fix(plugin-security)!: collectRLSPolicies applies an object's declared default row scope when no held set carries a row policy for it

[objectstack-fleet]

Fixes #24340

Clause-②: no (narrowing) — the narrowing is real only for a principal with no platform baseline whose permission sets carry no row policy for an object that declares a default (0 measured producers: no object in this tree declares defaultRowScope, ruling E′ item 7).

What changed

collectRLSPolicies (packages/plugins/plugin-security/src/security-plugin.ts), the one collection every read, write and explain door composes from, now applies an object's declared ObjectSchema.defaultRowScope (#24338) when the held sets' collection for that object and operation comes out empty. This is #24164 ruling E′ item 2, at the one collection point:

• When no held set carries a row policy for the object, the object's default applies: one policy, object implied, built by objectDefaultRowScopePolicy (new, object-default-row-scope.ts) and marked by identity.
• An authored set policy is used as authored: the default is never added to a non-empty collection.
• Superuser-bypass principals are untouched: the bypass is decided by the callers before the collection, so they never reach it.
• An object with no default keeps today's behaviour: the branch returns the held collection unchanged.

The shipped sets are not edited (default-permission-sets.ts untouched), so their behaviour and explain output do not move; the platform-objects declarations and the registry rule are #24341's.

What "carries a row policy" means (measured, then pinned)

It is exactly what the collection already means by empty: the held sets' policies after the ADR-0105 D3 admission, enabled, the positions domain and '*' matching (RLSCompiler.getApplicablePolicies). So:

• a held '*' policy counts (the default is not applied);
• a held policy for another operation does not count (an object whose held sets scope only update reads under its default);
• a held policy switched off or outside the caller's positions does not count.

An object-level reading ("any held policy naming the object, any operation") was measured and rejected: member_default ships the wildcard ownership floor (owner_only_writes / owner_only_deletes, object '*'), so that reading would switch the default off for every baseline member on every object. The two readings agree on every declaration in sight: the identity defaults #24341 is to declare mirror the operations of the set literals they copy. The ADR-0095 D1 note words it as Layer 1 silence, which is the collection's emptiness.

The default takes the path a held policy takes

From the admission on, the default is a held policy: it passes the same ADR-0105 D3 admission (admitCollectedPolicy, extracted from the loop unchanged, so a default spelling a shipped tenant policy is stripped exactly as its set copy is, by the (object, name, using) provenance key), the same getApplicablePolicies filter (its own operation, positions, enabled), and the same compiler (using, check).

Call sites (every one reads the same collection)

Call site (HEAD line)	What the collection is used for	What the default does there
resolvePreImageFloorDrop (:5326)	.some(isPlatformOwnershipFloorPolicy): is the platform floor in play	Nothing: the default is collected only when the held collection is empty, so the floor is absent either way, and the default is never the floor (identity provenance). Answer unchanged.
checkAuthoredRowWrite (:5448)	authored pre-check: a non-floor policy with using; empty answers abstain	Counts as the declaration it is, exactly as a held copy of it would, so it can answer admit for a row it admits. Pinned.
computeLayeredRlsFilter Layer 1 (:7222)	read door, by-id pre-image, bulk write filter, getReadFilter / analytics, explain; empty means layer1 = null, no filter	Compiled into Layer 1: the reads and writes it governs are narrowed. Pinned.
derive-from-select (:7369)	update / delete with no write-class using re-collects select	A select default scopes the derived write exactly as a held select policy does.
computeWriteCheckFilter (:7657)	post-image check via writeCheckPolicies; empty means no check	The default's check (or its using, by the schema's default) judges the post-image. Pinned: handing your own row away is refused.
assertControlledByParentWrite master leg (:8907)	.some(isPlatformOwnershipFloorPolicy)	Nothing, for the reason in the first row.

Which call sites read an empty collection as "no policy, no filter": the Layer 1 compile (:7222, and :7369 behind it) and the post-image check (:7657). Which already refuse on empty: none refuses; checkAuthoredRowWrite abstains (its fail-closed direction) and the two floor probes answer false. On a compile failure every door fails closed through RLS_DENY_FILTER.

Cost of the read

The declaration is read off ql.getSchema(object), the ObjectQL registry's resolved object (the schema every find compiles against, and the source getObjectSecurityMeta prefers): two in-memory map lookups behind the registry's merged-object cache, made only when the held collection is empty. No I/O and no parse on any path; a non-empty collection pays nothing.

Explain names the object default

Explain already identifies policies inside a composed filter by identity (compiledPolicyNameOf). RLSCompiler.compileFilter now also records when a compiled policy filter came from an object default (compiledObjectDefaultRowScopeOf), and explain reads it:

• object-level: the rls layer's detail gains one sentence naming the default by name, with its label and description, and the declaring object, saying it is not a permission set. contributors stays [] (the spec's contributor kinds are permission_set / position / system; a structured object-level field would be a spec change, not taken).
• record-grained: the rule is named after the default (kind: 'rls_policy', name set to the default's own name, via: 'object_default') instead of business_rls.

A filter from held sets is explained byte-for-byte as before.

A using that does not lower: why the runtime refusal suffices here (rider 6255162631)

The default reaches the same compiler an authored policy does, so a non-lowering using is dropped with the same "uncompilable predicate ... DROPPED" WARN and the clause fails closed to RLS_DENY_FILTER: zero rows, never a silent admission or a silent drop. Pinned on the same predicate in both forms (an object's default, and an authored set policy on a sibling object): both read zero rows, both WARN naming their policy, explain answers denies for both.

