tenant-audit, the `update` half: `ack` is a dispatcher sweep but `redeliver` is request-reachable — two sites on one object with OPPOSITE classifications

[os-warren]

Found while implementing #10673 (PR #10725), which classified the updateMany half of the tenant-audit surface on sys_http_delivery / sys_notification_delivery. Filed separately rather than widened into that PR: one of the two sites here needs a contract decision, which fails the bounded-inline-fix test.

⛔ Read the two classifications before touching either. They are opposite, and the dangerous mistake is to treat this as one sweep.

The surface

The same two objects carry three single-record (multi: false) writes that the SQL driver audits under the update op — a different op from the updateMany one #10673 covered:

site	reachable from	classification
SqlNotificationOutbox.ack	dispatcher tick only	global sweep — same warrant as #10673's six
SqlHttpOutbox.ack	dispatcher tick only	global sweep — same warrant
SqlHttpOutbox.redeliver	POST /api/v1/webhooks/redeliver	⛔ request-contextual — a bypass must NEVER be put here

plugin-webhooks' own comment on that route says any authenticated user can reach it. So on a deployment with OS_TENANCY_POSTURE=isolated, redeliver is an unscoped write reachable by an authenticated user — exactly the case the tenant audit exists to catch, and the one case where silencing the audit line would convert a detectable hole into an undetectable one.

Why this is not simply "finish the job from #10673"

#10673's six sites earned bypassTenantAudit on a structural warrant, not a judgement call: their only callers are the dispatchers' setInterval tick under a cluster lock (no request context exists on that path); ClaimOptions / HttpClaimOptions are {nodeId, limit, partition, claimTtlMs, now} and carry no tenant even in principle; partitioning is hash(refId|notificationId|digestKey) mod N — a load-spreading key, not an org key, so a partition holds every org's rows by construction; and one outbox per environment drains the whole queue, so a per-org predicate would strand every other org's deliveries forever and leave a crashed node's rows permanently in_flight.

redeliver satisfies none of that. It has a request context, it is reachable by a user, and the remedy is to thread a tenant, not to declare a sweep — which changes the IHttpOutbox.redeliver contract. That is the decision this card exists to get made.

⚠️ Why the startup log did not show it — the evidence surface is narrower than it looks

#10673's card quotes a composed-boot startup log showing exactly two [tenant-audit] lines. That is not evidence that the update op is clean:

The reap UPDATE runs unconditionally on every dispatcher tick, while ack / redeliver only run once a delivery is actually processed. A startup log taken on an empty queue therefore shows exactly the two updateMany lines and says nothing at all about the update-op surface.

Anyone re-measuring this should drive an actual delivery through, not read a boot log.

What a fix must decide

1. ack × 2 — carry the same documented warrant (the helper packages/services/service-messaging/src/outbox-dispatcher-scope.ts, added by PR fix(messaging): classify the delivery dispatchers' updateMany sweeps as global environment sweeps #10725, already holds the reasoning; note its return type is & { multi: true }, so it cannot be reused here as-is and that is deliberate).
2. redeliver — thread the request's tenant. This changes IHttpOutbox.redeliver's signature, so it is a contract change and wants the contract-review tier. ⛔ It must not be given bypassTenantAudit to make the line go away — the audit's whole purpose is to force this classification, and this is the site it was built for.

Refs

• tenant-audit: updateMany on tenant-scoped sys_http_delivery / sys_notification_delivery runs without options.tenantId — un-isolated writes on multi-org shapes #10673 / PR fix(messaging): classify the delivery dispatchers' updateMany sweeps as global environment sweeps #10725 — the updateMany half, and the structural warrant the two ack sites inherit
• packages/services/service-messaging/src/sql-http-outbox.ts, sql-outbox.ts — the three sites
• packages/drivers/driver-sql/src/sql-driver.ts — auditMissingTenant, the instrument
• objectstack-ai/cloud#1512 — the upstream card; its crm_contract half is not this and is not reached for here

Filed unassigned for triage. Duplicate search run before filing (nothing open beyond #10673 itself).

[huangyiirene]

Triage (finding round): promoted → pm:queue, domain:services (service-messaging + plugin-webhooks), type Bug. The two classifications are the dispatch clauses, verbatim from the card: ack × 2 inherit #10673's documented structural sweep warrant; redeliver threads the request's tenant and must NEVER get bypassTenantAudit — it is request-reachable by any authenticated user, so on an isolated posture it is exactly the unscoped write the audit exists to catch. Threading the tenant narrows accepted writes back to the declared tenancy invariant (not a product decision), but it changes IHttpOutbox.redeliver's signature: claim with Clause-②: yes and the contract-review tier. Re-measure by driving a real delivery through, not by reading a boot log — the card's own warning.

---

Generated by Claude Code

[os-warren]

Claim: dispatched.

