fix(service-messaging): stamp organization_id on sys_http_delivery rows so the redeliver() cross-organization wall excludes other tenants' rows

.changeset/http-outbox-organization-stamp.md

@@ -0,0 +1,39 @@
+---
+"@objectstack/service-messaging": minor
+"@objectstack/service-automation": patch
+"@objectstack/plugin-webhooks": patch
+---
+
+fix(service-messaging,service-automation,plugin-webhooks): stamp `organization_id` on `sys_http_delivery` rows so the cross-organization wall on `redeliver()` actually excludes other tenants' rows (#13546)
+
+`sys_http_delivery` is tenant-scoped and `redeliver()` — the one
+request-reachable door on it — deliberately scopes by the caller's
+organization (#10740). But the enqueue door never stamped the
+`organization_id` column, and the SQL driver's tenant term is
+`(organization_id = :tenantId OR organization_id IS NULL)` — a deliberate
+global-row fail-open — so 100% of delivery rows landed in the NULL arm:
+visible to, and replayable by, every organization on a walled deployment.
+
+The repair mirrors the notification outbox's existing convention
+(`EnqueueDeliveryInput.organizationId`), end to end:
+
+- `EnqueueHttpInput` gains an **optional** `organizationId` member (inherited
+ by `UndeliverableHttpInput`, so parked rows are tenant-stamped too), and
+ `HttpDelivery` surfaces it on read-back. `SqlHttpOutbox.insert` writes
+ `organization_id: input.organizationId ?? null` exactly like
+ `SqlOutbox.enqueue`; `MemoryHttpOutbox` stores the same field and — now
+ that its rows carry a tenant — applies `RedeliverOptions.tenantId` in
+ `redeliver()` with the driver's exact semantics (another organization's row
+ is invisible/`RESOURCE_NOT_FOUND`; an org-less row stays a global row; a
+ tenant-less caller stays unscoped).
+- The flow `http` node (durable mode) threads its run's acting organization
+ (`AutomationContext.tenantId` — the same source as the `notify` node's
+ #11303 repair) and warns loudly when a multi-org run has none to thread.
+- The webhook auto-enqueuer stamps each delivery with its subscription's own
+ organization (`sys_webhook.organization_id`); org-less subscriptions
+ enqueue org-less, unchanged.
+
+Forward-stamping only: existing NULL rows are untouched (their disposition is
+a separate decision). Producers with genuinely no organization — a
+`single`-posture deployment, a stack before its first organization — keep
+working unchanged; their rows land NULL, which is the honest global-row shape.

packages/plugins/plugin-webhooks/src/auto-enqueuer.test.ts

@@ -222,6 +222,48 @@ describe('AutoEnqueuer', () => {
  await ae.stop();
  });
 
+ // [#13546] The delivery row belongs to the SUBSCRIPTION's organization —
+ // `sys_webhook` is organization-scoped (#8554), the enqueuer runs
+ // fire-and-forget off the write path with no request context, so the
+ // subscription row is the one honest tenant source. Without the stamp the
+ // row lands `organization_id = NULL` — the driver's global-row arm — and
+ // the redeliver() cross-organization wall (#10740) excludes nothing.
+ it("stamps the subscription's organization onto the enqueue input (#13546)", async () => {
+ const engine = new FakeEngine({
+ sys_webhook: [webhook({ organization_id: 'org_pin_alpha' })],
+ });
+ const realtime = new FakeRealtime();
+ const { enqueue, calls } = makeRecorder();
+ const ae = new AutoEnqueuer(engine, realtime, enqueue, { refreshIntervalMs: 0 });
+ await ae.start();
+
+ await realtime.publish(event('created', 'contact', { id: 'c-1' }));
+ await flush();
+
+ expect(calls).toHaveLength(1);
+ // Verbatim from the sys_webhook row — threaded, never fabricated.
+ expect(calls[0].organizationId).toBe('org_pin_alpha');
+ await ae.stop();
+ });
+
+ it('an org-less subscription enqueues with NO organization (the honest global-row shape, #13546)', async () => {
+ // The over-denial control: a `single`-posture install has org-less
+ // sys_webhook rows, and their events must still deliver — org-less,
+ // never refused, never stamped with a guess.
+ const engine = new FakeEngine({ sys_webhook: [webhook()] });
+ const realtime = new FakeRealtime();
+ const { enqueue, calls } = makeRecorder();
+ const ae = new AutoEnqueuer(engine, realtime, enqueue, { refreshIntervalMs: 0 });
+ await ae.start();
+
+ await realtime.publish(event('created', 'contact', { id: 'c-1' }));
+ await flush();
+
+ expect(calls).toHaveLength(1);
+ expect(calls[0].organizationId).toBeUndefined();
+ await ae.stop();
+ });
+
  it('[#4626] drops an off-contract data event instead of enqueuing it as "unknown"', async () => {
  // Pre-#4626 the enqueuer read `recordId ?? id ?? after?.id ?? 'unknown'`,
  // so a payload that named no record still produced a delivery whose
@@ -583,6 +625,25 @@ describe('AutoEnqueuer — bulk data events (#4639)', () => {
  await ae.stop();
  });
 
+ it("the bulk path stamps the subscription's organization too (#13546)", async () => {
+ // Same tenant seam as the per-record path — a bulk delivery for an
+ // organization-owned subscription must not land as a global row either.
+ const engine = new FakeEngine({
+ sys_webhook: [webhook({ triggers: 'bulk_update', organization_id: 'org_pin_alpha' })],
+ });
+ const realtime = new FakeRealtime();
+ const { enqueue, calls } = makeRecorder();
+ const ae = new AutoEnqueuer(engine, realtime, enqueue, { refreshIntervalMs: 0 });
+ await ae.start();
+
+ await realtime.publish(bulkEvent('updated', 'contact', 3));
+ await flush();
+
+ expect(calls).toHaveLength(1);
+ expect(calls[0].organizationId).toBe('org_pin_alpha');
+ await ae.stop();
+ });
+
  it('does NOT deliver a bulk event to a per-record update subscriber', async () => {
  // The opt-in half of the decision: an existing `update` webhook keeps
  // receiving only bodies shaped the way it already reads them.

packages/plugins/plugin-webhooks/src/auto-enqueuer.ts

@@ -115,6 +115,21 @@ interface CachedSubscription {
  headers?: Record<string, string>;
  secret?: string;
  timeoutMs?: number;
+ /**
+ * [#13546] The subscription's own organization — `sys_webhook` is
+ * organization-scoped (#8554), so each row carries the tenant that authored
+ * it. Stamped onto every delivery row this subscription produces
+ * (`EnqueueHttpInput.organizationId`), which is what makes the
+ * cross-organization wall on `redeliver()` (#10740) actually exclude other
+ * tenants' rows: a row enqueued without it lands `organization_id = NULL`,
+ * the driver's global-row arm, visible to every organization. There is no
+ * request context to read here — the enqueuer runs fire-and-forget off the
+ * write path — so the subscription row is the one honest source. Absent
+ * when the row itself carries no organization (a `single`-posture install):
+ * the delivery then lands NULL, which is honest for a subscription that
+ * belongs to no organization. Threaded, never fabricated (#11303's rule).
+ */
+ organizationId?: string;
  /**
  * [#8069] Set when a credential this subscription needs could not be
  * recovered. The subscription stays CACHED — that is the change — but every
@@ -783,6 +798,10 @@ export class AutoEnqueuer {
  // from their encrypted columns, NOT read off the row — see #7799
  // (secret) and #7986 (headers).
  timeoutMs: defn.timeoutMs,
+ // [#13546] The tenant column the kernel provisions on sys_webhook.
+ // This cache read is a dispatcher-side unscoped find, so the column
+ // comes back for every organization's rows.
+ organizationId: row.organization_id ? String(row.organization_id) : undefined,
  };
  }
 
@@ -867,6 +886,12 @@ export class AutoEnqueuer {
  // subscription, so the delivery path is byte-identical to before.
  undeliverableReason: sub.parkedReason,
  timeoutMs: sub.timeoutMs,
+ // [#13546] The delivery row belongs to the SUBSCRIPTION's
+ // organization — the one honest tenant in scope on this
+ // fire-and-forget path (no request context exists here).
+ // Absent for an org-less subscription; the row then lands
+ // NULL, the global-row shape.
+ organizationId: sub.organizationId,
  // [#3946] Envelope keys are written LAST so the event payload
  // cannot rewrite them. Behaviour-neutral for the engine's own
  // publishers — since #4626 a `data.record.*` payload is a
@@ -960,6 +985,9 @@ export class AutoEnqueuer {
  // an undeliverable row instead of enqueuing a delivery.
  undeliverableReason: sub.parkedReason,
  timeoutMs: sub.timeoutMs,
+ // [#13546] See the per-record path — the subscription's own
+ // organization, absent for an org-less subscription.
+ organizationId: sub.organizationId,
  // [#3946] Envelope keys last so the payload cannot rewrite them.
  payload: {
  ...payload,

packages/services/service-automation/src/builtin/http-nodes.test.ts

@@ -110,6 +110,78 @@ describe('http (canonical node)', () => {
  expect(result.success).toBe(true);
  expect(fetchMock).toHaveBeenCalledOnce();
  });
+
+ // [#13546] The producer pin: `sys_http_delivery` rows must carry the
+ // organization of the run that caused them, or they land in the
+ // driver's `organization_id IS NULL` global-row arm — visible to and
+ // replayable by every organization through redeliver() (#10740). The
+ // organization is THREADED from the run's own acting context
+ // (`AutomationContext.tenantId`) — the same source, and the same
+ // no-fallback rule, as the notify node's #11303 repair.
+ it("threads the run's acting organization onto the enqueue input (#13546)", async () => {
+ const enqueued: any[] = [];
+ const messaging: HttpSurface = {
+ isHttpDeliveryReady: () => true,
+ async enqueueHttp(input) {
+ enqueued.push(input);
+ return 'dlv_1';
+ },
+ };
+ const engine = new AutomationEngine(createTestLogger());
+ registerHttpNodes(engine, createCtx(messaging));
+ engine.registerFlow(
+ 'http_flow',
+ httpFlow('http', { url: 'https://example.test/hook', durable: true }),
+ );
+
+ const result = await engine.execute('http_flow', { tenantId: 'org_pin_alpha' } as any);
+
+ expect(result.success).toBe(true);
+ expect(enqueued).toHaveLength(1);
+ // Verbatim — the acting tenant, not a derived or defaulted value.
+ expect(enqueued[0].organizationId).toBe('org_pin_alpha');
+ });
+
+ it('with NO organization in scope: still enqueues, passes NO organizationId key, and says so out loud (#13546)', async () => {
+ // The over-denial control (the notify suite's PIN C shape): a
+ // `single`-posture install and a stack before its first
+ // organization legitimately have no tenant to thread, and a
+ // durable callout there must still enqueue — org-less, loudly,
+ // never refused and never guessed.
+ const warnings: string[] = [];
+ const logger: any = {
+ info: () => {}, error: () => {}, debug: () => {},
+ warn: (...args: unknown[]) => { warnings.push(args.map(String).join(' ')); },
+ };
+ logger.child = () => logger;
+ const enqueued: any[] = [];
+ const messaging: HttpSurface = {
+ isHttpDeliveryReady: () => true,
+ async enqueueHttp(input) {
+ enqueued.push(input);
+ return 'dlv_1';
+ },
+ };
+ const engine = new AutomationEngine(logger);
+ registerHttpNodes(engine, {
+ logger,
+ getService: (name: string) => (name === 'messaging' ? messaging : undefined),
+ } as any);
+ engine.registerFlow(
+ 'http_flow',
+ httpFlow('http', { url: 'https://example.test/hook', durable: true }),
+ );
+
+ const result = await engine.execute('http_flow');
+
+ expect(result.success).toBe(true);
+ expect(enqueued).toHaveLength(1);
+ // Absent, not null and not '' — the outbox normalizes a missing
+ // value to NULL exactly once, at its insert.
+ expect('organizationId' in enqueued[0]).toBe(false);
+ // Fail-LOUD: the org-less durable callout is a visible event.
+ expect(warnings.some((w) => w.includes('organization_id = NULL'))).toBe(true);
+ });
  });
 
  describe('request/response mode (default)', () => {

packages/services/service-automation/src/builtin/http-nodes.ts

@@ -48,6 +48,11 @@ interface MessagingHttpSurface {
  signingSecret?: string;
  timeoutMs?: number;
  payload: unknown;
+ /**
+ * [#13546] Organization the delivery row belongs to — the tenant
+ * column the `redeliver()` cross-organization wall scopes by (#10740).
+ */
+ organizationId?: string;
  }): Promise<string>;
 }
 
