter is null and the scan is the whole master table. The statement log shows select id from MASTER, unbounded, twice per request (once for find, once for count).
Measured (local hosted-shaped rig, cloud main b4a6a777 = framework 9d13b5fc, HotCRM 5.0.0; crm_contact and crm_quote are controlled_by_parent of crm_account; environment owner)
crm_account rows |
GET /api/v1/data/crm_contact?top=1, main-thread CPU |
answer |
|---|---|---|
| 9 | ~8 ms | 200 |
| 1,009 | 12 ms | 200 |
| 10,009 | 45 ms | 200 |
| 40,009 / 50,009 | — | 500 DATABASE_ERROR (too many SQL variables, sql-driver log) |
crm_account's own read stays at 5–6 ms throughout. Staging's Turso remote was not measured.
Wanted
- Push the master scope into the child query as a subquery or semi-join, instead of materialising an id list. When the caller's master scope is unrestricted, short-circuit to no predicate.
- Pin it with a statements-per-request test on a
controlled_by_parentchild, and with a test past the dialect's variable limit (the read answers 200 with the right rows).
Acceptance
- A CBP child read answers 200 with the rows the master scope allows, at a master count past the dialect's variable limit.
- Its statement count and CPU do not grow with the master table when the master scope is unrestricted.
Blocking (director seat, ruling Q1 C 6329027469; the two engine cards #25009 and #25010 the earlier lines named closed completed, so those lines left the body)
The plugin-security switch to the ADR-0139 leaf is dispatched after #25144 (the boot-time refusal of a controlled_by_parent master on another datasource or behind an object-scoped read middleware) has merged. Q2 A (service-analytics) rides the switch PR. The empty branch claude/issue-24932-cbp-master-scope is not reused; claude/issue-24932-cbp-leaf-switch is empty at f2b6cf230.
Activity
objectstack-fleet commentedon Oct 20, 2026
Claim: PM loop round 3 · 2026-10-20T18:22Z
Session:
session_01UmqzD97e14iws6hmVhgZ5yAccount:
os-support-ai(the seat's linked user asGET /useranswers it; always the card's assignee)Branch:
claude/issue-24932-cbp-master-scopeWorktree:
objectstack-issue-24932Domain:
domain:servicesSeat:
domain:services#2(seat post #21118)File surface:
packages/plugins/plugin-security/src/security-plugin.ts(computeControlledByParentFilterand its two call sites' per-request reuse only), pins beside it inplugin-security, one new.changeset/24932-*.md. ⛔ Notpackages/objectql/**, ⛔ notpackages/drivers/**, ⛔ notpackages/spec/**: if the semi-join needs an engine or driver change, stop and report the design fordomain:engine. Stop on breach and explain in the report.Container & model:
M,mode:subagent,model: opus(TIER_DEFAULT;dispatch-gates --tieron this surface: no path-derived mandate, floor sonnet, default opus, ceiling fable)Clause-②: no
Responsibility:
plugin-security materialises every readable master id into an $in list, with no limit, twice per request | none in the filter path today, to be measured: a semi-join spelling the engine already supports | every reader of a controlled_by_parent child; measured at a public door on a hosted-shaped rig, 500 past ~32.8k masters (card)Thread-read: none
Serial constraints cleared: no open PR touches
plugin-security/src/security-plugin.ts(all open PRs' files read this act). This seat's #24865 (PR #24930, in the merge queue) touchesservice-messagingandplugin-authonly.⛔ The visible rows must not change: a child whose foreign key is null or dangling stays outside the read as it is today. A short-circuit that drops the predicate would widen what is visible, which is a security-boundary relaxation and outside this card.
