@everystack/cli 0.4.79 → 0.4.81

package/CHANGELOG.md

@@ -4,6 +4,44 @@ All notable changes to `@everystack/cli` are documented here.
 
 Format based on [Keep a Changelog](https://keepachangelog.com/).
 
+## [0.4.81] - 2026-09-08
+
+### Added
+
+- every declared write compiles a policy; check narrows, never replaces
+
+### Fixed
+
+- db:pull recovers owner: from the normalized predicate and round-trips
+
+## [0.4.80] - 2026-09-07
+
+### BREAKING CHANGES
+
+- apply-contract v3 — the default-privilege lock is a server-run gate; redeploy the stage before the first staged db:apply after upgrading
+
+### Added
+
+- empty-edge summary names the ungoverned grantees, not 35 tables
+- carryUngovernedAuthz — the full-prediction merge helper (N3 step 1)
+- predictLiveState carryUngoverned — the full endpoint flavor (N3 step 2)
+- the plan `to` is the full endpoint, verified and disclosed (N3 steps 3-5)
+- a plan-created serial sequence is granted in the same plan
+- the plan locks the default-privilege posture it predicted from
+
+### Fixed
+
+- the full endpoint carries default privileges onto plan-created objects
+- bump apply-contract to v2 for the full endpoint; sharpen the empty-edge summary
+- db:check fails on a named artifact path with nothing at it
+
+### Documentation
+
+- the plan `to` flavor; test: condition (a) drop end-to-end (N3 step 6)
+- every db verb has a reference entry, and a test says so
+- the disclosed gap names what actually compiles, and a test pins it
+- the last two rollback-point sentences say what the code does; the retargeting edge is named
+
 ## [0.4.79] - 2026-09-07
 
 ### Removed

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@everystack/cli",
-  "version": "0.4.79",
+  "version": "0.4.81",
   "description": "CLI and OTA updates for Expo apps on everystack",
   "license": "AGPL-3.0-only",
   "author": "Scalable Technology, Inc. <licensing@scalable.technology>",

package/src/cli/apply-execute.ts

@@ -38,7 +38,7 @@ import {
   COLUMN_GRANTS_SQL,
   EFFECTIVE_PRIVILEGES_SQL,
   SCHEMA_ACL_SQL,
-  SEQUENCE_ACLS_SQL,
+  SEQUENCE_ACLS_SQL, DEFAULT_ACL_SQL,
   type QueryRunner,
   type AuthzContract,
 } from './authz-contract';
@@ -56,10 +56,9 @@ import {
 } from './schema-introspect';
 import { FUNCTIONS_SQL, contractFunctionRow } from './security-catalog';
 import { fingerprintLive, FINGERPRINT_VERSION } from './schema-fingerprint';
-import { governedLiveFingerprint } from './edge-plan';
 import { applyGeneratedStatements } from './state-apply';
 import { ENSURE_RECONCILER_SQL, renderSchemaLogInsert, renderSchemaLogFingerprintUpdate } from './derived-apply';
-import { checkPlanPrecondition, planHash, type EdgePlan } from './edge-plan';
+import { checkPlanPrecondition, planHash, defaultAclHash, type EdgePlan } from './edge-plan';
 import type { DescentLedgerRow } from './git-descent';
 
 /**
@@ -255,6 +254,9 @@ export async function liveBaseAndLedger(session: SessionRunner): Promise<LiveBas
     [
       COLUMNS_SQL, CONSTRAINTS_SQL, ENUMS_SQL, INDEXES_SQL, SEQUENCES_SQL, EXTENSIONS_SQL,
       RLS_SQL, POLICIES_SQL, GRANTS_SQL, COLUMN_GRANTS_SQL, EFFECTIVE_PRIVILEGES_SQL, SCHEMA_ACL_SQL, SEQUENCE_ACLS_SQL, FUNCTIONS_SQL,
+      // The default-privilege posture the plan's `defaultAclHash` is checked against — read in
+      // the SAME session as the lock's state, so the two gates describe one instant.
+      DEFAULT_ACL_SQL,
       { sql: SCHEMA_LOG_WITNESS_SQL, allowFailure: true },
     ],
     INTROSPECTION_SESSION,
@@ -270,8 +272,9 @@ export async function liveBaseAndLedger(session: SessionRunner): Promise<LiveBas
     columnGrants: results[9] as any[], effectivePrivileges: results[10] as any[],
     schemaAcls: results[11] as any[], sequenceAcls: results[12] as any[],
     functions: (results[13] as any[]).map(contractFunctionRow),
+    defaultAcls: results[14] as any[],
   });
-  const ledger = mapLedgerRows(rowsOrEmpty(results[14]));
+  const ledger = mapLedgerRows(rowsOrEmpty(results[15]));
   return { hash: fingerprintLive(snapshot, contract).hash, snapshot, contract, ledger };
 }
 