@@ -121,6 +126,38 @@ export function registerHttpNodes(engine: AutomationEngine, ctx: PluginContext):
  if (durable) {
  const messaging = getMessaging();
  if (messaging?.isHttpDeliveryReady?.() && messaging.enqueueHttp) {
+ // [#13546] The organization this delivery belongs to,
+ // THREADED from the run's own acting context — never
+ // fabricated. Same source and same no-fallback rule as the
+ // `notify` node's #11303 repair one file over:
+ // `AutomationContext.tenantId` is the acting run's
+ // organization, and a wrong value is worse than a null (a
+ // null is visibly missing; a wrong one is silently
+ // authoritative). Without it the sys_http_delivery row
+ // lands `organization_id = NULL` — the driver's global-row
+ // arm — visible to and replayable by EVERY organization
+ // through the redeliver() door (#10740).
+ const organizationId =
+ typeof context.tenantId === 'string' && context.tenantId !== ''
+ ? context.tenantId
+ : undefined;
+ if (!organizationId) {
+ // Fail-LOUD, not fail-guess, not fail-closed (#11303's
+ // triage): a `single`-posture install and a stack before
+ // its first organization legitimately have none, and a
+ // durable callout there must still enqueue.
+ // (Issue anchor lives in these comments, not in the
+ // runtime string — operators cannot resolve a tracker
+ // id; see check:doc-authoring.)
+ ctx.logger.warn(
+ `[http] node '${node.id}': no organization in scope for this durable callout — its ` +
+ `sys_http_delivery row will carry organization_id = NULL, which is a global row ` +
+ `every organization's redeliver door can reach on a walled deployment. ` +
+ `On a multi-organization install the triggering context lost its tenant: give the ` +
+ `flow's trigger an acting organization (AutomationContext.tenantId). On a ` +
+ `single-organization install this is expected and can be ignored.`,
+ );
+ }
  try {
  const deliveryId = await messaging.enqueueHttp({
  source: 'flow',
@@ -133,6 +170,10 @@ export function registerHttpNodes(engine: AutomationEngine, ctx: PluginContext):
  signingSecret,
  timeoutMs,
  payload: body ?? {},
+ // [#13546] Absent (not null) when the run has no
+ // organization; the outbox normalizes a missing
+ // value to NULL exactly once, at the insert.
+ ...(organizationId ? { organizationId } : {}),
  });
  // #4354 — the outbox row IS a durable effect this run
  // caused, but it is NOT a countable one (#7882). What

.changeset/http-outbox-organization-stamp.md

@@ -0,0 +1,39 @@
+---
+"@objectstack/service-messaging": minor
+"@objectstack/service-automation": patch
+"@objectstack/plugin-webhooks": patch
+---
+
+fix(service-messaging,service-automation,plugin-webhooks): stamp `organization_id` on `sys_http_delivery` rows so the cross-organization wall on `redeliver()` actually excludes other tenants' rows (#13546)
+
+`sys_http_delivery` is tenant-scoped and `redeliver()` — the one
+request-reachable door on it — deliberately scopes by the caller's
+organization (#10740). But the enqueue door never stamped the
+`organization_id` column, and the SQL driver's tenant term is
+`(organization_id = :tenantId OR organization_id IS NULL)` — a deliberate
+global-row fail-open — so 100% of delivery rows landed in the NULL arm:
+visible to, and replayable by, every organization on a walled deployment.
+
+The repair mirrors the notification outbox's existing convention
+(`EnqueueDeliveryInput.organizationId`), end to end:
+
+- `EnqueueHttpInput` gains an **optional** `organizationId` member (inherited
+ by `UndeliverableHttpInput`, so parked rows are tenant-stamped too), and
+ `HttpDelivery` surfaces it on read-back. `SqlHttpOutbox.insert` writes
+ `organization_id: input.organizationId ?? null` exactly like
+ `SqlOutbox.enqueue`; `MemoryHttpOutbox` stores the same field and — now
+ that its rows carry a tenant — applies `RedeliverOptions.tenantId` in
+ `redeliver()` with the driver's exact semantics (another organization's row
+ is invisible/`RESOURCE_NOT_FOUND`; an org-less row stays a global row; a
+ tenant-less caller stays unscoped).
+- The flow `http` node (durable mode) threads its run's acting organization
+ (`AutomationContext.tenantId` — the same source as the `notify` node's
+ #11303 repair) and warns loudly when a multi-org run has none to thread.
+- The webhook auto-enqueuer stamps each delivery with its subscription's own
+ organization (`sys_webhook.organization_id`); org-less subscriptions
+ enqueue org-less, unchanged.
+
+Forward-stamping only: existing NULL rows are untouched (their disposition is
+a separate decision). Producers with genuinely no organization — a
+`single`-posture deployment, a stack before its first organization — keep
+working unchanged; their rows land NULL, which is the honest global-row shape.

packages/plugins/plugin-webhooks/src/auto-enqueuer.test.ts

@@ -222,6 +222,48 @@ describe('AutoEnqueuer', () => {
  await ae.stop();
  });
 
+ // [#13546] The delivery row belongs to the SUBSCRIPTION's organization —
+ // `sys_webhook` is organization-scoped (#8554), the enqueuer runs
+ // fire-and-forget off the write path with no request context, so the
+ // subscription row is the one honest tenant source. Without the stamp the
+ // row lands `organization_id = NULL` — the driver's global-row arm — and
+ // the redeliver() cross-organization wall (#10740) excludes nothing.
+ it("stamps the subscription's organization onto the enqueue input (#13546)", async () => {
+ const engine = new FakeEngine({
+ sys_webhook: [webhook({ organization_id: 'org_pin_alpha' })],
+ });
+ const realtime = new FakeRealtime();
+ const { enqueue, calls } = makeRecorder();
+ const ae = new AutoEnqueuer(engine, realtime, enqueue, { refreshIntervalMs: 0 });
+ await ae.start();
+
+ await realtime.publish(event('created', 'contact', { id: 'c-1' }));
+ await flush();
+
+ expect(calls).toHaveLength(1);
+ // Verbatim from the sys_webhook row — threaded, never fabricated.
+ expect(calls[0].organizationId).toBe('org_pin_alpha');
+ await ae.stop();
+ });
+
+ it('an org-less subscription enqueues with NO organization (the honest global-row shape, #13546)', async () => {
+ // The over-denial control: a `single`-posture install has org-less
+ // sys_webhook rows, and their events must still deliver — org-less,
+ // never refused, never stamped with a guess.
+ const engine = new FakeEngine({ sys_webhook: [webhook()] });
+ const realtime = new FakeRealtime();
+ const { enqueue, calls } = makeRecorder();
+ const ae = new AutoEnqueuer(engine, realtime, enqueue, { refreshIntervalMs: 0 });
+ await ae.start();
+
+ await realtime.publish(event('created', 'contact', { id: 'c-1' }));
+ await flush();
+
+ expect(calls).toHaveLength(1);
+ expect(calls[0].organizationId).toBeUndefined();
+ await ae.stop();
+ });
+
  it('[#4626] drops an off-contract data event instead of enqueuing it as "unknown"', async () => {
  // Pre-#4626 the enqueuer read `recordId ?? id ?? after?.id ?? 'unknown'`,
  // so a payload that named no record still produced a delivery whose
@@ -583,6 +625,25 @@ describe('AutoEnqueuer — bulk data events (#4639)', () => {
  await ae.stop();
  });
 
+ it("the bulk path stamps the subscription's organization too (#13546)", async () => {
+ // Same tenant seam as the per-record path — a bulk delivery for an
+ // organization-owned subscription must not land as a global row either.
+ const engine = new FakeEngine({
+ sys_webhook: [webhook({ triggers: 'bulk_update', organization_id: 'org_pin_alpha' })],
+ });
+ const realtime = new FakeRealtime();
+ const { enqueue, calls } = makeRecorder();
+ const ae = new AutoEnqueuer(engine, realtime, enqueue, { refreshIntervalMs: 0 });
+ await ae.start();
+
+ await realtime.publish(bulkEvent('updated', 'contact', 3));
+ await flush();
+
+ expect(calls).toHaveLength(1);
+ expect(calls[0].organizationId).toBe('org_pin_alpha');
+ await ae.stop();
+ });
+
  it('does NOT deliver a bulk event to a per-record update subscriber', async () => {
  // The opt-in half of the decision: an existing `update` webhook keeps
  // receiving only bodies shaped the way it already reads them.

packages/plugins/plugin-webhooks/src/auto-enqueuer.ts

@@ -115,6 +115,21 @@ interface CachedSubscription {
  headers?: Record<string, string>;
  secret?: string;
  timeoutMs?: number;
+ /**
+ * [#13546] The subscription's own organization — `sys_webhook` is
+ * organization-scoped (#8554), so each row carries the tenant that authored
+ * it. Stamped onto every delivery row this subscription produces
+ * (`EnqueueHttpInput.organizationId`), which is what makes the
+ * cross-organization wall on `redeliver()` (#10740) actually exclude other
+ * tenants' rows: a row enqueued without it lands `organization_id = NULL`,
+ * the driver's global-row arm, visible to every organization. There is no
+ * request context to read here — the enqueuer runs fire-and-forget off the
+ * write path — so the subscription row is the one honest source. Absent
+ * when the row itself carries no organization (a `single`-posture install):
+ * the delivery then lands NULL, which is honest for a subscription that
+ * belongs to no organization. Threaded, never fabricated (#11303's rule).
+ */
+ organizationId?: string;
  /**
  * [#8069] Set when a credential this subscription needs could not be
  * recovered. The subscription stays CACHED — that is the change — but every
@@ -783,6 +798,10 @@ export class AutoEnqueuer {
  // from their encrypted columns, NOT read off the row — see #7799
  // (secret) and #7986 (headers).
  timeoutMs: defn.timeoutMs,
+ // [#13546] The tenant column the kernel provisions on sys_webhook.
+ // This cache read is a dispatcher-side unscoped find, so the column
+ // comes back for every organization's rows.
+ organizationId: row.organization_id ? String(row.organization_id) : undefined,
  };
  }
 
@@ -867,6 +886,12 @@ export class AutoEnqueuer {
  // subscription, so the delivery path is byte-identical to before.
  undeliverableReason: sub.parkedReason,
  timeoutMs: sub.timeoutMs,
+ // [#13546] The delivery row belongs to the SUBSCRIPTION's
+ // organization — the one honest tenant in scope on this
+ // fire-and-forget path (no request context exists here).
+ // Absent for an org-less subscription; the row then lands
+ // NULL, the global-row shape.
+ organizationId: sub.organizationId,
  // [#3946] Envelope keys are written LAST so the event payload
  // cannot rewrite them. Behaviour-neutral for the engine's own
  // publishers — since #4626 a `data.record.*` payload is a
@@ -960,6 +985,9 @@ export class AutoEnqueuer {
  // an undeliverable row instead of enqueuing a delivery.
  undeliverableReason: sub.parkedReason,
  timeoutMs: sub.timeoutMs,
+ // [#13546] See the per-record path — the subscription's own
+ // organization, absent for an org-less subscription.
+ organizationId: sub.organizationId,
  // [#3946] Envelope keys last so the payload cannot rewrite them.
  payload: {
  ...payload,

packages/services/service-automation/src/builtin/http-nodes.test.ts

@@ -110,6 +110,78 @@ describe('http (canonical node)', () => {
  expect(result.success).toBe(true);
  expect(fetchMock).toHaveBeenCalledOnce();
  });
+
+ // [#13546] The producer pin: `sys_http_delivery` rows must carry the
+ // organization of the run that caused them, or they land in the
+ // driver's `organization_id IS NULL` global-row arm — visible to and
+ // replayable by every organization through redeliver() (#10740). The
+ // organization is THREADED from the run's own acting context
+ // (`AutomationContext.tenantId`) — the same source, and the same
+ // no-fallback rule, as the notify node's #11303 repair.
+ it("threads the run's acting organization onto the enqueue input (#13546)", async () => {
+ const enqueued: any[] = [];
+ const messaging: HttpSurface = {
+ isHttpDeliveryReady: () => true,
+ async enqueueHttp(input) {
+ enqueued.push(input);
+ return 'dlv_1';
+ },
+ };
+ const engine = new AutomationEngine(createTestLogger());
+ registerHttpNodes(engine, createCtx(messaging));
+ engine.registerFlow(
+ 'http_flow',
+ httpFlow('http', { url: 'https://example.test/hook', durable: true }),
+ );
+
+ const result = await engine.execute('http_flow', { tenantId: 'org_pin_alpha' } as any);
+
+ expect(result.success).toBe(true);
+ expect(enqueued).toHaveLength(1);
+ // Verbatim — the acting tenant, not a derived or defaulted value.
+ expect(enqueued[0].organizationId).toBe('org_pin_alpha');
+ });
+
+ it('with NO organization in scope: still enqueues, passes NO organizationId key, and says so out loud (#13546)', async () => {
+ // The over-denial control (the notify suite's PIN C shape): a
+ // `single`-posture install and a stack before its first
+ // organization legitimately have no tenant to thread, and a
+ // durable callout there must still enqueue — org-less, loudly,
+ // never refused and never guessed.
+ const warnings: string[] = [];
+ const logger: any = {
+ info: () => {}, error: () => {}, debug: () => {},
+ warn: (...args: unknown[]) => { warnings.push(args.map(String).join(' ')); },
+ };
+ logger.child = () => logger;
+ const enqueued: any[] = [];
+ const messaging: HttpSurface = {
+ isHttpDeliveryReady: () => true,
+ async enqueueHttp(input) {
+ enqueued.push(input);
+ return 'dlv_1';
+ },
+ };
+ const engine = new AutomationEngine(logger);
+ registerHttpNodes(engine, {
+ logger,
+ getService: (name: string) => (name === 'messaging' ? messaging : undefined),
+ } as any);
+ engine.registerFlow(
+ 'http_flow',
+ httpFlow('http', { url: 'https://example.test/hook', durable: true }),
+ );
+
+ const result = await engine.execute('http_flow');
+
+ expect(result.success).toBe(true);
+ expect(enqueued).toHaveLength(1);
+ // Absent, not null and not '' — the outbox normalizes a missing
+ // value to NULL exactly once, at its insert.
+ expect('organizationId' in enqueued[0]).toBe(false);
+ // Fail-LOUD: the org-less durable callout is a visible event.
+ expect(warnings.some((w) => w.includes('organization_id = NULL'))).toBe(true);
+ });
  });
 
  describe('request/response mode (default)', () => {

packages/services/service-automation/src/builtin/http-nodes.ts

@@ -48,6 +48,11 @@ interface MessagingHttpSurface {
  signingSecret?: string;
  timeoutMs?: number;
  payload: unknown;
+ /**
+ * [#13546] Organization the delivery row belongs to — the tenant
+ * column the `redeliver()` cross-organization wall scopes by (#10740).
+ */
+ organizationId?: string;
  }): Promise<string>;
 }
 
