fix(spec)!: HierarchyScopeContext 声明 organizationId 为权威租户字段并转必填 (#5858) by qq9340100 · Pull Request #5973 · objectstack-ai/objectstack

qq9340100 · 2026-08-06T13:35:49Z

按 issue 上 PM 2026-08-06 裁决执行(B + C + fail-closed doc)。⛔ 未重开方向讨论。

改了什么

packages/spec/src/contracts/sharing-service.ts 一处契约:

B —— organizationId 定为权威字段。doc 写明「承载调用方的活动组织,null = platform/unscoped」,措辞与 packages/spec/src/identity/eval-user.zod.ts:129 的 EvalUser.organizationId describe 对齐,并在注释里点名依据(Unify the developer-facing org identifier: hooks expose session.tenantId while RLS/seed/columns use organizationId (add organizationId as the blessed name) #3280 定名、Remove the deprecated hook/action ctx.session.tenantId alias in the next major (converge on organizationId) #3290 v11 移除 session.tenantId 别名、scripts/check-org-identifier.mjs 硬门)。
C —— 权威字段转必填:organizationId?: string | null 改为 organizationId: string | null。producer 漏填从「doc 没说清楚」变成 typecheck 失败;「没有组织」仍然合法,但必须显式写成 null —— null 是值,不是缺省。
tenantId 保留为 deprecated 别名,⛔ 未删除。JSDoc 标 @deprecated,写明它仍是通用 driver 层租户旋钮(database-per-tenant 内核里合法地放 environment id),并明确「resolver 不得单独依赖它,也不得拿它顶替为 null 的 organizationId」。退役另行立单。
IHierarchyScopeResolver.resolveOwnerIds 补 fail-closed 义务:权威字段为 null 时实现方必须 fail-closed —— 「没有组织」永远不等于「所有组织」,返回 owner-only 或抛出(sharing 层同等处理),⛔ 不得静默按无租户约束构建 owner set,也不得退回读 tenantId。

外加 .changeset/hierarchy-scope-organization-authority.md(@objectstack/spec: major)与钉子测试。未碰 packages/plugins/plugin-sharing 的任何代码(生产逻辑与测试都没动 —— 见下方「机械补齐:零处」)。

P1 / P2 / P3 前提核验(全部成立)

P1 —— check-org-identifier.mjs 门与 #3280/#3290 公约仍活着:成立。

$ git ls-tree origin/main -- scripts/check-org-identifier.mjs
100644 blob 007057a39f42e2e53e0d67b903efa86e8faa450d	scripts/check-org-identifier.mjs

$ git grep -n "check-org-identifier\|check:org-identifier" origin/main -- .github/workflows/ package.json
origin/main:.github/workflows/lint.yml:171:        run: pnpm check:org-identifier
origin/main:package.json:41:    "check:org-identifier": "node scripts/check-org-identifier.mjs",

脚本头部原文仍在陈述该公约:「#3280 made organizationId the blessed developer-facing name for the caller's active org across the JS authoring surface … #3290 REMOVED it from the hook/action ctx.session surface entirely (v11 major)」。同一段还自己记录了本裁决援引的那条:driver 层 tenantId 在 database-per-tenant 内核里合法地是 environment id,门禁刻意不匹配它。本地跑过一遍:check-org-identifier: OK (1660 author-facing source file(s), no removed session.tenantId alias)。

P2 —— 仓内唯一 producer 仍是 plugin-sharing/src/sharing-service.ts:875-880:成立。

HierarchyScopeContext 是结构化类型,构造点即「传给 resolveOwnerIds 的第一实参」。两轮普查:

$ git grep -n "HierarchyScopeContext" origin/main
origin/main:packages/spec/api-surface.json:3603:    "HierarchyScopeContext (interface)",
origin/main:packages/spec/src/contracts/sharing-service.ts:396:export interface HierarchyScopeContext {
origin/main:packages/spec/src/contracts/sharing-service.ts:424:  resolveOwnerIds(context: HierarchyScopeContext, scope: HierarchyScope): Promise...

