ISecurityService gains a fail-closed authored-row-write verdict (contract + plugin-security implementation) — #5493 ruling, step 1

[os-zhuang]

Part of #5493 (maintainer ruling 2026-08-08, recorded in #5493 comment 5226377985 and the chat ruling it links: Q1 = A, Q2 = A1).

Why (one measurement carries the whole card)

#5493's fix requires the sharing middleware to defer, before hard-refusing a by-id write, to "an app-authored RLS update-widener admits this row by declaration". No reachable surface answers that today, and the cheap proxy is measurably a security hole: probe E-A (#5493 comment 5226364929) shows a creator-but-no-longer-owner is admitted by the platform created_by floor and refused by sharing with an envelope byte-identical to #5493's — a deferral keyed on "composed RLS admits" would hand transferred records back to their former creators. Separating the two requires policy provenance (isPlatformOwnershipFloorPolicy), which is deliberately private to plugin-security (platform-ownership-policies.ts, ADR-0105 D3 keying).

What (ruled shape — Q1 = A, Q2 = A1)

packages/spec/src/contracts/security-service.ts (ISecurityService) gains a verdict-shaped, by-id method:

• checkAuthoredRowWrite(object, recordId, operation, context) returning 'admit' | 'abstain' (exact name/signature per contract conventions — implementer's call, trade-offs in the PR body);
• admit iff at least one applicable non-floor (app-authored) RLS policy matches the row for this operation;
• abstain in every other case — including a missing method, an unresolvable probe, or a throw. Fail-closed: a deployment without this method behaves byte-for-byte as today. (Same discipline feat(sharing): ISharingService 的每行写判定补三态(放行/不表态/拒绝)(#6428) #6564 pinned for SharingWriteVerdict: a failure is never a widening.)
• packages/plugins/plugin-security/src/security-plugin.ts implements it on the registered service, reusing the private provenance split fix(plugin-security): enforce both declared write-wideners; the platform baseline becomes explicit-allow (#5492, #5491) #6684 landed (computeRlsFilter internals / RlsFilterOptions.dropPlatformOwnershipFloor / platform-ownership-policies.ts) — no second implementation of RLS evaluation anywhere.
• Semantic pin the implementation must carry (the E-A hole, as a test): a principal matching only the platform floor (creator of a since-transferred row, no authored policy) gets abstain, never admit.
• Q2 note, ruled: verdict-shaped by-id ONLY. The bulk-path half of the family is deliberately excluded and tracked separately (see the sibling card filed alongside this one); do not widen this surface toward filters.

Ordering (contract-first, the #6428 chain shape)

This card is the head: this lands → #5493 step 2 (plugin-sharing consumption + the control-pin flip in row-write-widener-composition.test.ts) dispatches in the identity lane. #5493 carries Blocked-by: pointing here.

Boundaries

• ⛔ No plugin-sharing edits (that is On objects that carry sharing rules, sharing middleware answers FORBIDDEN before RLS update-wideners are consulted — the identical widener works on rule-less objects #5493 step 2, identity lane).
• Two-seat surface by nature (spec contract + plugin-security implementation). Precedent for keeping them in ONE PR to avoid a declared-but-unimplemented window: ISharingService 写判定补三态(放行/不表态/拒绝)—— #5492 裁决 B 案的 step1,二态 canEdit 已实测产出 fail-open #6428 (triage designated a single claimant via the cross-domain exception path). Filed by the identity seat per the cross-seat transfer protocol; packages/spec has one owner (domain:spec seat) — routing labels left to the triage seat.

[os-zhuang]

Triage: domain:spec + target:v17 added (pm:queue kept as filed), with a cross-domain exception designation.