@@ -121,6 +126,38 @@ export function registerHttpNodes(engine: AutomationEngine, ctx: PluginContext):
  if (durable) {
  const messaging = getMessaging();
  if (messaging?.isHttpDeliveryReady?.() && messaging.enqueueHttp) {
+ // [#13546] The organization this delivery belongs to,
+ // THREADED from the run's own acting context — never
+ // fabricated. Same source and same no-fallback rule as the
+ // `notify` node's #11303 repair one file over:
+ // `AutomationContext.tenantId` is the acting run's
+ // organization, and a wrong value is worse than a null (a
+ // null is visibly missing; a wrong one is silently
+ // authoritative). Without it the sys_http_delivery row
+ // lands `organization_id = NULL` — the driver's global-row
+ // arm — visible to and replayable by EVERY organization
+ // through the redeliver() door (#10740).
+ const organizationId =
+ typeof context.tenantId === 'string' && context.tenantId !== ''
+ ? context.tenantId
+ : undefined;
+ if (!organizationId) {
+ // Fail-LOUD, not fail-guess, not fail-closed (#11303's
+ // triage): a `single`-posture install and a stack before
+ // its first organization legitimately have none, and a
+ // durable callout there must still enqueue.
+ // (Issue anchor lives in these comments, not in the
+ // runtime string — operators cannot resolve a tracker
+ // id; see check:doc-authoring.)
+ ctx.logger.warn(
+ `[http] node '${node.id}': no organization in scope for this durable callout — its ` +
+ `sys_http_delivery row will carry organization_id = NULL, which is a global row ` +
+ `every organization's redeliver door can reach on a walled deployment. ` +
+ `On a multi-organization install the triggering context lost its tenant: give the ` +
+ `flow's trigger an acting organization (AutomationContext.tenantId). On a ` +
+ `single-organization install this is expected and can be ignored.`,
+ );
+ }
  try {
  const deliveryId = await messaging.enqueueHttp({
  source: 'flow',
@@ -133,6 +170,10 @@ export function registerHttpNodes(engine: AutomationEngine, ctx: PluginContext):
  signingSecret,
  timeoutMs,
  payload: body ?? {},
+ // [#13546] Absent (not null) when the run has no
+ // organization; the outbox normalizes a missing
+ // value to NULL exactly once, at the insert.
+ ...(organizationId ? { organizationId } : {}),
  });
  // #4354 — the outbox row IS a durable effect this run
  // caused, but it is NOT a countable one (#7882). What

.changeset/http-outbox-organization-stamp.md

@@ -0,0 +1,39 @@
+---
+"@objectstack/service-messaging": minor
+"@objectstack/service-automation": patch
+"@objectstack/plugin-webhooks": patch
+---
+
+fix(service-messaging,service-automation,plugin-webhooks): stamp `organization_id` on `sys_http_delivery` rows so the cross-organization wall on `redeliver()` actually excludes other tenants' rows (#13546)
+
+`sys_http_delivery` is tenant-scoped and `redeliver()` — the one
+request-reachable door on it — deliberately scopes by the caller's
+organization (#10740). But the enqueue door never stamped the
+`organization_id` column, and the SQL driver's tenant term is
+`(organization_id = :tenantId OR organization_id IS NULL)` — a deliberate
+global-row fail-open — so 100% of delivery rows landed in the NULL arm:
+visible to, and replayable by, every organization on a walled deployment.
+
+The repair mirrors the notification outbox's existing convention
+(`EnqueueDeliveryInput.organizationId`), end to end:
+
+- `EnqueueHttpInput` gains an **optional** `organizationId` member (inherited
+ by `UndeliverableHttpInput`, so parked rows are tenant-stamped too), and
+ `HttpDelivery` surfaces it on read-back. `SqlHttpOutbox.insert` writes
+ `organization_id: input.organizationId ?? null` exactly like
+ `SqlOutbox.enqueue`; `MemoryHttpOutbox` stores the same field and — now
+ that its rows carry a tenant — applies `RedeliverOptions.tenantId` in
+ `redeliver()` with the driver's exact semantics (another organization's row
+ is invisible/`RESOURCE_NOT_FOUND`; an org-less row stays a global row; a
+ tenant-less caller stays unscoped).
+- The flow `http` node (durable mode) threads its run's acting organization
+ (`AutomationContext.tenantId` — the same source as the `notify` node's
+ #11303 repair) and warns loudly when a multi-org run has none to thread.
+- The webhook auto-enqueuer stamps each delivery with its subscription's own
+ organization (`sys_webhook.organization_id`); org-less subscriptions
+ enqueue org-less, unchanged.
+
+Forward-stamping only: existing NULL rows are untouched (their disposition is
+a separate decision). Producers with genuinely no organization — a
+`single`-posture deployment, a stack before its first organization — keep
+working unchanged; their rows land NULL, which is the honest global-row shape.

packages/plugins/plugin-webhooks/src/auto-enqueuer.test.ts

@@ -222,6 +222,48 @@ describe('AutoEnqueuer', () => {
  await ae.stop();
  });
 
+ // [#13546] The delivery row belongs to the SUBSCRIPTION's organization —
+ // `sys_webhook` is organization-scoped (#8554), the enqueuer runs
+ // fire-and-forget off the write path with no request context, so the
+ // subscription row is the one honest tenant source. Without the stamp the
+ // row lands `organization_id = NULL` — the driver's global-row arm — and
+ // the redeliver() cross-organization wall (#10740) excludes nothing.
+ it("stamps the subscription's organization onto the enqueue input (#13546)", async () => {
+ const engine = new FakeEngine({
+ sys_webhook: [webhook({ organization_id: 'org_pin_alpha' })],
+ });
+ const realtime = new FakeRealtime();
+ const { enqueue, calls } = makeRecorder();
+ const ae = new AutoEnqueuer(engine, realtime, enqueue, { refreshIntervalMs: 0 });
+ await ae.start();
+
+ await realtime.publish(event('created', 'contact', { id: 'c-1' }));
+ await flush();
+
+ expect(calls).toHaveLength(1);
+ // Verbatim from the sys_webhook row — threaded, never fabricated.
+ expect(calls[0].organizationId).toBe('org_pin_alpha');
+ await ae.stop();
+ });
+
+ it('an org-less subscription enqueues with NO organization (the honest global-row shape, #13546)', async () => {
+ // The over-denial control: a `single`-posture install has org-less
+ // sys_webhook rows, and their events must still deliver — org-less,
+ // never refused, never stamped with a guess.
+ const engine = new FakeEngine({ sys_webhook: [webhook()] });
+ const realtime = new FakeRealtime();
+ const { enqueue, calls } = makeRecorder();
+ const ae = new AutoEnqueuer(engine, realtime, enqueue, { refreshIntervalMs: 0 });
+ await ae.start();
+
+ await realtime.publish(event('created', 'contact', { id: 'c-1' }));
+ await flush();
+
+ expect(calls).toHaveLength(1);
+ expect(calls[0].organizationId).toBeUndefined();
+ await ae.stop();
+ });
+
  it('[#4626] drops an off-contract data event instead of enqueuing it as "unknown"', async () => {
  // Pre-#4626 the enqueuer read `recordId ?? id ?? after?.id ?? 'unknown'`,
  // so a payload that named no record still produced a delivery whose
@@ -583,6 +625,25 @@ describe('AutoEnqueuer — bulk data events (#4639)', () => {
  await ae.stop();
  });
 
+ it("the bulk path stamps the subscription's organization too (#13546)", async () => {
+ // Same tenant seam as the per-record path — a bulk delivery for an
+ // organization-owned subscription must not land as a global row either.
+ const engine = new FakeEngine({
+ sys_webhook: [webhook({ triggers: 'bulk_update', organization_id: 'org_pin_alpha' })],
+ });
+ const realtime = new FakeRealtime();
+ const { enqueue, calls } = makeRecorder();
+ const ae = new AutoEnqueuer(engine, realtime, enqueue, { refreshIntervalMs: 0 });
+ await ae.start();
+
+ await realtime.publish(bulkEvent('updated', 'contact', 3));
+ await flush();
+
+ expect(calls).toHaveLength(1);
+ expect(calls[0].organizationId).toBe('org_pin_alpha');
+ await ae.stop();
+ });
+
  it('does NOT deliver a bulk event to a per-record update subscriber', async () => {
  // The opt-in half of the decision: an existing `update` webhook keeps
  // receiving only bodies shaped the way it already reads them.

packages/plugins/plugin-webhooks/src/auto-enqueuer.ts

@@ -115,6 +115,21 @@ interface CachedSubscription {
  headers?: Record<string, string>;
  secret?: string;
  timeoutMs?: number;
+ /**
+ * [#13546] The subscription's own organization — `sys_webhook` is
+ * organization-scoped (#8554), so each row carries the tenant that authored
+ * it. Stamped onto every delivery row this subscription produces
+ * (`EnqueueHttpInput.organizationId`), which is what makes the
+ * cross-organization wall on `redeliver()` (#10740) actually exclude other
+ * tenants' rows: a row enqueued without it lands `organization_id = NULL`,
+ * the driver's global-row arm, visible to every organization. There is no
+ * request context to read here — the enqueuer runs fire-and-forget off the
+ * write path — so the subscription row is the one honest source. Absent
+ * when the row itself carries no organization (a `single`-posture install):
+ * the delivery then lands NULL, which is honest for a subscription that
+ * belongs to no organization. Threaded, never fabricated (#11303's rule).
+ */
+ organizationId?: string;
  /**
  * [#8069] Set when a credential this subscription needs could not be
  * recovered. The subscription stays CACHED — that is the change — but every
@@ -783,6 +798,10 @@ export class AutoEnqueuer {
  // from their encrypted columns, NOT read off the row — see #7799
  // (secret) and #7986 (headers).
  timeoutMs: defn.timeoutMs,
+ // [#13546] The tenant column the kernel provisions on sys_webhook.
+ // This cache read is a dispatcher-side unscoped find, so the column
+ // comes back for every organization's rows.
+ organizationId: row.organization_id ? String(row.organization_id) : undefined,
  };
  }
 