$ git grep -n "resolveOwnerIds(" origin/main -- '*.ts' '*.tsx' '*.mts' '*.mjs' | grep -v CHANGELOG
origin/main:packages/plugins/plugin-sharing/src/sharing-service.ts:875:      const ids = await resolver.resolveOwnerIds(     ← 唯一构造点
origin/main:packages/qa/dogfood/test/showcase-scope-depth-fallback.dogfood.test.ts:71:    async resolveOwnerIds(c: any, sc: string)
origin/main:packages/qa/dogfood/test/showcase-scope-depth-write.dogfood.test.ts:82:      async resolveOwnerIds(c: any, sc: string)
origin/main:packages/qa/dogfood/test/showcase-scope-depth.dogfood.test.ts:60:    async resolveOwnerIds(c: any, sc: string)
origin/main:packages/spec/src/contracts/sharing-service.ts:424: (契约声明本身)

该类型在 spec 之外零 import,所以不存在「显式标注了该类型的第三处」。后 4 处全是 resolver 实现(消费侧,签名 c: any),不是构造点;plugin-sharing/src/sharing-service.test.ts:853/867/881/893 同理,是 stub resolver 而非 stub context。

机械补齐:零处。 唯一构造点 :875-880 本来就填了 organizationId 这个键(填的是恒 null 的值 —— 语义修复归 #5859,本单⛔不做),所以必填化在本仓内是零破坏。实测两个可能受影响的包 typecheck 全绿,没有一处需要补 organizationId: null:

$ pnpm --workspace-concurrency=2 --filter @objectstack/plugin-sharing --filter @objectstack/dogfood typecheck
packages/plugins/plugin-sharing typecheck: Done
packages/qa/dogfood typecheck: Done

如实申报一处与裁决预期的偏差:裁决预计「qa/dogfood 与 plugin-sharing 测试 stub」需要补键,实测不需要 —— 因为它们是 resolver 实现而不是 context 构造点。裁决对生产构造点「预计不红」的判断则完全成立。

P3 —— PM 裁决评论仍是最后一条裁决:成立。 issue #5858 共 2 条评论:认领评论(12:28:59Z)+ PM 裁决评论(12:41:15Z)。裁决之后无任何评论,不存在更晚的维护者否决。

测试

钉子落在 packages/spec/src/contracts/sharing-service.test.ts(该文件在 packages/spec/test-typecheck-debt.json 里无条目,即错误预算为 0 —— 任何新错误直接让 check:test-typecheck 变红;#5286 的机制)。

编译期探针 ×2(钉 C 不回退):漏写 organizationId 的对象字面量、以及只给 tenantId 的对象字面量,各带一条 @ts-expect-error。
必填键双向钉:用一个 RequiredKeys 映射类型取出必填键集合,正向断言恰为 ['userId', 'organizationId'],反向用 @ts-expect-error 钉住 tenantId 仍是可选 —— 这同时是「⛔ 不删除 tenantId」的守卫(删了它,反向那行引用即断)。
散文钉(钉 B 与 fail-closed doc):走 TypeScript AST 读成员的 leading trivia(沿用同文件 spec 契约文档漂移:ISharingService.canEdit 未提 modifyAllRecords 旁路(canDelete 提了) #5125 那条钉子的写法),断言成员集合恰为 ['userId', 'organizationId', 'tenantId'](反空过),organizationId doc 含 AUTHORITATIVE / platform/unscoped / MUST scope its owner set by this field,tenantId doc 含 @deprecated / Not the authority for hierarchy scoping,resolveOwnerIds doc 含 Fail CLOSED / never widen;并以 userId 作诚实反例(断言它不含 AUTHORITATIVE —— 它是身份不是租户),证明匹配是有区分度的。

反向验证(方向为预先判定的「红」,实测吻合)。 把 ? 放回去、其余不动,重跑测试层 tsc:

src/contracts/sharing-service.test.ts(172,5): error TS2578: Unused '@ts-expect-error' directive.
src/contracts/sharing-service.test.ts(177,5): error TS2578: Unused '@ts-expect-error' directive.
src/contracts/sharing-service.test.ts(193,78): error TS2322: Type '"organizationId"' is not assignable to type '"userId"'.

