Federated read × org-walled deployment has no reachable end-to-end coverage — the required dogfood test that names the path boots single-tenant and cannot emit the predicate

[os-zhuang]

Measured by #7738's dev, who then re-measured their own first explanation and found it wrong (report, correction). Filed unassigned.

The gate that should have caught #7738, and could not

packages/qa/dogfood/test/showcase-external-autoconnect.dogfood.test.ts:37 asserts rows.length >= 3 for an authenticated admin read of showcase_ext_customer. It is part of a required CI job (3 shards, ci.yml:709).

Per #7738's QA capture, that authenticated read returned 0 rows — a declared, correctly-bound external object silently answering empty. So this assertion is exactly the shape that should have failed, and CI was green.

The first explanation was plausible and wrong — the second is measured

The initial hypothesis was that the @objectstack/verify harness's signed-in admin carries no active org, leaving the wall dormant. Rather than leave that standing, the dev checked engine.ts back out at main, rebuilt @objectstack/objectql, and re-ran the same file: 3 passed / 3 — with the fix and without it.

That is the decisive measurement. The test does not merely fail to assert the wall; it never emits the predicate at all, in either direction. It could not have caught this defect and cannot catch a regression of it.

Mechanism, one line of harness:

• bootStack sets OS_TENANCY_POSTURE=isolated only when opts.multiTenant is truthy — packages/verify/src/harness.ts:268. This test calls bootStack(showcaseStack) with no options.
• Boot log confirms: [security] tenancy posture 'single' — Layer 0 is inert; the platform's own tenant-scoped RLS policies are stripped.
• With no organization plugin and no active org, execCtx.tenantId is undefined, hasTenant is false at engine.ts:2528, the driver never receives a tenantId, and applyTenantScope early-returns.

The structural part — this is not a missing assertion

Per BootOptions.multiTenant's own docstring, the only honest way to boot the organization wall is multiTenant: true with the cloud-private @objectstack/organizations. 'posture-only' is explicitly documented as performing no isolation — "nothing stamps organization_id, nothing scopes a query" — and the gates that need the real wall SKIP without that package.

⇒ The intersection this bug lived in — a federated read × an org-walled deployment — has no reachable end-to-end coverage in this repo's dogfood tier. The one federated-read fixture boots single-tenant; the one honest walled harness is unavailable here.

Same class as #7802, different mechanism

#7802: a cross-package conformance scan is never run because affected-subset CI is keyed on the package the scan lives in.
This: a required test runs, passes, and names the path — while booting a posture in which the thing under test is inert.

Both are a green gate over a path it does not exercise, which is worse than an absent gate because it reads as coverage. Worth deciding together whether there is a general answer.

⛔ What not to do

• Do not "fix" this by adding assertions to the single-tenant boot — that pins the inert path and deepens the illusion.
• Do not mark the test skipped; it is doing useful work on the autoconnect path, just not on the wall.
• Do not treat fix(objectql): withhold the org-scope predicate from federated objects (#7738) #7833's unit pin as closing this. That pin sits at the DriverOptions seam and is reachable without the enterprise package — it closes the regression risk, and it is genuinely not an end-to-end proof.

Step one — a decision, not code

Pick honestly between:

1. a posture-aware fixture that can emit the org wall without the cloud-private package (if that is even possible — measure before promising it);
2. accepting that this intersection is covered at the unit/seam tier only, and saying so in a comment on the dogfood test so the next reader does not mistake its assertion for coverage;
3. something else — but not silence, because the current state is the failure mode.

Related

• external-datasource-federated-read: the platform injects its org-scoping predicate onto a federated remote table that has no organization_id column #7738 / PR fix(objectql): withhold the org-scope predicate from federated objects (#7738) #7833 — where this was measured; fixes the engine-side injection.
• main is red for every PR that touches packages/spec: #7769 gave sys_api_key update without bulk, and the conformance scan that catches it lives in a package #7769 never touched #7802 — the sibling green-gate-over-unrun-path card (CI affected-subset scoping).
• external-datasource-federated-read: federated read returns empty — the external object→remote-table mapping never registers (boot ordering) #7737 — the boot-ordering card whose reported symptom external-datasource-federated-read: the platform injects its org-scoping predicate onto a federated remote table that has no organization_id column #7738 turned out to produce.

[claude]

Routing fix (route A) from the triage seat: appended domain:cli — routing only; the finding grade is unchanged and no ownership is taken.