@@ -867,6 +886,12 @@ export class AutoEnqueuer {
  // subscription, so the delivery path is byte-identical to before.
  undeliverableReason: sub.parkedReason,
  timeoutMs: sub.timeoutMs,
+ // [#13546] The delivery row belongs to the SUBSCRIPTION's
+ // organization — the one honest tenant in scope on this
+ // fire-and-forget path (no request context exists here).
+ // Absent for an org-less subscription; the row then lands
+ // NULL, the global-row shape.
+ organizationId: sub.organizationId,
  // [#3946] Envelope keys are written LAST so the event payload
  // cannot rewrite them. Behaviour-neutral for the engine's own
  // publishers — since #4626 a `data.record.*` payload is a
@@ -960,6 +985,9 @@ export class AutoEnqueuer {
  // an undeliverable row instead of enqueuing a delivery.
  undeliverableReason: sub.parkedReason,
  timeoutMs: sub.timeoutMs,
+ // [#13546] See the per-record path — the subscription's own
+ // organization, absent for an org-less subscription.
+ organizationId: sub.organizationId,
  // [#3946] Envelope keys last so the payload cannot rewrite them.
  payload: {
  ...payload,

packages/services/service-automation/src/builtin/http-nodes.test.ts

@@ -110,6 +110,78 @@ describe('http (canonical node)', () => {
  expect(result.success).toBe(true);
  expect(fetchMock).toHaveBeenCalledOnce();
  });
+
+ // [#13546] The producer pin: `sys_http_delivery` rows must carry the
+ // organization of the run that caused them, or they land in the
+ // driver's `organization_id IS NULL` global-row arm — visible to and
+ // replayable by every organization through redeliver() (#10740). The
+ // organization is THREADED from the run's own acting context
+ // (`AutomationContext.tenantId`) — the same source, and the same
+ // no-fallback rule, as the notify node's #11303 repair.
+ it("threads the run's acting organization onto the enqueue input (#13546)", async () => {
+ const enqueued: any[] = [];
+ const messaging: HttpSurface = {
+ isHttpDeliveryReady: () => true,
+ async enqueueHttp(input) {
+ enqueued.push(input);
+ return 'dlv_1';
+ },
+ };
+ const engine = new AutomationEngine(createTestLogger());
+ registerHttpNodes(engine, createCtx(messaging));
+ engine.registerFlow(
+ 'http_flow',
+ httpFlow('http', { url: 'https://example.test/hook', durable: true }),
+ );
+
+ const result = await engine.execute('http_flow', { tenantId: 'org_pin_alpha' } as any);
+
+ expect(result.success).toBe(true);
+ expect(enqueued).toHaveLength(1);
+ // Verbatim — the acting tenant, not a derived or defaulted value.
+ expect(enqueued[0].organizationId).toBe('org_pin_alpha');
+ });
+
+ it('with NO organization in scope: still enqueues, passes NO organizationId key, and says so out loud (#13546)', async () => {
+ // The over-denial control (the notify suite's PIN C shape): a
+ // `single`-posture install and a stack before its first
+ // organization legitimately have no tenant to thread, and a
+ // durable callout there must still enqueue — org-less, loudly,
+ // never refused and never guessed.
+ const warnings: string[] = [];
+ const logger: any = {
+ info: () => {}, error: () => {}, debug: () => {},
+ warn: (...args: unknown[]) => { warnings.push(args.map(String).join(' ')); },
+ };
+ logger.child = () => logger;
+ const enqueued: any[] = [];
+ const messaging: HttpSurface = {
+ isHttpDeliveryReady: () => true,
+ async enqueueHttp(input) {
+ enqueued.push(input);
+ return 'dlv_1';
+ },
+ };
+ const engine = new AutomationEngine(logger);
+ registerHttpNodes(engine, {
+ logger,
+ getService: (name: string) => (name === 'messaging' ? messaging : undefined),
+ } as any);
+ engine.registerFlow(
+ 'http_flow',
+ httpFlow('http', { url: 'https://example.test/hook', durable: true }),
+ );
+
+ const result = await engine.execute('http_flow');
+
+ expect(result.success).toBe(true);
+ expect(enqueued).toHaveLength(1);
+ // Absent, not null and not '' — the outbox normalizes a missing
+ // value to NULL exactly once, at its insert.
+ expect('organizationId' in enqueued[0]).toBe(false);
+ // Fail-LOUD: the org-less durable callout is a visible event.
+ expect(warnings.some((w) => w.includes('organization_id = NULL'))).toBe(true);
+ });
  });
 
  describe('request/response mode (default)', () => {

packages/services/service-automation/src/builtin/http-nodes.ts

@@ -48,6 +48,11 @@ interface MessagingHttpSurface {
  signingSecret?: string;
  timeoutMs?: number;
  payload: unknown;
+ /**
+ * [#13546] Organization the delivery row belongs to — the tenant
+ * column the `redeliver()` cross-organization wall scopes by (#10740).
+ */
+ organizationId?: string;
  }): Promise<string>;
 }
 
@@ -121,6 +126,38 @@ export function registerHttpNodes(engine: AutomationEngine, ctx: PluginContext):
  if (durable) {
  const messaging = getMessaging();
  if (messaging?.isHttpDeliveryReady?.() && messaging.enqueueHttp) {
+ // [#13546] The organization this delivery belongs to,
+ // THREADED from the run's own acting context — never
+ // fabricated. Same source and same no-fallback rule as the
+ // `notify` node's #11303 repair one file over:
+ // `AutomationContext.tenantId` is the acting run's
+ // organization, and a wrong value is worse than a null (a
+ // null is visibly missing; a wrong one is silently
+ // authoritative). Without it the sys_http_delivery row
+ // lands `organization_id = NULL` — the driver's global-row
+ // arm — visible to and replayable by EVERY organization
+ // through the redeliver() door (#10740).
+ const organizationId =
+ typeof context.tenantId === 'string' && context.tenantId !== ''
+ ? context.tenantId
+ : undefined;
+ if (!organizationId) {
+ // Fail-LOUD, not fail-guess, not fail-closed (#11303's
+ // triage): a `single`-posture install and a stack before
+ // its first organization legitimately have none, and a
+ // durable callout there must still enqueue.
+ // (Issue anchor lives in these comments, not in the
+ // runtime string — operators cannot resolve a tracker
+ // id; see check:doc-authoring.)
+ ctx.logger.warn(
+ `[http] node '${node.id}': no organization in scope for this durable callout — its ` +
+ `sys_http_delivery row will carry organization_id = NULL, which is a global row ` +
+ `every organization's redeliver door can reach on a walled deployment. ` +
+ `On a multi-organization install the triggering context lost its tenant: give the ` +
+ `flow's trigger an acting organization (AutomationContext.tenantId). On a ` +
+ `single-organization install this is expected and can be ignored.`,
+ );
+ }
  try {
  const deliveryId = await messaging.enqueueHttp({
  source: 'flow',
@@ -133,6 +170,10 @@ export function registerHttpNodes(engine: AutomationEngine, ctx: PluginContext):
  signingSecret,
  timeoutMs,
  payload: body ?? {},
+ // [#13546] Absent (not null) when the run has no
+ // organization; the outbox normalizes a missing
+ // value to NULL exactly once, at the insert.
+ ...(organizationId ? { organizationId } : {}),
  });
  // #4354 — the outbox row IS a durable effect this run
  // caused, but it is NOT a countable one (#7882). What

.changeset/http-outbox-organization-stamp.md

@@ -0,0 +1,39 @@
+---
+"@objectstack/service-messaging": minor
+"@objectstack/service-automation": patch
+"@objectstack/plugin-webhooks": patch
+---
+
+fix(service-messaging,service-automation,plugin-webhooks): stamp `organization_id` on `sys_http_delivery` rows so the cross-organization wall on `redeliver()` actually excludes other tenants' rows (#13546)
+
+`sys_http_delivery` is tenant-scoped and `redeliver()` — the one
+request-reachable door on it — deliberately scopes by the caller's
+organization (#10740). But the enqueue door never stamped the
+`organization_id` column, and the SQL driver's tenant term is
+`(organization_id = :tenantId OR organization_id IS NULL)` — a deliberate
+global-row fail-open — so 100% of delivery rows landed in the NULL arm:
+visible to, and replayable by, every organization on a walled deployment.
+
+The repair mirrors the notification outbox's existing convention
+(`EnqueueDeliveryInput.organizationId`), end to end:
+
+- `EnqueueHttpInput` gains an **optional** `organizationId` member (inherited
+ by `UndeliverableHttpInput`, so parked rows are tenant-stamped too), and
+ `HttpDelivery` surfaces it on read-back. `SqlHttpOutbox.insert` writes
+ `organization_id: input.organizationId ?? null` exactly like
+ `SqlOutbox.enqueue`; `MemoryHttpOutbox` stores the same field and — now
+ that its rows carry a tenant — applies `RedeliverOptions.tenantId` in
+ `redeliver()` with the driver's exact semantics (another organization's row
+ is invisible/`RESOURCE_NOT_FOUND`; an org-less row stays a global row; a
+ tenant-less caller stays unscoped).
+- The flow `http` node (durable mode) threads its run's acting organization
+ (`AutomationContext.tenantId` — the same source as the `notify` node's
+ #11303 repair) and warns loudly when a multi-org run has none to thread.
+- The webhook auto-enqueuer stamps each delivery with its subscription's own
+ organization (`sys_webhook.organization_id`); org-less subscriptions
+ enqueue org-less, unchanged.
+
+Forward-stamping only: existing NULL rows are untouched (their disposition is
+a separate decision). Producers with genuinely no organization — a
+`single`-posture deployment, a stack before its first organization — keep
+working unchanged; their rows land NULL, which is the honest global-row shape.

packages/plugins/plugin-webhooks/src/auto-enqueuer.test.ts

@@ -222,6 +222,48 @@ describe('AutoEnqueuer', () => {
  await ae.stop();
  });
 
+ // [#13546] The delivery row belongs to the SUBSCRIPTION's organization —
+ // `sys_webhook` is organization-scoped (#8554), the enqueuer runs
+ // fire-and-forget off the write path with no request context, so the
+ // subscription row is the one honest tenant source. Without the stamp the
+ // row lands `organization_id = NULL` — the driver's global-row arm — and
+ // the redeliver() cross-organization wall (#10740) excludes nothing.
+ it("stamps the subscription's organization onto the enqueue input (#13546)", async () => {
+ const engine = new FakeEngine({
+ sys_webhook: [webhook({ organization_id: 'org_pin_alpha' })],
+ });
+ const realtime = new FakeRealtime();
+ const { enqueue, calls } = makeRecorder();
+ const ae = new AutoEnqueuer(engine, realtime, enqueue, { refreshIntervalMs: 0 });
+ await ae.start();
+
+ await realtime.publish(event('created', 'contact', { id: 'c-1' }));
+ await flush();
+
+ expect(calls).toHaveLength(1);
+ // Verbatim from the sys_webhook row — threaded, never fabricated.
+ expect(calls[0].organizationId).toBe('org_pin_alpha');
+ await ae.stop();
+ });
+
+ it('an org-less subscription enqueues with NO organization (the honest global-row shape, #13546)', async () => {
+ // The over-denial control: a `single`-posture install has org-less
+ // sys_webhook rows, and their events must still deliver — org-less,
+ // never refused, never stamped with a guess.
+ const engine = new FakeEngine({ sys_webhook: [webhook()] });
+ const realtime = new FakeRealtime();
+ const { enqueue, calls } = makeRecorder();
+ const ae = new AutoEnqueuer(engine, realtime, enqueue, { refreshIntervalMs: 0 });
+ await ae.start();
+
+ await realtime.publish(event('created', 'contact', { id: 'c-1' }));
+ await flush();
+
+ expect(calls).toHaveLength(1);
+ expect(calls[0].organizationId).toBeUndefined();
+ await ae.stop();
+ });
+
  it('[#4626] drops an off-contract data event instead of enqueuing it as "unknown"', async () => {
  // Pre-#4626 the enqueuer read `recordId ?? id ?? after?.id ?? 'unknown'`,
  // so a payload that named no record still produced a delivery whose
@@ -583,6 +625,25 @@ describe('AutoEnqueuer — bulk data events (#4639)', () => {
  await ae.stop();
  });
 
+ it("the bulk path stamps the subscription's organization too (#13546)", async () => {
+ // Same tenant seam as the per-record path — a bulk delivery for an
+ // organization-owned subscription must not land as a global row either.
+ const engine = new FakeEngine({
+ sys_webhook: [webhook({ triggers: 'bulk_update', organization_id: 'org_pin_alpha' })],
+ });
+ const realtime = new FakeRealtime();
+ const { enqueue, calls } = makeRecorder();
+ const ae = new AutoEnqueuer(engine, realtime, enqueue, { refreshIntervalMs: 0 });
+ await ae.start();
+
+ await realtime.publish(bulkEvent('updated', 'contact', 3));
+ await flush();
+
+ expect(calls).toHaveLength(1);
+ expect(calls[0].organizationId).toBe('org_pin_alpha');
+ await ae.stop();
+ });
+
  it('does NOT deliver a bulk event to a per-record update subscriber', async () => {
  // The opt-in half of the decision: an existing `update` webhook keeps
  // receiving only bodies shaped the way it already reads them.

packages/plugins/plugin-webhooks/src/auto-enqueuer.ts

@@ -115,6 +115,21 @@ interface CachedSubscription {
  headers?: Record<string, string>;
  secret?: string;
  timeoutMs?: number;
+ /**
+ * [#13546] The subscription's own organization — `sys_webhook` is
+ * organization-scoped (#8554), so each row carries the tenant that authored
+ * it. Stamped onto every delivery row this subscription produces
+ * (`EnqueueHttpInput.organizationId`), which is what makes the
+ * cross-organization wall on `redeliver()` (#10740) actually exclude other
+ * tenants' rows: a row enqueued without it lands `organization_id = NULL`,
+ * the driver's global-row arm, visible to every organization. There is no
+ * request context to read here — the enqueuer runs fire-and-forget off the
+ * write path — so the subscription row is the one honest source. Absent
+ * when the row itself carries no organization (a `single`-posture install):
+ * the delivery then lands NULL, which is honest for a subscription that
+ * belongs to no organization. Threaded, never fabricated (#11303's rule).
+ */
+ organizationId?: string;
  /**
  * [#8069] Set when a credential this subscription needs could not be
  * recovered. The subscription stays CACHED — that is the change — but every
@@ -783,6 +798,10 @@ export class AutoEnqueuer {
  // from their encrypted columns, NOT read off the row — see #7799
  // (secret) and #7986 (headers).
  timeoutMs: defn.timeoutMs,
+ // [#13546] The tenant column the kernel provisions on sys_webhook.
+ // This cache read is a dispatcher-side unscoped find, so the column
+ // comes back for every organization's rows.
+ organizationId: row.organization_id ? String(row.organization_id) : undefined,
  };
  }
 
