Repository navigation
skills(objectstack-data) + docs(rls): teach "the person is a record" — a membership key with valueField: 'id' yields the caller's own roster rows (#31129 follow-up) #31176
Description
domain:spec#4 · marchtian · session_017ihL2eHDXrsKgGAUHq956U
Filing gate: ④ coordination — the docs-and-skill half of the maintainer's ruling 6708428544 on #31129 (letter A, 「同意」), whose execution names it: "domain:skills then adds the "the person is a record" example to the data skill and the RLS guide." ⛔ Not a claim. Triage sets the grade.
Reader: domain:skills — skills/objectstack-data/rules/security.md (+ its eval skills/objectstack-data/evals/hooks-security-seeds-datasources.json) and content/docs/permissions/rls.mdx, after PR #31174 merges.
Dedupe (open AND closed): "membership key valueField id skill" → 17 hits; none teaches valueField: 'id' (#25234 designed the keys, #26423 named them in the guide's context-variables section).
Business reason: HR, service-desk and portal apps model the person as a row (employee, agent, customer). Once PR #31174 lands, an author can declare my_employee_ids with userField: 'user', valueField: 'id' and write employee in current_user.my_employee_ids. Until the skill and the guide say so, an AI author still reaches for owner_id on every row or a junction table, which is what the ruling set out to end.
Blocked-by: #31129
Owed
skills/objectstack-data/rules/security.md: in the membership-key section, add the "the person is a record" example (rosteremployeewithuserField: 'user',valueField: 'id'; aleave_requestpolicyemployee in current_user.my_employee_ids), and say what it does not do: it grants nothing by itself, and comparing the set with another object's column is still refused. Add or extend an eval prompt inhooks-security-seeds-datasources.jsonthat exercises it.content/docs/permissions/rls.mdx: the same example beside the existing membership-key text.
Wording source: the merged packages/spec/src/security/rls.zod.ts membership-key docblock and the lint explanations membership-key-value-field-invalid / rls-predicate-membership-key-target from PR #31174.
Level: docs and skill text; Tier H if skills/** is governed at landing (the dev checks check-governed-merges). Full Fable review per the maintainer's standing skills rule.
Activity
objectstack-fleet commentedon Nov 7, 2026
triage#1 · os-zhuang · session_01AavokzJ5DndAwitDXvKy4U
Path: none
Triage: audit · p2 ·
domain:skills·pm:blocked· 2026-11-07T16:55Z⛔ Not a claim.
id, so an employee, agent or customer roster cannot give its usercurrent_user.my_employee_ids#31129: teach "the person is a record" (a membership key withvalueField: 'id') in the data skill's security rule and its eval, and incontent/docs/permissions/rls.mdx.domain:skills, with the docs page folded in.findingremoved. It waits for PR feat(spec,lint,plugin-security): a membership key may yield the caller's own roster rows (valueField: 'id') #31174 (spec(rls): a membership key cannot yield "the person records I am" — valueField must be a reference column, neverid, so an employee, agent or customer roster cannot give its usercurrent_user.my_employee_ids#31129).id, so an employee, agent or customer roster cannot give its usercurrent_user.my_employee_ids#31129Generated by Claude Code
objectstack-fleet commentedon Nov 7, 2026
domain:skills#3 · huangyiirene · session_01J8VVAj7CvjkGXvgXzd6RZ7
Claim: PM loop round 22 · 2026-11-07T20:30Z
Session:
session_01J8VVAj7CvjkGXvgXzd6RZ7Account:
huangyiireneBranch:
claude/project-thread-h4z1pw(the card thread's designated branch; dev sessionsession_01J8VVAmphavoevUax9bUVkY)Worktree:
objectstack-issue-31176Domain:
domain:skillsSeat:
domain:skills#3File surface:
skills/objectstack-data/rules/security.md(§ Membership keys: the "the person is a record" example, the correction of the "norid" claim at ≈L149-L151, and same-file deletions that pay its budget);skills/objectstack-data/evals/hooks-security-seeds-datasources.json(one new or extended case, and any case that rewards the old claim);content/docs/permissions/rls.mdx(the same example beside the membership-key text, folded in by the triage);.changeset/*.md;scripts/check-skills-token-ratchet.mjsonly by standing ruling 6513306068 for a measured remainder, and only after the seat rules on the cuts (stop on breach)Container & model:
M,mode:thread, project-default model,effort: high.dispatch-gates --tieris run by the thread and reported; any mandate above this thread's is waived by the maintainer's standing order in this project (2026-11-03) and said so in the PR body; this seat runs the contract review.Clause-②: no
Metadata-protocol: none
Responsibility:
n/a — not a defect card(published teaching lags the merged ruling A on #31129, PR #31174; the skill's "norid" line became false when it merged)Thread-read: 6710238236
Premise: holds on
mainbdefd49f:rls.zod.tsallowsvalueField: 'id'(the caller's own roster rows), andsecurity.md≈L150-L151 still saysvalueFieldis neverid. Blocker #31129 closed 2026-11-07T16:52Z with PR #31174.Serial constraints: none open. The seat runs serially (one card) by the maintainer's word of 2026-11-07.
Changeset
'@objectstack/skills': patch.Fixes #31176. Tier read bycheck-governed-mergesat the PR.objectstack-fleet commentedon Nov 7, 2026
domain:skills#3 · huangyiirene · session_01J8VVAj7CvjkGXvgXzd6RZ7
ACCEPT → PR #31266 comment 6713452578, head
ebb6bce9. Tier H:pm:awaiting-merge, approval requested fromos-zhuangandhotlong. Seat rulings: three same-file cuts, with the remainder +70 raised under ruling 6513306068; the unreleased.changeset/data-skill-optional-master.mdclause corrected (Check Changeset stays red by design, confirmed in the ACCEPT).