Repository navigation
test(plugin-security,plugin-auth,plugin-approvals): narrow the blanket pre-18 tenant-column relax rigs to the residue tables they model #25132
Description
carries item B6 of #25128; #25128 keeps item C1 (the three stale "stays NULL on single-tenant" comments in packages/objectql and packages/spec).
Filing gate ③, carried from #25128. This is a follow-up that 7b-0 owes (#24940, merged as 5e9b100743). It is B6 of that PR's contract review 6317931247, which did not block the landing.
- Who acts: the
domain:servicesseat. Every file is inpackages/plugins/plugin-security,plugin-authorplugin-approvals. Split off bydomain:engineseat 1 ([PM seat] domain:server · seat 1 — ⏳ vacant #6367) under the execution rule that a queued card carrying another lane's item is split by the seat that finds it. It carries nodomain:*label, so triage routes it. - Dedupe: the issue search for "relaxEveryRegisteredTenantColumn relaxEveryTenantColumn narrow pre-18 tenant column relax rigs" (open and closed) returns 1 hit: test(plugin-security,plugin-auth,plugin-approvals): narrow the blanket pre-18 tenant-column relax rigs to the residue tables they model, and correct the last "stays NULL on single-tenant" comments #25128, the parent.
B6: narrow the blanket relax rigs
Since 7b-0, a table the driver creates has a NOT NULL tenant column. Tests that model a pre-18 store (where the column was nullable) relax that column through the pre-18 testkits.
Measured on origin/main 4e2c42f363, the blanket form relaxEveryRegisteredTenantColumn( / relaxEveryTenantColumn( appears 47 times in 40 test files:
| Package | Files |
|---|---|
plugin-security |
27 |
plugin-auth |
11 |
plugin-approvals |
2 |
Each package's own pre-18-tenant-column.testkit.ts already exports the named form, relaxTenantColumns(engine, tables).
Each rig is a legitimate pre-18 model, and no assertion is weakened by it. But the blanket form also relaxes tables that hold no organization-less residue. So an unstamped production write inside such a rig lands, where it should fail. The rig loses the power to catch exactly the bug 7b-0 exists to refuse.
Fix:
- Replace each blanket call with
relaxTenantColumns(engine, [the tables the test seeds organization-less]), for examplesys_permission_set,sys_position,sys_user_permission_setand the holdings. - Keep the one-line justification comment.
- Spot-check a rig by removing its relax: only the named tables' seeds should fail.
Test files only. No behavior change.
Generated by Claude Code
Activity
objectstack-fleet commentedon Oct 23, 2026
Claim: card thread of the Sales project's fleet director (2026-10-23T00:29Z)
Session:
session_014aRYTwvuSQoDgWzLdw1nc9Account:
os-salesBranch:
claude/project-thread-wxw16aWorktree:
objectstack-issue-25132Domain:
domain:servicesSeat:
domain:services#1File surface: the 40 test files under
packages/plugins/plugin-security/src/,packages/plugins/plugin-auth/src/andpackages/plugins/plugin-approvals/src/that callrelaxEveryRegisteredTenantColumn(orrelaxEveryTenantColumn(, plus those three packages'pre-18-tenant-column.testkit.ts(only if a blanket export is left with no caller). Test files only; no source, no changeset (stop on breach; explain in the report)Container & model:
M,mode:thread,model: default — dispatch-gates --tier: no path-derived mandate for the plugin test files,effort: highClause-②: no
Metadata-protocol: none
Responsibility: n/a — not a defect card
Thread-read: none
Serial constraints cleared: none — no
issue-25132branch on origin and no open PR names these rigsLane check: every file is in
packages/plugins/plugin-security,plugin-authorplugin-approvals, which the lane table givesdomain:services. services seat 1 (#6021) claims it, and this card thread works it.The branch is the harness-assigned
claude/project-thread-wxw16a, not the repo-conventionclaude/issue-25132-…. The PR body says so for the Duplicate Fix Guard.Planned route (the implementation may change it): per rig, measure which tables its organization-less seeds actually need by running it with the relax removed, then name exactly those tables in
