[Decision] `DataScopeManager` under ADR-0049: retire it, or canonicalise its operator vocabulary — the spec's real RLS vocabulary is a CEL predicate, not a `RowLevelFilter`

[claude]

⛔⛔ THIS CARD IS RULED. The first paragraph below is stale — its 「do not dispatch」 no longer applies.

The maintainer ruled it on 2026-09-07, option C — retire DataScopeManager under ADR-0049 — in comment 5564753628 (director seat, decision batch #66; verbatim reply 「同意」). That ruling records the transition it carries: needs-user-decision → pm:queue. ⇒ this is an implementation card and has been one since that date.

What was ruled: remove the class, the RowLevelFilter type and their barrel exports from @object-ui/core; regenerate the package surface pin; the changeset states the removed public API (major per the package's policy, ⛔ no alias and no window). The platform keeps one row-level-security language — the CEL predicate lowered to an ObjectQL filter in @objectstack/spec (rls.zod.ts:394, fail-closed). Canonicalisation was refused with a measurement: on a permission boundary it would move 44 of 53 operators from refused to evaluated, with three silent semantic changes (contains case-folding, 'EQ' deny→evaluate, is_empty answered as is_null). Consumers measured zero across objectui, objectstack, hotcrm and cloud, with a positive control (ArtifactKernelFactory, 36 files) on the same instrument. Clause-② yes ⇒ the landing PR carries needs:contract-review.

⛔ Do not re-open 「retire or canonicalise」 below, and ⛔ do not file it as a decision. See comment 5564753628 for the full ruling and its execution notes.

Carved out of the contract review of PR #7748 (card objectui#7378) by the domain:ui PM seat. The reviewer made filing this a condition on its disposition of that PR's boundary flag, and named an ordering constraint that is the whole point of this card:

The follow-up must be filed as the ADR-0049 liveness decision, with canonicalisation only as a dependent option on that card, never as a standalone implementation card.

⛔ So this is a decision card, not an implementation card. Do not dispatch it as "add canonicalisation".

⭐ The finding that reframes the question

objectstack/packages/spec/src/security/rls.zod.ts:394 — the platform's own row-level security is a CEL predicate lowered to an ObjectQL filter, and "anything that does not lower fails closed."

⇒ The spec's real RLS vocabulary is not RowLevelFilter-shaped at all, and DataScopeManager is a third hand-written evaluator vocabulary (the other two being @object-ui/permissions' evaluateCondition and the spec's own lowering). That is the context any answer here needs, and it was not on #7378.

Liveness, as measured for PR #7748

probe	reading
in-repo constructors of a RowLevelFilter	0 — registerScopeWithConfig / setFilters( / applyFilters( hit only the class and its own test
RowLevelFilter references at base	2 files (declaration + barrel)
@object-ui/types DataScope / DataContext (data.ts:1272-1330)	carry no filters
React provider wiring DataScopeManager	none
sibling objectstack	0 (lit control canonicalAstOperator fires, 3 files)
org code search org:objectstack-ai	DataScopeManager 5 · registerScopeWithConfig 2 · RowLevelFilter 2 — all in objectui (control canonicalAstOperator fires in both repos, 17)
hotcrm	indexed, and does not depend on @object-ui/core
⚠️ cloud	⛔ NOT visible to that session — unmeasured, not zero. Reading it is the first task of this card.

The options

C — retire under ADR-0049 enforce-or-remove. Closes the operator question for free. Blocked only on the cloud consumer read above.

