[security] driver upsert: a tenant-scoped upsert keyed on a globally-unique business column can merge into, and re-parent, another tenant's row

Ruled: 5934879010 · letter A (refinements 1/2/3) · 2026-10-01T15:40Z

Filing gate: ① a reproducible defect with a named landing site: the driver upsert merge set (packages/drivers/driver-sql/src/sql-driver.ts, upsert and insertOnlyUpsertColumns; the remote face reads the same list since PR #21184). reach: exception: security. It was measured once, by #21166's dev, on SqlDriver over better-sqlite3 through a direct driver call. The remote face, PostgreSQL and MySQL were not measured.

Filed by the domain:engine execution seat 2 (seat post #20966, session_01Ujdtvqs7ree7WyQmEDwEnG) from #21166's report, out_of_scope_findings[0]. ⛔ Filed bare: grading and routing belong to triage. ⛔ Not a claim. Reader: the maintainer first (a tenant-isolation boundary), then triage.

What is known publicly

A caller scoped to one tenant called the published IDataDriver.upsert with a conflict key on a column declared unique across tenants. The call merged into a row that another tenant owns. The row's tenant column and its other columns were overwritten, with no error. The row then belonged to the caller's tenant, and was readable there.
The class: the tenant column is not among the columns upsert treats as insert-only. That is the family drivers(sql): an upsert that merges on a non-PK conflict key silently REWRITES the existing row's primary key — measured on SQLite and MySQL alike #8622 fixed for id, and [finding] driver-turso remote: upsert keyed on a business column replaces the existing row's primary key (the #8622 re-key) — RemoteTransport's merge set keeps id, which the local face declares insert-only #21166 for the remote face.
In-repo reach, measured by this seat's grep: no in-repo producer passes a business-key conflictKeys.
- LifecycleService passes ['id'].
- ObjectQL has no upsert method, so the sandbox body runner's upsert falls back to insert.
- The import runner finds a record by its match fields, then updates it by id ([finding] driver-turso remote: upsert keyed on a business column replaces the existing row's primary key (the #8622 re-key) — RemoteTransport's merge set keeps id, which the local face declares insert-only #21166, H2).
The exposure is the published driver contract: a connector, a plugin or a host that upserts on a business key.

Detail withheld pending the maintainer. The reproduction stays with the seat.

Scope for whoever takes it (⛔ not a ruling)

The tenant column is insert-only in the upsert merge set on every face, read from the one list (insertOnlyUpsertColumns).
And/or a conflict that resolves to another tenant's row is refused rather than merged. That is a security-boundary choice, and the maintainer's.
Pins on SQLite and PostgreSQL, and on the remote face.

Dedupe

#8622 (the id re-key, local face) and #21166 (the id re-key, remote face; PR #21184) are the same family. Neither covers the tenant column. The 200 most recent objectstack issues contain no card on a cross-tenant upsert merge.

Generated by Claude Code

Claim: PM loop round 1
Session: session_017xfMoEjKUuSh2xYB8sCozp
Account: huangyiirene (the seat's linked user as GET /user answers it; the card's assignee)
Branch: claude/issue-21185-upsert-cross-org-refusal
Worktree: objectstack-issue-21185
Domain: domain:engine
Seat: domain:engine#1 (seat post #6367)
Ruling-ref: 5934879010
File surface: packages/drivers/driver-sql/src/sql-driver.ts (upsert, insertOnlyUpsertColumns, the MySQL assertMergeLandedOnSuppliedIdentity path), packages/drivers/driver-turso/src/turso-driver.ts and remote-transport.ts (the upsert regions only), pins on SQLite, PostgreSQL, MySQL (CI's live leg) and the remote face, and changesets for driver-sql and driver-turso. ⛔ Not driver-memory or driver-mongodb (the ruling's "not in scope"). ⛔ No packages/spec edit without a report first (the ruling's Clause-② parameter).
Container & model: M, mode:subagent, model: opus (dispatch-gates --tier at 0d421041: no path-derived mandate, floor sonnet · default opus · ceiling fable)
Clause-②: no (narrowing)
Thread-read: 5934879010
Serial constraints cleared: read at 2026-10-01T16:38Z against origin/main 0d421041. In flight on these files, all this seat's and region-disjoint: #21178 (remote-transport.ts buildWhereSQL, plus a new resolver setter wired in turso-driver.ts's constructor) and #21163 (PR #21206, sql-driver.ts's autonumber sequence scan). Whichever lands second merges main. Seat 2's in-flight branches touch neither package. The ruling 5934879010 was retrieved in this act; the dispatch quotes it verbatim, and the ruling's p0 raise rule stands.

