[A of #7929] a spec-declared provenance mark set at both read-scope merge boundaries, so the driver can restore the author-facing cross-field diagnostic without re-disclosing policy

[os-zhuang]

This is "A" of the maintainer ruling of 2026-08-12 on #7929 (comment 5266067250, verbatim 「接受你的全部建议。」 — adopting "B now, A next"). B landed in #8198 (merged a5dcb74, closing #7929 and #7988). This card is the sanctioned follow-up, not a new proposal.

⛔ Filed unassigned — claim it before writing code, per the repo's claim discipline.

Why A exists

B stopped driver-sql's cross-field INVALID_FILTER refusal from echoing its operands, for every caller, because the driver genuinely cannot tell an administrator's predicate from an author's. Measured on both merge boundaries: the read scope arrives as a bare FilterCondition in where, DriverQuery is Omit<QueryAST, 'object'> with no provenance slot, and the only thing that crosses (context) says who is asking, never which subtree they did not write.

The accepted cost, stated plainly in B's changeset: an author debugging their own cross-field filter now gets the redacted message too. Their diagnostic is relocated to the server log, not destroyed. A is what gives it back — behind a real mark rather than a guess.

What A has to build

1. A provenance mark declared in packages/spec. Declared, not conventional — the whole point is that the driver may trust it because the contract defines it.
2. Set at BOTH merge boundaries, or the fix is half-live:
   • plugin-security's CRUD injection — the ast.where = ast.where ? { $and: [ast.where, scoped] } : scoped merge around security-plugin.ts:2198;
   • service-analytics' read-scope merge (ObjectQLStrategy.withReadScope).
3. driver-sql consumes it: a marked (policy-authored) subtree keeps B's redaction; an unmarked, author-written filter gets its full diagnostic back — both columns, the operator, the list index, the boundary reason.

⚠️ The invariant that must not regress — fail closed

An unmarked or ambiguous predicate must default to WITHHELD. The mark is permission to reveal, never a requirement to prove secrecy. A driver-side guess at provenance is precisely the shape triage rejected on #7929, and an inverted default would silently restore the original disclosure — including the sentence naming which column is the object's tenant-isolation column. Any design where "the mark is missing" lands on the disclosing branch is wrong, however convenient.

⚠️ One pin A is expected to REWRITE — it is not a regression

packages/runtime/src/cross-field-refusal-operand-withhold.test.ts contains a byte-equality assertion: an author-written $field filter and a policy-injected one must produce identical messages. That pin is the strongest available statement of "the driver cannot tell them apart" — which is exactly the fact A is chartered to change.

Whoever implements A must rewrite that assertion deliberately, and say so in the changeset. ⛔ Do not treat it as a failing test to make green by weakening it, and ⛔ do not delete it — replace it with its successor: marked and unmarked now differ, and the unmarked-by-default case still withholds. Left unexplained, this pin reads like a bug to the next agent who runs the suite.

Scope notes

• driver-sql: the #7929 withhold covers the cross-field family only — every other INVALID_FILTER refusal still names the target field, which is admin-authored on a read-scope predicate #8197 is probably evidence for this card's scope, not independent work. It records that refusals outside the cross-field family still name the target field, which is admin-authored whenever the predicate came from a read scope. A's mark closes that class without the blanket cost of withholding the target field from every author. ⛔ It is unlabelled and unassigned pending triage — decide the relationship there, don't silently absorb it.
• Prior-art lead, UNVERIFIED — check before inventing a second mechanism. finding: author-time expression validation resolves injected anchors on external objects but cannot warn they are unprovisioned — the #7865 provenance marker is unreachable from @objectstack/lint #8116 refers to "the [Decision] applySystemFields injects platform anchors into external objects the platform provisions no storage for — three consumers have now independently re-derived "that column is not really there" #7865 provenance marker" in the context of injected anchors on external objects. I have not confirmed whether that marker generalises to read-scope filter subtrees; it may be an unrelated mechanism. Read it first — a second, parallel provenance concept in packages/spec would be worse than either alone.
• Sibling drivers: driver-turso carries its own copy of the refusal (RemoteTransport.uncompilableComparand), fixed in fix(driver-sql,driver-turso): a cross-field $field refusal stops naming the two columns it compared (#7929, #7988) #8198; driver-sqlite-wasm inherits from SqlDriver. A has the same three-driver surface.
• ⛔ Out of scope: the REST boundary's 5xx-only withhold (analytics dataset 路由的 message 正则兜底没有退休时间表:六族拒收仍靠措辞分类,改一个字就换一个 HTTP 码 #5367's tiering, fix(service-analytics,rest): analytics dimension 的源字段闸门 —— 不存在的 dimension 答 400 INVALID_FIELD,dataset 500 不再回显 SQL (#5520) #5667's decision) stays untouched — that was ruled out on finding: after the #7598 Q1=B ruling, a read scope with a driver-refused field reference answers 400 from the driver — which cuts across #5367's attribution argument on that one path #7929 and is not reopened by A.

Done means

An author's own cross-field filter names its columns again; a policy-injected one does not; an unmarked one does not; and all three are pinned at the two real merge boundaries with a real driver, not a mock.

[hotlong]

Triage: half-annotated shape completed ⇒ pm:queue, type Feature (maintainer-sanctioned A of the 2026-08-12 #7929 ruling — no new decision needed; the ruling and its scope are already on this card).

Lane anchoring — one label, and it is domain:spec: the deliverable's contract half is a provenance mark declared in packages/spec, and any card touching packages/spec routes to the spec seat as sole owner. Removed the second lane label (domain:drivers) — one card, one lane; the driver/boundary consumers stay in card scope, not in the label.

Cross-domain single-PR exception (designated here): the card is correctly argued as unsplittable — the mark set at only one merge boundary is half-live. The domain:spec seat (#6017) takes it under the exception path: the claim comment must declare the full file surface (packages/spec mark + plugin-security/src/security-plugin.ts ~2198 merge + service-analytics ObjectQLStrategy.withReadScope + drivers/driver-sql and driver-turso RemoteTransport + packages/runtime/src/cross-field-refusal-operand-withhold.test.ts rewrite) and run the targeted in-flight check against the identity / services / drivers lanes' claimed surfaces before dispatch.

Model (not discretionary): expands the contract's public face ⇒ claude-fable-5 per the 2026-08-12 tiering clause. Size: L.

Related state set this round: #8197 graded as evidence for this card's scope and parked pm:blocked on it — on landing, its unlock re-measure is part of proving A closed the class. The card's own fail-closed invariant (unmarked ⇒ withheld) and the #7865/#8116 prior-art check are dev must-verifies; the byte-equality pin rewrite must be explained in the changeset, per the card.

---

Generated by Claude Code