publish-time advisory: bare `unique: true` on a tenant-scoped object under group/isolated postures — point authors at the explicit 'organization' | 'global' choice

[hotlong]

Filed by the triage seat executing the maintainer's 2026-08-13 ruling on #8323 (part 3 of that ruling — see its ruling comment). This is the authoring-guidance half pulled forward as an advisory; the accept set does not change.

What

When a tenant-scoped object declares a field with bare unique: true and the deployment/authoring context is a tenant-walled posture (group / isolated), publish-time validation emits a warning (not a refusal): the bare spelling materializes a global unique index, which under a tenant wall both leaks a 409-vs-201 oracle for other tenants' values and blocks legitimate same-value rows across organizations (measured end-to-end on #8323). The guidance names the two explicit spellings and what each means:

• unique: 'organization' — unique within the tenant ((organization_id, field) index, ADR-0120 D1);
• unique: 'global' — deliberately global, with the cross-tenant collision signal that implies.

Why a warning and not a refusal

Parked #5082 (v18 D2) already rules the endgame: bare true → 'global' + loud refusal of the ambiguous spelling. This card pulls only the guidance forward so that the v18 flip hardens an existing warning instead of introducing a refusal cold, and so AI-authored apps are pushed toward the explicit spelling today. ⛔ Do not implement the refusal or any posture-aware reinterpretation of bare true here — both are explicitly reserved to #5082 by the #8323 ruling ("Option 1 rejected for now").

Landing

The posture-aware publish validation surface in packages/spec (the validateSecurityPosture family is the neighbouring pattern, cf. #7891). Warning text must state the mechanism ("bare unique: true materializes a GLOBAL unique index"), not just the preference.

Acceptance

• Tenant-scoped object + bare unique: true + group/isolated context ⇒ warning present, publish still succeeds (accept set unchanged — pin both halves).
• Explicit 'organization' or 'global' ⇒ no warning.
• Non-tenant-scoped objects and single posture ⇒ no warning.

Refs: #8323 (ruling + measurements) · #5082 (v18 endgame, parked) · ADR-0120 D1.

[qq9340100]

Claim: PM loop round 2
Session: session_012MNV7ZSCjNfA38eDCjsXQL
Branch: claude/issue-8379-bare-unique-tenant-advisory
Worktree: objectstack-issue-8379
Domain: domain:spec
File surface: the posture-aware publish-validation surface — expected packages/lint/src/validate-security-posture.ts family (warning tier) and/or packages/spec posture helpers; dev locates the exact seam and declares it in the PR (stop on wider breach; explain in the report)
Container & model: M, mode:subagent, model: opus (warning-only advisory — the accept set explicitly does NOT change, pinned both halves per the card; not the fable clause's territory)
Serial constraints cleared: the #7891 family serial released — PR #8390/#8491/#8546 all MERGED (19:21Z latest); object is NOT runtime-gated (escalated on #8310), so this advisory's runtime-door reach for object writes follows that ruling — CLI/publish doors serve it today; no in-flight claim touches the lint posture surface (relay leg 4 is in packages/spec kernel/data)

---

Generated by Claude Code

[qq9340100]

Premise falsified — no PR. The card asks for a warning whose stated mechanism does not exist at the spelling it names, and whose remedy is a byte-identical no-op. On the spelling where the hazard is real, the warning the ruling asked for already ships.

