Skip to content

test(tenancy): prove Program and service read isolation (#157) #370

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
smiggleworth merged 4 commits into from
Sep 23, 2026
+852 −0
Merged

test(tenancy): prove Program and service read isolation (#157) #370

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
12c0a76
test(tenancy): prove Program and service read isolation (#157)
smiggleworth Sep 23, 2026
82fdfeb
test(tenancy): verify cursor exhaustion and tenant transplant (#157)
smiggleworth Sep 23, 2026
7884445
test(tenancy): reject foreign program cursors and check content (#157)
smiggleworth Sep 23, 2026
41e8e25
test(tenancy): prove exact program and service reads (#157)
smiggleworth Sep 23, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 7 additions & 0 deletions docs/architecture/program-service-read-leak-evidence.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,7 @@
# Program and client-service read isolation

`ProgramReadLeakMatrixE2ETests` contributes to [EN-01 backend #157](https://github.com/bdgrz/compliance/issues/157). In standalone and split API/worker hosts, one member owns two populated tenants and an unrelated member exercises denial. Each tenant has two Programs, two client services under its first Program, and two draft boundaries. The first Program and service each have two revisions.

HTTP and MCP reads cover current Program and service detail, Program and service revision detail, Program list, Program history, tenant and Program service lists, service history, and boundary-derived Program setup work. List tests follow `limit=1` cursors to a terminal page, check every seeded ID and tenant-specific name, and require an A-issued cursor to fail in B with HTTP `BadRequest` and MCP `Validation`. Exact reads check current revision, history versions 1 and 2, content, and the service's owning Program. Foreign IDs in the other tenant and an unrelated member receive `NotFound` over both transports. The setup-work pages contain only the two seeded boundary sources.

This fixture does not prove stopped-worker replay, attributable Program stage transitions, or future setup-work inputs beyond boundaries. These routes expose no separate count or search operation. The broader current-surface inventory remains in [tenant-read-leak-matrix.md](tenant-read-leak-matrix.md).
Loading