Generated by Claude Code
objectstack-fleet commentedon Oct 20, 2026
os-dev-report
{ "issue": 24932, "status": "needs_decision", "branch": "claude/issue-24932-cbp-master-scope", "pr": null, "session": "session_01UmqzD97e14iws6hmVhgZ5y — the dispatching PM's session (mode:subagent shares it)", "premise_still_valid": true, "summary": "M1 holds on origin/main 223ae939b (unchanged on the measured files through 8cfe1f94c). computeControlledByParentFilter (security-plugin.ts:8535, scan :8613-8626) scans the master with no limit under a system context and returns fk $in ids. It runs once per engine operation, so a findData list request (find, then count, protocol.ts:15134) scans twice. Measured on the real stack (ObjectQL + SqlDriver, better-sqlite3): find+count on a controlled_by_parent child = 4 statements, 2 of them `select id from MASTER`; a 2-level chain = 8 statements; with 33,000 masters both find and count answer 500 DATABASE_ERROR `too many SQL variables` (better-sqlite3 limit measured: 32,766 binds pass, 32,767 fail). M2: exactly one semi-join spelling exists, the ADR-0139 ReadableIds leaf (engine.ts:6120 composeReadableIdsAtBoundary, driver-sql compiles `fk in (select id from MASTER)`), and it does NOT keep the visible rows. Experiment (uncommitted; ablation-replace, blob == HEAD restored and git diff HEAD empty after each run): the leaf gives 1 statement per find, 2 per find+count, and 200 with the right rows past 33k masters. It matches today's rows for restricted, unrestricted, null-FK and dangling-FK children. It differs in 3 measured cases: (1) on-behalf-of read: today c1, leaf 500 INTERNAL_ERROR (engine.ts:6185 refuses a delegated caller, ADR-0139 D5.1); the delegator half cannot be spelled at all, because the engine composes for the outer caller only. (2) A caller holding child read but no object-level read on the master: today every child under an existing master (c1,c2), leaf none (canReadObject gate, engine.ts:6237). (3) A 2-level chain: the leaf nested in the master's scope reaches the driver uncomposed, so 500 INTERNAL_ERROR from driver-sql. From source only: a federated master (engine.ts:6202) and a master narrowed by an object-scoped middleware (engine.ts:6196) are refused 500. getReadFilter (:5943) hands its scope to the analytics raw-SQL door, which refuses the leaf as a non-list comparand. Plugin-security cannot hand the engine its own composed scope either: the boundary refuses a forged composed leaf (filter-comparand-shape.ts:196). ADR-0139 D6 and O5 leave open whether controlled_by_parent becomes its seventh consumer, and ADR-0055 §2 mechanism (b) stands, so switching it is a decision (Prime Directive #13), not a card edit. The interim the PM asked about (one scan per request instead of two) is not sound inside the landing. find and count share only the caller's context object (engine.ts:3722 returns it by reference). That object is not request-bounded for non-REST callers that reuse it across writes, so a memo keyed on it would serve a stale master set, wider or narrower. The one sound precedent (packages/core/src/security/request-grants-memo.ts) needs a scope opened by the request owner plus an engine write observer, and its scope closes before the handler runs. It also leaves the 500 and the unbounded scan in place. Not shipped. The card's Wanted #1 short-circuit was measured as the forbidden widening: with the predicate dropped on an unrestricted scope, c_null and c_dangling become visible. No code, no PR.", "tests": "Measurement only, nothing committed. Harness (removed from the worktree, copy kept): /tmp/claude-0/-home-user/baba1a33-5813-5ac5-906a-64b704dc6695/scratchpad/issue-24932/measure-harness.test.ts.txt. Raw outputs are in the same directory: measure-main3.txt (today), measure-leaf.txt and measure-leaf2.txt (leaf), measure-shortcircuit.txt. Command: `bash scripts/pm/os-verify-lock.sh -c 'pnpm --filter @objectstack/plugin-security exec vitest run --maxWorkers=2 src/zz-measure-24932.test.ts'`, every run `VERDICT command-exit 0`, `Tests 3 passed (3)`. TODAY: viewAll c1,c2 · owner c1 · childOnly c1,c2 (direct master read: PERMISSION_DENIED 403) · agentForU1 c1 · chain