feat(objectql): declare a legitimately org-less write instead of inferring it from NULL#14923

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
os-musk wants to merge 10 commits into from
Closed

feat(objectql): declare a legitimately org-less write instead of inferring it from NULL #14923

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
10 commits
Select commit Hold shift + click to select a range
33df2b5
feat(objectql): declare a legitimately org-less write instead of infe…
claude Sep 3, 2026
d7b49cf
Merge remote-tracking branch 'origin/main' into claude/issue-13636-or…
claude Sep 3, 2026
9ef492f
fix(docs): re-anchor the system-context census line citations after t…
claude Sep 3, 2026
4c2da50
fix(#14923 review): respell the gate's bare-root literal, register th…
claude Sep 3, 2026
d126ae8
fix(docs): re-anchor the system-context census after this round's eng…
claude Sep 3, 2026
0ac778e
Merge remote-tracking branch 'origin/main' into claude/issue-13636-or…
claude Sep 3, 2026
f5d20ac
chore: regenerate the system-context census page on the merged tree
claude Sep 3, 2026
2cb2976
fix(objectql): move the tracker id off the orgless-write refusal message
claude Sep 3, 2026
6a60b04
Merge remote-tracking branch 'origin/main' into claude/issue-13636-or…
claude Sep 3, 2026
9dce213
fix(docs): repair system-context census anchor after merge conflict
claude Sep 3, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
47 changes: 47 additions & 0 deletions .changeset/orgless-write-declaration-channel.md
View file
Open in desktop
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
---
"@objectstack/objectql": minor
"@objectstack/metadata-protocol": minor
"@objectstack/plugin-audit": minor
"@objectstack/plugin-auth": minor
"@objectstack/service-settings": minor
---

feat(objectql): an explicit per-write declaration for a legitimately org-less row

Until now one `NULL` organization on a platform object meant two different
things — a deliberate environment-level row, and a write that forgot to thread
an organization — and `resolveSystemInsertOrganization` had no way to tell them
apart. So the two objects that hold BOTH populations, `sys_metadata` (whose
non-overridable-type write lands env-wide by adjudication) and `sys_audit_log`
(whose writers enumerate their own legitimate org-less cases), had to stay
outside the tenant-audit control entirely. They are two of the largest write
populations in the platform namespace, which put the control's blind spot
exactly where it was least affordable.

Writes may now DECLARE that their rows belong to an adjudicated org-less
population:

```ts
await engine.insert('sys_metadata', row, {
context: { isSystem: true },
orgLessWrite: { object: 'sys_metadata', reason: 'env-level-metadata' },
});
```

The platform tenancy ledger gains a fourth verdict, `conditional`, and both
objects are admitted under it. ⚠️ Admission makes them STRICTER, not looser: an
org-less system write on either is now derived on a single-organization install
and refused loudly on a walled one, exactly as a `tenant-scoped` object's is,
and the declaration is the only way through. It is checked against the ledger
before anything else the resolver does, so a declaration naming an object the
ledger has not admitted, a reason that object does not admit, or an object other
than the one being written throws `ERR_ORGLESS_WRITE_DECLARATION_REFUSED` — no
spelling of the option is silently ignored, which is what separates a
declaration from a bypass flag. ⛔ It is not a way to quiet a refusal: a write
that simply forgot to thread an organization is the defect the refusal reports.

The platform's own six org-less writers declare, each on a test a reader can
check — the metadata repository on its own env-level scope, the audit writers on
whether the audited subject resolves an organization column at all. A new gate,
`pnpm check:orgless-write-declarations`, enumerates every declaration in the
tree, holds each to the same ledger the runtime does, and prints the count.
14 changes: 14 additions & 0 deletions .github/workflows/lint.yml
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -3596,6 +3596,20 @@ jobs:
- name: Read-side tenant chokepoint gate
run: pnpm check:tenant-chokepoint

# [#13636] The 'orgLessWrite' declaration census. The maintainer's
# 2026-08-31 ruling put 'loud, checkable, countable' in the decision text
# rather than in implementation notes; the engine discharges the first two
# at the write, and this is the third — every declaration in the monorepo
# enumerated, held to the same ledger the runtime holds it to, and COUNTED
# on every pass. A declaration nobody can count is the silent marker that
# ruling disqualified by name.
#
# Static scan over tracked sources, no build needed, so it belongs here.
# Runs its own --self-test first: a matcher that stopped matching would
# report OK while reading nothing.
- name: Org-less write declaration gate
run: pnpm check:orgless-write-declarations

# Every committed `pnpm --filter <name>` must name a real workspace
# package (#10853).
#
Expand Down
26 changes: 13 additions & 13 deletions content/docs/permissions/system-context.mdx
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -101,26 +101,26 @@ that silently does not happen.
| 12 | Per-request performance timings disclosed | observability | Get: timing headers a normal caller cannot pull | `perf-timing.ts:474` |
| 13 | Permission-set **overlay discard** skips the tenant-admin assertion | plugin-security | Get: an overlay can be discarded with no authenticated tenant administrator | `permission-set-overlay-discard.ts:142` |
| 14 | MCP stdio bridge skips the object API-exposure gate | mcp | Get: the bridge reaches objects whose `apiEnabled` / `apiMethods` would refuse an external caller | `stdio-data-bridge.ts:246` |
| 15 | **Read-audit rows are not written** | plugin-audit | Lose: the "a person opened this record" trail. `sudo()` keeps the caller's `userId`, so this flag is the only thing separating a human read from a platform one | `read-audit.ts:556` |
| 15 | **Read-audit rows are not written** | plugin-audit | Lose: the "a person opened this record" trail. `sudo()` keeps the caller's `userId`, so this flag is the only thing separating a human read from a platform one | `read-audit.ts:583` |
| 16 | Approval snapshot payload redaction skipped | plugin-approvals | Get: the whole snapshot on `find` / `findOne` — the audit/replay channel. Lose: field-visibility redaction over approval payloads | `payload-redaction-middleware.ts:115` |
| 17 | REST anonymous-deny seam satisfied | rest | Get: `enforceAuth` passes with no `userId`. Not reachable from the wire — `isSystem` is never set on an inbound request | `rest-server.ts:1552` |

### 2. Write pipeline and data integrity

| # | Behaviour when `isSystem` | Package | What you get / what you lose | Anchor |
|:--|:---|:---|:---|:---|
| 18 | **`readonly` strip bypassed — UPDATE, single row** | objectql | Get: a `readonly` field CAN be written. Lose: the protection that stops a caller seeding e.g. `approval_status` | `objectql/src/engine.ts:11289` |
| 19 | **`readonly` strip bypassed — UPDATE, bulk/predicate** | objectql | Same, on the multi-row path | `objectql/src/engine.ts:11472` |
| 20 | **`readonly` strip bypassed — INSERT (engine pass)** | objectql | Same, on create | `objectql/src/engine.ts:10024` |
| 18 | **`readonly` strip bypassed — UPDATE, single row** | objectql | Get: a `readonly` field CAN be written. Lose: the protection that stops a caller seeding e.g. `approval_status` | `objectql/src/engine.ts:11351` |
| 19 | **`readonly` strip bypassed — UPDATE, bulk/predicate** | objectql | Same, on the multi-row path | `objectql/src/engine.ts:11534` |
| 20 | **`readonly` strip bypassed — INSERT (engine pass)** | objectql | Same, on create | `objectql/src/engine.ts:10086` |
| 21 | **`readonly` strip bypassed — INSERT (protocol ingress)** | metadata-protocol | `isSystem` is the **only** exemption here. `preserveAudit` is deliberately not read on this path (#6640) — a non-system historical import is still stripped on create | `metadata-protocol/src/protocol.ts:1746` |
| 22 | Strict-drop refusal never fires | objectql | Lose: a caller that opted into loud refusal gets **silence** — strict refuses exactly what the strip would have taken, and the strip took nothing | `objectql/src/engine.ts:10072`, `readonly-strict-errors.ts:66` |
| 23 | **Referential-integrity check skipped** | objectql | Get: writes proceed against unreachable/unresolvable targets. Lose: an `isSystem` caller can write a **dangling reference** | `objectql/src/engine.ts:5891` |
| 24 | Tenant-audit warning silenced; `bypassTenantAudit` threaded to the driver | objectql | Get: unscoped system writes stop warning. Lose: the signal that would flag a genuine user-path scoping bug | `objectql/src/engine.ts:3735`, `:3745`, `:3772` |
| 22 | Strict-drop refusal never fires | objectql | Lose: a caller that opted into loud refusal gets **silence** — strict refuses exactly what the strip would have taken, and the strip took nothing | `objectql/src/engine.ts:10134`, `readonly-strict-errors.ts:66` |
| 23 | **Referential-integrity check skipped** | objectql | Get: writes proceed against unreachable/unresolvable targets. Lose: an `isSystem` caller can write a **dangling reference** | `objectql/src/engine.ts:5931` |
| 24 | Tenant-audit warning silenced; `bypassTenantAudit` threaded to the driver | objectql | Get: unscoped system writes stop warning. Lose: the signal that would flag a genuine user-path scoping bug | `objectql/src/engine.ts:3740`, `:3750`, `:3777` |
| 25 | Engine-owned / append-only write guard bypassed | plugin-security | Get: generic writes to `managedBy` engine-owned objects | `system-write-guard.ts:96`, `:120` |
| 26 | Identity write guard bypassed (ADR-0092) | plugin-auth | Get: direct writes to identity tables through the generic data path | `identity-write-guard.ts:98` |
| 27 | Search-companion column **kept** in a read's rows when it was explicitly requested | objectql | Get: the internal companion column is readable. Lose: nothing for app code — this is the engine reading its own index | `objectql/src/engine.ts:6589` |
| 28 | Dependent-count disclosure on a blocked delete | objectql | Get: the count of blocking children. Nothing was elevated past the caller, so nothing is withheld | `objectql/src/engine.ts:12084` |
| 29 | Reference-cleanup log attributes the write to `'system'` | objectql | Get: an honest actor label instead of `anonymous` when the context carries neither `userId` nor `actor` | `objectql/src/engine.ts:12013` |
| 27 | Search-companion column **kept** in a read's rows when it was explicitly requested | objectql | Get: the internal companion column is readable. Lose: nothing for app code — this is the engine reading its own index | `objectql/src/engine.ts:6629` |
| 28 | Dependent-count disclosure on a blocked delete | objectql | Get: the count of blocking children. Nothing was elevated past the caller, so nothing is withheld | `objectql/src/engine.ts:12146` |
| 29 | Reference-cleanup log attributes the write to `'system'` | objectql | Get: an honest actor label instead of `anonymous` when the context carries neither `userId` nor `actor` | `objectql/src/engine.ts:12075` |

### 3. Sharing (`plugin-sharing`)

Expand DownExpand Up@@ -179,8 +179,8 @@ a reader tracing where elevation travels needs them.

| # | Site | Package | What it does |
|:--|:---|:---|:---|
| 62 | `objectql/src/engine.ts:3542` | objectql | Propagates `isSystem` into the hook session so hooks can tell engine self-writes from user writes |
| 63 | `objectql/src/engine.ts:14433` | objectql | `ScopedContext.isSystem` getter — re-exposes the underlying execution context's flag |
| 62 | `objectql/src/engine.ts:3547` | objectql | Propagates `isSystem` into the hook session so hooks can tell engine self-writes from user writes |
| 63 | `objectql/src/engine.ts:14504` | objectql | `ScopedContext.isSystem` getter — re-exposes the underlying execution context's flag |
| 64 | `plugin-reports/src/report-service.ts:556` | plugin-reports | Threads the flag into the engine call that runs a report |
| 65 | `body-runner.ts:279` | runtime | Rebuilds an `ExecutionContext` from a hook session, carrying the flag across |

Expand All@@ -195,7 +195,7 @@ assuming `isSystem` covers it is a documented source of bugs.
|:---|:---|:---|
| "It suppresses triggers / record-change automation" | **No.** Only `skipTriggers` does. A bare `{ isSystem: true }` on a seed write re-fired automation on freshly seeded rows and wedged first boot | `metadata-protocol/src/seed-loader.ts:1971` (rationale at `:1881`–`1883`, #3760), `flow.zod.ts:702` |
| "It skips the state machine" | **No.** That is `skipStateMachine`, carried by seed replay and by `treatAsHistorical` imports | `objectql/src/engine.ts` FSM gate; see [State Machine](/docs/protocol/objectql/state-machine) |
| "It skips validation rules" | **No.** Field shape, `format`, `script` and the rest still run. The `readonly` strip runs *before* validation precisely so a discarded value is not judged | `objectql/src/engine.ts:10007`–`10024` |
| "It skips validation rules" | **No.** Field shape, `format`, `script` and the rest still run. The `readonly` strip runs *before* validation precisely so a discarded value is not judged | `objectql/src/engine.ts:10069`–`10086` |
| "It preserves a supplied `updated_at` / `updated_by`" | **No.** That is `preserveAudit`, a separate opt-in — and an UPDATE-path exemption only | `field.zod.ts:1537` (#3493 / #6640) |
| "It stamps `created_by`" | **No.** Audit stamping reads `userId` from the context. A user-less system write stamps nothing — that is today's behaviour, not an error | `runtime-identity.ts:280`–`281` |
| "It bypasses every guard" | **No.** The last-admin guard applies to **every** context, `isSystem` included — the deprovision path that actually locks an org out is the system one | `last-admin-guard.ts:299` |
Expand Down
3 changes: 2 additions & 1 deletion content/docs/references/api/contract.mdx
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -27,7 +27,7 @@ const result = ApiErrorSchema.parse(data);

| Property | Type | Required | Description |
| :--- | :--- | :--- | :--- |
| **code** | `Enum<'VALIDATION_ERROR' \| 'INVALID_FIELD' \| 'MISSING_REQUIRED_FIELD' \| 'INVALID_FORMAT' \| 'VALUE_TOO_LONG' \| 'VALUE_TOO_SHORT' \| 'VALUE_OUT_OF_RANGE' \| … +292 more>` | ✅ | Error code (e.g. VALIDATION_ERROR; StandardErrorCode ∪ the ledger the serving side registers — ERROR_CODE_LEDGER for framework packages) |
| **code** | `Enum<'VALIDATION_ERROR' \| 'INVALID_FIELD' \| 'MISSING_REQUIRED_FIELD' \| 'INVALID_FORMAT' \| 'VALUE_TOO_LONG' \| 'VALUE_TOO_SHORT' \| 'VALUE_OUT_OF_RANGE' \| … +293 more>` | ✅ | Error code (e.g. VALIDATION_ERROR; StandardErrorCode ∪ the ledger the serving side registers — ERROR_CODE_LEDGER for framework packages) |
| **declaredCode** | `string` | optional | The producer-declared code, verbatim, when it is not a member of the closed `code` vocabulary — the open, author-authored channel (app-specific spellings; ADR-0112) |
| **message** | `string` | ✅ | Readable error message |
| **userMessage** | `string` | optional | Producer-marked user-facing refusal text, verbatim. Present exactly when the producer opted in at throw time; consumers render it to end users and keep their generic substitution for anything unmarked. Status-agnostic; never replaces `message`. |
Expand DownExpand Up@@ -156,6 +156,7 @@ const result = ApiErrorSchema.parse(data);
* `ERR_FILE_CONSTRAINT`
* `ERR_FILE_REFERENCE_COPY`
* `ERR_HOOK_TARGET_REBIND`
* `ERR_ORGLESS_WRITE_DECLARATION_REFUSED`
* `ERR_READONLY_FIELD_REJECTED`
* `ERR_SUMMARY_RECOMPUTE`
* `ERR_SYSTEM_WRITE_ORGANIZATION_REQUIRED`
Expand Down
1 change: 1 addition & 0 deletions content/docs/references/api/error-code-ledger.mdx
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -272,6 +272,7 @@ const result = ErrorCode.parse(data);
* `ERR_FILE_CONSTRAINT`
* `ERR_FILE_REFERENCE_COPY`
* `ERR_HOOK_TARGET_REBIND`
* `ERR_ORGLESS_WRITE_DECLARATION_REFUSED`
* `ERR_READONLY_FIELD_REJECTED`
* `ERR_SUMMARY_RECOMPUTE`
* `ERR_SYSTEM_WRITE_ORGANIZATION_REQUIRED`
Expand Down
1 change: 1 addition & 0 deletions package.json
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -151,6 +151,7 @@
"check:resume-authority-declared": "node scripts/check-resume-authority-declared.mjs --self-test && node scripts/check-resume-authority-declared.mjs",
"check:spec-parsed-alias": "node scripts/check-spec-parsed-alias.mjs --self-test && node scripts/check-spec-parsed-alias.mjs",
"check:tenant-chokepoint": "node scripts/check-tenant-chokepoint.mjs --self-test && node scripts/check-tenant-chokepoint.mjs",
"check:orgless-write-declarations": "node scripts/check-orgless-write-declarations.mjs --self-test && node scripts/check-orgless-write-declarations.mjs",
"check:stall-guard": "node scripts/run-with-stall-guard.mjs --self-test",
"check:stall-guard-budget": "node scripts/check-stall-guard-budget.mjs --self-test && node scripts/check-stall-guard-budget.mjs",
"check:stall-guard-headroom": "node scripts/measure-stall-guard-headroom.mjs --self-test",
Expand Down
31 changes: 29 additions & 2 deletions packages/metadata-protocol/src/sys-metadata-repository.ts
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -191,7 +191,20 @@ export interface SysMetadataEngine {
insert(
table: string,
data: Record<string, unknown>,
options?: { context?: any },
options?: {
context?: any;
/**
* [#13636] The engine's per-write "these rows are legitimately org-less"
* declaration. Spelled structurally rather than imported: the canonical
* type is `OrgLessWriteDeclarationOptions` in
* `@objectstack/objectql`'s `tenancy/orgless-write-declaration.ts`, and
* THAT package depends on this one — importing it here would be a cycle.
* The engine validates every declaration against its ledger and throws on
* one it does not admit, so a drift between these two spellings fails
* loudly at the write rather than being tolerated.
*/
orgLessWrite?: { object: string; reason: string };
},
): Promise<{ id: string }>;
update(
table: string,
Expand DownExpand Up@@ -608,7 +621,21 @@ export class SysMetadataRepository implements MetadataRepository {
});
} else {
parentRowData.created_at = now;
await this.engine.insert('sys_metadata', parentRowData, { context: ctx });
// [#13636] An ENV-LEVEL repository writes `organization_id: null` on
// purpose — the #6190 option A population, a row that belongs to the
// installation rather than to any organization. `sys_metadata` is
// admitted as `conditional` in the engine's platform tenancy ledger, so
// without this declaration that write is indistinguishable from a
// forgotten stamp and is refused on a walled install. The condition is
// the repository's own scope, fixed at construction, not a property of
// the row being written — so an org-scoped repository never declares,
// and a missing stamp on ITS writes still refuses.
await this.engine.insert('sys_metadata', parentRowData, {
context: ctx,
...(this.organizationId == null
? { orgLessWrite: { object: 'sys_metadata', reason: 'env-level-metadata' } }
: {}),
});
}

// Durable history append — same transaction, so the parent write
Expand Down
Loading
Loading
, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Add copy buttons to all 
 blocks\n(function() {\n function addCopyButtons() {\n document.querySelectorAll('pre code').forEach(function(codeBlock) {\n if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;\n codeBlock.parentElement.setAttribute('data-copy-added', 'true');\n \n var btn = document.createElement('button');\n btn.textContent = 'Copy';\n btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';\n btn.onmouseover = function() { this.style.opacity = '1'; };\n btn.onmouseout = function() { this.style.opacity = '0.7'; };\n btn.onclick = function() {\n navigator.clipboard.writeText(codeBlock.textContent).then(function() {\n btn.textContent = 'Copied!';\n setTimeout(function() { btn.textContent = 'Copy'; }, 1500);\n });\n };\n codeBlock.parentElement.style.position = 'relative';\n codeBlock.parentElement.appendChild(btn);\n });\n }\n \n addCopyButtons();\n \n // Re-run on dynamic content\n var observer = new MutationObserver(addCopyButtons);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Add Copy Buttons to Code Blocks");
}
} catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
})();
(function(){
try {
var __m = "github.com";
var __re = new RegExp('^' + "github\\.com" + '

Skip to content
feat(objectql): declare a legitimately org-less write instead of inferring it from NULL#14923

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Closed

os-musk
wants to merge
10
commits into

from

 Closed


feat(objectql): declare a legitimately org-less write instead of inferring it from NULL
#14923
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


10 commits


Select commit
Hold shift + click to select a range
33df2b5

feat(objectql): declare a legitimately org-less write instead of infe…


claude Sep 3, 2026
d7b49cf

Merge remote-tracking branch 'origin/main' into claude/issue-13636-or…


claude Sep 3, 2026
9ef492f

fix(docs): re-anchor the system-context census line citations after t…


claude Sep 3, 2026
4c2da50

fix(#14923 review): respell the gate's bare-root literal, register th…


claude Sep 3, 2026
d126ae8

fix(docs): re-anchor the system-context census after this round's eng…


claude Sep 3, 2026
0ac778e

Merge remote-tracking branch 'origin/main' into claude/issue-13636-or…


claude Sep 3, 2026
f5d20ac

chore: regenerate the system-context census page on the merged tree


claude Sep 3, 2026
2cb2976

fix(objectql): move the tracker id off the orgless-write refusal message


claude Sep 3, 2026
6a60b04

Merge remote-tracking branch 'origin/main' into claude/issue-13636-or…


claude Sep 3, 2026
9dce213

fix(docs): repair system-context census anchor after merge conflict


claude Sep 3, 2026

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


47 changes: 47 additions & 0 deletions
.changeset/orgless-write-declaration-channel.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
---
"@objectstack/objectql": minor
"@objectstack/metadata-protocol": minor
"@objectstack/plugin-audit": minor
"@objectstack/plugin-auth": minor
"@objectstack/service-settings": minor
---

feat(objectql): an explicit per-write declaration for a legitimately org-less row

Until now one `NULL` organization on a platform object meant two different
things — a deliberate environment-level row, and a write that forgot to thread
an organization — and `resolveSystemInsertOrganization` had no way to tell them
apart. So the two objects that hold BOTH populations, `sys_metadata` (whose
non-overridable-type write lands env-wide by adjudication) and `sys_audit_log`
(whose writers enumerate their own legitimate org-less cases), had to stay
outside the tenant-audit control entirely. They are two of the largest write
populations in the platform namespace, which put the control's blind spot
exactly where it was least affordable.

