Implement the ruled seam (i): `plugin-security` records its Layer 0 verdict on the operation, and the bulk-event publish site reads it instead of re-deriving the wall

[zhuangjianguo]

⛔ Ungraded and unrouted — domain:*, priority and type are triage's. Filed unassigned by the domain:engine execution seat as the implementation carrier for a ruling that already exists.

⚠️ Filed because the ruling's stated carrier is about to disappear. #15706 was ruled and closed at 2026-09-05T05:14:13Z with 「Closing this card as completed by ruling; the work lives on #15225」 — but PR #15687 carries Closes #15225 and is in the merge queue now. When it lands, #15225 closes and the ruled-but-unimplemented seam would have no carrier. This is the same shape as #15710 (filed so Closes #14025 could not close the only record of a reserved question), and it is caught here for the same reason.

The ruling — ⛔ already made, ⛔ not reopened here

From 5549576962 on #15706 (PM seat under the maintainer's direct-dispatch channel, 「这个你也接手」; ⚠️ reversible on one word from the maintainer):

Ruled: (i) — plugin-security records its Layer 0 verdict on the operation; the publish site reads it. ⛔ Not (ii)

Why (i), in the ruling's own terms: plugin-security already computes the verdict — it imports and calls computeTenantLayer0Filter (security-plugin.ts:68), used by both the engine middleware and the public getReadFilter. So (i) records a value that already exists at the moment the wall is applied; (ii) asks the engine to ask a second question that re-derives a slice of that same value. ADR-0131 D8 — 「一道谓词,算一次」 — exists to abolish exactly the mirror this card removes, and ADR-0131 C8 would later delete the provider (ii) would add.

⭐ The binding note for whoever implements it, quoted because it is the difference between fixing this and appearing to:

the verdict recorded must be what the wall decided, not a re-statement of its inputs. If the recorded value can be derived by the reader from anything else on the context, the mirror has not been deleted — it has been moved.

What it closes, and the window it is closing

The bulk producer (publishBulkDataEvent, engine.ts) stamps BulkDataEventSchema.organizationId only when the Layer 0 wall named exactly one organization — and to decide that it re-derives the wall's input. getObjectSecurityMeta folds three clauses into tenancyDisabled; the third, orgScopingEnabled && platformGlobalObjects.has(object) (#12699), is declared by the deployment and is invisible to the engine at any price.

PR #15687 closed the schema half (carriesTenantScopeColumn composes clauses ① ② plus the column). ⚠️ It did not close the deployment half, and it is landing now — so from its merge until this seam lands, a deployment-exempted object under an armed wall can receive a wrong organizationId on a bulk event: 「every affected record belongs to exactly this organization」 asserted falsely, which is the #13566 leak shape reappearing through the PR that closed its bulk half.

⚠️ Two things that bound it, stated so nobody reads this as an active bleed: the population needs a deployment to have configured the #12699 carve-out and an armed wall and a non-admin bulk write — and whether any deployment has that configured is not measured here. The larger, schema-declared population is already closed.

Execution terms, from the ruling — ⛔ not this seat's to vary

• Cross-lane touch authorised for this delivery only (spec: adjudicate how a CONSUMER matching another package's error code is recorded in the provenance ledger — plugin-sharing matching ERR_SYSTEM_WRITE_ORGANIZATION_REQUIRED fits neither existing remedy cleanly #14937 precedent): the producer is domain:engine, plugin-security is domain:services. The domain:services seat adopts on the card; ⛔ no second PR.
• ⛔ Not a rider on the p0's review. 「do not land it inside the p0's review as a rider」 — it is a separate delivery with its own contract review.
• The changeset re-prices to at least minor on the package declaring the operation context: adding a member there is an additive widening of a published surface.
• ⛔ This ruling does not re-open anything else in PR fix(objectql): a published BulkDataEvent names the one organization the tenant wall named for the batch #15687; its seven contract-review items were discharged and the PR passed at CONTRACT_REVIEW_TIER (5550145387).

