@@ -0,0 +1,29 @@
+---
+'@objectstack/spec': minor
+'@objectstack/lint': minor
+'@objectstack/plugin-security': minor
+---
+
+feat(spec,lint,plugin-security): a membership key may yield the caller's own roster rows (`valueField: 'id'`)
+
+Clause-②: yes (widening)
+Metadata-protocol: added
+
+A declared membership key (`ObjectSchema.membershipKeys`) may now name `id`, the roster object's own primary key, as its `valueField`. `current_user.KEY` is then the ids of the signed-in user's own rows of that object, "the records I am". This covers the apps where the person is a record: an HR `employee`, a service-desk `agent`, a portal `customer`.
+
+```ts
+// on the employee roster object
+membershipKeys: {
+  my_employee_ids: { userField: 'user', valueField: 'id' },
+}
+// in a permission set
+rowLevelSecurity: [
+  { name: 'own_leave', object: 'hr_leave_request', operation: 'select', using: 'employee in current_user.my_employee_ids' },
+]
+```
+
+The key yields only rows whose `userField` is the caller, so it grants nothing by itself. What a policy grants with it is the author's choice, as for any other key.
+
+- `os validate`, `os build`, `os lint` and the server's save gate no longer refuse `valueField: 'id'` with `membership-key-value-field-invalid`. They still refuse any other column that is not a `lookup`, `master_detail` or `user` reference. `id` is still no user reference as `userField`.
+- `rls-predicate-membership-key-target` treats such a key as holding ids of the roster object itself. A policy may compare it with a column that references the roster, or with the roster's own `id`. A comparison with a column of another object, a non-reference column, or another object's `id` is refused as before.
+- The security plugin's roster read projects `id` once for such a key. The set is de-duplicated, bounded by `MEMBERSHIP_KEY_MAX_VALUES` and fails closed over the bound, as before.
@@ -458,7 +458,7 @@ const result = ApiMethod.parse(data);
 | Property | Type | Required | Description |
 | :--- | :--- | :--- | :--- |
 | **userField** | `string` | ✅ | The column of this object that holds the user a row belongs to: a single-valued user reference (`user`, or a `lookup` / `master_detail` to `sys_user`). A row counts for the signed-in user when this column holds their user id. |
-| **valueField** | `string` | ✅ | The column of this object whose values form the set: a reference (`lookup`, `master_detail` or `user`), multi-valued allowed. A policy compares the set with a column that references the same object, or with `id` on that object. Never the same column as `userField`. |
+| **valueField** | `string` | ✅ | The column of this object whose values form the set: a reference (`lookup`, `master_detail` or `user`), multi-valued allowed, or `id` for the ids of the signed-in user's own rows of this object (an employee roster's "the employee records I am"). A policy compares the set with a column that references the object the values belong to, or with `id` on that object. Never the same column as `userField`. |
 | **filter** | `string` | optional | Optional condition a roster row must also meet, in canonical CEL over this object's own columns and within the row-level security subset a policy's `using` lowers (e.g. "active == true"). It may not read any `current_user.*` value. |
 | **label** | `string` | optional | Human-readable name of the set |
 | **description** | `string` | optional | What the set holds and who it is for |
 
@@ -171,7 +171,7 @@ const result = DefaultRowScopeSchema.parse(data);
 | Property | Type | Required | Description |
 | :--- | :--- | :--- | :--- |
 | **userField** | `string` | ✅ | The column of this object that holds the user a row belongs to: a single-valued user reference (`user`, or a `lookup` / `master_detail` to `sys_user`). A row counts for the signed-in user when this column holds their user id. |
-| **valueField** | `string` | ✅ | The column of this object whose values form the set: a reference (`lookup`, `master_detail` or `user`), multi-valued allowed. A policy compares the set with a column that references the same object, or with `id` on that object. Never the same column as `userField`. |
+| **valueField** | `string` | ✅ | The column of this object whose values form the set: a reference (`lookup`, `master_detail` or `user`), multi-valued allowed, or `id` for the ids of the signed-in user's own rows of this object (an employee roster's "the employee records I am"). A policy compares the set with a column that references the object the values belong to, or with `id` on that object. Never the same column as `userField`. |
 | **filter** | `string` | optional | Optional condition a roster row must also meet, in canonical CEL over this object's own columns and within the row-level security subset a policy's `using` lowers (e.g. "active == true"). It may not read any `current_user.*` value. |
 | **label** | `string` | optional | Human-readable name of the set |
 | **description** | `string` | optional | What the set holds and who it is for |
 
