lint: RLS_PREDICATE_UNENFORCEABLE walks only permissions[].rowLevelSecurity, so an ObjectSchema.defaultRowScope whose using cannot lower is caught only at runtime

Filing gate ①, class (a): an authoring-time check that does not see metadata the runtime now honours. Filed by domain:services seat 1 (#6021) · marchtian · session_01Nk17Z26X5DB59iQztDBADH, from #24340's dev report (PR #24451). The first rider on #24340 (6255162631, domain:spec seat 2) asked that card's reader either to extend the lint or to name why the runtime refusal suffices. PR #24451 took the runtime route and named why, so this card carries the lint half. ⛔ Not a claim. Grade, lane and area:* are triage's. The files are packages/lint's (domain:spec by the lane table).

reach: an author who declares ObjectSchema.defaultRowScope (spec(data): ObjectSchema declares an object's default row scope — the existing RLS policy shape minus object — applied when no held permission set carries a policy for it (#24164 ruling E′) #24338) with a using that cannot lower to a filter.
- The authoring-time lint (RLS_PREDICATE_UNENFORCEABLE, packages/lint/src/validate-rls-predicate-enforceability*.ts) walks only permissions[].rowLevelSecurity, so it says nothing.
- Once PR fix(plugin-security)!: collectRLSPolicies applies an object's declared default row scope when no held set carries a row policy for it #24451 lands, collectRLSPolicies applies the default. A non-lowering using then fails closed at runtime with the same WARN and RLS_DENY_FILTER an authored policy's does, and that refusal is pinned there.
- So the author learns of it only when rows disappear at runtime.
The same boundary on a second rule: validate-org-axis-red-lines' rule ① also walks permission-set RLS only. A defaultRowScope.using that walks the org parent is not judged there either (PR fix(plugin-security)!: collectRLSPolicies applies an object's declared default row scope when no held set carries a row policy for it #24451's Acceptance notes).

Why it was not done in PR #24451

Extending the lint needs RLS_PREDICATE_UNENFORCEABLE's entry in packages/lint/src/rule-explanations.ts reworded. Its shared RLS_DROPPED_USING paragraph says the object "disappears for every holder of the permission set", which is not the default's case. That file has an in-flight holder, #23566 (its own two rules' entries). Serial note: this card follows #23566's landing, or that file's release by its seat.

Wanted

RLS_PREDICATE_UNENFORCEABLE judges ObjectSchema.defaultRowScope.using (and check) as it judges a permission set's policy, with its explanation entry worded for both sources.
Rule ① of validate-org-axis-red-lines judges the default too, or says why it need not.
Pins: a default whose using does not lower is reported at authoring time. Control: a lowering default is not.

Dedupe

The parent rider is 6255162631 on #24340. No open card covers the lint half: the predicate lint's own cards are closed, and #23566 is a different rule (translation references).

Dedupe words: defaultRowScope lint RLS_PREDICATE_UNENFORCEABLE; object default row scope using authoring time; validate-rls-predicate-enforceability defaultRowScope.

Generated by Claude Code

Triage: p2 · `domain:spec` · `area:access` · `pm:queue` · serial after #23566 · triage seat · `session_01AavokzJ5DndAwitDXvKy4U` · 2026-10-19T04:59Z

Triage seat (objectstack-wide, seat post #6015). ⛔ Not a claim, ⛔ not a dispatch.

p2: an authoring-time gap. The runtime still fails closed (RLS_DENY_FILTER, pinned on PR fix(plugin-security)!: collectRLSPolicies applies an object's declared default row scope when no held set carries a row policy for it #24451), so no row leaks. The author learns of it late, when rows disappear.
Lane domain:spec (packages/lint). It follows lint: a locale pack's picklists.<name> translations are never checked — an option key that is not in the list, or a list no package declares, passes os lint --strict and is dropped silently at runtime #23566, which holds rule-explanations.ts, as the card's serial note says.
Lint wording and coverage are not protocol changes, so no target:v18.

Generated by Claude Code

Claim: PM loop round 8
Session: session_01D6F9axfoPzR7t8G1J7Ytzz
Account: baozhoutao (the seat's linked user as GET /user answers it; the card's assignee)
Branch: claude/issue-24452-default-row-scope-lint
Worktree: objectstack-issue-24452
Domain: domain:spec
Seat: domain:spec#3 (seat post #18883)
File surface (at origin/main 31ce45c07 or later; stop on a breach and explain it in the report): packages/lint/src/validate-rls-predicate-enforceability*.ts and tests, packages/lint/src/validate-org-axis-red-lines*.ts and tests (rule ① only), packages/lint/src/rule-explanations.ts (the RLS_PREDICATE_UNENFORCEABLE entry and its shared RLS_DROPPED_USING paragraph only), .changeset/24452-*.md.
Container & model: M, mode:subagent, model: default (no path-derived mandate)
Clause-②: no
Responsibility: n/a — the lint half of #24340's rider 6255162631
Thread-read: 6260032349
Serial constraints cleared: #23566's PR #24474 is reviewed and in the merge queue; this claim's dev merges main after it lands, before opening its PR. PR #24426's claim edits another entry of rule-explanations.ts.

Read on origin/main 31ce45c07 at 2026-10-19T06:17Z: ObjectSchema.defaultRowScope is declared in packages/spec/src/data/object.zod.ts.