Writes may now DECLARE that their rows belong to an adjudicated org-less
population:

```ts
await engine.insert('sys_metadata', row, {
 context: { isSystem: true },
 orgLessWrite: { object: 'sys_metadata', reason: 'env-level-metadata' },
});
```

The platform tenancy ledger gains a fourth verdict, `conditional`, and both
objects are admitted under it. ⚠️ Admission makes them STRICTER, not looser: an
org-less system write on either is now derived on a single-organization install
and refused loudly on a walled one, exactly as a `tenant-scoped` object's is,
and the declaration is the only way through. It is checked against the ledger
before anything else the resolver does, so a declaration naming an object the
ledger has not admitted, a reason that object does not admit, or an object other
than the one being written throws `ERR_ORGLESS_WRITE_DECLARATION_REFUSED` — no
spelling of the option is silently ignored, which is what separates a
declaration from a bypass flag. ⛔ It is not a way to quiet a refusal: a write
that simply forgot to thread an organization is the defect the refusal reports.

The platform's own six org-less writers declare, each on a test a reader can
check — the metadata repository on its own env-level scope, the audit writers on
whether the audited subject resolves an organization column at all. A new gate,
`pnpm check:orgless-write-declarations`, enumerates every declaration in the
tree, holds each to the same ledger the runtime does, and prints the count.

14 changes: 14 additions & 0 deletions
.github/workflows/lint.yml

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -3596,6 +3596,20 @@ jobs:
 - name: Read-side tenant chokepoint gate
 run: pnpm check:tenant-chokepoint

 # [#13636] The 'orgLessWrite' declaration census. The maintainer's
 # 2026-08-31 ruling put 'loud, checkable, countable' in the decision text
 # rather than in implementation notes; the engine discharges the first two
 # at the write, and this is the third — every declaration in the monorepo
 # enumerated, held to the same ledger the runtime holds it to, and COUNTED
 # on every pass. A declaration nobody can count is the silent marker that
 # ruling disqualified by name.
 #
 # Static scan over tracked sources, no build needed, so it belongs here.
 # Runs its own --self-test first: a matcher that stopped matching would
 # report OK while reading nothing.
 - name: Org-less write declaration gate
 run: pnpm check:orgless-write-declarations

 # Every committed `pnpm --filter <name>` must name a real workspace
 # package (#10853).
 #
Expand Down

26 changes: 13 additions & 13 deletions
content/docs/permissions/system-context.mdx

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -101,26 +101,26 @@ that silently does not happen.
| 12 | Per-request performance timings disclosed | observability | Get: timing headers a normal caller cannot pull | `perf-timing.ts:474` |
| 13 | Permission-set **overlay discard** skips the tenant-admin assertion | plugin-security | Get: an overlay can be discarded with no authenticated tenant administrator | `permission-set-overlay-discard.ts:142` |
| 14 | MCP stdio bridge skips the object API-exposure gate | mcp | Get: the bridge reaches objects whose `apiEnabled` / `apiMethods` would refuse an external caller | `stdio-data-bridge.ts:246` |
| 15 | **Read-audit rows are not written** | plugin-audit | Lose: the "a person opened this record" trail. `sudo()` keeps the caller's `userId`, so this flag is the only thing separating a human read from a platform one | `read-audit.ts:556` |
| 15 | **Read-audit rows are not written** | plugin-audit | Lose: the "a person opened this record" trail. `sudo()` keeps the caller's `userId`, so this flag is the only thing separating a human read from a platform one | `read-audit.ts:583` |
| 16 | Approval snapshot payload redaction skipped | plugin-approvals | Get: the whole snapshot on `find` / `findOne` — the audit/replay channel. Lose: field-visibility redaction over approval payloads | `payload-redaction-middleware.ts:115` |
| 17 | REST anonymous-deny seam satisfied | rest | Get: `enforceAuth` passes with no `userId`. Not reachable from the wire — `isSystem` is never set on an inbound request | `rest-server.ts:1552` |

### 2. Write pipeline and data integrity

| # | Behaviour when `isSystem` | Package | What you get / what you lose | Anchor |
|:--|:---|:---|:---|:---|
| 18 | **`readonly` strip bypassed — UPDATE, single row** | objectql | Get: a `readonly` field CAN be written. Lose: the protection that stops a caller seeding e.g. `approval_status` | `objectql/src/engine.ts:11289` |
| 19 | **`readonly` strip bypassed — UPDATE, bulk/predicate** | objectql | Same, on the multi-row path | `objectql/src/engine.ts:11472` |
| 20 | **`readonly` strip bypassed — INSERT (engine pass)** | objectql | Same, on create | `objectql/src/engine.ts:10024` |
| 18 | **`readonly` strip bypassed — UPDATE, single row** | objectql | Get: a `readonly` field CAN be written. Lose: the protection that stops a caller seeding e.g. `approval_status` | `objectql/src/engine.ts:11351` |
| 19 | **`readonly` strip bypassed — UPDATE, bulk/predicate** | objectql | Same, on the multi-row path | `objectql/src/engine.ts:11534` |
| 20 | **`readonly` strip bypassed — INSERT (engine pass)** | objectql | Same, on create | `objectql/src/engine.ts:10086` |
| 21 | **`readonly` strip bypassed — INSERT (protocol ingress)** | metadata-protocol | `isSystem` is the **only** exemption here. `preserveAudit` is deliberately not read on this path (#6640) — a non-system historical import is still stripped on create | `metadata-protocol/src/protocol.ts:1746` |
| 22 | Strict-drop refusal never fires | objectql | Lose: a caller that opted into loud refusal gets **silence** — strict refuses exactly what the strip would have taken, and the strip took nothing | `objectql/src/engine.ts:10072`, `readonly-strict-errors.ts:66` |
| 23 | **Referential-integrity check skipped** | objectql | Get: writes proceed against unreachable/unresolvable targets. Lose: an `isSystem` caller can write a **dangling reference** | `objectql/src/engine.ts:5891` |
| 24 | Tenant-audit warning silenced; `bypassTenantAudit` threaded to the driver | objectql | Get: unscoped system writes stop warning. Lose: the signal that would flag a genuine user-path scoping bug | `objectql/src/engine.ts:3735`, `:3745`, `:3772` |
| 22 | Strict-drop refusal never fires | objectql | Lose: a caller that opted into loud refusal gets **silence** — strict refuses exactly what the strip would have taken, and the strip took nothing | `objectql/src/engine.ts:10134`, `readonly-strict-errors.ts:66` |
| 23 | **Referential-integrity check skipped** | objectql | Get: writes proceed against unreachable/unresolvable targets. Lose: an `isSystem` caller can write a **dangling reference** | `objectql/src/engine.ts:5931` |
| 24 | Tenant-audit warning silenced; `bypassTenantAudit` threaded to the driver | objectql | Get: unscoped system writes stop warning. Lose: the signal that would flag a genuine user-path scoping bug | `objectql/src/engine.ts:3740`, `:3750`, `:3777` |
| 25 | Engine-owned / append-only write guard bypassed | plugin-security | Get: generic writes to `managedBy` engine-owned objects | `system-write-guard.ts:96`, `:120` |
| 26 | Identity write guard bypassed (ADR-0092) | plugin-auth | Get: direct writes to identity tables through the generic data path | `identity-write-guard.ts:98` |
| 27 | Search-companion column **kept** in a read's rows when it was explicitly requested | objectql | Get: the internal companion column is readable. Lose: nothing for app code — this is the engine reading its own index | `objectql/src/engine.ts:6589` |
| 28 | Dependent-count disclosure on a blocked delete | objectql | Get: the count of blocking children. Nothing was elevated past the caller, so nothing is withheld | `objectql/src/engine.ts:12084` |
| 29 | Reference-cleanup log attributes the write to `'system'` | objectql | Get: an honest actor label instead of `anonymous` when the context carries neither `userId` nor `actor` | `objectql/src/engine.ts:12013` |
| 27 | Search-companion column **kept** in a read's rows when it was explicitly requested | objectql | Get: the internal companion column is readable. Lose: nothing for app code — this is the engine reading its own index | `objectql/src/engine.ts:6629` |
| 28 | Dependent-count disclosure on a blocked delete | objectql | Get: the count of blocking children. Nothing was elevated past the caller, so nothing is withheld | `objectql/src/engine.ts:12146` |
| 29 | Reference-cleanup log attributes the write to `'system'` | objectql | Get: an honest actor label instead of `anonymous` when the context carries neither `userId` nor `actor` | `objectql/src/engine.ts:12075` |

### 3. Sharing (`plugin-sharing`)

Expand DownExpand Up@@ -179,8 +179,8 @@ a reader tracing where elevation travels needs them.

| # | Site | Package | What it does |
|:--|:---|:---|:---|
| 62 | `objectql/src/engine.ts:3542` | objectql | Propagates `isSystem` into the hook session so hooks can tell engine self-writes from user writes |
| 63 | `objectql/src/engine.ts:14433` | objectql | `ScopedContext.isSystem` getter — re-exposes the underlying execution context's flag |
| 62 | `objectql/src/engine.ts:3547` | objectql | Propagates `isSystem` into the hook session so hooks can tell engine self-writes from user writes |
| 63 | `objectql/src/engine.ts:14504` | objectql | `ScopedContext.isSystem` getter — re-exposes the underlying execution context's flag |
| 64 | `plugin-reports/src/report-service.ts:556` | plugin-reports | Threads the flag into the engine call that runs a report |
| 65 | `body-runner.ts:279` | runtime | Rebuilds an `ExecutionContext` from a hook session, carrying the flag across |

Expand All@@ -195,7 +195,7 @@ assuming `isSystem` covers it is a documented source of bugs.
|:---|:---|:---|
| "It suppresses triggers / record-change automation" | **No.** Only `skipTriggers` does. A bare `{ isSystem: true }` on a seed write re-fired automation on freshly seeded rows and wedged first boot | `metadata-protocol/src/seed-loader.ts:1971` (rationale at `:1881`–`1883`, #3760), `flow.zod.ts:702` |
| "It skips the state machine" | **No.** That is `skipStateMachine`, carried by seed replay and by `treatAsHistorical` imports | `objectql/src/engine.ts` FSM gate; see [State Machine](/docs/protocol/objectql/state-machine) |
| "It skips validation rules" | **No.** Field shape, `format`, `script` and the rest still run. The `readonly` strip runs *before* validation precisely so a discarded value is not judged | `objectql/src/engine.ts:10007`–`10024` |
| "It skips validation rules" | **No.** Field shape, `format`, `script` and the rest still run. The `readonly` strip runs *before* validation precisely so a discarded value is not judged | `objectql/src/engine.ts:10069`–`10086` |
| "It preserves a supplied `updated_at` / `updated_by`" | **No.** That is `preserveAudit`, a separate opt-in — and an UPDATE-path exemption only | `field.zod.ts:1537` (#3493 / #6640) |
| "It stamps `created_by`" | **No.** Audit stamping reads `userId` from the context. A user-less system write stamps nothing — that is today's behaviour, not an error | `runtime-identity.ts:280`–`281` |
| "It bypasses every guard" | **No.** The last-admin guard applies to **every** context, `isSystem` included — the deprovision path that actually locks an org out is the system one | `last-admin-guard.ts:299` |
Expand Down

3 changes: 2 additions & 1 deletion
content/docs/references/api/contract.mdx

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -27,7 +27,7 @@ const result = ApiErrorSchema.parse(data);

| Property | Type | Required | Description |
| :--- | :--- | :--- | :--- |
| **code** | `Enum<'VALIDATION_ERROR' \| 'INVALID_FIELD' \| 'MISSING_REQUIRED_FIELD' \| 'INVALID_FORMAT' \| 'VALUE_TOO_LONG' \| 'VALUE_TOO_SHORT' \| 'VALUE_OUT_OF_RANGE' \| … +292 more>` | ✅ | Error code (e.g. VALIDATION_ERROR; StandardErrorCode ∪ the ledger the serving side registers — ERROR_CODE_LEDGER for framework packages) |
| **code** | `Enum<'VALIDATION_ERROR' \| 'INVALID_FIELD' \| 'MISSING_REQUIRED_FIELD' \| 'INVALID_FORMAT' \| 'VALUE_TOO_LONG' \| 'VALUE_TOO_SHORT' \| 'VALUE_OUT_OF_RANGE' \| … +293 more>` | ✅ | Error code (e.g. VALIDATION_ERROR; StandardErrorCode ∪ the ledger the serving side registers — ERROR_CODE_LEDGER for framework packages) |
| **declaredCode** | `string` | optional | The producer-declared code, verbatim, when it is not a member of the closed `code` vocabulary — the open, author-authored channel (app-specific spellings; ADR-0112) |
| **message** | `string` | ✅ | Readable error message |
| **userMessage** | `string` | optional | Producer-marked user-facing refusal text, verbatim. Present exactly when the producer opted in at throw time; consumers render it to end users and keep their generic substitution for anything unmarked. Status-agnostic; never replaces `message`. |
Expand DownExpand Up@@ -156,6 +156,7 @@ const result = ApiErrorSchema.parse(data);
* `ERR_FILE_CONSTRAINT`
* `ERR_FILE_REFERENCE_COPY`
* `ERR_HOOK_TARGET_REBIND`
* `ERR_ORGLESS_WRITE_DECLARATION_REFUSED`
* `ERR_READONLY_FIELD_REJECTED`
* `ERR_SUMMARY_RECOMPUTE`
* `ERR_SYSTEM_WRITE_ORGANIZATION_REQUIRED`
Expand Down

1 change: 1 addition & 0 deletions
content/docs/references/api/error-code-ledger.mdx

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -272,6 +272,7 @@ const result = ErrorCode.parse(data);
* `ERR_FILE_CONSTRAINT`
* `ERR_FILE_REFERENCE_COPY`
* `ERR_HOOK_TARGET_REBIND`
* `ERR_ORGLESS_WRITE_DECLARATION_REFUSED`
* `ERR_READONLY_FIELD_REJECTED`
* `ERR_SUMMARY_RECOMPUTE`
* `ERR_SYSTEM_WRITE_ORGANIZATION_REQUIRED`
Expand Down

1 change: 1 addition & 0 deletions
package.json

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -151,6 +151,7 @@
 "check:resume-authority-declared": "node scripts/check-resume-authority-declared.mjs --self-test && node scripts/check-resume-authority-declared.mjs",
 "check:spec-parsed-alias": "node scripts/check-spec-parsed-alias.mjs --self-test && node scripts/check-spec-parsed-alias.mjs",
 "check:tenant-chokepoint": "node scripts/check-tenant-chokepoint.mjs --self-test && node scripts/check-tenant-chokepoint.mjs",
 "check:orgless-write-declarations": "node scripts/check-orgless-write-declarations.mjs --self-test && node scripts/check-orgless-write-declarations.mjs",
 "check:stall-guard": "node scripts/run-with-stall-guard.mjs --self-test",
 "check:stall-guard-budget": "node scripts/check-stall-guard-budget.mjs --self-test && node scripts/check-stall-guard-budget.mjs",
 "check:stall-guard-headroom": "node scripts/measure-stall-guard-headroom.mjs --self-test",
Expand Down

31 changes: 29 additions & 2 deletions
packages/metadata-protocol/src/sys-metadata-repository.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -191,7 +191,20 @@ export interface SysMetadataEngine {
 insert(
 table: string,
 data: Record<string, unknown>,
 options?: { context?: any },
 options?: {
 context?: any;
 /**
 * [#13636] The engine's per-write "these rows are legitimately org-less"
 * declaration. Spelled structurally rather than imported: the canonical
 * type is `OrgLessWriteDeclarationOptions` in
 * `@objectstack/objectql`'s `tenancy/orgless-write-declaration.ts`, and
 * THAT package depends on this one — importing it here would be a cycle.
 * The engine validates every declaration against its ledger and throws on
 * one it does not admit, so a drift between these two spellings fails
 * loudly at the write rather than being tolerated.
 */
 orgLessWrite?: { object: string; reason: string };
 },
 ): Promise<{ id: string }>;
 update(
 table: string,
Expand DownExpand Up@@ -608,7 +621,21 @@ export class SysMetadataRepository implements MetadataRepository {
 });
 } else {
 parentRowData.created_at = now;
 await this.engine.insert('sys_metadata', parentRowData, { context: ctx });
 // [#13636] An ENV-LEVEL repository writes `organization_id: null` on
 // purpose — the #6190 option A population, a row that belongs to the
 // installation rather than to any organization. `sys_metadata` is
 // admitted as `conditional` in the engine's platform tenancy ledger, so
 // without this declaration that write is indistinguishable from a
 // forgotten stamp and is refused on a walled install. The condition is
 // the repository's own scope, fixed at construction, not a property of
 // the row being written — so an org-scoped repository never declares,
 // and a missing stamp on ITS writes still refuses.
 await this.engine.insert('sys_metadata', parentRowData, {
 context: ctx,
 ...(this.organizationId == null
 ? { orgLessWrite: { object: 'sys_metadata', reason: 'env-level-metadata' } }
 : {}),
 });
 }

 // Durable history append — same transaction, so the parent write
Expand Down
Loading
Loading

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Force GitHub README to respect dark mode\n(function() {\n var style = document.createElement('style');\n style.textContent = '\n .markdown-body {\n color-scheme: dark light;\n }\n .markdown-body pre { background: #161b22 !important; }\n .markdown-body code { background: rgba(110, 118, 129, 0.4) !important; }\n .markdown-body table th, .markdown-body table td { border-color: #30363d !important; }\n .markdown-body img { background: #0d1117; }\n .markdown-body blockquote { border-left-color: #8b949e; }\n .markdown-body hr { border-color: #30363d; }\n ';\n document.head.appendChild(style);\n})();", "GitHub Dark Mode README Fix");
}
} catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
feat(objectql): declare a legitimately org-less write instead of inferring it from NULL#14923

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Closed

os-musk
wants to merge
10
commits into

from

 Closed


feat(objectql): declare a legitimately org-less write instead of inferring it from NULL
#14923
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


10 commits


Select commit
Hold shift + click to select a range
33df2b5

feat(objectql): declare a legitimately org-less write instead of infe…


claude Sep 3, 2026
d7b49cf

Merge remote-tracking branch 'origin/main' into claude/issue-13636-or…


claude Sep 3, 2026
9ef492f

fix(docs): re-anchor the system-context census line citations after t…


claude Sep 3, 2026
4c2da50

fix(#14923 review): respell the gate's bare-root literal, register th…


claude Sep 3, 2026
d126ae8

fix(docs): re-anchor the system-context census after this round's eng…


claude Sep 3, 2026
0ac778e

Merge remote-tracking branch 'origin/main' into claude/issue-13636-or…


claude Sep 3, 2026
f5d20ac

chore: regenerate the system-context census page on the merged tree


claude Sep 3, 2026
2cb2976

fix(objectql): move the tracker id off the orgless-write refusal message


claude Sep 3, 2026
6a60b04

Merge remote-tracking branch 'origin/main' into claude/issue-13636-or…


claude Sep 3, 2026
9dce213

fix(docs): repair system-context census anchor after merge conflict


claude Sep 3, 2026

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


47 changes: 47 additions & 0 deletions
.changeset/orgless-write-declaration-channel.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
---
"@objectstack/objectql": minor
"@objectstack/metadata-protocol": minor
"@objectstack/plugin-audit": minor
"@objectstack/plugin-auth": minor
"@objectstack/service-settings": minor
---

feat(objectql): an explicit per-write declaration for a legitimately org-less row

Until now one `NULL` organization on a platform object meant two different
things — a deliberate environment-level row, and a write that forgot to thread
an organization — and `resolveSystemInsertOrganization` had no way to tell them
apart. So the two objects that hold BOTH populations, `sys_metadata` (whose
non-overridable-type write lands env-wide by adjudication) and `sys_audit_log`
(whose writers enumerate their own legitimate org-less cases), had to stay
outside the tenant-audit control entirely. They are two of the largest write
populations in the platform namespace, which put the control's blind spot
exactly where it was least affordable.