@@ -1786,9 +1786,12 @@ const MEMBERSHIP_KEY_VALUE_FIELD_INVALID_EXPLANATION: RuleExplanation = {
     MEMBERSHIP_KEY_RESOLUTION,
     'The set holds F\'s values, and a policy compares it with a column that references the same object, or ' +
       'with `id` on that object. So F must be a reference column of X: `lookup`, `master_detail` or `user`. A ' +
-      'multi-valued one is allowed, and its values are flattened. A column X does not have makes the read ' +
-      'fail; any other type holds values no policy can compare with a record. F may not be U\'s column: the ' +
-      'schema refuses that, because the set would hold only the caller\'s own id.',
+      'multi-valued one is allowed, and its values are flattened. F may also be `id`, X\'s own primary key: the ' +
+      'set is then the caller\'s own rows of X, "the records I am" (an `employee` roster\'s ' +
+      '`my_employee_ids`), compared with a column that references X, such as a leave request\'s `employee`. A ' +
+      'column X does not have makes the read fail; any other type holds values no policy can compare with a ' +
+      'record. F may not be U\'s column: the schema refuses that, because the set would hold only the ' +
+      'caller\'s own user id.',
     'F is judged on the object as it runs, an `objectExtensions` entry that replaces it folded in first.',
   ],
 };
@@ -1824,15 +1827,18 @@ const RLS_PREDICATE_MEMBERSHIP_KEY_TARGET_EXPLANATION: RuleExplanation = {
   covers: 'what a membership key can be compared with',
   paragraphs: [
     MEMBERSHIP_KEY_RESOLUTION,
-    'The set holds ids of the object F references; call it T (`sys_user` for a `user` field). A policy can ' +
+    'The set holds ids of the object F references; call it T (`sys_user` for a `user` field, and the ' +
+      'declaring object X itself when F is `id`, the caller\'s own rows of X). A policy can ' +
       'only find those ids in a column that references T, or in the `id` of T itself. Tested against a ' +
       'reference to another object, against a column that is not a reference, or against the `id` of another ' +
       'object, the set never matches: `x in KEY` matches no row, and `!(x in KEY)` matches every row. Neither ' +
       'is the policy that was written. The compiler accepts the comparison, because it knows the predicate ' +
       'and not what the declaration collects; the rule reads the declaration.',
     'So test the key against the column that references T — on a purchase order whose `supplier` is a lookup ' +
-      'to the supplier object, `supplier in current_user.portal_supplier_ids` — or against `id` when the ' +
-      'policy is on T itself. A key whose declaring object is not in the stack, or that two objects declare, ' +
+      'to the supplier object, `supplier in current_user.portal_supplier_ids`; on a leave request whose ' +
+      '`employee` is a lookup to an employee roster declaring `my_employee_ids` with `valueField: \'id\'`, ' +
+      '`employee in current_user.my_employee_ids` — or against `id` when the policy is on T itself. A key ' +
+      'whose declaring object is not in the stack, or that two objects declare, ' +
       'is not judged here.',
   ],
 };
 
@@ -141,6 +141,41 @@ describe('validateMembershipKeyDeclarations — refusal 6: `valueField` is a ref
     expect(judge({ objects: [roster({ valueField: 'contact_user' }), supplier] })).toEqual([]);
   });
 