3 条错误落在预算为 0 的文件上 → 红。恢复后复跑,typecheck 与 check:test-typecheck 均绿。

正向证据(全部前台阻塞执行,共享 flock 串行):

$ pnpm --filter @objectstack/spec test
 Test Files  323 passed (323)
      Tests  8270 passed (8270)

$ pnpm --filter @objectstack/spec typecheck
✓ check:test-typecheck --self-test — 8 semantic case(s) + the parser hold.
check:test-typecheck: OK — @objectstack/spec's test layer compiles under packages/spec/tsconfig.test.json;
  79 file(s) / 691 error(s) held in test-typecheck-debt.json (shrink-only)

$ pnpm --filter @objectstack/plugin-sharing test
 Test Files  13 passed (13)
      Tests  347 passed (347)

$ pnpm lint            # eslint . --no-inline-config,零输出
$ pnpm check:nul-bytes # OK (scanned 5726 tracked text file(s); no raw ASCII control bytes)
$ pnpm check:org-identifier / check:doc-authoring / check:adr-anchors / check:authz-resolver
  / check:error-code-casing / check:engine-double-contract / check:role-word   # 全绿

生成物

按纪律整体重生成(⛔ 未手改任何生成物,⛔ 未动 authorable-surface.base.json 锚点):gen:schema → gen:openapi(#5371)→ gen:api-surface。结果:生成物零 diff —— 本单改的是纯 TypeScript 接口(无 Zod schema、无新增/删除导出),api-surface.json 只记录名字级别的存在性,HierarchyScopeContext 早已在册。

$ git status --short
 M packages/spec/src/contracts/sharing-service.test.ts
 M packages/spec/src/contracts/sharing-service.ts

$ pnpm --filter @objectstack/spec check:generated
✓ All 10 generated artifacts are up to date.
$ pnpm --filter @objectstack/spec check:api-surface
@objectstack/spec public API surface + factory signatures unchanged ✓
$ pnpm --filter @objectstack/spec check:authorable-surface / check:docs / check:spec-changes
  / check:upgrade-guide / check:exported-any / check:dual-source-exports   # 全绿

authorable-surface.base.json 相对 72bd873 滞后 16 个 key —— 生成器自己声明这是预期而非错误,按纪律不做重锚。

changeset 档位

@objectstack/spec: major。必填化对 producer 是 breaking(implementer 反而更容易 —— 必填属性只会让消费更简单)。当前处于 v17 rc 窗口(packages/spec 版本 17.0.0-rc.2,.changeset/pre.json 为 mode: pre / tag: rc),窗口内 @objectstack/spec: major 是既有惯例而非新开先例,同窗口在库的同档 changeset 包括 adr-0113-required-write-contract.md(同为「把一个宽松契约收紧成必填/强制」)、adr-0114-field-errors-rename.md、多个 retire-*。故本单按 major 落,⛔ 未为了凑档位把字段降级回 optional。

与同批其他单的关系(如实申报)

spec: 按 ADR-0049 摘除 IStorageService.list(prefix) 契约成员(零消费方,双适配器语义分叉 —— #5266 方案 2,维护者已批) #5540(packages/spec/src/contracts/storage-service.ts 摘 IStorageService.list):同目录不同文件,零共享符号。PM 预警的「生成物基线相交」在本单侧没有发生 —— 本 PR 生成物零 diff(上面已实测),而 spec: 按 ADR-0049 摘除 IStorageService.list(prefix) 契约成员(零消费方,双适配器语义分叉 —— #5266 方案 2,维护者已批) #5540 摘导出必然改 api-surface.json,所以串行接力时冲突面是单向的,只在 spec: 按 ADR-0049 摘除 IStorageService.list(prefix) 契约成员(零消费方,双适配器语义分叉 —— #5266 方案 2,维护者已批) #5540 那一侧。
[#5588 裁 C · 第二棒] build-openapi.ts 摘除 built-in 路由段生成 —— spec 静态产物只保留 components.schemas / info / securitySchemes #5744(packages/spec/scripts/build-openapi.ts 摘路由段):不同文件;本单未动任何 Zod schema,重跑 gen:openapi 后 openapi.json 零 diff。
shared/http.zod.ts 的两个不同 enum 发布成同一个 JSON Schema 名 HttpMethod，后写覆盖前写 —— 参考页只描述了 5 值那份，7 值的线上契约（HEAD/OPTIONS）不见了 #5832(shared/http.zod.ts 的 HttpMethod def-key 碰撞):不同文件,且 HierarchyScopeContext 是纯 TS 接口、根本不进 json-schema 的 def-key 命名空间。
HookEvent 的枚举注释仍在说批量写把行级谓词「carried in input」—— 与 #5273 同一句假话,在同文件 40 行之外 #5899(data/hook.zod.ts 的 HookEvent 注释订正):不同文件,纯注释。