Writes may now DECLARE that their rows belong to an adjudicated org-less
population:

```ts
await engine.insert('sys_metadata', row, {
 context: { isSystem: true },
 orgLessWrite: { object: 'sys_metadata', reason: 'env-level-metadata' },
});
```

The platform tenancy ledger gains a fourth verdict, `conditional`, and both
objects are admitted under it. ⚠️ Admission makes them STRICTER, not looser: an
org-less system write on either is now derived on a single-organization install
and refused loudly on a walled one, exactly as a `tenant-scoped` object's is,
and the declaration is the only way through. It is checked against the ledger
before anything else the resolver does, so a declaration naming an object the
ledger has not admitted, a reason that object does not admit, or an object other
than the one being written throws `ERR_ORGLESS_WRITE_DECLARATION_REFUSED` — no
spelling of the option is silently ignored, which is what separates a
declaration from a bypass flag. ⛔ It is not a way to quiet a refusal: a write
that simply forgot to thread an organization is the defect the refusal reports.

The platform's own six org-less writers declare, each on a test a reader can
check — the metadata repository on its own env-level scope, the audit writers on
whether the audited subject resolves an organization column at all. A new gate,
`pnpm check:orgless-write-declarations`, enumerates every declaration in the
tree, holds each to the same ledger the runtime does, and prints the count.

14 changes: 14 additions & 0 deletions
.github/workflows/lint.yml

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -3596,6 +3596,20 @@ jobs:
 - name: Read-side tenant chokepoint gate
 run: pnpm check:tenant-chokepoint

 # [#13636] The 'orgLessWrite' declaration census. The maintainer's
 # 2026-08-31 ruling put 'loud, checkable, countable' in the decision text
 # rather than in implementation notes; the engine discharges the first two
 # at the write, and this is the third — every declaration in the monorepo
 # enumerated, held to the same ledger the runtime holds it to, and COUNTED
 # on every pass. A declaration nobody can count is the silent marker that
 # ruling disqualified by name.
 #
 # Static scan over tracked sources, no build needed, so it belongs here.
 # Runs its own --self-test first: a matcher that stopped matching would
 # report OK while reading nothing.
 - name: Org-less write declaration gate
 run: pnpm check:orgless-write-declarations

 # Every committed `pnpm --filter <name>` must name a real workspace
 # package (#10853).
 #
Expand Down

26 changes: 13 additions & 13 deletions
content/docs/permissions/system-context.mdx

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -101,26 +101,26 @@ that silently does not happen.
| 12 | Per-request performance timings disclosed | observability | Get: timing headers a normal caller cannot pull | `perf-timing.ts:474` |
| 13 | Permission-set **overlay discard** skips the tenant-admin assertion | plugin-security | Get: an overlay can be discarded with no authenticated tenant administrator | `permission-set-overlay-discard.ts:142` |
| 14 | MCP stdio bridge skips the object API-exposure gate | mcp | Get: the bridge reaches objects whose `apiEnabled` / `apiMethods` would refuse an external caller | `stdio-data-bridge.ts:246` |
| 15 | **Read-audit rows are not written** | plugin-audit | Lose: the "a person opened this record" trail. `sudo()` keeps the caller's `userId`, so this flag is the only thing separating a human read from a platform one | `read-audit.ts:556` |
| 15 | **Read-audit rows are not written** | plugin-audit | Lose: the "a person opened this record" trail. `sudo()` keeps the caller's `userId`, so this flag is the only thing separating a human read from a platform one | `read-audit.ts:583` |
| 16 | Approval snapshot payload redaction skipped | plugin-approvals | Get: the whole snapshot on `find` / `findOne` — the audit/replay channel. Lose: field-visibility redaction over approval payloads | `payload-redaction-middleware.ts:115` |
| 17 | REST anonymous-deny seam satisfied | rest | Get: `enforceAuth` passes with no `userId`. Not reachable from the wire — `isSystem` is never set on an inbound request | `rest-server.ts:1552` |

### 2. Write pipeline and data integrity

| # | Behaviour when `isSystem` | Package | What you get / what you lose | Anchor |
|:--|:---|:---|:---|:---|
| 18 | **`readonly` strip bypassed — UPDATE, single row** | objectql | Get: a `readonly` field CAN be written. Lose: the protection that stops a caller seeding e.g. `approval_status` | `objectql/src/engine.ts:11289` |
| 19 | **`readonly` strip bypassed — UPDATE, bulk/predicate** | objectql | Same, on the multi-row path | `objectql/src/engine.ts:11472` |
| 20 | **`readonly` strip bypassed — INSERT (engine pass)** | objectql | Same, on create | `objectql/src/engine.ts:10024` |
| 18 | **`readonly` strip bypassed — UPDATE, single row** | objectql | Get: a `readonly` field CAN be written. Lose: the protection that stops a caller seeding e.g. `approval_status` | `objectql/src/engine.ts:11351` |
| 19 | **`readonly` strip bypassed — UPDATE, bulk/predicate** | objectql | Same, on the multi-row path | `objectql/src/engine.ts:11534` |
| 20 | **`readonly` strip bypassed — INSERT (engine pass)** | objectql | Same, on create | `objectql/src/engine.ts:10086` |
| 21 | **`readonly` strip bypassed — INSERT (protocol ingress)** | metadata-protocol | `isSystem` is the **only** exemption here. `preserveAudit` is deliberately not read on this path (#6640) — a non-system historical import is still stripped on create | `metadata-protocol/src/protocol.ts:1746` |
| 22 | Strict-drop refusal never fires | objectql | Lose: a caller that opted into loud refusal gets **silence** — strict refuses exactly what the strip would have taken, and the strip took nothing | `objectql/src/engine.ts:10072`, `readonly-strict-errors.ts:66` |
| 23 | **Referential-integrity check skipped** | objectql | Get: writes proceed against unreachable/unresolvable targets. Lose: an `isSystem` caller can write a **dangling reference** | `objectql/src/engine.ts:5891` |
| 24 | Tenant-audit warning silenced; `bypassTenantAudit` threaded to the driver | objectql | Get: unscoped system writes stop warning. Lose: the signal that would flag a genuine user-path scoping bug | `objectql/src/engine.ts:3735`, `:3745`, `:3772` |
| 22 | Strict-drop refusal never fires | objectql | Lose: a caller that opted into loud refusal gets **silence** — strict refuses exactly what the strip would have taken, and the strip took nothing | `objectql/src/engine.ts:10134`, `readonly-strict-errors.ts:66` |
| 23 | **Referential-integrity check skipped** | objectql | Get: writes proceed against unreachable/unresolvable targets. Lose: an `isSystem` caller can write a **dangling reference** | `objectql/src/engine.ts:5931` |
| 24 | Tenant-audit warning silenced; `bypassTenantAudit` threaded to the driver | objectql | Get: unscoped system writes stop warning. Lose: the signal that would flag a genuine user-path scoping bug | `objectql/src/engine.ts:3740`, `:3750`, `:3777` |
| 25 | Engine-owned / append-only write guard bypassed | plugin-security | Get: generic writes to `managedBy` engine-owned objects | `system-write-guard.ts:96`, `:120` |
| 26 | Identity write guard bypassed (ADR-0092) | plugin-auth | Get: direct writes to identity tables through the generic data path | `identity-write-guard.ts:98` |
| 27 | Search-companion column **kept** in a read's rows when it was explicitly requested | objectql | Get: the internal companion column is readable. Lose: nothing for app code — this is the engine reading its own index | `objectql/src/engine.ts:6589` |
| 28 | Dependent-count disclosure on a blocked delete | objectql | Get: the count of blocking children. Nothing was elevated past the caller, so nothing is withheld | `objectql/src/engine.ts:12084` |
| 29 | Reference-cleanup log attributes the write to `'system'` | objectql | Get: an honest actor label instead of `anonymous` when the context carries neither `userId` nor `actor` | `objectql/src/engine.ts:12013` |
| 27 | Search-companion column **kept** in a read's rows when it was explicitly requested | objectql | Get: the internal companion column is readable. Lose: nothing for app code — this is the engine reading its own index | `objectql/src/engine.ts:6629` |
| 28 | Dependent-count disclosure on a blocked delete | objectql | Get: the count of blocking children. Nothing was elevated past the caller, so nothing is withheld | `objectql/src/engine.ts:12146` |
| 29 | Reference-cleanup log attributes the write to `'system'` | objectql | Get: an honest actor label instead of `anonymous` when the context carries neither `userId` nor `actor` | `objectql/src/engine.ts:12075` |

### 3. Sharing (`plugin-sharing`)

Expand DownExpand Up@@ -179,8 +179,8 @@ a reader tracing where elevation travels needs them.

| # | Site | Package | What it does |
|:--|:---|:---|:---|
| 62 | `objectql/src/engine.ts:3542` | objectql | Propagates `isSystem` into the hook session so hooks can tell engine self-writes from user writes |
| 63 | `objectql/src/engine.ts:14433` | objectql | `ScopedContext.isSystem` getter — re-exposes the underlying execution context's flag |
| 62 | `objectql/src/engine.ts:3547` | objectql | Propagates `isSystem` into the hook session so hooks can tell engine self-writes from user writes |
| 63 | `objectql/src/engine.ts:14504` | objectql | `ScopedContext.isSystem` getter — re-exposes the underlying execution context's flag |
| 64 | `plugin-reports/src/report-service.ts:556` | plugin-reports | Threads the flag into the engine call that runs a report |
| 65 | `body-runner.ts:279` | runtime | Rebuilds an `ExecutionContext` from a hook session, carrying the flag across |

Expand All@@ -195,7 +195,7 @@ assuming `isSystem` covers it is a documented source of bugs.
|:---|:---|:---|
| "It suppresses triggers / record-change automation" | **No.** Only `skipTriggers` does. A bare `{ isSystem: true }` on a seed write re-fired automation on freshly seeded rows and wedged first boot | `metadata-protocol/src/seed-loader.ts:1971` (rationale at `:1881`–`1883`, #3760), `flow.zod.ts:702` |
| "It skips the state machine" | **No.** That is `skipStateMachine`, carried by seed replay and by `treatAsHistorical` imports | `objectql/src/engine.ts` FSM gate; see [State Machine](/docs/protocol/objectql/state-machine) |
| "It skips validation rules" | **No.** Field shape, `format`, `script` and the rest still run. The `readonly` strip runs *before* validation precisely so a discarded value is not judged | `objectql/src/engine.ts:10007`–`10024` |
| "It skips validation rules" | **No.** Field shape, `format`, `script` and the rest still run. The `readonly` strip runs *before* validation precisely so a discarded value is not judged | `objectql/src/engine.ts:10069`–`10086` |
| "It preserves a supplied `updated_at` / `updated_by`" | **No.** That is `preserveAudit`, a separate opt-in — and an UPDATE-path exemption only | `field.zod.ts:1537` (#3493 / #6640) |
| "It stamps `created_by`" | **No.** Audit stamping reads `userId` from the context. A user-less system write stamps nothing — that is today's behaviour, not an error | `runtime-identity.ts:280`–`281` |
| "It bypasses every guard" | **No.** The last-admin guard applies to **every** context, `isSystem` included — the deprovision path that actually locks an org out is the system one | `last-admin-guard.ts:299` |
Expand Down

3 changes: 2 additions & 1 deletion
content/docs/references/api/contract.mdx

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -27,7 +27,7 @@ const result = ApiErrorSchema.parse(data);

| Property | Type | Required | Description |
| :--- | :--- | :--- | :--- |
| **code** | `Enum<'VALIDATION_ERROR' \| 'INVALID_FIELD' \| 'MISSING_REQUIRED_FIELD' \| 'INVALID_FORMAT' \| 'VALUE_TOO_LONG' \| 'VALUE_TOO_SHORT' \| 'VALUE_OUT_OF_RANGE' \| … +292 more>` | ✅ | Error code (e.g. VALIDATION_ERROR; StandardErrorCode ∪ the ledger the serving side registers — ERROR_CODE_LEDGER for framework packages) |
| **code** | `Enum<'VALIDATION_ERROR' \| 'INVALID_FIELD' \| 'MISSING_REQUIRED_FIELD' \| 'INVALID_FORMAT' \| 'VALUE_TOO_LONG' \| 'VALUE_TOO_SHORT' \| 'VALUE_OUT_OF_RANGE' \| … +293 more>` | ✅ | Error code (e.g. VALIDATION_ERROR; StandardErrorCode ∪ the ledger the serving side registers — ERROR_CODE_LEDGER for framework packages) |
| **declaredCode** | `string` | optional | The producer-declared code, verbatim, when it is not a member of the closed `code` vocabulary — the open, author-authored channel (app-specific spellings; ADR-0112) |
| **message** | `string` | ✅ | Readable error message |
| **userMessage** | `string` | optional | Producer-marked user-facing refusal text, verbatim. Present exactly when the producer opted in at throw time; consumers render it to end users and keep their generic substitution for anything unmarked. Status-agnostic; never replaces `message`. |
Expand DownExpand Up@@ -156,6 +156,7 @@ const result = ApiErrorSchema.parse(data);
* `ERR_FILE_CONSTRAINT`
* `ERR_FILE_REFERENCE_COPY`
* `ERR_HOOK_TARGET_REBIND`
* `ERR_ORGLESS_WRITE_DECLARATION_REFUSED`
* `ERR_READONLY_FIELD_REJECTED`
* `ERR_SUMMARY_RECOMPUTE`
* `ERR_SYSTEM_WRITE_ORGANIZATION_REQUIRED`
Expand Down

1 change: 1 addition & 0 deletions
content/docs/references/api/error-code-ledger.mdx

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -272,6 +272,7 @@ const result = ErrorCode.parse(data);
* `ERR_FILE_CONSTRAINT`
* `ERR_FILE_REFERENCE_COPY`
* `ERR_HOOK_TARGET_REBIND`
* `ERR_ORGLESS_WRITE_DECLARATION_REFUSED`
* `ERR_READONLY_FIELD_REJECTED`
* `ERR_SUMMARY_RECOMPUTE`
* `ERR_SYSTEM_WRITE_ORGANIZATION_REQUIRED`
Expand Down

1 change: 1 addition & 0 deletions
package.json

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -151,6 +151,7 @@
 "check:resume-authority-declared": "node scripts/check-resume-authority-declared.mjs --self-test && node scripts/check-resume-authority-declared.mjs",
 "check:spec-parsed-alias": "node scripts/check-spec-parsed-alias.mjs --self-test && node scripts/check-spec-parsed-alias.mjs",
 "check:tenant-chokepoint": "node scripts/check-tenant-chokepoint.mjs --self-test && node scripts/check-tenant-chokepoint.mjs",
 "check:orgless-write-declarations": "node scripts/check-orgless-write-declarations.mjs --self-test && node scripts/check-orgless-write-declarations.mjs",
 "check:stall-guard": "node scripts/run-with-stall-guard.mjs --self-test",
 "check:stall-guard-budget": "node scripts/check-stall-guard-budget.mjs --self-test && node scripts/check-stall-guard-budget.mjs",
 "check:stall-guard-headroom": "node scripts/measure-stall-guard-headroom.mjs --self-test",
Expand Down

31 changes: 29 additions & 2 deletions
packages/metadata-protocol/src/sys-metadata-repository.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -191,7 +191,20 @@ export interface SysMetadataEngine {
 insert(
 table: string,
 data: Record<string, unknown>,
 options?: { context?: any },
 options?: {
 context?: any;
 /**
 * [#13636] The engine's per-write "these rows are legitimately org-less"
 * declaration. Spelled structurally rather than imported: the canonical
 * type is `OrgLessWriteDeclarationOptions` in
 * `@objectstack/objectql`'s `tenancy/orgless-write-declaration.ts`, and
 * THAT package depends on this one — importing it here would be a cycle.
 * The engine validates every declaration against its ledger and throws on
 * one it does not admit, so a drift between these two spellings fails
 * loudly at the write rather than being tolerated.
 */
 orgLessWrite?: { object: string; reason: string };
 },
 ): Promise<{ id: string }>;
 update(
 table: string,
Expand DownExpand Up@@ -608,7 +621,21 @@ export class SysMetadataRepository implements MetadataRepository {
 });
 } else {
 parentRowData.created_at = now;
 await this.engine.insert('sys_metadata', parentRowData, { context: ctx });
 // [#13636] An ENV-LEVEL repository writes `organization_id: null` on
 // purpose — the #6190 option A population, a row that belongs to the
 // installation rather than to any organization. `sys_metadata` is
 // admitted as `conditional` in the engine's platform tenancy ledger, so
 // without this declaration that write is indistinguishable from a
 // forgotten stamp and is refused on a walled install. The condition is
 // the repository's own scope, fixed at construction, not a property of
 // the row being written — so an org-scoped repository never declares,
 // and a missing stamp on ITS writes still refuses.
 await this.engine.insert('sys_metadata', parentRowData, {
 context: ctx,
 ...(this.organizationId == null
 ? { orgLessWrite: { object: 'sys_metadata', reason: 'env-level-metadata' } }
 : {}),
 });
 }

 // Durable history append — same transaction, so the parent write
Expand Down
Loading
Loading

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Highlight search terms from Google/DuckDuckGo/Bing referrer\n(function() {\n var ref = document.referrer;\n var terms = [];\n \n if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) {\n var url = new URL(ref);\n var q = url.searchParams.get('q') || url.searchParams.get('p');\n if (q) {\n terms = q.split(/\\s+/).filter(function(t) { return t.length > 2; });\n }\n }\n \n if (terms.length === 0) return;\n \n var style = document.createElement('style');\n style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }';\n document.head.appendChild(style);\n \n function highlight(node) {\n if (node.nodeType === 3) { // text node\n var text = node.textContent;\n var found = false;\n terms.forEach(function(term) {\n var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\') + ')', 'gi');\n if (regex.test(text)) {\n found = true;\n var frag = document.createDocumentFragment();\n var parts = text.split(regex);\n parts.forEach(function(part, i) {\n if (i % 2 === 0) {\n frag.appendChild(document.createTextNode(part));\n } else {\n var span = document.createElement('span');\n span.className = 'userscript-highlight';\n span.textContent = part;\n frag.appendChild(span);\n }\n });\n node.parentNode.replaceChild(frag, node);\n }\n });\n } else if (node.nodeType === 1 && node.childNodes) { // element\n var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT'];\n if (!skipTags.includes(node.tagName)) {\n Array.from(node.childNodes).forEach(highlight);\n }\n }\n }\n \n highlight(document.body);\n \n // Re-highlight on dynamic content\n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1 || node.nodeType === 3) highlight(node);\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Highlight Search Terms");
}
} catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
feat(objectql): declare a legitimately org-less write instead of inferring it from NULL#14923

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Closed

os-musk
wants to merge
10
commits into

from

 Closed


feat(objectql): declare a legitimately org-less write instead of inferring it from NULL
#14923
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


10 commits


Select commit
Hold shift + click to select a range
33df2b5

feat(objectql): declare a legitimately org-less write instead of infe…


claude Sep 3, 2026
d7b49cf

Merge remote-tracking branch 'origin/main' into claude/issue-13636-or…


claude Sep 3, 2026
9ef492f

fix(docs): re-anchor the system-context census line citations after t…


claude Sep 3, 2026
4c2da50

fix(#14923 review): respell the gate's bare-root literal, register th…


claude Sep 3, 2026
d126ae8

fix(docs): re-anchor the system-context census after this round's eng…


claude Sep 3, 2026
0ac778e

Merge remote-tracking branch 'origin/main' into claude/issue-13636-or…


claude Sep 3, 2026
f5d20ac

chore: regenerate the system-context census page on the merged tree


claude Sep 3, 2026
2cb2976

fix(objectql): move the tracker id off the orgless-write refusal message


claude Sep 3, 2026
6a60b04

Merge remote-tracking branch 'origin/main' into claude/issue-13636-or…


claude Sep 3, 2026
9dce213

fix(docs): repair system-context census anchor after merge conflict


claude Sep 3, 2026

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


47 changes: 47 additions & 0 deletions
.changeset/orgless-write-declaration-channel.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
---
"@objectstack/objectql": minor
"@objectstack/metadata-protocol": minor
"@objectstack/plugin-audit": minor
"@objectstack/plugin-auth": minor
"@objectstack/service-settings": minor
---

feat(objectql): an explicit per-write declaration for a legitimately org-less row

Until now one `NULL` organization on a platform object meant two different
things — a deliberate environment-level row, and a write that forgot to thread
an organization — and `resolveSystemInsertOrganization` had no way to tell them
apart. So the two objects that hold BOTH populations, `sys_metadata` (whose
non-overridable-type write lands env-wide by adjudication) and `sys_audit_log`
(whose writers enumerate their own legitimate org-less cases), had to stay
outside the tenant-audit control entirely. They are two of the largest write
populations in the platform namespace, which put the control's blind spot
exactly where it was least affordable.

