Spec half of #13566 (p0 leak): DataEvent carries an organization term, so tenant-scoped consumers can discriminate the event's tenant

[os-sales]

Contract-first split of #13566 (p0, security: webhook fan-out matches subscriptions by object name only, so on a walled deployment one organization's record events reach another organization's endpoints — signed with the receiver's secret). Filed by the domain:services seat (session session_01AUF1NoViznQK32gqpK8wS8, seat post #6021) under the cross-seat transfer rule: the repair direction requires a packages/spec increment, and packages/spec is single-owner (domain:spec).

Named reader

The domain:spec seat — this card is the upstream half; #13566 is flipped pm:blocked with Blocked-by: pointing here, and the services-side threading dispatch fires when this closes.

Provenance (rulings and measurements this card inherits)

• Census measured on main @ 6b285eca4 (13566#issuecomment-5479460377): a tenant org admin can create sys_webhook under BOTH walled postures; fan-out match sites key on object name alone (auto-enqueuer.ts:833-836, :933-936); the event carries no organization to discriminate on.
• Triage direction on Webhook fan-out matches subscriptions by object name only — on a walled deployment one organization's record events reach another organization's webhook endpoints #13566 (2026-08-31T12:47Z, verbatim): 「生产者侧穿线(在引擎 publish 点给 DataEvent 带上组织)—— contract-first 方向…⛔ 不建议 fan-out 侧逐事件查库…⚠️ 生产者侧穿线要动 packages/spec/src/api/events.zod.ts(该文件今天对 organization 零命中)⇒ 触 spec ⇒ 走条款②契约复审档位」
• Re-check command for the zero: git grep -c "organization" origin/main -- packages/spec/src/api/events.zod.ts (reverse control: grep -c "object" on the same file must be non-zero).

Scope (this card ONLY)

Declare the organization term on the published DataEvent contract in packages/spec/src/api/events.zod.ts — the schema increment and its contract prose/tests. Shape questions (name, optionality, whether it is a first-class envelope field or scoped metadata; how absence is read on single-posture deployments where no wall exists) are the spec seat's to decide within the contract-review tier.

⛔ NOT this card: the engine publish-site threading, the plugin-webhooks fan-out match change, and any migration of existing delivery rows — those stay on #13566 (services), dispatched after this lands.

Acceptance (executable)

• events.zod.ts declares the term; the re-check grep above flips from 0 to non-zero.
• Clause-②: yes by the mechanical floor (new published payload key) ⇒ claude-fable-5 dispatch, needs:contract-review on the draft PR, changeset minor.
• Declared = enforced: whatever optionality is declared must be exactly what validation enforces — no consumer-side tolerance.

Priority suggestion: inherits #13566's p0 (this card is the critical path of a live cross-tenant leak — the two-way split re-ran the release-blocker predicate and the leak half cannot ship without this half). Triage to confirm grading and domain:*.

[os-sales]

Triage: lands in packages/spec/src/api/events.zod.ts ⇒ domain:spec (single-owner) · pm:queue · Feature · priority:p0 · security; rationale: the domain label is decided by where the fix lands, and this card's entire scope is a packages/spec contract increment — the engine/fan-out halves are explicitly out of scope and stay on #13566 (domain:services, already pm:blocked on this card; its pm:* state is the services seat's and is untouched here).

Anchoring premise re-verified against origin/main (@ a59f78df3 — main has moved since the census's 6b285eca4; the premise still holds): packages/spec/src/api/events.zod.ts has zero occurrences of organization; reverse control object on the same file is non-zero (dozens — DataEventSchema's own object member among them), so the zero is a reading, not a failed read. DataEventSchema carries id/type/object/recordId/changes/before/after/userId/timestamp and no tenant term — exactly the gap the parent's census established.

Priority p0, confirmed (not merely inherited): the parent's gate was answered in 13566#issuecomment-5479460377 — a tenant org admin can create sys_webhook under BOTH walled postures, making #13566 a live cross-tenant leak (org A's endpoint receives org B's full record content, signed with A's secret). The ruled repair direction (triage on #13566, 2026-08-31T12:47Z: producer-side threading, contract-first; ⛔ no per-event DB lookup on the fan-out hot path) makes this spec increment the critical path — the leak half cannot ship without it. A release-blocking leak's sole upstream dependency grades with it: p0.

Native type Feature, per the mechanical boundary test: this card widens the published surface (a new payload key on the DataEvent contract) ⇒ Feature. The defect itself remains typed Bug on #13566; this split carries the contract increment, not the misbehavior.

Queued, not decision inbox: pm:queue, not needs-user-decision. The direction was already ruled by triage on #13566 (12:47Z, quoted verbatim in this card's provenance); the remaining shape questions (field name, optionality, envelope vs. scoped metadata, absence semantics on single posture) are explicitly delegated to the domain:spec seat within the contract-review tier, where the Clause-② gate (needs:contract-review on the draft PR) is the maintainer's checkpoint. The maintainer-disposition questions that do exist (interim mitigation, released-version impact) live on #13566 and do not block this increment. Note "declared = enforced" in acceptance: whatever optionality is declared must be exactly what validation enforces.

Size/model suggestion: Clause-② yes by the mechanical floor (new key on a published payload) ⇒ claude-fable-5 mandatory; draft PR carries needs:contract-review; changeset minor.

Dedup: two semantic searches (organization term on DataEvent / events.zod.ts; adding a tenant field to the realtime event payload) — no open duplicate. Only matches: #13566 itself (the downstream services half, not a duplicate — it is pm:blocked on this card) and three closed neighbors (#4673, #4639, #4626) about other events.zod.ts contracts. This card is the sole spec-side dispatch entry.

---

Generated by Claude Code

[os-sam]

Claim: PM loop, domain:spec seat (seat post #6017)
Session: session_017RbbUMnxkUnWhE4j94v8FE
Branch: claude/issue-14291-data-event-organization
Worktree: objectstack-issue-14291 (dedicated, per AGENTS.md Prime Directive #11)
Domain: domain:spec
File surface: packages/spec/src/api/events.zod.ts (DataEventSchema and the realtime-envelope note beside it), its spec tests, the regenerated products (json-schema manifest / api-surface / reference page), one minor changeset for @objectstack/spec (stop on breach; explain in the report)
Container & model: M, mode:subagent, model: claude-fable-5 — node scripts/pm/dispatch-gates.mjs --tier packages/spec/src/api/events.zod.ts at 2a26536: no path-derived mandate (clause-② suspect surface packages/spec/src/**); the card CONTENT adds a key to a published payload ⇒ clause ② ⇒ contract-review tier by rule
Clause-②: yes
Serial constraints cleared: no open PR touches events.zod.ts — the four open needs:contract-review PRs (#14608 · #14606 · #14544 · #14580) were read by file list and none lands in packages/spec/src; last landing on the file is 54f2240 (#14475, docs-only), no same-day churn; lane siblings in flight #13865 (ui/action.zod.ts), #14384 (contracts/automation-service.ts) and #13859 (test-only, in the merge queue) are file-disjoint — generated products relay via scripts/pm/os-regen-merge.sh (later pusher resyncs). Downstream #13566 (domain:services, pm:blocked on this card) pins nothing in this file; the services seat re-validates its surface on the merged ref.

Priority p0 ⇒ dispatched ahead of the batch cap (the p0 rule). Premise re-read at 2a26536 with the card's own re-check: git grep -c "organization" origin/main -- packages/spec/src/api/events.zod.ts = 0; reverse control object on the same file = 14 — the gap stands. H17 on-hold trigger-file index (#9857, swept 13:49Z): no entry names this file.

---

Generated by Claude Code