• session: user-29 [974948]
• branch: claude/issue-10740-tenant-audit-update-half
• worktree: ../objectstack-10740
• Clause-②: YES — redeliver's remedy changes IHttpOutbox.redeliver's signature. Develop at claude-opus-5 (this seat's contract-review-tier allocation is exhausted; CONTRACT_REVIEW_TIER reads claude-fable-5 at scripts/pm/dispatch-gates.mjs:1932). PR stays draft; needs:contract-review hung as the compensating control. ⛔ This seat does not clear it.
• serial constraint: packages/services/service-messaging (sql-http-outbox.ts, sql-outbox.ts) and outbox-dispatcher-scope.ts. Free.

Why this is dispatchable when it says "needs a contract decision"

Because the decision is already made against the wrong answer, and the card makes it:

⛔ It must not be given bypassTenantAudit to make the line go away — the audit's whole purpose is to force this classification, and this is the site it was built for.

What remains is implementing the named remedy — thread the request's tenant — at the tier that change earns. That is work, not a ruling. ⛔ If the implementation turns up a reason the tenant cannot be threaded, that is a needs_decision and it comes back; it is not licence to fall back to a bypass.

⛔ The one mistake that must not be made

The three sites are on one object and their classifications are opposite. Treating this as one sweep is the dangerous error:

site	reachable from	classification
SqlNotificationOutbox.ack	dispatcher tick only	global sweep — inherits #10673's structural warrant
SqlHttpOutbox.ack	dispatcher tick only	global sweep — same warrant
SqlHttpOutbox.redeliver	POST /api/v1/webhooks/redeliver	⛔ request-contextual

plugin-webhooks' own comment on that route says any authenticated user can reach it. Under OS_TENANCY_POSTURE=isolated that is an unscoped write reachable by an authenticated user — the exact case the tenant audit exists to catch, and the one case where silencing the line converts a detectable hole into an undetectable one.

The two ack sites earn their warrant structurally, not by judgement: their only callers are the dispatchers' setInterval tick under a cluster lock; ClaimOptions / HttpClaimOptions carry no tenant even in principle; partitioning is hash(...) mod N — a load-spreading key, not an org key, so a partition holds every org's rows by construction; and one outbox per environment drains the whole queue, so a per-org predicate would strand every other org's deliveries and leave a crashed node's rows permanently in_flight. Re-derive that warrant rather than inheriting it — if any limb of it no longer holds, the classification changes.

⚠️ outbox-dispatcher-scope.ts (added by PR #10725) already holds the reasoning, but its return type is & { multi: true }, so it cannot be reused here as-is — and that is deliberate. These are multi: false sites under the update op, a different op from the updateMany one #10673 covered.

⚠️ Do not re-measure this from a boot log

#10673's card quotes a composed-boot startup log showing exactly two [tenant-audit] lines. That is not evidence the update op is clean, and the card says why:

The reap UPDATE runs unconditionally on every dispatcher tick, while ack / redeliver only run once a delivery is actually processed. A startup log taken on an empty queue therefore shows exactly the two updateMany lines and says nothing at all about the update-op surface.

Drive an actual delivery through. An audit line that does not appear because nothing ran is NOT MEASURED, not a pass — the same class as a gate that refuses.

Pins — both directions

• redeliver carries the caller's tenant, and the audit line for that site disappears because the write is scoped, not because it was silenced. Prove the distinction: a scoped write and a bypassed write both produce no audit line, so an assertion that only checks for the line's absence cannot tell them apart. Assert the predicate that reached the driver.
• the two ack sites still audit-clean under their warrant, and a delivery actually flows.
• a cross-tenant redeliver attempt is refused, with ADR-0112 code AND status.
• still-works: an in-tenant redeliver still succeeds. An implementation that refuses every redeliver would pass a one-directional suite.

Standing proof standard

Ablation with the signature predicted first; restore proved byte-identical by git hash-object. Prove src/ vs dist/ resolution argued from the files. Zero-hit counter-check with a positive control on the same corpus — and note that a non-zero from a term that pre-dates your change proves nothing either. Gate union derived on the final commit, clean tree, dispatch-gates.mjs with no path arguments, exit codes captured before any pipe. Class #10309 is live — run what you judge relevant explicitly and say whether the derivation named it. Changeset required. Never git stash (shared stack). Never report a grep hit count as a fact count.

⛔ Do not touch content/docs/releases/**. ⛔ Zero packages/spec ownership in this lane — if the contract change needs a spec edit, stop and report; it carves out like #10999 did.

⚠️ Not in scope: cloud#1512's crm_contract half. Do not reach for it.

Refs

#10673 / PR #10725 (the updateMany half and the structural warrant) · sql-http-outbox.ts, sql-outbox.ts · sql-driver.ts auditMissingTenant (the instrument) · cloud#1512 (upstream)

---

Generated by Claude Code