Writes may now DECLARE that their rows belong to an adjudicated org-less
population:

```ts
await engine.insert('sys_metadata', row, {
 context: { isSystem: true },
 orgLessWrite: { object: 'sys_metadata', reason: 'env-level-metadata' },
});
```

The platform tenancy ledger gains a fourth verdict, `conditional`, and both
objects are admitted under it. ⚠️ Admission makes them STRICTER, not looser: an
org-less system write on either is now derived on a single-organization install
and refused loudly on a walled one, exactly as a `tenant-scoped` object's is,
and the declaration is the only way through. It is checked against the ledger
before anything else the resolver does, so a declaration naming an object the
ledger has not admitted, a reason that object does not admit, or an object other
than the one being written throws `ERR_ORGLESS_WRITE_DECLARATION_REFUSED` — no
spelling of the option is silently ignored, which is what separates a
declaration from a bypass flag. ⛔ It is not a way to quiet a refusal: a write
that simply forgot to thread an organization is the defect the refusal reports.

The platform's own six org-less writers declare, each on a test a reader can
check — the metadata repository on its own env-level scope, the audit writers on
whether the audited subject resolves an organization column at all. A new gate,
`pnpm check:orgless-write-declarations`, enumerates every declaration in the
tree, holds each to the same ledger the runtime does, and prints the count.

14 changes: 14 additions & 0 deletions
.github/workflows/lint.yml

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -3596,6 +3596,20 @@ jobs:
 - name: Read-side tenant chokepoint gate
 run: pnpm check:tenant-chokepoint

 # [#13636] The 'orgLessWrite' declaration census. The maintainer's
 # 2026-08-31 ruling put 'loud, checkable, countable' in the decision text
 # rather than in implementation notes; the engine discharges the first two
 # at the write, and this is the third — every declaration in the monorepo
 # enumerated, held to the same ledger the runtime holds it to, and COUNTED
 # on every pass. A declaration nobody can count is the silent marker that
 # ruling disqualified by name.
 #
 # Static scan over tracked sources, no build needed, so it belongs here.
 # Runs its own --self-test first: a matcher that stopped matching would
 # report OK while reading nothing.
 - name: Org-less write declaration gate
 run: pnpm check:orgless-write-declarations

 # Every committed `pnpm --filter <name>` must name a real workspace
 # package (#10853).
 #
Expand Down

26 changes: 13 additions & 13 deletions
content/docs/permissions/system-context.mdx

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -101,26 +101,26 @@ that silently does not happen.
| 12 | Per-request performance timings disclosed | observability | Get: timing headers a normal caller cannot pull | `perf-timing.ts:474` |
| 13 | Permission-set **overlay discard** skips the tenant-admin assertion | plugin-security | Get: an overlay can be discarded with no authenticated tenant administrator | `permission-set-overlay-discard.ts:142` |
| 14 | MCP stdio bridge skips the object API-exposure gate | mcp | Get: the bridge reaches objects whose `apiEnabled` / `apiMethods` would refuse an external caller | `stdio-data-bridge.ts:246` |
| 15 | **Read-audit rows are not written** | plugin-audit | Lose: the "a person opened this record" trail. `sudo()` keeps the caller's `userId`, so this flag is the only thing separating a human read from a platform one | `read-audit.ts:556` |
| 15 | **Read-audit rows are not written** | plugin-audit | Lose: the "a person opened this record" trail. `sudo()` keeps the caller's `userId`, so this flag is the only thing separating a human read from a platform one | `read-audit.ts:583` |
| 16 | Approval snapshot payload redaction skipped | plugin-approvals | Get: the whole snapshot on `find` / `findOne` — the audit/replay channel. Lose: field-visibility redaction over approval payloads | `payload-redaction-middleware.ts:115` |
| 17 | REST anonymous-deny seam satisfied | rest | Get: `enforceAuth` passes with no `userId`. Not reachable from the wire — `isSystem` is never set on an inbound request | `rest-server.ts:1552` |

### 2. Write pipeline and data integrity

| # | Behaviour when `isSystem` | Package | What you get / what you lose | Anchor |
|:--|:---|:---|:---|:---|
| 18 | **`readonly` strip bypassed — UPDATE, single row** | objectql | Get: a `readonly` field CAN be written. Lose: the protection that stops a caller seeding e.g. `approval_status` | `objectql/src/engine.ts:11289` |
| 19 | **`readonly` strip bypassed — UPDATE, bulk/predicate** | objectql | Same, on the multi-row path | `objectql/src/engine.ts:11472` |
| 20 | **`readonly` strip bypassed — INSERT (engine pass)** | objectql | Same, on create | `objectql/src/engine.ts:10024` |
| 18 | **`readonly` strip bypassed — UPDATE, single row** | objectql | Get: a `readonly` field CAN be written. Lose: the protection that stops a caller seeding e.g. `approval_status` | `objectql/src/engine.ts:11351` |
| 19 | **`readonly` strip bypassed — UPDATE, bulk/predicate** | objectql | Same, on the multi-row path | `objectql/src/engine.ts:11534` |
| 20 | **`readonly` strip bypassed — INSERT (engine pass)** | objectql | Same, on create | `objectql/src/engine.ts:10086` |
| 21 | **`readonly` strip bypassed — INSERT (protocol ingress)** | metadata-protocol | `isSystem` is the **only** exemption here. `preserveAudit` is deliberately not read on this path (#6640) — a non-system historical import is still stripped on create | `metadata-protocol/src/protocol.ts:1746` |
| 22 | Strict-drop refusal never fires | objectql | Lose: a caller that opted into loud refusal gets **silence** — strict refuses exactly what the strip would have taken, and the strip took nothing | `objectql/src/engine.ts:10072`, `readonly-strict-errors.ts:66` |
| 23 | **Referential-integrity check skipped** | objectql | Get: writes proceed against unreachable/unresolvable targets. Lose: an `isSystem` caller can write a **dangling reference** | `objectql/src/engine.ts:5891` |
| 24 | Tenant-audit warning silenced; `bypassTenantAudit` threaded to the driver | objectql | Get: unscoped system writes stop warning. Lose: the signal that would flag a genuine user-path scoping bug | `objectql/src/engine.ts:3735`, `:3745`, `:3772` |
| 22 | Strict-drop refusal never fires | objectql | Lose: a caller that opted into loud refusal gets **silence** — strict refuses exactly what the strip would have taken, and the strip took nothing | `objectql/src/engine.ts:10134`, `readonly-strict-errors.ts:66` |
| 23 | **Referential-integrity check skipped** | objectql | Get: writes proceed against unreachable/unresolvable targets. Lose: an `isSystem` caller can write a **dangling reference** | `objectql/src/engine.ts:5931` |
| 24 | Tenant-audit warning silenced; `bypassTenantAudit` threaded to the driver | objectql | Get: unscoped system writes stop warning. Lose: the signal that would flag a genuine user-path scoping bug | `objectql/src/engine.ts:3740`, `:3750`, `:3777` |
| 25 | Engine-owned / append-only write guard bypassed | plugin-security | Get: generic writes to `managedBy` engine-owned objects | `system-write-guard.ts:96`, `:120` |
| 26 | Identity write guard bypassed (ADR-0092) | plugin-auth | Get: direct writes to identity tables through the generic data path | `identity-write-guard.ts:98` |
| 27 | Search-companion column **kept** in a read's rows when it was explicitly requested | objectql | Get: the internal companion column is readable. Lose: nothing for app code — this is the engine reading its own index | `objectql/src/engine.ts:6589` |
| 28 | Dependent-count disclosure on a blocked delete | objectql | Get: the count of blocking children. Nothing was elevated past the caller, so nothing is withheld | `objectql/src/engine.ts:12084` |
| 29 | Reference-cleanup log attributes the write to `'system'` | objectql | Get: an honest actor label instead of `anonymous` when the context carries neither `userId` nor `actor` | `objectql/src/engine.ts:12013` |
| 27 | Search-companion column **kept** in a read's rows when it was explicitly requested | objectql | Get: the internal companion column is readable. Lose: nothing for app code — this is the engine reading its own index | `objectql/src/engine.ts:6629` |
| 28 | Dependent-count disclosure on a blocked delete | objectql | Get: the count of blocking children. Nothing was elevated past the caller, so nothing is withheld | `objectql/src/engine.ts:12146` |
| 29 | Reference-cleanup log attributes the write to `'system'` | objectql | Get: an honest actor label instead of `anonymous` when the context carries neither `userId` nor `actor` | `objectql/src/engine.ts:12075` |

### 3. Sharing (`plugin-sharing`)

Expand DownExpand Up@@ -179,8 +179,8 @@ a reader tracing where elevation travels needs them.

| # | Site | Package | What it does |
|:--|:---|:---|:---|
| 62 | `objectql/src/engine.ts:3542` | objectql | Propagates `isSystem` into the hook session so hooks can tell engine self-writes from user writes |
| 63 | `objectql/src/engine.ts:14433` | objectql | `ScopedContext.isSystem` getter — re-exposes the underlying execution context's flag |
| 62 | `objectql/src/engine.ts:3547` | objectql | Propagates `isSystem` into the hook session so hooks can tell engine self-writes from user writes |
| 63 | `objectql/src/engine.ts:14504` | objectql | `ScopedContext.isSystem` getter — re-exposes the underlying execution context's flag |
| 64 | `plugin-reports/src/report-service.ts:556` | plugin-reports | Threads the flag into the engine call that runs a report |
| 65 | `body-runner.ts:279` | runtime | Rebuilds an `ExecutionContext` from a hook session, carrying the flag across |

Expand All@@ -195,7 +195,7 @@ assuming `isSystem` covers it is a documented source of bugs.
|:---|:---|:---|
| "It suppresses triggers / record-change automation" | **No.** Only `skipTriggers` does. A bare `{ isSystem: true }` on a seed write re-fired automation on freshly seeded rows and wedged first boot | `metadata-protocol/src/seed-loader.ts:1971` (rationale at `:1881`–`1883`, #3760), `flow.zod.ts:702` |
| "It skips the state machine" | **No.** That is `skipStateMachine`, carried by seed replay and by `treatAsHistorical` imports | `objectql/src/engine.ts` FSM gate; see [State Machine](/docs/protocol/objectql/state-machine) |
| "It skips validation rules" | **No.** Field shape, `format`, `script` and the rest still run. The `readonly` strip runs *before* validation precisely so a discarded value is not judged | `objectql/src/engine.ts:10007`–`10024` |
| "It skips validation rules" | **No.** Field shape, `format`, `script` and the rest still run. The `readonly` strip runs *before* validation precisely so a discarded value is not judged | `objectql/src/engine.ts:10069`–`10086` |
| "It preserves a supplied `updated_at` / `updated_by`" | **No.** That is `preserveAudit`, a separate opt-in — and an UPDATE-path exemption only | `field.zod.ts:1537` (#3493 / #6640) |
| "It stamps `created_by`" | **No.** Audit stamping reads `userId` from the context. A user-less system write stamps nothing — that is today's behaviour, not an error | `runtime-identity.ts:280`–`281` |
| "It bypasses every guard" | **No.** The last-admin guard applies to **every** context, `isSystem` included — the deprovision path that actually locks an org out is the system one | `last-admin-guard.ts:299` |
Expand Down

3 changes: 2 additions & 1 deletion
content/docs/references/api/contract.mdx

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -27,7 +27,7 @@ const result = ApiErrorSchema.parse(data);

| Property | Type | Required | Description |
| :--- | :--- | :--- | :--- |
| **code** | `Enum<'VALIDATION_ERROR' \| 'INVALID_FIELD' \| 'MISSING_REQUIRED_FIELD' \| 'INVALID_FORMAT' \| 'VALUE_TOO_LONG' \| 'VALUE_TOO_SHORT' \| 'VALUE_OUT_OF_RANGE' \| … +292 more>` | ✅ | Error code (e.g. VALIDATION_ERROR; StandardErrorCode ∪ the ledger the serving side registers — ERROR_CODE_LEDGER for framework packages) |
| **code** | `Enum<'VALIDATION_ERROR' \| 'INVALID_FIELD' \| 'MISSING_REQUIRED_FIELD' \| 'INVALID_FORMAT' \| 'VALUE_TOO_LONG' \| 'VALUE_TOO_SHORT' \| 'VALUE_OUT_OF_RANGE' \| … +293 more>` | ✅ | Error code (e.g. VALIDATION_ERROR; StandardErrorCode ∪ the ledger the serving side registers — ERROR_CODE_LEDGER for framework packages) |
| **declaredCode** | `string` | optional | The producer-declared code, verbatim, when it is not a member of the closed `code` vocabulary — the open, author-authored channel (app-specific spellings; ADR-0112) |
| **message** | `string` | ✅ | Readable error message |
| **userMessage** | `string` | optional | Producer-marked user-facing refusal text, verbatim. Present exactly when the producer opted in at throw time; consumers render it to end users and keep their generic substitution for anything unmarked. Status-agnostic; never replaces `message`. |
Expand DownExpand Up@@ -156,6 +156,7 @@ const result = ApiErrorSchema.parse(data);
* `ERR_FILE_CONSTRAINT`
* `ERR_FILE_REFERENCE_COPY`
* `ERR_HOOK_TARGET_REBIND`
* `ERR_ORGLESS_WRITE_DECLARATION_REFUSED`
* `ERR_READONLY_FIELD_REJECTED`
* `ERR_SUMMARY_RECOMPUTE`
* `ERR_SYSTEM_WRITE_ORGANIZATION_REQUIRED`
Expand Down

1 change: 1 addition & 0 deletions
content/docs/references/api/error-code-ledger.mdx

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -272,6 +272,7 @@ const result = ErrorCode.parse(data);
* `ERR_FILE_CONSTRAINT`
* `ERR_FILE_REFERENCE_COPY`
* `ERR_HOOK_TARGET_REBIND`
* `ERR_ORGLESS_WRITE_DECLARATION_REFUSED`
* `ERR_READONLY_FIELD_REJECTED`
* `ERR_SUMMARY_RECOMPUTE`
* `ERR_SYSTEM_WRITE_ORGANIZATION_REQUIRED`
Expand Down

1 change: 1 addition & 0 deletions
package.json

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -151,6 +151,7 @@
 "check:resume-authority-declared": "node scripts/check-resume-authority-declared.mjs --self-test && node scripts/check-resume-authority-declared.mjs",
 "check:spec-parsed-alias": "node scripts/check-spec-parsed-alias.mjs --self-test && node scripts/check-spec-parsed-alias.mjs",
 "check:tenant-chokepoint": "node scripts/check-tenant-chokepoint.mjs --self-test && node scripts/check-tenant-chokepoint.mjs",
 "check:orgless-write-declarations": "node scripts/check-orgless-write-declarations.mjs --self-test && node scripts/check-orgless-write-declarations.mjs",
 "check:stall-guard": "node scripts/run-with-stall-guard.mjs --self-test",
 "check:stall-guard-budget": "node scripts/check-stall-guard-budget.mjs --self-test && node scripts/check-stall-guard-budget.mjs",
 "check:stall-guard-headroom": "node scripts/measure-stall-guard-headroom.mjs --self-test",
Expand Down

31 changes: 29 additions & 2 deletions
packages/metadata-protocol/src/sys-metadata-repository.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -191,7 +191,20 @@ export interface SysMetadataEngine {
 insert(
 table: string,
 data: Record<string, unknown>,
 options?: { context?: any },
 options?: {
 context?: any;
 /**
 * [#13636] The engine's per-write "these rows are legitimately org-less"
 * declaration. Spelled structurally rather than imported: the canonical
 * type is `OrgLessWriteDeclarationOptions` in
 * `@objectstack/objectql`'s `tenancy/orgless-write-declaration.ts`, and
 * THAT package depends on this one — importing it here would be a cycle.
 * The engine validates every declaration against its ledger and throws on
 * one it does not admit, so a drift between these two spellings fails
 * loudly at the write rather than being tolerated.
 */
 orgLessWrite?: { object: string; reason: string };
 },
 ): Promise<{ id: string }>;
 update(
 table: string,
Expand DownExpand Up@@ -608,7 +621,21 @@ export class SysMetadataRepository implements MetadataRepository {
 });
 } else {
 parentRowData.created_at = now;
 await this.engine.insert('sys_metadata', parentRowData, { context: ctx });
 // [#13636] An ENV-LEVEL repository writes `organization_id: null` on
 // purpose — the #6190 option A population, a row that belongs to the
 // installation rather than to any organization. `sys_metadata` is
 // admitted as `conditional` in the engine's platform tenancy ledger, so
 // without this declaration that write is indistinguishable from a
 // forgotten stamp and is refused on a walled install. The condition is
 // the repository's own scope, fixed at construction, not a property of
 // the row being written — so an org-scoped repository never declares,
 // and a missing stamp on ITS writes still refuses.
 await this.engine.insert('sys_metadata', parentRowData, {
 context: ctx,
 ...(this.organizationId == null
 ? { orgLessWrite: { object: 'sys_metadata', reason: 'env-level-metadata' } }
 : {}),
 });
 }

 // Durable history append — same transaction, so the parent write
Expand Down
Loading
Loading

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Strip utm_, fbclid, gclid, etc. from all links on page\n(function() {\n var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content',\n 'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid',\n 'ref', 'ref_src', 'source', 'medium', 'campaign'];\n \n function cleanUrl(url) {\n try {\n var u = new URL(url, window.location.origin);\n var changed = false;\n trackingParams.forEach(function(p) {\n if (u.searchParams.has(p)) {\n u.searchParams.delete(p);\n changed = true;\n }\n });\n return changed ? u.toString() : url;\n } catch (e) {\n return url;\n }\n }\n \n function cleanLinks() {\n document.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n \n cleanLinks();\n \n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1) {\n if (node.tagName === 'A') cleanLinks();\n node.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Remove Tracking Parameters from Links");
}
} catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); }
})();
(function(){
try {
var __m = "youtube.com";
var __re = new RegExp('^' + "youtube\\.com" + '

Skip to content
feat(objectql): declare a legitimately org-less write instead of inferring it from NULL#14923

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Closed

os-musk
wants to merge
10
commits into

from

 Closed


feat(objectql): declare a legitimately org-less write instead of inferring it from NULL
#14923
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


10 commits


Select commit
Hold shift + click to select a range
33df2b5

feat(objectql): declare a legitimately org-less write instead of infe…


claude Sep 3, 2026
d7b49cf

Merge remote-tracking branch 'origin/main' into claude/issue-13636-or…


claude Sep 3, 2026
9ef492f

fix(docs): re-anchor the system-context census line citations after t…


claude Sep 3, 2026
4c2da50

fix(#14923 review): respell the gate's bare-root literal, register th…


claude Sep 3, 2026
d126ae8

fix(docs): re-anchor the system-context census after this round's eng…


claude Sep 3, 2026
0ac778e

Merge remote-tracking branch 'origin/main' into claude/issue-13636-or…


claude Sep 3, 2026
f5d20ac

chore: regenerate the system-context census page on the merged tree


claude Sep 3, 2026
2cb2976

fix(objectql): move the tracker id off the orgless-write refusal message


claude Sep 3, 2026
6a60b04

Merge remote-tracking branch 'origin/main' into claude/issue-13636-or…


claude Sep 3, 2026
9dce213

fix(docs): repair system-context census anchor after merge conflict


claude Sep 3, 2026

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


47 changes: 47 additions & 0 deletions
.changeset/orgless-write-declaration-channel.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
---
"@objectstack/objectql": minor
"@objectstack/metadata-protocol": minor
"@objectstack/plugin-audit": minor
"@objectstack/plugin-auth": minor
"@objectstack/service-settings": minor
---

feat(objectql): an explicit per-write declaration for a legitimately org-less row

Until now one `NULL` organization on a platform object meant two different
things — a deliberate environment-level row, and a write that forgot to thread
an organization — and `resolveSystemInsertOrganization` had no way to tell them
apart. So the two objects that hold BOTH populations, `sys_metadata` (whose
non-overridable-type write lands env-wide by adjudication) and `sys_audit_log`
(whose writers enumerate their own legitimate org-less cases), had to stay
outside the tenant-audit control entirely. They are two of the largest write
populations in the platform namespace, which put the control's blind spot
exactly where it was least affordable.