@@ -284,15 +287,17 @@ export async function executeApplyPlan(
 ): Promise<ApplyPlanResult> {
   const { hash: live, snapshot: before, contract: beforeAuthz, ledger } = await liveBaseAndLedger(session);
 
-  // Two flavors, matched to what each check compares (see EdgePlan): the RAW
-  // hash for live-vs-live (the lock, the backup chain), the GOVERNED hash for
-  // declared-vs-live (already-applied here, verify-after below) — computed with
-  // the exact set the mint stamped on the plan. A plan minted before the field
-  // existed verifies raw, as it was minted.
-  const governed = plan.governedRoles ? new Set(plan.governedRoles) : undefined;
-  const governedLive = governed ? governedLiveFingerprint(before, beforeAuthz, governed) : live;
+  // The endpoint is FULL (it carries the ungoverned live authz through), so it is compared against
+  // the RAW live hash directly — the same flavor as `from`. A plan without that flavor predates
+  // the full endpoint (N3, milestone plan-endpoint-full): its `to` is a governed hash, and
+  // verifying the full live against it would false-fail AFTER the DDL landed. Refuse and re-mint.
+  if (plan.toFlavor !== 'full') {
+    const reason = 'this plan predates the full endpoint — its `to` is a governed fingerprint. Re-mint with db:plan.';
+    await recordRefusal(runner, plan, live, 'plan flavor', reason, options);
+    return { status: 'refused', liveFingerprint: live, reason };
+  }
 
-  if (governedLive === plan.toFingerprint) {
+  if (live === plan.toFingerprint) {
     return { status: 'already-applied', liveFingerprint: live };
   }
   const pre = checkPlanPrecondition(plan, live);
@@ -301,6 +306,24 @@ export async function executeApplyPlan(
     return { status: 'refused', liveFingerprint: live, reason: pre.reason };
   }
 
+  // The lock covers object state. The default-privilege posture is not object state — `from`
+  // never hashed it — yet the FULL prediction consumed it for every object this plan creates.
+  // Compare it BEFORE any write: an ALTER DEFAULT PRIVILEGES since minting used to pass the
+  // lock, land the DDL, and fail verify-after post-DDL. A plan without the field predates the
+  // gate and cannot be checked; plans are minutes old, so refusing costs one re-mint.
+  if (plan.defaultAclHash === undefined) {
+    const reason = 'this plan predates the default privileges lock — it carries no defaultAclHash. Re-mint with db:plan.';
+    await recordRefusal(runner, plan, live, 'default privileges', reason, options);
+    return { status: 'refused', liveFingerprint: live, reason };
+  }
+  if (defaultAclHash(beforeAuthz) !== plan.defaultAclHash) {
+    const reason =
+      'the default-privilege posture (ALTER DEFAULT PRIVILEGES) moved since minting — the plan predicted its endpoint ' +
+      'from the old one, so the objects it creates would land with grants it did not carry. Re-mint with db:plan.';
+    await recordRefusal(runner, plan, live, 'default privileges', reason, options);
+    return { status: 'refused', liveFingerprint: live, reason };
+  }
+
   if (options.checkDescent) {
     const descent = await options.checkDescent({ snapshot: before, contract: beforeAuthz, fingerprint: live, ledger });
     if (!descent.ok) {
@@ -347,19 +370,19 @@ export async function executeApplyPlan(
     ...(options.descentNote ? { descentNote: options.descentNote } : {}),
   });
 
-  const { hash: landed, snapshot: after, contract: afterAuthz } = await liveBaseFingerprint(session);
+  const { hash: landed } = await liveBaseFingerprint(session);
   if (result.logId !== undefined) {
-    // The log stamps the RAW landed hash — the same flavor as `from`, so the
+    // The log stamps the RAW landed hash — the same flavor as `from` AND as the full `to`, so the
     // schema_log chain reads as one consistent series of live states.
     await runner(renderSchemaLogFingerprintUpdate(result.logId, landed));
   }
 
