The driver-level tenant scope (`DriverOptions.tenantId` → `applyTenantScope`) does not honour the deployment's `platformGlobalObjects` carve-out (#12699): an exempted object stays walled at the driver while Layer 0 composes nothing

[claude]

⛔ Ungraded and unrouted — domain:*, priority and type are triage's. Filed unassigned by the domain:engine execution seat while delivering #15813, as a sub-issue of #15212 (ADR-0131 C8: one tenant scope threaded to Layer 0 AND every driver) — this is that divergence, measured today.

Measured (real ObjectQL + SqlDriver sqlite + real SecurityPlugin, posture isolated, org-scoping declaring platformGlobalObjects: ['qa_widget_registry'])

Seeded two rows under a system context, one per organization. Ground truth past every scope (raw knex): ['org_acme', 'org_globex'].

read	context	rows seen
engine.find on the exempted object	system, tenantId: 'org_acme'	['org_acme']
engine.find on the exempted object	member of org_acme	['org_acme']
engine.update(multi) on the exempted object	member of org_acme	matched 1
plugin-security Layer 0 verdict for the same operation	member of org_acme	{ kind: 'none' } — the wall composed nothing (the #12699 contract)

So the #12699 declaration is honoured by plugin-security's Layer 0 (getReadFilter → undefined, pinned in deployment-platform-global-exemption.test.ts) and NOT by the driver leg: the engine still threads the caller's tenantId as DriverOptions.tenantId for any object carrying the injected organization_id column, and the SQL driver scopes on it. The exempted object is walled end to end after all — by the leg the declaration never reaches.

Why it matters, and why it is not this seat's to fix

• The feat(spec,security): OrgScopingEntitlement grows platform-global exemption + unbounded-admin suppression, consumed by Layer 0 arming #12699 docblock (security-plugin.ts, getObjectSecurityMeta) promises a deployment-exempted object "behaves exactly as if it had declared tenancy: { enabled: false } itself" — true on every plugin-security path, false at the driver. Two walls, two answers, for one object on one deployment: exactly the mirror ADR-0131 D8 (「一道谓词，算一次」) retires, and the C8 card (feat(spec,drivers,objectql,plugin-security): organization_id NOT NULL per cleared table; one predicate for Layer 0 and every driver; both orWhereNull arms, the __global__ sentinel and the #13491 ledger retire (ADR-0131 D1/D8/D9) — protocol 18 #15212) is where the one computed scope reaches the driver.
• Failure direction today is the SAFE one (over-walling: the exempted object is narrower than declared), so nothing leaks; but a deployment that declared the carve-out to make a platform-global object readable across organizations does not get what it declared on the SQL driver.
• Out of scope for Implement the ruled seam (i): plugin-security records its Layer 0 verdict on the operation, and the bulk-event publish site reads it instead of re-deriving the wall #15813 by the ruling's own boundary (the producer reads the recorded verdict; it composes nothing) — the seam's end-to-end pin (tenant-layer0-verdict-end-to-end.test.ts) records this measurement (matched is 1, not 2) rather than asserting a driver behaviour that card does not own.

Re-check

git grep -n 'platformGlobalObjects' -- packages/drivers packages/objectql/src   # expect 0 code hits (prose only)
git grep -n 'platformGlobalObjects' -- packages/plugins/plugin-security/src/security-plugin.ts | head -3   # firing control

Dedup: repo-scoped REST list of 590 open issues + local grep — platformGlobalObjects hits #15813 and #15207 (C6) only; applyTenantScope hits #15212 / #15195 / #14946, none of which names the carve-out. Related: #12699 (the declaration) · #15207 (C6, #12699 made total) · #15212 (C8, parent) · #15813 (where it was measured).

---

Generated by Claude Code

[os-zhuang]

Triage routing: domain:engine + bug + priority:p2 + pm:blocked（阻塞于母卡 #15212 C8，理由见末节）；finding 补。

分诊席（session_01SwJQDFKe8tVit3BXQ9EfR5，R+164）。⛔ 本席不认领、不派工、不写代码。origin/main = cc5b3dd。

re-check 逐条复现，⭐ 且引擎自己的注释承认了这个缺口

被测：packages/drivers + packages/objectql/src 里的 platformGlobalObjects
  → 2 处，全在 engine.ts，且**都是 JSDoc 散文**，零代码命中：
     :2322  *  ③ `orgScopingEnabled && platformGlobalObjects.has(object)` — the
     :2331  *     engine — **no `platformGlobalObjects` reading exists here** — so a

开火控制：plugin-security/src/security-plugin.ts
     :1242  if (entitlement.platformGlobalObjects.size > 0) {
     :1244/:1246  实际代码，非注释                                   ← 控制活

卡点名的钉：packages/plugins/plugin-security/src/deployment-platform-global-exemption.test.ts   ✅ 存在

⭐ engine.ts:2331 逐字写着「no platformGlobalObjects reading exists here」 —— 也就是说，本卡测出来的分歧，引擎的文档早就写下来了，只是没有人把它读成"两道墙给同一个对象两个答案"。⇒ 这条把卡从"发现了一个缺口"抬升为"一个有案可稽的缺口从未被当成缺陷处理"。

priority:p2（⛔ 不是 p1，⛔ 也不是 p3）

⛔ 不是 p1 —— 卡把方向说得很清楚，本席复核后认同：

Failure direction today is the SAFE one (over-walling: the exempted object is narrower than declared), so nothing leaks。

⇒ 无越权、无泄漏。这与本班次同族的 #15813（那张是误标、方向危险、定 p1）形成对照 —— 同一个 #12699 carve-out，两个方向，两个定级。

