finding: the #7929 read-scope disclosure is NOT analytics-only — an RLS `$field` filter injected by the security middleware discloses the same policy column on the ordinary CRUD path, and predates #7598

[huangyiirene]

Observation-class finding, filed unassigned with no pm:queue — for triage to grade and route. Measured while executing the #7929 measurement dispatch (domain:engine-core seat, 2026-08-12). Recording, not claiming.

Blocked-by: #7929

Why this is filed separately from #7929

#7929's body, the triage block, and the 2026-08-12 maintainer ruling on it all frame the disclosure as a consequence of #7598's Q1 = B routing — "the refusal moved to the driver along with the compilation" — and the ruling's implementation boundaries scope the pins accordingly:

Pin both directions: (a) a read scope carrying a driver-refused reference answers the withheld envelope with no field-name echo — extend the analytics-query-read-scope-withhold pin family to this path

That framing is incomplete, and a fix scoped to it would leave the larger half open. The ordinary CRUD read path has the identical disclosure, and did not need #7598 to get it. It arrived with #5222 (2026-08-06), when driver-sql learned to compile { $field } and to refuse it with INVALID_FILTER / 400.

The two paths differ only in which component merges the admin's read filter into the query:

path	merge boundary	file
analytics POST /analytics/query	ObjectQLStrategy.withReadScope	packages/services/service-analytics/src/strategies/objectql-strategy.ts (withReadScope)
ordinary CRUD read	security middleware ANDs into opCtx.ast.where	packages/plugins/plugin-security/src/security-plugin.ts:2198

Both hand the driver a bare FilterCondition with no provenance mark, and driver-sql's applyCrossFieldComparison refuses identically in both cases.

Measured

Real ObjectQL engine, real SqliteWasmDriver seeded with the shared CROSS_FIELD_* corpus fixture, and a read-filter middleware shaped exactly like the security/sharing ones (ast.where = ast.where ? { $and: [ast.where, scoped] } : scoped) injecting an admin-authored policy predicate the caller never wrote:

scoped = { amount: { $gt: { $field: 'secret_policy_column' } } }
caller  = ql.find('cross_field_deal', { where: { stage: 'won' } })

What the engine surfaces:

code:    INVALID_FILTER
status:  400
message: Operator "$gt" on field "amount" compares against another field
         ({ "$field": "secret_policy_column" }), which cannot be compiled here:
         "secret_policy_column" is not a declared field of "cross_field_deal" —
         only declared fields can be referenced. Cross-field comparison on SQL
         push-down supports same-table columns the object declares, compared as
         the same type class, excluding the tenant-isolation column.

names the admin-authored column: true

Producer chain from the captured stack, verbatim:

unsupportedFilterError            (driver-sql/src/sql-driver.ts:554)
uncompilableFieldReferenceError   (driver-sql/src/sql-driver.ts:1138)
applyCrossFieldComparison         (driver-sql/src/sql-driver.ts:9160)
applyFilterCondition              (driver-sql/src/sql-driver.ts:8870)

The 400 is a declared 4xx, so the REST boundary's withhold — declaresServerFault, which requires status >= 500 — can never reach it. That tiering is deliberate and already pinned (analytics-query-read-scope-withhold.test.ts, the "a DECLARED 4xx is untouched — the withhold is 5xx-only" case), so this is not a boundary bug; it is the same attribution seam #7929 records, one path over.

Scope of the exposure

Requires an administrator to have authored a CEL permission/RLS rule with a field-to-field comparison — compileCelToFilter emits { $field: path } for exactly that — whose reference fails one of the four #5222 rulings (dotted path, undeclared column, the tenant-isolation column on either side, or a cross-class comparison). Narrow, and no customer report; but on the CRUD path it reaches every SQL-driver read, not just the analytics face.

Explicitly NOT claimed

• Not a regression, and not [spec] service-analytics' read-scope / Cube filter compilers still refuse $field, so a CEL field-to-field RLS rule 400s on those faces #7598's doing. [spec] service-analytics' read-scope / Cube filter compilers still refuse $field, so a CEL field-to-field RLS rule 400s on those faces #7598 Q1 = B is not implicated on this path at all — the CRUD read has gone straight to driver-sql since long before it. [spec] SqlDriver 将 $field 编译为列对列比较(cross-field comparison push-down) #5222's refusal arm is correct on its own terms; what is missing is the provenance to know the predicate was not the caller's.
• Neither ruling is re-litigated. [spec] SqlDriver 将 $field 编译为列对列比较(cross-field comparison push-down) #5222, analytics dataset 路由的 message 正则兜底没有退休时间表:六族拒收仍靠措辞分类,改一个字就换一个 HTTP 码 #5367, [spec] service-analytics' read-scope / Cube filter compilers still refuse $field, so a CEL field-to-field RLS rule 400s on those faces #7598 Q1 = B and Q2 = A all stand. This records a scope fact about the remedy, not an objection to any of them.
• No remedy is proposed here. The 2026-08-12 ruling on finding: after the #7598 Q1=B ruling, a read scope with a driver-refused field reference answers 400 from the driver — which cuts across #5367's attribution argument on that one path #7929 already picked the shape (provenance marker at the merge boundary, driver withholds on a marked predicate). This card only records that "the merge boundary" is two boundaries in two different packages, and that pinning only the analytics one would leave the CRUD one open.