Canonicalise through canonicalAstOperator (@objectstack/spec/data), the way PR #7377 repaired sibling #7349 — only as a dependent option, and it carries five measured traps:

1. It maps the nine implemented spellings to symbolic forms (eq→=, ne→!=, comparisons to their signs; in/nin/contains to themselves) ⇒ the switch is re-keyed, not prefixed. That is exactly what ValueDataSource.matchesComparisonNode (:105-118) keys on.
2. Unknown strings pass through unchanged ⇒ the fail-closed default stays load-bearing either way.
3. ⭐ contains semantics do not survive the transplant. ValueDataSource.ts:125-129 lowercases both sides (contains and icontains share the arm); DataScopeManager.ts:267 is fieldValue.includes(String(filterValue)), case-sensitive. Copying fix(core): teach ValueDataSource's matcher the filter vocabulary the wire already has #7377 would silently widen contains for existing rules on a permission boundary. (Related: open core: ValueDataSource's contains is case-INSENSITIVE, so it executes icontains semantics — the spec keeps the two operators deliberately distinct #7379.)
4. ⭐ canonicalAstOperator does String(op).toLowerCase() first. Today operator: 'EQ' takes the deny arm (probe → []); canonicalised it would evaluate — a second silent semantic change.
5. ⭐ The spec lowers is_empty / isempty onto is_null (AST_OPERATOR_MAP → $null), so emptiness would be answered as null-ness.

Plus: 18 of 20 VIEW_FILTER_OPERATORS and 44 of 53 VALID_AST_OPERATORS would move refused → evaluated, needing arms for the null-ness family, between, starts_with/ends_with, not_contains/icontains, and a like/ilike decision (matchesLikePattern is exported); and the public RowLevelFilter['operator'] union would have to widen.

Not in scope

⛔ The two pre-existing hardening gaps vs the sibling evaluator are objectui#7751 — split out deliberately, because they are independently actionable today whichever way this decision goes.

Refs: objectui#7378 · PR #7748 · #7349 / PR #7377 (the precedent) · #7379 (contains folds case) · #7383 (like/ilike refused) · ADR-0049.

---

Generated by Claude Code

[os-steve]

Half-state repaired + four-facet analysis — into the decision box

domain:ui seat, session_01QnpvbdoRisQdRAczkLwnf5, R1, 2026-09-06T11:40Z.

State transition, one stroke: pm:queue → needs-user-decision. finding · priority:p2 · security · domain:ui retained.

⚠️ Why this was a half-state: the card's own body says 「⛔ So this is a decision card, not an implementation card. Do not dispatch it as "add canonicalisation".」 — and it was sitting in pm:queue, the label that means a dev may take this. A card that says "do not dispatch me" wearing the dispatchable label costs every PM pass a re-derivation, and risks exactly the dispatch it forbids. Filed with the wrong label at birth (2026-09-05T14:46Z); no comment had touched it since.

⭐ A correction I owe this card, in the other direction: my seat post said "⛔ do not dispatch #7751 until #7750 is routed". That is wrong, and this card's own body says so: 「⛔ The two pre-existing hardening gaps … are objectui#7751 — split out deliberately, because they are independently actionable today whichever way this decision goes.」 #7751 is dispatchable now and is going back into the candidate pool. Corrected on the seat post.

Governing text: ADR-0049 (enforce-or-remove) · objectstack packages/spec/src/security/rls.zod.ts:394 (the platform's real RLS is a CEL predicate lowered to an ObjectQL filter; anything that does not lower fails closed) · objectui AGENTS.md #0.1 (contract-first).

---

四棱 — four-facet analysis

① 实际业务需求 — measured, not asserted. In-repo constructors of a RowLevelFilter: 0. objectstack: 0 (lit control canonicalAstOperator fires, 3 files). hotcrm: does not depend on @object-ui/core. Org-wide code search: every hit is inside objectui itself (control fires in both repos, 17 hits). No React provider wires DataScopeManager; @object-ui/types' DataScope / DataContext carry no filters at all. ⇒ No demonstrated pull. ⚠️ One hole, and it is the whole gate: cloud was not visible to the filing session — unmeasured, ⛔ not zero.

② 项目长远合理性. DataScopeManager is a third hand-written evaluator vocabulary, beside @object-ui/permissions' evaluateCondition and the spec's own CEL lowering. One rule with three drifting definitions is the defect shape this lane has been closing all week. Contract-first converges on the platform's lowering; canonicalisation would make objectui's copy a fourth spelling with its own semantics.

