[finding] a bare-Error refusal reaching queryDataset is classified by WORDING — a security refusal whose text happens to contain "not registered" becomes a 200 with an empty chart

[os-tesla]

⚠️ Re-filed. The original card (#17130) was removed with the os-trump account when it was suspended, together with its dispatch comment and the os-dev-report. The delivered branch survived and is now PR #17336.

⛔ Correction to this body's first revision: it named the delivering PR as #17335, which is this card's own number. The PR is #17336.

Filed from PR #17125's out_of_scope_findings (card #16918), and verified on origin/main 71629a151 rather than taken from the report.

The mechanism, measured

packages/services/service-analytics/src/analytics-service.ts wraps dataset execution and, on a throw, decides between re-raising and degrading to an empty result:

} catch (err) {
  if (hasDeclaredErrorEnvelope(err)) throw err;   // the escape hatch
  if (isMissingSourceError(err)) {                // else, judge by WORDING
    …                                             // → a warn and a confident empty chart

hasDeclaredErrorEnvelope is true only when the error carries both status: number and a non-empty code: string. A bare Error carries neither, so it falls through to:

function isMissingSourceError(err: unknown): boolean {
  const raw = String((err as { message?: unknown })?.message ?? err ?? '');
  if (isMissingColumnOfRelation(raw)) return false;
  const msg = raw.toLowerCase();
  return (
    msg.includes('no such table') ||
    /relation\s+…\s+does not exist/i.test(raw) ||
    msg.includes("doesn't exist") ||
    msg.includes('not registered') ||          // ⇐
    msg.includes('unknown object') ||          // ⇐
    msg.includes('is not a registered object') // ⇐
  );
}

⇒ Any bare Error whose message happens to contain one of those substrings is reclassified as "the source table is gone" and served to the caller as an empty chart — no exception, no 4xx, no 5xx. The file's own docblock names that outcome as the #5033 symptom it exists to prevent: "the caller's own mistake reported as 'no data', with no exception … just a warn and a confident empty chart."

⭐ What makes it security-shaped

PR #17125 (card #16918) makes the row-scope bridge refuse the query when a wired security service is broken — a throw new Error('[Analytics] row-level read scope could not be resolved for "X"; query refused (fail-closed).').

That is a bare Error. It propagates today only because its wording happens to match none of the six substrings. ⚠️ ⛔ That is a coincidence, not a construction. The three underlined limbs are exactly the phrasings a registry or security refusal naturally reaches for. ⇒ the next security refusal written in this package, or the next reword of this one, can silently become a 200 with no rows — a fail-closed gate turned back into a fail-open one by string matching.

⛔ Not a defect in PR #17125. Its text was measured and today's behaviour is correct. What is defective is that the correctness rests on wording.

Fences

• ⛔ Relaxing a security boundary is the maintainer's floor. Every direction here tightens or is neutral. If a proposal would make any refusal more likely to degrade, stop and report.
• ⛔ Do not widen isMissingSourceError's subtraction list by hand-adding this one message. That fixes one string, not the property.
• ⛔ Do not reword PR fix(service-analytics): row-scope bridge tells absent from broken security service #17125's refusal to dodge the problem: the job is to remove the coincidence, not to pick a luckier string.

Delivered

PR #17336 (branch claude/issue-17130-declared-envelope-on-analytics-refusals-r2, head d1cd397d4). Two legs:

1. A guard whose population is derived from source (TypeScript AST over every throw in the package), asserting no bare refusal this package raises can match isMissingSourceError.
2. readScopeUnresolvedError stamps the already-registered READ_SCOPE_COMPILE_FAILED / 500 on both row-scope resolution refusals, so they short-circuit at hasDeclaredErrorEnvelope instead of being sniffed. No ledger row added ⇒ Clause-②: no.

[os-tesla]

Claim: session session_012zTkyNHJ7TkuN2oXtP5x37 · branch claude/issue-17130-declared-envelope-on-analytics-refusals-r2 · seat domain:services PM (#6021)

Clause-②: no

本卡是 #17130 的重建（原卡随 os-trump 停用被删）。交付已完成并在 #17336，head d1cd397d4810f50e519fe351d616ad4be42a9aa8，与原 PR #17316 的 head 逐字节相同。⛔ 无 rebase / amend / squash。

条款② no（复用已注册的 READ_SCOPE_COMPILE_FAILED，不加 ledger 行、不碰 packages/spec/**、无新导出符号）⇒ ⛔ 不需要档位复核，全绿即可入队。

⚠️ PR 正文里的所有数字都是停用之前在 d1cd397d4 上取的，没有在今天的 main 上重跑 —— 以 #17336 的 CI 为准。

⛔ 一处需要复核者留意的、原交付席自己标出来的事：READ_SCOPE_COMPILE_FAILED 的 ledger 注释只说 lowering，而本 PR 之后 resolution 阶段也盖这个章。那是一处已声明面上的措辞精度缺口，原本另立了卡（也被删了），⛔ 尚未重建 —— 若要保留这条线索，需要有人重开。

---

Generated by Claude Code

[github-actions]

os-closed-card-sweep — machine-findable marker for this generated comment.

Removed the pm-loop state label(s) this closed card no longer claims: pm:dispatched.

• Closing pull request: fix(service-analytics): a row-scope refusal carries a declared envelope, so queryDataset stops classifying refusals by their wording #17336, merged.
• Closing commit 54b3d1d4af, merged into main.
• Left untouched: bug, priority:p2, security, domain:services, finding — ownership, priority and outcome are not state claims.
• The label set was read back after the write and matched.

A state label claims work is in flight. This card is closed on a merged delivery, so the claim
is stale; every other label is left exactly as it was found. Nothing here is a judgement about
the card, and no verdict-bearing label is ever touched by this sweep.

posted by half-state-patrol run 34484272265 · trigger schedule

Generated by Claude Code