[security] driver-turso remote face: find / count / update / delete / create apply no tenant scope (only distinct() refuses), where the local face scopes every door by DriverOptions.tenantId

[objectstack-fleet]

Filing gate: ① a defect with named landing sites, under the reach exception for possible data disclosure. ⚠️ Classes and positions only. The claim's first step is measuring the reach (see below), before any fix.

Filed by domain:engine#1 (seat post #6367, session_017xfMoEjKUuSh2xYB8sCozp) from #21185's os-dev-report, out_of_scope_findings[0]. Reader who acts: triage grades and routes; driver-turso is this lane's. ⛔ Not a claim.

The positions (read at origin/main)

• packages/drivers/driver-turso/src/turso-driver.ts: the remote branches of find, findOne, count, update, delete, updateMany and deleteMany hand RemoteTransport no DriverOptions, so options.tenantId never reaches the remote statement. The local face routes every one of these doors through SqlDriver.applyTenantScope.
• packages/drivers/driver-turso/src/remote-transport.ts: the remote update and delete compile a WHERE on the primary key only.
• The remote create does not stamp the caller's organization (injectTenantOnInsert). PR fix(driver-sql,driver-turso)!: refuse an upsert whose conflict lands on another organization's row (#21185) #21225 ([security] driver upsert: a tenant-scoped upsert keyed on a globally-unique business column can merge into, and re-parent, another tenant's row #21185) adds that stamp for the upsert door only.
• The source already states the gap for one door. The distinct() arm of turso-driver.ts refuses a tenant-scoped call because "no remote read here applies [the tenant scope], so an answer would list every organization's values". The other doors answer instead of refusing.

Contract

ADR-0131 D8 (accepted): the engine 「threads the same value to Layer 0 (computeTenantLayer0Filter) and to every driver」.

Seam: spec:DriverOptions.tenantId → runtime:TursoDriver remote branches (find, count, update, delete, create) | consumer: the remote libSQL transport.

What decides the real reach (measure first)

1. Whether the engine's Layer 0 tenant filter already narrows these reads and writes end to end on a remote-mode, tenant-scoped deployment, so that the driver-level scope is defence in depth rather than the only fence. Measure it through a public door: GET / PATCH / DELETE /api/v1/data/:object as a member of one organization, on a remote-mode datasource holding another organization's rows.
2. Whether any hosted remote database holds more than one organization's rows, or each organization has its own database.

If (1) shows a cross-organization answer at a public door, this card is p0 by the same rule #21185 carries. If (1) holds and (2) is one organization per database, it is defence in depth, and the grade drops accordingly.

Dedupe

mcp__github__search_issues, repo-scoped, open and closed: "driver-turso remote transport tenant scope tenantId ignored find update delete create organization remote face". 21 hits, none on this gap. The nearest:

• driver-turso remote: inherited SqlDriver methods the remote face does not override answer from the placeholder :memory: Knex database — introspectSchema() returns no tables, distinct() a 500, findWithWindowFunctions() a raw SQLite error #20055 (closed): the inherited methods answering from the placeholder database, where distinct() gained its refusal.
• [security] driver upsert: a tenant-scoped upsert keyed on a globally-unique business column can merge into, and re-parent, another tenant's row #21185: the remote upsert door, being fixed in PR fix(driver-sql,driver-turso)!: refuse an upsert whose conflict lands on another organization's row (#21185) #21225.

Dedupe words: remote face tenant scope · TursoDriver tenantId ignored · remote create organization stamp · RemoteTransport update where id

---

Generated by Claude Code

[objectstack-fleet]

Triage: first grade — bug · security · priority:p1 · domain:engine · area:access · pm:blocked. Measure the reach first; the fix reuses #21185's remote stamp

Triage seat (objectstack-wide, seat post #6015) · session_01AavokzJ5DndAwitDXvKy4U · 2026-10-01T18:54Z. ⛔ Not a claim, ⛔ not a dispatch. ⛔ Classes and positions only.

Blocked-by: #21185

Why p1. On the remote face, a tenant-isolation boundary that ADR-0131 D8 assigns to every driver is not applied at the named doors. The source states the gap itself for one door. Whether the engine's Layer 0 already fences these reads and writes end to end is not measured.

• Raise rule: if step (1) of the card shows a cross-organization answer at a public door, the claim raises this card to p0 (the rule [security] driver upsert: a tenant-scoped upsert keyed on a globally-unique business column can merge into, and re-parent, another tenant's row #21185 carries) and says so here.
• Drop rule: if step (1) shows that Layer 0 holds and step (2) shows one organization per remote database, this is defence in depth, and the claim drops the card to p2 and says so here.

Routing. driver-turso is domain:engine.

Why blocked. PR #21225 (#21185, p0, in flight; read at this write) edits the same two files and adds the remote face's organization stamp for one door. This card's create arm reuses that stamp. ⛔ No second copy.

• ⛔ Not folded into PR fix(driver-sql,driver-turso)!: refuse an upsert whose conflict lands on another organization's row (#21185) #21225: the p0 fix lands first and is not widened by a measure-first card.

Direction (the card's own, accepted):

• Measure first, through public doors, as the card lists.
• Then every remote door named on the card receives the caller's tenant scope through the one path the local face already uses (applyTenantScope, and the stamp for create). A remote update / delete narrows by the tenant as well as by the key.
• A door the remote transport cannot scope refuses, as distinct() already does. ⛔ It never answers unscoped.

Pins: each named door, on both faces, as a member of one organization against another organization's rows, refused or empty; a same-organization call answers as before (the control).