The authoring lint (validate-rls-predicate-enforceability.ts) is not extended, for three reasons:

1. Extending it needs RLS_PREDICATE_UNENFORCEABLE's explanation entry in packages/lint/src/rule-explanations.ts to change: the entry's shared RLS_DROPPED_USING paragraph says the object "disappears for every holder of the permission set", which is wrong for a default. That file has another in-flight holder (lint: a locale pack's picklists.<name> translations are never checked — an option key that is not in the list, or a list no package declares, passes os lint --strict and is dropped silently at runtime #23566), so per the claim it is not edited here; it is reported to the seat.
2. The refusal is loud at runtime and fails closed, the same posture the lint's own header accepts as survivable for authored policies.
3. Zero producers can write a non-lowering default today: no object in the tree declares the key, the Studio form omits it, and the only planned writers (platform-objects: the identity objects declare their default row scope (the literals the shipped sets copy today), and the registry refuses an extend contributor that loosens a platform object's default (#24164 ruling E′) #24341) copy literals that already pass the lint where they live in the shipped sets.

The key's describe now says plainly that authoring checks do not judge this predicate.

Spec-lane riders (rider 6256199121)

• packages/spec/liveness/object.json: defaultRowScope and its eight members flip to live, citing collectRLSPolicies, objectDefaultRowScopePolicy and explain's objectDefaultRowScopeSource as read points; authorWarn / authorHint dropped in the same edit. label / description are live by the README's display-key rule: explain shows them to the administrator. state-counts/object.md regenerated by gen:liveness-counts (live 53 to 61, planned 8 to 0).
• packages/spec/src/data/object.zod.ts: the key's TSDoc and describe say what the reader does, in place of "is to apply" and "no server reads this key".
• packages/spec/src/security/rls.zod.ts: DefaultRowScopeSchema's TSDoc likewise.
• packages/lint/src/validate-org-axis-red-lines.test.ts: the title and docblock name defaultRowScope as the one object-level policy; the assertion is unchanged.
• Patch round 1 (claim surface extended by the seat's rework record 6259617731): .changeset/pre/24338-object-default-row-scope.md, the pending spec(data): ObjectSchema declares an object's default row scope — the existing RLS policy shape minus object — applied when no held permission set carries a policy for it (#24164 ruling E′) #24338 release note, now says what the key does (see Acceptance notes), and the Studio form ledger's omit row for object.defaultRowScope in packages/spec/src/system/metadata-form-zod-reconciliation.test.ts gives the reason that is true now.
• Generated by their own generators (check:generated --fix, only the two it proved stale): content/docs/references/{data/object,api/metadata,system/migration}.mdx, packages/spec/liveness/state-counts/object.md.

Pins (packages/plugins/plugin-security/src/object-default-row-scope.test.ts)

Real SecurityPlugin + ObjectQL over SqlDriver, the shipped sets, rows written past every scope. The identity objects are the platform's own declarations, each given in the fixture the default its sets copy today (sys_user's two literals as the one || policy the key allows, rider A); qa_note is a test object.

1. No baseline, an authored '*' read set: reads only its own sys_user, sys_session, sys_scim_user rows plus its organisation's members on sys_user. CONTROL without the declarations: every row.
2. An authored policy on the object is applied alone (the default is not OR-ed in); a held '*' policy counts; a held policy for another operation, or outside the caller's positions, does not.
3. The write doors read the same collection: a by-id update of a row outside the default answers RECORD_NOT_FOUND / 404 (an unreadable target is absent), and handing your own row away fails the post-image check with PERMISSION_DENIED / 403. checkAuthoredRowWrite answers admit / abstain from the default.
4. The platform administrator reads every row, with and without the defaults.
5. Explain names the default (object-level detail; record-grained rule and via); CONTROL: an authored policy is not named as one.
6. A deployment with the baseline is byte-for-byte unchanged: for member_default, viewer_readonly, organization_admin and the platform admin, on the three identity objects, the served ids and the JSON.stringify of explain (read and update) are identical with and without the declarations.
7. A default whose using does not lower is refused as an authored one is (zero rows, the WARN, explain denies).

Ablation (once, committed first, then reverted): node scripts/ablation-replace.mjs replaced if (held.length > 0) return held; with if (held.length >= 0) return held; (anchor 1 to 0, blob 1e3792351de2 to c54fe3ed549d), ran the file: 10 failed / 6 passed, the 10 being every default-dependent pin and the 6 exactly the controls (no-declaration control, authored-alone, held '*', platform admin, authored explain control, baseline byte-for-byte). Restored: blob 1e3792351de2 equals HEAD, git diff HEAD empty. Direction observed: turned red, as expected.

Tests and gates

Final head 7702f3ca2: patch round 1 (ef9a7a01e, the two corrected texts) with origin/main 26501ae24 merged in by scripts/pm/os-regen-merge.sh. The merge was a merge commit (no rebase, amend or force-push), and git carried the patch-round edit onto the moved .changeset/pre/24338-object-default-row-scope.md (blob d5154221dd). After a full turbo run build:

• pnpm --filter @objectstack/spec test: 698 files, 21286 passed, 1 todo. typecheck exit 0.
• The pin file: 16 passed. pnpm --filter @objectstack/spec check:generated: all 14 generated artifacts up to date, so no regeneration commit was owed after the merge.
• plugin-security and lint: incoming main touched neither package's source, so their suites stand from the pre-merge head 1081739c9 (plugin-security 188 files, 3754 passed, 45 skipped; lint 145 files, 6864 passed; both typecheck exit 0).
• Derived gate families: node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack derives 117 commands for this diff (17 paths, +788 / -102 against merge base 26501ae24). All 117 were run on 7702f3ca2, each through scripts/pm/os-verify-lock.sh with the command's own exit read from its VERDICT line, and --ran reconciles: 117 derived, 117 run, 0 NOT-MEASURED, 0 UNRUN. 115 exit 0.
• node scripts/check-empty-changeset.mjs --base origin/main exits 1, by design: its foreign-changeset rule names .changeset/pre/24338-object-default-row-scope.md as present on the merge base and changed here. That is the DELIBERATE CORRECTION class in Acceptance notes; Check Changeset is not a required context.
• pnpm check:platform-checklist exits 1 with one problem (ABSENT SYMBOL packages/core/src/security/resolve-authz-context.ts#legacyGrantAnchorRetired in areas/access-security.json). Control leg: the same command in a detached worktree at the merge base 26501ae24 exits 1 with the same single problem, and earlier at e22defb13 likewise. Pre-existing, not this change's.
• The other changeset gates: check-adr-0087-registration --base origin/main exit 0, check-changeset-no-major --base origin/main exit 0.
• Not run locally, declared to CI: test:repo (Test Core), and every family CI runs beyond the derived list.

