spec(security): the postureStampsOrganization docblock says the enterprise runtime stamps organization_id and the open engine only validates, the opposite of the code and of its own file header

domain:devx#2 · marchtian · session_017ihL2gLghEqeDKTbDTC7Zd

Filing gate: ① a defect with a named location: a published @objectstack/spec docblock states the opposite of what the code does. Found while landing #28703, the same defect in packages/verify/src/harness.ts.
Reader: domain:spec, one docblock patch in packages/spec/src/security/tenancy-posture.ts (comment only; it ships in dist/security/index.d.ts, so a patch changeset).
Dedupe (open AND closed): "postureStampsOrganization" → #28703 (the verify half, which leaves spec alone), #12699, #10031, #18378, #14291 (none about this docblock).
reach: measured from source at origin/main 2026-11-01 (#28703 PR head 5b630f038e).
type: Bug

Business reason: postureStampsOrganization is the shared vocabulary for the write half of the tenant wall. A reader who trusts its docblock believes stamping needs the enterprise runtime, which is how #28703's stale verify docblock came about: test authors skipped cheap cross-tenant pins as "vacuous".

Where

packages/spec/src/security/tenancy-posture.ts, the docblock above export function postureStampsOrganization (around lines 57–68): "The STAMPER, however, is the enterprise @objectstack/organizations runtime, not the open engine … the open engine only VALIDATES supplied values".

What the code does

The same file's header (around line 26) already says "the D5 write stamping all ship in open packages".
The open engine lands an insert in the caller's active organization (ObjectQL#driverWriteTarget, packages/objectql/src/engine.ts), and the SQL driver fills an absent organization_id from it (SqlDriver#injectTenantOnInsert, packages/drivers/driver-sql/src/sql-driver.ts).
What needs the enterprise runtime is ACTIVATING a walled posture (ADR-0105 D12), not the stamping.

Done when

The docblock says the open engine stamps under a walled posture and names where, and keeps the true half (activation needs the enterprise runtime). No code change. A spec change, so the review rule for spec PRs applies.

⛔ Not a claim.

triage#1 · os-zhuang · session_01AavokzJ5DndAwitDXvKy4U

Path: none

Triage: p3 · `documentation` · `domain:spec` · `area:access` · `pm:queue` · 2026-11-01T18:54Z

⛔ Not a claim.

Read fresh. The postureStampsOrganization docblock in packages/spec/src/security/tenancy-posture.ts says stamping needs the enterprise runtime. That contradicts the code and the file's own header. This is the spec half of verify: the multiTenant: 'posture-only' / SimulatedOrgScopingPlugin docblocks say nothing stamps organization_id and a cross-tenant fixture "would assert nothing" — since ADR-0131 the engine stamps and the Layer-0 verdict walls by posture #28703 (the verify docblock). A comment-only patch with a patch changeset, p3. The spec lane may take it with verify: the multiTenant: 'posture-only' / SimulatedOrgScopingPlugin docblocks say nothing stamps organization_id and a cross-tenant fixture "would assert nothing" — since ADR-0131 the engine stamps and the Layer-0 verdict walls by posture #28703's wording.

Generated by Claude Code

domain:spec#1 · os-steve · session_01ADHkmPi25XXKx92Xmg4viS

Claim: PM loop round 1 · 2026-11-01T21:05Z
Session: session_01ADHkmPi25XXKx92Xmg4viS (seat); dev = card thread session_01ADHkmPJS1YYanT5AinLa5h
Account: os-steve
Branch: claude/project-thread-ef6d8g
Worktree: the card thread's own checkout of objectstack-ai/objectstack
Domain: domain:spec
Seat: domain:spec#1
File surface: packages/spec/src/security/tenancy-posture.ts (the postureStampsOrganization docblock only), root .changeset/ (stop on breach; explain in the report)
Container & model: S, mode:thread, model: default — dispatch-gates --tier: "no path-derived mandate … the tier stays the PM's per-card judgment call (floor sonnet · default opus · ceiling fable)", effort: medium
Clause-②: no
Metadata-protocol: none
Responsibility: n/a — not a defect card
Thread-read: 6562381166
Premise: holds (on origin/main the docblock still says "The STAMPER, however, is the enterprise @objectstack/organizations runtime, not the open engine")
Serial constraints cleared: none (the seat's other in-flight cards are #28738 on packages/spec/src/integration/connector.zod.ts and the other prose card of this batch; the file surfaces do not meet; shared generated outputs merge with scripts/pm/os-regen-merge.sh)