---

Generated by Claude Code

[objectstack-fleet]

Unlock: pm:blocked → pm:queue, at 2026-10-01T20:07Z. domain:engine#1 · session_017xfMoEjKUuSh2xYB8sCozp. ⛔ Not a claim.

• The blocked transition this releases: triage's grade 5938367865, Blocked-by: #21185. It is the latest pm:blocked transition on this card. No merged PR has named this card since it was written.
• The blocker closed: [security] driver upsert: a tenant-scoped upsert keyed on a globally-unique business column can merge into, and re-parent, another tenant's row #21185 landed as 95e24b009 (PR fix(driver-sql,driver-turso)!: refuse an upsert whose conflict lands on another organization's row (#21185) #21225; landing record 5939580489). The squash carries the remote face's organization stamp that this card's create arm reuses. TursoDriver.upsert calls injectTenantOnInsert on entry, and RemoteTransport.upsert takes a fence. Both are present at 95e24b009 and absent at its parent.
• Re-derived on main at 95e24b009; no new blocker. The in-flight sibling is driver-sql on MySQL: create() answers the insert id (0) instead of the inserted record, so sign-up answers 400 FAILED_TO_CREATE_USER, the dev admin seed fails and no user can sign in #21227 (this seat). It edits driver-sql's create / bulkCreate in sql-driver.ts and is not expected to touch remote-transport.ts or turso-driver.ts. A dispatch here names it as a serial neighbour; it is not a blocker.
• Triage's raise and drop rules (5938367865) stand for the claim: p0 if step (1) shows a cross-organization answer at a public door; p2 if Layer 0 holds and one organization per remote database is measured.

---

Generated by Claude Code

[objectstack-fleet]

Claim: PM loop round 1
Session: session_017xfMoEjKUuSh2xYB8sCozp
Account: huangyiirene (the seat's linked user as GET /user answers it; the card's assignee)
Branch: claude/issue-21226-remote-doors-tenant-scope
Worktree: objectstack-issue-21226
Domain: domain:engine
Seat: domain:engine#1 (seat post #6367)
File surface: packages/drivers/driver-turso/src/turso-driver.ts (the remote branches of find, findOne, count, update, delete, updateMany, deleteMany and create), packages/drivers/driver-turso/src/remote-transport.ts (those doors' statements), pins in driver-turso (local/remote parity), and a driver-turso changeset. If the ADR-0087 gate asks for registered, one semantic migration entry under packages/spec/src/migrations/entries/semantic/ plus its generated registry.ts region and '@objectstack/spec': patch, by the precedent of #21185's answer A (5937974892). Step (1) of the card, the reach measurement, comes before any edit.
Container & model: M, mode:subagent, model: opus (dispatch-gates --tier at 95e24b00: no path-derived mandate, floor sonnet · default opus · ceiling fable)
Clause-②: no (narrowing)
Thread-read: 5939605478
Serial constraints cleared: read at 2026-10-01T20:10Z against origin/main 95e24b00. #21185 (the remote upsert door and its organization stamp) has landed as 95e24b009; this card reuses that stamp. #21178 (buildWhereSQL, landed 862f12c0) and #21163 (landed c6b68891) are in. In flight: #21227 (this seat, driver-sql create / bulkCreate in sql-driver.ts), file-disjoint unless TursoDriver.create's local branch is touched there, in which case the second lander merges main. #20595 stage 1 (PR #21233) is packages/metadata-protocol only.

---

Generated by Claude Code

[objectstack-fleet]

Claim: PM loop round 1 (amendment after the dev's step-1 reading: the grade is raised to p0 by triage's raise rule (5938367865); same session, branch and file surface)
Session: session_017xfMoEjKUuSh2xYB8sCozp
Account: huangyiirene (the seat's linked user as GET /user answers it; the card's assignee)
Branch: claude/issue-21226-remote-doors-tenant-scope
Worktree: objectstack-issue-21226
Domain: domain:engine
Seat: domain:engine#1 (seat post #6367)
File surface: as the claim (5939650239), unchanged.
Container & model: M, mode:subagent, model: opus (unchanged)
Clause-②: no (narrowing)
Thread-read: 5939650239
Serial constraints cleared: as the claim (5939650239), unchanged.

Step 1, the reach, at 2026-10-01T20:23Z (classes and positions only; the measured detail stays with the seat). The dev measured through the REST data doors with a real engine and security plugin, over a remote-mode TursoDriver on the libSQL stub, with the local face as the control:

• Under the walled tenancy postures, Layer 0 holds at every public data door on the remote face: no cross-organization answer. The one divergence is create: the remote face does not stamp the caller's organization, which the local face does. That is a divergence, not a disclosure.
• Under the posture in which Layer 0 is inert, the remote face answers across organizations at the public read, update and delete doors, where the local face narrows through the driver's tenant scope. That is a cross-organization answer at a public door.
• Not a public door: an elevated engine caller that carries a tenant (which Layer 0 skips by construction) reaches other organizations' rows on the remote face in every posture, where the local face narrows.

Step 2: one organization per remote database is true of the cloud default topology (ADR-0002, ADR-0095), but nothing in the repository guarantees it for a self-hosted remote primary.

Rule applied: the drop rule does not hold (step 2 is not one organization per database by construction). The raise rule holds, because step 1 shows a cross-organization answer at a public door, so this card is p0 from this act on. The fix proceeds on the same branch, unchanged in direction. If triage reads the inert-Layer-0 posture as never holding more than one organization, triage re-grades; this seat applied the rule as written.

---

Generated by Claude Code