feat(plugin-security)!: under a walled tenancy posture every external object states its organization scope - #29867

📓 Docs Drift Check

This PR changes 3 package(s): @objectstack/core, @objectstack/plugin-security, @objectstack/spec, touching 33 documentable anchor(s). ⚠️ 1 changed file(s) yielded no anchor (packages/plugins/plugin-security/src/index.ts), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files.

2 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/data-modeling/objects.mdx (via tenantField (symbol, a field of interface UndeclaredExternalObject))
• content/docs/protocol/objectql/schema.mdx (via tenantField (symbol, a field of interface UndeclaredExternalObject))

⛔ 3 release-owned page(s) also name something this change touched. These are read-only:

• content/docs/releases/implementation-status.mdx (via tenantField (symbol, a field of interface UndeclaredExternalObject))
• content/docs/releases/v15.mdx (via tenantField (symbol, a field of interface UndeclaredExternalObject))
• content/docs/releases/v17/17-5.mdx (via tenantField (symbol, a field of interface UndeclaredExternalObject))

content/docs/releases/ is RELEASE-OWNED (AGENTS.md "Documentation Guardrails"): release
notes are written centrally at release time, and a code PR that edits them is the exact PR
that guardrail exists to stop. They are still audited — read-only. If one of them is actually
wrong, file an issue or open a dedicated docs-only PR; do not edit it here.

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 97b05d2cd396156aa0dc38c32fb004e0e2557b10 && git checkout 97b05d2cd396156aa0dc38c32fb004e0e2557b10
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 7b2bb668dacc8d915c161791facf20be78138a99 554573c4f4e71abebfce28cd6d466b998dc1a109 && git checkout -B drift-repro 7b2bb668dacc8d915c161791facf20be78138a99 && git merge --no-ff 554573c4f4e71abebfce28cd6d466b998dc1a109

node scripts/docs-audit/affected-docs.mjs --json 7b2bb668dacc8d915c161791facf20be78138a99

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 7b2bb668dacc8d915c161791facf20be78138a99 → pass the list as
args.docs, on the commit named under Which tree this was computed on.

security#1 · os-justin · session_01QSeKYn5CmmdShCJifm6WYj

Contract-review-claim: session_01QSeKYn5CmmdShCJifm6WYj · head 778365a · 2026-11-03T10:29Z

security#1 · os-justin · session_01QSeKYn5CmmdShCJifm6WYj

Contract-review-claim: session_01QSeKYn5CmmdShCJifm6WYj · head 29680f9 · 2026-11-03T12:30Z

security#1 · os-justin · session_01QSeKYn5CmmdShCJifm6WYj

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 29680f9ff49d292c22818521a723a528e7b625b8
Local-runs: none
Scope: packages/spec/src/migrations/entries/semantic/18.external-object-organization-scope-declared.ts, packages/plugins/plugin-security/src/external-organization-scope.ts, packages/plugins/plugin-security/src/security-plugin.ts, packages/plugins/plugin-security/src/tenant-layer.ts, packages/plugins/plugin-security/src/security-plugin-field-readers.ts, packages/plugins/plugin-security/src/index.ts, packages/core/src/security/tenant-layer0-verdict.ts, examples/app-showcase/src/data/objects/external/customer.object.ts, examples/app-showcase/src/data/objects/external/order.object.ts, .changeset/sec-hardening-g-external-object-organization-scope.md, scripts/adr-anchors/packages__plugins__plugin-security__src__external-organization-scope.ts.json, scripts/engine-double-contract.pinned.json, packages/runtime/src/plugin-driver-external-object.spike.test.ts, packages/plugins/plugin-security/src/external-organization-scope.test.ts, packages/core/src/security/tenant-layer0-verdict.test.ts, packages/plugins/plugin-security/src/federated-tenant-layer0.test.ts, packages/plugins/plugin-security/src/tenant-layer0-verdict-on-operation.test.ts, packages/plugins/plugin-security/src/object-membership-keys.test.ts, packages/qa/dogfood/test/federated-anchor-provenance.dogfood.test.ts, packages/qa/dogfood/test/federated-rls-injectors.dogfood.test.ts, packages/qa/dogfood/test/federated-sweep-projections.dogfood.test.ts, packages/qa/dogfood/test/organization-delete-federated-fixture.dogfood.test.ts + packages/plugins/plugin-security/src/federated-phantom-anchors.ts, packages/plugins/plugin-security/src/security-plugin-rls-filter.ts, packages/plugins/plugin-security/src/security-plugin-write-tenant-wall.ts, packages/plugins/plugin-security/src/security-plugin-object-inputs.ts, packages/plugins/plugin-security/src/suggested-audience-bindings.ts, packages/plugins/plugin-security/src/object-membership-keys.ts, packages/plugins/plugin-security/src/metadata-change-invalidation.ts, packages/objectql/src/engine-driver-options.ts, packages/objectql/src/external-driver-floor.ts, packages/objectql/src/engine.ts, packages/objectql/src/registry.ts, packages/objectql/src/plugin.ts, packages/metadata-protocol/src/protocol.ts, packages/core/src/kernel.ts, packages/core/src/lite-kernel.ts, packages/core/src/hook-dispatch.ts, packages/spec/src/data/object.zod.ts, packages/spec/src/data/injected-system-column-provenance.ts, packages/spec/src/security/tenancy-posture.ts, packages/types/src/env.ts, packages/drivers/driver-sql/src/sql-driver-schema-sync.ts, packages/drivers/driver-odata/src/odata-driver.ts

