Uh oh!
There was an error while loading. Please reload this page.
docs(security): RLS predicates SQL → canonical CEL + fix non-compilable examples - #2113
Merged
Conversation
…le examples After "RLS using → canonical CEL" (#2099) the docs/skills still taught the old SQL-ish grammar — which now misleads AI authors (the skills/docs were lying relative to main). Fix: - skills/objectstack-data/SKILL.md: drop "restricted grammar (not arbitrary CEL): field = current_user.x, IN(...), 1=1" — RLS predicates are now canonical CEL (==, in, comparisons, &&/||/!, == null), no subqueries/cross-object (compile error, ADR-0055); legacy SQL still compiles via the deprecated bridge. - protocol/objectql/security.mdx: "SQL-like" → CEL; all using/check examples to CEL; and fix three examples that NEVER compiled — an `IN (SELECT …)` subquery, a `current_user.region` (a non-exposed variable), and a `NOW()`/`AND` time window (functions aren't pushdown-able) — replaced with pre-resolved §7.3.1 membership sets / honest "do it in the app layer" notes. - guides/security.mdx, guides/metadata/permission.mdx, concepts/implementation- status.mdx: `=`/`IN` → `==`/`in` in prose + examples. Doc/skill-only. check:skill-docs in sync; no runtime change. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Uh oh!
There was an error while loading. Please reload this page.
This was referenced Jun 30, 2026
os-zhuang added a commit
that referenced
this pull request
Jun 30, 2026
…-build time (ADR-0081) (#2485) Wire the spec↔frontend react-block conformance check in as a baseline ratchet at the one place the registry-inputs manifest is produced for free — `scripts/build-console.sh`, right after it dumps `sdui.manifest.json`. Running it on every framework PR isn't worth it (the manifest only exists at console-build time); the ratchet catches NEW divergence there at near-zero marginal cost. - check-react-blocks-conformance.ts gains `--baseline <path>` (compare, report only regressions: a component exposing a NEW undocumented prop or a previously-present block vanishing) and `--update` (accept current as the new baseline). The soft spec-only signal is not gated. `--strict` exits 1 on regression. - packages/spec/react-conformance.baseline.json captures the accepted state (ListView frontend-only fields/options, ObjectChart data; rest clean after #2113/#2484). - build-console.sh runs the ratchet warn-only after the dump — never fails the console build, surfaces new divergence at the release point. - audit doc documents the ratchet + how to re-accept the baseline. Co-authored-by: Jack Zhuang <277994282+os-zhuang@users.noreply.github.com> Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
os-zhuang added a commit
that referenced
this pull request
Jun 30, 2026
Records the model that the spec↔contract↔conformance↔prop-gate work converged on (now implemented + merged across framework #2478/#2480/#2482/#2484/#2485/#2488/ #2489 and objectui #2113/#2115), so future contributors don't re-litigate it: - the spec zod schema is the protocol source of truth; the AI-facing contract is GENERATED from it (zero-drift), never hand-authored; - registry inputs are the designer palette (a curated subset) — spec-only is a soft signal, frontend-only is the actionable one; - React-interaction props (callbacks/controlled/binding escape-hatches) live in a thin overlay, not the spec; declaring a genuine binding there is how a frontend-only prop is closed (baseline now 0 frontend-only); - conformance is a build-time baseline ratchet (build-console.sh, warn-only), not a per-PR gate — the manifest only exists at console-build time; - authoring correctness is a hard gate at os validate (missing-required = error, typo = warning); and the dogfood golden page proves the chain closes. Captures the alternatives rejected (copy props into spec / per-PR hard gate / hand-authored contract / registry-as-source). Co-authored-by: Jack Zhuang <277994282+os-zhuang@users.noreply.github.com> Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Follow-up audit after #2099 (RLS using → canonical CEL): the docs and the objectstack-data skill still taught the old SQL-ish grammar, so they now mislead AI authors relative to main.
Fixes
skills/objectstack-data/SKILL.md(highest priority — it shapes AI output): drop "restricted grammar (not arbitrary CEL):field = current_user.x,IN(...),1=1". RLS predicates are now canonical CEL (==,in, comparisons,&&/||/!,== null); no subqueries/cross-object (compile error, ADR-0055); legacy SQL still compiles via the deprecated bridge.protocol/objectql/security.mdx: "SQL-like" → CEL; allusing/checkexamples → CEL; and fixed three examples that never compiled — anIN (SELECT …)subquery,current_user.region(a non-exposed variable), and aNOW()/ANDtime window (functions aren't pushdown-able) — replaced with pre-resolved §7.3.1 membership sets / honest app-layer notes.=/IN→==/in.Doc/skill-only ·
check:skill-docsin sync · no runtime change.🤖 Generated with Claude Code