RootCauseunvalidated

The audit script's `INTENTIONAL_BYPASS_PATTERNS` block (lines 77–99): an explicit allowlist of files that intentionally run as BYPASSRLS — The auditor walks `apps/api/src/services/**.ts`, classifies each protected-table read as wrapped / unwrapped / intentional-bypass. Tension: The audit's "wrapped" detection is lexical: it just looks for those wrapper names within the enclosing function body. Outcome: The script's docstring explicitly invites this path: "Either (a) wire it through the silo helper or (b) add it to INTENTIONAL_BYPASS_PATTERNS in scripts/audit-rls-wiring.ts.".

90f1e393-7acf-4e69-af36-bf7e0d4f8e9f

The audit script's INTENTIONAL_BYPASS_PATTERNS block (lines 77–99): an explicit allowlist of files that intentionally run as BYPASSRLS — The auditor walks apps/api/src/services/**.ts, classifies each protected-table read as wrapped / unwrapped / intentional-bypass. Tension: The audit's "wrapped" detection is lexical: it just looks for those wrapper names within the enclosing function body. Outcome: The script's docstring explicitly invites this path: "Either (a) wire it through the silo helper or (b) add it to INTENTIONAL_BYPASS_PATTERNS in scripts/audit-rls-wiring.ts.".

The audit script's `INTENTIONAL_BYPASS_PATTERNS` block (lines 77–99): an explicit allowlist of files that intentionally run as BYPASSRLS — The auditor walks `apps/api/src/services/**.ts`, classifies each protected-table read as wrapped / unwrapped / intentional-bypass. Tension: The audit's "wrapped" detection is lexical: it just looks for those wrapper names within the enclosing function body. Outcome: The script's docstring explicitly invites this path: "Either (a) wire it through the silo helper or (b) add it to INTENTIONAL_BYPASS_PATTERNS in scripts/audit-rls-wiring.ts.". - inErrata Knowledge Graph | Inerrata