① Derived judgments

Read in the tree at the head above, against the maintainer's seven rulings and the two choices taken at seat discretion. The check-runs on this head are the gate verdict: every required context is success.

1. Every external object states its scope under isolated / group. externalOrganizationScopeOf is the one reading: an own organization_id (any definition other than the shipped anchor, by hasPhantomTenantAnchor's identity test), isTenancyDisabled, systemFields.tenant: false, and the discretionary systemFields: false. Holds.
2. Undeclared ⇒ refused by name at boot, naming the ways out. refuseUndeclaredExternalObjectScope, subscribed in start() to kernel:ready, enumerates registry.getAllObjects(); the message names the posture, every object (sorted), the three declarations, the columnMap route onto the wall's column, the restart, and the single carve-out. Both kernels propagate a kernel:ready throw into a failed bootstrap() (dispatchHookPropagating; LiteKernel triggerHookOrThrow). Holds.
3. Registered after boot ⇒ deny at Layer 0. getObjectSecurityMeta reads the same predicate into externalOrganizationScopeUndeclared; tenantLayer0InputOf carries it; computeTenantLayer0Verdict answers deny after the tenancy opt-out and ahead of the column question and the platform-admin rung, under both walled postures. Every post-boot registration path — Studio writes through metadata-protocol, the objectql plugin's metadata:reloaded re-registration, runtime package registration, a raw registry.registerObject — lands in the one registry the door reads per object name; the meta cache is cleared on onMetadataMutation and metadata:reloaded, and a name never read has no entry. The recorded verdict is what find, count and aggregate project; the driver's native scope stays withheld for federated objects. Holds for reads. For writes see ③ (must-fix).
4. tenancy.tenantField on an external object closed. A tenantField naming any column but organization_id is refused at boot and denied after; tenantField: 'organization_id' beside an own column reads walled; tenancy: { enabled: true } alone states nothing. Closed by refusal, with the columnMap remedy spelled. Holds.
5. Showcase declares its scope. Both federated objects declare tenancy: { enabled: false }; the four dogfood premises are re-pinned to the declared shape. Holds.
6. Reference test and skills/docs. Spike block (h) under isolated with two organizations: walled through a where-honouring and a where-blind driver, a row without the column reads to no one, both shared spellings, a local control, the after-boot deny by sentinel identity, the by-name refusal. Unit pins on the predicate, the refusal, both doors and the once-only warning; the core verdict pins the rung's order. Docs and skill are docs(adr): under a walled tenancy posture every external object states its organization scope (ADR-0015 §10) #29866.
7. ADR-0015 §10 and D7 — docs(adr): under a walled tenancy posture every external object states its organization scope (ADR-0015 §10) #29866.

Seat discretion, judged: the refusal at kernel:ready, not inside start() is correct — during start() the registry is still filling (AGENTS.md, startup registry reads, cure 1); the ADR-0131 D5 precedent judges an option, not the registry; the identity-object refusal in the same plugin already judges at kernel:ready. A hookless context judges at the end of start(); a host that withholds boot-phase hooks is not refused at boot, and the Layer 0 door holds for it. Accepted. systemFields: false accepted as a declaration: in effect sound — the registry injects nothing for it, so an external object without an own column reaches none exactly as a local one does, and no wall is narrowed (the wall's tenancyDisabled keeps its two clauses, so an object declaring both systemFields: false and an own organization_id stays walled). Two spelling defects flagged in ③.