Generated by Claude Code

os-dev-report
{
"issue": 21185,
"status": "blocked",
"branch": "claude/issue-21185-upsert-cross-org-refusal",
"pr": "#21225",
"session": "session_017xfMoEjKUuSh2xYB8sCozp — the dispatching PM's (subagent run)",
"premise_still_valid": true,
"summary": "P0 RAISE RULE — MEASURED HIT ON THE REMOTE FACE: on main (base 5e5ce48), through the libSQL stub that runs RemoteTransport's own upsert SQL on better-sqlite3, a tenant-scoped upsert whose conflict landed on another organization's row (both the ['id'] target and a unique:'global' column) was NOT refused: it returned with no error, and the merge statement carried no organization predicate. Turso pins red on the remote face: 5 of 7 face pins, plus the parity pin. With no tenant context, a payload's organization re-parented the other organization's row (measured diff: organization_id other -> caller, on both faces). The remote insert leg wrote the row with NO organization ('expected null to be org_os21185_caller'), because that face never stamped options.tenantId. Not measured against a hosted Turso endpoint. In-repo producer: none reaches the fenced path (census at e746da2). The lifecycle archiver calls cold.upsert(object,row,['id']) without a tenant context, so it gets half 2 only. The sandbox body runner's ql.upsert falls back to insert. The knowledge adapters' upsert is another interface. IMPLEMENTED (ruling A, refinements 1/2/3): a tenant-scoped upsert is fenced to the organization the row is WRITTEN under, for any conflict target, the primary key included. SQLite and PostgreSQL carry the predicate in the merge statement (DO UPDATE ... WHERE stored IS / IS NOT DISTINCT FROM excluded). The read-back now reads under the written organization exactly, and a miss throws UNIQUE_VIOLATION/409. MySQL runs the statement plus a landed-row read under the written organization in one transaction whenever the call is fenced (a savepoint inside a caller's transaction). The read carries #8807's verdict, and a rival-key probe keeps #8807's own refusal for same-organization rival landings. The remote face carries the same predicate, stamps the caller's organization on entry, and uses a fenced read-back: the read-back was chosen over rowsAffected because DO NOTHING affects 0 rows on a same-organization conflict. Half 2: the tenant column joined insertOnlyUpsertColumns, the one list both faces read. The refusal is code UNIQUE_VIOLATION, status 409, with the engine's duplicate-record sentence. It names no organization or row value and carries no cause. BLOCKED ON THE SEAT'S WORD for two packages/spec edits that the dispatch forbids without a report. Both gates are red on e746da2 for exactly these, and nothing else is red locally. (1) The error-code provenance row: 'UNIQUE_VIOLATION' under '@objectstack/driver-sql' in packages/spec/src/api/error-code-ledger.zod.ts. It is provenance only: the ErrorCode union is byte-unchanged, and api-surface records ERROR_CODE_LEDGER by name only. (2) The ADR-0087 semantic ledger entry entries/semantic/17.driver-upsert-cross-organization-conflict-refused.ts, plus gen:migration-registry / gen:spec-changes / gen:upgrade-guide. The changeset already names 'registered driver-upsert-cross-organization-conflict-refused'; the ruled FROM -> TO is a prescription, so the gate refuses not-required(no-migration-prescription). It also needs '@objectstack/spec': patch in the changeset front matter. Neither edit moves Clause-② (precedent: the changeset for driver-sql-calendar-day-methods-removed is registered + 'Clause-②: no (narrowing)' + spec patch). H4 holds: the IDataDriver.upsert docblock is one line and states no merge semantics, so Clause-② stays no (narrowing). DEVIATIONS: (a) MySQL reuses #8807's MECHANISM (transaction + post-statement read + rollback) through a new read keyed on the conflict-key values, assertMergeLandedInWrittenOrganization. The literal assertMergeLandedOnSuppliedIdentity reads by the supplied id, which falsely refuses the same-organization business-key control, since id is insert-only. (b) A savepoint inside a caller's transaction, so that 'its failure rolls the write back' holds there too. #8807 alone does not do this; its own path is unchanged. (c) The ruled premise 'the tenant-scoped read-back then finds no row' is false for a row with NO organization, because applyTenantScope admits NULL rows. The fenced read-back adds equality on the tenant column, so such a conflict is refused (pinned) instead of being a silent no-write. (d) The remote face now stamps injectTenantOnInsert on upsert. Without it the 'written organization' is empty and the same-organization control would be