{
 "issue": 8379,
 "status": "needs_decision",
 "branch": "claude/issue-8379-bare-unique-tenant-advisory (created, no commits, torn down)",
 "pr": null,
 "premise_still_valid": false,
 "summary": "The card's premise is inverted at the spelling it names. It asks for a publish-time warning that a FIELD's bare `unique: true` 'materializes a GLOBAL unique index'. Measured: it does the opposite. `uniqueIndexesFromFields` returns columns ['organization_id','email'] with nullSafeColumns ['organization_id'] for a field's bare `unique: true` on a tenant-scoped object — the NULL-safe PER-ORGANIZATION composite. The remedy the card mandates is a no-op: `unique: 'organization'` on a field produces a BYTE-IDENTICAL index (JSON.stringify equality asserted). `unique: 'global'` is the only field spelling that materializes installation-wide. So the mandated warning text would be factually false and its fix would change nothing physically. Three normative sources agree and were confirmed by execution, not merely read: packages/spec/src/data/field.zod.ts UniqueScopeSchema ('a synonym of `true` at field level, with identical materialization'; bare `true` 'stays valid indefinitely ... no trap'); ADR-0120 D1 line 293 ('Field-level `unique: true` is not converted — it is not deprecated') and Resolved review question #2 line 535 ('Field-level bare `true` stays valid indefinitely'); packages/types/src/unique-scope-install-gate.ts fieldUniqueIsGlobal, whose doc states outright that field-level bare true 'is never a finding'. Parked #5082 — the endgame this card exists to pre-harden — says the same in its own body: field-level `unique: true` is not converted (D1: permanently valid), and it scopes the v18 hard refusal to the bare spelling ON DECLARED INDEXES. The card's own reasoning therefore points at DECLARED INDEXES, where the #8323 409-vs-201 oracle was actually measured — and there the advisory ALREADY EXISTS and already satisfies every acceptance criterion: `unique/unscoped-declared-index` (R11, ADR-0120 D5a, packages/lint/src/data-model-rules.ts), tier 'advisory', commands ['validate','build'] — i.e. publish-time, warning, never a refusal — stating the mechanism verbatim ('materializes over exactly its `fields`, i.e. installation-wide'), naming both explicit spellings in its `fix`, and backlinking #5082 so the v18 flip hardens an existing warning rather than introducing a refusal cold. That is the card's stated purpose, already delivered. The remaining half of the card's acceptance ('single posture ⇒ no warning') would NARROW that shipped rule, deleting coverage, on an inference the codebase documents as a dead end: R11's own comment says it fires on the SPELLING alone, 'deliberately no tenancy or posture inference (organization_id is kernel-injected at registration, not authored, so an authoring-time guess would be wrong half the time; that dead end is documented on #4698)'. PM MECHANISM ASSUMPTION FALSIFIED, as invited: the deployment posture is not reachable in packages/lint at all — zero occurrences of 'isolated' anywhere in packages/lint/src. It lives in packages/types/src/env.ts and in the ADR-0120 D5e install-time gate (packages/types/src/unique-scope-install-gate.ts, GLOBAL_UNIQUE_CONFIRMATION_REQUIRED), which is the seam where posture IS known — and that gate already blocks installation-wide uniques under the isolated posture with a per-index confirmation ceremony. So posture-aware judgment of global uniques exists; it sits at install time, correctly, because metadata is portable: an app authored on a `single` stack can be installed on an `isolated` one, which makes the AUTHORING machine's posture the wrong oracle by construction. Net: every element the ruling asked for is already in the tree, split across the two seams where each half's information is actually available. I wrote no speculative code.",
 "tests": "No product change, so no suite to move; the deliverable is measurement. Dependency closure built first (`pnpm --filter '@objectstack/lint^...' --filter '@objectstack/driver-sql^...' build`, `--workspace-concurrency=2` before the filters), all under `flock -w 7200 /tmp/os-heavy-verify.lock` with NODE_OPTIONS=--max-old-space-size=4096. Measurement ran as two throwaway vitest files (driver-sql 4/4 passed, lint 4/4 passed), both DELETED afterwards — final `git status --porcelain` empty, worktree torn down unforced, local branch deleted with no commits. Real output, driver-sql: BARE true => [{name:'uniq_crm_contact_organization_id_email',columns:['organization_id','email'],unique:true,nullSafeColumns:['organization_id']}] · EXPLICIT organization => byte-identical to the above (asserted via JSON.stringify equality, not eyeballed) · EXPLICIT global => [{name:'uniq_crm_contact_email',columns:['email'],unique:true}] · isOrganizationScopedUnique(true)===true, isOrganizationScopedUnique('organization')===true, isOrganizationScopedUnique('global')===false. Real output, lint (lintDataModel): FIELD bare true => ['suggestion:object/missing-name-field'] only — no unique/* finding today, i.e. the card's case 1 is silent by design, not by omission. DECLARED INDEX bare true => severity 'warning', rule 'unique/unscoped-declared-index', message '\"crm_contact\" declares index [email] with bare `unique: true` — a unique index whose scope is unstated (ADR-0120). Today the bare spelling materializes over exactly its `fields`, i.e. installation-wide; an author who meant \"unique per organization\" gets no per-organization constraint and no error. Protocol 18 rejects this spelling (#5082).', with fix 'State the scope: unique: global (installation-wide — exactly today's behavior) or unique: organization (one holder per organization ...)'