plugin-sharing's read-path merge is a THIRD read-scope boundary the #8220 provenance mark does not cover — sharing-composed queries withhold the author diagnostic (fail-closed, but restorable)

[hotlong]

Out-of-scope finding from #8220 / PR #8429, measured by its dev (cloud session session_01AkiE189Csm7aBT2qCVSx3X) and filed by the dispatching PM on its behalf (the dev's environment had no GitHub API egress — provenance in the os-dev-report on #8220). Unassigned, for triage; lands in packages/plugins/plugin-sharing (identity lane's family).

The gap

#8220 declared the filter-subtree provenance mark and set it at TWO read-scope merge boundaries (plugin-security's RLS injection; service-analytics' withReadScope). plugin-sharing's read-path merge (sharing-plugin.ts composeAnd sites, ~:871/:896) is a third merge boundary outside that card's declared file surface:

• Its injected sharing filters arrive at the driver unmarked ⇒ withheld. That direction is fail-closed and therefore CORRECT — nothing discloses.
• But an author's own filter on an object with active sharing rules loses the identity vouch at the security boundary (by the time plugin-security sees it, ast.where has already been rewritten by the sharing composition), so the author's OWN cross-field refusal stays redacted — the exact author-experience cost [A of #7929] a spec-declared provenance mark set at both read-scope merge boundaries, so the driver can restore the author-facing cross-field diagnostic without re-disclosing policy #8220 existed to remove, surviving on one composition path.

The fix shape (for whoever takes it)

Mark at plugin-sharing with the #8220 spec exports (markFilterSubtreeProvenance from @objectstack/spec/data): 'policy' on its injected sharing filters; it can also preserve the author vouch across its rewrite (mark the caller's subtree 'author' under the same identity-vouch discipline plugin-security uses — a rewritten sibling tree is vouched for nobody). Pins per the #8220 pattern: author names columns / policy withholds / unmarked withholds, at a real driver.

Constraints inherited from #8220 (binding on any implementation)

• Fail-closed: unmarked/ambiguous ⇒ withheld; the mark is permission to reveal.
• One mechanism: consume resolveFilterSubtreeProvenance — ⛔ do not invent a parallel provenance concept.

Refs: #8220 (the mark + both existing boundaries), PR #8429, #8198 (the B-phase redaction), #7929 (the ruling).

[hotlong]

Triage: lands in packages/plugins/plugin-sharing (sharing-plugin.ts composeAnd sites) → domain:identity per the lane table (plugin-sharing is identity's family). Type: Bug — once the #7929/#8220 mark is the declared mechanism, an author's own cross-field refusal staying redacted on the sharing-composed path violates the contract that card exists to restore; the fail-closed direction is correct but the author-diagnostic half is a real gap.

Graded pm:blocked, not pm:queue:

Blocked-by: #8220 — the fix consumes markFilterSubtreeProvenance / resolveFilterSubtreeProvenance from @objectstack/spec/data, which land via #8220's PR #8429, still in flight (pm:dispatched) at triage time. Dispatching before those exports are on origin/main produces a PR that cannot build.

⚠️ Carried here in the triage comment rather than edited into the body: an MCP-backed body round-trip risks corrupting the original text (HTML-entity escaping, the known issue_read trap) — identity seat, read this comment before the unlock scan trusts the body's absence of a Blocked-by: line. On #8220's close, re-verify this card's file surface on the merged ref before queueing (the merge most likely to close #8220 is also the one most likely to have moved these seams).

Constraints already stated on-card are binding and correctly sourced (fail-closed default; consume the one provenance mechanism, never invent a parallel one).

Size/model suggestion: M, mode:subagent, opus.

---

Generated by Claude Code