refused. (e) #8807's identity read no longer scopes to the payload's tenant on a call without a tenant context. Measured on MariaDB 10.11: half 2 otherwise produced a false #8807 refusal. (f) The MySQL leg was measured locally on a throwaway MariaDB 10.11 (binaries from apt-get download + dpkg -x, no system install), not on MySQL 8.0. MySQL 8.0 is NOT MEASURED locally; CI's Temporal Conformance job runs it. (g) Throwaway PG 16 and MariaDB ran under /tmp/os21185-* because the scratchpad's parents are not traversable by the non-root PG user. Both servers were stopped by recorded PID and both dirs removed. PR BODY ADDITION REQUESTED (the seat writes it; dev wrote the body once): add to Acceptance notes the out_of_scope_findings[1] observation about SqlDriver.create on the MySQL family. files_changed: .changeset/21185-upsert-cross-org-refusal.md; packages/drivers/driver-sql/src/sql-driver.ts; packages/drivers/driver-sql/src/sql-driver-upsert-cross-organization-refusal.test.ts; packages/drivers/driver-turso/src/remote-transport.ts; packages/drivers/driver-turso/src/turso-driver.ts; packages/drivers/driver-turso/src/turso-local-remote-upsert-cross-organization-parity.test.ts. line_budget: not applicable (no skills/** or governed surface). Hypotheses: H1 confirmed: at base 5e5ce48 the list was created_at, id and autonumber, with no tenant column. H2 confirmed: assertMergeLandedOnSuppliedIdentity ran only on the MySQL pre-flight verdict identity-at-risk (PK target plus a rival UNIQUE key). H3 confirmed, plus the remote face did not stamp the tenant. H5: today a read-back miss raised nothing; it returned the payload (local formatOutput(...) || toUpsert, remote rows[0] || toUpsert). The SQL drivers' create() throws the raw dialect error; the engine wraps it as DUPLICATE_RECORD and REST answers 409 UNIQUE_VIOLATION. The driver-level construction here follows driver-memory's {code:'UNIQUE_VIOLATION', status:409}, which is why the provenance row is owed.",
"tests": "All on HEAD e746da2 (git rev-parse --short HEAD), after merging origin/main 097ef80 (which includes #21178's 862f12c). PINS: driver-sql src/sql-driver-upsert-cross-organization-refusal.test.ts (dialect cells sqlite/pg/mysql) and driver-turso src/turso-local-remote-upsert-cross-organization-parity.test.ts (local + remote faces + parity). Live run: OS_TEST_POSTGRES_URL (throwaway PG 16) + OS_TEST_MYSQL_URL (throwaway MariaDB 10.11), vitest run of the new file + sql-driver-upsert-conflict-target-dialects.test.ts -> 'Tests 92 passed (92)', VERDICT command-exit 0. Full suites, SQLite cell: driver-sql 'Test Files 209 passed | 11 skipped (220) / Tests 3491 passed | 192 skipped' exit 0; driver-turso 'Test Files 85 passed (85) / Tests 2301 passed | 33 skipped' exit 0; driver-sqlite-wasm (inherits the door) 'Tests 675 passed (675)' exit 0. Typecheck: driver-sql and driver-turso exit 0 (after a rebuild of the turso dependency closure). REVERSE VERIFICATION, committed fix first: main's sql-driver.ts restored with git restore --source=5e5ce48c under trap 'git checkout HEAD -- path'. Mutation landed: on-disk blob a7a0da5e == base blob, grep -c upsertTenantGuard = 0. Result on sqlite+pg+mariadb: 'Tests 25 failed | 14 passed (39)'. Red: every refusal pin and half 2 on each cell, and the fresh-id business-key pin on MariaDB only (SQLite/PG already answer it natively). Restored blob ed1603d2 == HEAD blob, git diff HEAD empty. Turso file on main (driver-sql dist = main): 'Tests 10 failed | 5 passed (15)', including remote 'expected null to be org_os21185_caller' (insert leg wrote no organization). Earlier red run of the driver-sql file on main: sqlite+pg 14 failed / 10 passed / 1 skipped (MySQL cell declared un-run). GATES on e746da2: node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --ran -> 'Run reconciliation — 63 derived, 63 run, 0 NOT-MEASURED, 0 UNRUN' exit 0. All exit 0 except: node scripts/check-adr-0087-registration.mjs --base origin/main :: exit 1 ('claims registered driver-upsert-cross-organization-conflict-refused but 1 of those id(s) do not exist' = owed item 2). Notable greens: pnpm check:tenant-chokepoint :: exit 0 ('22 getBuilder() binding(s) across 3 file(s); every read builder routes through applyTenantScope()'); pnpm check:nul-bytes :: exit 0; pnpm check:dual-build-cjs-loads and pnpm check:lean-entry-closure :: exit 0 (exit 3 PREREQUISITE NOT MET on the pre-merge tree, measured after the closure rebuild). Outside the derivation: pnpm --filter @objectstack/spec check:error-code-provenance :: exit 1 ('@objectstack/driver-sql stamps UNIQUE_VIOLATION (constdef) at sql-driver.ts:2361 — not listed under its own owner key' = owed item 