relaxTenantColumns(engine, [...]). A table that only an unstamped production write needs is not relaxed; it is reported as a finding instead.objectstack-fleet commentedon Oct 23, 2026
os-dev-report
{ "issue": 25132, "status": "done", "branch": "claude/project-thread-wxw16a", "pr": "https://github.com/objectstack-ai/objectstack/pull/25327", "session": "session_014aRYTwvuSQoDgWzLdw1nc9", "premise_still_valid": true, "summary": "Every blanket relaxEveryRegisteredTenantColumn / relaxEveryTenantColumn call in plugin-security, plugin-auth and plugin-approvals tests (41 sites, 38 files on base 9dc1f42d) now names, through relaxTenantColumns, exactly the tables its rig writes organization-less. The lists were measured by a temporary NULL-write trigger probe per call site, and each logged row was traced to the test's own seed or to a test-initiated engine write. 2 sites wrote no organization-less row, so their relax and comment were deleted (controlled-by-parent-chain-middle-master, explain-enforce-parity bootSharing). The blanket exports were removed from the three packages' testkits. The dogfood testkit copy is untouched and out of scope. Test files only, skip-changeset.", "tests": "On head c4a6f34b. (1) The 38 files with the named lists: plugin-security 27 files/641 tests, plugin-auth 9/96 (10 skipped: the env-gated Postgres/MySQL cells of driver-fault-auth-log-carriers), plugin-approvals 2/18, all exit 0. (2) Leave-one-out, the card's spot check run on every rig: each of the 58 named entries was dropped on disk in turn and the file was run, then restored from HEAD, proven by git diff --quiet HEAD. 58/58 runs red, each failing ONLY on NOT NULL constraint failed for the dropped table (the per-test qa_parity_deal family for bootRls). (3) Full suites under os-verify-lock: plugin-security 210 files/4448 tests (45 skipped), plugin-auth 187/3535 (10 skipped), plugin-approvals 94/1213, VERDICT command-exit 0. (4) typecheck for all three, including check:test-typecheck: exit 0, debt ledgers unchanged. No ablation of source: no tested behaviour changed.", "gates": "dispatch-gates --commands derived 58 families. All 58 ran exit 0, after fetching the teardown-shape pinned fixture 621a4876 (the first run exited 3, a prerequisite). dispatch-gates --ran: 58 run, 0 NOT-MEASURED (a DERIVED zero). Families CI runs: in_progress at report time; see the PR check-runs.", "dogfood_battery": "n/a: the PR title has no bang and the claim has Clause-② no with no (narrowing) arm. The diff is plugin test files that dogfood does not run.", "contract_review": "not owed: none of the four faces is touched (Clause-② no, no narrowing declaration, no packages/spec source, no governed rules text). Per contract-review.md, CI plus the seat's own read.", "mcp_calls": "1: mcp__github__issue_read (read). Zero MCP write tools. Every GitHub write went through scripts/pm.", "api_writes": "5 relay writes as objectstack-fleet[bot]: label-write (labels_add pm:dispatched, labels_remove pm:queue, assign os-sales) on 25132; post-stamped Claim comment 6354434072; pr_create 25327 (assignees os-sales, labels skip-changeset); pr_request_reviewers 25327 os-sales; this os-dev-report comment. Plus 2 git pushes (empty-branch probe, then c4a6f34b).", "open_questions": [], "out_of_scope_findings": [ "carrier: none. packages/qa/dogfood/test/pre-18-tenant-column.testkit.ts keeps its own blanket relaxEveryTenantColumn / relaxEveryRegisteredTenantColumn copy and callers, the same rig shape in the dogfood suite. Noted, not filed. Dedupe words: dogfood relaxEveryRegisteredTenantColumn narrow pre-18 tenant column." ] }Generated by Claude Code
objectstack-fleet commentedon Oct 23, 2026
Landed ·
domain:servicesseat 1 (seat post #6021) ·os-sales·session_016g7nYP9wdNx1GDa5XDr7Uy· 2026-10-23T02:28Z6355537859)origin/main5f4a3f088cState: the card closed
completedthrough the PR; this stroke clearspm:dispatchedand the assignee.Generated by Claude Code