Attempts to break it: single regression — the verdict's first rung, the refusal's early return and the warning's guard all read postureEnforcesWall; blocks (a)–(g) boot undeclared objects as the control; the default posture is single unless the posture or multi-organization variable is set. None. SQL-federated — the door is per object name, not per driver; the dogfood after-boot case runs on the showcase's SQL-backed datasource; the deny sentinel is an ordinary where the SQL driver runs; columnMap is applied by the SQL and OData drivers. Holds. A declared organization_id judged phantom — only an authored definition byte-equal to the shipped constant, which a parsed declaration never is. Accepted. Refusal firing on a declared object — (h6) and the unit control pin the shared and walled siblings unnamed. None. Timing at kernel:ready — handlers run in subscription order; an object a later plugin registers in its own kernel:ready or kernel:bootstrapped handler is missed by the refusal and met by the deny with its once warning: fail-closed. Accepted. Write path for an after-boot undeclared object — see ③.

② Semver level

BREAKING (!) on the walled postures only. Clause-②: no (narrowing) and Metadata-protocol: narrowed on the body and the changeset; minor on @objectstack/plugin-security, @objectstack/core and @objectstack/spec (the kind's floor on the packages the diff moves); the BREAKING banner carries the FROM → TO (the three declarations, no data migration) and the ADR-0087 D3 marker external-object-organization-scope-declared, matching the entry's id. TenantLayer0Input gains an optional field; omitted, every existing caller reads as before. Level correct.

③ Boundary flags

• MUST-FIX — the write half of the deny verdict is narrower than four texts claim. The warning (undeclaredExternalScopeDenialWarning), the changeset, the D3 entry's reason and the ADR/guide text in docs(adr): under a walled tenancy posture every external object states its organization scope (ADR-0015 §10) #29866 say every write of an after-boot undeclared object is refused. In the tree the verdict refuses every read and every write whose rows it selects; the composed write wall (composeWriteTenantWall) judges a row's organization only where the row names one, and the engine stamps none on a federated object — so one write shape is not refused by this verdict. Either refuse any write whose caller wall is the deny sentinel outright in composeWriteTenantWall, as its scope pre-test already does, with a pin beside (h5), or narrow the four texts to what is enforced. Detail is with the seat (security-findings §6); it belongs in the no-card dispatch, not here.
• systemFields: false — (a) the branch is ordered ahead of the own-column branch, so the exported predicate answers shared for an external object the wall walls (declares both); order the own-column test first. (b) The parenthetical "systemFields: false includes it" (module docblock, changeset, ADR note) contradicts the registry's recorded reading that the wall's opt-out has exactly two clauses and systemFields: false is in neither; restate it as accepted on an external object with no own column, not as the wall's opt-out.
• Platform-owner read crossing. computeLayeredRlsFilter lifts every armed read wall for the verified declared platform owner (standing ruling), the deny sentinel included, so the owner reads an undeclared after-boot object unwalled while the verdict's ladder places this deny ahead of the platform-admin rung. Whether a configuration-defect deny should stand for the owner too is a ruling, not a dev change; recorded, not judged.
• security-findings §6. The PR body's before-readings paragraph and the changeset's Before bullet state more than the hardening rule; trim both to the rule before landing (the Now and Who-moves bullets carry what an operator needs).
• A host that withholds boot-phase hooks, and objects a later plugin registers at kernel:ready, are not refused at boot; the Layer 0 door holds for them. Say so in the D3 acceptance criterion or accept as is.
• The spike's test-budget is re-pinned from a local ratio; the first scheduled run re-measures it. Lane note, not a must-fix.

④ Design judgment

• One predicate, two doors, judged against federated-phantom-anchors.ts (provenance by identity, fail toward isolation), tenant-layer.ts and tenant-layer0-verdict.ts: the new rung sits after the opt-out and before the column question and the crossing, and externalOrganizationScopeIsUndeclared is the only derivation on both doors, so they cannot disagree. Sound.
• The boot door's placement against refuseAcceptedDefaultsWithoutWall: the precedent judges a declared option the moment the posture is known; this judges the registry, which is final only at kernel:ready. The deviation from the dispatch's wording is the right one.
• The operator's path for a production single-database multi-organization deployment: the refusal names the objects and the three declarations with the columnMap route; the D3 entry's surface, replacement, reason and acceptanceCriteria say the same, with no data migration. Adequate, once the write claim is made true.
• tenancy.tenantField closed by refusal rather than enforcement: right — the wall has one column, columnMap already reaches it, and enforcing would widen the verdict schema and the deny sentinel.
• engineLayer0Verdict (the engine's own facts) does not carry the flag; federated objects receive no driver scope there regardless. No gap.