-  const governedLanded = governed ? governedLiveFingerprint(after, afterAuthz, governed) : landed;
-  if (governedLanded !== plan.toFingerprint) {
+  // The full `to` equals the post-apply raw live hash, so verify-after compares them directly.
+  if (landed !== plan.toFingerprint) {
     return {
       status: 'verify-failed',
       liveFingerprint: landed,
-      reason: `applied, but the target landed on ${governedLanded.slice(0, 12)} — the plan predicted ${plan.toFingerprint.slice(0, 12)}. Investigate before touching this database again (db:fingerprint, db:generate).`,
+      reason: `applied, but the target landed on ${landed.slice(0, 12)} — the plan predicted ${plan.toFingerprint.slice(0, 12)}. Investigate before touching this database again (db:fingerprint, db:generate).`,
       ...(result.logId !== undefined ? { logId: result.logId } : {}),
     };
   }

package/src/cli/authz-compile.ts

@@ -322,6 +322,22 @@ export function compileTableContract(model: ModelDescriptor, opts: CompileOption
   // A "row-scoped" condition is either a direct owner or a transitive via.
   const rowScoped = (a: Ability): boolean => Boolean(a.condition.owner || a.condition.via);
 
+  // The `authenticated` role — named `role: 'authenticated'` OR the role-less default. On a
+  // row-scoped model this role is ALWAYS row-scoped; every other role gets its own policy.
+  const isAuthClass = (a: Ability): boolean => !a.condition.role || a.condition.role === 'authenticated';
+
+  // The model's row scope as a bare condition — owner/via keys ONLY, with the READ's guards
+  // stripped. It is what an authenticated/role-less `manage` desugars to: the four verbs are
+  // scoped to the model's owner, never to whatever a `can('read', { owner, sql })` narrowed the
+  // read with. Non-null exactly when `rowPred` is.
+  const ownerConditionAbility = model.abilities.find((a) => a.condition.owner);
+  const viaConditionAbility = model.abilities.find((a) => a.condition.via);
+  const rowScopeCondition: Ability['condition'] | null = owner && ownerConditionAbility
+    ? { owner: ownerConditionAbility.condition.owner, userField: ownerConditionAbility.condition.userField, ownerExpr: ownerConditionAbility.condition.ownerExpr }
+    : via && viaConditionAbility
+      ? { via: viaConditionAbility.condition.via }
+      : null;
+
   /**
    * A read scoped to a named role — `can('read', { role })`. It compiles to its own
    * `<table>_select_<role>` policy, so its predicate must NOT also be folded into the
@@ -331,19 +347,29 @@ export function compileTableContract(model: ModelDescriptor, opts: CompileOption
   const isRoleRead = (a: Ability): boolean =>
     a.action === 'read' && Boolean(a.condition.role) && !isColumnAbility(a);
 
-  // `manage` + owner/via desugars into four verb abilities for policy emission.
-  // Role-scoped `manage` (the admin bypass) passes through — it matches `hasAdminManage`
-  // directly. Grants handle `manage` natively via `verbsFor`, so this expansion is
-  // policy-compiler-local: `compileGrants` still reads `model.abilities`.
+  // `manage` desugars into four verb abilities for policy emission. Two cases become
+  // manage-OWN (four row-scoped verbs):
+  //   - `manage` carrying its OWN owner/via (`can('manage', { owner })`); or
+  //   - authenticated/role-less `manage` on a row-scoped MODEL — the role is dropped and the
+  //     model's owner/via added, because the authenticated role on a row-scoped model is
+  //     always row-scoped (the W1 ruling). The literal reading (an ALL policy USING true for
+  //     authenticated beside `_select_own`) would be the round-1 widening: permissive policies
+  //     UNION, so an unconditional policy beside an owner-checked one opens the whole table.
+  // Everything else — another role's `manage` (the admin bypass, an editor's ALL), or an
+  // authenticated `manage` with no row scope — passes through to the ALL-policy path below.
+  // Grants handle `manage` natively via `verbsFor`, so this expansion is policy-compiler-local:
+  // `compileGrants` still reads `model.abilities`.
+  const desugarManage = (c: Ability['condition']): Ability[] => [
+    { action: 'read', condition: c },
+    { action: 'create', condition: c },
+    { action: 'update', condition: c },
+    { action: 'delete', condition: c },
+  ];
   const abilities: readonly Ability[] = model.abilities.flatMap((a) => {
-    if (a.action !== 'manage' || !rowScoped(a)) return [a];
-    const c = a.condition;
-    return [
-      { action: 'read' as const, condition: c },
-      { action: 'create' as const, condition: c },
-      { action: 'update' as const, condition: c },
-      { action: 'delete' as const, condition: c },
-    ];
+    if (a.action !== 'manage') return [a];
+    if (rowScoped(a)) return desugarManage(a.condition);
+    if (isAuthClass(a) && rowScopeCondition) return desugarManage(rowScopeCondition);
+    return [a];
   });
 