Landing rationale (read from source at origin/main @ 31fb03d, not inferred from the title): the fix lands in the QA/verify harness surface — packages/qa/dogfood/test/showcase-external-autoconnect.dogfood.test.ts (the rows.length >= 3 assertion is at the cited site) and packages/verify/src/harness.ts (confirmed: OS_TENANCY_POSTURE = 'isolated' is requested only when opts.multiTenant is truthy). Both packages/qa and packages/verify are domain:cli per the lanes table.

Dedup: distinct from #7737 (the empty-read defect itself, pm:blocked) and #7738 (the org-predicate injection defect, dispatched via PR #7833) — this card is the coverage gap those two lived in, filed from #7738's dev report. No existing open card covers it.

Stale-premise check: both cited files exist at current origin/main tip and read as the card describes.

本评论来自分诊座位 Routine（#5474 试点），不构成认领。

---

Generated by Claude Code

[claude]

Triage grading (same round as the routing comment above): regraded finding → needs-user-decision — the card's own "Step one — a decision, not code" section is right: choosing between a posture-aware fixture (needs the cloud-private @objectstack/organizations boundary re-examined) and formally accepting seam-tier-only coverage is a maintainer appetite/strategy call, not something a dev agent should pick silently. domain:cli stays (execution lands in packages/qa / packages/verify once ruled).

Required four-lens block (#7498):

1. Platform long-term coherence — Option 2 (declare seam-tier coverage honestly on the dogfood test) adds zero new machinery; Option 1 (a fixture that emits the org wall without the cloud-private package) risks a second, half-honest wall implementation — special-case growth in the exact place the harness docstring warns about.
2. Measured business pull — measured today, not hypothetical: this green required gate sat over external-datasource-federated-read: the platform injects its org-scoping predicate onto a federated remote table that has no organization_id column #7738's fail-open federated read; the poisoned intersection shipped and was found by dogfooding, not CI.
3. AI-agent error-resistance — a green required test that names the path but boots it inert is actively misleading to agent readers ("reads as coverage"); a loud in-test statement of what is NOT covered beats silent green.
4. Startup scope discipline — Option 1 is declare-and-maintain (a new fixture posture is a permanent obligation); Option 2 is document-and-move-on. Default lens favors 2.

Recommendation: Option 2 now (one comment on showcase-external-autoconnect.dogfood.test.ts stating the wall is NOT exercised there + a seam-tier pointer to #7833's pin), and treat Option 1 as a separate appetite question only if the maintainer wants the general answer this card shares with #7802's class.

Dedup/premise: #7818 (the #7802 exemption) merged at 60b672e after this card was filed; it does not change this card's substance (different mechanism, same class). PR #7833 still open; its pin is seam-tier by its own description.

本评论来自分诊座位 Routine（#5474 试点），不构成认领。

---

Generated by Claude Code

[huangyiirene]

Maintainer ruling — 2026-08-12

裁定:选项 2 —— 承认该交叉面只有 unit/seam 层覆盖,并把边界写在 dogfood 测试上。

要点:

• 在 showcase-external-autoconnect.dogfood.test.ts 的断言处写明:此测试覆盖 autoconnect 路径,不覆盖 org 墙(单租户 boot,谓词不发射);墙的回归防线是 fix(objectql): withhold the org-scope predicate from federated objects (#7738) #7833 的 seam pin(DriverOptions 接缝,无需企业包即可达)。
• ⛔ 不建 posture-aware fixture:它依赖 cloud 私有的 @objectstack/organizations,可行性未测,不为一个交叉面投资测试基建。若未来该交叉面再出实measured 缺陷,先测 fixture 可行性再立卡。
• ⛔ 卡内三条「不要做」维持:不给单租户 boot 加断言(钉死惰性路径)、不 skip 该测试(autoconnect 半边是真覆盖)、不把 fix(objectql): withhold the org-scope predicate from federated objects (#7738) #7833 的 unit pin 当端到端证明。
• 与 main is red for every PR that touches packages/spec: #7769 gave sys_api_key update without bulk, and the conformance scan that catches it lives in a package #7769 never touched #7802 同类(「绿灯盖在未走过的路上」):两卡的一般性答案就是诚实注释 + seam pin,不再另立通用机制。

裁定人:维护者 huangyiirene(2026-08-12,接受 PM 综合分析后批准);由 PM 会话 session_01GZKbx4xyF7U5WXj6ch49BM 代笔落卡。转 pm:queue(注释卡,小)。

---

Generated by Claude Code