• Classification: ruled execution card (maintainer 2026-08-08, Q1 = A / Q2 = A1 on On objects that carry sharing rules, sharing middleware answers FORBIDDEN before RLS update-wideners are consulted — the identical widener works on rule-less objects #5493) — the ruling is made, so this goes to the queue, not the decision box.
• Routing anchor (read, not guessed): the head of the change is the contract — packages/spec/src/contracts/security-service.ts (ISecurityService at :150 on origin/main @ 3172831; checkAuthoredRowWrite confirmed absent repo-wide, so the surface is genuinely new). Contracts are domain:spec (acceptance-face change: the contract set grows a method). Implementation half lands in packages/plugins/plugin-security/src/security-plugin.ts reusing the fix(plugin-security): enforce both declared write-wideners; the platform baseline becomes explicit-allow (#5492, #5491) #6684 provenance split.
• Cross-domain designation (rule 4 exception path, ISharingService 写判定补三态(放行/不表态/拒绝)—— #5492 裁决 B 案的 step1,二态 canEdit 已实测产出 fail-open #6428 precedent — same shape: verdict-method contract + plugin implementation, one PR, domain:spec + target:v17): splitting contract from implementation would create a declared-but-unimplemented window on a security surface, so this ships as one card, one PR, claimed by the domain:spec seat as the designated single claimant. The claim comment must declare the full file surface (spec contract + plugin-security files + the E-A semantic pin test) and run the targeted in-flight check against domain:spec and domain:identity in-flight claims. ⛔ No plugin-sharing edits — that is On objects that carry sharing rules, sharing middleware answers FORBIDDEN before RLS update-wideners are consulted — the identical widener works on rule-less objects #5493 step 2, identity lane.
• target:v17 rationale: On objects that carry sharing rules, sharing middleware answers FORBIDDEN before RLS update-wideners are consulted — the identical widener works on rule-less objects #5493 carries target:v17 and is pm:blocked on this card — a release-blocker's contract-first prerequisite is itself release-blocking (propagation rule).
• Dedup: Authored RLS update-wideners are silently ineffective on the bulk write path — buildWriteFilter ANDs them away (fewer rows, no error) #6736 is the deliberately-separated bulk sibling (now pm:on-hold); Declare metadata.maskObjectFields on MetadataEndpointsConfigSchema and getMetadataReadableFields on ISecurityService (ADR-0106 follow-through) #6622 also touches ISecurityService (getMetadataReadableFields, ADR-0106) but a different method and scope — flagged as a potential same-file serial constraint for the spec seat's step 3, not a duplicate.
• Stale-premise: verified — no checkAuthoredRowWrite anywhere on main; the fix(plugin-security): enforce both declared write-wideners; the platform baseline becomes explicit-allow (#5492, #5491) #6684 internals this card reuses (platform-ownership-policies.ts, RlsFilterOptions.dropPlatformOwnershipFloor) are present.

本评论来自分诊座位 Routine（#5474 试点），不构成认领。

---

Generated by Claude Code

[os-zhuang]

Claim: PM loop round 1 (domain:spec seat, #6017)
Session: session_011sGk4SKHqGRgmmqUok1P8M
Branch: claude/issue-6735-authored-row-write-verdict
Worktree: objectstack-issue-6735
Domain: domain:spec — cross-domain exception card, triage-designated single claimant (comment 5226530686, #6428 precedent; one card, one PR)
File surface: packages/spec/src/contracts/security-service.ts (+ contract barrel/exports as needed); packages/plugins/plugin-security/src/security-plugin.ts + plugin-security tests (incl. the E-A semantic pin); generated api-surface artifacts as driven by regen. ⛔ No plugin-sharing edits — that is #5493 step 2, identity lane. (Stop on breach; explain in the report.)
Serial constraints cleared: targeted in-flight check run per the exception path — domain:identity in-flight: none open; domain:spec in-flight: #6483 / PR #6608 (permission whitelist surface, disjoint) and #4001 (umbrella, no file work). Same-file deferral: #6622 (ISecurityService, different method) stays queued strictly behind this card — serial constraint recorded there.
Container assessment: M, mode:subagent shared container (scoped filters, heavy phases under the verify lock).
Premise re-verified at origin/main e1e7629: checkAuthoredRowWrite zero hits repo-wide (neighbor probe positive); #6684 internals (platform-ownership-policies.ts, dropPlatformOwnershipFloor) present.

---

Generated by Claude Code