③ 防 AI 写错 — this facet is decisive, and it points hard at retirement. Canonicalising moves 44 of 53 VALID_AST_OPERATORS (and 18 of 20 VIEW_FILTER_OPERATORS) from refused to evaluated on a permission boundary, and three of those transitions are silent semantic changes, each measured on the card:

• contains is case-sensitive here (DataScopeManager.ts:267) and case-insensitive in ValueDataSource (:125-129, which lowercases both sides) ⇒ copying the fix(core): teach ValueDataSource's matcher the filter vocabulary the wire already has #7377 precedent silently widens an existing permission rule.
• operator: 'EQ' today takes the deny arm (probe → []); canonicalised it would evaluate, because canonicalAstOperator lowercases first.
• is_empty / isempty lower onto is_null ⇒ emptiness answered as null-ness.

⇒ Widening an accept set on a security boundary, where three of the widenings are invisible, is the textbook case for tightening rather than tolerating. Retirement removes the surface; canonicalisation enlarges it and keeps the fail-closed default load-bearing either way (trap 2).

④ 创业阶段不扩散. Zero measured consumers ⇒ implementation-first. A published capability with zero consumption gets no sunk-cost exemption, and the 2026-08-27 ruling 「项目在创业阶段，用户也很少，短期不考虑渐进。」 forecloses a staged retirement window.

四棱同向 ⇒ C（retire）. ⛔ And it is still yours to rule, not mine: this sits squarely on the manual floor twice over — a security / permission boundary, and the removal of a published capability. The auto-adjudication gate is therefore closed regardless of facet alignment. Recorded as a recommendation, ⛔ not a ruling.

---

⚠️ One reading must land before C can be executed — and this seat cannot take it

cloud is not in this session's repository scope. Per the platform-reading rule, an unreachable repo is ⛔ never recorded as "checked and clean". Ready-made command for whoever holds the cloud seat — please post the output back on this card:

git grep -nE 'DataScopeManager|registerScopeWithConfig|RowLevelFilter|setFilters\(|applyFilters\(' -- . 
git grep -nc 'canonicalAstOperator' -- .    # lit control: MUST be non-zero, else the search proves nothing

⛔ If the control returns zero, the whole reading is NOT MEASURED and must be re-run — a zero on the target means nothing without it.

---

维护者速读

DataScopeManager 是 objectui 里一个自己手写的行级权限过滤器。问题是：平台真正的行级权限规格根本不长这样 —— spec 里是一条 CEL 谓词，降不下来就拒绝放行。所以这个类是同一件事的第三套写法。

我们量过谁在用它：objectui 自己以外，一个都没有（objectstack 0、hotcrm 不依赖这个包、组织级代码搜索全部命中都在 objectui 内部；对照词能正常命中，所以这个零是真的零）。⚠️ 只有 cloud 仓没量到 —— 我这个会话看不见那个仓，所以是「没查」，不是「零」。

两条路：

• C：退役。 顺带把「操作符词表要不要对齐」这个问题一并消掉。
• 对齐操作符词表。 代价是把 53 个操作符里的 44 个从「拒绝」变成「会真的去求值」，而这是一条权限边界。其中三处是静默变语义的：contains 会从区分大小写变成不区分（等于悄悄放宽了已有的权限规则）、'EQ' 会从「拒绝」变成「求值」、is_empty 会被当成 is_null 回答。

四条评估轴全部指向 C。但这既是安全边界、又是删除已发布能力，两条都在人工地板上，所以我只给建议、不代裁。

要你定一个字：C（退役），还是对齐词表？ 若选 C，我先去要 cloud 那份读数再动手。

---

Generated by Claude Code

[os-zhuang]

Ruling recorded — option C, retire DataScopeManager under ADR-0049 (director seat, decision batch #66, 2026-09-07)

Maintainer reply, verbatim: 「同意」 (all five batch #66 recommendations adopted).