Writes may now DECLARE that their rows belong to an adjudicated org-less
population:

```ts
await engine.insert('sys_metadata', row, {
 context: { isSystem: true },
 orgLessWrite: { object: 'sys_metadata', reason: 'env-level-metadata' },
});
```

The platform tenancy ledger gains a fourth verdict, `conditional`, and both
objects are admitted under it. ⚠️ Admission makes them STRICTER, not looser: an
org-less system write on either is now derived on a single-organization install
and refused loudly on a walled one, exactly as a `tenant-scoped` object's is,
and the declaration is the only way through. It is checked against the ledger
before anything else the resolver does, so a declaration naming an object the
ledger has not admitted, a reason that object does not admit, or an object other
than the one being written throws `ERR_ORGLESS_WRITE_DECLARATION_REFUSED` — no
spelling of the option is silently ignored, which is what separates a
declaration from a bypass flag. ⛔ It is not a way to quiet a refusal: a write
that simply forgot to thread an organization is the defect the refusal reports.

The platform's own six org-less writers declare, each on a test a reader can
check — the metadata repository on its own env-level scope, the audit writers on
whether the audited subject resolves an organization column at all. A new gate,
`pnpm check:orgless-write-declarations`, enumerates every declaration in the
tree, holds each to the same ledger the runtime does, and prints the count.

14 changes: 14 additions & 0 deletions
.github/workflows/lint.yml

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -3596,6 +3596,20 @@ jobs:
 - name: Read-side tenant chokepoint gate
 run: pnpm check:tenant-chokepoint

 # [#13636] The 'orgLessWrite' declaration census. The maintainer's
 # 2026-08-31 ruling put 'loud, checkable, countable' in the decision text
 # rather than in implementation notes; the engine discharges the first two
 # at the write, and this is the third — every declaration in the monorepo
 # enumerated, held to the same ledger the runtime holds it to, and COUNTED
 # on every pass. A declaration nobody can count is the silent marker that
 # ruling disqualified by name.
 #
 # Static scan over tracked sources, no build needed, so it belongs here.
 # Runs its own --self-test first: a matcher that stopped matching would
 # report OK while reading nothing.
 - name: Org-less write declaration gate
 run: pnpm check:orgless-write-declarations

 # Every committed `pnpm --filter <name>` must name a real workspace
 # package (#10853).
 #
Expand Down

26 changes: 13 additions & 13 deletions
content/docs/permissions/system-context.mdx

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -101,26 +101,26 @@ that silently does not happen.
| 12 | Per-request performance timings disclosed | observability | Get: timing headers a normal caller cannot pull | `perf-timing.ts:474` |
| 13 | Permission-set **overlay discard** skips the tenant-admin assertion | plugin-security | Get: an overlay can be discarded with no authenticated tenant administrator | `permission-set-overlay-discard.ts:142` |
| 14 | MCP stdio bridge skips the object API-exposure gate | mcp | Get: the bridge reaches objects whose `apiEnabled` / `apiMethods` would refuse an external caller | `stdio-data-bridge.ts:246` |
| 15 | **Read-audit rows are not written** | plugin-audit | Lose: the "a person opened this record" trail. `sudo()` keeps the caller's `userId`, so this flag is the only thing separating a human read from a platform one | `read-audit.ts:556` |
| 15 | **Read-audit rows are not written** | plugin-audit | Lose: the "a person opened this record" trail. `sudo()` keeps the caller's `userId`, so this flag is the only thing separating a human read from a platform one | `read-audit.ts:583` |
| 16 | Approval snapshot payload redaction skipped | plugin-approvals | Get: the whole snapshot on `find` / `findOne` — the audit/replay channel. Lose: field-visibility redaction over approval payloads | `payload-redaction-middleware.ts:115` |
| 17 | REST anonymous-deny seam satisfied | rest | Get: `enforceAuth` passes with no `userId`. Not reachable from the wire — `isSystem` is never set on an inbound request | `rest-server.ts:1552` |

### 2. Write pipeline and data integrity

| # | Behaviour when `isSystem` | Package | What you get / what you lose | Anchor |
|:--|:---|:---|:---|:---|
| 18 | **`readonly` strip bypassed — UPDATE, single row** | objectql | Get: a `readonly` field CAN be written. Lose: the protection that stops a caller seeding e.g. `approval_status` | `objectql/src/engine.ts:11289` |
| 19 | **`readonly` strip bypassed — UPDATE, bulk/predicate** | objectql | Same, on the multi-row path | `objectql/src/engine.ts:11472` |
| 20 | **`readonly` strip bypassed — INSERT (engine pass)** | objectql | Same, on create | `objectql/src/engine.ts:10024` |
| 18 | **`readonly` strip bypassed — UPDATE, single row** | objectql | Get: a `readonly` field CAN be written. Lose: the protection that stops a caller seeding e.g. `approval_status` | `objectql/src/engine.ts:11351` |
| 19 | **`readonly` strip bypassed — UPDATE, bulk/predicate** | objectql | Same, on the multi-row path | `objectql/src/engine.ts:11534` |
| 20 | **`readonly` strip bypassed — INSERT (engine pass)** | objectql | Same, on create | `objectql/src/engine.ts:10086` |
| 21 | **`readonly` strip bypassed — INSERT (protocol ingress)** | metadata-protocol | `isSystem` is the **only** exemption here. `preserveAudit` is deliberately not read on this path (#6640) — a non-system historical import is still stripped on create | `metadata-protocol/src/protocol.ts:1746` |
| 22 | Strict-drop refusal never fires | objectql | Lose: a caller that opted into loud refusal gets **silence** — strict refuses exactly what the strip would have taken, and the strip took nothing | `objectql/src/engine.ts:10072`, `readonly-strict-errors.ts:66` |
| 23 | **Referential-integrity check skipped** | objectql | Get: writes proceed against unreachable/unresolvable targets. Lose: an `isSystem` caller can write a **dangling reference** | `objectql/src/engine.ts:5891` |
| 24 | Tenant-audit warning silenced; `bypassTenantAudit` threaded to the driver | objectql | Get: unscoped system writes stop warning. Lose: the signal that would flag a genuine user-path scoping bug | `objectql/src/engine.ts:3735`, `:3745`, `:3772` |
| 22 | Strict-drop refusal never fires | objectql | Lose: a caller that opted into loud refusal gets **silence** — strict refuses exactly what the strip would have taken, and the strip took nothing | `objectql/src/engine.ts:10134`, `readonly-strict-errors.ts:66` |
| 23 | **Referential-integrity check skipped** | objectql | Get: writes proceed against unreachable/unresolvable targets. Lose: an `isSystem` caller can write a **dangling reference** | `objectql/src/engine.ts:5931` |
| 24 | Tenant-audit warning silenced; `bypassTenantAudit` threaded to the driver | objectql | Get: unscoped system writes stop warning. Lose: the signal that would flag a genuine user-path scoping bug | `objectql/src/engine.ts:3740`, `:3750`, `:3777` |
| 25 | Engine-owned / append-only write guard bypassed | plugin-security | Get: generic writes to `managedBy` engine-owned objects | `system-write-guard.ts:96`, `:120` |
| 26 | Identity write guard bypassed (ADR-0092) | plugin-auth | Get: direct writes to identity tables through the generic data path | `identity-write-guard.ts:98` |
| 27 | Search-companion column **kept** in a read's rows when it was explicitly requested | objectql | Get: the internal companion column is readable. Lose: nothing for app code — this is the engine reading its own index | `objectql/src/engine.ts:6589` |
| 28 | Dependent-count disclosure on a blocked delete | objectql | Get: the count of blocking children. Nothing was elevated past the caller, so nothing is withheld | `objectql/src/engine.ts:12084` |
| 29 | Reference-cleanup log attributes the write to `'system'` | objectql | Get: an honest actor label instead of `anonymous` when the context carries neither `userId` nor `actor` | `objectql/src/engine.ts:12013` |
| 27 | Search-companion column **kept** in a read's rows when it was explicitly requested | objectql | Get: the internal companion column is readable. Lose: nothing for app code — this is the engine reading its own index | `objectql/src/engine.ts:6629` |
| 28 | Dependent-count disclosure on a blocked delete | objectql | Get: the count of blocking children. Nothing was elevated past the caller, so nothing is withheld | `objectql/src/engine.ts:12146` |
| 29 | Reference-cleanup log attributes the write to `'system'` | objectql | Get: an honest actor label instead of `anonymous` when the context carries neither `userId` nor `actor` | `objectql/src/engine.ts:12075` |

### 3. Sharing (`plugin-sharing`)

Expand DownExpand Up@@ -179,8 +179,8 @@ a reader tracing where elevation travels needs them.

| # | Site | Package | What it does |
|:--|:---|:---|:---|
| 62 | `objectql/src/engine.ts:3542` | objectql | Propagates `isSystem` into the hook session so hooks can tell engine self-writes from user writes |
| 63 | `objectql/src/engine.ts:14433` | objectql | `ScopedContext.isSystem` getter — re-exposes the underlying execution context's flag |
| 62 | `objectql/src/engine.ts:3547` | objectql | Propagates `isSystem` into the hook session so hooks can tell engine self-writes from user writes |
| 63 | `objectql/src/engine.ts:14504` | objectql | `ScopedContext.isSystem` getter — re-exposes the underlying execution context's flag |
| 64 | `plugin-reports/src/report-service.ts:556` | plugin-reports | Threads the flag into the engine call that runs a report |
| 65 | `body-runner.ts:279` | runtime | Rebuilds an `ExecutionContext` from a hook session, carrying the flag across |

Expand All@@ -195,7 +195,7 @@ assuming `isSystem` covers it is a documented source of bugs.
|:---|:---|:---|
| "It suppresses triggers / record-change automation" | **No.** Only `skipTriggers` does. A bare `{ isSystem: true }` on a seed write re-fired automation on freshly seeded rows and wedged first boot | `metadata-protocol/src/seed-loader.ts:1971` (rationale at `:1881`–`1883`, #3760), `flow.zod.ts:702` |
| "It skips the state machine" | **No.** That is `skipStateMachine`, carried by seed replay and by `treatAsHistorical` imports | `objectql/src/engine.ts` FSM gate; see [State Machine](/docs/protocol/objectql/state-machine) |
| "It skips validation rules" | **No.** Field shape, `format`, `script` and the rest still run. The `readonly` strip runs *before* validation precisely so a discarded value is not judged | `objectql/src/engine.ts:10007`–`10024` |
| "It skips validation rules" | **No.** Field shape, `format`, `script` and the rest still run. The `readonly` strip runs *before* validation precisely so a discarded value is not judged | `objectql/src/engine.ts:10069`–`10086` |
| "It preserves a supplied `updated_at` / `updated_by`" | **No.** That is `preserveAudit`, a separate opt-in — and an UPDATE-path exemption only | `field.zod.ts:1537` (#3493 / #6640) |
| "It stamps `created_by`" | **No.** Audit stamping reads `userId` from the context. A user-less system write stamps nothing — that is today's behaviour, not an error | `runtime-identity.ts:280`–`281` |
| "It bypasses every guard" | **No.** The last-admin guard applies to **every** context, `isSystem` included — the deprovision path that actually locks an org out is the system one | `last-admin-guard.ts:299` |
Expand Down

3 changes: 2 additions & 1 deletion
content/docs/references/api/contract.mdx

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -27,7 +27,7 @@ const result = ApiErrorSchema.parse(data);

| Property | Type | Required | Description |
| :--- | :--- | :--- | :--- |
| **code** | `Enum<'VALIDATION_ERROR' \| 'INVALID_FIELD' \| 'MISSING_REQUIRED_FIELD' \| 'INVALID_FORMAT' \| 'VALUE_TOO_LONG' \| 'VALUE_TOO_SHORT' \| 'VALUE_OUT_OF_RANGE' \| … +292 more>` | ✅ | Error code (e.g. VALIDATION_ERROR; StandardErrorCode ∪ the ledger the serving side registers — ERROR_CODE_LEDGER for framework packages) |
| **code** | `Enum<'VALIDATION_ERROR' \| 'INVALID_FIELD' \| 'MISSING_REQUIRED_FIELD' \| 'INVALID_FORMAT' \| 'VALUE_TOO_LONG' \| 'VALUE_TOO_SHORT' \| 'VALUE_OUT_OF_RANGE' \| … +293 more>` | ✅ | Error code (e.g. VALIDATION_ERROR; StandardErrorCode ∪ the ledger the serving side registers — ERROR_CODE_LEDGER for framework packages) |
| **declaredCode** | `string` | optional | The producer-declared code, verbatim, when it is not a member of the closed `code` vocabulary — the open, author-authored channel (app-specific spellings; ADR-0112) |
| **message** | `string` | ✅ | Readable error message |
| **userMessage** | `string` | optional | Producer-marked user-facing refusal text, verbatim. Present exactly when the producer opted in at throw time; consumers render it to end users and keep their generic substitution for anything unmarked. Status-agnostic; never replaces `message`. |
Expand DownExpand Up@@ -156,6 +156,7 @@ const result = ApiErrorSchema.parse(data);
* `ERR_FILE_CONSTRAINT`
* `ERR_FILE_REFERENCE_COPY`
* `ERR_HOOK_TARGET_REBIND`
* `ERR_ORGLESS_WRITE_DECLARATION_REFUSED`
* `ERR_READONLY_FIELD_REJECTED`
* `ERR_SUMMARY_RECOMPUTE`
* `ERR_SYSTEM_WRITE_ORGANIZATION_REQUIRED`
Expand Down

1 change: 1 addition & 0 deletions
content/docs/references/api/error-code-ledger.mdx

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -272,6 +272,7 @@ const result = ErrorCode.parse(data);
* `ERR_FILE_CONSTRAINT`
* `ERR_FILE_REFERENCE_COPY`
* `ERR_HOOK_TARGET_REBIND`
* `ERR_ORGLESS_WRITE_DECLARATION_REFUSED`
* `ERR_READONLY_FIELD_REJECTED`
* `ERR_SUMMARY_RECOMPUTE`
* `ERR_SYSTEM_WRITE_ORGANIZATION_REQUIRED`
Expand Down

1 change: 1 addition & 0 deletions
package.json

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -151,6 +151,7 @@
 "check:resume-authority-declared": "node scripts/check-resume-authority-declared.mjs --self-test && node scripts/check-resume-authority-declared.mjs",
 "check:spec-parsed-alias": "node scripts/check-spec-parsed-alias.mjs --self-test && node scripts/check-spec-parsed-alias.mjs",
 "check:tenant-chokepoint": "node scripts/check-tenant-chokepoint.mjs --self-test && node scripts/check-tenant-chokepoint.mjs",
 "check:orgless-write-declarations": "node scripts/check-orgless-write-declarations.mjs --self-test && node scripts/check-orgless-write-declarations.mjs",
 "check:stall-guard": "node scripts/run-with-stall-guard.mjs --self-test",
 "check:stall-guard-budget": "node scripts/check-stall-guard-budget.mjs --self-test && node scripts/check-stall-guard-budget.mjs",
 "check:stall-guard-headroom": "node scripts/measure-stall-guard-headroom.mjs --self-test",
Expand Down

31 changes: 29 additions & 2 deletions
packages/metadata-protocol/src/sys-metadata-repository.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -191,7 +191,20 @@ export interface SysMetadataEngine {
 insert(
 table: string,
 data: Record<string, unknown>,
 options?: { context?: any },
 options?: {
 context?: any;
 /**
 * [#13636] The engine's per-write "these rows are legitimately org-less"
 * declaration. Spelled structurally rather than imported: the canonical
 * type is `OrgLessWriteDeclarationOptions` in
 * `@objectstack/objectql`'s `tenancy/orgless-write-declaration.ts`, and
 * THAT package depends on this one — importing it here would be a cycle.
 * The engine validates every declaration against its ledger and throws on
 * one it does not admit, so a drift between these two spellings fails
 * loudly at the write rather than being tolerated.
 */
 orgLessWrite?: { object: string; reason: string };
 },
 ): Promise<{ id: string }>;
 update(
 table: string,
Expand DownExpand Up@@ -608,7 +621,21 @@ export class SysMetadataRepository implements MetadataRepository {
 });
 } else {
 parentRowData.created_at = now;
 await this.engine.insert('sys_metadata', parentRowData, { context: ctx });
 // [#13636] An ENV-LEVEL repository writes `organization_id: null` on
 // purpose — the #6190 option A population, a row that belongs to the
 // installation rather than to any organization. `sys_metadata` is
 // admitted as `conditional` in the engine's platform tenancy ledger, so
 // without this declaration that write is indistinguishable from a
 // forgotten stamp and is refused on a walled install. The condition is
 // the repository's own scope, fixed at construction, not a property of
 // the row being written — so an org-scoped repository never declares,
 // and a missing stamp on ITS writes still refuses.
 await this.engine.insert('sys_metadata', parentRowData, {
 context: ctx,
 ...(this.organizationId == null
 ? { orgLessWrite: { object: 'sys_metadata', reason: 'env-level-metadata' } }
 : {}),
 });
 }

 // Durable history append — same transaction, so the parent write
Expand Down
Loading
Loading

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Auto-enable theater mode on YouTube\n(function() {\n function tryTheater() {\n var btn = document.querySelector('button[aria-label=\"Theater mode\"], ytd-player #player button[title=\"Theater mode\"]');\n if (btn && !btn.classList.contains('activated')) {\n btn.click();\n }\n }\n \n // Try immediately\n tryTheater();\n \n // Try after navigation (SPA)\n var lastUrl = location.href;\n setInterval(function() {\n if (location.href !== lastUrl) {\n lastUrl = location.href;\n setTimeout(tryTheater, 500);\n }\n }, 1000);\n \n // Also try on player load\n var observer = new MutationObserver(tryTheater);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "YouTube Theater Mode Default");
}
} catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
feat(objectql): declare a legitimately org-less write instead of inferring it from NULL#14923

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Closed

os-musk
wants to merge
10
commits into

from

 Closed


feat(objectql): declare a legitimately org-less write instead of inferring it from NULL
#14923
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


10 commits


Select commit
Hold shift + click to select a range
33df2b5

feat(objectql): declare a legitimately org-less write instead of infe…


claude Sep 3, 2026
d7b49cf

Merge remote-tracking branch 'origin/main' into claude/issue-13636-or…


claude Sep 3, 2026
9ef492f

fix(docs): re-anchor the system-context census line citations after t…


claude Sep 3, 2026
4c2da50

fix(#14923 review): respell the gate's bare-root literal, register th…


claude Sep 3, 2026
d126ae8

fix(docs): re-anchor the system-context census after this round's eng…


claude Sep 3, 2026
0ac778e

Merge remote-tracking branch 'origin/main' into claude/issue-13636-or…


claude Sep 3, 2026
f5d20ac

chore: regenerate the system-context census page on the merged tree


claude Sep 3, 2026
2cb2976

fix(objectql): move the tracker id off the orgless-write refusal message


claude Sep 3, 2026
6a60b04

Merge remote-tracking branch 'origin/main' into claude/issue-13636-or…


claude Sep 3, 2026
9dce213

fix(docs): repair system-context census anchor after merge conflict


claude Sep 3, 2026

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


47 changes: 47 additions & 0 deletions
.changeset/orgless-write-declaration-channel.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
---
"@objectstack/objectql": minor
"@objectstack/metadata-protocol": minor
"@objectstack/plugin-audit": minor
"@objectstack/plugin-auth": minor
"@objectstack/service-settings": minor
---

feat(objectql): an explicit per-write declaration for a legitimately org-less row

Until now one `NULL` organization on a platform object meant two different
things — a deliberate environment-level row, and a write that forgot to thread
an organization — and `resolveSystemInsertOrganization` had no way to tell them
apart. So the two objects that hold BOTH populations, `sys_metadata` (whose
non-overridable-type write lands env-wide by adjudication) and `sys_audit_log`
(whose writers enumerate their own legitimate org-less cases), had to stay
outside the tenant-audit control entirely. They are two of the largest write
populations in the platform namespace, which put the control's blind spot
exactly where it was least affordable.