. DECLARED INDEX 'organization' => no unique/* finding; DECLARED INDEX 'global' => no unique/* finding. So the card's three acceptance criteria are ALREADY met on the declared-index spelling, including both negative arms. FIELD-level 'global' => no authoring-time finding, by design (explicit deliberate spelling; the ADR-0120 D5e install gate is what judges it, with posture). CORPUS: examples/app-showcase, app-crm and app-todo declare NO `unique` constraint at all — zero bare unique, zero explicit organization, zero declared unique indexes (the single grep hit in invoice.object.ts is the word 'unique' in a prose comment). The corpus is warning-clean and unaffected in either direction; the card's hazard has zero instances there. GATES: not re-derived and not run — `scripts/pm/dispatch-gates.mjs` takes changed paths and there are none; no file in the repo was modified. Nothing in the forbidden surface was touched (runtime-gate.ts, packages/spec regenerated artifacts, content/docs/releases/** all untouched). No changeset, since nothing is user-visible.",
 "open_questions": [
 {
 "question": "Part 3 of the maintainer's 2026-08-13 ruling on #8323 rests on a mechanism that does not exist at the spelling it names: a FIELD's bare `unique: true` is already per-organization and `unique: 'organization'` is its byte-identical synonym, permanently valid per ADR-0120 D1. The advisory the ruling describes already ships, at publish time, on the declared-index spelling where the measured oracle actually lives. What should happen to #8379?",
 "options": [
 "A — Close #8379 as already-satisfied, recording that `unique/unscoped-declared-index` (ADR-0120 D5a) is the advisory part 3 asked for and that the ADR-0120 D5e install gate is its posture-aware half. Optionally add a one-line backlink from the rule's doc comment to #8323's measurement, as a docs-only card.",
 "B — Implement the card literally: a field-level warning stating that bare `unique: true` materializes a global index, suppressed under `single` posture.",
 "C — Add the card's posture-conditioning to the existing declared-index rule: keep the warning under group/isolated, suppress it under `single`."
 ],
 "recommendation": "A, and B and C are not close. B would ship a factually false statement — the field composite is per-organization and I have the materialized index to prove it — and its remedy is byte-identical to the spelling it complains about, so an author who complies changes nothing and learns that this platform's warnings are noise. That is the precise failure mode the AI-error-resistance axis exists to prevent: AI-authored metadata apps are the population most likely to obey a warning literally, and a no-op remedy trains obedience to a falsehood while the genuinely global spellings ('global' on a field, bare true on a declared index) go unmentioned. B also contradicts a live ADR (D1, 'valid indefinitely') and parked #5082, whose body already rules that field-level `unique: true` is not converted — so implementing B would put a warning on a spelling the v18 train has committed to KEEPING, and the v18 flip would have to RETRACT this warning rather than harden it, inverting the card's own rationale. C is subtler but still a net loss: it narrows a shipped rule that deliberately fires on the spelling alone, for a reason documented and measured before this card (#4698) — organization_id is kernel-injected at registration, not authored, so authoring-time tenancy inference is wrong about half the time. Worse, it is wrong even when the inference succeeds: metadata is portable, so an app linted on a `single` stack can be installed on an `isolated` one, and suppressing by the authoring machine's posture removes the warning exactly for the author who will later be bitten. Posture belongs where it is known — the ADR-0120 D5e install gate, which already runs and already demands per-index confirmation under `isolated`. On real business need: the pull behind this card was #8323's measured cross-tenant oracle, and that pull is fully discharged — the two platform objects were respelled in #8461, the authoring-time warning for the trap that produced them exists, and the corpus has zero instances of the shape; there is no measured author writing the thing B would warn about. On long-term soundness for this project: A keeps one meaning per spelling and one judgment per seam, which is what lets #5082 land as a clean warning-to-error promotion; B and C each add a second, contradictory judgment of the same token and give the v18 train more to unwind — the two-contradictory-meanings sequence the 2026-08-13 ruling exists to avoid. I recommend the PM take A back to the maintainer rather than close it unilaterally, since part 3 was maintainer-authored — but the substance is that part 3 was already true when it was written."
 }
 ],
 "out_of_scope_findings": []
}

Evidence index

Claim	Where
Field bare true produces a per-organization composite	packages/drivers/driver-sql/src/schema-drift.ts — uniqueIndexesFromFields / isOrganizationScopedUnique
'organization' is a field-level synonym of true	packages/spec/src/data/field.zod.ts — UniqueScopeSchema
Field bare true permanently valid, not deprecated	ADR-0120 D1 (line 293) + Resolved review question #2 (line 535)
Field bare true "is never a finding"	packages/types/src/unique-scope-install-gate.ts — fieldUniqueIsGlobal
v18 refusal is declared-index only	#5082 body
The advisory already ships, publish-time	packages/lint/src/data-model-rules.ts — lintUnscopedDeclaredIndexes; authoring-rules.ts (tier: 'advisory', commands: ['validate','build'])
Posture-blind by design, dead end documented	R11 doc comment, citing #4698
Posture unreachable in lint	zero isolated occurrences in packages/lint/src
Posture-aware judgment exists at install	unique-scope-install-gate.ts (ADR-0120 D5e), GLOBAL_UNIQUE_CONFIRMATION_REQUIRED

No files were modified; the worktree was torn down clean and the unused branch deleted.

---

Generated by Claude Code

---

Generated by Claude Code