+  it("[#31129 ruling A] accepts `id`, the roster row's own primary key: the caller's own rows", () => {
+    expect(judge({ objects: [roster({ valueField: 'id' }), supplier] })).toEqual([]);
+    expect(judge({ objects: [roster({ valueField: 'id', filter: undefined }), supplier] })).toEqual([]);
+  });
+
+  it("[#31129] only the driver's primary key counts: an authored text field named `id` is still refused", () => {
+    const authoredId = parsed({
+      name: 'srm_supplier_contact',
+      label: 'Supplier contact',
+      fields: { ...ROSTER_FIELDS, id: { type: 'text', label: 'Id' } },
+      membershipKeys: { portal_supplier_ids: { userField: 'user', valueField: 'id' } },
+    });
+    const findings = judge({ objects: [authoredId, supplier] });
+    expect(brief(findings)).toEqual([{ rule: MEMBERSHIP_KEY_VALUE_FIELD_INVALID, path: `${KEY_PATH}.valueField` }]);
+    expect(findings[0].severity).toBe('error');
+    expect(findings[0].message).toContain('is a `text` field, not a reference');
+  });
+
+  it("[#31129] `id` is X's own key only as `valueField`: as `userField` it is still no user reference", () => {
+    const findings = judge({ objects: [roster({ userField: 'id', valueField: 'supplier' }), supplier] });
+    expect(brief(findings)).toEqual([{ rule: MEMBERSHIP_KEY_USER_FIELD_INVALID, path: `${KEY_PATH}.userField` }]);
+    expect(findings[0].severity).toBe('error');
+    expect(findings[0].message).toContain('not a user reference');
+  });
+
+  it('[#31129] the save door accepts an object write whose key takes `valueField: \'id\'`', () => {
+    const saved = runRuntimeAuthoringRules({
+      type: 'object',
+      item: roster({ valueField: 'id' }),
+      context: { objects: [supplier], permissions: [] },
+      rlsMembershipResolverKeys: [],
+    });
+    expect(saved.errors.filter((f) => f.rule.startsWith('membership-key-'))).toEqual([]);
+  });
+
   it('refuses a column the object does not declare, and a column that is no reference', () => {
     const missing = judge({ objects: [roster({ valueField: 'supplierr' }), supplier] });
     expect(brief(missing)).toEqual([{ rule: MEMBERSHIP_KEY_VALUE_FIELD_INVALID, path: `${KEY_PATH}.valueField` }]);
@@ -149,6 +184,8 @@ describe('validateMembershipKeyDeclarations — refusal 6: `valueField` is a ref
     const text = judge({ objects: [roster({ valueField: 'supplier_name' }), supplier] });
     expect(brief(text)).toEqual([{ rule: MEMBERSHIP_KEY_VALUE_FIELD_INVALID, path: `${KEY_PATH}.valueField` }]);
     expect(text[0].message).toContain('is a `text` field, not a reference');
+    expect(text[0].severity).toBe('error');
+    expect(text[0].hint).toContain('or at `id`');
   });
 });
 
 
@@ -28,11 +28,14 @@
  *   wrong ones. A registry-injected column (`owner_id`, `created_by`) is a
  *   column of the object and is judged by its injected definition.
  * - {@link MEMBERSHIP_KEY_VALUE_FIELD_INVALID} (refusal 6) — F is not a column
- *   of the merged object, or not a reference (`lookup`, `master_detail` or
- *   `user`). The set holds F's values, and a policy compares it with a column
- *   that references F's target or with that target's `id` (refusal 11), which
- *   only a reference has. `multiple: true` is allowed: its values are
- *   flattened. F naming U's column is refused by `MembershipKeySchema` itself.
+ *   of the merged object, or neither a reference (`lookup`, `master_detail` or
+ *   `user`) nor `id`, the object's own primary key. The set holds F's values,
+ *   and a policy compares it with a column that references F's target or with
+ *   that target's `id` (refusal 11): a reference names its target, and `id`
+ *   names X itself, so the key holds the caller's own rows of X (#31129 ruling
+ *   A, "the records I am"). Any other column has no target to compare with.
+ *   `multiple: true` is allowed: its values are flattened. F naming U's column
+ *   is refused by `MembershipKeySchema` itself.
  * - {@link MEMBERSHIP_KEY_DECLARED_TWICE} (refusal 3) — one key on two objects.
  *   `defineStack` and `composeStacks` refuse it inside one stack; this is the
  *   door they do not see, the runtime publish gate, where the other declaration
@@ -105,7 +108,11 @@ function str(v: unknown): string {
 /** The platform's user object, the target of every `user` field. */
 const USER_OBJECT = 'sys_user';
 