Refs

• finding: after the #7598 Q1=B ruling, a read scope with a driver-refused field reference answers 400 from the driver — which cuts across #5367's attribution argument on that one path #7929 (the attribution seam, and the 2026-08-12 ruling that picked the provenance-marker shape)
• analytics dataset 路由的 message 正则兜底没有退休时间表:六族拒收仍靠措辞分类,改一个字就换一个 HTTP 码 #5367 (the withhold adjudication whose invariant this breaks)
• [spec] SqlDriver 将 $field 编译为列对列比较(cross-field comparison push-down) #5222 (the four cross-field rulings, and the INVALID_FILTER / 400 refusal arm)
• [spec] service-analytics' read-scope / Cube filter compilers still refuse $field, so a CEL field-to-field RLS rule 400s on those faces #7598 (the Q1 = B routing that brought the analytics face into the same seam)

[hotlong]

Triage: routed domain:identity, grade stays finding (held — deliberately), type Bug.

• Why held rather than queued: this card is a scope fact about the in-flight finding: after the #7598 Q1=B ruling, a read scope with a driver-refused field reference answers 400 from the driver — which cuts across #5367's attribution argument on that one path #7929 remedy, not yet separate work. The 2026-08-12 ruling on finding: after the #7598 Q1=B ruling, a read scope with a driver-refused field reference answers 400 from the driver — which cuts across #5367's attribution argument on that one path #7929 picked the shape (provenance marker at the merge boundary, driver withholds marked predicates); this card's contribution is that "the merge boundary" is two boundaries — the analytics strategy (service-analytics) and the security middleware (plugin-security/src/security-plugin.ts:2198). Whether this becomes its own card depends entirely on what finding: after the #7598 Q1=B ruling, a read scope with a driver-refused field reference answers 400 from the driver — which cuts across #5367's attribution argument on that one path #7929's implementation covers, and that PR is being written right now.
• Disposition, two outcomes: at finding: after the #7598 Q1=B ruling, a read scope with a driver-refused field reference answers 400 from the driver — which cuts across #5367's attribution argument on that one path #7929's PR review — (a) if the marker lands at both boundaries with both pin directions, this card closes with it (the reviewing seat should say so here); (b) if finding: after the #7598 Q1=B ruling, a read scope with a driver-refused field reference answers 400 from the driver — which cuts across #5367's attribution argument on that one path #7929 covers the analytics face only, promote this to pm:queue as the follow-up, and it then depends on finding: after the #7598 Q1=B ruling, a read scope with a driver-refused field reference answers 400 from the driver — which cuts across #5367's attribution argument on that one path #7929's marker contract (serial: marker mechanism first). Regrade trigger = finding: after the #7598 Q1=B ruling, a read scope with a driver-refused field reference answers 400 from the driver — which cuts across #5367's attribution argument on that one path #7929's PR merging, whichever way it falls.
• Landing if promoted: the residual injection site is plugin-security ⇒ domain:identity per the lane table; driver consumption is already ruled and lands with finding: after the #7598 Q1=B ruling, a read scope with a driver-refused field reference answers 400 from the driver — which cuts across #5367's attribution argument on that one path #7929's mechanism.
• Cross-ref left on finding: after the #7598 Q1=B ruling, a read scope with a driver-refused field reference answers 400 from the driver — which cuts across #5367's attribution argument on that one path #7929 so the implementing side sees the second boundary before the pins are scoped.

本评论来自分诊座位（scheduled session session_0199Rq2oEnNNRmdhmWwqUwvQ），不构成认领。

---

Generated by Claude Code

[hotlong]

Triage (findings round): graded — finding → pm:blocked with Blocked-by: #7929 added to the body, stays domain:identity (the CRUD merge boundary is plugin-security).

Rationale: the remedy shape is already ruled on #7929 (provenance marker at the merge boundary, driver withholds on a marked predicate), and the mechanism is one implementation — marking two merge boundaries and one shared driver check. Queuing this card independently would put two devs into driver-sql's withhold seam for one mechanism. Instead: #7929's dispatch should treat "the merge boundary" as two boundaries (this card's table names both files) and cover the plugin-security one in the same PR; a pointer comment goes on #7929 so the dispatching seat sees this before writing the dispatch order.

Unlock rule for the blocked-scan: when #7929 closes, re-check whether its PR touched security-plugin.ts:2198's merge — if yes, this closes as delivered; if the PR was analytics-only, this card unblocks as the CRUD remainder with the marker mechanism already in the tree (an S-sized consumer change at that point).

---

Generated by Claude Code