measure: what does the single-kernel REST provider wiring actually skip when a wall-enforcing tenancy posture is configured — the question B′ of #13906 asked, without the boot refusal

[hotlong]

Filed from the maintainer's ruling on #13906 (2026-09-04, live chat, adopting the PM recommendation verbatim: 「按照你的建议，你帮我跟进处理15020」). Measurement only — ⛔ no code lands under this card. domain:cli (REST transport wiring); type and priority are triage's.

Why this exists

PR #15020 shipped decision 1 of the 2026-09-02 ruling as A + B′. B′ was a boot refusal: on the single-kernel provider wiring (no kernel-manager service), a wall-enforcing tenancy posture made RestApiPlugin refuse to start, on the reasoning that computeExecCtx never reads a posture on that wiring so "the Layer 0 wall would silently not be enforced". Measured on the merged tree (#15020 comment "CI triage", 2026-09-03): the ONLY registrar of a kernel-manager service in the repository is B′'s own narrowness control test (positive control: the same grep for org-scoping returns four real registrars), so every wall-enforcing composition the open core can build — the real os serve process under isolated, the ADR-0105 bootStack multiTenant harness, seven dogfood suites, group as well as isolated — is on the refusing side. And the refusal's premise is false where it fires: a wall-enforcing effective posture requires org-scoping, and org-scoping is exactly what makes plugin-security keep the platform's organization_id row policies (ADR-0105 D3), so the row wall IS enforced on those deployments. What the provider wiring actually skips is narrower — the two API-key admission refusals computeExecCtx derives from the posture (organization_required, organization_membership_ended) — and nobody has measured whether those refusals are reached by another layer on that wiring.

The maintainer therefore removed B′ from #15020 (A and decision-2 B land in 17.3) and moved B′'s question here.

The measurement

On a real os serve boot under OS_TENANCY_POSTURE=isolated with @objectstack/organizations mounted (the composition B′ refused), as an authenticated principal whose API key is stamped with an organization they are no longer a member of:

1. Does the request reach data, or is it refused — and by which layer (Layer 0 in plugin-security, the REST computeExecCtx posture branch, better-auth session validation)? Name file and symbol either way.
2. Repeat for a key whose principal has no organization (organization_required).
3. Control: the same two requests on the multi-kernel wiring (a kernel-manager present), where the posture branch is known to fire — both must be refused there, proving the probe itself works.
4. Read computeExecCtx and state, from the code, which authorization inputs the single-kernel branch derives without a posture and which it cannot derive at all.

Outcomes

• Every refusal reached by another layer → close: the single-kernel wiring carries no posture and needs none; document that in the REST plugin's docblock (a docs card, not a refusal).
• A refusal reached by NO layer → a real defect: file it with the measured blast radius; the repair is to make the single-kernel branch derive the posture (the option the 2026-09-02 ruling declined, to be re-judged on the measurement), never a boot refusal that turns every walled deployment off.

Refs: #13906 · PR #15020 · ADR-0105 D3 · ADR-0095 D1 · ADR-0069.

[hotlong]

Claim: PM loop — maintainer direct-dispatch channel (2026-08-10 standing authorization)
Provenance: maintainer, 2026-09-04, live chat, verbatim 「这几个问题你都帮我派发处理」 — dispatching the loose ends this session surfaced on the 17.3 review.
Session: 6679d191-11f4-465b-b322-0e0409d76793
Branch: claude/issue-15163-measure-single-kernel-posture-skip
Worktree: objectstack-issue-15163
Domain: domain:cli (REST transport wiring)
File surface: measurement only — ⛔ NO source file changes land; the deliverable is a comment on this card. A throwaway probe may be written and must not be committed
Container & model: M, mode:subagent, model: opus — a security-adjacent reading whose wrong answer would re-open a withdrawn boot refusal
Clause-②: no — nothing lands
Serial constraints cleared: PR #15020 merged 2026-09-04 (919beca43), so packages/rest is quiet; no open PR touches rest-server.ts or rest-api-plugin.ts

[hotlong]

os-dev-report

Verdict: a refusal reached by NO layer — a real defect, and it is wider than reads

On the single-kernel provider wiring under a live, non-degraded isolated posture:

• organization_membership_ended is reached by no layer at all. An API key stamped with an
  organization its owner is not a member of reads that organization's rows and writes new rows
  into it. HTTP 200 / HTTP 201.
• organization_required is reached by no layer on reads (HTTP 200, total 0 — the exact
  silent-empty the refusal was filed to kill) and is reached on writes, by Layer 0 in
  plugin-security (HTTP 403 PERMISSION_DENIED, ADR-0123 D2).

So the card's first outcome does not hold. B-prime's conclusion ("something is skipped here") was
right; its reasoning ("the Layer 0 wall would silently not be enforced") was wrong in the direction
already measured — the wall IS enforced, and enforcing it is precisely what lets the ex-member
through, because under isolated the wall is organization_id = tenantId and tenantId is the
value the unvetted key supplied.