@@ -867,6 +886,12 @@ export class AutoEnqueuer {
  // subscription, so the delivery path is byte-identical to before.
  undeliverableReason: sub.parkedReason,
  timeoutMs: sub.timeoutMs,
+ // [#13546] The delivery row belongs to the SUBSCRIPTION's
+ // organization — the one honest tenant in scope on this
+ // fire-and-forget path (no request context exists here).
+ // Absent for an org-less subscription; the row then lands
+ // NULL, the global-row shape.
+ organizationId: sub.organizationId,
  // [#3946] Envelope keys are written LAST so the event payload
  // cannot rewrite them. Behaviour-neutral for the engine's own
  // publishers — since #4626 a `data.record.*` payload is a
@@ -960,6 +985,9 @@ export class AutoEnqueuer {
  // an undeliverable row instead of enqueuing a delivery.
  undeliverableReason: sub.parkedReason,
  timeoutMs: sub.timeoutMs,
+ // [#13546] See the per-record path — the subscription's own
+ // organization, absent for an org-less subscription.
+ organizationId: sub.organizationId,
  // [#3946] Envelope keys last so the payload cannot rewrite them.
  payload: {
  ...payload,

packages/services/service-automation/src/builtin/http-nodes.test.ts

@@ -110,6 +110,78 @@ describe('http (canonical node)', () => {
  expect(result.success).toBe(true);
  expect(fetchMock).toHaveBeenCalledOnce();
  });
+
+ // [#13546] The producer pin: `sys_http_delivery` rows must carry the
+ // organization of the run that caused them, or they land in the
+ // driver's `organization_id IS NULL` global-row arm — visible to and
+ // replayable by every organization through redeliver() (#10740). The
+ // organization is THREADED from the run's own acting context
+ // (`AutomationContext.tenantId`) — the same source, and the same
+ // no-fallback rule, as the notify node's #11303 repair.
+ it("threads the run's acting organization onto the enqueue input (#13546)", async () => {
+ const enqueued: any[] = [];
+ const messaging: HttpSurface = {
+ isHttpDeliveryReady: () => true,
+ async enqueueHttp(input) {
+ enqueued.push(input);
+ return 'dlv_1';
+ },
+ };
+ const engine = new AutomationEngine(createTestLogger());
+ registerHttpNodes(engine, createCtx(messaging));
+ engine.registerFlow(
+ 'http_flow',
+ httpFlow('http', { url: 'https://example.test/hook', durable: true }),
+ );
+
+ const result = await engine.execute('http_flow', { tenantId: 'org_pin_alpha' } as any);
+
+ expect(result.success).toBe(true);
+ expect(enqueued).toHaveLength(1);
+ // Verbatim — the acting tenant, not a derived or defaulted value.
+ expect(enqueued[0].organizationId).toBe('org_pin_alpha');
+ });
+
+ it('with NO organization in scope: still enqueues, passes NO organizationId key, and says so out loud (#13546)', async () => {
+ // The over-denial control (the notify suite's PIN C shape): a
+ // `single`-posture install and a stack before its first
+ // organization legitimately have no tenant to thread, and a
+ // durable callout there must still enqueue — org-less, loudly,
+ // never refused and never guessed.
+ const warnings: string[] = [];
+ const logger: any = {
+ info: () => {}, error: () => {}, debug: () => {},
+ warn: (...args: unknown[]) => { warnings.push(args.map(String).join(' ')); },
+ };
+ logger.child = () => logger;
+ const enqueued: any[] = [];
+ const messaging: HttpSurface = {
+ isHttpDeliveryReady: () => true,
+ async enqueueHttp(input) {
+ enqueued.push(input);
+ return 'dlv_1';
+ },
+ };
+ const engine = new AutomationEngine(logger);
+ registerHttpNodes(engine, {
+ logger,
+ getService: (name: string) => (name === 'messaging' ? messaging : undefined),
+ } as any);
+ engine.registerFlow(
+ 'http_flow',
+ httpFlow('http', { url: 'https://example.test/hook', durable: true }),
+ );
+
+ const result = await engine.execute('http_flow');
+
+ expect(result.success).toBe(true);
+ expect(enqueued).toHaveLength(1);
+ // Absent, not null and not '' — the outbox normalizes a missing
+ // value to NULL exactly once, at its insert.
+ expect('organizationId' in enqueued[0]).toBe(false);
+ // Fail-LOUD: the org-less durable callout is a visible event.
+ expect(warnings.some((w) => w.includes('organization_id = NULL'))).toBe(true);
+ });
  });
 
  describe('request/response mode (default)', () => {

packages/services/service-automation/src/builtin/http-nodes.ts

@@ -48,6 +48,11 @@ interface MessagingHttpSurface {
  signingSecret?: string;
  timeoutMs?: number;
  payload: unknown;
+ /**
+ * [#13546] Organization the delivery row belongs to — the tenant
+ * column the `redeliver()` cross-organization wall scopes by (#10740).
+ */
+ organizationId?: string;
  }): Promise<string>;
 }
 
@@ -121,6 +126,38 @@ export function registerHttpNodes(engine: AutomationEngine, ctx: PluginContext):
  if (durable) {
  const messaging = getMessaging();
  if (messaging?.isHttpDeliveryReady?.() && messaging.enqueueHttp) {
+ // [#13546] The organization this delivery belongs to,
+ // THREADED from the run's own acting context — never
+ // fabricated. Same source and same no-fallback rule as the
+ // `notify` node's #11303 repair one file over:
+ // `AutomationContext.tenantId` is the acting run's
+ // organization, and a wrong value is worse than a null (a
+ // null is visibly missing; a wrong one is silently
+ // authoritative). Without it the sys_http_delivery row
+ // lands `organization_id = NULL` — the driver's global-row
+ // arm — visible to and replayable by EVERY organization
+ // through the redeliver() door (#10740).
+ const organizationId =
+ typeof context.tenantId === 'string' && context.tenantId !== ''
+ ? context.tenantId
+ : undefined;
+ if (!organizationId) {
+ // Fail-LOUD, not fail-guess, not fail-closed (#11303's
+ // triage): a `single`-posture install and a stack before
+ // its first organization legitimately have none, and a
+ // durable callout there must still enqueue.
+ // (Issue anchor lives in these comments, not in the
+ // runtime string — operators cannot resolve a tracker
+ // id; see check:doc-authoring.)
+ ctx.logger.warn(
+ `[http] node '${node.id}': no organization in scope for this durable callout — its ` +
+ `sys_http_delivery row will carry organization_id = NULL, which is a global row ` +
+ `every organization's redeliver door can reach on a walled deployment. ` +
+ `On a multi-organization install the triggering context lost its tenant: give the ` +
+ `flow's trigger an acting organization (AutomationContext.tenantId). On a ` +
+ `single-organization install this is expected and can be ignored.`,
+ );
+ }
  try {
  const deliveryId = await messaging.enqueueHttp({
  source: 'flow',
@@ -133,6 +170,10 @@ export function registerHttpNodes(engine: AutomationEngine, ctx: PluginContext):
  signingSecret,
  timeoutMs,
  payload: body ?? {},
+ // [#13546] Absent (not null) when the run has no
+ // organization; the outbox normalizes a missing
+ // value to NULL exactly once, at the insert.
+ ...(organizationId ? { organizationId } : {}),
  });
  // #4354 — the outbox row IS a durable effect this run
  // caused, but it is NOT a countable one (#7882). What

.changeset/http-outbox-organization-stamp.md

@@ -0,0 +1,39 @@
+---
+"@objectstack/service-messaging": minor
+"@objectstack/service-automation": patch
+"@objectstack/plugin-webhooks": patch
+---
+
+fix(service-messaging,service-automation,plugin-webhooks): stamp `organization_id` on `sys_http_delivery` rows so the cross-organization wall on `redeliver()` actually excludes other tenants' rows (#13546)
+
+`sys_http_delivery` is tenant-scoped and `redeliver()` — the one
+request-reachable door on it — deliberately scopes by the caller's
+organization (#10740). But the enqueue door never stamped the
+`organization_id` column, and the SQL driver's tenant term is
+`(organization_id = :tenantId OR organization_id IS NULL)` — a deliberate
+global-row fail-open — so 100% of delivery rows landed in the NULL arm:
+visible to, and replayable by, every organization on a walled deployment.
+
+The repair mirrors the notification outbox's existing convention
+(`EnqueueDeliveryInput.organizationId`), end to end:
+
+- `EnqueueHttpInput` gains an **optional** `organizationId` member (inherited
+ by `UndeliverableHttpInput`, so parked rows are tenant-stamped too), and
+ `HttpDelivery` surfaces it on read-back. `SqlHttpOutbox.insert` writes
+ `organization_id: input.organizationId ?? null` exactly like
+ `SqlOutbox.enqueue`; `MemoryHttpOutbox` stores the same field and — now
+ that its rows carry a tenant — applies `RedeliverOptions.tenantId` in
+ `redeliver()` with the driver's exact semantics (another organization's row
+ is invisible/`RESOURCE_NOT_FOUND`; an org-less row stays a global row; a
+ tenant-less caller stays unscoped).
+- The flow `http` node (durable mode) threads its run's acting organization
+ (`AutomationContext.tenantId` — the same source as the `notify` node's
+ #11303 repair) and warns loudly when a multi-org run has none to thread.
+- The webhook auto-enqueuer stamps each delivery with its subscription's own
+ organization (`sys_webhook.organization_id`); org-less subscriptions
+ enqueue org-less, unchanged.
+
+Forward-stamping only: existing NULL rows are untouched (their disposition is
+a separate decision). Producers with genuinely no organization — a
+`single`-posture deployment, a stack before its first organization — keep
+working unchanged; their rows land NULL, which is the honest global-row shape.

packages/plugins/plugin-webhooks/src/auto-enqueuer.test.ts

@@ -222,6 +222,48 @@ describe('AutoEnqueuer', () => {
  await ae.stop();
  });
 
+ // [#13546] The delivery row belongs to the SUBSCRIPTION's organization —
+ // `sys_webhook` is organization-scoped (#8554), the enqueuer runs
+ // fire-and-forget off the write path with no request context, so the
+ // subscription row is the one honest tenant source. Without the stamp the
+ // row lands `organization_id = NULL` — the driver's global-row arm — and
+ // the redeliver() cross-organization wall (#10740) excludes nothing.
+ it("stamps the subscription's organization onto the enqueue input (#13546)", async () => {
+ const engine = new FakeEngine({
+ sys_webhook: [webhook({ organization_id: 'org_pin_alpha' })],
+ });
+ const realtime = new FakeRealtime();
+ const { enqueue, calls } = makeRecorder();
+ const ae = new AutoEnqueuer(engine, realtime, enqueue, { refreshIntervalMs: 0 });
+ await ae.start();
+
+ await realtime.publish(event('created', 'contact', { id: 'c-1' }));
+ await flush();
+
+ expect(calls).toHaveLength(1);
+ // Verbatim from the sys_webhook row — threaded, never fabricated.
+ expect(calls[0].organizationId).toBe('org_pin_alpha');
+ await ae.stop();
+ });
+
+ it('an org-less subscription enqueues with NO organization (the honest global-row shape, #13546)', async () => {
+ // The over-denial control: a `single`-posture install has org-less
+ // sys_webhook rows, and their events must still deliver — org-less,
+ // never refused, never stamped with a guess.
+ const engine = new FakeEngine({ sys_webhook: [webhook()] });
+ const realtime = new FakeRealtime();
+ const { enqueue, calls } = makeRecorder();
+ const ae = new AutoEnqueuer(engine, realtime, enqueue, { refreshIntervalMs: 0 });
+ await ae.start();
+
+ await realtime.publish(event('created', 'contact', { id: 'c-1' }));
+ await flush();
+
+ expect(calls).toHaveLength(1);
+ expect(calls[0].organizationId).toBeUndefined();
+ await ae.stop();
+ });
+
  it('[#4626] drops an off-contract data event instead of enqueuing it as "unknown"', async () => {
  // Pre-#4626 the enqueuer read `recordId ?? id ?? after?.id ?? 'unknown'`,
  // so a payload that named no record still produced a delivery whose
@@ -583,6 +625,25 @@ describe('AutoEnqueuer — bulk data events (#4639)', () => {
  await ae.stop();
  });
 
+ it("the bulk path stamps the subscription's organization too (#13546)", async () => {
+ // Same tenant seam as the per-record path — a bulk delivery for an
+ // organization-owned subscription must not land as a global row either.
+ const engine = new FakeEngine({
+ sys_webhook: [webhook({ triggers: 'bulk_update', organization_id: 'org_pin_alpha' })],
+ });
+ const realtime = new FakeRealtime();
+ const { enqueue, calls } = makeRecorder();
+ const ae = new AutoEnqueuer(engine, realtime, enqueue, { refreshIntervalMs: 0 });
+ await ae.start();
+
+ await realtime.publish(bulkEvent('updated', 'contact', 3));
+ await flush();
+
+ expect(calls).toHaveLength(1);
+ expect(calls[0].organizationId).toBe('org_pin_alpha');
+ await ae.stop();
+ });
+
  it('does NOT deliver a bulk event to a per-record update subscriber', async () => {
  // The opt-in half of the decision: an existing `update` webhook keeps
  // receiving only bodies shaped the way it already reads them.