   const predFor = (action: Ability['action']): string | null => {
@@ -370,15 +396,6 @@ export function compileTableContract(model: ModelDescriptor, opts: CompileOption
     }
     return null;
   };
-  const checkFor = (action: Ability['action']): string | null => {
-    for (const a of abilities) {
-      if (a.action !== action) continue;
-      const p = rawPredicate(a.condition.check, `${table}: can('${action}', { check })`);
-      if (p) return p;
-    }
-    return null;
-  };
-  const hasAdminManage = abilities.some((a) => a.action === 'manage' && a.condition.role === 'admin');
   const hasPublicRead = abilities.some((a) => a.action === 'read' && !a.condition.role && !rowScoped(a));
   // The audience is open when the public read says so. Read off the SAME abilities that make
   // `hasPublicRead` true, so the two can never disagree about which read is being compiled.
@@ -389,10 +406,7 @@ export function compileTableContract(model: ModelDescriptor, opts: CompileOption
   // full-row owner read — so it is excluded here and handled by its own branch.
   const hasOwnerRead = abilities.some((a) => a.action === 'read' && rowScoped(a) && !isColumnAbility(a));
   const hasColumnOwnerRead = abilities.some((a) => a.action === 'read' && isColumnAbility(a) && !a.condition.role && rowScoped(a));
-  const canCreate = abilities.some((a) => a.action === 'create');
-  const hasUpdateOwner = abilities.some((a) => a.action === 'update' && rowScoped(a) && !isColumnAbility(a));
   const hasColumnUpdateOwner = abilities.some((a) => a.action === 'update' && isColumnAbility(a) && !a.condition.role && rowScoped(a));
-  const hasDeleteOwner = abilities.some((a) => a.action === 'delete' && rowScoped(a));
 
   const t = model.table;
   const policies: PolicyContract[] = [];
@@ -410,8 +424,15 @@ export function compileTableContract(model: ModelDescriptor, opts: CompileOption
     });
   };
 
-  // admin-bypass — one ALL policy, true/true.
-  if (hasAdminManage) policy(`${t}_admin`, 'ALL', ['admin'], 'true', 'true');
+  // The ALL-policy `manage` roles — every `manage` ability that did NOT desugar to manage-own:
+  // another role's bypass (admin, editor, moderator) and an authenticated `manage` with no row
+  // scope. Each is one ALL policy `<t>_<role>` USING true WITH CHECK true. `admin` is simply the
+  // first instance of this rule, not a special case; the fold to `authenticated` covers the
+  // role-less no-scope `can('manage')`. Deduplicated by policy name.
+  const manageAllRoles = [...new Set(
+    abilities.filter((a) => a.action === 'manage').map((a) => policyRole(a.condition.role ?? 'authenticated')),
+  )];
+  for (const role of manageAllRoles) policy(`${t}_${role}`, 'ALL', [role], 'true', 'true');
 
   if (hasPublicRead) {
     // public read on a soft-delete table — split per role; authenticated owners
@@ -512,26 +533,136 @@ export function compileTableContract(model: ModelDescriptor, opts: CompileOption
     );
   }
 
