feat(security): ADR-0056 P1 honesty pass — D8 experimental markers + D4 RLS no-silent-drop#2064
Merged
Merged
Conversation
…ng/RLS-config EXPERIMENTAL Honesty pass per ADR-0049/ADR-0056 D8: the security-adjacent schemas with no runtime consumer get an explicit `⚠️ EXPERIMENTAL — NOT ENFORCED` header (GDPR/HIPAA/PCI, encryption, masking, security-context governance, global RLSConfig + RLSAuditEvent). The ENFORCED RowLevelSecurityPolicySchema is deliberately left unmarked. Comment-only; spec builds; liveness gate green (these aren't governed types — the markers are documentation honesty, not a gate change). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01XVdnfUAx85amkerym26vdx
…icates Stop silently dropping a `using`/`check` whose SHAPE the compiler cannot compile (`==`, AND/OR, ranges) — warn via the security plugin logger so an unenforced predicate is observable, distinguished from the intentional context-var-absent skip. Export `isSupportedRlsExpression(expr)` for a future authoring-time compile gate. Additive: valid predicates compile identically; fail-closed preserved. 4 new unit tests; plugin-security 83; RLS/OWD dogfood proofs 16/16. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01XVdnfUAx85amkerym26vdx
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
github-actions
Bot
added
documentation
Contributor
📓 Docs Drift CheckThis PR changes 2 package(s): 89 hand-written doc(s) reference the affected code and may need an implementation-accuracy re-verification:
|
os-zhuang
marked this pull request as ready for review
June 20, 2026 07:53
This was referenced Jun 20, 2026
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
ADR-0056 P1 honesty pass — two zero/low-risk decisions that make the model's unenforced surfaces honest, with no behavior change for valid usage.
D8 — mark the unenforced security-adjacent schemas EXPERIMENTAL
Per ADR-0049's enforce-or-remove gate, schemas that are parsed but have no runtime consumer now carry an explicit
⚠️ EXPERIMENTAL — NOT ENFORCEDheader: GDPR/HIPAA/PCI compliance configs, field-level encryption, data masking, the unified security-context governance, and the globalRLSConfig/RLSAuditEvent. The enforcedRowLevelSecurityPolicySchemais deliberately left unmarked. Comment-only — these were already inert; the marker makes the inertness honest. (Liveness gate green; these aren't governed types.)D4 — RLS compiler surfaces uncompilable predicates instead of dropping them silently
The compiler used to drop any
using/checkit couldn't parse (==,AND/OR, ranges) in silence — if it was the only policy, the object lost protection with no signal (the exact class of bug that left a showcase owner predicate inert for two PRs). Now it WARNS via the security-plugin logger when an unsupported-shape predicate is dropped, distinguished from the intentional "context variable absent" fail-closed skip. ExportsisSupportedRlsExpression(expr)so a future authoring-time gate (objectstack compile) can reject a predicate the runtime would never enforce.Verification
plugin-security83 unit tests (incl. 4 new D4 tests: validator accepts compilable shapes, rejects==/AND/ranges, warns on unsupported-shape drop, does NOT warn on context-var-absent).Where this sits in ADR-0056
P1 (honesty, no behavior change). Remaining: D1 OWD enum reconciliation, D2 anonymous default-deny and D7 default Profile (behavior-changing — separate PRs with scenarios), D6 role hierarchy (P4), D10 conformance matrix.
🤖 Generated with Claude Code
Generated by Claude Code