l1 · `STATEMENTS find 2 find+count 4` (select id from msr_account twice) · `CHAIN STATEMENTS find+count 8` · BIG (33,000 masters): find and count both `THROW DATABASE_ERROR 500 … too many SQL variables`. LEAF: viewAll c1,c2 · owner c1 · childOnly empty · agentForU1 `THROW INTERNAL_ERROR 500 … the engine composes no such leaf for a delegated (on-behalf-of) caller` · chain `THROW INTERNAL_ERROR 500 [driver-sql] … ReadableIds leaf … UNCOMPOSED` · `STATEMENTS find 1 find+count 2` (`account in (select id from msr_account)`) · BIG find bc1,bc2, count 2. SHORT-CIRCUIT: viewAll c1,c2,c_dangling,c_null · childOnly c1,c2,c_dangling,c_null. Mutation and restore lines, each run: `ablation-replace: ok mutation landed: anchor 1 -> 0` then `ok restored: blob == HEAD (25d6a049dc7b) and git diff HEAD is empty`. The first leaf attempt was refused by the tool because the anchor was contained in the replacement (no mutation was measured), then corrected. NOT MEASURED: tenancy-enabled master (the subquery's driver tenant wall vs Layer 0 inside today's scan); a federated master; a master narrowed by an object middleware; Postgres/MySQL/Turso.", "gates": "No diff, so no gate families. `node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack` in the worktree answers exit 2: `this branch changes nothing against 'origin/main' (merge base 223ae939b) — nothing to derive`. Typecheck and dispatch-gates --ran: not applicable (no commit). Built locally: `pnpm --workspace-concurrency=2 --filter '@objectstack/plugin-security^...' build`, VERDICT command-exit 0. No PR, so no check-runs.", "mcp_calls": "0", "api_writes": "1 — POST /repos/objectstack-ai/objectstack/issues/24932/comments (this report, via scripts/pm/post-stamped.mjs). Also `git push -u origin claude/issue-24932-cbp-master-scope`: the empty-branch write probe, branch head = 223ae939b, not a REST write. pr_create not used.", "line_budget": "n/a — no file changed", "deviations": [ "No PR and no code: needs_decision under the dispatch's M2 rule (no spelling inside plugin-security keeps the rows; ADR-0139 O5 is undecided). The remote branch claude/issue-24932-cbp-master-scope stays empty at 223ae939b.", "Measurement harness written into the worktree (packages/plugins/plugin-security/src/zz-measure-24932.test.ts), never committed, deleted before cleanup; copy in the scratchpad.", "Four experimental mutations of security-plugin.ts through scripts/ablation-replace.mjs: 1 refused by the tool, 3 measured. Each was restored, blob == HEAD 25d6a049dc7b, git diff HEAD empty." ], "files_changed": [], "open_questions": [ { "question": "How should a controlled_by_parent child's read scope stop materialising the master id list (ADR-0139 O5: is controlled_by_parent its seventh consumer), given that the only engine semi-join today, the ReadableIds leaf, changes visible rows in 3 measured cases (delegated caller → 500, no object-level read on the master → no rows, 2-level chain → 500)?", "options": [ "A — O5 = yes, caller half only, chosen up front. Single-level masters, non-delegated callers, same datasource, no object middleware: the caller half writes ReadableIds.of(master). Every other shape keeps today's id list: delegated (both halves), chained, federated or middleware-narrowed master, and the getReadFilter/analytics path. Precondition: the no-master-object-read case must first be ruled and given one answer on the id list, or the switch narrows it. Effort: 1 plugin-security PR (~200-300 lines with real-stack pins) plus a one-line ADR-0139 O5 / ADR-0055 status pointer (Tier H). Business need: fixes the measured HotCRM crm_contact/crm_quote → crm_account case (500 → 200, 4 → 2 statements per list). Leaves HotCRM quote lines (2-level chain) and agent reads at the ceiling. Long-term: one accepted mechanism, but two live spellings of one scope (leaf and id list), the drift getReadFilter's shared helper exists to prevent. AI-safety: neutral, nothing authorable. Startup scope: smallest change that serves the measured case, no new engine form.", "B — engine first, then a wholesale switch (domain:engine, ADR-0139 amendment, Tier H). (i) A delegated read composes the leaf with the D10 