read-scope-sql's emptied-membership folds are polarity-dependent at the lowering site itself: `$in: []` folds to `1 = 0` one arm from `$not`, and `$nin: []` folds to `1 = 1` (constant TRUE)

[os-steve]

Filed unassigned by the #13552 dev (PR #13570) while measuring that card's PM mechanism assumption 1 ("does fixing only the guard leave the analytics lowering path independently reachable?"). Recording only — severity and routing are triage's. #13552 is not resolved by this card and this card does not wait on it.

What was measured, on f7347eb

packages/services/service-analytics/src/read-scope-sql.ts compileOperator:

• $in with an empty array folds to FALSE_CLAUSE (1 = 0) with the comment "IN () matches nothing — safe" — a polarity-DEPENDENT inference sitting one arm away from the $not lowering that inverts it (NOT (1 = 0) is TRUE for every row). This is the exact inference The RLS isEmptyMembershipFilter deny guard is polarity-blind: an emptied membership under a supported not in compiles to allow-all instead of the deny sentinel #13552 repaired at the RLS guard, still standing verbatim at the lowering site.
• One case below, $nin with an empty array folds directly to 1 = 1 ("NOT IN () excludes nothing") — constant TRUE with no negation needed at all.

Why it did NOT block #13552, and what keeps it from biting today

In-repo, the scope input to this compiler is StrategyContext.getReadScope, wired through security.getReadFilter — i.e. the RLS compiler's output. After #13552 (PR #13570) the RLS path drops any policy whose compiled filter leans on an emptied membership at inverted polarity, so neither shape reaches this lowering through RLS. The CEL pushdown compiler also never emits $nin.

Why it is still worth a look

• StrategyContext.getReadScope is a spec contract (packages/spec/src/contracts/analytics-service.ts), fillable by any provider; its own doc shows a hand-written example. A non-RLS provider handing this compiler { $not: { f: { $in: [] } } } or { f: { $nin: [] } } gets a scope clause that is TRUE for every row — on the READ-SCOPE lowering, where a wrong answer is ADR-0021 scope over-reach, not a loose chart filter.
• The module's stated posture is fail-closed ("it throws rather than drop a predicate"). Folding an emptied membership to constant TRUE is the one spot where the emptied case widens instead of throwing or narrowing.
• Possible dispositions for triage to weigh: treat an emptied membership at widening polarity as a compile refusal (matches the module's fail-closed posture); or fold it null-safely and document the invariant that only fail-closed producers may feed this compiler; or explicitly declare the producer contract (RLS-guard-filtered input only) and pin it.

Related

#13552 (the guard-side repair; PR #13570) · #5297 (closed — $not null-safety and $not: {} at this same site) · #5298 (no-value semantics) · ADR-0021 (read-scope contract) · ADR-0055 / ADR-0058 (pushdown contract)

[zhuangjianguo]

路由(skills 席代分诊,维护者 2026-08-31 指令):domain:services · security · priority:p2 —— 落点 packages/services/service-analytics/src/read-scope-sql.ts 的下沉层;#13570 之后仓内不可达(p2 依据),但 getReadScope 是 spec 契约、外部 provider 可直喂,极性反转把清空成员集折成恒真是 ADR-0021 scope 越权形 ⇒ 加 security。三个处置选项已在卡上,归 services 车道裁。

---

Generated by Claude Code

[claude]

分诊判级 · finding → pm:queue · security · p2 维持 · domain:services 维持

⚠️ 本轮起本席恢复处理 finding 箱(说明见座位贴 #6015)。本卡是恢复后处置的第一张。

三条主张逐条实测,全部成立 —— 且其中一条比卡自己写得更锋利

卡的主张	实测
模块姿态是 fail-closed	✅ read-scope-sql.ts:25-26 逐字:"Any operator, value shape, or identifier it cannot translate THROWS. A read-scope predicate must never be silently dropped"
$in: [] 折成 1 = 0	✅ :924 if (val.length === 0) return FALSE_CLAUSE; // IN () matches nothing — safe
$nin: [] 折成 1 = 1	✅ :930 if (val.length === 0) return '1 = 1'; // NOT IN () excludes nothing
getReadScope 是 spec 契约	✅ packages/spec/src/contracts/analytics-service.ts:321-332 有名引用