Writes may now DECLARE that their rows belong to an adjudicated org-less
population:

```ts
await engine.insert('sys_metadata', row, {
 context: { isSystem: true },
 orgLessWrite: { object: 'sys_metadata', reason: 'env-level-metadata' },
});
```

The platform tenancy ledger gains a fourth verdict, `conditional`, and both
objects are admitted under it. ⚠️ Admission makes them STRICTER, not looser: an
org-less system write on either is now derived on a single-organization install
and refused loudly on a walled one, exactly as a `tenant-scoped` object's is,
and the declaration is the only way through. It is checked against the ledger
before anything else the resolver does, so a declaration naming an object the
ledger has not admitted, a reason that object does not admit, or an object other
than the one being written throws `ERR_ORGLESS_WRITE_DECLARATION_REFUSED` — no
spelling of the option is silently ignored, which is what separates a
declaration from a bypass flag. ⛔ It is not a way to quiet a refusal: a write
that simply forgot to thread an organization is the defect the refusal reports.

The platform's own six org-less writers declare, each on a test a reader can
check — the metadata repository on its own env-level scope, the audit writers on
whether the audited subject resolves an organization column at all. A new gate,
`pnpm check:orgless-write-declarations`, enumerates every declaration in the
tree, holds each to the same ledger the runtime does, and prints the count.

14 changes: 14 additions & 0 deletions
.github/workflows/lint.yml

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -3596,6 +3596,20 @@ jobs:
 - name: Read-side tenant chokepoint gate
 run: pnpm check:tenant-chokepoint

 # [#13636] The 'orgLessWrite' declaration census. The maintainer's
 # 2026-08-31 ruling put 'loud, checkable, countable' in the decision text
 # rather than in implementation notes; the engine discharges the first two
 # at the write, and this is the third — every declaration in the monorepo
 # enumerated, held to the same ledger the runtime holds it to, and COUNTED
 # on every pass. A declaration nobody can count is the silent marker that
 # ruling disqualified by name.
 #
 # Static scan over tracked sources, no build needed, so it belongs here.
 # Runs its own --self-test first: a matcher that stopped matching would
 # report OK while reading nothing.
 - name: Org-less write declaration gate
 run: pnpm check:orgless-write-declarations

 # Every committed `pnpm --filter <name>` must name a real workspace
 # package (#10853).
 #
Expand Down

26 changes: 13 additions & 13 deletions
content/docs/permissions/system-context.mdx

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -101,26 +101,26 @@ that silently does not happen.
| 12 | Per-request performance timings disclosed | observability | Get: timing headers a normal caller cannot pull | `perf-timing.ts:474` |
| 13 | Permission-set **overlay discard** skips the tenant-admin assertion | plugin-security | Get: an overlay can be discarded with no authenticated tenant administrator | `permission-set-overlay-discard.ts:142` |
| 14 | MCP stdio bridge skips the object API-exposure gate | mcp | Get: the bridge reaches objects whose `apiEnabled` / `apiMethods` would refuse an external caller | `stdio-data-bridge.ts:246` |
| 15 | **Read-audit rows are not written** | plugin-audit | Lose: the "a person opened this record" trail. `sudo()` keeps the caller's `userId`, so this flag is the only thing separating a human read from a platform one | `read-audit.ts:556` |
| 15 | **Read-audit rows are not written** | plugin-audit | Lose: the "a person opened this record" trail. `sudo()` keeps the caller's `userId`, so this flag is the only thing separating a human read from a platform one | `read-audit.ts:583` |
| 16 | Approval snapshot payload redaction skipped | plugin-approvals | Get: the whole snapshot on `find` / `findOne` — the audit/replay channel. Lose: field-visibility redaction over approval payloads | `payload-redaction-middleware.ts:115` |
| 17 | REST anonymous-deny seam satisfied | rest | Get: `enforceAuth` passes with no `userId`. Not reachable from the wire — `isSystem` is never set on an inbound request | `rest-server.ts:1552` |

### 2. Write pipeline and data integrity

| # | Behaviour when `isSystem` | Package | What you get / what you lose | Anchor |
|:--|:---|:---|:---|:---|
| 18 | **`readonly` strip bypassed — UPDATE, single row** | objectql | Get: a `readonly` field CAN be written. Lose: the protection that stops a caller seeding e.g. `approval_status` | `objectql/src/engine.ts:11289` |
| 19 | **`readonly` strip bypassed — UPDATE, bulk/predicate** | objectql | Same, on the multi-row path | `objectql/src/engine.ts:11472` |
| 20 | **`readonly` strip bypassed — INSERT (engine pass)** | objectql | Same, on create | `objectql/src/engine.ts:10024` |
| 18 | **`readonly` strip bypassed — UPDATE, single row** | objectql | Get: a `readonly` field CAN be written. Lose: the protection that stops a caller seeding e.g. `approval_status` | `objectql/src/engine.ts:11351` |
| 19 | **`readonly` strip bypassed — UPDATE, bulk/predicate** | objectql | Same, on the multi-row path | `objectql/src/engine.ts:11534` |
| 20 | **`readonly` strip bypassed — INSERT (engine pass)** | objectql | Same, on create | `objectql/src/engine.ts:10086` |
| 21 | **`readonly` strip bypassed — INSERT (protocol ingress)** | metadata-protocol | `isSystem` is the **only** exemption here. `preserveAudit` is deliberately not read on this path (#6640) — a non-system historical import is still stripped on create | `metadata-protocol/src/protocol.ts:1746` |
| 22 | Strict-drop refusal never fires | objectql | Lose: a caller that opted into loud refusal gets **silence** — strict refuses exactly what the strip would have taken, and the strip took nothing | `objectql/src/engine.ts:10072`, `readonly-strict-errors.ts:66` |
| 23 | **Referential-integrity check skipped** | objectql | Get: writes proceed against unreachable/unresolvable targets. Lose: an `isSystem` caller can write a **dangling reference** | `objectql/src/engine.ts:5891` |
| 24 | Tenant-audit warning silenced; `bypassTenantAudit` threaded to the driver | objectql | Get: unscoped system writes stop warning. Lose: the signal that would flag a genuine user-path scoping bug | `objectql/src/engine.ts:3735`, `:3745`, `:3772` |
| 22 | Strict-drop refusal never fires | objectql | Lose: a caller that opted into loud refusal gets **silence** — strict refuses exactly what the strip would have taken, and the strip took nothing | `objectql/src/engine.ts:10134`, `readonly-strict-errors.ts:66` |
| 23 | **Referential-integrity check skipped** | objectql | Get: writes proceed against unreachable/unresolvable targets. Lose: an `isSystem` caller can write a **dangling reference** | `objectql/src/engine.ts:5931` |
| 24 | Tenant-audit warning silenced; `bypassTenantAudit` threaded to the driver | objectql | Get: unscoped system writes stop warning. Lose: the signal that would flag a genuine user-path scoping bug | `objectql/src/engine.ts:3740`, `:3750`, `:3777` |
| 25 | Engine-owned / append-only write guard bypassed | plugin-security | Get: generic writes to `managedBy` engine-owned objects | `system-write-guard.ts:96`, `:120` |
| 26 | Identity write guard bypassed (ADR-0092) | plugin-auth | Get: direct writes to identity tables through the generic data path | `identity-write-guard.ts:98` |
| 27 | Search-companion column **kept** in a read's rows when it was explicitly requested | objectql | Get: the internal companion column is readable. Lose: nothing for app code — this is the engine reading its own index | `objectql/src/engine.ts:6589` |
| 28 | Dependent-count disclosure on a blocked delete | objectql | Get: the count of blocking children. Nothing was elevated past the caller, so nothing is withheld | `objectql/src/engine.ts:12084` |
| 29 | Reference-cleanup log attributes the write to `'system'` | objectql | Get: an honest actor label instead of `anonymous` when the context carries neither `userId` nor `actor` | `objectql/src/engine.ts:12013` |
| 27 | Search-companion column **kept** in a read's rows when it was explicitly requested | objectql | Get: the internal companion column is readable. Lose: nothing for app code — this is the engine reading its own index | `objectql/src/engine.ts:6629` |
| 28 | Dependent-count disclosure on a blocked delete | objectql | Get: the count of blocking children. Nothing was elevated past the caller, so nothing is withheld | `objectql/src/engine.ts:12146` |
| 29 | Reference-cleanup log attributes the write to `'system'` | objectql | Get: an honest actor label instead of `anonymous` when the context carries neither `userId` nor `actor` | `objectql/src/engine.ts:12075` |

### 3. Sharing (`plugin-sharing`)

Expand DownExpand Up@@ -179,8 +179,8 @@ a reader tracing where elevation travels needs them.

| # | Site | Package | What it does |
|:--|:---|:---|:---|
| 62 | `objectql/src/engine.ts:3542` | objectql | Propagates `isSystem` into the hook session so hooks can tell engine self-writes from user writes |
| 63 | `objectql/src/engine.ts:14433` | objectql | `ScopedContext.isSystem` getter — re-exposes the underlying execution context's flag |
| 62 | `objectql/src/engine.ts:3547` | objectql | Propagates `isSystem` into the hook session so hooks can tell engine self-writes from user writes |
| 63 | `objectql/src/engine.ts:14504` | objectql | `ScopedContext.isSystem` getter — re-exposes the underlying execution context's flag |
| 64 | `plugin-reports/src/report-service.ts:556` | plugin-reports | Threads the flag into the engine call that runs a report |
| 65 | `body-runner.ts:279` | runtime | Rebuilds an `ExecutionContext` from a hook session, carrying the flag across |

Expand All@@ -195,7 +195,7 @@ assuming `isSystem` covers it is a documented source of bugs.
|:---|:---|:---|
| "It suppresses triggers / record-change automation" | **No.** Only `skipTriggers` does. A bare `{ isSystem: true }` on a seed write re-fired automation on freshly seeded rows and wedged first boot | `metadata-protocol/src/seed-loader.ts:1971` (rationale at `:1881`–`1883`, #3760), `flow.zod.ts:702` |
| "It skips the state machine" | **No.** That is `skipStateMachine`, carried by seed replay and by `treatAsHistorical` imports | `objectql/src/engine.ts` FSM gate; see [State Machine](/docs/protocol/objectql/state-machine) |
| "It skips validation rules" | **No.** Field shape, `format`, `script` and the rest still run. The `readonly` strip runs *before* validation precisely so a discarded value is not judged | `objectql/src/engine.ts:10007`–`10024` |
| "It skips validation rules" | **No.** Field shape, `format`, `script` and the rest still run. The `readonly` strip runs *before* validation precisely so a discarded value is not judged | `objectql/src/engine.ts:10069`–`10086` |
| "It preserves a supplied `updated_at` / `updated_by`" | **No.** That is `preserveAudit`, a separate opt-in — and an UPDATE-path exemption only | `field.zod.ts:1537` (#3493 / #6640) |
| "It stamps `created_by`" | **No.** Audit stamping reads `userId` from the context. A user-less system write stamps nothing — that is today's behaviour, not an error | `runtime-identity.ts:280`–`281` |
| "It bypasses every guard" | **No.** The last-admin guard applies to **every** context, `isSystem` included — the deprovision path that actually locks an org out is the system one | `last-admin-guard.ts:299` |
Expand Down

3 changes: 2 additions & 1 deletion
content/docs/references/api/contract.mdx

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -27,7 +27,7 @@ const result = ApiErrorSchema.parse(data);

| Property | Type | Required | Description |
| :--- | :--- | :--- | :--- |
| **code** | `Enum<'VALIDATION_ERROR' \| 'INVALID_FIELD' \| 'MISSING_REQUIRED_FIELD' \| 'INVALID_FORMAT' \| 'VALUE_TOO_LONG' \| 'VALUE_TOO_SHORT' \| 'VALUE_OUT_OF_RANGE' \| … +292 more>` | ✅ | Error code (e.g. VALIDATION_ERROR; StandardErrorCode ∪ the ledger the serving side registers — ERROR_CODE_LEDGER for framework packages) |
| **code** | `Enum<'VALIDATION_ERROR' \| 'INVALID_FIELD' \| 'MISSING_REQUIRED_FIELD' \| 'INVALID_FORMAT' \| 'VALUE_TOO_LONG' \| 'VALUE_TOO_SHORT' \| 'VALUE_OUT_OF_RANGE' \| … +293 more>` | ✅ | Error code (e.g. VALIDATION_ERROR; StandardErrorCode ∪ the ledger the serving side registers — ERROR_CODE_LEDGER for framework packages) |
| **declaredCode** | `string` | optional | The producer-declared code, verbatim, when it is not a member of the closed `code` vocabulary — the open, author-authored channel (app-specific spellings; ADR-0112) |
| **message** | `string` | ✅ | Readable error message |
| **userMessage** | `string` | optional | Producer-marked user-facing refusal text, verbatim. Present exactly when the producer opted in at throw time; consumers render it to end users and keep their generic substitution for anything unmarked. Status-agnostic; never replaces `message`. |
Expand DownExpand Up@@ -156,6 +156,7 @@ const result = ApiErrorSchema.parse(data);
* `ERR_FILE_CONSTRAINT`
* `ERR_FILE_REFERENCE_COPY`
* `ERR_HOOK_TARGET_REBIND`
* `ERR_ORGLESS_WRITE_DECLARATION_REFUSED`
* `ERR_READONLY_FIELD_REJECTED`
* `ERR_SUMMARY_RECOMPUTE`
* `ERR_SYSTEM_WRITE_ORGANIZATION_REQUIRED`
Expand Down

1 change: 1 addition & 0 deletions
content/docs/references/api/error-code-ledger.mdx

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -272,6 +272,7 @@ const result = ErrorCode.parse(data);
* `ERR_FILE_CONSTRAINT`
* `ERR_FILE_REFERENCE_COPY`
* `ERR_HOOK_TARGET_REBIND`
* `ERR_ORGLESS_WRITE_DECLARATION_REFUSED`
* `ERR_READONLY_FIELD_REJECTED`
* `ERR_SUMMARY_RECOMPUTE`
* `ERR_SYSTEM_WRITE_ORGANIZATION_REQUIRED`
Expand Down

1 change: 1 addition & 0 deletions
package.json

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -151,6 +151,7 @@
 "check:resume-authority-declared": "node scripts/check-resume-authority-declared.mjs --self-test && node scripts/check-resume-authority-declared.mjs",
 "check:spec-parsed-alias": "node scripts/check-spec-parsed-alias.mjs --self-test && node scripts/check-spec-parsed-alias.mjs",
 "check:tenant-chokepoint": "node scripts/check-tenant-chokepoint.mjs --self-test && node scripts/check-tenant-chokepoint.mjs",
 "check:orgless-write-declarations": "node scripts/check-orgless-write-declarations.mjs --self-test && node scripts/check-orgless-write-declarations.mjs",
 "check:stall-guard": "node scripts/run-with-stall-guard.mjs --self-test",
 "check:stall-guard-budget": "node scripts/check-stall-guard-budget.mjs --self-test && node scripts/check-stall-guard-budget.mjs",
 "check:stall-guard-headroom": "node scripts/measure-stall-guard-headroom.mjs --self-test",
Expand Down

31 changes: 29 additions & 2 deletions
packages/metadata-protocol/src/sys-metadata-repository.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -191,7 +191,20 @@ export interface SysMetadataEngine {
 insert(
 table: string,
 data: Record<string, unknown>,
 options?: { context?: any },
 options?: {
 context?: any;
 /**
 * [#13636] The engine's per-write "these rows are legitimately org-less"
 * declaration. Spelled structurally rather than imported: the canonical
 * type is `OrgLessWriteDeclarationOptions` in
 * `@objectstack/objectql`'s `tenancy/orgless-write-declaration.ts`, and
 * THAT package depends on this one — importing it here would be a cycle.
 * The engine validates every declaration against its ledger and throws on
 * one it does not admit, so a drift between these two spellings fails
 * loudly at the write rather than being tolerated.
 */
 orgLessWrite?: { object: string; reason: string };
 },
 ): Promise<{ id: string }>;
 update(
 table: string,
Expand DownExpand Up@@ -608,7 +621,21 @@ export class SysMetadataRepository implements MetadataRepository {
 });
 } else {
 parentRowData.created_at = now;
 await this.engine.insert('sys_metadata', parentRowData, { context: ctx });
 // [#13636] An ENV-LEVEL repository writes `organization_id: null` on
 // purpose — the #6190 option A population, a row that belongs to the
 // installation rather than to any organization. `sys_metadata` is
 // admitted as `conditional` in the engine's platform tenancy ledger, so
 // without this declaration that write is indistinguishable from a
 // forgotten stamp and is refused on a walled install. The condition is
 // the repository's own scope, fixed at construction, not a property of
 // the row being written — so an org-scoped repository never declares,
 // and a missing stamp on ITS writes still refuses.
 await this.engine.insert('sys_metadata', parentRowData, {
 context: ctx,
 ...(this.organizationId == null
 ? { orgLessWrite: { object: 'sys_metadata', reason: 'env-level-metadata' } }
 : {}),
 });
 }

 // Durable history append — same transaction, so the parent write
Expand Down
Loading
Loading

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Remove or un-stick sticky/fixed headers that block content\n(function() {\n function unstick() {\n document.querySelectorAll('header, nav, [role=\"banner\"], .header, .navbar, .sticky, .fixed-top, [style*=\"position: fixed\"], [style*=\"position:sticky\"]').forEach(function(el) {\n if (el.style.position === 'fixed' || el.style.position === 'sticky' || \n getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') {\n el.style.position = 'static';\n el.style.top = 'auto';\n el.style.zIndex = 'auto';\n }\n });\n }\n \n unstick();\n \n var observer = new MutationObserver(unstick);\n observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] });\n})();", "Kill Sticky Headers");
}
} catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
feat(objectql): declare a legitimately org-less write instead of inferring it from NULL#14923

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Closed

os-musk
wants to merge
10
commits into

from

 Closed


feat(objectql): declare a legitimately org-less write instead of inferring it from NULL
#14923
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


10 commits


Select commit
Hold shift + click to select a range
33df2b5

feat(objectql): declare a legitimately org-less write instead of infe…


claude Sep 3, 2026
d7b49cf

Merge remote-tracking branch 'origin/main' into claude/issue-13636-or…


claude Sep 3, 2026
9ef492f

fix(docs): re-anchor the system-context census line citations after t…


claude Sep 3, 2026
4c2da50

fix(#14923 review): respell the gate's bare-root literal, register th…


claude Sep 3, 2026
d126ae8

fix(docs): re-anchor the system-context census after this round's eng…


claude Sep 3, 2026
0ac778e

Merge remote-tracking branch 'origin/main' into claude/issue-13636-or…


claude Sep 3, 2026
f5d20ac

chore: regenerate the system-context census page on the merged tree


claude Sep 3, 2026
2cb2976

fix(objectql): move the tracker id off the orgless-write refusal message


claude Sep 3, 2026
6a60b04

Merge remote-tracking branch 'origin/main' into claude/issue-13636-or…


claude Sep 3, 2026
9dce213

fix(docs): repair system-context census anchor after merge conflict


claude Sep 3, 2026

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


47 changes: 47 additions & 0 deletions
.changeset/orgless-write-declaration-channel.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
---
"@objectstack/objectql": minor
"@objectstack/metadata-protocol": minor
"@objectstack/plugin-audit": minor
"@objectstack/plugin-auth": minor
"@objectstack/service-settings": minor
---

feat(objectql): an explicit per-write declaration for a legitimately org-less row

Until now one `NULL` organization on a platform object meant two different
things — a deliberate environment-level row, and a write that forgot to thread
an organization — and `resolveSystemInsertOrganization` had no way to tell them
apart. So the two objects that hold BOTH populations, `sys_metadata` (whose
non-overridable-type write lands env-wide by adjudication) and `sys_audit_log`
(whose writers enumerate their own legitimate org-less cases), had to stay
outside the tenant-audit control entirely. They are two of the largest write
populations in the platform namespace, which put the control's blind spot
exactly where it was least affordable.