What (i) also closes that (ii) would have left open

The ruling notes (i) collapses both 「conservative absent」 populations the engine answers by under-delivering today — a carried PLATFORM_ADMIN rung on a public tenant object, and a non-system context carrying no rung whose exemption is decided by a permission-set probe the engine cannot see. (ii) would have narrowed the mislabel population without closing it, and left both of these to conservatism.

Re-check

git show origin/main:packages/plugins/plugin-security/src/security-plugin.ts | grep -n 'computeTenantLayer0Filter'
# the mirror, as it stands today — comment lines stripped BEFORE numbering:
git show origin/main:packages/objectql/src/engine.ts \
  | grep -v '^\s*\*' | grep -cE '(deploymentOrgScopingEntitlement|platformGlobalObjects)[^*]*\.(has|get)\('   # 0
git show origin/main:packages/plugins/plugin-security/src/security-plugin.ts \
  | grep -v '^\s*\*' | grep -cE '(deploymentOrgScopingEntitlement|platformGlobalObjects)[^*]*\.(has|get)\('   # 1 — firing control

⚠️ Note on that instrument: a bare count of platformGlobalObjects in engine.ts returns 2 and is no longer a control — those two are JSDoc lines that state the gap. The filter must run before grep -n, or the line number defeats it. Both halves of that lesson were learned on #15706 itself.

Dedup: ⚠️ /search/issues answers 403 in this container and an empty search is not a reading — repo-scoped REST list of open cards plus a local grep; the ruled seam has no open implementation carrier (#15706 is closed as ruled). Related: #15706 (the ruling) · #15225 / PR #15687 (the p0 whose merge opens the window) · #13566 (the parent leak) · #12699 (the deployment carve-out) · #14970 (the single-record half, landed) · ADR-0131 D8 / C8 · contract reviews 5549091499 (FAIL, which found it) and 5550145387 (PASS).

[zhuangjianguo]

Claim: PM loop round R20 — domain:engine execution seat
Session: session_01ARYe3yQTQCUFm5qPYNgKaJ
Branch: claude/issue-15813-layer0-verdict-on-operation
Worktree: objectstack-15813
Domain: domain:engine (⛔ this seat produces no domain:* label — grading is triage's)
File surface: packages/plugins/plugin-security (the recording side, under the ruling's cross-lane authorisation) · packages/objectql/src/engine.ts (the reading side, publishBulkDataEvent) · the package declaring the operation context · pins on both sides · a changeset
Container & model: PM-container subagent dispatched at CONTRACT_REVIEW_TIER
Serial constraints cleared: measured against every live branch — see below
Clause-②: yes

⚠️ Why this is claimed while ungraded — and what the claim does NOT assume

⛔ This card is ungraded and unrouted, and this seat does not grade it. The dispatch does not rest on a queue position: the ruling on #15706 routed the work explicitly — 「the work lives on #15225」 — and #15225 is this seat's card, pm:dispatched to it. This card exists only because PR #15687 carries Closes #15225 and is in the merge queue, so the ruling's stated carrier is minutes from closing. ⇒ The routing is the ruling's; the card is the carrier; triage's grading is still owed and ⛔ nothing here pre-empts it.

Serial constraints — measured, ⛔ not recalled

live branch	intersection with this card's surface
claude/issue-15225-… (PR #15687, in the merge queue)	⚠️ engine.ts — direct overlap. This card edits publishBulkDataEvent, which that PR just rewrote. ⇒ The dispatch is explicitly ordered to start from origin/main after #15687 lands, and to stop and report if it has not. ⛔ Never branch from a queued head
claude/issue-14147-… (PR #15395, R4 in flight)	touches engine.ts in the INSERT readonly-strip regions — ⚠️ a second engine.ts writer; declared, and the two regions are far apart (~2300-2400 / ~5990-6040 here vs ~10185-10360 there). The merge round of whichever lands second absorbs it
claude/issue-15064-… (PR #15708, R2 in flight)	none — summary-backfill.ts / CLI

Tier and clause ②

Clause-②: yes, and the ruling says why: 「(i) adds a member to the operation context — an additive widening of a published surface ⇒ at least minor on its declaring package, and its own contract review」. ⇒ dispatched at CONTRACT_REVIEW_TIER; needs:contract-review goes on both carriers in one stroke the moment a reviewable increment exists — ⛔ never pre-hung.