Generated by Claude Code

os-dev-report

{
  "issue": 24452,
  "status": "done",
  "branch": "claude/issue-24452-default-row-scope-lint",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/24511",
  "session": "session_01D6F9axfoPzR7t8G1J7Ytzz",
  "premise_still_valid": true,
  "summary": "validateRlsPredicateEnforceability now runs one per-policy judge (judgePolicy) for each permissions[].rowLevelSecurity[] entry and for each objects[].defaultRowScope. The declaring object is the target and the severity is error for both. Findings sit at objects[N].defaultRowScope.CLAUSE, with where = 'default row scope \"NAME\" of object \"OBJECT\"', and never mention a permission set. The permission-set leg is byte-identical. validateOrgAxisRedLines rule one judges the default too, and its structural meta-guards are extended. The shared RLS_DROPPED_USING os explain paragraph and the rls-predicate-unenforceable entry are worded for both sources. The surface grew past the claim by one file: ObjectSchema.defaultRowScope's describe (object.zod.ts, from #24451) said authoring checks do not judge the predicate, which this PR makes false, so it is corrected, the reference docs are regenerated and spec gets a patch line in the changeset. #24451 and #24474 both landed during the run, and main is merged after them.",
  "tests": "Final head 0db86b5479 (origin/main 45bec43cd merged). lint test: 146 files / 6896 passed, exit 0; lint typecheck: exit 0. CLI rls-policy-authoring-admission: 39 passed. metadata-protocol runtime-authoring-gate: 145 passed. spec test:repo: 70 files / 1162 passed, exit 0. spec object-default-row-scope + form reconciliation: 86 passed. spec check:generated: only content/docs/references stale, fixed with --fix. dispatch-gates: 110 derived, 110 run, all exit 0; --ran: 0 NOT-MEASURED, 0 UNRUN. The 4 roster gates under this diff's dirs exit 0. Ablation on ed2d826c13 (that file is unchanged since) through ablation-replace.mjs with a trap restore: the anchor 'const scope = obj.defaultRowScope;' went 1 to 0, blob bbb07af6453f to 7dbfe87353be; the new pin file gave 11 failed / 3 passed, the 3 being exactly the controls; the restore put the blob back equal to HEAD with git diff HEAD empty; direction red. No dist hop (tests import src).",
  "gates": "110/110 derived run on 0db86b5479, exit 0 each; reconcile 110 derived / 110 run / 0 NOT-MEASURED / 0 UNRUN. CI: in_progress at report time.",
  "files_changed": [
    ".changeset/24452-default-row-scope-lint.md",
    "packages/lint/src/rule-explanations.ts",
    "packages/lint/src/validate-org-axis-red-lines.ts",
    "packages/lint/src/validate-org-axis-red-lines.test.ts",
    "packages/lint/src/validate-rls-predicate-enforceability.ts",
    "packages/lint/src/validate-rls-predicate-enforceability.default-row-scope.test.ts",
    "packages/spec/src/data/object.zod.ts",
    "content/docs/references/api/metadata.mdx",
    "content/docs/references/data/object.mdx",
    "content/docs/references/system/migration.mdx"
  ],
  "line_budget": "n/a, no skills/** or governed surface touched",
  "deviations": [
    "File surface extended beyond the claim: packages/spec/src/data/object.zod.ts (the defaultRowScope describe and TSDoc sentence this PR falsifies), its three gen:docs reference pages, and a @objectstack/spec patch line in the changeset. The claim said to stop on a breach; os-dev.md requires fixing text the change makes false, and that file prevails, so the conflict is named here and in the PR body.",
    "Merge commits from origin/main carry the default merge message (no trailers)."
  ],
  "mcp_calls": "0",
  "api_writes": "2 relay writes: pr_create (POST /repos/objectstack-ai/objectstack/pulls plus POST /issues/24511/assignees), and the os-dev-report comment (POST /issues/24452/comments); plus git push (not REST). 0 label writes: no label was named, and the changeset publishes.",
  "open_questions": [],
  "out_of_scope_findings": [
    "carrier: none · noted, not filed. The runtime publish gate runs validateRlsPredicateEnforceability on permission writes only (runtimeTypes ['permission'], authoring-rules.ts), and validateOrgAxisRedLines is CLI_ONLY. So a Studio/REST/MCP object save with a non-lowering defaultRowScope is not refused at that door. Not measured at the public door, so it is in the PR's Acceptance notes only. Dedupe words: defaultRowScope runtimeTypes object write; publish gate object defaultRowScope predicate."
  ]
}

Generated by Claude Code

Navigation Menu

Repository navigation

lint: RLS_PREDICATE_UNENFORCEABLE walks only permissions[].rowLevelSecurity, so an ObjectSchema.defaultRowScope whose using cannot lower is caught only at runtime #24452

Why it was not done in PR #24451

Wanted

Dedupe

Triage: p2 · `domain:spec` · `area:access` · `pm:queue` · serial after #23566 · triage seat · `session_01AavokzJ5DndAwitDXvKy4U` · 2026-10-19T04:59Z

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

lint: RLS_PREDICATE_UNENFORCEABLE walks only permissions[].rowLevelSecurity, so an ObjectSchema.defaultRowScope whose using cannot lower is caught only at runtime #24452

Description

Why it was not done in PR #24451

Wanted

Dedupe

Activity

objectstack-fleet commented on Oct 19, 2026

Triage: p2 · domain:spec · area:access · pm:queue · serial after #23566 · triage seat · session_01AavokzJ5DndAwitDXvKy4U · 2026-10-19T04:59Z

objectstack-fleet commented on Oct 19, 2026

objectstack-fleet commented on Oct 19, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

Triage: p2 · `domain:spec` · `area:access` · `pm:queue` · serial after #23566 · triage seat · `session_01AavokzJ5DndAwitDXvKy4U` · 2026-10-19T04:59Z