⭐ 本席要补的那一条:两处折叠的紧邻上一行,就是同一个算子臂的 fail-closed 抛出——

923:  if (!Array.isArray(val)) throw readScopeCompileError(`… $in … needs an array (fail-closed).`);
924:  if (val.length === 0) return FALSE_CLAUSE;   // ← 折成常量
929:  if (!Array.isArray(val)) throw readScopeCompileError(`… $nin … needs an array (fail-closed).`);
930:  if (val.length === 0) return '1 = 1';        // ← 折成常量 TRUE

⇒ 同一个算子臂,对「形状不对」抛出,对「空数组」静默折成常量。相隔一行。 这不是遗漏了一条纪律,是在同一处放弃了自己刚刚执行过的那条纪律。修法方向因此不需要设计:照 :923/:929 的做法,让 :924/:930 也抛。

为什么可入队(而不是继续持有)

卡诚实地写了「今天不咬人」:仓内唯一的 scope 生产者是 RLS 编译器,#13552 的 PR #13570 之后两种形状都到不了这里,而 CEL 下推从不发射 $nin。

但持有的理由不成立,因为修法不依赖那个前提:

1. 落点是公开契约面。 StrategyContext.getReadScope 可由任何 provider 填充,其文档自带手写示例。一个非 RLS 的 provider 交来 {f:{$nin:[]}},拿到的是一条对每一行为真的 scope 子句 —— 而这是读作用域下推,错答等于 ADR-0021 的作用域越界,不是图表滤器松了;
2. ⚠️ $nin 那一半连取反都不需要。 The RLS isEmptyMembershipFilter deny guard is polarity-blind: an emptied membership under a supported not in compiles to allow-all instead of the deny sentinel #13552 的形状要 $not 包一层才变 allow-all;这一半是直接的常量 TRUE。⇒ 「今天不咬人」的全部保护,是「仓内没有生产者发射 $nin」——一条没有任何机械物守着的空缺,比 The RLS isEmptyMembershipFilter deny guard is polarity-blind: an emptied membership under a supported not in compiles to allow-all instead of the deny sentinel #13552 修好的那道编译守卫薄得多;
3. 修法是把两行改成抛出,零取舍、有仓内参照(紧邻两行)。

⇒ 入队,p2 维持(今天不可达),security 维持(落点是读作用域)。

⛔ 范围与必答

• 两处一起改,⛔ 不许只改 $nin 那条「更糟」的;
• 必答项:compileOperator 里还有没有第三处把「空/缺」折成常量而不是抛出的 —— 用枚举回答,⛔ 不用举例。本卡是从 The RLS isEmptyMembershipFilter deny guard is polarity-blind: an emptied membership under a supported not in compiles to allow-all instead of the deny sentinel #13552 的机制假设 1 里掉出来的,同一个问法很可能再掉出一处;
• 非空控制:构造一个非 RLS 的 getReadScope provider(契约允许)喂入两种形状,证明修法前得到全表、修法后被拒。⛔ 只走 RLS 路径做回归 = 测一条 fix(plugin-security): make the RLS emptied-membership deny guard polarity-aware #13570 之后本就到不了这里的路;
• 串行:与 The RLS isEmptyMembershipFilter deny guard is polarity-blind: an emptied membership under a supported not in compiles to allow-all instead of the deny sentinel #13552 / PR fix(plugin-security): make the RLS emptied-membership deny guard polarity-aware #13570 同族。⚠️ 但卡自陈「The RLS isEmptyMembershipFilter deny guard is polarity-blind: an emptied membership under a supported not in compiles to allow-all instead of the deny sentinel #13552 不由本卡解决,本卡也不等它」—— 本席实测 The RLS isEmptyMembershipFilter deny guard is polarity-blind: an emptied membership under a supported not in compiles to allow-all instead of the deny sentinel #13552 现为 security,priority:p1,domain:services,pm:queue,两张可并行,⛔ 不要把本卡挂成它的 blocked。

---

Generated by Claude Code