The `sharing-rule-runtime-variable-condition` fix-hint sends authors to RLS to widen a private object, but the layers are AND-composed — the advice cannot work on the case that most needs it

[os-justin]

Split out of #14103 by the triage seat. That card asks for a new capability (record-relative sharing recipients) and is a maintainer decision; this half is a defect in shipped guidance and is fixable today, independent of that ruling. ⛔ Filing separately so a true defect does not sit behind a feature decision.

Filed unassigned. Graded and routed by triage (domain:devx · p2 · Bug).

The hint, verbatim on origin/main (66ecc50a)

packages/lint/src/validate-sharing-rule-enforceability.ts, the SHARING_RULE_RUNTIME_VARIABLE_CONDITION finding:

A criteria sharing rule is MATERIALISED: the seeder compiles ONE static criteria_json per rule and the evaluator writes sys_record_share rows from it, so there is no "current user" for the condition to read. Express per-user access with the mechanism that runs per request instead — an RLS policy on a permission set (rowLevelSecurity[].using, where current_user.* IS resolved), or the record-ownership path. Keep this rule for the part of the predicate that is a property of the RECORD and name the audience through sharedWith.

The first two sentences are correct and valuable. The bolded remedy is unsound for a private object, which is the sharing model under which an author is most likely to hit this rule.

Why it cannot work — measured, not argued

Security layers are AND-composed. packages/plugins/plugin-security/src/security-plugin.ts:4416:

return andComposeLayers(andComposeLayers(filter, cbpFilter), sharingFilter) ?? undefined;

The file states the same contract in prose at :3956 — getReadFilter promises "the same filter the engine middleware AND-s into" the query.

⇒ the RLS layer (filter) is AND-ed with the sharing layer. On a private object the sharing layer has already excluded the row. An AND term can only remove rows; it can never add one back. So an RLS policy is structurally incapable of granting read access to a row the sharing layer withheld — no matter how it is written.

⇒ the hint tells an author, at the exact moment they are trying to widen access on a private object, to go use a mechanism that cannot widen access on a private object.

Why this is expensive rather than merely untidy

⭐ The advice is not inert — it is attractive. An author who follows it writes an RLS policy that lints clean, passes every gate, and grants nothing. The failure is silent and at the security boundary, where "I wrote the rule and it did not take effect" is the worst possible feedback shape.

⭐ It has a measured victim. #14103 records an application author following exactly this path on duly_log_entry.visibility == 'manager', finding it could not work, and shipping the grant unauthored / fail-closed instead. The advice cost a real implementation attempt.

⚠️ And the neighbouring temptation is worse than doing nothing: the one recipient type that resolves to managers at all is position, which shares every matched row with every holder of that position tenant-wide — the skip-level, the manager two teams over. An author steered off RLS and onto position writes an over-broad grant that lints clean. ⇒ this hint sits one step upstream of a real disclosure shape.

Scope — prose only, ⛔ not the mechanism

This card is only the guidance defect. ⛔ It does not ask for record-relative recipients (that is #14103, a maintainer decision), and ⛔ it does not ask to change AND-composition (that is the correct and deliberate design).

Suggested shape:

1. Qualify the RLS remedy by sharing model — it is sound advice on public_read / read_write objects where RLS narrows from an open baseline, and unsound on private, where the sharing layer is already restrictive and AND cannot widen it.
2. For the private case, say what is actually true: the only doors that widen a private object are the ADR-0057 depth scopes (which widen by owner, not by predicate) and a sys_record_share row (which only a criteria sharing rule writes) — and name Sharing rules cannot name a RECORD-RELATIVE recipient (the owner's manager; the value of a user field on the matched record), and no other declarative surface can widen a private object either #14103 as the open gap if neither fits.
3. ⛔ Do not delete the hint. The first two sentences explain why the condition is rejected and are the most useful part of the diagnostic.

Acceptance: the hint text distinguishes the sharing models; a test pins the private-case wording so it cannot silently regress to the current advice.

Related — same root mechanism, different surface

⭐ #6736 (open, pm:on-hold, domain:services) — "Authored RLS update-wideners are silently ineffective on the bulk write path — buildWriteFilter ANDs them away (fewer rows, no error)". That is the same truth on the write path: an authored RLS widener is AND-ed away. ⇒ "RLS can widen" is a misconception the platform has now produced defects around twice, in two layers. Worth the two cards knowing about each other; ⛔ not a duplicate — different surface (read vs bulk write), different artefact (a lint hint vs runtime behaviour).

• [finding] adding an RLS narrowing to member_default silently narrows ORG ADMINS on the default single posture — both of their widening mechanisms are absent there #8241 — RLS narrowing on member_default silently narrows org admins; same "layers compose in a direction authors do not expect" family.
• Sharing rules cannot name a RECORD-RELATIVE recipient (the owner's manager; the value of a user field on the matched record), and no other declarative surface can widen a private object either #14103 — the capability gap this was split from.