-  // owner-gated writes. INSERT checks ownership (you can only create rows you own);
-  // UPDATE gates + checks; DELETE gates. `rowPred` is the direct-owner or `via:` predicate.
+  // Writes. Every declared write compiles a policy — a grant with no policy behind it is dead
+  // under RLS, which is the whole bug this milestone closes. The rule per verb:
   //
-  // A declared `check` is the WITH CHECK half; without one the read half governs both
-  // (Postgres' own default). The two differ when a row may be written into a shape its
-  // author could not have selected by — the direction that matters is a check WEAKER than
-  // the using, which lets an owner move their own row past whatever the using guarded.
-  const createPred = andPredicates(rowPred, predFor('create'));
-  const updatePred = andPredicates(rowPred, predFor('update'));
-  const deletePred = andPredicates(rowPred, predFor('delete'));
-
-  if (canCreate && createPred) {
-    policy(`${t}_insert_own`, 'INSERT', ['authenticated'], null, checkFor('create') ?? createPred);
-  }
-  if ((hasUpdateOwner || predFor('update')) && updatePred) {
-    policy(`${t}_update_own`, 'UPDATE', ['authenticated'], updatePred, checkFor('update') ?? updatePred);
+  //   - authenticated (named or role-less), on a ROW-SCOPED model → `_<verb>_own`.
+  //     USING = rowScope AND where; WITH CHECK = rowScope AND (check ?? where). The row-scope
+  //     term is NEVER removable: a `where`/`check` narrows WITHIN own rows. INSERT has no USING;
+  //     DELETE has no WITH CHECK.
+  //   - authenticated, on a model with NO row scope → `_<verb>_authenticated`.
+  //     USING = where ?? true; WITH CHECK = check ?? where ?? true.
+  //   - any OTHER named role → `_<verb>_<role>`, predicate ?? true. NEVER folded into `_own`,
+  //     so one role's `where` can never narrow (or, unscoped, widen) another's rows.
+  //
+  // Permissive policies UNION, so at most ONE authenticated policy is emitted per verb — the
+  // where/check are taken from the first authenticated ability that declares one.
+  // A column-scoped write with no role cannot carry a WITH CHECK. Postgres' WITH CHECK is
+  // ROW-level, never column-level, so the predicate has nowhere honest to go: AND-ing it into
+  // the full-row `_own` policy over-applies it to every update (not just the scoped columns),
+  // and dropping it silently is an evaporating security rule — the exact hole this compiler
+  // throws over for a malformed `sql:`. So it throws here too, rather than swallow it. (A
+  // NAMED-role column write keeps its own policy and is unaffected; a row-level `check:` on a
+  // non-column ability is the supported spelling.)
+  for (const a of model.abilities) {
+    // A role name is emitted UNQUOTED into GRANT/CREATE POLICY, so Postgres folds or splits
+    // anything that is not a bare lowercase identifier: `AUTHENTICATED` folds onto
+    // `authenticated`, `anon, authenticated` becomes two grantees — and a policy meant for a
+    // distinct role silently lands on a real vocabulary role beside its owner-checked one, which
+    // permissive UNION turns into the whole table. Refuse it. (PUBLIC is folded deliberately by
+    // isPseudoPublic and is exempt.)
+    const role = a.condition.role;
+    if (role && !isPseudoPublic(role) && !/^[a-z_][a-z0-9_]*$/.test(role)) {
+      throw new Error(
+        `${table}: can('${a.action}', { role: '${role}' }) — a role name is emitted unquoted, so it must be a bare `
+        + `lowercase identifier ([a-z_][a-z0-9_]*). '${role}' would be case-folded or split by Postgres and the policy `
+        + `would land on a different role. Use the exact lowercase role name.`,
+      );
+    }
+    // A role-less column ability cannot carry a ROW predicate (where/sql/check). Postgres USING
+    // and WITH CHECK are row-level, never column-level, so the predicate has nowhere honest to
+    // go: applied to the whole-row policy it over-applies to every column, dropped it evaporates
+    // — the exact hole this compiler throws over for a malformed `sql:`. (A NAMED-role column
+    // ability keeps its own policy and is unaffected; a row-level predicate on a non-column
+    // ability is the supported spelling.)
+    if (isColumnAbility(a) && !a.condition.role
+      && (a.condition.check != null || a.condition.sql != null || a.condition.where != null)) {
+      throw new Error(
+        `${table}: can('${a.action}', { owner, columns, … }) — a column-scoped ability cannot carry a row predicate `
+        + `(where/sql/check). Postgres USING/WITH CHECK are row-level, not column-level, so the predicate could only be `
+        + `applied to the whole-row policy (over-applying it to every column) or dropped (an evaporating security rule). `
+        + `Move the predicate to a row-level ability — can('${a.action}', { owner, where }) — or enforce it with a trigger.`,
+      );
+    }
   }
-  else if (hasColumnUpdateOwner && updatePred) {
-    policy(`${t}_update_own`, 'UPDATE', ['authenticated'], updatePred, updatePred);
+
+  const WRITE_VERBS = [
+    { action: 'create' as const, word: 'insert', command: 'INSERT' as PolicyCommand },
+    { action: 'update' as const, word: 'update', command: 'UPDATE' as PolicyCommand },
+    { action: 'delete' as const, word: 'delete', command: 'DELETE' as PolicyCommand },
+  ];
+  const firstPred = (abs: readonly Ability[], half: 'where' | 'check'): string | null => {
