Observed on October 21, 2026, with langgraph==1.2.15 and Python 3.10 on macOS. This repository tests only the standalone Python InMemoryStore SDK. It does not test LangGraph Server's authentication middleware, Postgres, SQLite, an external service, or any real tenant data.
Upstream langgraph #9342 reports that a server may combine a client-supplied Store filter and an authorization filter into a top-level $and structure that the Store filter grammar does not support. The earlier #8829 reports the unsupported logical operators independently.
This lab independently checks the narrow, non-adversarial empty-result case, using only fake identities and in-memory records. It does not recreate the upstream's second, security-sensitive crafted-record case.
python3 -m venv .venv
.venv/bin/python -m pip install -r requirements.txt
.venv/bin/python repro.pyUse an isolated environment; requirements.txt intentionally pins the tested SDK. No external account, database, tokens, or network service are needed at runtime.
- Control: an ordinary combined filter on two disjoint fields returned
['owned-hit']. - Top-level
$andshape: identical intended conditions returned[]. - The script asserts both results, then exits successfully on the pinned, observed behavior. Raw facts are in
evidence.json.
Boundary: the flat control works here only because owner and category do not overlap. Blind dictionary merging is not a safe general authorization fix. Do not deploy a guessed workaround. Check upstream release notes and test the actual server/backend combination before changing production authorization.
The website articles discuss broader Policy Gate architecture and separately label upstream reports; this small lab is the only independent Store filter test claimed here. A future server-level and multi-backend matrix should be version-pinned and run without production user data.
- Runtime/version evidence matrix
- Captured local JSON output
- Verified fix status — currently none; never treat a speculative workaround as verified.