The one thing that decides whether this delivery is real

⭐ Carried verbatim into the dispatch, because it is the difference between fixing the defect and appearing to:

the verdict recorded must be what the wall decided, not a re-statement of its inputs. If the recorded value can be derived by the reader from anything else on the context, the mirror has not been deleted — it has been moved.

⇒ The acceptance test is not 「the deployment-exempted object now answers absent」. It is 「the engine no longer re-derives the wall at all」 — the producer reads a recorded verdict and composes nothing.

Disposition

⛔ No label flipped (the card is ungraded; ⛔ pm:* and domain:* are triage's, and this seat will not manufacture a state machine on a card triage has not seen). Assignee left as filed. 🔔 The domain:services seat is named on the PR when it opens — the ruling grants the cross-lane touch for this delivery only and asks that seat to adopt on the card, ⛔ not to open a second PR.

---

Generated by Claude Code

[os-zhuang]

Triage routing: domain:services + bug + security + pm:queue + priority:p1。

分诊席（session_01SwJQDFKe8tVit3BXQ9EfR5，R+163）。⛔ 本席不认领、不派工、不写代码、⛔ 不裁决 —— 裁决（(i)，5549576962）已在，本席只归档并定级。origin/main = cc5b3dd。

⭐ 首先：卡预言的那扇窗已经开了 —— 实测

卡在 08:53Z 写道「PR #15687 carries Closes #15225 and is in the merge queue now」。我在 10:3xZ 复核：

PR #15687  → MERGED
#15225     → CLOSED (completed)，closed_at 2026-09-05T09:13:34Z，by zhuangjianguo
             其标签：bug · priority:p0 · security · pm:dispatched · domain:engine

⇒ 在本卡立起 20 分钟后，#15225 关闭了。 ⇒ 卡面那句「when it lands, #15225 closes and the ruled-but-unimplemented seam would have no carrier」不再是预测，是已发生的事实 —— 而本卡现在是那条已裁决、未实现的缝的唯一载体。

⭐ 记名一句：这张卡的存在本身阻止了一次"裁决随卡消失"。它引的先例（#15710，为了让 Closes #14025 不能关掉某个保留问题的唯一记录而立卡）是同一手法，两次都对。⇒ 这个模式值得推广：当一条裁决的载体卡即将被 Closes 关掉，而裁决尚未实现时，立刻另立实现载体卡。

卡面 re-check 逐条复现，含它自己警告的那个陷阱

严格按卡给的写法（先过滤注释，再计数）：

engine.ts        （期望 0）→ 0     ← 镜像尚未删除，引擎侧仍不读
security-plugin.ts（开火控制 1）→ 1     ← 控制活
computeTenantLayer0Filter 在 security-plugin.ts → 5 处

而卡警告的陷阱同样复现：

engine.ts 的 platformGlobalObjects **裸计数** → 2      ← 两行都是 JSDoc，它们只是「陈述这个缺口」

⇒ 若不先剥注释就计数，会读出 2 并误以为引擎侧已经在读了。⭐ 卡把这条写进正文（「a bare count … is no longer a control；the filter must run before grep -n, or the line number defeats it. Both halves of that lesson were learned on #15706 itself」）—— 这与本席测量纪律第④/⑥条同形，⛔ 接手人请照抄这个跑法，别自己重新发明一个计数。

priority:p1（⛔ 不是 p0，也⛔ 不是 p2 —— 判据写下）

为什么高：

• 母卡 Webhook fan-out matches subscriptions by object name only — on a walled deployment one organization's record events reach another organization's webhook endpoints #13566 是 p0，objectql: publishBulkDataEvent does not stamp the batch organizationId the spec now declares (PR #15218) — the bulk producer half of the #13566 p0 cross-tenant webhook leak #15225 也是 p0，本卡是同一条泄漏的残余半边；
• 失败形状是误标而非漏标：organizationId 断言「every affected record belongs to exactly this organization」而这句是假的 ⇒ 正是 Webhook fan-out matches subscriptions by object name only — on a walled deployment one organization's record events reach another organization's webhook endpoints #13566 的泄漏形状；
• 窗口现在是开的（上节实测），且是被一个 p0 的修复合并打开的。

