Fleet-wide RLS enforcement: report and apply FORCE ROW LEVEL SECURITY across every database in docs/attestation/fleet-inventory.json. ENABLE without FORCE is a no-op whenever the runtime role owns the table, which is the deployed shape — see docs/reports/SECURITY-FINDINGS.md F-6.
| Tier | tools |
| Role | unclassified (baselined) |
| Path | crates/tools/fleet-rls |
| Edition | 2021 |
| Targets | tools-fleet-rls |
| Public items | 0 across 0 modules |
| Tests | 0 |
What it is for
tools-fleet-rls — fleet-wide FORCE ROW LEVEL SECURITY enforcement.
# Why this exists
ALTER TABLE t ENABLE ROW LEVEL SECURITY does not apply to the table's owner. Whenever the runtime role is the owner — the shape 16 databases in this fleet are deployed with — every policy on the table is inert and a cross-tenant read succeeds. Measured 2026-07-25 against the jail: 298 RLS-enabled tables, 759 policies, 2 tables with FORCE. Demonstrated on a clone of rehearsal_hasselbring_plumbing: with the correct tenant GUC set, today's config still returned the other tenant's row. FORCE is the fix.
# Safety
FORCE changes row visibility, never row contents, and --revert undoes it. With no tenant GUC bound a SELECT returns zero rows and a DELETE matches zero rows — it fails closed, it does not destroy.
The real hazard is a GUC-name mismatch: a policy reading a GUC nobody sets excludes every row permanently, which is the B-041 lockout that cost an app access to 2,393 audit rows. --apply therefore refuses any table whose policies reference a non-canonical tenant GUC unless --allow-guc-drift is passed explicitly.
# Usage
tools-fleet-rls --check # report; exit 1 if any RLS table lacks FORCE tools-fleet-rls --apply # add FORCE (idempotent, skips GUC-drift tables) tools-fleet-rls --revert # remove FORCE (the undo) tools-fleet-rls --check --db case_forge # scope to one database
Connection base comes from FLEET_DSN_BASE (default postgres://postgres@127.0.0.1:5432).
Capabilities
No public items.
How to use it
No examples/ target, no doctest, and no test. No executable usage of this crate exists in the repository to project.
Module structure
No public modules: the crate root is its whole surface.
Public surface
No public items.
No pub use re-exports: every item above is declared in this crate.
Boundary
Depends on no other workspace tier.
Shares tier tools with 84 other crates: tools-advisory-reach, tools-archive-guard, tools-artifact-scaffold, tools-ask-ai-core, tools-ask-ais, tools-ask-gemini, tools-book, tools-book-report, … (84 total).
_What this crate deliberately does NOT own is a judgment. No committed registry records one for it, so none is stated here._
Where it sits
| Tier (ontology) | tools |
| Architectural role (taxonomy) | unclassified (baselined) |
| Location | crates/tools/fleet-rls |
| Vocabulary in force (lexicon) | current |
Dependencies
Runtime, from outside the workspace.
| Crate | Requirement | Features | Optional | Only on |
|---|---|---|---|---|
anyhow | ^1 | — | no | always |
serde | ^1 | derive | no | always |
serde_json | ^1 | — | no | always |
sqlx | ^0.8 | runtime-tokio, postgres, chrono, uuid, json | no | always |
tokio | ^1 | macros, rt-multi-thread | no | always |
Development. None.
Build. None.
Depended on by. Nothing in this workspace.
Feature flags
No Cargo features are defined: every capability is unconditional, so no consumer can receive a half-wired crate.
Targets
| Kind | Name | Source |
|---|---|---|
| bin | tools-fleet-rls | `src/main.rs` |
Error model
No public error type was detected: no public item declares a type named *Error, and no public signature returns one.
Operational characteristics
| Property | Evidence |
|---|---|
| async public surface | none detected |
| async runtime | yes |
| database access | yes |
| network I/O | none detected |
| unsafe code | none detected |
| environment variables | yes |
No unsafe block, unsafe fn, unsafe impl or unsafe trait was found by the parser anywhere in this crate's source.
Configuration
| Variable | Read in |
|---|---|
CARGO_MANIFEST_DIR | src/main.rs |
FLEET_DSN_BASE | src/main.rs |
Related capabilities
No workspace crate depends on this one.
Verification
No test, example or doctest was found in this crate. Nothing here is proven by the crate itself.
Documentation coverage
| Measure | Documented | Total |
|---|---|---|
| Public items with rustdoc | 0 | 0 |
Public modules with a //! block | 0 | 0 |
Metrics
| Metric | Value |
|---|---|
| Rust source files | 1 |
| Source lines | 346 |
| Code lines | 284 |
| Public API items | 0 |
| Public modules | 0 |
| Tests | 0 |
| Examples | 0 |
| Cargo features | 0 |
| Direct runtime dependencies | 5 |
| Workspace reverse dependencies | 0 |
pie showData
title Rust source composition
"Code" : 284
"Blank or comment" : 62
Generation
Rendered by tools-corpus corpus readme from repository evidence alone, renderer schema 2, lexicon current. No model, network service or database was consulted. Regenerate with tools-corpus corpus readme --write; verify with --check.