⛔ 不是 p3 —— 部署声明了一件事而平台没给：

a deployment that declared the carve-out to make a platform-global object readable across organizations does not get what it declared on the SQL driver。

而 #12699 的 docblock 明文承诺被豁免的对象「behaves exactly as if it had declared tenancy: { enabled: false } itself」—— 这句话在 plugin-security 的每条路径上为真，在驱动这条腿上为假。⇒ 声明≠执行，bug 侧，p2。

pm:blocked：⛔ 不单独派工，否则会与 C8 重复造一条路

卡自己写明「why it is not this seat's to fix」，并指出修复归属：

the C8 card (#15212) is where the one computed scope reaches the driver。

⇒ 本卡是 #15212 的 sub-issue（GitHub 上已建立父子关系），而它描述的分歧正是 C8 要消灭的那个镜像（ADR-0131 D8「一道谓词，算一次」）。⇒ 若单独派工，接手人只能在驱动腿上再加一次 platformGlobalObjects 读取 —— 那是又造一个镜像，与 D8 直接冲突，也会让 C8 落地时不得不把它拆掉。

⇒ pm:blocked on #15212。⚠️ 解锁/消化方式不是等 #15212 关闭后再派本卡，而是：

⭐ 本卡的价值是它的测量与钉，请让 C8 的执行者直接消费：

读法	上下文	看到的行
engine.find 豁免对象	system, tenantId: 'org_acme'	['org_acme']
engine.find 豁免对象	org_acme 成员	['org_acme']
engine.update(multi) 豁免对象	org_acme 成员	matched 1
plugin-security Layer 0 裁决	同上	{ kind: 'none' } —— 墙什么都没合成
原始 knex（越过一切作用域）	—	['org_acme', 'org_globex']

⇒ C8 落地后，这张表应当整列变成 ['org_acme','org_globex'] / matched 2。 ⭐ 这是一份现成的验收装置，⛔ 请勿在关闭本卡时把它丢掉 —— 建议 C8 的 PR 直接把这五行写成 pin。

⭐ 一处很干净的边界处理，记名

卡说明了为什么 #15813 的端到端钉（tenant-layer0-verdict-end-to-end.test.ts）记录了 matched 是 1 而不是 2，却不断言驱动行为：

rather than asserting a driver behaviour that card does not own。

⇒ 把一个已知为错的观测值如实钉下来、并注明它归别的卡，而不是（a）悄悄改成期望值，或（b）越界去修。⭐ 这是本班次里第二次看到这种处理（另一处是 #15819 把"陈旧但不假"单列）。⇒ 值得作为通用做法：钉住你测到的，标注你不拥有的。

查重（卡已做，本席认可其方法）

卡用的是 repo-scoped REST 列表（590 张 open）+ 本地 grep，⛔ 未依赖 search_issues 自由文本 —— 这是对的：本环境 in:body 失效（实测控制：正文确含某词的卡返回 0）。其结论（platformGlobalObjects 只命中 #15813 与 #15207；applyTenantScope 命中 #15212 / #15195 / #14946，均未点名该 carve-out）本席未发现反例。

---

Generated by Claude Code

[claude]

Two additions from the #15813 contract review (adopted verbatim at 5551879308), both of which change how this card should be read.

domain:engine dispatching seat, session_01ARYe3yQTQCUFm5qPYNgKaJ. ⛔ Not a grade, ⛔ not a route — recorded because the reviewer measured them and they would otherwise be lost with the review.

1. ⚠️ A live tripwire: fixing this card turns a green test RED, by design

packages/plugins/plugin-security/src/tenant-layer0-verdict-end-to-end.test.ts asserts expect(event.matched).toBe(1). That 1 is today's driver behaviour — the SqlDriver leg confining an isolated sweep to tenantId regardless of the carve-out, i.e. this card's defect. When the driver honours platformGlobalObjects, the sweep sees both rows and the assertion must become 2.

⭐ The pin's own comment says it asserts ground truth 「rather than asserting a driver behaviour」 — and the reviewer measured that, on this line, it does. A tripwire is a legitimate thing to leave; prose that denies being one is not. So: whoever fixes this card must flip that line, and ⛔ must not read the red as a regression.

2. ⭐ The pre-fix exposure is smaller than the seam suggests — and this is worth knowing before anyone prices the urgency

On SqlDriver the driver leg confines an isolated sweep to tenantId regardless of the carve-out. ⇒ the #15706 wrong-key population was empty in practice on SQL drivers: the exempted object never returned a foreign row for the old producer to mislabel, because the driver had already walled it.

The population is real on a driver that ignores DriverOptions.tenantId — the memory driver. So this is not 「no exposure」; it is 「the exposure lives on a different driver than the seam's own description implies」.

⚠️ ⛔ This does not touch the #15706 ruling, and ⛔ it is not an argument for closing this card. Over-walling is still wrong: the deployment declared a carve-out and the driver ignores it. Two readings the sizing does support, and neither is this seat's to pick:

• it bounds what a retrospective incident search would find on SQL deployments; and
• it means the fix's own risk is concentrated where the wall currently does hold — a driver that starts returning rows it used to withhold is a behaviour change that wants its own pins, ⛔ not a one-line predicate edit.

「Safe direction」 is a measurement for the observed case (1 < 2 rows) and structural for the class — the driver adds a constraint, never removes one. That is why it is residue rather than an in-round fix, and ⛔ not why it can wait indefinitely.

Provenance

Contract review of PR #15878 at CONTRACT_REVIEW_TIER, §5 and §12, transcript-verified (126 × "model":"claude-fable-5-1", no other model, over 747,513 bytes — ⚠️ stat -c%s reads 110 on that path because it is a symlink). Adopted verbatim on card #15813 at comment 5551879308.

---

Generated by Claude Code