packages/plugins/plugin-webhooks/src/auto-enqueuer.ts

@@ -115,6 +115,21 @@ interface CachedSubscription {
  headers?: Record<string, string>;
  secret?: string;
  timeoutMs?: number;
+ /**
+ * [#13546] The subscription's own organization — `sys_webhook` is
+ * organization-scoped (#8554), so each row carries the tenant that authored
+ * it. Stamped onto every delivery row this subscription produces
+ * (`EnqueueHttpInput.organizationId`), which is what makes the
+ * cross-organization wall on `redeliver()` (#10740) actually exclude other
+ * tenants' rows: a row enqueued without it lands `organization_id = NULL`,
+ * the driver's global-row arm, visible to every organization. There is no
+ * request context to read here — the enqueuer runs fire-and-forget off the
+ * write path — so the subscription row is the one honest source. Absent
+ * when the row itself carries no organization (a `single`-posture install):
+ * the delivery then lands NULL, which is honest for a subscription that
+ * belongs to no organization. Threaded, never fabricated (#11303's rule).
+ */
+ organizationId?: string;
  /**
  * [#8069] Set when a credential this subscription needs could not be
  * recovered. The subscription stays CACHED — that is the change — but every
@@ -783,6 +798,10 @@ export class AutoEnqueuer {
  // from their encrypted columns, NOT read off the row — see #7799
  // (secret) and #7986 (headers).
  timeoutMs: defn.timeoutMs,
+ // [#13546] The tenant column the kernel provisions on sys_webhook.
+ // This cache read is a dispatcher-side unscoped find, so the column
+ // comes back for every organization's rows.
+ organizationId: row.organization_id ? String(row.organization_id) : undefined,
  };
  }
 
@@ -867,6 +886,12 @@ export class AutoEnqueuer {
  // subscription, so the delivery path is byte-identical to before.
  undeliverableReason: sub.parkedReason,
  timeoutMs: sub.timeoutMs,
+ // [#13546] The delivery row belongs to the SUBSCRIPTION's
+ // organization — the one honest tenant in scope on this
+ // fire-and-forget path (no request context exists here).
+ // Absent for an org-less subscription; the row then lands
+ // NULL, the global-row shape.
+ organizationId: sub.organizationId,
  // [#3946] Envelope keys are written LAST so the event payload
  // cannot rewrite them. Behaviour-neutral for the engine's own
  // publishers — since #4626 a `data.record.*` payload is a
@@ -960,6 +985,9 @@ export class AutoEnqueuer {
  // an undeliverable row instead of enqueuing a delivery.
  undeliverableReason: sub.parkedReason,
  timeoutMs: sub.timeoutMs,
+ // [#13546] See the per-record path — the subscription's own
+ // organization, absent for an org-less subscription.
+ organizationId: sub.organizationId,
  // [#3946] Envelope keys last so the payload cannot rewrite them.
  payload: {
  ...payload,

packages/services/service-automation/src/builtin/http-nodes.test.ts

@@ -110,6 +110,78 @@ describe('http (canonical node)', () => {
  expect(result.success).toBe(true);
  expect(fetchMock).toHaveBeenCalledOnce();
  });
+
+ // [#13546] The producer pin: `sys_http_delivery` rows must carry the
+ // organization of the run that caused them, or they land in the
+ // driver's `organization_id IS NULL` global-row arm — visible to and
+ // replayable by every organization through redeliver() (#10740). The
+ // organization is THREADED from the run's own acting context
+ // (`AutomationContext.tenantId`) — the same source, and the same
+ // no-fallback rule, as the notify node's #11303 repair.
+ it("threads the run's acting organization onto the enqueue input (#13546)", async () => {
+ const enqueued: any[] = [];
+ const messaging: HttpSurface = {
+ isHttpDeliveryReady: () => true,
+ async enqueueHttp(input) {
+ enqueued.push(input);
+ return 'dlv_1';
+ },
+ };
+ const engine = new AutomationEngine(createTestLogger());
+ registerHttpNodes(engine, createCtx(messaging));
+ engine.registerFlow(
+ 'http_flow',
+ httpFlow('http', { url: 'https://example.test/hook', durable: true }),
+ );
+
+ const result = await engine.execute('http_flow', { tenantId: 'org_pin_alpha' } as any);
+
+ expect(result.success).toBe(true);
+ expect(enqueued).toHaveLength(1);
+ // Verbatim — the acting tenant, not a derived or defaulted value.
+ expect(enqueued[0].organizationId).toBe('org_pin_alpha');
+ });
+
+ it('with NO organization in scope: still enqueues, passes NO organizationId key, and says so out loud (#13546)', async () => {
+ // The over-denial control (the notify suite's PIN C shape): a
+ // `single`-posture install and a stack before its first
+ // organization legitimately have no tenant to thread, and a
+ // durable callout there must still enqueue — org-less, loudly,
+ // never refused and never guessed.
+ const warnings: string[] = [];
+ const logger: any = {
+ info: () => {}, error: () => {}, debug: () => {},
+ warn: (...args: unknown[]) => { warnings.push(args.map(String).join(' ')); },
+ };
+ logger.child = () => logger;
+ const enqueued: any[] = [];
+ const messaging: HttpSurface = {
+ isHttpDeliveryReady: () => true,
+ async enqueueHttp(input) {
+ enqueued.push(input);
+ return 'dlv_1';
+ },
+ };
+ const engine = new AutomationEngine(logger);
+ registerHttpNodes(engine, {
+ logger,
+ getService: (name: string) => (name === 'messaging' ? messaging : undefined),
+ } as any);
+ engine.registerFlow(
+ 'http_flow',
+ httpFlow('http', { url: 'https://example.test/hook', durable: true }),
+ );
+
+ const result = await engine.execute('http_flow');
+
+ expect(result.success).toBe(true);
+ expect(enqueued).toHaveLength(1);
+ // Absent, not null and not '' — the outbox normalizes a missing
+ // value to NULL exactly once, at its insert.
+ expect('organizationId' in enqueued[0]).toBe(false);
+ // Fail-LOUD: the org-less durable callout is a visible event.
+ expect(warnings.some((w) => w.includes('organization_id = NULL'))).toBe(true);
+ });
  });
 
  describe('request/response mode (default)', () => {

packages/services/service-automation/src/builtin/http-nodes.ts

@@ -48,6 +48,11 @@ interface MessagingHttpSurface {
  signingSecret?: string;
  timeoutMs?: number;
  payload: unknown;
+ /**
+ * [#13546] Organization the delivery row belongs to — the tenant
+ * column the `redeliver()` cross-organization wall scopes by (#10740).
+ */
+ organizationId?: string;
  }): Promise<string>;
 }
 
@@ -121,6 +126,38 @@ export function registerHttpNodes(engine: AutomationEngine, ctx: PluginContext):
  if (durable) {
  const messaging = getMessaging();
  if (messaging?.isHttpDeliveryReady?.() && messaging.enqueueHttp) {
+ // [#13546] The organization this delivery belongs to,
+ // THREADED from the run's own acting context — never
+ // fabricated. Same source and same no-fallback rule as the
+ // `notify` node's #11303 repair one file over:
+ // `AutomationContext.tenantId` is the acting run's
+ // organization, and a wrong value is worse than a null (a
+ // null is visibly missing; a wrong one is silently
+ // authoritative). Without it the sys_http_delivery row
+ // lands `organization_id = NULL` — the driver's global-row
+ // arm — visible to and replayable by EVERY organization
+ // through the redeliver() door (#10740).
+ const organizationId =
+ typeof context.tenantId === 'string' && context.tenantId !== ''
+ ? context.tenantId
+ : undefined;
+ if (!organizationId) {
+ // Fail-LOUD, not fail-guess, not fail-closed (#11303's
+ // triage): a `single`-posture install and a stack before
+ // its first organization legitimately have none, and a
+ // durable callout there must still enqueue.
+ // (Issue anchor lives in these comments, not in the
+ // runtime string — operators cannot resolve a tracker
+ // id; see check:doc-authoring.)
+ ctx.logger.warn(
+ `[http] node '${node.id}': no organization in scope for this durable callout — its ` +
+ `sys_http_delivery row will carry organization_id = NULL, which is a global row ` +
+ `every organization's redeliver door can reach on a walled deployment. ` +
+ `On a multi-organization install the triggering context lost its tenant: give the ` +
+ `flow's trigger an acting organization (AutomationContext.tenantId). On a ` +
+ `single-organization install this is expected and can be ignored.`,
+ );
+ }
  try {
  const deliveryId = await messaging.enqueueHttp({
  source: 'flow',
@@ -133,6 +170,10 @@ export function registerHttpNodes(engine: AutomationEngine, ctx: PluginContext):
  signingSecret,
  timeoutMs,
  payload: body ?? {},
+ // [#13546] Absent (not null) when the run has no
+ // organization; the outbox normalizes a missing
+ // value to NULL exactly once, at the insert.
+ ...(organizationId ? { organizationId } : {}),
  });
  // #4354 — the outbox row IS a durable effect this run
  // caused, but it is NOT a countable one (#7882). What

.changeset/http-outbox-organization-stamp.md

@@ -0,0 +1,39 @@
+---
+"@objectstack/service-messaging": minor
+"@objectstack/service-automation": patch
+"@objectstack/plugin-webhooks": patch
+---
+
+fix(service-messaging,service-automation,plugin-webhooks): stamp `organization_id` on `sys_http_delivery` rows so the cross-organization wall on `redeliver()` actually excludes other tenants' rows (#13546)
+
+`sys_http_delivery` is tenant-scoped and `redeliver()` — the one
+request-reachable door on it — deliberately scopes by the caller's
+organization (#10740). But the enqueue door never stamped the
+`organization_id` column, and the SQL driver's tenant term is
+`(organization_id = :tenantId OR organization_id IS NULL)` — a deliberate
+global-row fail-open — so 100% of delivery rows landed in the NULL arm:
+visible to, and replayable by, every organization on a walled deployment.
+
+The repair mirrors the notification outbox's existing convention
+(`EnqueueDeliveryInput.organizationId`), end to end:
+
+- `EnqueueHttpInput` gains an **optional** `organizationId` member (inherited
+ by `UndeliverableHttpInput`, so parked rows are tenant-stamped too), and
+ `HttpDelivery` surfaces it on read-back. `SqlHttpOutbox.insert` writes
+ `organization_id: input.organizationId ?? null` exactly like
+ `SqlOutbox.enqueue`; `MemoryHttpOutbox` stores the same field and — now
+ that its rows carry a tenant — applies `RedeliverOptions.tenantId` in
+ `redeliver()` with the driver's exact semantics (another organization's row
+ is invisible/`RESOURCE_NOT_FOUND`; an org-less row stays a global row; a
+ tenant-less caller stays unscoped).
+- The flow `http` node (durable mode) threads its run's acting organization
+ (`AutomationContext.tenantId` — the same source as the `notify` node's
+ #11303 repair) and warns loudly when a multi-org run has none to thread.
+- The webhook auto-enqueuer stamps each delivery with its subscription's own
+ organization (`sys_webhook.organization_id`); org-less subscriptions
+ enqueue org-less, unchanged.
+
+Forward-stamping only: existing NULL rows are untouched (their disposition is
+a separate decision). Producers with genuinely no organization — a
+`single`-posture deployment, a stack before its first organization — keep
+working unchanged; their rows land NULL, which is the honest global-row shape.

packages/plugins/plugin-webhooks/src/auto-enqueuer.test.ts

@@ -222,6 +222,48 @@ describe('AutoEnqueuer', () => {
  await ae.stop();
  });
 