+    for (const a of abs) {
+      const raw = half === 'check' ? a.condition.check : (a.condition.sql ?? a.condition.where);
+      const label = `${table}: can('${a.action}'${half === 'check' ? ', { check }' : ''})`;
+      const p = rawPredicate(raw, label);
+      if (p) return p;
+    }
+    return null;
+  };
+  for (const { action, word, command } of WRITE_VERBS) {
+    const verbAbilities = abilities.filter((a) => a.action === action && !isColumnAbility(a));
+    const authAbilities = verbAbilities.filter(isAuthClass);
+
+    if (authAbilities.length) {
+      const where = firstPred(authAbilities, 'where');
+      const check = firstPred(authAbilities, 'check');
+      if (rowPred) {
+        policy(
+          `${t}_${word}_own`, command, ['authenticated'],
+          command === 'INSERT' ? null : andPredicates(rowPred, where),
+          command === 'DELETE' ? null : andPredicates(rowPred, check ?? where),
+        );
+      } else {
+        // No row scope: USING = where ?? true, WITH CHECK = check ?? where ?? true. Route through
+        // andPredicates so a vacuous `where: sql`true`` collapses to plain `true` rather than
+        // leaking a `(true)` term that would churn the reconciler against a live `USING (true)`.
+        policy(
+          `${t}_${word}_authenticated`, command, ['authenticated'],
+          command === 'INSERT' ? null : (andPredicates(where) ?? 'true'),
+          command === 'DELETE' ? null : (andPredicates(check ?? where) ?? 'true'),
+        );
+      }
+    } else if (action === 'update' && hasColumnUpdateOwner && rowPred) {
+      // A column-scoped owner update with no full-row authenticated update: the row gate is the
+      // owner (this policy), the GRANT scopes the columns. The full-row branch above would have
+      // covered it otherwise, so this only fires when there is no non-column owner update.
+      policy(`${t}_update_own`, 'UPDATE', ['authenticated'], rowPred, rowPred);
+    }
+
+    // Other named roles — each its own policy, never folded into `_own`.
+    const seenRoles = new Set<string>();
+    for (const a of verbAbilities) {
+      if (isAuthClass(a)) continue;
+      const role = policyRole(a.condition.role!);
+      if (seenRoles.has(role)) continue;
+      seenRoles.add(role);
+      const name = `${t}_${word}_${role}`;
+      const label = `${table}: can('${action}', { role: '${role}' })`;
+      if (policies.some((p) => p.name === name)) {
+        throw new Error(
+          `${label} collides with the ${name} policy already compiled from this model. `
+          + `Declare one ${action} ability for that role: permissive policies OR together, so separate rules could only widen.`,
+        );
+      }
+      const where = rawPredicate(a.condition.sql ?? a.condition.where, label);
+      const check = rawPredicate(a.condition.check, `${label}, { check }`);
+      // A role that ALSO declares owner:/via: (`can('update', { role: 'editor', owner })`) is
+      // scoped to its own rows exactly as an authenticated owner write is — the row scope AND-s
+      // in, and without it the role would get USING (true): the whole table, not its own rows.
+      // Same rule the role-read (`isRoleRead`) and column-role-update loops already apply.
+      const roleScope = rowScoped(a) ? rowPred : null;
+      policy(
+        name, command, [role],
+        command === 'INSERT' ? null : (andPredicates(roleScope, where) ?? 'true'),
+        command === 'DELETE' ? null : (andPredicates(roleScope, check ?? where) ?? 'true'),
+      );
+    }
   }
+
+  // Column-scoped role UPDATE — a `can('update', { role, columns })` grants those columns and
+  // needs its own policy TO that role. (The owner/column-owner cases are handled above; this is
+  // the named-role column path, kept distinct because `verbAbilities` excludes column abilities.)
   for (const a of abilities.filter((ability) =>
     isColumnAbility(ability) && ability.action === 'update' && Boolean(ability.condition.role),
   )) {
@@ -544,14 +675,16 @@ export function compileTableContract(model: ModelDescriptor, opts: CompileOption
         + `Declare one update ability for that role: permissive policies OR together, so separate rules could only widen.`,
       );
     }
-    const using = andPredicates(
-      rowScoped(a) ? rowPred : null,
-      rawPredicate(a.condition.sql ?? a.condition.where, where),
-    ) ?? 'true';
-    policy(name, 'UPDATE', [role], using, rawPredicate(a.condition.check, `${where}, { check }`) ?? using);
-  }
-  if ((hasDeleteOwner || predFor('delete')) && deletePred) {
-    policy(`${t}_delete_own`, 'DELETE', ['authenticated'], deletePred, null);
+    const rowScope = rowScoped(a) ? rowPred : null;
+    const wherePred = rawPredicate(a.condition.sql ?? a.condition.where, where);
+    const checkPred = rawPredicate(a.condition.check, `${where}, { check }`);
+    const using = andPredicates(rowScope, wherePred) ?? 'true';
+    // WITH CHECK NARROWS, symmetric with USING: the row scope is ANDed in, never replaced, and
+    // the write guard defaults to the read guard. The old `rawPredicate(check) ?? using` emitted
+    // the check verbatim, so on a row-scoped column update a `check:` dropped the owner term —
+    // the one path the milestone's headline claim did not yet hold.
+    const check = andPredicates(rowScope, checkPred ?? wherePred) ?? using;
+    policy(name, 'UPDATE', [role], using, check);
   }
 