1); pnpm check:error-code-casing :: exit 0. check:driver-conformance BEFORE first edit (base 5e5ce48) and AFTER last commit (e746da2): both 'OK — 50 covered cell(s), 0 in the DEBT ledger, 0 exempt' (ledger unchanged). LINT, narrowed: eslint --no-inline-config --format json over the 5 changed .ts files -> files 5, errors 0, warnings 0. Population is the changed TypeScript set. eslint.config.mjs states it enables no type-aware linting (no parserOptions.project), so this diff cannot move the verdict on any untouched file. The repo-wide pnpm lint is CI's. NOT MEASURED: MySQL 8.0 live cell (no server in the container; CI's Temporal Conformance (live PG + MySQL) job runs the whole driver-sql suite with OS_EXPECT_LIVE_DIALECT_MATRIX=1). CI convergence is the PM's.",
"mcp_calls": "0 — no MCP GitHub tool was called",
"api_writes": "3 — each one relay dispatch (POST /repos/objectstack-ai/objectstack/dispatches) executed as objectstack-fleet[bot]: POST /repos/objectstack-ai/objectstack/pulls (draft #21225, body read back 9412/9412 bytes identical); POST /repos//issues/21225/assignees (huangyiirene, read back MATCHES); POST /repos//issues/21185/comments (this os-dev-report). Reads were REST GETs only. No label written: the dispatch named none, and skip-changeset does not apply since a changeset ships. git push is not a REST write.",
"open_questions": [
{
"question": "Authorize the two packages/spec edits that the ruled answer requires, so a patch round on PR #21225 can make it landable? (1) error-code-ledger.zod.ts: 'UNIQUE_VIOLATION' under '@objectstack/driver-sql', provenance only. (2) An ADR-0087 semantic entry 17.driver-upsert-cross-organization-conflict-refused plus its generated artifacts, and '@objectstack/spec': patch in the changeset.",
"options": [
"A — authorize both in this PR. The Clause-② line stays 'no (narrowing)', per the 20822 precedent: registered + no (narrowing) + spec patch.",
"B — land the semantic entry in its own PR first and switch this changeset to not-required (already-registered ...), the 19922 precedent. The provenance row still has to ride here.",
"C — answer the refusal without a driver-level stamp (re-issue a plain INSERT so the server raises its own unique violation). Rejected: the ruling says no new machinery, and the code would be the dialect's, not UNIQUE_VIOLATION."
],
"recommendation": "A, because: (real business need) the stamp is the ruled answer and the ledger row is what makes it visible; (long-term soundness) one PR keeps code, changeset and ledger together; (AI-proofing) the gates stay strict and nothing is waived; (no sprawl) no new code, key or gate, just one provenance row and one ledger entry."
}
],
"out_of_scope_findings": [
"class: b · reach: exception: security (could expose data across organizations if a remote database holds more than one) · The remote face applies no tenant scope on its other doors. The remote branches of TursoDriver find/findOne/count/update/delete/updateMany/deleteMany pass no options to RemoteTransport, whose update/delete compile WHERE "id" = ? only. The remote create does not stamp options.tenantId. Read at e746da2 (turso-driver.ts remote branches, remote-transport.ts update/delete). The distinct() docblock already records 'no remote read applies the tenant scope'. This PR fixes the upsert door only. Contract: ADR-0131 D8 'threads the same value ... to every driver'. Seam: spec:DriverOptions.tenantId → runtime:TursoDriver remote branches (find/update/delete/create) | renderer: consumer: none. Not measured end to end; whether hosted tenant databases hold several organizations decides real reach · dedupe words: remote face tenant scope, TursoDriver tenantId ignored, remote create organization stamp, libsql transport tenancy, RemoteTransport update where id",
"carrier: 承接者:无 · noted, not filed — SqlDriver.create on the MySQL family answers a value that is not the stored row: knex returning('*') is a no-op on mysql2. Measured on MariaDB 10.11 in this run: create() answered a value whose id was undefined. No public door was measured, so there is no reach. The seat is asked to add it to PR #21225 Acceptance notes.",
"carrier: 承接者:无 · noted, not filed (in PR #21225 Acceptance notes) — the ruled predicate compares against the WRITTEN organization. A tenant-scoped payload that names another organization (injectTenantOnInsert's documented admin authority) still merges into that organization's row, which update() under the caller's scope would not reach. Under the group posture an upsert onto another member organization's row is refused, where update()'s union scope reaches it. Ruled semantics, recorded for the maintainer."
]
}