Implemented-by: claude/sec-hardening-g
Reviewed-by: session_01QSeKYn5CmmdShCJifm6WYj

VERDICT: FAIL

security#1 · os-justin · session_01QSeKYn5CmmdShCJifm6WYj

Contract-review-claim: session_01QSeKYn5CmmdShCJifm6WYj · head 554573c · 2026-11-03T14:39Z

security#1 · os-justin · session_01QSeKYn5CmmdShCJifm6WYj

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 554573c4f4e71abebfce28cd6d466b998dc1a109
Local-runs: none
Scope: packages/plugins/plugin-security/src/security-plugin-write-tenant-wall.ts, packages/plugins/plugin-security/src/external-organization-scope.ts, packages/plugins/plugin-security/src/security-plugin.ts, packages/spec/src/migrations/entries/semantic/18.external-object-organization-scope-declared.ts, .changeset/sec-hardening-g-external-object-organization-scope.md, packages/plugins/plugin-security/src/external-organization-scope.test.ts, packages/plugins/plugin-security/src/tenant-layer0-verdict-on-operation.test.ts, packages/runtime/src/plugin-driver-external-object.spike.test.ts, packages/qa/dogfood/test/external-object-scope-after-boot-writes.dogfood.test.ts + packages/plugins/plugin-security/src/security-plugin-rls-filter.ts, packages/plugins/plugin-security/src/tenant-layer.ts, packages/core/src/security/tenant-layer0-verdict.ts, packages/objectql/src/registry.ts (delta review of 29680f9ff49d292c22818521a723a528e7b625b8..554573c4f4e71abebfce28cd6d466b998dc1a109; the record on the earlier head is comment 6604182905, FAIL)

① Derived judgments

Delta only, read in the tree; the check-runs on this head are the gate verdict — every required context (Lint & Repo Gates, TypeScript Type Check, Test Core, Build Core, Governed Surface Queue Guard, Type Check UI, Test UI, Build & E2E UI, Live E2E UI, Dogfood Regression Gate) is success; Lint UI is path-skipped as before.

1. Must-fix closed — the write half now matches the texts. composeWriteTenantWall gains a first pre-test, ahead of the no-active-organization pre-test: under orgScopingEnabled, when getObjectSecurityMeta(object).externalOrganizationScopeUndeclared holds and the caller's write-wall Layer 0 (or, failing that, the delegator's) is the deny sentinel, the whole write is refused with undeclaredExternalScopeWriteRefusal — a PermissionDeniedError naming the posture, the object, the undeclared scope and the three declarations, never the join-an-organization sentence; judgePayload and storedImage are not composed. Verified against the ladder: the read door's platform-owner lift is read-only (!isWrite), so the owner's writes stay refused; single yields none, so the pre-test never fires there; the pre-test reads the same cached meta the read door reads, so a local object pays one map lookup. Pinned at three layers: unit (writeWallVerdict: caller with an organization, caller without one, group, shared control, single control), spike (h5b) over HTTP (POST 403 PERMISSION_DENIED with the sentence, PATCH and DELETE 403/404, the remote records no write, the shared sibling on the same datasource lands), and the new dogfood file on the showcase plus a writable plugin-driver datasource (insert refused with the sentence, update/delete reach the remote with no write, member read is the deny sentinel, shared control lands). The on-operation test now records deny on a delete sweep and the 403 sentence on an update sweep. Closed.
2. systemFields: false corrected. externalOrganizationScopeOf now computes optedOut from exactly the wall's two clauses (isTenancyDisabled, systemFields.tenant === false); a foreign tenantField is judged first unless opted out; shared only when opted out; walled on an own column; else undeclared. The whole-block systemFields: false alone is undeclared (refused at boot / denied after, consistent with the registry's recorded reading and the ruling's three declarations); an own column beside systemFields: false is walled, as the wall walls it; an opt-out beside an own column is shared, as the wall composes nothing there. Unit pins cover all four shapes and the refusal now names such an object. The docblock and the changeset no longer say "systemFields: false includes it". Closed.
3. Disclosure at rule level. The changeset's Before bullet is gone; "Now" is "What the rule does"; the D3 entry's reason no longer narrates the prior reading and now also names the kernel:ready-late and withheld-hooks registrations as met by the denial (the ③ note from the earlier record, taken). The rewritten PR body carries no before-readings block; its acceptance notes record the owner read crossing as the maintainer's question. Read against security-findings §6: rule only. Closed.
4. check:objectql-double-limit. The new dogfood driver's find honours limit and offset; Lint & Repo Gates is green on this head. Closed.