   policies.sort((a, b) => a.name.localeCompare(b.name));

package/src/cli/authz-contract.ts

@@ -357,6 +357,15 @@ export interface AuthzContract {
    * it did not read.
    */
   sequenceGrants?: SequenceGrantContract[];
+  /**
+   * Default privileges (`pg_default_acl`) that fire for objects the current role CREATES —
+   * `{ tables, sequences }`, each schema (`''` = all schemas) → grantee → sorted privileges. The
+   * FULL prediction folds the ungoverned slice onto plan-created objects: Postgres auto-grants
+   * them at creation, so a `to` endpoint without them false-verify-fails a successful CREATE
+   * apply on a brownfield BI stage. Absent means NOT MEASURED (older recorder, hand-built
+   * fixture) — the prediction then models no default ACL, as before.
+   */
+  defaultAcls?: { tables: DefaultAclScope; sequences: DefaultAclScope };
 }
 
 /**
@@ -682,6 +691,59 @@ export function assembleSequenceGrants(rows: readonly SequenceAclRow[]): Sequenc
   return [...bySequence.values()].sort((a, b) => a.sequence.localeCompare(b.sequence));
 }
 
+/**
+ * The default privileges (`ALTER DEFAULT PRIVILEGES`) that fire for TABLES and SEQUENCES the
+ * CURRENT role creates — so the prediction can model what a plan-CREATED object will carry.
+ *
+ * `pg_default_acl` is keyed by (defaclrole, defaclnamespace, defaclobjtype). An object created by
+ * role R in schema S receives the ACL for (R, S) AND for (R, all-schemas). We read the current
+ * role's rows only: everystack applies as one operator, so the creator IS the introspector. A
+ * NULL `defaclnamespace` means "every schema" — reported as an empty schema string so the
+ * resolver can union it with any specific schema. Objtype 'r' is a table, 'S' a sequence.
+ */
+export const DEFAULT_ACL_SQL = `
+SELECT
+  COALESCE(n.nspname, '') AS schema,
+  d.defaclobjtype AS objtype,
+  COALESCE(r.rolname, 'PUBLIC') AS grantee,
+  a.privilege_type AS privilege
+FROM pg_default_acl d
+LEFT JOIN pg_namespace n ON n.oid = d.defaclnamespace
+CROSS JOIN LATERAL aclexplode(d.defaclacl) a
+LEFT JOIN pg_roles r ON r.oid = a.grantee
+WHERE d.defaclrole = (SELECT oid FROM pg_roles WHERE rolname = current_user)
+  AND d.defaclobjtype IN ('r', 'S')
+  AND (n.nspname IS NULL OR (n.nspname NOT IN ('pg_catalog', 'information_schema') AND n.nspname NOT LIKE 'pg_%'))
+ORDER BY 1, 2, 3, 4;
+`.trim();
+
+export interface DefaultAclRow {
+  schema: unknown;
+  /** 'r' = table, 'S' = sequence. */
+  objtype: unknown;
+  grantee: unknown;
+  privilege: unknown;
+}
+
+/** schema (`''` = all schemas) → grantee → sorted privileges. */
+export type DefaultAclScope = Record<string, Record<string, string[]>>;
+
+/** Fold the per-privilege rows into { tables, sequences }, each schema → grantee → privileges. */
+export function assembleDefaultAcls(rows: readonly DefaultAclRow[]): { tables: DefaultAclScope; sequences: DefaultAclScope } {
+  const tables: DefaultAclScope = {};
+  const sequences: DefaultAclScope = {};
+  for (const row of rows) {
+    if (row.grantee == null || row.privilege == null) continue;
+    const scope = String(row.objtype) === 'S' ? sequences : String(row.objtype) === 'r' ? tables : null;
+    if (!scope) continue;
+    const schema = String(row.schema ?? '');
+    const grantee = String(row.grantee);
+    const byGrantee = scope[schema] ?? (scope[schema] = {});
+    byGrantee[grantee] = [...new Set([...(byGrantee[grantee] ?? []), String(row.privilege)])].sort();
+  }
+  return { tables, sequences };
+}
+
 /** The two privileges a schema ACL can carry, in aclitem letter form. */
 const SCHEMA_PRIV_LETTERS: Record<string, string> = { U: 'USAGE', C: 'CREATE' };
 