Generated by Claude Code

Claim: PM loop round 1 (amendment after the dev's report 5937894588: the grade is raised to p0 by the ruling's own rule, and the file surface gains two packages/spec edits; same session, branch and PR #21225)
Session: session_017xfMoEjKUuSh2xYB8sCozp
Account: huangyiirene (the seat's linked user as GET /user answers it; the card's assignee)
Branch: claude/issue-21185-upsert-cross-org-refusal
Worktree: objectstack-issue-21185
Domain: domain:engine
Seat: domain:engine#1 (seat post #6367)
Ruling-ref: 5934879010
File surface: as the first claim (5935961155), plus two packages/spec edits:

packages/spec/src/api/error-code-ledger.zod.ts: one provenance row, UNIQUE_VIOLATION under @objectstack/driver-sql. It is a pure append in that package's own section, and the ErrorCode union is unchanged.
packages/spec/src/migrations/entries/semantic/17.driver-upsert-cross-organization-conflict-refused.ts, plus the artifacts gen:migration-registry, gen:spec-changes and gen:upgrade-guide regenerate, and '@objectstack/spec': patch in the changeset.
Container & model: M, mode:subagent, model: opus (unchanged)
Clause-②: no (narrowing)
Thread-read: 5937894588
Serial constraints cleared: read at 2026-10-01T18:32Z against origin/main. [finding] driver-turso remote: RemoteTransport.buildWhereSQL has no JSON-column gate — $contains matches a substring instead of a member, $nin fails open, and the refused families compile over the serialized array (the orphaned #20987 remote item) #21178 (862f12c0b) and rest(import): a column for a formula field passes the dry run, then fails the row at commit with the driver's SQL error, where the create door answers 400 INVALID_FIELD #20701 (bbcd20c52) have landed. The branch merged main at 097ef802. No open PR edits error-code-ledger.zod.ts's driver-sql section or entries/semantic/, per this seat's read of the open PR list at this act. [finding] driver-sql's JSON-column refusal is about 800 characters and is cut at the REST envelope's 500, so no caller reads the sentence saying the field and operator were withheld #21067 (PR fix(core): the JSON-column refusal reads true on every face and reaches a REST caller whole #21213) and [finding] SQLite: an autonumber format whose prefix contains _ or % seeds its counter from 0 — scanMaxNumericTail escapes the prefix but Knex emits no ESCAPE clause, so the bootstrap and #5495 re-seed scans match nothing #21163 (PR fix(driver-sql): an autonumber prefix carrying _, % or \ seeds its counter from the stored MAX on SQLite (#21163) #21206) are queued in other regions of sql-driver.ts and core.

p0 raise (the ruling's rule, measured)

The ruling 5934879010 says: 「an in-repo producer that reaches this, or a measured hit on the remote face hosted tenants run, raises the card to p0」. The dev measured the remote face on main through the libSQL stub that runs RemoteTransport's own upsert SQL:

a tenant-scoped upsert whose conflict lands on another organization's row, on both the ['id'] target and a unique: 'global' column, is not refused;
with no tenant context, the payload's organization re-parents the other organization's row;
the remote insert leg writes a row with no organization.

It was not measured against a hosted endpoint, and no in-repo producer reaches the fenced path (census at e746da26). This act raises the card to priority:p0. PR #21225 already carries the fix on every face.

Seat answer to the dev's open question: A, open to the maintainer's veto

Both packages/spec edits ride PR #21225, and Clause-② stays no (narrowing).

The provenance row is pre-approved by the domain:spec lane's standing commitment for cross-lane error-code-ledger.zod.ts appends, and all three of its conditions hold:
- the code's existence is ruled on this card (refinement 2: UNIQUE_VIOLATION, no new code);
- the at-tier contract review before enqueue still applies, because the diff now touches packages/spec/src/**;
- it is a pure append under the package's own section.
The ADR-0087 semantic entry follows this lane's precedent: PR fix(plugin-security,driver-sql,driver-turso): lower type-blind at the RLS seam without a guard, then delete the F1/F2 whole-day and NOT-rewrite copies (#5930 step 4, group 2) #20988 registered driver-sql-calendar-day-methods-removed with Clause-②: no (narrowing) and a spec patch. The ruled FROM → TO is a prescription, so the disposition is registered.
B splits one ruling across two PRs for no gain. C contradicts refinement 2 (the dialect's code instead of UNIQUE_VIOLATION) and adds machinery the ruling forbids.

The dev's other outputs

Deviations (a) to (g): each is recorded in the report, and each is for the at-tier review to judge.
Out-of-scope finding 1, the remote face applying no tenant scope on its other doors, is filed as [security] driver-turso remote face: find / count / update / delete / create apply no tenant scope (only distinct() refuses), where the local face scopes every door by DriverOptions.tenantId #21226: a security-class exception, with the reach to be measured first.
Finding 2, SqlDriver.create on the MySQL family answering a value that is not the stored row, is under a separate read-only measurement by this seat. It goes into PR fix(driver-sql,driver-turso)!: refuse an upsert whose conflict lands on another organization's row (#21185) #21225's Acceptance notes at the next body edit.
Finding 3 is ruled semantics, recorded in the PR's Acceptance notes.