intersection; this is D5.1's own exit condition, threading the delegator into getReadFilter. (ii) A leaf nested inside a composed scope is composed; measured: driver-sql refuses it today. Then plugin-security moves the caller half, the delegator half and getReadFilter in one PR. Federated and middleware-narrowed masters still need a ruling (keep the list or refuse loudly). Effort: 2-3 engine PRs plus 1 plugin-security PR. Business need: covers chains and agent reads too. Long-term: one mechanism, no fallback; best end state. AI-safety: neutral. Startup scope: largest; widens ADR-0139 beyond what its six consumers needed.", "C — stay on ADR-0055 (b) and make the ceiling honest, in this lane: past a bound below the dialect limit, refuse with a located error (the RELATION_FILTER_ID_CAP posture, ADR-0139 letter C) instead of an unattributed 500 DATABASE_ERROR. Effort: small. Business need: serves no rows past the bound, so the card's acceptance is unmet. Long-term: a patch; ADR-0139 already ruled cap moves out for its consumers. AI-safety: a loud refusal beats a 500. Startup scope: smallest, but it does not deliver the card.", "D — the driver binds a large $in as one parameter (json_each / = ANY). Not recommended: ADR-0139 ruled out the unbounded $in (its alternative B), and the scan's CPU still grows with the master table, the card's other measured axis." ], "recommendation": "A now, with B filed as the domain:engine follow-up that retires A's fallback. Business need: A clears the measured HotCRM 500 with one plugin-security PR, and the chain and agent shapes keep exactly today's answer, with no regression. Long-term: B is the end state, and A's fallback is chosen up front in ADR-0139 D5 style, never reached by catching a refusal, so it retires cleanly once B lands. AI-safety: both are non-authorable, a wash. Startup scope: A adds no engine form; B is written only because chains (quote lines) are a measured business shape. Two rulings are needed before A: O5 = yes, and the master object-read question below. Without them, A violates this card's binding row constraint in the no-master-read case." }, { "question": "Today a caller with read on a controlled_by_parent child but NO object-level read on its master gets every child row whose master exists (measured: direct master read 403, child read c1,c2). ADR-0055 §3 says 'Reading a detail requires read access to its master (§2)' and §4 says 'a member who cannot read master M can neither read nor by-id-write a detail D under M'. The ADR-0139 leaf answers no rows here (canReadObject). Which answer is the contract?", "options": [ "A — the ADR-0055 §4 reading: no master object read, no detail rows. Fix it on the id-list path first, in its own card (plugin-security: the master's object-level read admission before the scan), so a later leaf switch keeps rows by construction. Effort: small. Business need: none measured relying on today's answer (not searched in HotCRM). Long-term: one answer on both spellings. AI-safety: declared equals enforced. Startup scope: a narrowing fix, nothing new.", "B — keep today's answer (the child's object grant plus the master's row scope decide) and record it as the rule. Then the leaf can never be a drop-in for controlled_by_parent without an engine opt-out of canReadObject. That is a second engine path. Effort: an ADR-0055 clarification plus engine work. Long-term: the ADR text and runtime stay apart until edited." ], "recommendation": "A, because ADR-0055's own §3/§4 text already states it (spec declaration over implementation), and it turns option A of the first question into a row-preserving switch. It needs the maintainer's word because it narrows what some callers see today." } ], "out_of_scope_findings": [ "class: b · reach: exception: security (may leak data); measured on the real stack at engine.find with a member context (the call GET /api/v1/data/OBJECT makes), not over HTTP · evidence: a caller holding read on controlled_by_parent msr_contact and no object-level read on its private master msr_account gets PERMISSION_DENIED 403 reading the master directly, yet reads c1,c2, every child whose master exists. Contract: ADR-0055 §4 'a member who cannot read master M can neither read nor by-id-write a detail D under M'. Seam: spec:`sharingModel: 'controlled_by_parent'` → runtime:`security-plugin.ts#computeControlledByParentFilter` (no master object admission before the system scan) · dedupe words: controlled_by_parent master object read, detail visible without master grant, canReadObject master, ADR-0055 §4", "carrier: #24932 (this card's decision) · noted, not filed · ADR-0139 consumers whose parent object is controlled_by_parent (attachments, comments, activity on a CBP child) compose their subquery scope from getReadFilter(child), which still carries the unbounded master id list. Same ceiling, same family. Source reading, not measured.", "carrier: #24932 (this card's decision) · noted, not filed · ADR-0055 Consequences says 'One extra master-id query per controlled_by_parent object per request (cached within the request)'. Measured: no request cache, the master scan runs once per engine operation (find + count = 2). Declared text over a governed record; correct it in the same Tier H edit that answers O5." ] }Generated by Claude Code
objectstack-fleet commentedon Oct 20, 2026
[Decision] 主从(controlled_by_parent)子对象读取:是否改用 ADR-0139 的半连接叶子(O5),以及顺序
domain:servicesseat 2 (seat post #21118) ·os-support-ai·session_01UmqzD97e14iws6hmVhgZ5y· 2026-10-20T18:50Z。依据:本卡开发报告6298477402(只测量、未提交代码;origin/main223ae939b,在真实 ObjectQL + SqlDriver 上实测)。Release:
session_01UmqzD97e14iws6hmVhgZ5y· 因:唯一能消除 ID 列表的引擎形式会改变可见行;是否让 controlled_by_parent 成为 ADR-0139 的第七个消费者是该 ADR 明文留给你的开放问题(O5)· 去向:needs-user-decision,本笔清 assignee。开发分支claude/issue-24932-cbp-master-scope为空(未提交任何代码)。一句话问题: 子对象(如 HotCRM 的联系人、报价)每次列表读取都把「当前用户能看的全部主记录 ID」查出来拼成
IN (...),一次请求查两遍,没有上限。主表到约 3.3 万行时直接 500。引擎里唯一能改成子查询的现成写法,又会在三种情况下改变用户看到的行。背景(实测)
select id from 主表;两级主从链是 8 条;3.3 万主记录时查询和计数都返回 500too many SQL variables(SQLite 上限实测为 32,766)。Governing text
前提(复核命令)
git grep -n "computeControlledByParentFilter" origin/main -- packages/plugins/plugin-security/src/security-plugin.ts,其定义体内对主对象的find无limit。git grep -n "O5" origin/main -- docs/adr/0139-engine-internal-semi-join-leaf-readable-parent-ids.md(应命中开放问题一行)。选项
getReadFilter一次切完IN绑成一个参数json_each/= ANYIN业务含义直译: A =「先修最常见的单层主从,复杂形状照旧」;B =「先把引擎补全,再一次性全部换掉」;C =「坏了的时候说清楚为什么坏」;D =「把长名单塞进一个信封里递过去,名单本身还是要先抄一遍」。
推荐:B(终态一次付清),#24962 先行
getReadFilter共享这套逻辑,正是为了防止这种漂移。os-decision-facets
Prior rulings read: controlled_by_parent,readableids,semi-join,rlsmembership → 13 hits; ADR-0055 Decision §2, ADR-0139 D6, ADR-0055 Decision §1, ADR-0055 Decision §3, ADR-0055 Decision §4, ADR-0056 D1, ADR-0056 D3, ADR-0057 D3, ADR-0058 D2, ADR-0090 D4; thread: none; repo: objectstack-ai/objectstack
(Cross-checked by
git grep -l -iE "controlled_by_parent|ReadableIds|semi-join" origin/main -- AGENTS.md docs/adr: 6 ADR files (0055, 0056, 0090, 0111, 0138, 0139), AGENTS.md 0. ADR-0055 §2 chose mechanism (b), and ADR-0139 D6 explicitly leaves O5 undecided, so the switch is a decision, not execution.)裁后执行
pm:blocked等这两张卡,之后派发 plugin-security 整体切换。plugin-security: a controlled_by_parent detail is readable by a caller with no read on its master object, where ADR-0055 refuses it (detail withheld under the disclosure ruling) #24962 照常走安全通道,优先。Generated by Claude Code
34 remaining items
objectstack-fleet commentedon Oct 22, 2026
[Decision] 主从读取切换(PR #25198)入队前的两处实测分叉,以及 Tier H 的批准
domain:servicesseat 2 (seat post #21118) ·os-bill·session_01UnHcTADjeg3VwxF21QHj7W· 2026-10-22T12:22Z · Thread-read: 6340537042Ruling-ref: 6329027469 (Q1 C / Q2 A stands; only the two forks the build measured are put here)
一句话问题: 按裁决 Q1 C / Q2 A 做的切换已建成。PR #25198 全绿,完整 dogfood 通过,PostgreSQL 实测通过。派发令要求「实测到的行集变化是分叉,要上报不吸收」,开发据此上报了两处。PR 改了 ADR-0055 和 ADR-0139(Tier H),本来就要你批准才能合并,所以三件一次请示:分叉 1、分叉 2、合并批准。
背景(开发报告
6340537042;席位已复核 CI 与正文)35c4c3951上 35 项通过、7 项跳过。getReadFilter(master)的 ADR-0090 D10 写法(plugin-security: the raw-SQL read-scope provider (getReadFilter) does not apply the delegated organization-membership rule PR #25101 enforces at the operation prologue; measure reach first (detail withheld) #25106 落地的那一版):代理一侧取「声明深度」,未声明时为 'org'。实测两处变化:explain-enforce-parity中「代理代组织写者、更新他人主记录下的子记录」一行,由 404 变为 403;line_us变为line_us, line_jp,多读到一行。p_theirs更新答 403,说明可读不可写)。所以子对象现在恰好读到「代理直接读主对象能读到的行」,没有读到主对象上读不到的行。这正是 ADR-0139 D5.1(修订后)和 ADR-0055 §2 写明的等式。crm_contact计数 32.7 → 50.5 ms(1.54),crm_quote计数 33.9 → 54.4 ms(1.60),都是私有主对象crm_account的一跳子对象,绝对多 18–20 ms,在共享机器本身的抖动范围内。对照格显示,这点开销来自引擎路径在 PG COUNT 上的路由,叶子反而收回了大半。Governing text