Acceptance notes

• A pending release note corrected in this PR (DELIBERATE CORRECTION, for confirmation here): .changeset/pre/24338-object-default-row-scope.md is spec(data): ObjectSchema declares an object's default row scope — the existing RLS policy shape minus object — applied when no held permission set carries a policy for it (#24164 ruling E′) #24338's changeset. The version release 725a5b131 moved it from .changeset/ into .changeset/pre/, and release.yml has the pre exit GA version consume .changeset/pre/*.md again, so the GA changelog is built from it. Its bullet "What it does today: nothing ..." and its sentence naming the liveness-planned-property warning became false with this PR's reader. Patch round 1 rewrites that one bullet to what the key does now (collectRLSPolicies applies it when the caller's held sets carry no row policy for the object and the operation) and drops the warning sentence; level, Clause-②, heading and every other line are unchanged. The edit rides the moved path through the merge of main. The already-released next changelog text stays as released. check-empty-changeset's foreign-changeset rule refuses this file by design (the DELIBERATE CORRECTION class: do not restore it; confirm it on the PR), so Check Changeset, which is not a required context, stays red until the correction is confirmed. skip-changeset is not applied.
• The form ledger's omit reason corrected in this PR: the omit row for object.defaultRowScope (packages/spec/src/system/metadata-form-zod-reconciliation.test.ts) now says the reader is in and a row policy is a composite form-face addition rather than a reconciliation. Prose only; the row's kind, path and the assertion are unchanged.
• Boundary, not filed: the org-axis red-line rule (validate-org-axis-red-lines.ts rule ①) walks permission-set RLS only, so a defaultRowScope.using that walks the org parent is not judged there. That is a lint not covering metadata the runtime honours, which is outside the filing classes.
• Explain on a failing default: a default whose using does not lower is explained as "composes to DENY ALL" without naming the default, exactly as an authored policy in the same state (the compiled identity is lost to the shared deny sentinel).
• check:platform-checklist exits 1 on this head and at the merge base alike (one ABSENT SYMBOL in areas/access-security.json, resolve-authz-context.ts#legacyGrantAnchorRetired); this diff touches neither file. The control leg is in the gates section above.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 2 package(s): @objectstack/plugin-security, @objectstack/spec, touching 18 documentable anchor(s). ⚠️ 3 changed file(s) yielded no anchor (packages/spec/liveness/object.json, packages/spec/liveness/state-counts/object.md, packages/spec/src/security/rls.zod.ts), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files.

5 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/concepts/metadata-driven.mdx (via ObjectSchemaBase (symbol, a top-level const object))
• content/docs/permissions/field-level-security.mdx (via SecurityPlugin (symbol, a top-level class))
• content/docs/permissions/index.mdx (via SecurityPlugin (symbol, a top-level class))
• content/docs/plugins/packages.mdx (via SecurityPlugin (symbol, a top-level class))
• content/docs/ui/forms.mdx (via SecurityPlugin (symbol, a top-level class))

⛔ 1 release-owned page(s) also name something this change touched. These are read-only:

• content/docs/releases/implementation-status.mdx (via SecurityPlugin (symbol, a top-level class))

content/docs/releases/ is RELEASE-OWNED (AGENTS.md "Documentation Guardrails"): release
notes are written centrally at release time, and a code PR that edits them is the exact PR
that guardrail exists to stop. They are still audited — read-only. If one of them is actually
wrong, file an issue or open a dedicated docs-only PR; do not edit it here.

What this run could not see

• 3 changed file(s) yielded no anchor (packages/spec/liveness/object.json, packages/spec/liveness/state-counts/object.md, packages/spec/src/security/rls.zod.ts) — pages documenting those are invisible to this run
• the SDK route bridge reached 54 of 206 client-bound route-ledger rows — the other 152 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 152: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 55 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 97 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 146 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 26501ae24feed649dade94c4a5cc2d6f4a7e9d82 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 9bd3da7ba0ffa9b63420fd0e67f544980c18039c — the merge of head 7702f3ca2b0c5899763cca4b8fa96e84de0d1fbb into base 26501ae24feed649dade94c4a5cc2d6f4a7e9d82, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 9bd3da7ba0ffa9b63420fd0e67f544980c18039c && git checkout 9bd3da7ba0ffa9b63420fd0e67f544980c18039c
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 26501ae24feed649dade94c4a5cc2d6f4a7e9d82 7702f3ca2b0c5899763cca4b8fa96e84de0d1fbb && git checkout -B drift-repro 26501ae24feed649dade94c4a5cc2d6f4a7e9d82 && git merge --no-ff 7702f3ca2b0c5899763cca4b8fa96e84de0d1fbb

node scripts/docs-audit/affected-docs.mjs --json 26501ae24feed649dade94c4a5cc2d6f4a7e9d82

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 26501ae24feed649dade94c4a5cc2d6f4a7e9d82 → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[objectstack-fleet]

REWORK · patch round 1 · domain:services seat 1 (#6021) · marchtian · session_01Nk17Z26X5DB59iQztDBADH · 2026-10-19T04:24Z · head 1081739c97

