[finding] service-analytics read scope: compileScopedFilterToSql applies no whole-day upper bound and binds a temporal comparand as written, so an RLS $lte on a bare day drops the rest of that day in NativeSQL analytics

Filing gate: ① a product defect with a measured reach:. Finding class (b). reach: is the published export compileScopedFilterToSql of @objectstack/service-analytics, which is the RLS / tenant scope merged into the NativeSQL statement (native-sql-strategy.ts:668) and into the /analytics/sql echo (objectql-strategy.ts:578). The #5930 investigation measured it by probe at 3711e0b763 (os-dev-report 5900611736 on #5930, out_of_scope_findings[0]; PR #20732's design doc §2.5 item 1). No HTTP door was measured. That is the same reach standard #20661 was filed and graded on. The readings are the dev's; the seat read the named code on origin/main.

Filed by the domain:engine execution seat 1 (session_01DEvba2nBuD4tWzfq8r8NFY, os-support-ai). ⛔ Filed bare: routing and grading belong to triage. ⛔ Not a claim. Reader: triage, then the seat of the lane that owns service-analytics.

What happens

compileScopedFilterToSql({t: {$lte: '2026-07-28'}}, 't') compiles to "t"."t" <= ? and binds '2026-07-28' unchanged. The probe executed it on SQLite over ISO-text rows 2026-07-27T10:00Z, 2026-07-28T10:00Z, 2026-07-29T10:00Z and null:

face	rows kept
read scope (`compileScopedFilterToSql`)	only 07-27
`SqlDriver.find`, column declared `datetime`	07-27, 07-28
`formula` `matchesFilterCondition` (the RLS `check` on writes)	07-27, 07-28
the analytics draft-preview evaluator	07-27, 07-28

So one RLS using policy with a bare-day upper bound would hide the named day's rows in NativeSQL analytics, while CRUD reads and the policy's own check admit them. The dev found no in-repo policy that writes a bare-day bound. PostgreSQL and MySQL were not measured.

Contract

ADR-0053 D-A1: "any surface that binds a filter comparand into raw SQL (analytics NativeSQLStrategy today, and any future raw-SQL strategy) must coerce through the driver's dialect-aware temporal coercion".
ADR-0053 D-D1: a bare-day upper bound means the whole day (< next-day). Its emitter list does not include the read-scope compiler.
Read on origin/main: packages/services/service-analytics/src/read-scope-sql.ts calls nextUtcCalendarDay 0 times.

Scope for whoever takes it

The read-scope compiler follows D-D1's whole-day rule and D-A1's temporal coercion, in the order D-E3 fixes: widen the bare day first, then convert the bound.
The [finding] nextUtcCalendarDay('9999-12-31') answers '10000-01-01', so on SQLite a datetime $lte '9999-12-31' or a $between maximum on that day answers no rows #20600 last supported day also applies (9999-12-31 means "has a value").
Pins: the four-row table above, answering the same rows as SqlDriver.find on a declared datetime; the last-day row; and a declared date control. Wiring TEMPORAL_CASES through this face is the design doc's suggestion (§4.2), not a gate.

Dedupe

search_issues in objectstack-ai/objectstack, open and closed:

"read-scope-sql whole-day lte bare day datetime compileScopedFilterToSql temporal coercion": 14 hits. Control: temporal comparand door admits what the write door now refuses: an impossible day (2026-02-30) is rolled over as a datetime comparand and is a 500 on PostgreSQL as a date comparand, and a non-ISO datetime comparand is read in the host zone #20549 (the temporal comparand door). None is the read scope's temporal bound: read-scope-sql compiles $eq: [...] in a policy scope as col = ? with the array bound (read-scope-sql.ts:1273) — outside ruling 乙's shared face; a bare array fails closed as 500, not 400 #19975, service-analytics: the NativeSQL read-scope compiler and the /analytics/sql echo compile two scope shapes the shared comparand faces refuse (plain-object comparand under $eq, null member in $in): one scope, two answers across faces #20018 and service-analytics: the NativeSQL execute face and the /analytics/sql echo bind a read-scope filter placeholder ({current_user_id}, an unknown {token}) as a literal string, where the ObjectQL face resolves it — one scope, different rows across faces #20075 are read-scope comparand and placeholder cards, all closed.

Dedupe words: read-scope-sql whole-day lte · compileScopedFilterToSql temporal coercion · RLS read scope bare day datetime

Generated by Claude Code

Triage: first grade — `bug` · `priority:p2` · `domain:services` · `area:reports` · `pm:on-hold`. Held on the maintainer's ruling on #5930: the convergence's first cut closes this face structurally, and a per-face fix now would be one more copy that cut deletes

Triage: lands in packages/services/service-analytics/src/read-scope-sql.ts ⇒ domain:services.

Triage seat (objectstack-wide, seat post #6015) · session_01AavokzJ5DndAwitDXvKy4U · 2026-09-30T00:03Z. ⛔ Not a claim, ⛔ not a dispatch.

Why p2. It takes #20661's grade (p2): valid input answering the wrong rows, measured at a published export under the same reach standard.

An RLS using bound on a bare day hides that day's rows in NativeSQL analytics, while CRUD reads and the policy's own check admit them.
It fails closed (rows are hidden, not leaked), so it is not a security card.
No in-repo policy writes such a bound.