Writes may now DECLARE that their rows belong to an adjudicated org-less
population:

```ts
await engine.insert('sys_metadata', row, {
 context: { isSystem: true },
 orgLessWrite: { object: 'sys_metadata', reason: 'env-level-metadata' },
});
```

The platform tenancy ledger gains a fourth verdict, `conditional`, and both
objects are admitted under it. ⚠️ Admission makes them STRICTER, not looser: an
org-less system write on either is now derived on a single-organization install
and refused loudly on a walled one, exactly as a `tenant-scoped` object's is,
and the declaration is the only way through. It is checked against the ledger
before anything else the resolver does, so a declaration naming an object the
ledger has not admitted, a reason that object does not admit, or an object other
than the one being written throws `ERR_ORGLESS_WRITE_DECLARATION_REFUSED` — no
spelling of the option is silently ignored, which is what separates a
declaration from a bypass flag. ⛔ It is not a way to quiet a refusal: a write
that simply forgot to thread an organization is the defect the refusal reports.

The platform's own six org-less writers declare, each on a test a reader can
check — the metadata repository on its own env-level scope, the audit writers on
whether the audited subject resolves an organization column at all. A new gate,
`pnpm check:orgless-write-declarations`, enumerates every declaration in the
tree, holds each to the same ledger the runtime does, and prints the count.

14 changes: 14 additions & 0 deletions
.github/workflows/lint.yml

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -3596,6 +3596,20 @@ jobs:
 - name: Read-side tenant chokepoint gate
 run: pnpm check:tenant-chokepoint

 # [#13636] The 'orgLessWrite' declaration census. The maintainer's
 # 2026-08-31 ruling put 'loud, checkable, countable' in the decision text
 # rather than in implementation notes; the engine discharges the first two
 # at the write, and this is the third — every declaration in the monorepo
 # enumerated, held to the same ledger the runtime holds it to, and COUNTED
 # on every pass. A declaration nobody can count is the silent marker that
 # ruling disqualified by name.
 #
 # Static scan over tracked sources, no build needed, so it belongs here.
 # Runs its own --self-test first: a matcher that stopped matching would
 # report OK while reading nothing.
 - name: Org-less write declaration gate
 run: pnpm check:orgless-write-declarations

 # Every committed `pnpm --filter <name>` must name a real workspace
 # package (#10853).
 #
Expand Down

26 changes: 13 additions & 13 deletions
content/docs/permissions/system-context.mdx

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -101,26 +101,26 @@ that silently does not happen.
| 12 | Per-request performance timings disclosed | observability | Get: timing headers a normal caller cannot pull | `perf-timing.ts:474` |
| 13 | Permission-set **overlay discard** skips the tenant-admin assertion | plugin-security | Get: an overlay can be discarded with no authenticated tenant administrator | `permission-set-overlay-discard.ts:142` |
| 14 | MCP stdio bridge skips the object API-exposure gate | mcp | Get: the bridge reaches objects whose `apiEnabled` / `apiMethods` would refuse an external caller | `stdio-data-bridge.ts:246` |
| 15 | **Read-audit rows are not written** | plugin-audit | Lose: the "a person opened this record" trail. `sudo()` keeps the caller's `userId`, so this flag is the only thing separating a human read from a platform one | `read-audit.ts:556` |
| 15 | **Read-audit rows are not written** | plugin-audit | Lose: the "a person opened this record" trail. `sudo()` keeps the caller's `userId`, so this flag is the only thing separating a human read from a platform one | `read-audit.ts:583` |
| 16 | Approval snapshot payload redaction skipped | plugin-approvals | Get: the whole snapshot on `find` / `findOne` — the audit/replay channel. Lose: field-visibility redaction over approval payloads | `payload-redaction-middleware.ts:115` |
| 17 | REST anonymous-deny seam satisfied | rest | Get: `enforceAuth` passes with no `userId`. Not reachable from the wire — `isSystem` is never set on an inbound request | `rest-server.ts:1552` |

### 2. Write pipeline and data integrity

| # | Behaviour when `isSystem` | Package | What you get / what you lose | Anchor |
|:--|:---|:---|:---|:---|
| 18 | **`readonly` strip bypassed — UPDATE, single row** | objectql | Get: a `readonly` field CAN be written. Lose: the protection that stops a caller seeding e.g. `approval_status` | `objectql/src/engine.ts:11289` |
| 19 | **`readonly` strip bypassed — UPDATE, bulk/predicate** | objectql | Same, on the multi-row path | `objectql/src/engine.ts:11472` |
| 20 | **`readonly` strip bypassed — INSERT (engine pass)** | objectql | Same, on create | `objectql/src/engine.ts:10024` |
| 18 | **`readonly` strip bypassed — UPDATE, single row** | objectql | Get: a `readonly` field CAN be written. Lose: the protection that stops a caller seeding e.g. `approval_status` | `objectql/src/engine.ts:11351` |
| 19 | **`readonly` strip bypassed — UPDATE, bulk/predicate** | objectql | Same, on the multi-row path | `objectql/src/engine.ts:11534` |
| 20 | **`readonly` strip bypassed — INSERT (engine pass)** | objectql | Same, on create | `objectql/src/engine.ts:10086` |
| 21 | **`readonly` strip bypassed — INSERT (protocol ingress)** | metadata-protocol | `isSystem` is the **only** exemption here. `preserveAudit` is deliberately not read on this path (#6640) — a non-system historical import is still stripped on create | `metadata-protocol/src/protocol.ts:1746` |
| 22 | Strict-drop refusal never fires | objectql | Lose: a caller that opted into loud refusal gets **silence** — strict refuses exactly what the strip would have taken, and the strip took nothing | `objectql/src/engine.ts:10072`, `readonly-strict-errors.ts:66` |
| 23 | **Referential-integrity check skipped** | objectql | Get: writes proceed against unreachable/unresolvable targets. Lose: an `isSystem` caller can write a **dangling reference** | `objectql/src/engine.ts:5891` |
| 24 | Tenant-audit warning silenced; `bypassTenantAudit` threaded to the driver | objectql | Get: unscoped system writes stop warning. Lose: the signal that would flag a genuine user-path scoping bug | `objectql/src/engine.ts:3735`, `:3745`, `:3772` |
| 22 | Strict-drop refusal never fires | objectql | Lose: a caller that opted into loud refusal gets **silence** — strict refuses exactly what the strip would have taken, and the strip took nothing | `objectql/src/engine.ts:10134`, `readonly-strict-errors.ts:66` |
| 23 | **Referential-integrity check skipped** | objectql | Get: writes proceed against unreachable/unresolvable targets. Lose: an `isSystem` caller can write a **dangling reference** | `objectql/src/engine.ts:5931` |
| 24 | Tenant-audit warning silenced; `bypassTenantAudit` threaded to the driver | objectql | Get: unscoped system writes stop warning. Lose: the signal that would flag a genuine user-path scoping bug | `objectql/src/engine.ts:3740`, `:3750`, `:3777` |
| 25 | Engine-owned / append-only write guard bypassed | plugin-security | Get: generic writes to `managedBy` engine-owned objects | `system-write-guard.ts:96`, `:120` |
| 26 | Identity write guard bypassed (ADR-0092) | plugin-auth | Get: direct writes to identity tables through the generic data path | `identity-write-guard.ts:98` |
| 27 | Search-companion column **kept** in a read's rows when it was explicitly requested | objectql | Get: the internal companion column is readable. Lose: nothing for app code — this is the engine reading its own index | `objectql/src/engine.ts:6589` |
| 28 | Dependent-count disclosure on a blocked delete | objectql | Get: the count of blocking children. Nothing was elevated past the caller, so nothing is withheld | `objectql/src/engine.ts:12084` |
| 29 | Reference-cleanup log attributes the write to `'system'` | objectql | Get: an honest actor label instead of `anonymous` when the context carries neither `userId` nor `actor` | `objectql/src/engine.ts:12013` |
| 27 | Search-companion column **kept** in a read's rows when it was explicitly requested | objectql | Get: the internal companion column is readable. Lose: nothing for app code — this is the engine reading its own index | `objectql/src/engine.ts:6629` |
| 28 | Dependent-count disclosure on a blocked delete | objectql | Get: the count of blocking children. Nothing was elevated past the caller, so nothing is withheld | `objectql/src/engine.ts:12146` |
| 29 | Reference-cleanup log attributes the write to `'system'` | objectql | Get: an honest actor label instead of `anonymous` when the context carries neither `userId` nor `actor` | `objectql/src/engine.ts:12075` |

### 3. Sharing (`plugin-sharing`)

Expand DownExpand Up@@ -179,8 +179,8 @@ a reader tracing where elevation travels needs them.

| # | Site | Package | What it does |
|:--|:---|:---|:---|
| 62 | `objectql/src/engine.ts:3542` | objectql | Propagates `isSystem` into the hook session so hooks can tell engine self-writes from user writes |
| 63 | `objectql/src/engine.ts:14433` | objectql | `ScopedContext.isSystem` getter — re-exposes the underlying execution context's flag |
| 62 | `objectql/src/engine.ts:3547` | objectql | Propagates `isSystem` into the hook session so hooks can tell engine self-writes from user writes |
| 63 | `objectql/src/engine.ts:14504` | objectql | `ScopedContext.isSystem` getter — re-exposes the underlying execution context's flag |
| 64 | `plugin-reports/src/report-service.ts:556` | plugin-reports | Threads the flag into the engine call that runs a report |
| 65 | `body-runner.ts:279` | runtime | Rebuilds an `ExecutionContext` from a hook session, carrying the flag across |

Expand All@@ -195,7 +195,7 @@ assuming `isSystem` covers it is a documented source of bugs.
|:---|:---|:---|
| "It suppresses triggers / record-change automation" | **No.** Only `skipTriggers` does. A bare `{ isSystem: true }` on a seed write re-fired automation on freshly seeded rows and wedged first boot | `metadata-protocol/src/seed-loader.ts:1971` (rationale at `:1881`–`1883`, #3760), `flow.zod.ts:702` |
| "It skips the state machine" | **No.** That is `skipStateMachine`, carried by seed replay and by `treatAsHistorical` imports | `objectql/src/engine.ts` FSM gate; see [State Machine](/docs/protocol/objectql/state-machine) |
| "It skips validation rules" | **No.** Field shape, `format`, `script` and the rest still run. The `readonly` strip runs *before* validation precisely so a discarded value is not judged | `objectql/src/engine.ts:10007`–`10024` |
| "It skips validation rules" | **No.** Field shape, `format`, `script` and the rest still run. The `readonly` strip runs *before* validation precisely so a discarded value is not judged | `objectql/src/engine.ts:10069`–`10086` |
| "It preserves a supplied `updated_at` / `updated_by`" | **No.** That is `preserveAudit`, a separate opt-in — and an UPDATE-path exemption only | `field.zod.ts:1537` (#3493 / #6640) |
| "It stamps `created_by`" | **No.** Audit stamping reads `userId` from the context. A user-less system write stamps nothing — that is today's behaviour, not an error | `runtime-identity.ts:280`–`281` |
| "It bypasses every guard" | **No.** The last-admin guard applies to **every** context, `isSystem` included — the deprovision path that actually locks an org out is the system one | `last-admin-guard.ts:299` |
Expand Down

3 changes: 2 additions & 1 deletion
content/docs/references/api/contract.mdx

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -27,7 +27,7 @@ const result = ApiErrorSchema.parse(data);

| Property | Type | Required | Description |
| :--- | :--- | :--- | :--- |
| **code** | `Enum<'VALIDATION_ERROR' \| 'INVALID_FIELD' \| 'MISSING_REQUIRED_FIELD' \| 'INVALID_FORMAT' \| 'VALUE_TOO_LONG' \| 'VALUE_TOO_SHORT' \| 'VALUE_OUT_OF_RANGE' \| … +292 more>` | ✅ | Error code (e.g. VALIDATION_ERROR; StandardErrorCode ∪ the ledger the serving side registers — ERROR_CODE_LEDGER for framework packages) |
| **code** | `Enum<'VALIDATION_ERROR' \| 'INVALID_FIELD' \| 'MISSING_REQUIRED_FIELD' \| 'INVALID_FORMAT' \| 'VALUE_TOO_LONG' \| 'VALUE_TOO_SHORT' \| 'VALUE_OUT_OF_RANGE' \| … +293 more>` | ✅ | Error code (e.g. VALIDATION_ERROR; StandardErrorCode ∪ the ledger the serving side registers — ERROR_CODE_LEDGER for framework packages) |
| **declaredCode** | `string` | optional | The producer-declared code, verbatim, when it is not a member of the closed `code` vocabulary — the open, author-authored channel (app-specific spellings; ADR-0112) |
| **message** | `string` | ✅ | Readable error message |
| **userMessage** | `string` | optional | Producer-marked user-facing refusal text, verbatim. Present exactly when the producer opted in at throw time; consumers render it to end users and keep their generic substitution for anything unmarked. Status-agnostic; never replaces `message`. |
Expand DownExpand Up@@ -156,6 +156,7 @@ const result = ApiErrorSchema.parse(data);
* `ERR_FILE_CONSTRAINT`
* `ERR_FILE_REFERENCE_COPY`
* `ERR_HOOK_TARGET_REBIND`
* `ERR_ORGLESS_WRITE_DECLARATION_REFUSED`
* `ERR_READONLY_FIELD_REJECTED`
* `ERR_SUMMARY_RECOMPUTE`
* `ERR_SYSTEM_WRITE_ORGANIZATION_REQUIRED`
Expand Down

1 change: 1 addition & 0 deletions
content/docs/references/api/error-code-ledger.mdx

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -272,6 +272,7 @@ const result = ErrorCode.parse(data);
* `ERR_FILE_CONSTRAINT`
* `ERR_FILE_REFERENCE_COPY`
* `ERR_HOOK_TARGET_REBIND`
* `ERR_ORGLESS_WRITE_DECLARATION_REFUSED`
* `ERR_READONLY_FIELD_REJECTED`
* `ERR_SUMMARY_RECOMPUTE`
* `ERR_SYSTEM_WRITE_ORGANIZATION_REQUIRED`
Expand Down

1 change: 1 addition & 0 deletions
package.json

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -151,6 +151,7 @@
 "check:resume-authority-declared": "node scripts/check-resume-authority-declared.mjs --self-test && node scripts/check-resume-authority-declared.mjs",
 "check:spec-parsed-alias": "node scripts/check-spec-parsed-alias.mjs --self-test && node scripts/check-spec-parsed-alias.mjs",
 "check:tenant-chokepoint": "node scripts/check-tenant-chokepoint.mjs --self-test && node scripts/check-tenant-chokepoint.mjs",
 "check:orgless-write-declarations": "node scripts/check-orgless-write-declarations.mjs --self-test && node scripts/check-orgless-write-declarations.mjs",
 "check:stall-guard": "node scripts/run-with-stall-guard.mjs --self-test",
 "check:stall-guard-budget": "node scripts/check-stall-guard-budget.mjs --self-test && node scripts/check-stall-guard-budget.mjs",
 "check:stall-guard-headroom": "node scripts/measure-stall-guard-headroom.mjs --self-test",
Expand Down

31 changes: 29 additions & 2 deletions
packages/metadata-protocol/src/sys-metadata-repository.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -191,7 +191,20 @@ export interface SysMetadataEngine {
 insert(
 table: string,
 data: Record<string, unknown>,
 options?: { context?: any },
 options?: {
 context?: any;
 /**
 * [#13636] The engine's per-write "these rows are legitimately org-less"
 * declaration. Spelled structurally rather than imported: the canonical
 * type is `OrgLessWriteDeclarationOptions` in
 * `@objectstack/objectql`'s `tenancy/orgless-write-declaration.ts`, and
 * THAT package depends on this one — importing it here would be a cycle.
 * The engine validates every declaration against its ledger and throws on
 * one it does not admit, so a drift between these two spellings fails
 * loudly at the write rather than being tolerated.
 */
 orgLessWrite?: { object: string; reason: string };
 },
 ): Promise<{ id: string }>;
 update(
 table: string,
Expand DownExpand Up@@ -608,7 +621,21 @@ export class SysMetadataRepository implements MetadataRepository {
 });
 } else {
 parentRowData.created_at = now;
 await this.engine.insert('sys_metadata', parentRowData, { context: ctx });
 // [#13636] An ENV-LEVEL repository writes `organization_id: null` on
 // purpose — the #6190 option A population, a row that belongs to the
 // installation rather than to any organization. `sys_metadata` is
 // admitted as `conditional` in the engine's platform tenancy ledger, so
 // without this declaration that write is indistinguishable from a
 // forgotten stamp and is refused on a walled install. The condition is
 // the repository's own scope, fixed at construction, not a property of
 // the row being written — so an org-scoped repository never declares,
 // and a missing stamp on ITS writes still refuses.
 await this.engine.insert('sys_metadata', parentRowData, {
 context: ctx,
 ...(this.organizationId == null
 ? { orgLessWrite: { object: 'sys_metadata', reason: 'env-level-metadata' } }
 : {}),
 });
 }

 // Durable history append — same transaction, so the parent write
Expand Down
Loading
Loading

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Universal Dark Mode - works on any site\n(function() {\n var enabled = true;\n \n function applyDarkMode() {\n if (!enabled) return;\n \n // Create style element if it doesn't exist\n var style = document.getElementById('universal-dark-mode-style');\n if (!style) {\n style = document.createElement('style');\n style.id = 'universal-dark-mode-style';\n document.head.appendChild(style);\n }\n \n // Dark mode CSS - inverts colors but preserves images/video\n style.textContent = '\n /* Invert everything except media */\n html {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #1a1a2e !important;\n }\n \n /* Restore images, videos, iframes, canvas */\n img, video, iframe, canvas, svg, picture, [style*=\"background-image\"] {\n filter: invert(1) hue-rotate(180deg) !important;\n }\n \n /* Preserve specific elements that should not be inverted */\n .no-dark-mode, .no-dark-mode *,\n [data-theme=\"light\"], [data-theme=\"light\"],\n .ace_editor, .ace_editor *,\n .CodeMirror, .CodeMirror *,\n .monaco-editor, .monaco-editor *,\n .markdown-body pre, .markdown-body pre *,\n .highlight, .highlight *,\n pre code, pre code * {\n filter: none !important;\n }\n \n /* Fix common UI elements */\n .modal, .popup, .dropdown-menu, .tooltip, .popover {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #2d2d44 !important;\n border-color: #444 !important;\n }\n \n /* Scrollbars */\n ::-webkit-scrollbar { background: #1a1a2e !important; }\n ::-webkit-scrollbar-thumb { background: #444 !important; }\n ::-webkit-scrollbar-thumb:hover { background: #555 !important; }\n \n /* Selection */\n ::selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ';\n }\n \n function removeDarkMode() {\n var style = document.getElementById('universal-dark-mode-style');\n if (style) style.remove();\n }\n \n // Toggle with Alt+Shift+D\n document.addEventListener('keydown', function(e) {\n if (e.altKey && e.shiftKey && e.key === 'D') {\n e.preventDefault();\n enabled = !enabled;\n if (enabled) {\n applyDarkMode();\n console.log('[Universal Dark Mode] Enabled');\n } else {\n removeDarkMode();\n console.log('[Universal Dark Mode] Disabled');\n }\n }\n });\n \n // Apply on load\n applyDarkMode();\n \n // Re-apply on dynamic content\n var observer = new MutationObserver(function(mutations) {\n if (enabled && !document.getElementById('universal-dark-mode-style')) {\n applyDarkMode();\n }\n });\n observer.observe(document.head, { childList: true });\n \n console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle');\n})();", "Universal Dark Mode");
}
} catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); }
})();
})();