The seat read the diff. The collection-point change, the explain source and the riders' spec and lint texts are the shape ruling E′ and the riders ask for. The lint's runtime-refusal route is accepted with the PR body's reason (#23566 holds rule-explanations.ts). Two texts that this PR makes false are outside the claim. The seat extends the claim's surface to them, as domain:spec files declared with the rest before the queue:

1. .changeset/24338-object-default-row-scope.md (pending, unreleased) says "What it does today: nothing. No server reads the key in this release …", and it names the liveness-planned-property warning. It compiles into the same @objectstack/spec release entry as this PR. Reword that bullet to what the key does once this lands: the security plugin's collectRLSPolicies applies it when the caller's held sets carry no row policy for the object and operation. Drop the warning sentence. Use the replacement the PR body's Acceptance notes already give, or better.
2. packages/spec/src/system/metadata-form-zod-reconciliation.test.ts:536: the omit row's why says no server reads the key until collectRLSPolicies does (plugin-security: collectRLSPolicies applies an object's declared default row scope when no held set carries a policy for it — the platform identity objects stop depending on every set copying the same literals (#24164 ruling E′) #24340), and to revisit when the reader lands. The omit decision stands (the PR's own reading). Reword the why to the reason that is true now: the reader is in, and a row policy is a composite form-face addition, not a reconciliation.

Run the derived list again on the new head (--ran: 0 NOT-MEASURED, 0 UNRUN). After the push, the seat runs the CONTRACT_REVIEW_TIER review of record on that head and declares the spec-lane files before the queue.

---

Generated by Claude Code

[objectstack-fleet]

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 7702f3ca2b0c5899763cca4b8fa96e84de0d1fbb
Local-runs: none
Scope: packages/spec/src/data/object.zod.ts, packages/spec/src/security/rls.zod.ts, packages/plugins/plugin-security/src/security-plugin.ts, packages/plugins/plugin-security/src/object-default-row-scope.ts, packages/plugins/plugin-security/src/object-default-row-scope.test.ts, packages/plugins/plugin-security/src/rls-compiler.ts, packages/plugins/plugin-security/src/explain-engine.ts, packages/spec/liveness/object.json, packages/spec/liveness/state-counts/object.md, packages/spec/src/system/metadata-form-zod-reconciliation.test.ts, packages/lint/src/validate-org-axis-red-lines.test.ts + .changeset/pre/24338-object-default-row-scope.md, .changeset/24340-rls-object-default-scope.md, .changeset/24340-default-row-scope-live.md, content/docs/references/data/object.mdx, content/docs/references/api/metadata.mdx, content/docs/references/system/migration.mdx, packages/plugins/plugin-security/src/index.ts, packages/plugins/plugin-security/src/platform-ownership-policies.ts, packages/plugins/plugin-security/src/platform-tenant-policies.ts, packages/spec/src/security/explain.zod.ts, packages/lint/src/validate-rls-predicate-enforceability.ts, packages/lint/src/lint-liveness-properties.ts, packages/spec/liveness/README.md, packages/objectql/src/engine.ts, docs/adr/0095-authz-kernel-tenant-layer-and-posture-ladder.md, scripts/check-empty-changeset.mjs, .github/workflows/release.yml, packages/spec/CHANGELOG.md

Net diff judged: git diff 26501ae24 7702f3ca2 (merge base with main), 17 files, +788 −102. Inputs read at 2026-10-19T06:09Z: card #24340 (body and all seven comments, ruling E′ 6250748677 on #24164, claim 6258026360, riders 6255162631 / 6256199121, dev reports 6259584831 and 6260643691), PR #24451 (body, both comments including rework record 6259617731, file list), and the 48 check-runs on this head. Test Core (aggregate) was in_progress on first read and completed success before this record was written; the five required contexts (Lint & Repo Gates, TypeScript Type Check, Test Core, Build Core, Governed Surface Queue Guard) are all success. The only red is Check Changeset, twice (both runs on this head), judged below.

① Derived judgments

1. The collection point (security-plugin.ts collectRLSPolicies, now at :9018) — RIGHT. The accept-set change is the one ruling E′ item 2 names: after the held sets' policies pass the ADR-0105 D3 admission and RLSCompiler.getApplicablePolicies (enabled === false excluded, object match including '*', the positions domain, operation match), an empty result and a declared defaultRowScope on ql.getSchema(objectName) yield one policy, object set to the declaring object, passed through the same admission and the same applicability filter. held.length non-zero returns held untouched (an authored policy is used as authored, never OR-ed with the default); a null declaration returns held (an object with no default collects exactly as before). The reading of "carries a row policy" as the collection's own emptiness per object AND operation is right, not merely defensible: ADR-0095 D1's note words it as "Layer 1 silence", and Layer 1 is computed per operation; the object-level reading the dev measured and rejected would let member_default's wildcard update/delete floor switch every default off for every baseline member on every object, defeating ruling item 3's purpose ("a new identity table joins by declaring its default, not by being copied into every set"). The admitCollectedPolicy extraction is behaviour-preserving: the same two tests in the same order (strip a platform tenant policy when org scoping is off; warn once on an authored tenant policy), the same push. warnAuthoredTenantPolicyOnce keys on objectName + policy.name (a string), so the fresh default object built per call cannot re-warn.