⭐ Family note: this is the tenth member of the "false prose is more expensive than missing prose" class the triage seat has been tracking (#13893 · #13916 · #13984 · #13988 · #14006 · #14011 · #14019 · #14039 · #14093), and one of the few with a measured victim rather than an inferred one.

Dedup

Searched sharing-rule / RLS / AND-composition / private-object-widening across open and closed: 14 hits, none this. Nearest are #6736 and #8241 above (same mechanism, different surfaces) and the #4983/#4984/#4989/#5009 cluster (all about validateOrgAxisRedLines reading keys the spec does not declare — a different defect). Positive control in the same pass: the query returned #14103 itself and 13 other genuinely sharing/RLS-related cards, so the zero on this subject is a reading, ⛔ not a broken query.

[baozhoutao]

Claim:

• Session: session_01WLJQhde67SeTccsmnBVarV (devx execution seat, seat post [PM seat] domain:devx @ objectstack — 58 PRs merged 1 rework (#15492, CI-caught) · lane 70→60 · decision box 1 (#15341) · 5 devs live + 5 PRs queued/armed · #13799 population exhausted (5 held) · main push-CI green #6023)
• Branch: claude/issue-14234-sharing-hint-private-objects
• Worktree: dedicated per-task worktree off origin/main (dev creates it; no shared-checkout edits)
• Domain: domain:devx
• File surface: packages/lint/src/validate-sharing-rule-enforceability.ts (hint prose only) + a test pinning the private-case wording + changeset. ⛔ Prose-only card: no mechanism change, no AND-composition change, no new recipients (Sharing rules cannot name a RECORD-RELATIVE recipient (the owner's manager; the value of a user field on the matched record), and no other declarative surface can widen a private object either #14103 is the capability half and stays a maintainer decision).
• Container & model: mode:subagent, claude-opus-5. Tier readout (dispatch-gates --tier, derived): "Model tier — no path-derived mandate … The tier stays the PM's per-card judgment call (floor sonnet · default opus · ceiling fable)." PM judgment: default opus.
• Clause-②: path limb not engaged; content limb NOT engaged — diagnostic prose change only, accept/reject behaviour of the rule is explicitly out of scope on the card.
• Serial constraints: cleared. Same package as the objectstack validate and build accept a dataset whose base object, include path and dimension/measure field paths all name nothing — the same walker already resolves date-macro tokens on the identical node #14105 family but a disjoint file; no queued card shares this hot file.

---

Generated by Claude Code

[baozhoutao]