Generated by Claude Code

os-dev-report
{
"issue": 21185,
"status": "done",
"branch": "claude/issue-21185-upsert-cross-org-refusal",
"pr": "#21225",
"session": "session_017xfMoEjKUuSh2xYB8sCozp — the dispatching PM's (subagent run), patch round 1",
"premise_still_valid": true,
"summary": "P0 (unchanged from round 0, raised by the seat in claim amendment 5937974892): a measured hit on the remote face through the libSQL stub; no in-repo producer reaches the fenced path. PATCH ROUND 1 — the seat's answer A, executed on the same branch and PR, with no second claim. The newest Claim: 5937974892 names this branch. (1) packages/spec/src/api/error-code-ledger.zod.ts: ONE row, 'UNIQUE_VIOLATION', appended at the end of the '@objectstack/driver-sql' section with its wire-path comment (door none, provenance only). No other ledger line moved, and the ErrorCode union is byte-unchanged; UNIQUE_VIOLATION was already registered by @objectstack/types, @objectstack/plugin-security and @objectstack/driver-memory. (2) The ADR-0087 semantic entry, modelled on the lane precedent driver-sql-calendar-day-methods-removed. Regenerated with the repo's generators only: pnpm --filter @objectstack/spec build, then check:generated --fix, which proved exactly 1 of 15 stale (src/migrations/registry.ts) and ran gen:migration-registry. A second --fix pass found 'All 15 generated artifacts are up to date'. spec-changes.json and docs/protocol-upgrade-guide.md did not move, because step 18 is inert until the protocol major reaches 18; the precedent's id appears in neither file (0 hits each). (3) The changeset front matter gained '@objectstack/spec': patch, keeping 'Clause-②: no (narrowing)' and 'registered driver-upsert-cross-organization-conflict-refused'. MERGE: origin/main merged once with a merge, not a rebase: 35d01c9, carrying #21163's c6b6889 (the scanMaxNumericTail region of sql-driver.ts, disjoint from this change, merged clean) and #21067. The driver-sql and driver-turso suites were re-run on the merged head. DEVIATION, NEW AND MEASURED: the entry file is 18.driver-upsert-cross-organization-conflict-refused.ts, not the 17. prefix the dispatch named. The 17. in my round-0 report was my own guess. registry.ts records 'Protocol 18 step — accumulating, uncut. v17.0.0 was cut before these narrowings landed, so their migration prescriptions belong to the NEXT major'. The lane precedent is 18.driver-sql-calendar-day-methods-removed.ts, and current semantic entries split 77 at 17 and 257 at 18. The id is unchanged. Deviations (a) to (g) from round 0 stand as reported, for the at-tier review. CI interim reds the seat named: Lint & Repo Gates step 11 (check:migration-registry) was registry.ts not yet regenerated at interim head 82f8120; it is regenerated in 5682e8f and green locally. Check Changeset's ADR-0087 disposition red was the registered id not yet in registry.ts at 82f8120; locally on 35d01c9 check-adr-0087-registration --self-test and --base origin/main both exit 0. PR BODY EDITS REQUESTED (the seat writes them; dev wrote the body once): (i) the '⛔ Owed before this can land' section is now discharged by 82f8120 and 5682e8f; (ii) its item 2 names the file with a 17. prefix, and the landed file is 18.; (iii) the Tests line should name head 35d01c9; (iv) add round 0's out_of_scope_findings[1] (SqlDriver.create on the MySQL family) to Acceptance notes, which the seat already planned. files_changed this round: packages/spec/src/api/error-code-ledger.zod.ts (+21, one row and its comment); packages/spec/src/migrations/entries/semantic/18.driver-upsert-cross-organization-conflict-refused.ts (new); packages/spec/src/migrations/registry.ts (+51 in 5682e8f, generated; the merge brought main's own entry beside it); .changeset/21185-upsert-cross-org-refusal.md (+1 front-matter line). line_budget: not applicable. Upstream moved again after the merge (origin/main e47355b, #21218: the doc-authoring baseline shrink). dispatch-gates flags the tree as STALE for scripts/doc-authoring-prose-id.baseline.json only. This diff adds no runtime string carrying a tracker number. Not merged, per 'merge origin/main once'.",
"tests": "HEAD 35d01c9 (git rev-parse --short HEAD), pushed; origin/claude/issue-21185-upsert-cross-org-refusal = 35d01c9. Spec gates the seat named: node scripts/check-adr-0087-registration.mjs --base origin/main :: exit 0 ('1 declared-breaking changeset(s), each carrying an ADR-0087 disposition ... registered driver-upsert-cross-organization-conflict-refused (new here: ...)'); pnpm --filter @objectstack/spec check:error-code-provenance :: exit 0 ('scanned 2650 files; 336 registered-code stamp site(s): 317 listed, 19 waived — OK'); pnpm --filter @objectstack/spec check:generated :: exit 0 ('All 15 generated artifacts are up to date'); pnpm check:error-code-casing :: exit 0. Spec package tests for the ledger and the migration registry: vitest --project local over src/api/error-code-ledger.test.ts, src/migrations/migrations.test.ts, src/migrations/retired-tables-not-floor-scoped.test.ts, src/migrations/spec-changes-surface-scope.test.ts, scripts/build-migration-registry-entry.test.ts and scripts/check-error-code-provenance.test.ts -> 'Test Files 6 passed (6) / Tests 210 passed (210)' exit 0. Driver suites on the merged head, SQLite cell: driver-sql 'Test Files 211 passed | 11 skipped (222) / Tests 3545 passed | 196 skipped' exit 0; driver-turso 'Test Files 86 passed (86) / Tests 2313 passed | 33 skipped' exit 0; driver-sqlite-wasm 'Tests 675 passed (675)' exit 0. driver-sql and driver-turso typecheck exit 0. Live cells on 35d01c9: throwaway PG 16 plus throwaway MariaDB 10.11 (for the MySQL family), the new pin file plus sql-driver-upsert-conflict-target-dialects.test.ts -> 'Tests 92 passed (92)' exit 0. Both servers were stopped by recorded PID and their dirs removed. MySQL 8.0 itself is NOT MEASURED locally; that is CI's Temporal Conformance (live PG + MySQL) job. GATES: node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands re-derived on 35d01c9 -> 93 families (the spec paths added 30). All 93 were run, with exit codes recorded; --ran -> 'Run reconciliation — 93 derived, 93 run, 0 NOT-MEASURED, 0 UNRUN' exit 0. All 93 exit 0. Three first answered exit 3 (PREREQUISITE NOT MET on a fresh worktree) and were re-run after pnpm build (72 tasks, 71 turbo-cached) to exit 0: pnpm --filter @objectstack/lint run check:doc-formula-expressions, pnpm check:dual-build-cjs-loads and pnpm check:lean-entry-closure. Key families :: exit 0: check:migration-registry, check:spec-changes, check:upgrade-guide, check:api-surface, check:authorable-surface, check:error-code-provenance, check:error-code-casing, check-changeset-no-major --base, check-empty-changeset --base, check:driver-conformance ('OK — 50 covered cell(s), 0 in the DEBT ledger, 0 exempt', unchanged), check:tenant-chokepoint, check:nul-bytes. LINT, narrowed: eslint --no-inline-config --format json over the 8 changed .ts files (5 from round 0, plus the ledger, the semantic entry and the generated registry) -> files 8, errors 0, warnings 0. eslint.config.mjs enables no type-aware linting, so untouched files cannot move. The repo-wide lint is CI's. CI: not awaited, per contract; the PM reads convergence.",
"mcp_calls": "0 — no MCP GitHub tool was called this round",
"api_writes": "1 this round — one relay dispatch (POST /repos/objectstack-ai/objectstack/dispatches) executed as objectstack-fleet[bot]: POST /repos//issues/21185/comments (this os-dev-report). Reads were REST GETs only (the issue comments, to verify the newest Claim:). No PR body PATCH, no label write, no assignee write this round. git push is not a REST write.",
"open_questions": [],
"out_of_scope_findings": [
"carrier: the seat (PR #21225 body, at its next edit) · noted, not filed — the PR body's owed-edits section and its 17. filename are stale after this round; the four edits are listed in summary."
]
}

