test(plugin-security,plugin-auth,plugin-approvals): narrow the blanket pre-18 tenant-column relax rigs to the residue tables they model #25132

Activity

1. objectstack-fleet

   added

   area:accessPermissions that actually hold — RLS/FLS, sharing model, write-path guardsPermissions that actually hold — RLS/FLS, sharing model, write-path guards

   domain:services

   pm:queue

   priority:p3

   tooling

   pm:dispatched

   and removed

   pm:queue

   on Oct 21, 2026
2. objectstack-fleet

   assigned

   os-sales

   on Oct 23, 2026
3. objectstack-fleet commented on Oct 23, 2026

   

   objectstack-fleetBot

   on Oct 23, 2026

   ContributorAuthor

   More actions

   Claim: card thread of the Sales project's fleet director (2026-10-23T00:29Z)
   Session: session_014aRYTwvuSQoDgWzLdw1nc9
   Account: os-sales
   Branch: claude/project-thread-wxw16a
   Worktree: objectstack-issue-25132
   Domain: domain:services
   Seat: domain:services#1
   File surface: the 40 test files under packages/plugins/plugin-security/src/, packages/plugins/plugin-auth/src/ and packages/plugins/plugin-approvals/src/ that call relaxEveryRegisteredTenantColumn( or relaxEveryTenantColumn(, plus those three packages' pre-18-tenant-column.testkit.ts (only if a blanket export is left with no caller). Test files only; no source, no changeset (stop on breach; explain in the report)
   Container & model: M, mode:thread, model: default — dispatch-gates --tier: no path-derived mandate for the plugin test files, effort: high
   Clause-②: no
   Metadata-protocol: none
   Responsibility: n/a — not a defect card
   Thread-read: none
   Serial constraints cleared: none — no issue-25132 branch on origin and no open PR names these rigs

   Lane check: every file is in packages/plugins/plugin-security, plugin-auth or plugin-approvals, which the lane table gives domain:services. services seat 1 (#6021) claims it, and this card thread works it.

   The branch is the harness-assigned claude/project-thread-wxw16a, not the repo-convention claude/issue-25132-…. The PR body says so for the Duplicate Fix Guard.

   Planned route (the implementation may change it): per rig, measure which tables its organization-less seeds actually need by running it with the relax removed, then name exactly those tables in relaxTenantColumns(engine, [...]). A table that only an unstamped production write needs is not relaxed; it is reported as a finding instead.
4. objectstack-fleet commented on Oct 23, 2026

   

   objectstack-fleetBot

   on Oct 23, 2026

   ContributorAuthor

   More actions

   os-dev-report

   {
     "issue": 25132,
     "status": "done",
     "branch": "claude/project-thread-wxw16a",
     "pr": "https://github.com/objectstack-ai/objectstack/pull/25327",
     "session": "session_014aRYTwvuSQoDgWzLdw1nc9",
     "premise_still_valid": true,
     "summary": "Every blanket relaxEveryRegisteredTenantColumn / relaxEveryTenantColumn call in plugin-security, plugin-auth and plugin-approvals tests (41 sites, 38 files on base 9dc1f42d) now names, through relaxTenantColumns, exactly the tables its rig writes organization-less. The lists were measured by a temporary NULL-write trigger probe per call site, and each logged row was traced to the test's own seed or to a test-initiated engine write. 2 sites wrote no organization-less row, so their relax and comment were deleted (controlled-by-parent-chain-middle-master, explain-enforce-parity bootSharing). The blanket exports were removed from the three packages' testkits. The dogfood testkit copy is untouched and out of scope. Test files only, skip-changeset.",
     "tests": "On head c4a6f34b. (1) The 38 files with the named lists: plugin-security 27 files/641 tests, plugin-auth 9/96 (10 skipped: the env-gated Postgres/MySQL cells of driver-fault-auth-log-carriers), plugin-approvals 2/18, all exit 0. (2) Leave-one-out, the card's spot check run on every rig: each of the 58 named entries was dropped on disk in turn and the file was run, then restored from HEAD, proven by git diff --quiet HEAD. 58/58 runs red, each failing ONLY on NOT NULL constraint failed for the dropped table (the per-test qa_parity_deal family for bootRls). (3) Full suites under os-verify-lock: plugin-security 210 files/4448 tests (45 skipped), plugin-auth 187/3535 (10 skipped), plugin-approvals 94/1213, VERDICT command-exit 0. (4) typecheck for all three, including check:test-typecheck: exit 0, debt ledgers unchanged. No ablation of source: no tested behaviour changed.",
     "gates": "dispatch-gates --commands derived 58 families. All 58 ran exit 0, after fetching the teardown-shape pinned fixture 621a4876 (the first run exited 3, a prerequisite). dispatch-gates --ran: 58 run, 0 NOT-MEASURED (a DERIVED zero). Families CI runs: in_progress at report time; see the PR check-runs.",
     "dogfood_battery": "n/a: the PR title has no bang and the claim has Clause-② no with no (narrowing) arm. The diff is plugin test files that dogfood does not run.",
     "contract_review": "not owed: none of the four faces is touched (Clause-② no, no narrowing declaration, no packages/spec source, no governed rules text). Per contract-review.md, CI plus the seat's own read.",
     "mcp_calls": "1: mcp__github__issue_read (read). Zero MCP write tools. Every GitHub write went through scripts/pm.",
     "api_writes": "5 relay writes as objectstack-fleet[bot]: label-write (labels_add pm:dispatched, labels_remove pm:queue, assign os-sales) on 25132; post-stamped Claim comment 6354434072; pr_create 25327 (assignees os-sales, labels skip-changeset); pr_request_reviewers 25327 os-sales; this os-dev-report comment. Plus 2 git pushes (empty-branch probe, then c4a6f34b).",
     "open_questions": [],
     "out_of_scope_findings": [
       "carrier: none. packages/qa/dogfood/test/pre-18-tenant-column.testkit.ts keeps its own blanket relaxEveryTenantColumn / relaxEveryRegisteredTenantColumn copy and callers, the same rig shape in the dogfood suite. Noted, not filed. Dedupe words: dogfood relaxEveryRegisteredTenantColumn narrow pre-18 tenant column."
     ]
   }

   ---

   Generated by Claude Code