+ // [#13546] The delivery row belongs to the SUBSCRIPTION's organization —
+ // `sys_webhook` is organization-scoped (#8554), the enqueuer runs
+ // fire-and-forget off the write path with no request context, so the
+ // subscription row is the one honest tenant source. Without the stamp the
+ // row lands `organization_id = NULL` — the driver's global-row arm — and
+ // the redeliver() cross-organization wall (#10740) excludes nothing.
+ it("stamps the subscription's organization onto the enqueue input (#13546)", async () => {
+ const engine = new FakeEngine({
+ sys_webhook: [webhook({ organization_id: 'org_pin_alpha' })],
+ });
+ const realtime = new FakeRealtime();
+ const { enqueue, calls } = makeRecorder();
+ const ae = new AutoEnqueuer(engine, realtime, enqueue, { refreshIntervalMs: 0 });
+ await ae.start();
+
+ await realtime.publish(event('created', 'contact', { id: 'c-1' }));
+ await flush();
+
+ expect(calls).toHaveLength(1);
+ // Verbatim from the sys_webhook row — threaded, never fabricated.
+ expect(calls[0].organizationId).toBe('org_pin_alpha');
+ await ae.stop();
+ });
+
+ it('an org-less subscription enqueues with NO organization (the honest global-row shape, #13546)', async () => {
+ // The over-denial control: a `single`-posture install has org-less
+ // sys_webhook rows, and their events must still deliver — org-less,
+ // never refused, never stamped with a guess.
+ const engine = new FakeEngine({ sys_webhook: [webhook()] });
+ const realtime = new FakeRealtime();
+ const { enqueue, calls } = makeRecorder();
+ const ae = new AutoEnqueuer(engine, realtime, enqueue, { refreshIntervalMs: 0 });
+ await ae.start();
+
+ await realtime.publish(event('created', 'contact', { id: 'c-1' }));
+ await flush();
+
+ expect(calls).toHaveLength(1);
+ expect(calls[0].organizationId).toBeUndefined();
+ await ae.stop();
+ });
+
  it('[#4626] drops an off-contract data event instead of enqueuing it as "unknown"', async () => {
  // Pre-#4626 the enqueuer read `recordId ?? id ?? after?.id ?? 'unknown'`,
  // so a payload that named no record still produced a delivery whose
@@ -583,6 +625,25 @@ describe('AutoEnqueuer — bulk data events (#4639)', () => {
  await ae.stop();
  });
 
+ it("the bulk path stamps the subscription's organization too (#13546)", async () => {
+ // Same tenant seam as the per-record path — a bulk delivery for an
+ // organization-owned subscription must not land as a global row either.
+ const engine = new FakeEngine({
+ sys_webhook: [webhook({ triggers: 'bulk_update', organization_id: 'org_pin_alpha' })],
+ });
+ const realtime = new FakeRealtime();
+ const { enqueue, calls } = makeRecorder();
+ const ae = new AutoEnqueuer(engine, realtime, enqueue, { refreshIntervalMs: 0 });
+ await ae.start();
+
+ await realtime.publish(bulkEvent('updated', 'contact', 3));
+ await flush();
+
+ expect(calls).toHaveLength(1);
+ expect(calls[0].organizationId).toBe('org_pin_alpha');
+ await ae.stop();
+ });
+
  it('does NOT deliver a bulk event to a per-record update subscriber', async () => {
  // The opt-in half of the decision: an existing `update` webhook keeps
  // receiving only bodies shaped the way it already reads them.

packages/plugins/plugin-webhooks/src/auto-enqueuer.ts

@@ -115,6 +115,21 @@ interface CachedSubscription {
  headers?: Record<string, string>;
  secret?: string;
  timeoutMs?: number;
+ /**
+ * [#13546] The subscription's own organization — `sys_webhook` is
+ * organization-scoped (#8554), so each row carries the tenant that authored
+ * it. Stamped onto every delivery row this subscription produces
+ * (`EnqueueHttpInput.organizationId`), which is what makes the
+ * cross-organization wall on `redeliver()` (#10740) actually exclude other
+ * tenants' rows: a row enqueued without it lands `organization_id = NULL`,
+ * the driver's global-row arm, visible to every organization. There is no
+ * request context to read here — the enqueuer runs fire-and-forget off the
+ * write path — so the subscription row is the one honest source. Absent
+ * when the row itself carries no organization (a `single`-posture install):
+ * the delivery then lands NULL, which is honest for a subscription that
+ * belongs to no organization. Threaded, never fabricated (#11303's rule).
+ */
+ organizationId?: string;
  /**
  * [#8069] Set when a credential this subscription needs could not be
  * recovered. The subscription stays CACHED — that is the change — but every
@@ -783,6 +798,10 @@ export class AutoEnqueuer {
  // from their encrypted columns, NOT read off the row — see #7799
  // (secret) and #7986 (headers).
  timeoutMs: defn.timeoutMs,
+ // [#13546] The tenant column the kernel provisions on sys_webhook.
+ // This cache read is a dispatcher-side unscoped find, so the column
+ // comes back for every organization's rows.
+ organizationId: row.organization_id ? String(row.organization_id) : undefined,
  };
  }
 
@@ -867,6 +886,12 @@ export class AutoEnqueuer {
  // subscription, so the delivery path is byte-identical to before.
  undeliverableReason: sub.parkedReason,
  timeoutMs: sub.timeoutMs,
+ // [#13546] The delivery row belongs to the SUBSCRIPTION's
+ // organization — the one honest tenant in scope on this
+ // fire-and-forget path (no request context exists here).
+ // Absent for an org-less subscription; the row then lands
+ // NULL, the global-row shape.
+ organizationId: sub.organizationId,
  // [#3946] Envelope keys are written LAST so the event payload
  // cannot rewrite them. Behaviour-neutral for the engine's own
  // publishers — since #4626 a `data.record.*` payload is a
@@ -960,6 +985,9 @@ export class AutoEnqueuer {
  // an undeliverable row instead of enqueuing a delivery.
  undeliverableReason: sub.parkedReason,
  timeoutMs: sub.timeoutMs,
+ // [#13546] See the per-record path — the subscription's own
+ // organization, absent for an org-less subscription.
+ organizationId: sub.organizationId,
  // [#3946] Envelope keys last so the payload cannot rewrite them.
  payload: {
  ...payload,

packages/services/service-automation/src/builtin/http-nodes.test.ts

@@ -110,6 +110,78 @@ describe('http (canonical node)', () => {
  expect(result.success).toBe(true);
  expect(fetchMock).toHaveBeenCalledOnce();
  });
+
+ // [#13546] The producer pin: `sys_http_delivery` rows must carry the
+ // organization of the run that caused them, or they land in the
+ // driver's `organization_id IS NULL` global-row arm — visible to and
+ // replayable by every organization through redeliver() (#10740). The
+ // organization is THREADED from the run's own acting context
+ // (`AutomationContext.tenantId`) — the same source, and the same
+ // no-fallback rule, as the notify node's #11303 repair.
+ it("threads the run's acting organization onto the enqueue input (#13546)", async () => {
+ const enqueued: any[] = [];
+ const messaging: HttpSurface = {
+ isHttpDeliveryReady: () => true,
+ async enqueueHttp(input) {
+ enqueued.push(input);
+ return 'dlv_1';
+ },
+ };
+ const engine = new AutomationEngine(createTestLogger());
+ registerHttpNodes(engine, createCtx(messaging));
+ engine.registerFlow(
+ 'http_flow',
+ httpFlow('http', { url: 'https://example.test/hook', durable: true }),
+ );
+
+ const result = await engine.execute('http_flow', { tenantId: 'org_pin_alpha' } as any);
+
+ expect(result.success).toBe(true);
+ expect(enqueued).toHaveLength(1);
+ // Verbatim — the acting tenant, not a derived or defaulted value.
+ expect(enqueued[0].organizationId).toBe('org_pin_alpha');
+ });
+
+ it('with NO organization in scope: still enqueues, passes NO organizationId key, and says so out loud (#13546)', async () => {
+ // The over-denial control (the notify suite's PIN C shape): a
+ // `single`-posture install and a stack before its first
+ // organization legitimately have no tenant to thread, and a
+ // durable callout there must still enqueue — org-less, loudly,
+ // never refused and never guessed.
+ const warnings: string[] = [];
+ const logger: any = {
+ info: () => {}, error: () => {}, debug: () => {},
+ warn: (...args: unknown[]) => { warnings.push(args.map(String).join(' ')); },
+ };
+ logger.child = () => logger;
+ const enqueued: any[] = [];
+ const messaging: HttpSurface = {
+ isHttpDeliveryReady: () => true,
+ async enqueueHttp(input) {
+ enqueued.push(input);
+ return 'dlv_1';
+ },
+ };
+ const engine = new AutomationEngine(logger);
+ registerHttpNodes(engine, {
+ logger,
+ getService: (name: string) => (name === 'messaging' ? messaging : undefined),
+ } as any);
+ engine.registerFlow(
+ 'http_flow',
+ httpFlow('http', { url: 'https://example.test/hook', durable: true }),
+ );
+
+ const result = await engine.execute('http_flow');
+
+ expect(result.success).toBe(true);
+ expect(enqueued).toHaveLength(1);
+ // Absent, not null and not '' — the outbox normalizes a missing
+ // value to NULL exactly once, at its insert.
+ expect('organizationId' in enqueued[0]).toBe(false);
+ // Fail-LOUD: the org-less durable callout is a visible event.
+ expect(warnings.some((w) => w.includes('organization_id = NULL'))).toBe(true);
+ });
  });
 
  describe('request/response mode (default)', () => {

packages/services/service-automation/src/builtin/http-nodes.ts

@@ -48,6 +48,11 @@ interface MessagingHttpSurface {
  signingSecret?: string;
  timeoutMs?: number;
  payload: unknown;
+ /**
+ * [#13546] Organization the delivery row belongs to — the tenant
+ * column the `redeliver()` cross-organization wall scopes by (#10740).
+ */
+ organizationId?: string;
  }): Promise<string>;
 }
 
@@ -121,6 +126,38 @@ export function registerHttpNodes(engine: AutomationEngine, ctx: PluginContext):
  if (durable) {
  const messaging = getMessaging();
  if (messaging?.isHttpDeliveryReady?.() && messaging.enqueueHttp) {
+ // [#13546] The organization this delivery belongs to,
+ // THREADED from the run's own acting context — never
+ // fabricated. Same source and same no-fallback rule as the
+ // `notify` node's #11303 repair one file over:
+ // `AutomationContext.tenantId` is the acting run's
+ // organization, and a wrong value is worse than a null (a
+ // null is visibly missing; a wrong one is silently
+ // authoritative). Without it the sys_http_delivery row
+ // lands `organization_id = NULL` — the driver's global-row
+ // arm — visible to and replayable by EVERY organization
+ // through the redeliver() door (#10740).
+ const organizationId =
+ typeof context.tenantId === 'string' && context.tenantId !== ''
+ ? context.tenantId
+ : undefined;
+ if (!organizationId) {
+ // Fail-LOUD, not fail-guess, not fail-closed (#11303's
+ // triage): a `single`-posture install and a stack before
+ // its first organization legitimately have none, and a
+ // durable callout there must still enqueue.
+ // (Issue anchor lives in these comments, not in the
+ // runtime string — operators cannot resolve a tracker
+ // id; see check:doc-authoring.)
+ ctx.logger.warn(
+ `[http] node '${node.id}': no organization in scope for this durable callout — its ` +
+ `sys_http_delivery row will carry organization_id = NULL, which is a global row ` +
+ `every organization's redeliver door can reach on a walled deployment. ` +
+ `On a multi-organization install the triggering context lost its tenant: give the ` +
+ `flow's trigger an acting organization (AutomationContext.tenantId). On a ` +
+ `single-organization install this is expected and can be ignored.`,
+ );
+ }
  try {
  const deliveryId = await messaging.enqueueHttp({
  source: 'flow',
@@ -133,6 +170,10 @@ export function registerHttpNodes(engine: AutomationEngine, ctx: PluginContext):
  signingSecret,
  timeoutMs,
  payload: body ?? {},
+ // [#13546] Absent (not null) when the run has no
+ // organization; the outbox normalizes a missing
+ // value to NULL exactly once, at the insert.
+ ...(organizationId ? { organizationId } : {}),
  });
  // #4354 — the outbox row IS a durable effect this run
  // caused, but it is NOT a countable one (#7882). What

.changeset/http-outbox-organization-stamp.md

@@ -0,0 +1,39 @@
+---
+"@objectstack/service-messaging": minor
+"@objectstack/service-automation": patch
+"@objectstack/plugin-webhooks": patch
+---
+
+fix(service-messaging,service-automation,plugin-webhooks): stamp `organization_id` on `sys_http_delivery` rows so the cross-organization wall on `redeliver()` actually excludes other tenants' rows (#13546)
+
+`sys_http_delivery` is tenant-scoped and `redeliver()` — the one
+request-reachable door on it — deliberately scopes by the caller's
+organization (#10740). But the enqueue door never stamped the
+`organization_id` column, and the SQL driver's tenant term is
+`(organization_id = :tenantId OR organization_id IS NULL)` — a deliberate
+global-row fail-open — so 100% of delivery rows landed in the NULL arm:
+visible to, and replayable by, every organization on a walled deployment.
+
+The repair mirrors the notification outbox's existing convention
+(`EnqueueDeliveryInput.organizationId`), end to end:
+
+- `EnqueueHttpInput` gains an **optional** `organizationId` member (inherited
+ by `UndeliverableHttpInput`, so parked rows are tenant-stamped too), and
+ `HttpDelivery` surfaces it on read-back. `SqlHttpOutbox.insert` writes
+ `organization_id: input.organizationId ?? null` exactly like
+ `SqlOutbox.enqueue`; `MemoryHttpOutbox` stores the same field and — now
+ that its rows carry a tenant — applies `RedeliverOptions.tenantId` in
+ `redeliver()` with the driver's exact semantics (another organization's row
+ is invisible/`RESOURCE_NOT_FOUND`; an org-less row stays a global row; a
+ tenant-less caller stays unscoped).
+- The flow `http` node (durable mode) threads its run's acting organization
+ (`AutomationContext.tenantId` — the same source as the `notify` node's
+ #11303 repair) and warns loudly when a multi-org run has none to thread.
+- The webhook auto-enqueuer stamps each delivery with its subscription's own
+ organization (`sys_webhook.organization_id`); org-less subscriptions
+ enqueue org-less, unchanged.
+
+Forward-stamping only: existing NULL rows are untouched (their disposition is
+a separate decision). Producers with genuinely no organization — a
+`single`-posture deployment, a stack before its first organization — keep
+working unchanged; their rows land NULL, which is the honest global-row shape.