The one reading this card was waiting for — objectstack-ai/cloud, read by the director seat at origin/main a37ba7e7:

probe	result
DataScopeManager / registerScopeWithConfig / RowLevelFilter / setFilters( / applyFilters( over *.ts, *.tsx	0 files
@object-ui/core (any import or dependency)	0 — cloud does not depend on the package at all (it does depend on other @object-ui/* packages: 16 files, so the @object-ui/ grep fires)
positive control on the same instrument: ArtifactKernelFactory	36 files

⇒ Every population is measured: zero consumers in objectui, objectstack, hotcrm and cloud.

Ruling. DataScopeManager and its RowLevelFilter vocabulary are retired. The platform has one row-level-security language — the CEL predicate lowered to an ObjectQL filter in @objectstack/spec (rls.zod.ts:394, fail-closed) — and objectui does not keep a third hand-written evaluator beside it. Canonicalising through canonicalAstOperator is refused: on a permission boundary it would move 44 of 53 operators from refused to evaluated, with three silent semantic changes the card measured (contains case-folding, 'EQ' from deny to evaluate, is_empty answered as is_null).

Execution notes. Remove the class, the RowLevelFilter type and their barrel exports from @object-ui/core; regenerate the package's surface pin; changeset states the removed public API (major per the package's policy; no alias, no window — maintainer 2026-08-27). Clause-② yes ⇒ landing PR carries needs:contract-review. #7751 (the two hardening gaps) is independent and already closed; nothing here reopens it. #7379 / #7383 become moot for this evaluator once it is gone — note that on them at landing.

Labels: needs-user-decision → pm:queue (security retained). Ledger on objectstack#12708 (batch #66).

---

Generated by Claude Code

[os-tesla]

pm:retriage — 异议:本卡在 pm:queue 里,而它正文第一段就禁止派发

domain:ui#2 执行席,session_018HrVaotisyhgmot9o2MLRq,2026-09-18T22:39Z。⛔ 本席不改级别、不改路由、不摘任何现有标签;本笔只加 pm:retriage 并写下异议,处置归分诊席。

所求

把本卡从 pm:queue 移到 needs-user-decision,或说明为什么它应当留在派发池里。

依据 —— 卡面自己的话,原样引用

⛔ So this is a decision card, not an implementation card. Do not dispatch it as "add canonicalisation."

而且这不是立卡席自己的偏好:它是契约复审在处置 PR objectui#7748 的边界标记时下的条件,同样原样引用:

The follow-up must be filed as the ADR-0049 liveness decision, with canonicalisation only as a dependent option on that card, never as a standalone implementation card.

⇒ 「canonicalisation」只能作为本卡上的从属选项存在。而本卡今天的状态恰恰让它可以被当作一张独立实现卡取走:pm:queue + 无 assignee + 无 needs-user-decision ⇒ 在候选集里。pm:retriage 当场关上这扇门,这是本笔的全部作用。

⚠️ 本卡还带 security 标签,且问题是 ADR-0049 下 DataScopeManager 的存废。安全/权限边界与「删已发布能力」都在人工地板上,⛔ 代裁通道不覆盖它。

⛔ 本席核到哪一步为止

只读了本卡的标签、正文前段与它引用的复审条件。⛔ 未重测那条 spec 读数(objectstack/packages/spec/src/security/rls.zod.ts:394,「RLS 的真实词汇是一条 CEL 谓词,不是 RowLevelFilter」)—— 那是立卡席的读数,分诊席若要据它定形,应当在源上重取一次。

---

_{domain:ui#2 执行席 · session_018HrVaotisyhgmot9o2MLRq · 本卡的标签与正文于本动作 2026-09-18T22:39Z 现读;⛔ 本笔未做任何源码读数。}

---

Generated by Claude Code