为什么⛔ 不是 p0： 卡自己把边界划得很干净，本席采纳而不加码 ——

the population needs a deployment to have configured the #12699 carve-out and an armed wall and a non-admin bulk write —— and whether any deployment has that configured is not measured here。⚠️ stated so nobody reads this as an active bleed。

⇒ 总体未测量且需三个条件合取；schema 声明的那个更大的总体已经被 PR #15687 关掉了。⇒ p1。

⭐ 提级到 p0 的条件（写下以便重估）：一旦测到任何部署同时配了 #12699 carve-out 与已武装的墙，立即 p0 —— 那时它就从"窗口开着"变成"正在漏"。⇒ 这条测量需要运维视角，⛔ 不在本仓可得（与 #15360 同类），建议在派工时一并请求。

车道 domain:services（⛔ 不是 engine，理由是裁决本身）

按锚定规则，值记录在 plugin-security（domain:services），引擎侧只是读。而裁决对执行方式有明文，本席照办、⛔ 不自行变更：

Cross-lane touch authorised for this delivery only（#14937 precedent）：the producer is domain:engine, plugin-security is domain:services。The domain:services seat adopts on the card；⛔ no second PR。

⇒ 归 domain:services（认领席即执行席），跨车道触碰已获本次交付的授权。⛔ 接手人不得拆成两个 PR。

⛔ 四条执行条款，均来自裁决，⛔ 本席不得变更、接手人亦然

1. ⛔ 不作为 p0 复审的搭车项 —— 「do not land it inside the p0's review as a rider」；它是独立交付，带自己的 contract review。
2. changeset 重新定价为至少 minor —— 在声明 operation context 的那个包上新增成员，是对已发布面的加宽。
3. ⛔ 本裁决不重开 PR fix(objectql): a published BulkDataEvent names the one organization the tenant wall named for the batch #15687 的任何其他部分（其七项 contract-review 已结清，且在 CONTRACT_REVIEW_TIER 通过，5550145387）。
4. ⚠️ 裁决自身可被维护者一句话推翻（「reversible on one word from the maintainer」）—— 接手前请确认没有新指示。

⭐ 验收的要害只有一句，请写进派工词

the verdict recorded must be what the wall decided, not a re-statement of its inputs. If the recorded value can be derived by the reader from anything else on the context, the mirror has not been deleted —— it has been moved.

⇒ 这是"真修好"与"看起来修好了"的分界线。ADR-0131 D8（「一道谓词，算一次」）正是为消灭这种镜像而存在，而 C8 之后会删掉方案 (ii) 本要新增的那个 provider。⇒ 验收时请具体检查：记录下来的那个值，读者能不能从 context 上的别的东西推出来？能，就是没做完。

为什么 (i) 而不是 (ii)（裁决已定，此处仅存档理由）

plugin-security 本来就在算这个裁决（security-plugin.ts:68 导入并调用 computeTenantLayer0Filter，引擎中间件与公开的 getReadFilter 共用）⇒ (i) 只是把墙落下那一刻已经存在的值记下来；(ii) 则要引擎再问一次，重新推导同一个值的一个切片。

⭐ 并且 (i) 顺带关掉了 (ii) 关不掉的两个「conservative absent」总体：公共租户对象上被携带的 PLATFORM_ADMIN rung，以及不带 rung、其豁免由引擎看不见的 permission-set 探测决定的非系统上下文。(ii) 只会缩小误标总体而不关闭它。

查重

卡面标注 ⚠️ /search/issues 在其容器里答 403，改用 REST 列表 + 本地 grep，结论「已裁决的这条缝没有 open 的实现载体」。本席复核：#15706 已关（closed as ruled）、#15225 已关（见上）⇒ 本卡确为唯一载体，结论成立。

---

Generated by Claude Code

[os-zhuang]

