feat(security,spec): master-detail controlled-by-parent permissions (ADR-0055 P1+P2)

Implements derived master-detail access — a detail object's read/write scope is
derived from its master record.

- spec: `controlled_by_parent` added to the authorable `object.sharingModel` enum
  (converges with OWDModel).
- security (read): for a controlled_by_parent object, resolve the master records
  the user can read (reusing the master's own RLS via computeRlsFilter, run under
  a system context — no middleware re-entry) and AND-inject
  `masterFK IN (accessible master ids)` onto the read AST. Empty set ⇒ fail closed.
  Zero RLS-compiler changes (builds the $in filter directly).
- security (write): extend the by-id-write path — a detail insert/update/delete
  requires CRUD edit on the master AND the master row visible under the master's
  write RLS. Closes the #1994-class by-id hole for derived access (the detail
  carries no authored RLS of its own).
- proof (ADR-0054): dogfood RLS proof — a member who can't read the master can
  neither read nor by-id-write the detail, and isn't over-blocked on a master they
  own. Bound in the liveness ledger on object.sharingModel.

Five high-risk classes now CI-enforced: field types, RLS, controlled-by-parent,
analytics, flow nodes. Honest v1 limits documented in ADR-0055 (id-set ceiling,
single-level chains). Full dogfood suite green (73 tests); liveness gate green;
18 registry tests.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XVdnfUAx85amkerym26vdx

Author: claude

packages/dogfood/test/controlled-by-parent.dogfood.test.ts

@@ -0,0 +1,101 @@
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+//
+// Master-detail "controlled by parent" RLS proof (ADR-0055 P2), end-to-end
+// through the real HTTP + security stack.
+//
+// @proof: cbp-controlled-by-parent
+// ADR-0055 runtime proof for derived master-detail access. Referenced by the
+// liveness ledger entry `object.sharingModel` (packages/spec/liveness/object.json);
+// the spec liveness gate fails if this tag is removed. See proof-registry.mts.
+//
+// The detail (`cbp_note`) carries NO authored RLS — access is DERIVED from the
+// master (`cbp_account`, owner-scoped). The proof asserts both directions:
+//   • a member who cannot read the admin's account can neither READ nor by-id
+//     WRITE notes under it (the derived guard), and
+//   • the member CAN read/write notes under an account they own (not over-blocked).
+
+import { describe, it, expect, beforeAll, afterAll } from 'vitest';
+import { bootStack, type VerifyStack } from '@objectstack/verify';
+import { cbpStack, cbpSecurity } from './fixtures/cbp-fixture.js';
+
+describe('objectstack verify: master-detail controlled-by-parent (#cbp)', () => {
+  let stack: VerifyStack;
+  let adminToken: string;
+  let memberToken: string;
+
+  // Admin-owned graph (member must NOT reach it).
+  let adminAccountId: string;
+  let adminNoteId: string;
+
+  beforeAll(async () => {
+    stack = await bootStack(cbpStack, { security: cbpSecurity() });
+    adminToken = await stack.signIn();
+    memberToken = await stack.signUp('cbp-member@verify.test');
+
+    const acc = await stack.apiAs(adminToken, 'POST', '/data/cbp_account', { name: 'admin account' });
+    expect(acc.status, `admin account create: ${acc.status} ${await acc.clone().text()}`).toBeLessThan(300);
+    adminAccountId = idOf(await acc.json());
+
+    const note = await stack.apiAs(adminToken, 'POST', '/data/cbp_note', {
+      name: 'admin note',
+      body: 'admin-only',
+      account: adminAccountId,
+    });
+    expect(note.status, `admin note create: ${note.status} ${await note.clone().text()}`).toBeLessThan(300);
+    adminNoteId = idOf(await note.json());
+  }, 60_000);
+
+  afterAll(async () => {
+    await stack?.stop();
+  });
+
+  it('precondition: the member cannot read the admin master account (owner RLS)', async () => {
+    const r = await stack.apiAs(memberToken, 'GET', `/data/cbp_account/${adminAccountId}`);
+    expect(r.status, 'member must not read the admin account').not.toBe(200);
+  });
+
+  it('DERIVED READ: member cannot read a note under an account they cannot read', async () => {
+    const r = await stack.apiAs(memberToken, 'GET', `/data/cbp_note/${adminNoteId}`);
+    expect(r.status, 'member must not read the controlled-by-parent note').not.toBe(200);
+  });
+
+  it('DERIVED WRITE: member cannot by-id mutate a note whose master they cannot edit', async () => {
+    const w = await stack.apiAs(memberToken, 'PATCH', `/data/cbp_note/${adminNoteId}`, { body: 'hacked' });
+    expect(w.status, 'member by-id write should be denied').not.toBeLessThan(300);
+    // Ground truth: admin re-reads — the row must be unchanged.
+    const after = await stack.apiAs(adminToken, 'GET', `/data/cbp_note/${adminNoteId}`);
+    expect(after.status).toBe(200);
+    expect(((await after.json()) as any).record?.body).toBe('admin-only');
+  });
+
+  it('NOT over-blocked: member CAN read + write a note under an account they own', async () => {
+    // Member owns this account → derived access grants the note under it.
+    const acc = await stack.apiAs(memberToken, 'POST', '/data/cbp_account', { name: 'member account' });
+    expect(acc.status).toBeLessThan(300);
+    const memberAccountId = idOf(await acc.json());
+
+    const note = await stack.apiAs(memberToken, 'POST', '/data/cbp_note', {
+      name: 'member note',
+      body: 'mine',
+      account: memberAccountId,
+    });
+    expect(note.status, `member note create: ${note.status} ${await note.clone().text()}`).toBeLessThan(300);
+    const memberNoteId = idOf(await note.json());
+
+    // Read it back (derived: account IN [memberAccountId]).
+    const read = await stack.apiAs(memberToken, 'GET', `/data/cbp_note/${memberNoteId}`);
+    expect(read.status, 'member should read their own note').toBe(200);
+
+    // Edit it (master is member-owned → editable).
+    const edit = await stack.apiAs(memberToken, 'PATCH', `/data/cbp_note/${memberNoteId}`, { body: 'updated' });
+    expect(edit.status, 'member should edit their own note').toBeLessThan(300);
+    const after = await stack.apiAs(memberToken, 'GET', `/data/cbp_note/${memberNoteId}`);
+    expect(((await after.json()) as any).record?.body).toBe('updated');
+  });
+});
+
+function idOf(j: any): string {
+  const id = j?.id ?? j?.record?.id;
+  expect(id, 'expected an id from create').toBeTruthy();
+  return id as string;
+}