四单均为「完全无影响」 —— 既没变简单,也没变难,更没变得不必要。没有任何一单的完成范围被本 PR 覆盖或抢跑。

未做的事(范围红线)

⛔ 未删除 tenantId(也未删 organizationId)—— 退役走单独流程。
⛔ 未碰 packages/plugins/plugin-sharing:producer 把租户值真正映射进 organizationId 的语义修复归 [#5852 producer 半边] resolveOwnerScopeIds 按权威字段填充 hierarchy resolver context + 补「resolver 收到的 org 非空」断言 #5859(identity 车道),本单只把契约面钉住,让那处修复有一个明确的目标字段。
⛔ 未碰 cloud;consumer 侧的 fail-closed 断言归 cloud 对应单。

Generated by Claude Code

… authority and requires it (#5858) `HierarchyScopeContext` declared `organizationId?` and `tenantId?` side by side with no doc saying which one carries the caller's active organization. The one in-repo producer filled `organizationId` from a `SharingExecutionContext` whose only tenancy member is `tenantId` (structurally always null), while the real consumer reads `organizationId` and skipped tenant isolation on null — two individually contract-compliant ends adding up to a reachable cross-org read (#5852). - `organizationId` documented as AUTHORITATIVE (null = platform/unscoped, matching `EvalUser.organizationId`), per the #3280/#3290 naming convention that `scripts/check-org-identifier.mjs` gates. - `organizationId?: string | null` -> `organizationId: string | null`: a producer that omits the caller's org now fails to compile instead of handing every resolver an `undefined`. - `tenantId` retained as a `@deprecated` alias (NOT removed) with the explicit "a resolver must not depend on it alone" obligation. - `IHierarchyScopeResolver.resolveOwnerIds` documents the fail-closed rule: a null organization is "no org", never "every org". Pins: two compile-time probes (`@ts-expect-error` on the omitted field and on tenantId-only; a RequiredKeys pin in both directions) plus an AST prose pin over the three doc obligations, in a file with a zero budget in test-typecheck-debt.json. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_011M7UwH25Unfi73UHim7ajY

vercel · 2026-08-06T13:35:56Z

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
objectstack	Ignored		Aug 6, 2026 1:35pm

github-actions · 2026-08-06T13:36:23Z

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/spec.

111 hand-written doc(s) reference the affected code and may need an implementation-accuracy re-verification:

