fix(plugin-security)!: an external object that states no organization scope reads as empty for every caller, the platform owner included - #30146

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/plugin-security, touching 1 documentable anchor(s). ⚠️ 1 changed file(s) yielded no anchor (packages/plugins/plugin-security/src/platform-owner-wall-bypass.ts), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files.

2 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/permissions/permissions-matrix.mdx (via computeLayeredRlsFilter (symbol, a top-level function))
• content/docs/permissions/sharing-rules.mdx (via computeLayeredRlsFilter (symbol, a top-level function))

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 1b34afcc82cbf730a4298b8e01f32f3705e88a26 && git checkout 1b34afcc82cbf730a4298b8e01f32f3705e88a26
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 55337f4ce35dbe62434b23517547a0b5052b936c 471f23549959eeb65866de78dc14eaf577262e68 && git checkout -B drift-repro 55337f4ce35dbe62434b23517547a0b5052b936c && git merge --no-ff 471f23549959eeb65866de78dc14eaf577262e68

node scripts/docs-audit/affected-docs.mjs --json 55337f4ce35dbe62434b23517547a0b5052b936c

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 55337f4ce35dbe62434b23517547a0b5052b936c → pass the list as
args.docs, on the commit named under Which tree this was computed on.

security#1 · os-justin · session_01QSeKYn5CmmdShCJifm6WYj

Contract-review-claim: session_01QSeKYn5CmmdShCJifm6WYj · head 471f235 · 2026-11-04T16:33Z

security#1 · os-justin · session_01QSeKYn5CmmdShCJifm6WYj

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 471f23549959eeb65866de78dc14eaf577262e68
Local-runs: none
Scope: packages/plugins/plugin-security/src/security-plugin-rls-filter.ts, packages/plugins/plugin-security/src/platform-owner-wall-bypass.ts, packages/plugins/plugin-security/src/platform-owner-wall-bypass.test.ts, packages/runtime/src/plugin-driver-external-object.spike.test.ts + packages/core/src/security/tenant-layer0-verdict.ts, packages/plugins/plugin-security/src/tenant-layer.ts, packages/plugins/plugin-security/src/external-organization-scope.ts, packages/plugins/plugin-security/src/security-plugin.ts (getObjectSecurityMeta, the read-filter and write-wall callers), packages/plugins/plugin-security/src/security-plugin-authz-middleware.ts, packages/plugins/plugin-security/src/explain-engine.ts, packages/spec/src/migrations/entries/semantic/18.external-object-organization-scope-declared.ts, .changeset/sec-hardening-g-external-object-organization-scope.md

Inputs: the PR body, its file list, the net diff against the merge base 987ff33b88, the check-runs on the head, and the ruling (maintainer, 2026-11-04, option A). Face: narrowing (Clause-②: no (narrowing) at line start in the PR body and the changeset), so the floor is every path of the diff outside the prose faces; the scope above adds the code the hunks cite.

Check-runs on the head: every check is completed and green or an expected skip; none is still running. Check Changeset is green (the changeset is this PR's own). Lint & Repo Gates is green, which includes the ADR-0087 registration gate re-validating the marker.

