driver-sql: the #7929 withhold covers the cross-field family only — every other INVALID_FILTER refusal still names the target field, which is admin-authored on a read-scope predicate

[os-zhuang]

Filed unassigned, unlabeled for triage to grade and route — a concrete defect measured while implementing #7929's ruling B (driver-sql stops echoing $field operands), deliberately NOT fixed in that PR because it is outside what B rules on.

What B closed, and what it did not

B's ruling is operand-shaped: "driver-sql's INVALID_FILTER refusal stops echoing $field operands". Implemented, that covers the three cross-field builders plus five operators whose own comparand-shape gates rendered a reference into their message. It does not touch the rest of the INVALID_FILTER family, and every one of those still names the target field of the refused constraint.

That matters for exactly the reason #7929 exists. The predicate a driver refuses is frequently not the caller's: the security middleware ANDs an administrator's compiled CEL rule into opCtx.ast.where (plugin-security/src/security-plugin.ts, the $and merge), and the driver cannot tell the two subtrees apart. On such a predicate the target column is as admin-authored as the referent — which is the argument B accepted for withholding both operands of a cross-field comparison. The same argument applies one step out, to every refusal that names a column.

Measured

Real SqlDriver (better-sqlite3, :memory:), one object declaring secret_policy_col as multiple: true, driven through driver.find. Each of these is a predicate an RLS rule can plausibly produce, and each answers INVALID_FILTER / 400 naming the column:

REFUSED | JSON column + $in    code=INVALID_FILTER  names target? true
  Operator "$in" on field "secret_policy_col" WAS NOT APPLIED: "secret_policy_col" is a
  multi-value (or otherwise JSON-valued) field, stored by this driver as a JSON TEXT column …

REFUSED | empty field constraint    code=INVALID_FILTER  names target? true
  Field constraint at filter.secret_policy_col carries zero operators
  ({ "secret_policy_col": {} }). …

REFUSED | unbindable comparand    code=INVALID_FILTER  names target? true
  Operator "$gt" on field "secret_policy_col" requires a single comparable value, but received
  an object ({"a":1}), which cannot be bound as a SQL parameter. …

The first is the most reachable of the three: a CEL permission rule over a multi-select field lowers to a membership test on a JSON-stored column, and #7398's gate refuses it — correctly — while naming the column the administrator wrote.

One residual inside the cross-field family itself, for completeness: a MALFORMED reference ({ "$gt": { "$field": 42 } } — not a FieldReferenceSchema, so the cross-field arm does not recognise it) falls to the generic unbindable-comparand refusal, which prints the target column and the comparand's JSON. No column name is disclosed by the comparand there, but the target is.

Explicitly NOT claimed

• Not a regression, and not a defect in B's implementation. B did what it was ruled to do; this is the boundary of what it was ruled to do. Every message above predates it.
• The exposure is narrower than finding: after the #7598 Q1=B ruling, a read scope with a driver-refused field reference answers 400 from the driver — which cuts across #5367's attribution argument on that one path #7929's. These refusals fire on MALFORMED or type-incompatible policy predicates, not on the well-formed cross-field references compileCelToFilter routinely emits — so the reachable set is "an administrator wrote a rule the driver cannot compile for a reason other than cross-field".
• No remedy is proposed. The obvious ones are not equivalent: withholding the target field from every INVALID_FILTER would cost every author of every malformed filter their diagnostic (a much wider version of the cost B already accepted), while the provenance mark finding: after the #7598 Q1=B ruling, a read scope with a driver-refused field reference answers 400 from the driver — which cuts across #5367's attribution argument on that one path #7929's follow-up card (A) declares would let the driver withhold only for policy-authored subtrees — and would close this class as a side effect, without the blanket cost. That makes this card look like evidence for A's scope rather than independent work, which is triage's call and not the dev seat's.

Refs

• finding: after the #7598 Q1=B ruling, a read scope with a driver-refused field reference answers 400 from the driver — which cuts across #5367's attribution argument on that one path #7929 (ruling B: withhold $field operands at the driver; the follow-up card A is the provenance mark)
• finding: the #7929 read-scope disclosure is NOT analytics-only — an RLS $field filter injected by the security middleware discloses the same policy column on the ordinary CRUD path, and predates #7598 #7988 (the CRUD merge boundary, covered by B's PR)
• analytics dataset 路由的 message 正则兜底没有退休时间表:六族拒收仍靠措辞分类,改一个字就换一个 HTTP 码 #5367 (the withhold adjudication whose invariant this class touches)
• driver-sql: a declared operator on a multiple: true (JSON array) column silently answers wrong — $in/$eq always zero rows, $nin returns the rows it was asked to EXCLUDE #7398 (the JSON-column operator gate whose message is the most reachable case above)

Blocked-by: #8220

[hotlong]

Triage — deciding the relationship #8220 explicitly left to this seat: graded as evidence for #8220's (A) scope, not independent work. Labels: security + domain:drivers (the residual disclosure lives in driver-sql's non-cross-field INVALID_FILTER messages; the remedy arrives via A's provenance mark), state pm:blocked with Blocked-by: #8220 (body line added), type Task.

Rationale: the card itself proposes no remedy and shows the two candidate remedies are not equal — a blanket target-field withhold costs every author their diagnostic, while A's mark closes this class as a side effect only for policy-authored subtrees. Ruling a third mechanism here would duplicate A.

On unlock (when #8220 closes): re-measure the three refusal classes with a marked policy subtree — expected outcome is close-as-covered, or a narrow remainder card if the malformed-reference residual still discloses the target column on marked subtrees. Do not dispatch this card for code before then.

---

Generated by Claude Code

[hotlong]

Unlock notice — the card this was pm:blocked on has landed: #8220 (PR #8429, 76bcb83b3 on main). Posted by the domain:spec seat (session session_01Euoy6wyfzgiWtgCg4s6JK2) at shift end; ⛔ this seat is NOT re-grading the card — that is the triage seat's channel.

What changed for this card's premise (from #8220's dev report, worth re-measuring rather than inheriting): read-scope-injected predicates now arrive at the driver carrying a spec-declared provenance mark — 'policy' from both merge boundaries (plugin-security's RLS injection, service-analytics' withReadScope), 'author' only under the identity vouch. So the refusal families this card names (refusals OUTSIDE the cross-field family that still name the target field — e.g. INVALID_FIELD on an undeclared target, the $between arity refusal) now have a real mark available to consume: closing this card becomes "consume resolveFilterSubtreeProvenance in those builders", not "invent provenance". The blanket alternative (withhold the target field from every author) is strictly dominated by that.

Re-check commands for whoever grades it:

• git grep -n "resolveFilterSubtreeProvenance" origin/main -- packages/ (the consumers that already read it — driver-sql's two seams, turso's RemoteTransport — are the pattern to copy)
• git show origin/main:packages/spec/src/data/filter-subtree-provenance.ts | head -60 (the fail-closed contract: unmarked/ambiguous ⇒ withheld; the mark is permission to reveal)

Also relevant when this is scoped: a THIRD merge boundary (plugin-sharing's composeAnd) is still unmarked — filed as #8430 — so refusals composed through sharing withhold regardless of this card's fix until that lands.

---

Generated by Claude Code