content/docs/ai/agents.mdx (via @objectstack/spec)
content/docs/ai/skills-reference.mdx (via @objectstack/spec)
content/docs/ai/skills.mdx (via @objectstack/spec)
content/docs/api/client-sdk.mdx (via @objectstack/spec)
content/docs/api/environment-routing.mdx (via @objectstack/spec)
content/docs/api/error-catalog.mdx (via @objectstack/spec)
content/docs/api/error-handling-client.mdx (via @objectstack/spec)
content/docs/api/error-handling-server.mdx (via @objectstack/spec)
content/docs/api/index.mdx (via @objectstack/spec)
content/docs/automation/approvals.mdx (via @objectstack/spec)
content/docs/automation/connectors.mdx (via @objectstack/spec)
content/docs/automation/flows.mdx (via @objectstack/spec)
content/docs/automation/hook-bodies.mdx (via packages/spec)
content/docs/automation/hooks.mdx (via @objectstack/spec)
content/docs/automation/index.mdx (via @objectstack/spec)
content/docs/automation/webhooks.mdx (via @objectstack/spec)
content/docs/automation/workflows.mdx (via @objectstack/spec)
content/docs/concepts/architecture.mdx (via @objectstack/spec)
content/docs/concepts/design-principles.mdx (via packages/spec)
content/docs/concepts/index.mdx (via @objectstack/spec)
content/docs/concepts/metadata-driven.mdx (via @objectstack/spec)
content/docs/concepts/metadata-lifecycle.mdx (via packages/spec)
content/docs/concepts/north-star.mdx (via @objectstack/spec)
content/docs/data-modeling/analytics.mdx (via @objectstack/spec)
content/docs/data-modeling/drivers.mdx (via @objectstack/spec)
content/docs/data-modeling/external-datasources.mdx (via @objectstack/spec)
content/docs/data-modeling/field-types.mdx (via @objectstack/spec)
content/docs/data-modeling/fields.mdx (via @objectstack/spec)
content/docs/data-modeling/formulas.mdx (via @objectstack/spec)
content/docs/data-modeling/index.mdx (via @objectstack/spec)
content/docs/data-modeling/objects.mdx (via @objectstack/spec)
content/docs/data-modeling/queries.mdx (via @objectstack/spec)
content/docs/data-modeling/schema-design.mdx (via @objectstack/spec)
content/docs/data-modeling/seed-data.mdx (via @objectstack/spec)
content/docs/data-modeling/validation-rules.mdx (via @objectstack/spec)
content/docs/data-modeling/validation.mdx (via @objectstack/spec)
content/docs/deployment/cli.mdx (via @objectstack/spec)
content/docs/deployment/tenancy-modes.mdx (via @objectstack/spec)
content/docs/deployment/troubleshooting.mdx (via @objectstack/spec)
content/docs/deployment/validating-metadata.mdx (via @objectstack/spec)
content/docs/getting-started/build-with-claude-code.mdx (via @objectstack/spec)
content/docs/getting-started/common-patterns.mdx (via @objectstack/spec)
content/docs/getting-started/examples.mdx (via @objectstack/spec)
content/docs/getting-started/quick-reference.mdx (via @objectstack/spec)
content/docs/getting-started/quick-start.mdx (via @objectstack/spec)
content/docs/getting-started/your-first-project.mdx (via @objectstack/spec)
content/docs/kernel/cluster.mdx (via @objectstack/spec)
content/docs/kernel/contracts/auth-service.mdx (via packages/spec)
content/docs/kernel/contracts/cache-service.mdx (via packages/spec)
content/docs/kernel/contracts/data-engine.mdx (via @objectstack/spec)
content/docs/kernel/contracts/index.mdx (via @objectstack/spec)
content/docs/kernel/contracts/metadata-service.mdx (via packages/spec)
content/docs/kernel/contracts/storage-service.mdx (via packages/spec)
content/docs/kernel/index.mdx (via packages/spec)
content/docs/kernel/runtime-services/email-service.mdx (via packages/spec)
content/docs/kernel/runtime-services/examples.mdx (via @objectstack/spec)
content/docs/kernel/runtime-services/index.mdx (via packages/spec)
content/docs/kernel/runtime-services/queue-service.mdx (via packages/spec)
content/docs/kernel/runtime-services/sharing-service.mdx (via @objectstack/spec)
content/docs/kernel/runtime-services/sms-service.mdx (via packages/spec)
content/docs/kernel/runtime-services/storage-service.mdx (via packages/spec)
content/docs/kernel/services-checklist.mdx (via @objectstack/spec)
content/docs/kernel/services.mdx (via @objectstack/spec)
content/docs/permissions/authorization.mdx (via @objectstack/spec)
content/docs/permissions/permission-sets.mdx (via @objectstack/spec)
content/docs/permissions/permissions-matrix.mdx (via @objectstack/spec)
content/docs/permissions/positions.mdx (via @objectstack/spec)
content/docs/permissions/rls.mdx (via @objectstack/spec)
content/docs/permissions/sharing-rules.mdx (via @objectstack/spec)
content/docs/plugins/adding-a-metadata-type.mdx (via @objectstack/spec)
content/docs/plugins/development.mdx (via @objectstack/spec)
content/docs/plugins/index.mdx (via @objectstack/spec)
content/docs/plugins/packages.mdx (via @objectstack/spec)
content/docs/protocol/backward-compatibility.mdx (via @objectstack/spec)
content/docs/protocol/diagram.mdx (via packages/spec)
content/docs/protocol/kernel/config-resolution.mdx (via @objectstack/spec)
content/docs/protocol/kernel/http-protocol.mdx (via @objectstack/spec)
content/docs/protocol/kernel/i18n-standard.mdx (via @objectstack/spec)
content/docs/protocol/kernel/index.mdx (via @objectstack/spec)
content/docs/protocol/kernel/lifecycle.mdx (via @objectstack/spec)
content/docs/protocol/kernel/plugin-spec.mdx (via @objectstack/spec)
content/docs/protocol/knowledge.mdx (via @objectstack/spec)
content/docs/protocol/objectql/index.mdx (via @objectstack/spec)
content/docs/protocol/objectql/query-syntax.mdx (via @objectstack/spec)
content/docs/protocol/objectql/schema.mdx (via @objectstack/spec)
content/docs/protocol/objectql/security.mdx (via packages/spec)
content/docs/protocol/objectql/state-machine.mdx (via @objectstack/spec)
content/docs/protocol/objectui/actions.mdx (via @objectstack/spec)
content/docs/protocol/objectui/concept.mdx (via @objectstack/spec)
content/docs/protocol/objectui/index.mdx (via @objectstack/spec)
content/docs/protocol/objectui/layout-dsl.mdx (via @objectstack/spec)
content/docs/protocol/objectui/record-alert.mdx (via @objectstack/spec)
content/docs/protocol/objectui/widget-contract.mdx (via @objectstack/spec)
content/docs/releases/implementation-status.mdx (via @objectstack/spec)
content/docs/releases/index.mdx (via @objectstack/spec)
content/docs/releases/v12.mdx (via @objectstack/spec)
content/docs/releases/v13.mdx (via @objectstack/spec)
content/docs/releases/v16.mdx (via @objectstack/spec)
content/docs/releases/v17.mdx (via @objectstack/spec)
content/docs/releases/v9.mdx (via @objectstack/spec)
content/docs/ui/actions.mdx (via @objectstack/spec)
content/docs/ui/apps.mdx (via @objectstack/spec)
content/docs/ui/create-vs-edit-form.mdx (via @objectstack/spec)
content/docs/ui/dashboards.mdx (via @objectstack/spec)
content/docs/ui/field-grouping-and-order.mdx (via @objectstack/spec)
content/docs/ui/forms.mdx (via @objectstack/spec)
content/docs/ui/index.mdx (via @objectstack/spec)
content/docs/ui/public-data-collection.mdx (via @objectstack/spec)
content/docs/ui/setup-app.mdx (via @objectstack/spec)
content/docs/ui/translations.mdx (via @objectstack/spec)
content/docs/ui/views.mdx (via @objectstack/spec)