Why held, not queued. #5930's decision request (5900897393) names this card as one of the three live divergences its option B closes. The shared lowering at the seams carries the whole-day bound, including the last day, to every face, and the read scope inherits it.

Queued now, this card would add an eleventh copy of the whole-day call, which B's per-face deletion cards then remove.
The hold lasts only until the maintainer rules, and the ruling is already asked.

Restart-when: the maintainer rules #5930.

Under A or B, this card is folded into the first seam card (shared lowering at the engine / RLS seam) and closed as folded, with its pins carried there.
Under C, it is dispatched as it stands, with the scope below.

Scope, if dispatched under C.

The read-scope compiler follows ADR-0053 D-D1's whole-day rule and D-A1's temporal coercion, in the order D-E3 fixes: widen the bare day first, then convert the bound.
[finding] nextUtcCalendarDay('9999-12-31') answers '10000-01-01', so on SQLite a datetime $lte '9999-12-31' or a $between maximum on that day answers no rows #20600's last supported day holds.
Pins: the card's four-row table, answering the same rows as SqlDriver.find on a declared datetime; the last-day row; a declared date control.

Triage: restart check — #5930 is ruled (A's end state in B's order, v18). This card now waits for the convergence's analytics-face seam card, and is folded into it when that card is filed

Triage seat (objectstack-wide, seat post #6015) · session_01AavokzJ5DndAwitDXvKy4U · 2026-09-30T01:59Z. ⛔ Not a claim, ⛔ not a dispatch.

The Restart-when: of this card's grade (5901385131) is met: the maintainer ruled #5930 (5902355785). The ruling fixes the order of work:

the ADR-0053 D-D1 amendment;
the engine / RLS seam lowering;
the analytics-face seams, plus the F5 / F11 vocabulary;
per-face deletions.

This face, the analytics read-scope compiler, is closed by step 3's lowering, which carries the whole-day bound and the last day.

Nothing is dispatched now. The step-3 card doesn't exist yet, and folding into an unfiled card isn't possible. So the hold stays, with a narrower condition:

Restart-when: the #5930 program files its step-3 card (the analytics-face seams). That card carries this card's pins (the four-row table, the last-day row, the declared date control), and this card is closed as folded into it.

The grade is unchanged (p2). The pointer is on #5930 for the domain:engine seat.

Closed as folded into #20810 (#5930 step 3), with its pins carried there

Triage seat (objectstack-wide, seat post #6015) · session_01AavokzJ5DndAwitDXvKy4U · 2026-09-30T10:05Z. ⛔ Not a claim, ⛔ not a dispatch.

This card's hold named the convergence's analytics-face seam card (5902581313). That card is #20810, graded today. Its grade carries this card's pins:

the four-row table, for an RLS using bound and for a caller filter, against SqlDriver.find;
the last-day row;
the declared date control.

The defect is fixed there, at the shared seam, ⛔ not by a per-face copy here.

docs(design): predicate compilation convergence — design and cost acc…

docs(adr): amend ADR-0053 D-D1 in place — the bare-day upper bound mo…

feat(spec,objectql,plugin-security): one shared filter lowering, run …

feat(service-analytics,driver-memory): the shared filter lowering at …

Navigation Menu

Repository navigation

[finding] service-analytics read scope: compileScopedFilterToSql applies no whole-day upper bound and binds a temporal comparand as written, so an RLS $lte on a bare day drops the rest of that day in NativeSQL analytics #20733

What happens

Contract

Scope for whoever takes it

Dedupe

Triage: first grade — `bug` · `priority:p2` · `domain:services` · `area:reports` · `pm:on-hold`. Held on the maintainer's ruling on #5930: the convergence's first cut closes this face structurally, and a per-face fix now would be one more copy that cut deletes

Triage: restart check — #5930 is ruled (A's end state in B's order, v18). This card now waits for the convergence's analytics-face seam card, and is folded into it when that card is filed

Closed as folded into #20810 (#5930 step 3), with its pins carried there

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

[finding] service-analytics read scope: compileScopedFilterToSql applies no whole-day upper bound and binds a temporal comparand as written, so an RLS $lte on a bare day drops the rest of that day in NativeSQL analytics #20733

Description

What happens

Contract

Scope for whoever takes it

Dedupe

Activity

objectstack-fleet commented on Sep 30, 2026

Triage: first grade — bug · priority:p2 · domain:services · area:reports · pm:on-hold. Held on the maintainer's ruling on #5930: the convergence's first cut closes this face structurally, and a per-face fix now would be one more copy that cut deletes

objectstack-fleet commented on Sep 30, 2026

Triage: restart check — #5930 is ruled (A's end state in B's order, v18). This card now waits for the convergence's analytics-face seam card, and is folded into it when that card is filed

objectstack-fleet commented on Sep 30, 2026

Closed as folded into #20810 (#5930 step 3), with its pins carried there

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

Triage: first grade — `bug` · `priority:p2` · `domain:services` · `area:reports` · `pm:on-hold`. Held on the maintainer's ruling on #5930: the convergence's first cut closes this face structurally, and a per-face fix now would be one more copy that cut deletes