-/** The field types a membership key's `valueField` may have. */
+/**
+ * The field types a membership key's `valueField` may have. The one other
+ * column it may name is `id`, X's own primary key ({@link isRosterOwnId}),
+ * which has no field type: the driver, not a definition, provisions it.
+ */
 const VALUE_FIELD_TYPES: ReadonlySet<string> = new Set(['lookup', 'master_detail', 'user']);
 
 /** One `membershipKeys` entry, where the stack declares it. */
@@ -219,12 +226,32 @@ function userFieldFault(meta: GraphField): string | null {
   return null;
 }
 
-/** F's verdict: `null` when it is a reference, else the reason. */
-function valueFieldFault(meta: GraphField): string | null {
+/** F's verdict: `null` when it is a reference or X's own `id`, else the reason. */
+function valueFieldFault(column: Extract<ColumnVerdict, { kind: 'ok' }>): string | null {
+  if (column.primaryKey) return null;
+  const { meta } = column;
   if (meta.type && VALUE_FIELD_TYPES.has(meta.type)) return null;
-  return `is a \`${meta.type ?? 'untyped'}\` field, not a reference (\`lookup\`, \`master_detail\` or \`user\`)`;
+  return `is a \`${meta.type ?? 'untyped'}\` field, not a reference (\`lookup\`, \`master_detail\` or \`user\`) or \`id\``;
 }
 
+/**
+ * [#31129 ruling A] Does a membership key's resolved `valueField` name X's
+ * own primary key, so the set is the caller's own rows of X? Only the `id` the
+ * driver provisions: the graph serves it as an injected column with an empty
+ * slice. An author-declared field that happens to be named `id` is judged by
+ * its own definition, like any other column. Shared by the declaration judge
+ * and the policy-target judge, so the two cannot disagree about it.
+ */
+export function isRosterOwnId(column: string, verdict: { injected?: true; meta?: GraphField }): boolean {
+  return column === 'id' && verdict.injected === true && !verdict.meta?.type;
+}
+
+/** One of U / F, resolved on the merged object — see {@link columnOf}. */
+type ColumnVerdict =
+  | { kind: 'ok'; meta: GraphField; primaryKey: boolean }
+  | { kind: 'missing'; candidates: ReadonlySet<string> }
+  | { kind: 'skip' };
+
 /**
  * The column one of U / F names, judged on the merged object: `ok` with its
  * field slice, `missing` with the object's declared names, or `skip` when the
@@ -236,14 +263,15 @@ function columnOf(
   object: string,
   column: string,
   tied: ReadonlySet<string> | undefined,
-): { kind: 'ok'; meta: GraphField } | { kind: 'missing'; candidates: ReadonlySet<string> } | { kind: 'skip' } {
+): ColumnVerdict {
   if (!column || tied?.has(column)) return { kind: 'skip' };
   const verdict = resolveFieldPath(graph, object, column);
   if (!verdict || isUnjudgeable(verdict)) return { kind: 'skip' };
   if (verdict.kind === 'field-unknown') return { kind: 'missing', candidates: verdict.candidates };
   if (verdict.kind !== 'ok') return { kind: 'skip' };
   // `id` maps to an empty slice: the driver's primary key, never a reference.
-  return { kind: 'ok', meta: verdict.meta ?? {} };
+  // As U it is no user reference; as F it is the roster row's own id.
+  return { kind: 'ok', meta: verdict.meta ?? {}, primaryKey: isRosterOwnId(column, verdict) };
 }
 
 /**
@@ -319,7 +347,7 @@ export function validateMembershipKeyDeclarations(
           suggestName(decl.valueField, value.candidates),
       });
     } else if (value.kind === 'ok' && decl.valueField !== decl.userField) {
-      const fault = valueFieldFault(value.meta);
+      const fault = valueFieldFault(value);
       if (fault) {
         findings.push({
           severity: 'error',
@@ -329,7 +357,7 @@ export function validateMembershipKeyDeclarations(
           message:
             `\`valueField\` '${decl.valueField}' ${fault}, so the set holds values no policy can compare ` +
             'with a record',
-          hint: 'Point `valueField` at a `lookup`, `master_detail` or `user` column, or reference the values\' object',
+          hint: 'Point `valueField` at a `lookup`, `master_detail` or `user` column, or at `id` for the caller\'s own rows',
         });
       }
     }