Skip to content
feat(objectql): declare a legitimately org-less write instead of inferring it from NULL#14923

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Closed

os-musk
wants to merge
10
commits into

from

 Closed


feat(objectql): declare a legitimately org-less write instead of inferring it from NULL
#14923
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


10 commits


Select commit
Hold shift + click to select a range
33df2b5

feat(objectql): declare a legitimately org-less write instead of infe…


claude Sep 3, 2026
d7b49cf

Merge remote-tracking branch 'origin/main' into claude/issue-13636-or…


claude Sep 3, 2026
9ef492f

fix(docs): re-anchor the system-context census line citations after t…


claude Sep 3, 2026
4c2da50

fix(#14923 review): respell the gate's bare-root literal, register th…


claude Sep 3, 2026
d126ae8

fix(docs): re-anchor the system-context census after this round's eng…


claude Sep 3, 2026
0ac778e

Merge remote-tracking branch 'origin/main' into claude/issue-13636-or…


claude Sep 3, 2026
f5d20ac

chore: regenerate the system-context census page on the merged tree


claude Sep 3, 2026
2cb2976

fix(objectql): move the tracker id off the orgless-write refusal message


claude Sep 3, 2026
6a60b04

Merge remote-tracking branch 'origin/main' into claude/issue-13636-or…


claude Sep 3, 2026
9dce213

fix(docs): repair system-context census anchor after merge conflict


claude Sep 3, 2026

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


47 changes: 47 additions & 0 deletions
.changeset/orgless-write-declaration-channel.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
---
"@objectstack/objectql": minor
"@objectstack/metadata-protocol": minor
"@objectstack/plugin-audit": minor
"@objectstack/plugin-auth": minor
"@objectstack/service-settings": minor
---

feat(objectql): an explicit per-write declaration for a legitimately org-less row

Until now one `NULL` organization on a platform object meant two different
things — a deliberate environment-level row, and a write that forgot to thread
an organization — and `resolveSystemInsertOrganization` had no way to tell them
apart. So the two objects that hold BOTH populations, `sys_metadata` (whose
non-overridable-type write lands env-wide by adjudication) and `sys_audit_log`
(whose writers enumerate their own legitimate org-less cases), had to stay
outside the tenant-audit control entirely. They are two of the largest write
populations in the platform namespace, which put the control's blind spot
exactly where it was least affordable.

Writes may now DECLARE that their rows belong to an adjudicated org-less
population:

```ts
await engine.insert('sys_metadata', row, {
 context: { isSystem: true },
 orgLessWrite: { object: 'sys_metadata', reason: 'env-level-metadata' },
});
```

The platform tenancy ledger gains a fourth verdict, `conditional`, and both
objects are admitted under it. ⚠️ Admission makes them STRICTER, not looser: an
org-less system write on either is now derived on a single-organization install
and refused loudly on a walled one, exactly as a `tenant-scoped` object's is,
and the declaration is the only way through. It is checked against the ledger
before anything else the resolver does, so a declaration naming an object the
ledger has not admitted, a reason that object does not admit, or an object other
than the one being written throws `ERR_ORGLESS_WRITE_DECLARATION_REFUSED` — no
spelling of the option is silently ignored, which is what separates a
declaration from a bypass flag. ⛔ It is not a way to quiet a refusal: a write
that simply forgot to thread an organization is the defect the refusal reports.

The platform's own six org-less writers declare, each on a test a reader can
check — the metadata repository on its own env-level scope, the audit writers on
whether the audited subject resolves an organization column at all. A new gate,
`pnpm check:orgless-write-declarations`, enumerates every declaration in the
tree, holds each to the same ledger the runtime does, and prints the count.

14 changes: 14 additions & 0 deletions
.github/workflows/lint.yml

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -3596,6 +3596,20 @@ jobs:
 - name: Read-side tenant chokepoint gate
 run: pnpm check:tenant-chokepoint

 # [#13636] The 'orgLessWrite' declaration census. The maintainer's
 # 2026-08-31 ruling put 'loud, checkable, countable' in the decision text
 # rather than in implementation notes; the engine discharges the first two
 # at the write, and this is the third — every declaration in the monorepo
 # enumerated, held to the same ledger the runtime holds it to, and COUNTED
 # on every pass. A declaration nobody can count is the silent marker that
 # ruling disqualified by name.
 #
 # Static scan over tracked sources, no build needed, so it belongs here.
 # Runs its own --self-test first: a matcher that stopped matching would
 # report OK while reading nothing.
 - name: Org-less write declaration gate
 run: pnpm check:orgless-write-declarations

 # Every committed `pnpm --filter <name>` must name a real workspace
 # package (#10853).
 #
Expand Down

26 changes: 13 additions & 13 deletions
content/docs/permissions/system-context.mdx

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -101,26 +101,26 @@ that silently does not happen.
| 12 | Per-request performance timings disclosed | observability | Get: timing headers a normal caller cannot pull | `perf-timing.ts:474` |
| 13 | Permission-set **overlay discard** skips the tenant-admin assertion | plugin-security | Get: an overlay can be discarded with no authenticated tenant administrator | `permission-set-overlay-discard.ts:142` |
| 14 | MCP stdio bridge skips the object API-exposure gate | mcp | Get: the bridge reaches objects whose `apiEnabled` / `apiMethods` would refuse an external caller | `stdio-data-bridge.ts:246` |
| 15 | **Read-audit rows are not written** | plugin-audit | Lose: the "a person opened this record" trail. `sudo()` keeps the caller's `userId`, so this flag is the only thing separating a human read from a platform one | `read-audit.ts:556` |
| 15 | **Read-audit rows are not written** | plugin-audit | Lose: the "a person opened this record" trail. `sudo()` keeps the caller's `userId`, so this flag is the only thing separating a human read from a platform one | `read-audit.ts:583` |
| 16 | Approval snapshot payload redaction skipped | plugin-approvals | Get: the whole snapshot on `find` / `findOne` — the audit/replay channel. Lose: field-visibility redaction over approval payloads | `payload-redaction-middleware.ts:115` |
| 17 | REST anonymous-deny seam satisfied | rest | Get: `enforceAuth` passes with no `userId`. Not reachable from the wire — `isSystem` is never set on an inbound request | `rest-server.ts:1552` |

### 2. Write pipeline and data integrity

| # | Behaviour when `isSystem` | Package | What you get / what you lose | Anchor |
|:--|:---|:---|:---|:---|
| 18 | **`readonly` strip bypassed — UPDATE, single row** | objectql | Get: a `readonly` field CAN be written. Lose: the protection that stops a caller seeding e.g. `approval_status` | `objectql/src/engine.ts:11289` |
| 19 | **`readonly` strip bypassed — UPDATE, bulk/predicate** | objectql | Same, on the multi-row path | `objectql/src/engine.ts:11472` |
| 20 | **`readonly` strip bypassed — INSERT (engine pass)** | objectql | Same, on create | `objectql/src/engine.ts:10024` |
| 18 | **`readonly` strip bypassed — UPDATE, single row** | objectql | Get: a `readonly` field CAN be written. Lose: the protection that stops a caller seeding e.g. `approval_status` | `objectql/src/engine.ts:11351` |
| 19 | **`readonly` strip bypassed — UPDATE, bulk/predicate** | objectql | Same, on the multi-row path | `objectql/src/engine.ts:11534` |
| 20 | **`readonly` strip bypassed — INSERT (engine pass)** | objectql | Same, on create | `objectql/src/engine.ts:10086` |
| 21 | **`readonly` strip bypassed — INSERT (protocol ingress)** | metadata-protocol | `isSystem` is the **only** exemption here. `preserveAudit` is deliberately not read on this path (#6640) — a non-system historical import is still stripped on create | `metadata-protocol/src/protocol.ts:1746` |
| 22 | Strict-drop refusal never fires | objectql | Lose: a caller that opted into loud refusal gets **silence** — strict refuses exactly what the strip would have taken, and the strip took nothing | `objectql/src/engine.ts:10072`, `readonly-strict-errors.ts:66` |
| 23 | **Referential-integrity check skipped** | objectql | Get: writes proceed against unreachable/unresolvable targets. Lose: an `isSystem` caller can write a **dangling reference** | `objectql/src/engine.ts:5891` |
| 24 | Tenant-audit warning silenced; `bypassTenantAudit` threaded to the driver | objectql | Get: unscoped system writes stop warning. Lose: the signal that would flag a genuine user-path scoping bug | `objectql/src/engine.ts:3735`, `:3745`, `:3772` |
| 22 | Strict-drop refusal never fires | objectql | Lose: a caller that opted into loud refusal gets **silence** — strict refuses exactly what the strip would have taken, and the strip took nothing | `objectql/src/engine.ts:10134`, `readonly-strict-errors.ts:66` |
| 23 | **Referential-integrity check skipped** | objectql | Get: writes proceed against unreachable/unresolvable targets. Lose: an `isSystem` caller can write a **dangling reference** | `objectql/src/engine.ts:5931` |
| 24 | Tenant-audit warning silenced; `bypassTenantAudit` threaded to the driver | objectql | Get: unscoped system writes stop warning. Lose: the signal that would flag a genuine user-path scoping bug | `objectql/src/engine.ts:3740`, `:3750`, `:3777` |
| 25 | Engine-owned / append-only write guard bypassed | plugin-security | Get: generic writes to `managedBy` engine-owned objects | `system-write-guard.ts:96`, `:120` |
| 26 | Identity write guard bypassed (ADR-0092) | plugin-auth | Get: direct writes to identity tables through the generic data path | `identity-write-guard.ts:98` |
| 27 | Search-companion column **kept** in a read's rows when it was explicitly requested | objectql | Get: the internal companion column is readable. Lose: nothing for app code — this is the engine reading its own index | `objectql/src/engine.ts:6589` |
| 28 | Dependent-count disclosure on a blocked delete | objectql | Get: the count of blocking children. Nothing was elevated past the caller, so nothing is withheld | `objectql/src/engine.ts:12084` |
| 29 | Reference-cleanup log attributes the write to `'system'` | objectql | Get: an honest actor label instead of `anonymous` when the context carries neither `userId` nor `actor` | `objectql/src/engine.ts:12013` |
| 27 | Search-companion column **kept** in a read's rows when it was explicitly requested | objectql | Get: the internal companion column is readable. Lose: nothing for app code — this is the engine reading its own index | `objectql/src/engine.ts:6629` |
| 28 | Dependent-count disclosure on a blocked delete | objectql | Get: the count of blocking children. Nothing was elevated past the caller, so nothing is withheld | `objectql/src/engine.ts:12146` |
| 29 | Reference-cleanup log attributes the write to `'system'` | objectql | Get: an honest actor label instead of `anonymous` when the context carries neither `userId` nor `actor` | `objectql/src/engine.ts:12075` |

### 3. Sharing (`plugin-sharing`)

Expand DownExpand Up@@ -179,8 +179,8 @@ a reader tracing where elevation travels needs them.

| # | Site | Package | What it does |
|:--|:---|:---|:---|
| 62 | `objectql/src/engine.ts:3542` | objectql | Propagates `isSystem` into the hook session so hooks can tell engine self-writes from user writes |
| 63 | `objectql/src/engine.ts:14433` | objectql | `ScopedContext.isSystem` getter — re-exposes the underlying execution context's flag |
| 62 | `objectql/src/engine.ts:3547` | objectql | Propagates `isSystem` into the hook session so hooks can tell engine self-writes from user writes |
| 63 | `objectql/src/engine.ts:14504` | objectql | `ScopedContext.isSystem` getter — re-exposes the underlying execution context's flag |
| 64 | `plugin-reports/src/report-service.ts:556` | plugin-reports | Threads the flag into the engine call that runs a report |
| 65 | `body-runner.ts:279` | runtime | Rebuilds an `ExecutionContext` from a hook session, carrying the flag across |

Expand All@@ -195,7 +195,7 @@ assuming `isSystem` covers it is a documented source of bugs.
|:---|:---|:---|
| "It suppresses triggers / record-change automation" | **No.** Only `skipTriggers` does. A bare `{ isSystem: true }` on a seed write re-fired automation on freshly seeded rows and wedged first boot | `metadata-protocol/src/seed-loader.ts:1971` (rationale at `:1881`–`1883`, #3760), `flow.zod.ts:702` |
| "It skips the state machine" | **No.** That is `skipStateMachine`, carried by seed replay and by `treatAsHistorical` imports | `objectql/src/engine.ts` FSM gate; see [State Machine](/docs/protocol/objectql/state-machine) |
| "It skips validation rules" | **No.** Field shape, `format`, `script` and the rest still run. The `readonly` strip runs *before* validation precisely so a discarded value is not judged | `objectql/src/engine.ts:10007`–`10024` |
| "It skips validation rules" | **No.** Field shape, `format`, `script` and the rest still run. The `readonly` strip runs *before* validation precisely so a discarded value is not judged | `objectql/src/engine.ts:10069`–`10086` |
| "It preserves a supplied `updated_at` / `updated_by`" | **No.** That is `preserveAudit`, a separate opt-in — and an UPDATE-path exemption only | `field.zod.ts:1537` (#3493 / #6640) |
| "It stamps `created_by`" | **No.** Audit stamping reads `userId` from the context. A user-less system write stamps nothing — that is today's behaviour, not an error | `runtime-identity.ts:280`–`281` |
| "It bypasses every guard" | **No.** The last-admin guard applies to **every** context, `isSystem` included — the deprovision path that actually locks an org out is the system one | `last-admin-guard.ts:299` |
Expand Down

3 changes: 2 additions & 1 deletion
content/docs/references/api/contract.mdx

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -27,7 +27,7 @@ const result = ApiErrorSchema.parse(data);

| Property | Type | Required | Description |
| :--- | :--- | :--- | :--- |
| **code** | `Enum<'VALIDATION_ERROR' \| 'INVALID_FIELD' \| 'MISSING_REQUIRED_FIELD' \| 'INVALID_FORMAT' \| 'VALUE_TOO_LONG' \| 'VALUE_TOO_SHORT' \| 'VALUE_OUT_OF_RANGE' \| … +292 more>` | ✅ | Error code (e.g. VALIDATION_ERROR; StandardErrorCode ∪ the ledger the serving side registers — ERROR_CODE_LEDGER for framework packages) |
| **code** | `Enum<'VALIDATION_ERROR' \| 'INVALID_FIELD' \| 'MISSING_REQUIRED_FIELD' \| 'INVALID_FORMAT' \| 'VALUE_TOO_LONG' \| 'VALUE_TOO_SHORT' \| 'VALUE_OUT_OF_RANGE' \| … +293 more>` | ✅ | Error code (e.g. VALIDATION_ERROR; StandardErrorCode ∪ the ledger the serving side registers — ERROR_CODE_LEDGER for framework packages) |
| **declaredCode** | `string` | optional | The producer-declared code, verbatim, when it is not a member of the closed `code` vocabulary — the open, author-authored channel (app-specific spellings; ADR-0112) |
| **message** | `string` | ✅ | Readable error message |
| **userMessage** | `string` | optional | Producer-marked user-facing refusal text, verbatim. Present exactly when the producer opted in at throw time; consumers render it to end users and keep their generic substitution for anything unmarked. Status-agnostic; never replaces `message`. |
Expand DownExpand Up@@ -156,6 +156,7 @@ const result = ApiErrorSchema.parse(data);
* `ERR_FILE_CONSTRAINT`
* `ERR_FILE_REFERENCE_COPY`
* `ERR_HOOK_TARGET_REBIND`
* `ERR_ORGLESS_WRITE_DECLARATION_REFUSED`
* `ERR_READONLY_FIELD_REJECTED`
* `ERR_SUMMARY_RECOMPUTE`
* `ERR_SYSTEM_WRITE_ORGANIZATION_REQUIRED`
Expand Down

1 change: 1 addition & 0 deletions
content/docs/references/api/error-code-ledger.mdx

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -272,6 +272,7 @@ const result = ErrorCode.parse(data);
* `ERR_FILE_CONSTRAINT`
* `ERR_FILE_REFERENCE_COPY`
* `ERR_HOOK_TARGET_REBIND`
* `ERR_ORGLESS_WRITE_DECLARATION_REFUSED`
* `ERR_READONLY_FIELD_REJECTED`
* `ERR_SUMMARY_RECOMPUTE`
* `ERR_SYSTEM_WRITE_ORGANIZATION_REQUIRED`
Expand Down

1 change: 1 addition & 0 deletions
package.json

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -151,6 +151,7 @@
 "check:resume-authority-declared": "node scripts/check-resume-authority-declared.mjs --self-test && node scripts/check-resume-authority-declared.mjs",
 "check:spec-parsed-alias": "node scripts/check-spec-parsed-alias.mjs --self-test && node scripts/check-spec-parsed-alias.mjs",
 "check:tenant-chokepoint": "node scripts/check-tenant-chokepoint.mjs --self-test && node scripts/check-tenant-chokepoint.mjs",
 "check:orgless-write-declarations": "node scripts/check-orgless-write-declarations.mjs --self-test && node scripts/check-orgless-write-declarations.mjs",
 "check:stall-guard": "node scripts/run-with-stall-guard.mjs --self-test",
 "check:stall-guard-budget": "node scripts/check-stall-guard-budget.mjs --self-test && node scripts/check-stall-guard-budget.mjs",
 "check:stall-guard-headroom": "node scripts/measure-stall-guard-headroom.mjs --self-test",
Expand Down

31 changes: 29 additions & 2 deletions
packages/metadata-protocol/src/sys-metadata-repository.ts

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -191,7 +191,20 @@ export interface SysMetadataEngine {
 insert(
 table: string,
 data: Record<string, unknown>,
 options?: { context?: any },
 options?: {
 context?: any;
 /**
 * [#13636] The engine's per-write "these rows are legitimately org-less"
 * declaration. Spelled structurally rather than imported: the canonical
 * type is `OrgLessWriteDeclarationOptions` in
 * `@objectstack/objectql`'s `tenancy/orgless-write-declaration.ts`, and
 * THAT package depends on this one — importing it here would be a cycle.
 * The engine validates every declaration against its ledger and throws on
 * one it does not admit, so a drift between these two spellings fails
 * loudly at the write rather than being tolerated.
 */
 orgLessWrite?: { object: string; reason: string };
 },
 ): Promise<{ id: string }>;
 update(
 table: string,
Expand DownExpand Up@@ -608,7 +621,21 @@ export class SysMetadataRepository implements MetadataRepository {
 });
 } else {
 parentRowData.created_at = now;
 await this.engine.insert('sys_metadata', parentRowData, { context: ctx });
 // [#13636] An ENV-LEVEL repository writes `organization_id: null` on
 // purpose — the #6190 option A population, a row that belongs to the
 // installation rather than to any organization. `sys_metadata` is
 // admitted as `conditional` in the engine's platform tenancy ledger, so
 // without this declaration that write is indistinguishable from a
 // forgotten stamp and is refused on a walled install. The condition is
 // the repository's own scope, fixed at construction, not a property of
 // the row being written — so an org-scoped repository never declares,
 // and a missing stamp on ITS writes still refuses.
 await this.engine.insert('sys_metadata', parentRowData, {
 context: ctx,
 ...(this.organizationId == null
 ? { orgLessWrite: { object: 'sys_metadata', reason: 'env-level-metadata' } }
 : {}),
 });
 }

 // Durable history append — same transaction, so the parent write
Expand Down
Loading
Loading