2. The six call sites, each read in the cited code — RIGHT at every one.

• :5326 resolvePreImageFloorDrop and :8907 assertControlledByParentWrite ask .some(isPlatformOwnershipFloorPolicy). That predicate is identity (FLOOR_ALTERNATE_INSTANCES) OR the provenance key (object, name, using) against the shipped floor keys, whose object is '*'; a default's object is always the declaring object, so neither test can be satisfied by a default, and the default is collected only when the held collection (where the floor would live) is empty. Answer unchanged.
• :5448 checkAuthoredRowWrite filters non-floor policies with using; the default passes as the declaration it is, exactly as a held copy would, and computeLayeredRlsFilter(..., dropPlatformOwnershipFloor: true) leaves it standing (not the floor). admit for a row the default admits, abstain otherwise — pinned three ways. Safe: admit is only consumed to widen past a floor, and when the default applies no floor is in the collection.
• :7222 Layer 1 of computeLayeredRlsFilter (read door, by-id pre-image, bulk write filter, getReadFilter, explain): the default compiles into Layer 1 and narrows. Pinned on reads (identity objects and qa_note) and on the by-id update (RECORD_NOT_FOUND / 404).
• :7369 derive-from-select: a select-only default is filtered out for update by getApplicablePolicies, the write class carries no using, the branch re-collects select and the default scopes the derived write as a held select policy would. Right.
• :7657 computeWriteCheckFilter: writeCheckPolicies over the collection, the default's check (or its using, by the schema default) judges the post-image. Pinned (PERMISSION_DENIED / 403 on handing one's own row away).

3. Superuser bypass — RIGHT, with one boundary named. At :7222 the collection is skipped for posturePermits && superuserBypass; at :7657 the ADR-0066 ① bypass returns before the collection on private, tenancy-disabled or better-auth-managed objects (every identity object and the pin's qa_note fixture are in that class). On a non-private tenant object the bypass does not apply to a held policy today either, so a default there is judged exactly as a held copy would be: "as a held policy" is the ruling's own rule, not a widening. The platform-administrator pin covers reads on all four objects and read/update explain, with and without declarations.

4. Fail-closed on a using that does not lower — RIGHT. The default reaches the same compileFilter branch (ADR-0056 D4 unsupported-shape, warns on every drop) and the same RLS_DENY_FILTER. Pinned both forms on the same predicate (a default on qa_note_unlowerable, an authored set policy on qa_note_bare): zero rows, the WARN naming each policy, explain denies for both. The rider's pin is present.

5. Compiler mark and explain — RIGHT, and no public surface moves. OBJECT_DEFAULT_OF_COMPILED_FILTER is a WeakMap on the fresh compiled filter, set only when isObjectDefaultRowScopePolicy(policy) (a WeakSet of instances the builder made — identity, never spelling). index.ts exports RLSCompiler, RLS_DENY_FILTER, explainAccess, buildContextForUser and two types from these files; none of compiledObjectDefaultRowScopeOf, objectDefaultRowScopePolicy, isObjectDefaultRowScopePolicy is re-exported, so @objectstack/plugin-security publishes no new symbol. explainAccess output changes only when a default applies: the rls layer detail gains one sentence (objectDefaultRowScopeSource, naming name, label, description, the declaring object, "not a permission set"); the record-grained rule is kind: 'rls_policy', name = the default's name, via: 'object_default' instead of business_rls. All inside explain.zod.ts: via is z.string().optional(), rls_policy is in the kind enum, contributors kinds are the closed set permission_set / position / system, so [] is the right answer and a structured contributor would be a spec change this card does not take. A filter from held sets is explained byte-for-byte as before (CONTROL pinned).

6. The registry read — RIGHT. ql.getSchema is ObjectQL.getSchema(objectName): ServiceObject | undefined (packages/objectql/src/engine.ts:11208); two map lookups, no I/O, made only on an empty collection. The pins run on the real ObjectQL + SqlDriver, so the key's survival through registration is measured, not assumed.

7. Spec texts (object.zod.ts, rls.zod.ts) — RIGHT. Both hunks are TSDoc and the describe string; no member of ObjectSchema or DefaultRowScopeSchema moves, so the accept set is unchanged. Every clause of the new describe is true at this head: the per-object-and-operation emptiness with its three non-counting cases; authored policy used as authored; superuser bypass unaffected; no-default unchanged; judged like a held policy (operation, positions, enabled); un-lowerable using returns no rows with a warning; "Authoring checks do not judge this predicate" (validate-rls-predicate-enforceability.ts:1482-1501 walks permissions[].rowLevelSecurity[] only); explain names the default as the object's own. The three generated reference pages carry the same text (regenerated by gen:docs; TypeScript Type Check, which hosts check:docs, is green).

8. Liveness ledger — RIGHT. defaultRowScope and its eight children planned to live, authorWarn / authorHint dropped in the same edit (as the row's own note asked; a warned live row reds the gate). Evidence anchors name real symbols at this head: security-plugin.ts#collectRLSPolicies, object-default-row-scope.ts#objectDefaultRowScopePolicy, explain-engine.ts#objectDefaultRowScopeSource, rls-compiler.ts#compileFilter / #getApplicablePolicies, security-plugin.ts#writeCheckPolicies (module function at :1080); Spec property liveness is green. label / description live by the README's display-key rule (#7131: being shown to a human is the whole of the claimed effect) — objectDefaultRowScopeSource draws both verbatim. state-counts/object.md: live 53 to 61, planned 8 to 0, classified 62 unchanged. Consequence correctly declared: lint-liveness-properties.ts reads @objectstack/spec's shipped liveness/ dir, so authoring the key no longer raises liveness-planned-property.

9. validate-org-axis-red-lines.test.ts — RIGHT. Title and docblock now say an object-level RLS policy LIST is not an authoring surface and name defaultRowScope as the one object-level policy; the assertions (ObjectSchema.shape has neither rowLevelSecurity nor rls; PermissionSetSchema.shape has rowLevelSecurity) are unchanged and true.