packages/plugins/plugin-webhooks/src/auto-enqueuer.test.ts

@@ -222,6 +222,48 @@ describe('AutoEnqueuer', () => {
  await ae.stop();
  });
 
+ // [#13546] The delivery row belongs to the SUBSCRIPTION's organization —
+ // `sys_webhook` is organization-scoped (#8554), the enqueuer runs
+ // fire-and-forget off the write path with no request context, so the
+ // subscription row is the one honest tenant source. Without the stamp the
+ // row lands `organization_id = NULL` — the driver's global-row arm — and
+ // the redeliver() cross-organization wall (#10740) excludes nothing.
+ it("stamps the subscription's organization onto the enqueue input (#13546)", async () => {
+ const engine = new FakeEngine({
+ sys_webhook: [webhook({ organization_id: 'org_pin_alpha' })],
+ });
+ const realtime = new FakeRealtime();
+ const { enqueue, calls } = makeRecorder();
+ const ae = new AutoEnqueuer(engine, realtime, enqueue, { refreshIntervalMs: 0 });
+ await ae.start();
+
+ await realtime.publish(event('created', 'contact', { id: 'c-1' }));
+ await flush();
+
+ expect(calls).toHaveLength(1);
+ // Verbatim from the sys_webhook row — threaded, never fabricated.
+ expect(calls[0].organizationId).toBe('org_pin_alpha');
+ await ae.stop();
+ });
+
+ it('an org-less subscription enqueues with NO organization (the honest global-row shape, #13546)', async () => {
+ // The over-denial control: a `single`-posture install has org-less
+ // sys_webhook rows, and their events must still deliver — org-less,
+ // never refused, never stamped with a guess.
+ const engine = new FakeEngine({ sys_webhook: [webhook()] });
+ const realtime = new FakeRealtime();
+ const { enqueue, calls } = makeRecorder();
+ const ae = new AutoEnqueuer(engine, realtime, enqueue, { refreshIntervalMs: 0 });
+ await ae.start();
+
+ await realtime.publish(event('created', 'contact', { id: 'c-1' }));
+ await flush();
+
+ expect(calls).toHaveLength(1);
+ expect(calls[0].organizationId).toBeUndefined();
+ await ae.stop();
+ });
+
  it('[#4626] drops an off-contract data event instead of enqueuing it as "unknown"', async () => {
  // Pre-#4626 the enqueuer read `recordId ?? id ?? after?.id ?? 'unknown'`,
  // so a payload that named no record still produced a delivery whose
@@ -583,6 +625,25 @@ describe('AutoEnqueuer — bulk data events (#4639)', () => {
  await ae.stop();
  });
 
+ it("the bulk path stamps the subscription's organization too (#13546)", async () => {
+ // Same tenant seam as the per-record path — a bulk delivery for an
+ // organization-owned subscription must not land as a global row either.
+ const engine = new FakeEngine({
+ sys_webhook: [webhook({ triggers: 'bulk_update', organization_id: 'org_pin_alpha' })],
+ });
+ const realtime = new FakeRealtime();
+ const { enqueue, calls } = makeRecorder();
+ const ae = new AutoEnqueuer(engine, realtime, enqueue, { refreshIntervalMs: 0 });
+ await ae.start();
+
+ await realtime.publish(bulkEvent('updated', 'contact', 3));
+ await flush();
+
+ expect(calls).toHaveLength(1);
+ expect(calls[0].organizationId).toBe('org_pin_alpha');
+ await ae.stop();
+ });
+
  it('does NOT deliver a bulk event to a per-record update subscriber', async () => {
  // The opt-in half of the decision: an existing `update` webhook keeps
  // receiving only bodies shaped the way it already reads them.

packages/plugins/plugin-webhooks/src/auto-enqueuer.ts

@@ -115,6 +115,21 @@ interface CachedSubscription {
  headers?: Record<string, string>;
  secret?: string;
  timeoutMs?: number;
+ /**
+ * [#13546] The subscription's own organization — `sys_webhook` is
+ * organization-scoped (#8554), so each row carries the tenant that authored
+ * it. Stamped onto every delivery row this subscription produces
+ * (`EnqueueHttpInput.organizationId`), which is what makes the
+ * cross-organization wall on `redeliver()` (#10740) actually exclude other
+ * tenants' rows: a row enqueued without it lands `organization_id = NULL`,
+ * the driver's global-row arm, visible to every organization. There is no
+ * request context to read here — the enqueuer runs fire-and-forget off the
+ * write path — so the subscription row is the one honest source. Absent
+ * when the row itself carries no organization (a `single`-posture install):
+ * the delivery then lands NULL, which is honest for a subscription that
+ * belongs to no organization. Threaded, never fabricated (#11303's rule).
+ */
+ organizationId?: string;
  /**
  * [#8069] Set when a credential this subscription needs could not be
  * recovered. The subscription stays CACHED — that is the change — but every
@@ -783,6 +798,10 @@ export class AutoEnqueuer {
  // from their encrypted columns, NOT read off the row — see #7799
  // (secret) and #7986 (headers).
  timeoutMs: defn.timeoutMs,
+ // [#13546] The tenant column the kernel provisions on sys_webhook.
+ // This cache read is a dispatcher-side unscoped find, so the column
+ // comes back for every organization's rows.
+ organizationId: row.organization_id ? String(row.organization_id) : undefined,
  };
  }
 
@@ -867,6 +886,12 @@ export class AutoEnqueuer {
  // subscription, so the delivery path is byte-identical to before.
  undeliverableReason: sub.parkedReason,
  timeoutMs: sub.timeoutMs,
+ // [#13546] The delivery row belongs to the SUBSCRIPTION's
+ // organization — the one honest tenant in scope on this
+ // fire-and-forget path (no request context exists here).
+ // Absent for an org-less subscription; the row then lands
+ // NULL, the global-row shape.
+ organizationId: sub.organizationId,
  // [#3946] Envelope keys are written LAST so the event payload
  // cannot rewrite them. Behaviour-neutral for the engine's own
  // publishers — since #4626 a `data.record.*` payload is a
@@ -960,6 +985,9 @@ export class AutoEnqueuer {
  // an undeliverable row instead of enqueuing a delivery.
  undeliverableReason: sub.parkedReason,
  timeoutMs: sub.timeoutMs,
+ // [#13546] See the per-record path — the subscription's own
+ // organization, absent for an org-less subscription.
+ organizationId: sub.organizationId,
  // [#3946] Envelope keys last so the payload cannot rewrite them.
  payload: {
  ...payload,

packages/services/service-automation/src/builtin/http-nodes.test.ts

@@ -110,6 +110,78 @@ describe('http (canonical node)', () => {
  expect(result.success).toBe(true);
  expect(fetchMock).toHaveBeenCalledOnce();
  });
+
+ // [#13546] The producer pin: `sys_http_delivery` rows must carry the
+ // organization of the run that caused them, or they land in the
+ // driver's `organization_id IS NULL` global-row arm — visible to and
+ // replayable by every organization through redeliver() (#10740). The
+ // organization is THREADED from the run's own acting context
+ // (`AutomationContext.tenantId`) — the same source, and the same
+ // no-fallback rule, as the notify node's #11303 repair.
+ it("threads the run's acting organization onto the enqueue input (#13546)", async () => {
+ const enqueued: any[] = [];
+ const messaging: HttpSurface = {
+ isHttpDeliveryReady: () => true,
+ async enqueueHttp(input) {
+ enqueued.push(input);
+ return 'dlv_1';
+ },
+ };
+ const engine = new AutomationEngine(createTestLogger());
+ registerHttpNodes(engine, createCtx(messaging));
+ engine.registerFlow(
+ 'http_flow',
+ httpFlow('http', { url: 'https://example.test/hook', durable: true }),
+ );
+
+ const result = await engine.execute('http_flow', { tenantId: 'org_pin_alpha' } as any);
+
+ expect(result.success).toBe(true);
+ expect(enqueued).toHaveLength(1);
+ // Verbatim — the acting tenant, not a derived or defaulted value.
+ expect(enqueued[0].organizationId).toBe('org_pin_alpha');
+ });
+
+ it('with NO organization in scope: still enqueues, passes NO organizationId key, and says so out loud (#13546)', async () => {
+ // The over-denial control (the notify suite's PIN C shape): a
+ // `single`-posture install and a stack before its first
+ // organization legitimately have no tenant to thread, and a
+ // durable callout there must still enqueue — org-less, loudly,
+ // never refused and never guessed.
+ const warnings: string[] = [];
+ const logger: any = {
+ info: () => {}, error: () => {}, debug: () => {},
+ warn: (...args: unknown[]) => { warnings.push(args.map(String).join(' ')); },
+ };
+ logger.child = () => logger;
+ const enqueued: any[] = [];
+ const messaging: HttpSurface = {
+ isHttpDeliveryReady: () => true,
+ async enqueueHttp(input) {
+ enqueued.push(input);
+ return 'dlv_1';
+ },
+ };
+ const engine = new AutomationEngine(logger);
+ registerHttpNodes(engine, {
+ logger,
+ getService: (name: string) => (name === 'messaging' ? messaging : undefined),
+ } as any);
+ engine.registerFlow(
+ 'http_flow',
+ httpFlow('http', { url: 'https://example.test/hook', durable: true }),
+ );
+
+ const result = await engine.execute('http_flow');
+
+ expect(result.success).toBe(true);
+ expect(enqueued).toHaveLength(1);
+ // Absent, not null and not '' — the outbox normalizes a missing
+ // value to NULL exactly once, at its insert.
+ expect('organizationId' in enqueued[0]).toBe(false);
+ // Fail-LOUD: the org-less durable callout is a visible event.
+ expect(warnings.some((w) => w.includes('organization_id = NULL'))).toBe(true);
+ });
  });
 
  describe('request/response mode (default)', () => {

packages/services/service-automation/src/builtin/http-nodes.ts

@@ -48,6 +48,11 @@ interface MessagingHttpSurface {
  signingSecret?: string;
  timeoutMs?: number;
  payload: unknown;
+ /**
+ * [#13546] Organization the delivery row belongs to — the tenant
+ * column the `redeliver()` cross-organization wall scopes by (#10740).
+ */
+ organizationId?: string;
  }): Promise<string>;
 }
 
@@ -121,6 +126,38 @@ export function registerHttpNodes(engine: AutomationEngine, ctx: PluginContext):
  if (durable) {
  const messaging = getMessaging();
  if (messaging?.isHttpDeliveryReady?.() && messaging.enqueueHttp) {
+ // [#13546] The organization this delivery belongs to,
+ // THREADED from the run's own acting context — never
+ // fabricated. Same source and same no-fallback rule as the
+ // `notify` node's #11303 repair one file over:
+ // `AutomationContext.tenantId` is the acting run's
+ // organization, and a wrong value is worse than a null (a
+ // null is visibly missing; a wrong one is silently
+ // authoritative). Without it the sys_http_delivery row
+ // lands `organization_id = NULL` — the driver's global-row
+ // arm — visible to and replayable by EVERY organization
+ // through the redeliver() door (#10740).
+ const organizationId =
+ typeof context.tenantId === 'string' && context.tenantId !== ''
+ ? context.tenantId
+ : undefined;
+ if (!organizationId) {
+ // Fail-LOUD, not fail-guess, not fail-closed (#11303's
+ // triage): a `single`-posture install and a stack before
+ // its first organization legitimately have none, and a
+ // durable callout there must still enqueue.
+ // (Issue anchor lives in these comments, not in the
+ // runtime string — operators cannot resolve a tracker
+ // id; see check:doc-authoring.)
+ ctx.logger.warn(
+ `[http] node '${node.id}': no organization in scope for this durable callout — its ` +
+ `sys_http_delivery row will carry organization_id = NULL, which is a global row ` +
+ `every organization's redeliver door can reach on a walled deployment. ` +
+ `On a multi-organization install the triggering context lost its tenant: give the ` +
+ `flow's trigger an acting organization (AutomationContext.tenantId). On a ` +
+ `single-organization install this is expected and can be ignored.`,
+ );
+ }
  try {
  const deliveryId = await messaging.enqueueHttp({
  source: 'flow',
@@ -133,6 +170,10 @@ export function registerHttpNodes(engine: AutomationEngine, ctx: PluginContext):
  signingSecret,
  timeoutMs,
  payload: body ?? {},
+ // [#13546] Absent (not null) when the run has no
+ // organization; the outbox normalizes a missing
+ // value to NULL exactly once, at the insert.
+ ...(organizationId ? { organizationId } : {}),
  });
  // #4354 — the outbox row IS a durable effect this run
  // caused, but it is NOT a countable one (#7882). What