Advisory only. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs origin/main → pass the list as args.docs.

github-actions · 2026-08-06T14:05:35Z

⛔ merge queue 构建失败 — 先分诊，再决定要不要重排

队列构建 31108010067 红了。队列跑的是全量套件（PR 侧 CI 只跑 affected 子集），
所以失败的测试可能在本 PR 没碰过的包里 —— 那不是重排能修的。每次盲目重排都会让排在后面的所有 PR 重建一轮。

失败的 job（日志抽取，best effort）：

Test Core (1/3) — 失败步骤: Run this shard's tests

�[41m�[1m FAIL �[22m�[49m src/__tests__/datasource-pool-support.test.ts�[2m > �[22m#5714 — the driver factory rejects a pool it cannot honour�[2m > �[22msqlite WITHOUT a pool still builds exactly as b

历史信号：

本 PR 过去 24h 无队列失败记录（首次）。
过去 24h 队列共有 14 个失败构建（不含本次）。

分诊清单：

失败测试在本 PR 改动的包里 → 真回归，修 PR。
失败测试与本 PR 无关 → 在其他 PR 的同类评论里搜同名测试；出现过 ⇒ flaky 实锤，开 issue 修/隔离那条测试。修好前重排只会再烧一轮全队列。
两者都不是 → 可能与同组 PR 语义冲突；等前面的 PR 落地或失败出队后再重排一次即可，不要连续重排。

Generated by Claude Code · merge-queue-triage workflow (#4859)

os-zhuang · 2026-08-06T14:34:14Z

队列管家：⛔ 已修签名再现 = 新问题，本座位不重投（第 8 轮巡检）

本 PR 13:52:34Z 在队列里被踢出（run 31108010067）。按 #5810 签名台账认签名，判为 objectstack 表第 2 行「已修签名」的再现，因此 ⛔ 不重投，只留判读与路由。红与本 PR 的 diff 无关（连坐），处置权归本 PR 所属车道（Fixes #5858，spec 座位）。

完整签名（取完整日志归档，非 tail；note 7 的两个陷阱本轮都现身且都被绕过——同 job 的 11 个测试文件与 229 条用例全绿，Failed: 行附近的 @objectstack/spec:test 是 --concurrency 下的并发相邻、非因果）：

job Test Core (1/3) → step Run this shard's tests
包 @objectstack/service-datasource
FAIL src/__tests__/datasource-pool-support.test.ts > #5714 — the driver factory rejects a pool it cannot honour > sqlite WITHOUT a pool still builds exactly as before
Error: Test timed out in 5000ms. @ datasource-pool-support.test.ts:122，实测 5073ms
同 run 的 Duration 行：import 21.11s