10. Pins against ruling item 6 — complete for this card. Five of the ruling's six pins are here (no-baseline '*' reader on sys_user / sys_session / sys_scim_user with the org-members arm, with a CONTROL; authored policy applied alone; platform administrator unchanged; explain names the default with a CONTROL; baseline byte-for-byte on served ids and JSON.stringify(explain) for read and update across four personas and three identity objects), plus the rider's un-lowerable pin and the three "carries" readings ('*' counts; another operation and an unheld position do not). The sixth ruling pin (an extend contributor loosening a default is refused) is #24341's. The ablation (10 default-dependent pins red, 6 controls green on a loosened held.length guard) is read from the dev's report, not re-run.

The DELIBERATE CORRECTION — .changeset/pre/24338-object-default-row-scope.md — CONFIRMED

Provenance, read in the tree: the note is #24338's changeset. 725a5b1311 (chore: version packages (next) (#24168)) renamed it from .changeset/ into .changeset/pre/ with zero line changes; .changeset/pre.json is mode: pre, tag: next; release.yml (the version-pass glob logic around :499-521 and :857-868) consumes .changeset/pre/*.md on the GA pre exit version, so the GA @objectstack/spec changelog entry is compiled from THIS file. The next prerelease changelog already carries the old bullet (packages/spec/CHANGELOG.md:258) and is release-owned; it is correctly untouched. The old path is absent at this head (no duplicate note). The diff on the file is exactly one bullet, +1 −1; frontmatter (spec: minor, metadata-core: patch), heading, Clause-②: yes (widening) and every other bullet are byte-identical to the merge base.

Sentence by sentence (old = merge base 26501ae24, new = this head), each judged against the code at this head:

• OLD 1 "What it does today: nothing." — FALSE at this head: collectRLSPolicies reads and applies the key. NEW 1 "What it does." — a heading; true as the lead to what follows.
• OLD 2 "No server reads the key in this release, so declaring it filters no rows." — FALSE at this head (the reader is in this release's GA aggregate; the pins show rows filtered). NEW 2 "The security plugin's row-policy collection (collectRLSPolicies), the one step every read, write and explain passes through, applies the key: when the permission sets the caller holds carry no row policy for the object and the operation (a '*' policy counts; one switched off, outside the caller's positions, or for another operation does not), the object's default is used in their place and judged like a held policy." — TRUE: the six call sites in ①.2 are every door; the three non-counting cases are getApplicablePolicies' own three tests and are pinned.
• OLD 3 "The describe states the contract the security plugin's row-policy collection is to meet once it reads the key: the default is to apply when no permission set the caller holds carries a row policy for the object; a policy an authored set carries is to be used as authored; a superuser-bypass principal is to be unaffected; an object without the key keeps its behaviour." — FALSE in tense at this head: the describe no longer states a future contract, it states behaviour (①.7). NEW 3 "A policy an authored set carries for the object is used as authored, with the default not added to it; a principal whose superuser bypass skips row policies is unaffected; an object without the key keeps its behaviour." — TRUE (held.length guard; ①.3; the null-declaration return).
• OLD 4 "No object declares the key yet; the platform's identity objects are to declare it for their own tables." — still TRUE at this head (no defaultRowScope under packages/platform-objects); dropping its first half loses nothing false and the second half survives as NEW 5. Not a finding.
• OLD 5 "Authoring the key raises the liveness lint's liveness-planned-property warning until then." — FALSE at this head: the row is live with no authorWarn (①.8).
• OLD 6 "Restrict rows with a permission set's rowLevelSecurity policy in the meantime." — advice whose "meantime" presupposes OLD 2; misleading at this head, correctly dropped.
• NEW 4 "A using the row-filter compiler cannot lower makes the reads it governs return no rows, with one server warning." — TRUE (①.4), read per governed read: the ADR-0056 D4 branch warns on every drop, and the first fail-closed read also emits the once-per-cause denial line. The sentence claims the rows and the warning, not a per-boot count; no rewording required. (Precision option for a later spec-lane text pass, not owed here: "with a server warning naming the policy".)
• NEW 5 "The platform's identity objects are to declare it for their own tables in a separate change." — TRUE (platform-objects: the identity objects declare their default row scope (the literals the shipped sets copy today), and the registry refuses an extend contributor that loosens a platform object's default (#24164 ruling E′) #24341 open; none declares it at this head).
• NEW 6 "See the @objectstack/plugin-security entry in this release for the reader." — TRUE: .changeset/24340-rls-object-default-scope.md is pending stock in .changeset/ and lands in the same GA version pass that consumes .changeset/pre/*.md.

Restoring the note from the merge base would republish OLD 1, OLD 2 and OLD 5 as false sentences and OLD 3 in a false tense, in the GA changelog the file compiles into. The correction is the DELIBERATE CORRECTION class the script names; do not restore it. This record is its confirmation on the PR. Check Changeset stays red by the script's own design; it is not one of the five required contexts.

The form ledger's omit reason (metadata-form-zod-reconciliation.test.ts:536) — RIGHT

New why: "not offered by this reconciliation (#24164 ruling E′, item 1): the reader is in — the security plugin's collectRLSPolicies applies the object's default row scope when no held set carries a row policy for the object and operation (#24340) — but a row policy is a composite of a select, two predicate strings and a positions list, so offering it is a form-face addition rather than a reconciliation of a scalar key; its writers are to be the platform identity objects, declared in code (#24341)". Every clause true at this head: the reader is in (①.1); DefaultRowScopeSchema is operation (a select control), using and check (two predicates), positions (a list) beside name / label / description / enabled; the writers are #24341's. The old why ("no server reads the object's default row scope until ... does", "filters nothing", "Revisit when the reader lands") was made false by this PR. Kind, path, key and the assertion are unchanged; prose only.

② Semver level

• .changeset/24340-rls-object-default-scope.md: @objectstack/plugin-security minor, title fix(plugin-security)!: ..., one **BREAKING** line, Clause-②: no (narrowing), and the ADR-0087 marker comment not-required (no-migration-prescription) — accepted by check-adr-0087-registration (the notice annotation on this head's Check Changeset job) and by check-changeset-no-major (inside green Lint & Repo Gates). This matches ruling E′ item 7 word for word, the card's Acceptance line (minor under the launch-window convention) and AGENTS.md Post-Task §3 ((narrowing) is BREAKING; the disposition marker in the body). The body's "no export, option, schema or stored shape moves" is verified against index.ts (①.5). The level publishes what the diff publishes: a runtime accept-set narrowing for a principal class with 0 measured producers today.
• .changeset/24340-default-row-scope-live.md: @objectstack/spec patch, Clause-②: no. Right: describe, TSDoc and ledger text only; ObjectSchema and DefaultRowScopeSchema accept and refuse exactly what they did; the one behavioural consequence (the planned-property warning no longer raised, via the ledger the spec package ships) is declared in the body.
• No changeset for @objectstack/lint: its only hunk is test prose; nothing published. Right. skip-changeset is correctly not applied.
• Clause-②: line — the PR body carries Clause-②: no (narrowing) with the 0-producers measurement, identical in arm to the breaking changeset's line; the spec changeset's Clause-②: no is the right declaration for a text-only hunk. Consistent across body and both changesets.

③ Boundary flags

Dev flags (deviations, round 0 6259584831; round 1 6260643691 carries no deviations and no open_questions; open_questions is [] in round 0):

1. Lint not extended (runtime-refusal route) — ANSWERED, accepted. Rider 6255162631 offers exactly this route ("or name in the PR body why the runtime refusal suffices"); the body gives three reasons, the first of which (rule-explanations.ts held by lint: a locale pack's picklists.<name> translations are never checked — an option key that is not in the list, or a list no package declares, passes os lint --strict and is dropped silently at runtime #23566) is a claim exclusion; the refusal is pinned both forms (①.4) and the describe now tells the author the predicate is not judged at authoring time. ESCALATED to the domain:services seat: the follow-up — validate-rls-predicate-enforceability.ts and the org-axis red-line rule ① both walking defaultRowScope.using — is a lint not covering metadata the runtime honours, i.e. a metadata-authoring trap under Prime Directive chore: version packages #10; "noted, not filed" is not its end state. File it as a card serialized behind lint: a locale pack's picklists.<name> translations are never checked — an option key that is not in the list, or a list no package declares, passes os lint --strict and is dropped silently at runtime #23566. Not a condition on this verdict.
2. Two falsified texts left unedited — ANSWERED: both corrected in patch round 1 (ef9a7a01e) under the seat's surface extension (6259617731); judged true in ①.
3. origin/main merged before the PR opened, and again (os-regen-merge.sh) for the final head — procedural; this record judges the net diff against the merge base, so main's release commits are outside it.
4. Explain shape inside the existing schema (via: 'object_default', contributors: []) — ANSWERED right (①.5).
5. label / description graded live — ANSWERED right (①.8).
6. Attribution form — AGENTS.md's model-free pair and session-URL body footer used; no model identifier found in the diff, the PR body, or the comments read.
7. Typing-only commit after the ablation — acceptable; the implementation blob is reported unchanged, and this record does not re-run the ablation.
8. Round-1 pr_body note ("not patched by the dev; replacement body for one seat write") — ANSWERED: the PR body on this head already carries the patch-round content and the DELIBERATE CORRECTION request; the seat's write is done.

Other entries from the reports and riders:

9. check:platform-checklist exits 1 on this head and at the merge base alike (ABSENT SYMBOL resolve-authz-context.ts#legacyGrantAnchorRetired in areas/access-security.json) — not this diff's (no path under docs/qa/** or packages/core/**); routed to the main watchdog as the dev did. No action here.
10. Rider addendum, last clause — the packages/spec hunks in this domain:services PR are declared to the spec lane before the queue. That is the seat's act (promised in 6259617731); a landing condition, not a verdict condition. Named so it is not lost.
11. The narrowing has 0 measured producers at this head (no object declares the key; the pins build the declarations in fixtures). It becomes real when platform-objects: the identity objects declare their default row scope (the literals the shipped sets copy today), and the registry refuses an extend contributor that loosens a platform object's default (#24164 ruling E′) #24341 lands; that card's pins owe the baseline byte-for-byte comparison on the real platform declarations, and ruling item 4 (the registry extend rule) is its, not this PR's.
12. Unlisted blocker check — neither report names a premise_still_valid: false; 6257237666 re-derived that E′ names no other prerequisite; both blockers (spec(data): ObjectSchema declares an object's default row scope — the existing RLS policy shape minus object — applied when no held permission set carries a policy for it (#24164 ruling E′) #24338 31e7d0ba27, docs(adr): ADR-0095 D1 dated note — Layer 0 is inert on the platform identity objects; Layer 1 silence means the object's declared default row scope, a protocol key (#24164 ruling E′; Tier H) #24339 97cb5c5a82) are on main and in this merge base.

Implemented-by: claude/issue-24340-rls-object-default-scope
Reviewed-by: session_01Nk17Z26X5DB59iQztDBADH

VERDICT: PASS

---

Generated by Claude Code

[objectstack-fleet]

席位核对

ACCEPT · domain:services seat 1 (#6021) · marchtian · session_01Nk17Z26X5DB59iQztDBADH · 2026-10-19T06:14Z · head 7702f3ca2b.

The contract review of record is PASS 6260875372, at CONTRACT_REVIEW_TIER on this head. It covers the whole diff on the narrowing face, and this seat review records the rest. The PR lands through the merge queue.

• Shape:
  • A draft PR to main. Its first line is Fixes #24340, and that is the only closing keyword in the body.
  • Clause-②: no (narrowing) is at a line start in the body and in .changeset/24340-rls-object-default-scope.md.
  • That changeset is @objectstack/plugin-security minor, fix(plugin-security)!, with one BREAKING line and the adr-0087: not-required (no-migration-prescription) disposition. This is the card's Acceptance line and ruling E′ item 7.
  • The spec text changeset is @objectstack/spec patch, Clause-②: no.
  • Card and PR assignee: marchtian.
  • Not governed: check-governed-merges reads none of the 17 paths, and 890 changed lines is ≤ 3000.
• The card's change and pins, met (the review's ①.1–①.10):
  • collectRLSPolicies applies the object's declared default when the held sets carry no row policy for the object and the operation.
  • An authored policy is used as authored, the superuser bypass is decided before the collection, and an object with no default is unchanged.
  • Explain names the default as the object's own (via: 'object_default'), inside explain.zod.ts.
  • The five pins that are this card's (ruling E′ item 6) hold, plus the rider's pin on a non-lowering using. The sixth pin, the extend refusal, belongs to platform-objects: the identity objects declare their default row scope (the literals the shipped sets copy today), and the registry refuses an extend contributor that loosens a platform object's default (#24164 ruling E′) #24341.
  • The shipped sets are not edited (default-permission-sets.ts is outside the diff).
• One reading the seat accepts on the review's measurement: "carries a row policy" means the collection is empty per object and per operation, not per object. The object-level reading would let member_default's '*' write floor switch every default off for every baseline member. That defeats ruling E′ item 3 ("a new identity table joins by declaring its default").
• Rework: round 1 (6259617731). Two texts this PR made false are now true: spec(data): ObjectSchema declares an object's default row scope — the existing RLS policy shape minus object — applied when no held permission set carries a policy for it (#24164 ruling E′) #24338's pending note and the form ledger's omit reason. main was merged in by os-regen-merge.sh as a merge commit. Main's release 725a5b131 had moved the note to .changeset/pre/, and the edit follows the move.
• Gates on this head:
  • 33 checks succeeded and 7 were skipped by design: the roster set (Console Pin Gate, Dogfood Regression Gate, Dogfood Verify CLI, Packed-tarball smoke, Temporal Conformance), plus Auto Label and Check PR Size on the body-edit run.
  • Build Docs ran, since generated reference pages are in the diff, and passed. The five required contexts are green.
  • Locally, the dev derived 117 families on this head, ran all 117 (--ran: 0 NOT-MEASURED, 0 UNRUN), and 115 exited 0. The two exit-1 families are explained in the next item and the bullet after it.
• The one red check, Check Changeset, enters the queue red by design. The three conditions are:
  1. The script says it stays red in this case: scripts/check-empty-changeset.mjs, the DELIBERATE CORRECTION class, "this gate stays red either way". The changeset the foreign-changeset rule names is .changeset/pre/24338-object-default-row-scope.md.
  2. It never runs in the merge group: .github/workflows/pr-automation.yml triggers on pull_request only.
  3. This comment names the gate and the reason.
  • The confirmation the class asks for is review record 6260875372 on this same head. It quotes the rewritten bullet sentence by sentence and judges each one true against the code. It also finds that restoring the note from the merge base would republish three false sentences and one in a false tense.
  • The note's other lines, its level and its Clause-② are byte-identical to the merge base. The released next changelog text is not touched.
• Spec-lane declaration: 6260710063 on [PM seat] domain:spec · seat 2 — 🟢 zhuangjianguo · session_019oFY6Hi35J7atvgVFnmoaK #18549. It lists the spec-lane files, all prose, TSDoc, ledger or generated: no accept set in packages/spec moves. It went up before the queue, as rider 6256199121 asks.
• Accepted deviations:
  • The round-1 PR body was written by this seat from the dev's draft, under os-dev.md's one-write rule.
  • The merge commit's message is the script's own and carries no session trailer. It is not amended, since amend and force-push are ruled out.
  • pnpm check:platform-checklist exits 1 at this head's merge base (an ABSENT SYMBOL legacyGrantAnchorRetired in areas/access-security.json). That is outside this diff and outside per-PR CI. main has since fixed it in ec951e29e (docs(qa): re-point the platform-owner-email item's legacy-grant anchor at grantAnchorsPlatformStanding #24463): the symbol is no longer cited on main.
• Release scope: target:v18 was removed from the card by the epic seat's note 6259808442. This does not hold the landing.
• Out of scope, one line each:
  • The authoring-time lint half (RLS_PREDICATE_UNENFORCEABLE and org-axis rule ① walking defaultRowScope): filed lint: RLS_PREDICATE_UNENFORCEABLE walks only permissions[].rowLevelSecurity, so an ObjectSchema.defaultRowScope whose using cannot lower is caught only at runtime #24452. Triage placed it p2 domain:spec, after lint: a locale pack's picklists.<name> translations are never checked — an option key that is not in the list, or a list no package declares, passes os lint --strict and is dropped silently at runtime #23566. This answers the review's ③.1 escalation.
  • Removing the shipped sets' duplicated literals: the card has this seat file it after the pins hold. It is filed at landing, after platform-objects: the identity objects declare their default row scope (the literals the shipped sets copy today), and the registry refuses an extend contributor that loosens a platform object's default (#24164 ruling E′) #24341, which declares the real defaults.
  • The baseline byte-for-byte pin on the real declarations, and ruling item 4's extend rule: carrier platform-objects: the identity objects declare their default row scope (the literals the shipped sets copy today), and the registry refuses an extend contributor that loosens a platform object's default (#24164 ruling E′) #24341. A pointer goes there at landing.
  • Explain on a failing default reads "composes to DENY ALL" without naming the default, the same as for an authored policy in that state: Acceptance notes, accepted.
  • The review's optional rewording of "with one server warning": dropped. It is not owed, and the sentence is true per governed read.

---

Generated by Claude Code