@@ -872,6 +934,8 @@ export interface ContractRows {
   schemaAcls?: SchemaAclRow[];
   /** SEQUENCE_ACLS_SQL. Optional — absent means not measured, never "no sequences". */
   sequenceAcls?: SequenceAclRow[];
+  /** DEFAULT_ACL_SQL. Optional — absent means not measured, never "no default privileges". */
+  defaultAcls?: DefaultAclRow[];
   /** Already-mapped function descriptors (from security-catalog's FUNCTIONS_SQL). */
   functions: { schema: string; name: string; securityDefiner: boolean; hasSearchPath: boolean; owner?: string; ownerBypassesRls?: boolean; ownerIsSuperuser?: boolean }[];
 }
@@ -966,6 +1030,7 @@ export function assembleContract(rows: ContractRows): AuthzContract {
     ...(schemaAcls ? { schemaAcls } : {}),
     // Same absent-means-unmeasured contract as schemaAcls above.
     ...(rows.sequenceAcls ? { sequenceGrants: assembleSequenceGrants(rows.sequenceAcls) } : {}),
+    ...(rows.defaultAcls ? { defaultAcls: assembleDefaultAcls(rows.defaultAcls) } : {}),
   };
 }
 
@@ -978,8 +1043,8 @@ export async function introspectContract(
   // ONE session: the queries describe one moment under one pinned search_path.
   // Policy USING / WITH CHECK expressions deparse relative to that path, so a read spread
   // across connections can report authz drift that does not exist.
-  const [rls, policies, grants, columnGrants, effectivePrivileges, schemaAcls, sequenceAcls, fnRows] = await session(
-    [RLS_SQL, POLICIES_SQL, GRANTS_SQL, COLUMN_GRANTS_SQL, EFFECTIVE_PRIVILEGES_SQL, SCHEMA_ACL_SQL, SEQUENCE_ACLS_SQL, functionsSql],
+  const [rls, policies, grants, columnGrants, effectivePrivileges, schemaAcls, sequenceAcls, defaultAcls, fnRows] = await session(
+    [RLS_SQL, POLICIES_SQL, GRANTS_SQL, COLUMN_GRANTS_SQL, EFFECTIVE_PRIVILEGES_SQL, SCHEMA_ACL_SQL, SEQUENCE_ACLS_SQL, DEFAULT_ACL_SQL, functionsSql],
     INTROSPECTION_SESSION,
   );
   return assembleContract({
@@ -990,6 +1055,7 @@ export async function introspectContract(
     effectivePrivileges: effectivePrivileges as EffectivePrivilegeRow[],
     schemaAcls: schemaAcls as SchemaAclRow[],
     sequenceAcls: sequenceAcls as SequenceAclRow[],
+    defaultAcls: defaultAcls as DefaultAclRow[],
     functions: (fnRows as any[]).map(mapFunctionRow),
   });
 }