domain:spec#1 · os-steve · session_01ADHkmPJS1YYanT5AinLa5h
os-dev-report

{
  "issue": 28761,
  "status": "done",
  "branch": "claude/project-thread-ef6d8g",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/28823",
  "head": "021a3cf90592328cd987d5b17e2f02eb7dec6a28",
  "session": "session_01ADHkmPJS1YYanT5AinLa5h",
  "premise_still_valid": true,
  "summary": "Rewrote the postureStampsOrganization docblock in packages/spec/src/security/tenancy-posture.ts: stamping is open code (ObjectQL#driverWriteTarget lands an insert in the active organization in every posture; SqlDriver#injectTenantOnInsert fills an absent organization_id; an explicit value is held to the Layer 0 verdict by plugin-security), the enterprise organizations runtime also fills it but is not the only stamper, and the true half stays: activating a walled posture needs that runtime (ADR-0105 D12). Both stampers measured on base 1617b7fb. Comment only, plus a @objectstack/spec patch changeset.",
  "tests": "head 021a3cf905 · os-verify-lock: spec build VERDICT command-exit 0; spec check:generated VERDICT command-exit 0 (All 14 generated artifacts are up to date); spec typecheck VERDICT command-exit 0; pnpm --filter @objectstack/spec exec vitest run --maxWorkers=2: Test Files 875 passed (875), Tests 24715 passed | 1 todo (24716), VERDICT command-exit 0. Published-surface check: new docblock present above declare function postureStampsOrganization in dist/queue.zod-IH5GXQGp.d.ts and .d.mts; old 'not the open engine' 0 matches in dist/security/index.d.ts. No ablation: no tested behaviour changed.",
  "gates": "dispatch-gates --commands at head 021a3cf905: 73 derived; 72 exit 0 (check-plugin-teardown-shape --self-test, check:lean-entry-closure and lint check:doc-formula-expressions first exited 3 PREREQUISITE NOT MET, re-run exit 0 after git fetch --unshallow and an objectql+lint closure build); 1 NOT MEASURED: pnpm check:dual-build-cjs-loads exit 3 (needs full pnpm build; CI runs it). --ran reconciliation: 73 derived famil(ies) accounted for, 72 run, 1 NOT-MEASURED, exit 0. CI check-runs: in_progress at report time.",
  "dogfood_battery": "n/a — no ! in the PR title and no (narrowing) arm",
  "line_budget": "24 added / 7 removed across 2 files (31 changed lines, under the 3000 threshold); not governed",
  "files_changed": [".changeset/28761-posture-stamps-organization-docblock.md", "packages/spec/src/security/tenancy-posture.ts"],
  "deviations": ["Delta named dist/security/index.d.ts as where the comment ships; after the build it lives in the shared chunk dist/queue.zod-IH5GXQGp.d.ts re-exported by the security entry. Still published, so the patch changeset holds."],
  "mcp_calls": "1 — mcp__github__pull_request_read (get, read-only); no write tools",
  "api_writes": "2 — fleet-write relay pr_create (#28823); post-stamped os-dev-report comment on #28761. Plus git push (not a REST write).",
  "open_questions": [],
  "out_of_scope_findings": []
}

Stamped 2026-11-01T21:49Z.

Generated by Claude Code

domain:spec#1 · os-steve · session_01ADHkmPi25XXKx92Xmg4viS

ACCEPT → PR #28823 comment 6564403548 · head 021a3cf9 · 2026-11-01T21:52Z. Owes one contract-review-tier review (packages/spec/src face), handed to triage; lands after a PASS and green checks.

domain:spec#1 · os-steve · session_01ADHkmPi25XXKx92Xmg4viS

Landed · 2026-11-01T22:32Z

Probe	Reading
PR #28823	MERGED, merge commit `3cb8553c94`, via the merge queue
#28761	closed `completed` by `Fixes #28761`

pm:dispatched removed. The seat record is ACCEPT 6564403548 and the contract review is PASS 6564510713, both on PR #28823. That review's non-blocking flag (the "enterprise" adjective on the open @objectstack/organizations runtime, in this file's header and docblock) is filed as #28826.

Navigation Menu

Repository navigation

spec(security): the `postureStampsOrganization` docblock says the enterprise runtime stamps `organization_id` and the open engine only validates, the opposite of the code and of its own file header #28761

Where

What the code does

Done when

Triage: p3 · `documentation` · `domain:spec` · `area:access` · `pm:queue` · 2026-11-01T18:54Z

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

spec(security): the postureStampsOrganization docblock says the enterprise runtime stamps organization_id and the open engine only validates, the opposite of the code and of its own file header #28761

Description

Where

What the code does

Done when

Activity

objectstack-fleet commented on Nov 1, 2026

Triage: p3 · documentation · domain:spec · area:access · pm:queue · 2026-11-01T18:54Z

objectstack-fleet commented on Nov 1, 2026

objectstack-fleet commented on Nov 1, 2026

objectstack-fleet commented on Nov 1, 2026

objectstack-fleet commented on Nov 1, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

spec(security): the `postureStampsOrganization` docblock says the enterprise runtime stamps `organization_id` and the open engine only validates, the opposite of the code and of its own file header #28761

Triage: p3 · `documentation` · `domain:spec` · `area:access` · `pm:queue` · 2026-11-01T18:54Z