Generated by Claude Code

ACCEPT — PR #21225 at head `35d01c9d7fedae909f93a171ac2c319ed17000a6`

domain:engine#1 · session_017xfMoEjKUuSh2xYB8sCozp · read at 2026-10-01T19:37Z. Judged against GitHub.

Shape: draft, base main. The first body line is Fixes #21185, and there is no other closing keyword. No path is governed; 1,285 changed lines. The net diff is 9 files:
- sql-driver.ts's upsert fence, its refusal, and insertOnlyUpsertColumns;
- the remote face (remote-transport.ts, turso-driver.ts);
- two pin files (the driver-sql dialect-cell matrix and the driver-turso local/remote parity file);
- the UNIQUE_VIOLATION provenance row in error-code-ledger.zod.ts;
- the semantic entry 18.driver-upsert-cross-organization-conflict-refused and its generated registry.ts region;
- the changeset: driver-sql and driver-turso minor, spec patch, a ! title, Clause-②: no (narrowing), adr-0087: registered driver-upsert-cross-organization-conflict-refused.
The ruling (record 5934879010), refinement by refinement:
1. The fence is the written row's organization for any conflict target. Pinned on the default target, an explicit ['id'] and a unique: 'global' column, on SQLite, PostgreSQL and MySQL, and on both TursoDriver faces.
2. The refusal is UNIQUE_VIOLATION / 409 from one constructor that both faces throw. It carries no new code, names no organization, has no cause, and gives no value of the landed row.
3. On SQLite, PostgreSQL and the remote face, an in-statement DO UPDATE … WHERE NULL-safe predicate, then a read-back scoped exactly to the written organization. On MySQL, drivers(sql): on MySQL an upsert with no conflictKeys — or one naming the primary key — still merges on a unique key the caller never named #8807's transaction plus a read of the landed row, with a savepoint inside a caller's transaction. The tenant column is insert-only.
Rounds:
- Round 0 (e746da26) carried the fix and pins.
- Round 1, on the seat's answer A (claim amendment 5937974892): 82f8120c added the two packages/spec edits, 5682e8fe regenerated registry.ts, and 35d01c9d merged origin/main c6b68891 ([finding] SQLite: an autonumber format whose prefix contains _ or % seeds its counter from 0 — scanMaxNumericTail escapes the prefix but Knex emits no ESCAPE clause, so the bootstrap and #5495 re-seed scans match nothing #21163 and [finding] driver-sql's JSON-column refusal is about 800 characters and is cut at the REST envelope's 500, so no caller reads the sentence saying the field and operator were withheld #21067, clean). The dev's report 5938821270: 93 gate families derived, 93 run, all exit 0; check:driver-conformance unchanged (50 covered, 0 DEBT).
Contract review: PASS at CONTRACT_REVIEW_TIER on this head, record 5939108359. It judges round 0's deviations (a) to (g) and round 1's 18. prefix right, and the remote-face organization stamp and the drivers(sql): on MySQL an upsert with no conflictKeys — or one naming the primary key — still merges on a unique key the caller never named #8807 scope adjustment inside the ruling.
CI on this head, read at the review (19:34Z):
- The seven required contexts are success, Temporal Conformance (live PG + MySQL) included; that is the MySQL 8 cell the dev could not run locally.
- Skips: Build Docs, Console Pin Gate, Packed-tarball smoke (opt-in), and the edited-trigger re-runs of Auto Label and Check PR Size. All five are roster entries in check-expected-skips.mjs.
PR body: the seat edited it once for round 1. It records the discharged spec section, the 18. filename, the Tests line naming 35d01c9d, the 93-family gate line, and the driver-sql on MySQL: create() answers the insert id (0) instead of the inserted record, so sign-up answers 400 FAILED_TO_CREATE_USER, the dev admin seed fails and no user can sign in #21227 note.
Out-of-scope findings:
- SqlDriver.create on the MySQL family answers the insert id: filed driver-sql on MySQL: create() answers the insert id (0) instead of the inserted record, so sign-up answers 400 FAILED_TO_CREATE_USER, the dev admin seed fails and no user can sign in #21227, now dispatched. It does not bear on this PR.
- The remote face's other doors carry no tenant scope: filed [security] driver-turso remote face: find / count / update / delete / create apply no tenant scope (only distinct() refuses), where the local face scopes every door by DriverOptions.tenantId #21226, pm:blocked on this card. It reuses this PR's remote organization stamp.
- sys_activity schema sync on MySQL: driver-sql on MySQL: create() answers the insert id (0) instead of the inserted record, so sign-up answers 400 FAILED_TO_CREATE_USER, the dev admin seed fails and no user can sign in #21227's claim carries it as an out-of-scope finding.
- The reviewer's pre-existing observation, also at main: on a rotation-managed object, upsert's read-back names the base table rather than the current shard. Dropped — not filed: no in-repo object configures rotation, and the reach is not measured.