① Derived judgments

1. The stand-down condition catches exactly the undeclared-external deny and nothing else. deniedForUndeclaredExternalScope is verdict.kind === 'deny' && input.externalOrganizationScopeUndeclared === true. Read in computeTenantLayer0Verdict (packages/core): the ladder answers none for the single posture and for a tenancy-disabled object before it reads the flag, and when it does read the flag set it returns deny ahead of every other rung. So whenever the flag is set under a wall the deny is that rung's, and whenever the deny is another rung's (the org-less session under isolated, the empty access set under group) the flag is unset, because externalOrganizationScopeOf answers null for every local object and walled/shared for an external object that declared. The two facts are therefore equivalent to "this deny is the configuration-defect deny", and the condition is exact. Tested on the cases asked:
   • local objects: flag unset, the owner still crosses the equality, the union and the org-less deny (test CONTROL, local object);
   • declared-walled external: walled, flag unset, the owner crosses, a member keeps the equality (test CONTROL);
   • an org-less owner on an undeclared external: the undeclared rung returns before the org-less rung, so the deny is the undeclared one and stands (pinned);
   • group and isolated: pinned; single: none before the flag, the branch is never entered (CONTROL);
   • delegated reads: security-plugin-authz-middleware.ts computes the delegator's own layered filter through the same function, so a delegator who is the owner meets the stand-down too;
   • explain, count and aggregate: explain-engine.ts and security-plugin-explain-access.ts call the same function, and every operation other than insert/update/delete is read-class in it, so count and aggregate take the same branch;
   • by-id reads: getReadFilter goes through computeRlsFilter into the same function; the by-id write pre-image carries the write operation and was walled already.
     isVerifiedPlatformOwnerSession has one consumer in the tree, this branch, so there is no second door for the owner's crossing to lift the verdict elsewhere. The tenant-field-unenforceable declaration is folded into the same flag by externalOrganizationScopeIsUndeclared, so a foreign tenancy.tenantField on an external object meets the same stand-down; that is the rule the boot refusal and the D3 entry already state for it, and the PR's prose ("states no organization scope the wall can enforce") covers it.
2. The recorded verdict is honest. When the stand-down holds the function returns the computed { layer0: RLS_DENY_FILTER, tenantLayer0Verdict: { kind: 'deny' }, crossedByPlatformAdmin } untouched; crossedByPlatformAdmin is false there because it requires kind === 'none'. The verdict the engine reads and the filter the query carries are the same deny, so a reader learns nothing from a wall that still stands, and no crossing is logged (pinned: no bypass event, no sys_user read). The ADR-0095 D3 platform-admin crossing was already behind the undeclared rung on main (feat(plugin-security)!: under a walled tenancy posture every external object states its organization scope #29867), so this diff makes the owner's crossing consistent with it rather than introducing a new ordering.
3. The ablation is the right instrument and read the right way: replacing the condition with true reddened the three owner cases and (h5c) and nothing else; restored, all green with a clean tree. The pins fail for the reason the PR claims.
4. The ADR-0087 marker not-required (already-registered external-object-organization-scope-declared) is right. The entry exists at the merge base and at the head (packages/spec/src/migrations/entries/semantic/18.external-object-organization-scope-declared.ts), which is the category's own test (named id resolves at HEAD and already existed at base). Its replacement prescribes the three declarations, which is the whole remedy here; nothing an author writes changes, so no new entry. The changeset carries exactly one marker, both declaration lines and the BREAKING section with who moves and the fix, as AGENTS.md step 3 requires of a breaking changeset.
5. §6 holds. Title, body, changeset and every test name state the rule ("reads as empty for every caller, the platform owner included", "the deny sentinel", "no crossing is logged"). No advisory id, no attack wording. The only "bypass" tokens are pre-existing identifiers (platform-owner-wall-bypass.ts, PLATFORM_OWNER_WALL_BYPASS_EVENT) carried over, not new wording.
6. One prose claim in the PR body is inaccurate, not in the changeset. The body says the texts "already on main" include ADR-0015 §10; the §10 amendment is in docs(adr): under a walled tenancy posture every external object states its organization scope (ADR-0015 §10) #29866 (docs, Tier H), still open and unmerged. The two code texts cited are on main (the D3 entry's "every read is denied at Layer 0"; the once-warning), and the changeset's "ADR-0015 §10 as amended" is the same citation the already-merged feat(plugin-security)!: under a walled tenancy posture every external object states its organization scope #29867 changeset and the D3 entry use. Correction for the body, not a must-fix.

② Semver level

patch on @objectstack/plugin-security: Metadata-protocol: none is true (the three declarations an author writes are the ones main accepts, unchanged), and a non-protocol breaking change ships patch and keeps its BREAKING banner and ADR-0087 disposition (AGENTS.md step 3). Clause-②: no (narrowing) is true: nothing is widened, and one principal's reads narrow. Level, lines and marker agree.

The dev's open question, A or B: A — keep ! and no (narrowing). The arm's reference is the published accept set (clause2-line header: "a diff that NARROWS a published accept set"), and the published release is @objectstack/plugin-security@18.3.0 (tag on main), which carries no undeclared-external verdict; there, the owner's read of such an object crossed the wall. On main after #29867 the #12974 crossing still lifted the undeclared deny for the owner, which is what the three owner cases and (h5c) measure under ablation. So this PR, not #29867, is the diff that takes the owner's published read away; the unreleased #29867 note describes the object's deny without naming the owner, and a note that is pending does not turn a later narrowing into a non-change. Two BREAKING notes in one release, each naming who moves, is the honest CHANGELOG. The battery the ! owes was run at the head's source (417 files, 3462 passed). Under B the changeset would ship a narrowing with no banner, which is the shape the arm exists to prevent.