台账那一行的三个要素——Test Core 分片 / 5000ms 超时 / import 长耗时（#4796 家族）——逐条命中。台账判定为「已修（#4856 testTimeout: 60_000）⇒ 再现即新问题」，故走拦截分支。

为什么它是新问题而不是那条老 flaky（可证伪的读数，均取自 origin/main）：

$ git ls-tree origin/main packages/services/service-datasource/ | grep -i vitest
（无输出——该包没有 vitest.config.ts）

$ git grep -n "testTimeout" origin/main
origin/main:packages/spec/vitest.config.ts:15:    testTimeout: 60_000     ← #4856 的修法，只在 spec
（其余为 driver-mongodb 30s / plugin-auth 10s / metadata-fs 10s / qa 30s / client 30s）

#4856 的 testTimeout: 60_000 是包级的，只落在 packages/spec；service-datasource 无任何 vitest 配置，跑的是 vitest 默认 5000ms。⇒ 老修法的作用域从来没覆盖到这里，不是「修好的东西坏了」，是同一族签名在修法作用域之外的新落点。

起因（commit 级，非「相邻」推断）：该测试文件由 #5954（99d7a93，fix(service-datasource): reject a pool block the sqlite arms cannot honour (#5714)）引入，13:15:31Z 落地，37 分钟后首次咬人。该用例做的是一次真实 sqlite 驱动构建（factory().create({ driver: 'sqlite' })），未带显式超时；而同包同类的慢用例是带的——default-datasource-driver-factory.test.ts 的三条真实构建用例各挂 }, 30_000)，其中 builds a file-backed SqliteWasmDriver that connects and round-trips 在本次同一个 run 里跑了 9007ms 并通过。同一类工作，一边有护栏一边没有。

⚠️ 这是共享损伤，不是本 PR 的问题：5073ms vs 5000ms 是边界抖动，间歇性——自 99d7a93 落地起 20 个已完成的 merge_group CI run 里红 1 个（~5%），其余全绿。它能踢掉任何排进队列的 PR，与 diff 无关。

建议动作（本座位无权执行，仅指引）：

本 PR：车道确认无误后可正常重新入队——⛔ 但请知悉重投只是重掷一次骰子，~5% 概率再中，且不修根因；根因单见下。
根因：已在 datasource pool 声明在 sqlite / sqlite-wasm 驱动臂被静默丢弃(pg / mysql 生效) #5714（services 车道锚点）留详细指引。

⛔ 本座位未做任何入队/撤队/重跑/合并/ready-draft 切换/认领。让行核验：本 PR 最近 30 分钟仅 merge-queue-triage workflow 的自动分诊评论（14:05:35Z），无车道 PM 在处置 ⇒ 让行不成立，按拦截分支动作。

台账升级已在锚点 #5810 提请（⛔ 本座位不自行加表）。

Generated by Claude Code

按 #5859 裁决(C)追加:`SharingService` 新增 late-bound `tenancy` 姿态探针(读法与 SecurityPlugin 为 Layer-0 墙读 `tenancy` 服务一致,由 SharingServicePlugin 接线), 按 ADR-0105 D1 的既有分叉决定「没有活动组织」意味着什么: - `single`(纯单租户,无组织):行为不变,DEPTH 照常 —— 那是唯一隐含租户,不是「所有组织」; - `group` / `isolated`:权威组织缺失/空白 → 不咨询 resolver,回落 owner-only, warn 点名 ADR-0095 D1 / ADR-0105 D1 与 #5973 的 fail-closed 契约义务; - 姿态解析不出(未接线/抛错/词表外)→ 按有墙处理,未知姿态不是 single 的证据。测试两个方向都钉:single+无组织仍 widened(先绿保持绿)、walled+无组织拒绝(先红后绿)、姿态不可解析拒绝、legacy `isolationActive:false` 视为无墙、空白组织在两侧各自的表现。 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01JwwiU9bjhwy2SWj13ho8uv

github-actions Bot added size/m documentation Improvements or additions to documentation tests tooling labels Aug 6, 2026

qq9340100 mentioned this pull request Aug 6, 2026

[#5852 契约半边] HierarchyScopeContext 未声明 organizationId / tenantId 哪个权威 —— producer 只填一个、consumer 只读另一个,两边都「符合契约」 #5858