Next: pr_ready, then automerge_enable, as two relay acts. Fixes closes this card at merge. #21226 unblocks then, and #21227 merges main if it lands second.

Generated by Claude Code

Landed: PR #21225 → 95e24b009 on main, verified at 2026-10-01T20:05Z. domain:engine#1 · session_017xfMoEjKUuSh2xYB8sCozp.

The squash has one parent (3ddd3d0c) and is an ancestor of origin/main.
Present at the squash and absent at its parent:
- upsertTenantGuard in packages/drivers/driver-sql/src/sql-driver.ts (4, parent 0);
- upsertConflictRefusal in packages/drivers/driver-turso/src/turso-driver.ts (1, parent 0);
- the [#21185] UNIQUE_VIOLATION provenance row in packages/spec/src/api/error-code-ledger.zod.ts;
- the semantic entry 18.driver-upsert-cross-organization-conflict-refused.ts;
- .changeset/21185-upsert-cross-org-refusal.md.
Records it landed on: contract review PASS 5939108359 at 35d01c9d, and ACCEPT 5939123561 on this card. It executes the ruling record 5934879010 (refinements 1, 2 and 3).
Fixes #21185 closed this card as completed. This act strips pm:dispatched and clears the assignee. No other card was named by a closing keyword.
Unblocked by this landing: [security] driver-turso remote face: find / count / update / delete / create apply no tenant scope (only distinct() refuses), where the local face scopes every door by DriverOptions.tenantId #21226 (Blocked-by: #21185, the remote face's other doors). This seat's unlock scan returns it to the queue in a separate act. driver-sql on MySQL: create() answers the insert id (0) instead of the inserted record, so sign-up answers 400 FAILED_TO_CREATE_USER, the dev admin seed fails and no user can sign in #21227 (in flight, create / bulkCreate in the same file) merges main if it lands second.

Generated by Claude Code

fix(driver-turso)!: the remote filter compiler refuses the JSON-colum…

fix(driver-sql,driver-turso)!: refuse an upsert whose conflict lands …

Navigation Menu

Repository navigation

[security] driver upsert: a tenant-scoped upsert keyed on a globally-unique business column can merge into, and re-parent, another tenant's row #21185

What is known publicly

Scope for whoever takes it (⛔ not a ruling)

Dedupe

p0 raise (the ruling's rule, measured)

Seat answer to the dev's open question: A, open to the maintainer's veto

The dev's other outputs

ACCEPT — PR #21225 at head `35d01c9d7fedae909f93a171ac2c319ed17000a6`

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

[security] driver upsert: a tenant-scoped upsert keyed on a globally-unique business column can merge into, and re-parent, another tenant's row #21185

Description

What is known publicly

Scope for whoever takes it (⛔ not a ruling)

Dedupe

Activity

objectstack-fleet commented on Oct 1, 2026

objectstack-fleet commented on Oct 1, 2026

objectstack-fleet commented on Oct 1, 2026

p0 raise (the ruling's rule, measured)

Seat answer to the dev's open question: A, open to the maintainer's veto

The dev's other outputs

objectstack-fleet commented on Oct 1, 2026

objectstack-fleet commented on Oct 1, 2026

ACCEPT — PR #21225 at head 35d01c9d7fedae909f93a171ac2c319ed17000a6

objectstack-fleet commented on Oct 1, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

ACCEPT — PR #21225 at head `35d01c9d7fedae909f93a171ac2c319ed17000a6`