Nothing in the delta touches the boot refusal, the Layer 0 rung, the showcase, or the single controls; blocks (a)–(g) still boot undeclared objects under single, and the single write control admits the insert as before.

② Semver level

Unchanged: BREAKING (!) on walled postures; Clause-②: no (narrowing) and Metadata-protocol: narrowed on body and changeset (the Clause-② sentence now states the write refusal); minor on plugin-security, core and spec; the D3 marker matches the entry. The write-wall refusal is a further narrowing on the same walled postures and adds no authorable key. Level correct.

③ Boundary flags

No must-fix. Nits, for the seat's discretion, not for the landing:

• The changeset and the D3 reason say "every insert, update and delete is refused"; the delete of an undeclared object is closed by the row wall selecting nothing, and (h5b) and the dogfood pin accept 403 or 404 for it. "an update or delete reaches no row" is the exact phrase, or pin the delete at 403 if the door answers it.
• The new pre-test consults getObjectSecurityMeta for every non-system write under a wall; the lookup is the cached map and costs nothing measurable, noted only so nobody later "optimises" it behind the ADR-0123 pre-test, which would reopen the gap.
• Platform-owner read crossing: unchanged from the earlier record — a maintainer decision-batch item, not a must-fix here.

④ Design judgment

The fix is in the right door: the write wall's own verdict (isTenantWallDenial over the same Layer 0 the read side computes), applied whole and first, so the deny sentinel means the same thing for a write as for a read, and the rows-that-name-an-organization halves underneath keep their existing meaning for walled objects. The predicate's new order mirrors the wall's own clauses and the registry's recorded reading, so the exported label, the boot refusal, the Layer 0 flag and the write pre-test cannot disagree about an object. The texts an operator reads — the boot refusal, the once warning, the write refusal, the D3 entry and the changeset — now claim exactly what the tree enforces.

Implemented-by: claude/sec-hardening-g
Reviewed-by: session_01QSeKYn5CmmdShCJifm6WYj

VERDICT: PASS

security#1 · os-justin · session_01QSeKYn5CmmdShCJifm6WYj

席位核对

ACCEPT · head 554573c4f4e71abebfce28cd6d466b998dc1a109 · 2026-11-03T14:46Z

• Shape: 24 files, +1736/−85, not governed (0 of 24 paths hit the register), under 3000. BREAKING (!) under the walled postures; Clause-②: no (narrowing), Metadata-protocol: narrowed; minor on plugin-security, core and spec.
• Rule held (the security channel's ruling, D1 B, D2 (c2)+(a)): under isolated and group every external object states its organization scope. An undeclared one is refused by name at boot; one registered after the boot is denied at Layer 0 for reads and refused at the write wall for writes. single is unchanged.
• Contract review: the delta record, comment 6606840268, carries Served-tier: CONTRACT_REVIEW_TIER, a Head-sha equal to this head, and VERDICT PASS with no must-fix. It follows the FAIL at 6604182905, and the same reviewer closed both of that record's must-fixes.
• Check-runs at this head: 57 success, 11 skipped, 0 failed, all completed. The skips were judged by name: opt-in, path-gated, and the matrix placeholder. check-expected-skips.mjs was NOT MEASURED. mergeable_state reads clean.
• Gates: local dispatch-gates --ran at this head reports 98 derived and 98 run, with 0 NOT MEASURED. The full dogfood battery passed, with 408 files and 3365 tests.
• Nits left for the seat (not for this landing): the delete wording ("an update or delete reaches no row"); and the write pre-test must stay ahead of the ADR-0123 pre-test.
• Maintainer's question (decision batch, not changed here): the verified platform owner's read crossing on an undeclared after-boot object.
• Sibling: docs(adr): under a walled tenancy posture every external object states its organization scope (ADR-0015 §10) #29866 (Tier H, ADR and guide) has a PASS record at 6606851344 and lands by the maintainer's hand, after this PR or together with it.
• Landing: ready, then auto-merge.