Closed

qq9340100 marked this pull request as ready for review August 6, 2026 13:52

qq9340100 added this pull request to the merge queue Aug 6, 2026

github-merge-queue Bot removed this pull request from the merge queue due to failed status checks Aug 6, 2026

qq9340100 added this pull request to the merge queue Aug 6, 2026

qq9340100 mentioned this pull request Aug 6, 2026

spec 生成物按 category 分片：拆掉三个单体 ratchet 文件的合并队列串行税（维护者 2026-08-06 已拍板） #5837

Closed

Merged via the queue into main with commit abeb375 Aug 6, 2026
25 checks passed

qq9340100 deleted the claude/issue-5858-hierarchy-scope-authority branch August 6, 2026 14:55

qq9340100 mentioned this pull request Aug 6, 2026

[#5852 producer 半边] resolveOwnerScopeIds 按权威字段填充 hierarchy resolver context + 补「resolver 收到的 org 非空」断言 #5859

Closed

baozhoutao mentioned this pull request Aug 6, 2026

fix(objectql): 新建父行时把 count/sum 型 summary 汇总初始化为 0 (#5749) #6013

Merged

qq9340100 mentioned this pull request Aug 6, 2026

spec 契约文档漂移:ISharingService 模块头仍称 canEdit() 回答 update/delete,ADR-0111 D3 已把 delete 拆给 canDelete() #5817

Closed

baozhoutao mentioned this pull request Aug 6, 2026

flaky(service-datasource): datasource-pool-support.test.ts 的「sqlite WITHOUT a pool still builds」在合并队列全量跑间歇红 —— 今日已踢 2 个不相关 PR(#5999、#5973) #6044

Closed

os-zhuang mentioned this pull request Aug 6, 2026

fix(metadata-core): delete 判定末尾改真值测试,假值标量 where.id 不再答 by-id (#5747) #5999

Merged

qq9340100 mentioned this pull request Aug 6, 2026

[PM seat] domain:spec — ⏸️ qq9340100(暂停待维护者示意) #6017

Open

hotlong mentioned this pull request Aug 6, 2026

docs(automation): flows.mdx 的 Scheduled flow 示例补 runAs: 'system' (#5692) #6012

Merged

claude Bot mentioned this pull request Aug 6, 2026

[PM seat] triage (objectstack-wide) — 🟢 Routine #6015

Open

qq9340100 mentioned this pull request Aug 6, 2026

docs(spec): ISharingService 模块头按 ADR-0111 D3 拆出 canDelete() 门 #6066

Merged

baozhoutao mentioned this pull request Aug 6, 2026

fix(plugin-sharing): hierarchy resolver 按权威字段拿到调用方活动组织 (#5859) #6067

Merged

os-zhuang mentioned this pull request Aug 7, 2026

ci(spec): check:skill-examples 拒绝 os:check 块内的裸 any (#5943) #6049

Merged

hotlong mentioned this pull request Aug 7, 2026

fix(service-datasource): 补 vitest 超时配置覆盖空洞并复核 pool 用例并发隔离 (#6044) #6101

Merged

Navigation Menu

Uh oh!

fix(spec)!: HierarchyScopeContext 声明 organizationId 为权威租户字段并转必填 (#5858) - #5973

fix(spec)!: HierarchyScopeContext 声明 organizationId 为权威租户字段并转必填 (#5858)#5973
qq9340100 merged 1 commit into
mainfrom
claude/issue-5858-hierarchy-scope-authority

qq9340100 commented Aug 6, 2026

Uh oh!

vercel Bot commented Aug 6, 2026

Uh oh!

github-actions Bot commented Aug 6, 2026

Uh oh!

Uh oh!

github-actions Bot commented Aug 6, 2026

Uh oh!

os-zhuang commented Aug 6, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

qq9340100 commented Aug 6, 2026

改了什么

P1 / P2 / P3 前提核验(全部成立)

测试

生成物

changeset 档位

与同批其他单的关系(如实申报)

未做的事(范围红线)

Uh oh!

vercel Bot commented Aug 6, 2026

Uh oh!

github-actions Bot commented Aug 6, 2026

📓 Docs Drift Check

Uh oh!

Uh oh!

github-actions Bot commented Aug 6, 2026

⛔ merge queue 构建失败 — 先分诊，再决定要不要重排

Uh oh!

os-zhuang commented Aug 6, 2026

队列管家：⛔ 已修签名再现 = 新问题，本座位不重投（第 8 轮巡检）

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants