refactor(runtime,mcp): the last two admission doors classify the tenancy rejection through the shared classifier (#17683)

* refactor(runtime,mcp): fold the last two admission tenancy-posture copies onto the shared classifier

WIP checkpoint before the verification lap.

Claude-Session: https://claude.ai/code/session_01TSf4DV7ziu4V5j73e46b7c
Co-authored-by: Claude <noreply@anthropic.com>

* chore: changeset for the admission tenancy-posture fold

Claude-Session: https://claude.ai/code/session_01TSf4DV7ziu4V5j73e46b7c
Co-authored-by: Claude <noreply@anthropic.com>

---------

Co-authored-by: Claude <noreply@anthropic.com>

Author: claude[bot]

.changeset/17114-fold-admission-tenancy-classification.md

@@ -0,0 +1,48 @@
+---
+'@objectstack/runtime': patch
+'@objectstack/mcp': patch
+---
+
+refactor(runtime,mcp): the last two admission doors classify the `tenancy` rejection through the shared `classifyAdmissionTenancyPosture` (#17114)
+
+`@objectstack/core`'s `classifyAdmissionTenancyPosture` is the one place the
+#13906 decision 1 option A classification lives: a branded "never registered"
+rejection is the supported no-tenancy composition and answers a quiet
+`undefined`, while every other rejection becomes
+`AuthzStoreUnavailableError('tenancy', err)` — ADR-0112 `SERVICE_UNAVAILABLE` /
+503 — because the posture is an authorization INPUT and admission was never
+decided.
+
+Two admission doors were still hand-writing that classification, out of the
+declared scope of the fold that extracted it:
+
+- `@objectstack/runtime`'s `resolveExecutionContext` — the REST/dispatcher
+  entry-point identity resolver;
+- `@objectstack/mcp`'s `resolveStdioTenancyPosture` — the stdio door's **async
+  kernel** leg.
+
+Both now call the shared function. ⛔ **No behaviour changes at either door.**
+Tenancy posture decides which rows a caller may see, so a divergence between
+copies would be two answers to "whose data is this", and the copies are the
+stale ones by construction — the shared version is the one that will be
+maintained.
+
+**The resolution stayed at each seam, deliberately.** The extractable part is
+the classification, not the resolution: each door keeps its own accessor guard
+and hands its own former accessor expression in as the thunk, so the helper
+never learns *how* a seam reaches the service. A helper that owned the wiring
+too would be wrong for one seam or grow a flag per seam.
+
+**One neighbouring leg is deliberately NOT folded.** The stdio door's **sync**
+fallback is taken only on a `KernelBase`-shaped host with no `getServiceAsync`,
+whose accessor reports its one possible fault — nothing registered under that
+name — **unbranded**. Routing it through the shared classification would mint a
+503 outage out of a supported composition, so its bare `catch` remains that
+seam's recorded decision. A test arm now fails if that leg is ever folded.
+
+Shipped rather than `skip-changeset`: both packages publish `files[]: ["dist"]`,
+and the built `dist` of each carries the new call (2 files each, measured after
+a real build, with a symbol known-absent scoring 0 and
+`isServiceNotRegisteredError` scoring 4 in `runtime/dist` as the lit control).
+`@objectstack/mcp`'s `dist` no longer mentions `isServiceNotRegisteredError` at
+all.

packages/mcp/src/plugin.ts

@@ -5,13 +5,16 @@ import {
   assembleExecutionContext,
   resolveAuthzContext,
   resolveLocalizationContext,
-  // [#15348] The three symbols this door's tenancy-posture read is built from:
-  // the posture reader itself, plus the two halves of the classification
-  // decision 1 option A requires (#13906) — the registry's "never registered"
-  // brand, and the loud outage every other rejection has to become.
+  // [#15348 / #16013 / #17114] The two symbols this door's tenancy-posture
+  // read is built from. `classifyAdmissionTenancyPosture` is the ONE shared
+  // classification decision 1 option A requires (#13906) — branded "never
+  // registered" ⇒ quiet `undefined`, every other rejection ⇒ the loud
+  // `AuthzStoreUnavailableError('tenancy', err)` — and it is reachable only
+  // from the ASYNC accessor, which is the only leg that raises the brand.
+  // `effectiveTenancyPosture` stays because the SYNC leg below is a
+  // deliberately different shape, not a copy of that classification.
+  classifyAdmissionTenancyPosture,
   effectiveTenancyPosture,
-  isServiceNotRegisteredError,
-  AuthzStoreUnavailableError,
   type EntryLocalization,
   type TenancyPostureSource,
 } from '@objectstack/core';
@@ -61,14 +64,24 @@ import { CONNECT_AGENT_UI_BUNDLE } from './connect-ui.js';
  *    admitting on it is exactly the permissive-on-failure defect #13906 exists
  *    to repair, and the reason this seam is not a one-liner.
  *
+ * [#17114] That classification is no longer hand-written here — it is
+ * `classifyAdmissionTenancyPosture` (`@objectstack/core`), the shared function
+ * #16013 extracted and which this seam was one of the two left outside. ⛔ The
+ * RESOLUTION is NOT shared: which of this door's two accessors may be asked is
+ * this file's own fact (the `getServiceAsync` presence test below), so the
+ * accessor expression is handed in as a thunk and the helper never learns it.
+ *
  * Only the ASYNC accessor carries that discriminator — the branded rejection is
  * raised by `PluginLoader.getService`, which the sync accessor never reaches.
- * The sync leg below is taken only on a host whose `getKernel()` yields no
- * `getServiceAsync` (a `KernelBase`-shaped host, and the duck-typed contexts
- * this package's own tests build). Such a host instantiates no service
- * factories at all, so "nothing is registered under that name" is the only
- * fault its accessor can report, and absorbing it is the SAME classification
- * rather than a second collapse of it.
+ * ⛔ **So only the async leg is the shared classification.** The sync leg below
+ * is taken only on a host whose `getKernel()` yields no `getServiceAsync` (a
+ * `KernelBase`-shaped host, and the duck-typed contexts this package's own
+ * tests build). Such a host instantiates no service factories at all, so
+ * "nothing is registered under that name" is the only fault its accessor can
+ * report, and absorbing it is the SAME classification rather than a second
+ * collapse of it — which is why its bare `catch` is this seam's recorded
+ * decision and ⛔ must NOT be folded onto the helper. Routing it there would
+ * mint a 503 outage out of the one fault that host shape can report.
  *
  * ## ⚠️ Read PER CALL — deliberately not hoisted into `start()`
  *
@@ -90,13 +103,12 @@ import { CONNECT_AGENT_UI_BUNDLE } from './connect-ui.js';
 async function resolveStdioTenancyPosture(ctx: PluginContext): Promise<TenancyPosture | undefined> {
   const kernel = typeof ctx.getKernel === 'function' ? ctx.getKernel() : undefined;
   if (kernel && typeof kernel.getServiceAsync === 'function') {
-    try {
-      return effectiveTenancyPosture(await kernel.getServiceAsync<TenancyPostureSource>('tenancy'));
-    } catch (err) {
-      if (!isServiceNotRegisteredError(err)) throw new AuthzStoreUnavailableError('tenancy', err);
-      return undefined;
-    }
+    return classifyAdmissionTenancyPosture(
+      () => kernel.getServiceAsync<TenancyPostureSource>('tenancy'),
+    );
   }
+  // ⛔ NOT the classification above — see the "only the async leg" paragraph in
+  // this function's doc comment. This leg's bare `catch` is its decision.
   try {
     return effectiveTenancyPosture(ctx.getService<TenancyPostureSource>('tenancy'));
   } catch {

packages/mcp/src/stdio-tenancy-posture-api-key-matrix.test.ts

@@ -564,3 +564,91 @@ describe('[#15348] §5 — the posture and the membership are both re-read per c
     await expect(getRecord(OBJECT, 'u_a1')).rejects.toThrow(/no longer valid/);
   });
 });
+
+// ---------------------------------------------------------------------------
+// §6 [#17114] — the fold onto `classifyAdmissionTenancyPosture`, measured at
+// the two edges a fold can get wrong.
+//
+// §1 and §4 already pin the discrimination itself on the registry's own
+// rejections; what these arms pin is that the fold moved the CLASSIFICATION
+// and nothing else:
+//
+//  - the accessor is invoked INSIDE the shared classification, so a
+//    `getServiceAsync` that throws SYNCHRONOUSLY is classified exactly as its
+//    rejecting twin. A fold that resolved the service FIRST and handed the
+//    helper a settled value would need a `catch` of its own to get there —
+//    the per-seam copy this card deletes — and this arm is where that shows;
+//  - ⛔ the SYNC leg is NOT folded. Its host shape (`KernelBase` — no
+//    `getServiceAsync` at all) reports its one fault UNBRANDED, so routing it
+//    through the shared classification would mint a 503 outage out of a
+//    supported composition. That is the fence the card records, as a measured
+//    arm rather than a comment.
+//
+// Both rejection values are read out of a REAL kernel and then re-raised, so
+// neither arm is a hand-built brand at the seam under measurement (fixture
+// principle 4 above).
+// ---------------------------------------------------------------------------
+
+describe('[#17114] §6 — the classification is shared; the resolution is still this door\'s', () => {
+  /** Settle a real registry read to its rejection VALUE. */
+  const rejectionValue = (wiring: TenancyWiring): Promise<unknown> =>
+    makeKernel(makeFixture().engine, wiring)
+      .getServiceAsync('tenancy')
+      .then(() => undefined, (e: unknown) => e);
+
+  /**
+   * Boot with a host whose `getKernel()` answers a facade. Only
+   * `getServiceAsync`'s PRESENCE is read by the seam (`plugin.ts` calls
+   * `ctx.getKernel()` at exactly one place), so the facade carries the sync
+   * accessor plus whichever async shape the arm is measuring.
+   */
+  async function bootWithHost(
+    rawKey: string,
+    host: (kernel: ObjectKernel) => Record<string, unknown>,
+  ) {
+    process.env.OS_MCP_STDIO_API_KEY = rawKey;
+    const fixture = makeFixture();
+    const kernel = makeKernel(fixture.engine, { kind: 'unregistered' });
+    const ctx = { ...makeCtx(kernel), getKernel: vi.fn(() => host(kernel)) };
+    return { fixture, start: () => startStdio(ctx) };
+  }
+
+  it('a `getServiceAsync` that throws the branded rejection SYNCHRONOUSLY stays quiet — same answer as the rejected one', async () => {
+    const branded = await rejectionValue({ kind: 'unregistered' });
+    expect(isServiceNotRegisteredError(branded), 'fixture: the registry did not brand its miss').toBe(true);
+    const h = await bootWithHost(RAW_EXMEMBER_KEY, (kernel) => ({
+      getService: <T>(name: string): T => kernel.getService<T>(name),
+      getServiceAsync: () => { throw branded; },
+    }));
+    // The §4 CONTRAST answer, reached through a synchronous throw.
+    const { bridge } = await h.start();
+    expect((await readAll(bridge)).total).toBe(2);
+  });
+
+  it('a `getServiceAsync` that throws an UNBRANDED failure SYNCHRONOUSLY is the 503 outage, not a quiet admit', async () => {
+    const unbranded = await rejectionValue({ kind: 'factory-throws' });
+    expect(isServiceNotRegisteredError(unbranded), 'fixture: the failed build was branded').toBe(false);
+    const h = await bootWithHost(RAW_EXMEMBER_KEY, (kernel) => ({
+      getService: <T>(name: string): T => kernel.getService<T>(name),
+      getServiceAsync: () => { throw unbranded; },
+    }));
+    const err = await h.start().then(() => undefined, (e) => e);
+    expect(err, 'the door STARTED — a synchronous outage escaped the classification').toBeInstanceOf(Error);
+    expect((err as { code?: unknown }).code).toBe(AUTHZ_STORE_UNAVAILABLE_CODE);
+    expect((err as { status?: unknown }).status).toBe(AUTHZ_STORE_UNAVAILABLE_STATUS);
+    expect((err as { object?: unknown }).object).toBe('tenancy');
+  });
+
+  it('⛔ FENCE: a host with NO `getServiceAsync` takes the SYNC leg and stays quiet on its UNBRANDED miss', async () => {
+    // `ObjectKernelBase`'s sync accessor throws a plain `[Kernel] Service
+    // 'tenancy' not found` — unbranded, because it never reaches
+    // `PluginLoader.getService`. Folding this leg onto the shared
+    // classification would turn that one reportable fault into a 503 and break
+    // every embedder on a `KernelBase`-shaped host. This arm reddens if it is.
+    const h = await bootWithHost(RAW_EXMEMBER_KEY, (kernel) => ({
+      getService: <T>(name: string): T => kernel.getService<T>(name),
+    }));
+    const { bridge } = await h.start();
+    expect((await readAll(bridge)).total).toBe(2);
+  });
+});

packages/runtime/src/security/resolve-execution-context.test.ts

@@ -2,7 +2,7 @@
 
 import { describe, it, expect } from 'vitest';
 
-import { ObjectKernel, isAuthzStoreUnavailableError } from '@objectstack/core';
+import { ObjectKernel, isAuthzStoreUnavailableError, isServiceNotRegisteredError } from '@objectstack/core';
 
 import { resolveExecutionContext } from './resolve-execution-context.js';
 import { hashApiKey } from './api-key.js';
@@ -739,4 +739,61 @@ describe('[#13906 decision 1 A, runtime door] the tenancy posture seam tells "ne
     });
     expect(ctx.userId).toBe('u_exmember');
   });
+
+  // -------------------------------------------------------------------------
+  // [#17114] The classification above is now `classifyAdmissionTenancyPosture`
+  // (`@objectstack/core`) rather than a hand-written copy of it — one of the
+  // two seams #16013 left behind. The RESOLUTION stayed here: this facade's
+  // `opts.getService` is handed in as the thunk.
+  //
+  // These two arms are the pins the WRONG fold fails. A fold that awaited the
+  // service OUTSIDE the shared classification — resolving first and handing it
+  // an already-settled value — would need a `catch` of its own to get there,
+  // which is the per-seam copy this card deletes. The observable difference is
+  // a lookup that throws SYNCHRONOUSLY: `KernelServiceLookup` declares
+  // `Promise<any> | any`, so a facade that throws rather than rejecting is
+  // within its contract, and both rejection classes must classify exactly as
+  // their asynchronous twins above do.
+  //
+  // Both errors are the REGISTRY's own — read out of a real kernel and then
+  // re-raised synchronously — so neither arm is the fixture asserting itself.
+  // -------------------------------------------------------------------------
+
+  /** The registry's own branded "never registered" rejection, as a value. */
+  const brandedNotRegistered = async (): Promise<unknown> =>
+    kernelWith('unregistered').getServiceAsync('tenancy').then(() => undefined, (e) => e);
+
+  /** The registry's own UNBRANDED rejection for a factory that threw. */
+  const unbrandedBuildFailure = async (): Promise<unknown> =>
+    kernelWith('factory-throws').getServiceAsync('tenancy').then(() => undefined, (e) => e);
+
+  const throwingSync = (err: unknown, headers: Record<string, string>) => ({
+    getService: (name: string) => {
+      if (name === 'tenancy') throw err;
+      return undefined;
+    },
+    getQl: async () => qlWith(),
+    request: { headers },
+  });
+
+  it('[#17114] a SYNCHRONOUSLY thrown branded "never registered" is absorbed exactly like the rejected one — quiet, admitted', async () => {
+    const branded = await brandedNotRegistered();
+    expect(isServiceNotRegisteredError(branded), 'fixture: the kernel did not brand its miss').toBe(true);
+    const ctx = await resolveExecutionContext(throwingSync(branded, { 'x-api-key': RAW_EXMEMBER }) as any);
+    expect(ctx.userId).toBe('u_exmember');
+    expect(ctx.tenantId).toBe('org_A');
+  });
+
+  it('[#17114] and a SYNCHRONOUSLY thrown UNBRANDED failure is the 503 outage — the two still answer differently', async () => {
+    const unbranded = await unbrandedBuildFailure();
+    expect(isServiceNotRegisteredError(unbranded), 'fixture: the failed build was branded').toBe(false);
+    const err: any = await rejectionOf(
+      resolveExecutionContext(throwingSync(unbranded, { 'x-api-key': RAW_EXMEMBER }) as any),
+    );
+    expect(err, 'the resolver RESOLVED — a synchronous outage escaped the classification').toBeDefined();
+    expect(isAuthzStoreUnavailableError(err)).toBe(true);
+    expect(err.code).toBe('SERVICE_UNAVAILABLE');
+    expect(err.status).toBe(503);
+    expect(err.object).toBe('tenancy');
+  });
 });

packages/runtime/src/security/resolve-execution-context.ts

@@ -35,14 +35,13 @@ import {
   resolveLocalizationContext,
   assembleExecutionContextOrGuest,
   type EntryLocalization,
-  effectiveTenancyPosture,
-  // [#13906 decision 1 A] The loud answer for an authorization input that
-  // exists and could not be read, and the REGISTRY's own "never registered"
-  // brand that lets the tenancy seam absorb the supported no-tenancy
-  // composition while every other rejection stays loud. Never message text
-  // (#13905).
-  AuthzStoreUnavailableError,
-  isServiceNotRegisteredError,
+  // [#13906 decision 1 A / #16013] The ONE classification this door applies to
+  // the `tenancy` service's rejection: the REGISTRY's own "never registered"
+  // brand absorbs the supported no-tenancy composition (quiet `undefined`)
+  // while every other rejection becomes the loud `AuthzStoreUnavailableError`
+  // for an authorization input that exists and could not be read. Never
+  // message text (#13905). ⛔ The RESOLUTION stays here — see the call site.
+  classifyAdmissionTenancyPosture,
 } from '@objectstack/core';
 
 /**
@@ -203,15 +202,17 @@ export async function resolveExecutionContext(opts: ResolveOptions): Promise<Exe
   // capability PROBE, `resolveService`) still reads as absent — which is why
   // `HttpDispatcher.resolveRequestScope` hands THIS read the classified
   // rejection rather than the probe's collapsed answer.
-  let tenancyPosture;
-  try {
-    tenancyPosture = effectiveTenancyPosture(await opts.getService('tenancy'));
-  } catch (err) {
-    if (!isServiceNotRegisteredError(err)) {
-      throw new AuthzStoreUnavailableError('tenancy', err);
-    }
-    tenancyPosture = undefined;
-  }
+  //
+  // [#17114] The CLASSIFICATION above is `classifyAdmissionTenancyPosture`'s,
+  // not a hand-written copy of it: this seam was one of the two that #16013
+  // left behind, and a copy of this decision is by construction the stale one.
+  // ⛔ The RESOLUTION is still this door's own and must stay so — `opts.getService`
+  // is this facade's lookup (the dispatcher hands it the registry's own async
+  // accessor; other callers hand it a probe), so it is handed in as the thunk
+  // and the helper never learns how this seam reaches the service.
+  const tenancyPosture = await classifyAdmissionTenancyPosture(
+    () => opts.getService('tenancy'),
+  );
 
   const authz = await resolveAuthzContext({
     ql,