Repository navigation
plugin-security: the raw-SQL read-scope provider (getReadFilter) does not apply the delegated organization-membership rule PR #25101 enforces at the operation prologue; measure reach first (detail withheld) #25106
Description
Filing gate ①, the security exception ("may expose data": measure reach first). The source is the isolated contract review of PR #25101 (#25063), boundary flag 1 of 6313542596, which escalated this to the seat as a data path, not probe parity. It is a source reading; reach is not measured. Filed by domain:services seat 2 (seat post #21118, os-support-ai, session session_01UmqzD97e14iws6hmVhgZ5y). ⛔ Not a claim. ⛔ Ungraded and unrouted: the grade and lane are triage's.
Disclosure: the maintainer's ruling recorded on #9387 (5323310017) applies. This card records only:
- that the reading exists, and where it lives;
- the governing text.
⛔ No probe, context shape, request or served value goes on this card, its PR or any comment.
Reader (who acts): triage grades the card. Then the lane that takes it measures reach FIRST, and fixes only if reach is shown.
Where it lives (origin/main at filing)
- The provider:
packages/plugins/plugin-security/src/security-plugin.ts:getReadFilter→computeDelegatedReadFilter. It is the raw-SQL read-scope provider the analytics service bridges to (ADR-0021 D-C). - The rule it does not mirror: PR fix(plugin-security)!: a delegated operation runs only in an organization the delegator's membership backs #25101 makes the delegated-principal prologue (
resolveOperationPrincipals) refuse every engine operation of an on-behalf-of context, on a walled posture, whose live active organization the delegator's membership does not back. It does this throughvetOrganizationClaim(ADR-0090 D10). The provider mirrors the middleware's layers, but not that prologue. - The reading: under one walled posture, the provider can answer a read scope for such a context where the engine's find path now refuses it. Its own doc promises lock-step between the find path and the raw-SQL path.
- The reviewer: "in-process only, the same population as plugin-security / objectql: an on-behalf-of insert by a crossing platform operator that names no organization may be stamped outside the delegator's organization set (source reading only; measure reach first) #25063; no door builds the shape"; "pre-existing and unchanged by PR fix(plugin-security)!: a delegated operation runs only in an organization the delegator's membership backs #25101".
- A possible shape, for the taker to confirm: the same
vetOrganizationClaimask answering the deny sentinel, at the point where the provider already mirrors the dangling-delegator refusal.
Governing text
- ADR-0090 D10: a delegated operation is bounded by the delegator's scope.
- ADR-0021 D-C: the raw-SQL read scope is the find path's scope.
- The provider's own lock-step doc.
Dedupe
Searched (semantic): getReadFilter computeDelegatedReadFilter delegated organization membership raw SQL read scope analytics. Hits: #20733, #24164, #21177, #21417, #21080, #20933, #20001, #5815, all closed. None is this reading. #5815 (getReadFilter missing the controlled_by_parent half) is the nearest: same provider, different rule.
Dedupe words: getReadFilter delegated organization not backed · raw SQL read scope on-behalf-of vetOrganizationClaim · computeDelegatedReadFilter prologue parity.
Activity
objectstack-fleet commentedon Oct 21, 2026
Serial after #24932 ·
domain:servicesseat 2 (seat post #21118) ·session_01UmqzD97e14iws6hmVhgZ5y· 2026-10-21T13:55Z. ⛔ Not a claim, no label change.6317834763) rewrites thecontrolled_by_parenthalf ofgetReadFilterandcomputeDelegatedReadFilterinsecurity-plugin.ts. That is the provider this card names.computeDelegatedReadFilteron themainthat carries plugin-security: a controlled_by_parent child's read loads every readable master id with no limit (twice per request), so its CPU grows with the master table and the read answers 500 "too many SQL variables" past ~32.8k masters #24932's merge, not on the filing-timemain. The reach-first order and the skills: five principle gaps the #9296 wave exposed in checklist-test / checklist-author / dogfood-verification #9387 disclosure rule are unchanged.objectstack-fleet commentedon Oct 21, 2026
Claim: PM loop round 1 (re-seated term) · 2026-10-21T14:53Z · p2,
domain:services, reach-first under the disclosure ruling (#93875323310017)Session:
session_01UmqzD97e14iws6hmVhgZ5y(the dispatching seat; the dev is amode:subagentrun of this session, told apart by its branch)Account:
os-support-ai(the seat's linked user asGET /useranswers it; always the card's assignee)Branch:
claude/issue-25106-read-scope-org-vetWorktree:
objectstack-issue-25106Domain:
domain:servicesSeat:
domain:services#2File surface: measure reach first. Only if reach is shown:
packages/plugins/plugin-security/src/security-plugin.ts, the delegated prologue ofgetReadFilter/computeDelegatedReadFilter(:5969/:6092atedcc8ceae) and nothing else in that file, plus the plugin's tests and.changeset/. ⛔ Not the engine middleware's prologue (resolveOperationPrincipals, which PR #25101 already changed). ⛔ Notservice-analytics.Container & model:
M,mode:subagent,model: opus(TIER_DEFAULT;dispatch-gates --tieron this surface: "no path-derived mandate")Clause-②: no — expected: if reach is shown, the provider answers the deny sentinel where the operation prologue now refuses. That is a narrowing of a runtime read scope, not a published accept set. If the fix lands, it owes a review at
CONTRACT_REVIEW_TIERbefore the queue, as #25063's did.Responsibility:
plugin-security's computeDelegatedReadFilter (this lane's code) mirrors the middleware's layers but not the delegated prologue PR #25101 added | the operation prologue resolveOperationPrincipals → vetOrganizationClaim already refuses on the find path; the raw-SQL provider is the one door that does not mirror it | reach not measured: the review called it in-process only, with no door that builds the shape; the dev measures it firstThread-read: 6317847384
Serial constraints cleared: supersedes this seat's note
6317847384. #24932 is no longer in flight: it is inneeds-user-decision(6318800595), with no branch commits. So this card goes first ingetReadFilter/computeDelegatedReadFilter. #24932's switch, when it is re-dispatched, mergesmainand reads this change (its dev already priced it:6318648840deferred_card_repricing). In flight in this lane: #25096 / PR #25109 (plugin-auth), which is disjoint. Seat 1's queued #25095 is a different region (the detail write gate). No open PR touchessecurity-plugin.ts.objectstack-fleet commentedon Oct 21, 2026
pm:dispatched→pm:queue, released before any measurement ·domain:servicesseat 2 (seat post #21118) ·session_01UmqzD97e14iws6hmVhgZ5y· 2026-10-21T14:59Z · Thread-read: 6319041191Release:
session_01UmqzD97e14iws6hmVhgZ5y· Cause: the maintainer's word in this session's chat, verbatim: 「你可以下班了」 and then 「当前任务不用开发了」 (sign off now; the current task is not to be developed). The seat stopped its dev run · Goes to:pm:queue; this write clears the assignee.claude/issue-25106-read-scope-org-vetis empty (atmainedcc8ceae); the next taker starts from zero and may reuse or replace it.5323310017). The detail is boundary flag 1 of PR fix(plugin-security)!: a delegated operation runs only in an organization the delegator's membership backs #25101's review6313542596. Its order relative to plugin-security: a controlled_by_parent child's read loads every readable master id with no limit (twice per request), so its CPU grows with the master table and the read answers 500 "too many SQL variables" past ~32.8k masters #24932 (nowneeds-user-decision,6318800595): whichever lands second mergesmain.