③ Boundary flags

• Dev open question (A vs B): answered above, A.
• The ADR-0015 §10 text this PR and the D3 entry cite lands through docs(adr): under a walled tenancy posture every external object states its organization scope (ADR-0015 §10) #29866, Tier H, by the maintainer's hand; the ruling of 2026-11-04 (the owner included) is newer than that draft, so the maintainer may want the §10 text to name the owner when landing it. Not owed by this PR.
• Skills-docs: none stands on the two code texts on main; the body's "already on main" sentence should drop the ADR until docs(adr): under a walled tenancy posture every external object states its organization scope (ADR-0015 §10) #29866 lands (prose correction for the seat's ACCEPT).
• The spike file's test-budget header line is updated for the seventh (h) case; the budget value is unchanged.
• The author is objectstack-fleet[bot] (relay); no out-of-relay login to name.

④ Design judgment

• security-plugin-rls-filter.ts against the ruling: the stand-down is one condition at the one crossing, keyed on the verdict and the input fact rather than on the object's shape re-derived, so it cannot disagree with the ladder that produced the deny; the owner probe is not consulted, so a stood-down read costs no sys_user row. The recorded verdict stays deny. Holds against the ruling (option A) and against the texts on main that already state the rule for every caller.
• platform-owner-wall-bypass.ts header: names the one verdict the read crossing does not lift, pointing at where the stand-down lives. Holds.
• Narrowing against the published spec on main: it does not take a declared capability away from a metadata author; it makes the platform's own refusal (the D3 entry's "every read is denied at Layer 0") real for the one principal it had not reached. The migration is the existing entry's remedy.
• Tests: the shared harness gains an optional schema instead of a new file, the new describe sits beside the crossing's existing pins, and each case names the rule; the controls (declared-walled, local, member, single) are the cases that make the stand-down's exactness a measurement rather than a reading. The spike's (h5c) checks the deny reaches the remote on the real isolated boot and keeps the declared-walled crossing as its control. The scenario the PR is accepted against is covered.

Implemented-by: claude/sec-hardening-s
Reviewed-by: session_01QSeKYn5CmmdShCJifm6WYj

VERDICT: PASS

security#1 · os-justin · session_01QSeKYn5CmmdShCJifm6WYj

席位核对

ACCEPT · head 471f23549959eeb65866de78dc14eaf577262e68 · 2026-11-04T17:15Z

• Shape: 5 files, +173/−5. Not governed. Under 3000. Patch for plugin-security, with !, Clause-②: no (narrowing), Metadata-protocol: none, and ADR-0087 not-required (already-registered external-object-organization-scope-declared).
• Rule held (security-channel ruling of 2026-11-04, option A): under a walled tenancy posture, an external object that states no organization scope reads as empty for every caller, the verified platform owner included. The owner's crossing stands down on that one deny and on nothing else. The recorded verdict stays deny.
• Contract review: comment 6636959649. Served-tier: CONTRACT_REVIEW_TIER. Head-sha equals this head. VERDICT PASS, no must-fix. The dev's open question is answered A: keep ! and the narrowing arm.
• Check-runs at this head (latest per name): 15 skipped, 33 success. mergeable_state: clean.
• Gates: dev ran dispatch-gates --ran: 60 derived, 57 run, 3 NOT MEASURED, all three green in CI's lanes. Full plugin-security suite: 5273 passed. Spike: 20/20. Ablation: red, then restored green. Full dogfood battery at the head's source: 417 files, 3462 tests.
• Seat edit: the body's "already on main" sentence now says the ADR-0015 §10 amendment lands in docs(adr): under a walled tenancy posture every external object states its organization scope (ADR-0015 §10) #29866 (Tier H, open). This was the review's prose correction.
• Release note for the maintainer: the next release must carry this PR together with feat(plugin-security)!: under a walled tenancy posture every external object states its organization scope #29867.
• Landing: ready, then auto-merge.