ADR-0139 D5.1 as amended (a delegated read through the leaf serves exactly the rows a delegated direct read of the parent serves); ADR-0055 §1/§2 (the detail's visibility derives from the master's); ruling B
6303721609③ (no two spellings of one scope); ruling Q1 C / Q2 A6329027469(its measurement conditions: "a material regression is a fork to report, not to absorb").是否改协议: 否。不碰 spec 契约;spec 里只改一句 docblock 和一行一致性夹具(已在 #6017 声明)。
分叉 1 选项
getReadFilter对叶子和直接读给出两种写法(裁决 B ③ 已拒),要么在叶子旁另留一条推导路径(即已退役的预扫描);#25032 的代理组合钉子会转红分叉 2 选项
四轴(业务立场)
推荐:分叉 1 A、分叉 2 A,并批准 PR #25198 的 Tier H 合并
裁后执行段
CONTRACT_REVIEW_TIER隔离评审(安全读范围切换),通过后验收。本席按维护者的话收班(「当前任务处理完,合并后就下班」)。本卡与 PR #25198 交给下一位持本车道的席位,恢复点写在座位贴 #21118。
os-decision-facets
Prior rulings read: controlled_by_parent, ReadableIds, delegated read, D10 → ruling B
6303721609, ruling Q1 C / Q2 A6329027469, plugin-security: the raw-SQL read-scope provider (getReadFilter) does not apply the delegated organization-membership rule PR #25101 enforces at the operation prologue; measure reach first (detail withheld) #25106 (PR fix(plugin-security)!: the raw-SQL read scope (getReadFilter) answers the deny sentinel where the delegated prologue refuses #25150); thread: the dev report6340537042Related: PR #25198; claim
6334261853; cross-lane declarations6334266488(#6367) and6334275915(#6017).Generated by Claude Code
hotlong commentedon Oct 22, 2026
Ruling: batch #386 item 1 · letter fork 1 A / fork 2 A · Tier H approval granted in words · maintainer 「批 #386 五张全部按推荐：24932 分叉 1 A / 分叉 2 A，3134 A，3128 A，3138 A，3149 立 1 2 5 且第 1 项加 external 角色」 2026-10-22T13:41Z
Director seat, summon #48 (harness session
4890061b-3c11-4cab-8152-255c65343269, accounthotlong, written direct; ledger #12708 comment 6341703794), on the services seat's decision request6340537042's successor comment (thread read through the seat's request of 2026-10-22). Before presenting, this seat re-read PR #25198 on the board: 23 checks, none red (Lint 8, Test Core 7, Type Check 4, Dogfood Regression 2, 2 others), 29 files, draft, no review; the two ADR edits are +23 / −1 and the one replaced line in ADR-0139 keeps the original sentence and adds a dated parenthetical (the amendment rule holds: no rewrite, a dated note).What the ruling binds
controlled_by_parentdetail's delegated read serves exactly the rows a delegated direct read of its master serves — one scope, one spelling (ruling B6303721609③; ADR-0139 D5.1 as amended; ADR-0055 §2). The two pins already changed in the PR (theexplain-enforce-parityrow 404 → 403; the two-person delegated chain rowline_us→line_us, line_jp) stand with their stated reason. Not taken: B (a second derivation beside the leaf, the pre-scan this card retires; feat(objectql, plugin-security): the ReadableIds leaf composes for a delegated (on-behalf-of) caller with the delegator intersection; ADR-0139 records O5 answered and D5.1 amended #25032's pin would redden).hotlong/os-zhuang, both inGOVERNED_APPROVERS), never the seat's. Order unchanged from the seat's execution line: the lane seat runs the isolatedCONTRACT_REVIEW_TIERreview (a security read-scope switch); on PASS, with the maintainer's APPROVED review on the final head, the seat readies the PR and arms auto-merge through the relay; after landing, the cloud seat reads the two-level master-detail chain on staging at its next pin move (measurement condition 4). Deviation 3 (the two security(data): a predicate-scoped update or delete is refused when its predicate matches only rows the caller cannot read, and succeeds with zero rows when it matches nothing: an existence signal the read door withholds #21829 write shapes carrying only the RLS write filter) is accepted as named in the PR.Workload of the letters: none beyond the PR (fork 1 A and fork 2 A are the PR as built); the review is the lane's standing cost.
Execution:
needs-user-decision→pm:queuein this act; the nextdomain:servicesseat claims the card and the PR (recovery point on seat post #21118), runs the review, then the landing.Blocked-by: #25144in the body is spent (PR #25166 landed before the build); the claiming seat clears the line when it refreshes the body.os-decision-facets
objectstack-fleet commentedon Oct 22, 2026
Claim: stay-behind after sign-off · 2026-10-22T14:21Z · p1,
domain:services,area:access· PR #25198 to its landing, on ruling6342223675(fork 1 A / fork 2 A, Tier H approval granted in words)Session:
session_01UnHcTADjeg3VwxF21QHj7W(the seat session that dispatched the build and signed off at6340685792; it stays behind on this one card by the maintainer's word in this session's chat, verbatim: 「25198 已裁决，你要跟踪到合并啊」)Account:
os-bill(the seat's linked user asGET /useranswers it; always the card's assignee)Branch:
claude/issue-24932-cbp-leaf-switchWorktree:
objectstack-issue-24932(removed by the dev; no new build is planned)Domain:
domain:servicesSeat:
domain:services#2(seat post #21118, vacant; this claim is the stay-behind declared on its body)File surface: PR #25198 as built, 29 files at
35c4c3951. No new edit is planned. If the review or CI finds one, it is named here before any push.Container & model:
S,mode:subagent,model: fable(reason: ruling6342223675orders an isolatedCONTRACT_REVIEW_TIERreview of this security read-scope switch; the review only, no build)Clause-②: no
Ruling-ref: 6342223675
Resume-from:
claude/issue-24932-cbp-leaf-switch@35c4c3951Responsibility:
plugin-security's computeControlledByParentFilter materialised the master id list unbounded (500 past the bind limit); PR #25198 switches it to the engine's ADR-0139 leaf | ruling B 6303721609, ruling Q1 C / Q2 A 6329027469, and this ruling 6342223675 (fork 1 A, fork 2 A, Tier H granted in words) | every reader of a controlled_by_parent child; HotCRM's eightThread-read: 6342223675
Serial constraints cleared:
domain:engine's #25062 (6339470244) touchessecurity-plugin.tsstep 3.7 (the write wall), a different region. Whichever lands second mergesmain.Order, per the ruling:
CONTRACT_REVIEW_TIERon the final head.The spent
Blocked-by: #25144line leaves the card body in this act.Generated by Claude Code
objectstack-fleet commentedon Oct 22, 2026
Landed ·
domain:servicesseat 2, stay-behind ·session_01UnHcTADjeg3VwxF21QHj7W· 2026-10-22T17:04Z0b8bce40e0, on the maintainer's APPROVED review on head35c4c3951(Tier H, ruling6342223675)completedbyFixesState:
pm:dispatchedis removed and the claim is released in this act.What changed:
controlled_by_parentread now answers the engine's ADR-0139 leaf: one statement, no master scan, 200 past the bind limit.service-analyticsroutes a leaf-carrying scope to the engine face.The first queue entry was ejected by a failed board read in the issue-citation gate (
6345840031). It was re-queued once and landed.Owed after landing:
Generated by Claude Code