packages/dogfood/test/fixtures/cbp-fixture.ts

@@ -0,0 +1,80 @@
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+//
+// Master-detail "controlled by parent" fixture (ADR-0055 P2).
+//
+// A two-object app exercising derived access: `cbp_account` (the MASTER) is
+// owner-scoped via RLS on `created_by`; `cbp_note` (the DETAIL) declares
+// `sharingModel: 'controlled_by_parent'` with a required master_detail field
+// pointing at the account. The detail carries NO authored RLS — its access is
+// derived from the master by the security layer (read: `account IN (accessible
+// account ids)`; write: requires master edit access).
+//
+// The proof then asserts both directions: a member who cannot read the admin's
+// account cannot read OR by-id-write notes under it, but CAN read/write notes
+// under an account they own.
+
+import { defineStack } from '@objectstack/spec';
+import { ObjectSchema, Field } from '@objectstack/spec/data';
+import { PermissionSetSchema, RLS, type PermissionSet } from '@objectstack/spec/security';
+import { SecurityPlugin, securityDefaultPermissionSets } from '@objectstack/plugin-security';
+
+/** MASTER — owner-scoped account. */
+export const CbpAccount = ObjectSchema.create({
+  name: 'cbp_account',
+  label: 'CBP Account',
+  pluralLabel: 'CBP Accounts',
+  fields: {
+    name: Field.text({ label: 'Name', required: true }),
+  },
+});
+
+/** DETAIL — note whose access is controlled by its parent account. */
+export const CbpNote = ObjectSchema.create({
+  name: 'cbp_note',
+  label: 'CBP Note',
+  pluralLabel: 'CBP Notes',
+  sharingModel: 'controlled_by_parent',
+  fields: {
+    name: Field.text({ label: 'Name', required: true }),
+    body: Field.text({ label: 'Body' }),
+    account: Field.masterDetail('cbp_account', { label: 'Account', required: true }),
+  },
+});
+
+export const cbpStack = defineStack({
+  manifest: {
+    id: 'com.dogfood.cbp_fixture',
+    namespace: 'cbp',
+    version: '0.0.0',
+    type: 'app',
+    name: 'Controlled-by-Parent Fixture',
+    description: 'Master-detail app exercising controlled_by_parent derived access (ADR-0055).',
+  },
+  objects: [CbpAccount, CbpNote],
+});
+
+const FIXTURE_MEMBER_SET = 'cbp_fixture_member';
+
+/**
+ * The fallback permission set for a fresh member: full CRUD on both objects (so
+ * requests reach the RLS layer rather than being denied by RBAC) and an OWNER
+ * policy on the MASTER account. The detail `cbp_note` gets NO RLS — its scoping
+ * is derived from the master by `sharingModel: 'controlled_by_parent'`.
+ */
+export const cbpMemberSet: PermissionSet = PermissionSetSchema.parse({
+  name: FIXTURE_MEMBER_SET,
+  label: 'CBP Fixture Member — owner-scoped account, controlled-by-parent notes',
+  isProfile: true,
+  objects: {
+    cbp_account: { allowRead: true, allowCreate: true, allowEdit: true, allowDelete: true },
+    cbp_note: { allowRead: true, allowCreate: true, allowEdit: true, allowDelete: true },
+  },
+  rowLevelSecurity: [RLS.ownerPolicy('cbp_account', 'created_by')],
+});
+
+export function cbpSecurity(): SecurityPlugin {
+  return new SecurityPlugin({
+    defaultPermissionSets: [...securityDefaultPermissionSets, cbpMemberSet],
+    fallbackPermissionSet: FIXTURE_MEMBER_SET,
+  });
+}