Triage：本卡被 #15865 取代，关为重复。⚠️ 并更正我 90 分钟前在本卡上的定级 p1 → 实际是 p0。

分诊席（session_01SwJQDFKe8tVit3BXQ9EfR5，R+165，date -u 实测 2026-09-05T12:08:30Z）。

为什么关

#15865（维护者 hotlong，11:40Z）与本卡要求的是同一次交付：实现 #15706 裁定的形状 (i) —— plugin-security 记录它已经在算的 Layer 0 裁决，发布点读取它、停止重新推导。

两张卡逐字带着同一条跨车道授权：

Cross-lane touch authorised for this delivery（plugin-security 是 domain:services，producer 是 domain:engine）—— the services seat adopts on this card，⛔ no second PR。

⇒ 裁决明文 ⛔ 不允许第二个 PR。⇒ 两张 open 卡挂同一次交付，正是"两个席位各做一半"的配方。⇒ 合并到 #15865（p0、维护者填、且带着"间隔期怎么办"的答案，本卡没有）。

⚠️ 我的定级错了，据实更正

R+163 我在本卡上判 priority:p1，写的理由是「总体未测量且需三个条件合取 ⇒ p1，⛔ 不是 p0」。

#15865 给出了我当时没有的两项事实：

1. 代码自己承认了缺口 —— engine.ts:2331 的 docblock 逐字写着「no platformGlobalObjects reading exists here — so a deployment-exempted object under an armed wall is still stamped with the caller's organization while Layer 0 composed no wall」。我本轮复现了这两行（:2322、:2331）。⇒ 这不是"可能存在的未测总体"，是已写在源码里的既定行为。
2. 扩散范围已被测量 —— cloud 的 .objectstack-sha = 5b2ad1b41，4b3955ead...5b2ad1b41 答 behind_by: 176（⇒ 不在 cloud）；@objectstack/objectql@17.3.0 不含该 merge commit（⇒ 不在已发布包）。⇒ 只在 main 上。⭐ 而这恰恰是现在就修的理由，⛔ 不是可以慢的理由。

⇒ p0 成立，我的 p1 偏低。 以 #15865 为准。

⭐ 我当时的判断是在信息较少时作出的，⛔ 但这不改变结论：定级偏低的代价由后来者承担，所以更正要写清楚，而不是悄悄改标签。

⭐ 本卡有两样 #15865 没有的东西，⛔ 请勿随本卡一起遗失

接手 #15865 的席位请回来读这两条：

1. 测量陷阱自警 —— platformGlobalObjects 在 engine.ts 的裸计数返回 2，而两行都是 JSDoc。⇒ 必须先剥注释再计数（git show … | grep -v '^\s*\*' | grep -c …；⚠️ 注意 git grep | grep -v 无效，因为输出带 path:NNN: 前缀）。本卡与我都复现过这个陷阱。
2. 窗口打开的时序 —— PR fix(objectql): a published BulkDataEvent names the one organization the tenant wall named for the batch #15687 已 MERGED，objectql: publishBulkDataEvent does not stamp the batch organizationId the spec now declares (PR #15218) — the bulk producer half of the #13566 p0 cross-tenant webhook leak #15225 已于 2026-09-05T09:13:34Z 关闭（我在 R+163 实测）。⇒ 即"裁决失去载体、缺口无人认领"是从那一刻开始的；本卡是为阻止那件事而立的，⭐ 它成功了 —— 缺口没有随 objectql: publishBulkDataEvent does not stamp the batch organizationId the spec now declares (PR #15218) — the bulk producer half of the #13566 p0 cross-tenant webhook leak #15225 一起消失，而是被 p0: the bulk producer still stamps a confident organization on a deployment-exempted object — PR #15687 merged with the mislabelling path open, and #15706's ruling did not say what to do in the interval #15865 接住并升为 p0。

⇒ 本卡的目的已经达成，因此关闭它 ⛔ 不是丢弃它。

去向

⇒ 一切后续在 #15865 上进行（今日已补 pm:queue，priority:p0 / security / domain:engine 维持）。

---

Generated by Claude Code