P0: collectRLSPolicies silently strips authored org-scoped RLS policies when org-scoping is inactive (ADR-0105 F1 → D3)

[os-zhuang]

Problem

collectRLSPolicies (packages/plugins/plugin-security/src/security-plugin.ts ~L2785-2793) drops any RLS policy whose using expression contains the substring current_user.organization_id whenever org scoping is inactive (!this.orgScopingEnabled):

if (
 !this.orgScopingEnabled &&
 policy.using &&
 policy.using.includes('current_user.organization_id')
) {
 continue;
}

The comment states the intent: strip the platform's own wildcard tenant policies in single-tenant deployments. But the substring match also swallows app-authored policies that legitimately reference current_user.organization_id. A declared, authored security policy is silently unenforced — exactly the ADR-0049 ("no unenforced security properties") defect class.

Verified on main (2026-07-27). This is finding F1 of ADR-0105; the ADR marks it P0, shipping in the open edition independent of the rest of the ADR (decision D3).

Fix direction (ADR-0105 D3)

• Stop substring-matching. Tag the platform's own wildcard tenant_isolation policies with a provenance flag (or match on object === '*' ∧ shipped-by-default), and strip only tagged policies when isolation is inactive.
• An authored policy referencing an unavailable context variable follows the existing availability path: fails closed at resolution, surfaced by the isSupportedRlsExpression authoring lint. It is never silently dropped.

Acceptance

• Authored policy with current_user.organization_id in using survives collection in a deployment without org scoping (fails closed at resolution, with lint surfacing — not dropped).
• Platform wildcard tenant policies are still stripped when isolation is inactive (no behavior change for the intended case).
• Conformance-matrix row: authored-policy-survival (per ADR-0105 Phase 0).
• No visibility delta in the authz-matrix-gate snapshot beyond the intended correction.

Refs: ADR-0105 (F1/D3), ADR-0049.