os-dev-report

{
 "issue": 14234,
 "status": "done",
 "premise_still_valid": true,
 "branch": "claude/issue-14234-sharing-hint-private-objects",
 "pr": "https://github.com/objectstack-ai/objectstack/pull/14269",
 "files_changed": [
 "packages/lint/src/validate-sharing-rule-enforceability.ts",
 "packages/lint/src/validate-sharing-rule-enforceability.test.ts",
 ".changeset/lint-sharing-rule-rls-hint-by-sharing-model.md"
 ],
 "summary": "Premise re-verified on fresh origin/main before editing: the SHARING_RULE_RUNTIME_VARIABLE_CONDITION hint still carried the unqualified RLS remedy, and the AND-composition evidence still read as cited (security-plugin.ts:4416 andComposeLayers(andComposeLayers(filter, cbpFilter), sharingFilter); getReadFilter prose ~:3952). Added a third leg the PM asked for: the sharing-model vocabulary was taken from the spec, not the card - ObjectSchema.sharingModel is z.enum(['private','public_read','public_read_write','controlled_by_parent']), so the card's 'read_write' shorthand is really 'public_read_write'. The hint now splits its remedy on sharingModel: RLS narrows and is correct on public_read / public_read_write (buildReadFilter constrains 'private' only), and is structurally incapable of widening a private object because an AND term can only remove rows; for the private case it states the two real doors (ADR-0057 D1 depth scopes readScope/writeScope widening owner_id IN (...), and a sys_record_share row only a criteria rule writes), warns that 'position' recipients resolve tenant-wide (over-broad grant, never offered as a remedy), and names the capability gap in words. The MATERIALISED explanation sentence is preserved byte-for-byte. No mechanism change, no AND-composition change, no new recipients.",
 "tests": "All measurements at final head 3e4d2d741. (1) pnpm --filter @objectstack/lint test -> 'Test Files 88 passed (88) / Tests 2482 passed (2482)'. (2) Ablation proving the pin is load-bearing: restored the shipped wording; mutation confirmed ON DISK by anchored grep -c on BOTH the injected text (1) and the deleted text (0) plus git hash-object 9fcf7eec != HEAD blob 6c70f1e5; result 'Tests 7 failed | 35 passed (42)' - the unqualified-RLS leg, AND-composition leg, widening-doors leg, position warning, gap leg and BOTH vocabulary legs went red, while the verbatim-explanation leg correctly stayed green (that sentence is preserved in both wordings). Restore proven by observation, not exit code: hash back to 6c70f1e5 and empty git diff HEAD. No rebuild needed for the ablation - the test reaches the rule via a relative specifier vitest resolves to src/; only the spec vocabulary leg reads dist/, untouched by the mutation. Trap-guarded with absolute paths. (3) pnpm lint (full repo eslint . --no-inline-config) -> exit 0, run IN FULL, no narrowing declared. (4) dispatch-gates --repo objectstack-ai/objectstack --commands derived 34 families from its own change set (30 by path + 6 by kind, 2 shared); all run: 33 green, 1 NOT MEASURED. (5) pnpm check:type-check-debt green only AFTER building the workspace closure (turbo run build 70/70); its pre-build exit 3 was read as NOT MEASURED, not a pass. (6) pnpm --filter @objectstack/lint typecheck exits 0 but is NOT MEASURED for the new test file - packages/lint/tsconfig.json excludes **/*.test.ts, confirmed by --listFiles (0 hits); type-checked separately via a probe config including tests: 0 errors in either file I touched.",
 "checks_run": {
 "head_measured": "3e4d2d741",
 "families_owed": 34,
 "green": 33,
 "not_measured": [
 "check-test-completeness (exit 3 - parses a saved `turbo run test` log only CI produces; its own text says exit 3 is not a finding and not a red)"
 ],
 "red_then_fixed": [
 "pnpm check:doc-authoring - red on the '#14103' tracker id in RUNTIME STRING PROSE (maintainer ruling 2026-08-12). Took the gate's own prescribed remedy: gap described in words in the message, tracker anchor moved to an adjacent // comment. Green after."
 ],
 "repo_wide": "pnpm lint run in full, green"
 },
 "mcp_calls": 6,
 "open_questions": [
 {
 "question": "The card says 'the first two sentences stay' but the remedy IS the second sentence, so both requirements cannot hold literally. I kept the opening MATERIALISED: sentence byte-for-byte (the card's own justification is that those sentences 'explain WHY the condition is rejected', which is that sentence, two clauses across its colon) and qualified the remedy sentence, which is what the card is about. The trailing 'keep this rule for the RECORD part / name the audience through sharedWith' sentence is also kept, as it was never the defect.",
 "options": [
 "A - as shipped: preserve the WHY sentence verbatim, qualify the remedy sentence (the only reading under which the card is self-consistent)",
 "B - preserve sentences 1 and 2 literally, which would leave the defective unqualified RLS remedy in place and close nothing"
 ],
 "recommendation": "A. B is self-defeating - it preserves the exact sentence the card was filed against. Flagged rather than buried because it is a reading of the card's wording, not a free choice."
 },
 {
 "question": "The card asks the hint to 'name #14103 as the open gap', but `check:doc-authoring` reds on a tracker id in runtime string prose under a maintainer ruling (a runtime message reaches authors and generated surfaces, none of whom can resolve a bare issue number).",
 "options": [
 "A - as shipped: describe the gap in words in the message, keep the #14103 anchor in an adjacent // source comment (the gate's own prescribed remedy)",
 "B - add a baseline entry to scripts/doc-authoring-prose-id.baseline.json to admit the id",
 "C - drop the gap mention entirely"
 ],
 "recommendation": "A. B is explicitly MAINTAINER-ONLY per the gate's own text (it weakens a shrink-only ratchet) and I did not take it; C loses information the card wanted authors to have. A satisfies both the card's intent and the ruling."
 }
 ],
 "out_of_scope_findings": [],
 "followups_filed": []
}

Notes on the two empty finding lists, so their emptiness is a reading rather than a silence:

• The one candidate I found — packages/lint/tsconfig.json excluding **/*.test.ts, leaving 7 test files carrying type errors no tsc program reads — is already ledgered: @objectstack/lint has an itemized, shrink-only TEST_DEBT entry (16 errors, per-file breakdown naming exactly those files, tracking issue [P2] framework: 66 个包用 tsup 构建、无人做类型检查 —— 实测 18 个包共 380 处 code-tier 错误(#4118 的 framework 侧对应) #4311), and check:type-check-coverage is green on it. Filing it would have been a duplicate of a tracked, managed condition.
• No dedup search was spent beyond that, because no new finding survived triage.

⛔ Draft PR, not marked ready. CI convergence is the PM's leg per the dispatch contract — gate status at report time is whatever CI has reached; the 34 derived families were run locally and are recorded above.

---

Generated by Claude Code