Measured on 1bc3c092a (the origin/main at fetch time). All five files the reading depends on are
byte-identical on today's origin/main a23603ea9:

$ git diff --stat 1bc3c092a origin/main -- packages/rest/src/rest-server.ts \
    packages/rest/src/rest-api-plugin.ts packages/core/src/security/api-key.ts \
    packages/core/src/security/resolve-authz-context.ts \
    packages/plugins/plugin-security/src/tenant-layer.ts
(no output)

How the boot was composed

Three real os serve processes from packages/cli/bin/run.js (not dist/index.js), same throwaway
app, same seed, same OS_TENANCY_POSTURE=isolated, differing only in whether a kernel-manager
service is registered:

OS_TENANCY_POSTURE=isolated OS_PLATFORM_OWNER_EMAIL=owner@probe.local \
OS_DATABASE_DRIVER=sqlite OS_DATABASE_URL=file:./.objectstack/probe-subject.db \
node ../../packages/cli/bin/run.js serve -p 3163 --log-level info

All three booted the posture for real, not degraded:

INFO [security] tenancy posture 'isolated' — the Layer 0 organization wall is ACTIVE (organization_id = active organization)
INFO [probe15163] TENANCY posture=isolated isolationActive=true degraded=false

Seeded through the engine with context: { isSystem: true }:

INFO [probe15163] STORE probe_note rows=2 orgs=["org_alpha","org_alpha"]
INFO [probe15163] STORE sys_api_key rows=3 ids=["key_member","key_exmember","key_noorg"]
INFO [probe15163] STORE sys_member rows=1 pairs=[["u_member","org_alpha"]]

key_member and key_exmember both carry active_organization_id: org_alpha; only u_member has a
sys_member row. key_noorg carries no organization. probe_note is public_read_write so Layer 1
contributes nothing, and the app declares an isDefault permission set granting it, so RBAC is open
— the only thing that can hide a row is Layer 0.

Stand-in, stated plainly. @objectstack/organizations is cloud-private and resolves from nowhere
in this workspace, so the probe app declares a local package of that name whose OrganizationsPlugin
registers the org-scoping service and nothing else. That is a behavioural copy of the stand-in this
repo already ships for exactly this purpose (SimulatedOrgScopingPlugin,
packages/verify/src/harness.ts:61, mounted by bootStack({ multiTenant: 'posture-only' })), and
org-scoping registration is the single fact the open core probes
(TenancyService.probeIsolation, ADR-0093 D5). It activates the POSTURE, not a wall of its own —
which is what makes the reading a reading about the open core's three candidate layers. What it
cannot speak for is any refusal the real enterprise plugin might add on top; that is out of the open
core's reach either way.

The matrix

GET and POST on /api/v1/data/probe_note, credential in x-api-key:

credential	SUBJECT (no kernel-manager)	KM-ONLY (kernel-manager, never bound)	CONTROL (kernel bound)
member of org_alpha (positive control)	GET 200 total 2 · POST 201	GET 200 total 2 · POST 201	GET 200 total 2 · POST 201
ex-member, key stamped org_alpha	GET 200 total 2 · POST 201	GET 200 total 2 · POST 201	GET 401 · POST 401
no organization	GET 200 total 0 · POST 403	GET 200 total 0 · POST 403	GET 401 · POST 401
no credential	GET 401	—	—

Raw:

############ SUBJECT — single-kernel provider wiring (no kernel-manager) (port 3163) ############
  GET  probe_raw_member_key     HTTP 200  total=2 ids=['note_a1', 'note_a2']
  GET  probe_raw_exmember_key   HTTP 200  total=2 ids=['note_a1', 'note_a2']
  GET  probe_raw_noorg_key      HTTP 200  total=0 ids=[]
  POST probe_raw_member_key     HTTP 201  code=None org=org_alpha id=Z4BIfXqYrPXkz39Q
  POST probe_raw_exmember_key   HTTP 201  code=None org=org_alpha id=p2ra-XQfes4O4CJJ
  POST probe_raw_noorg_key      HTTP 403  code=PERMISSION_DENIED org=None id=None
############ CONTROL — multi-kernel wiring (kernel bound) (port 3164) ############
  GET  probe_raw_member_key     HTTP 200  total=2 ids=['note_a1', 'note_a2']
  GET  probe_raw_exmember_key   HTTP 401  code=UNAUTHENTICATED Authentication is required to access this endpoint.
  GET  probe_raw_noorg_key      HTTP 401  code=UNAUTHENTICATED Authentication is required to access this endpoint.
  POST probe_raw_member_key     HTTP 201  code=None org=org_alpha id=oEl_hounfB7LgerW
  POST probe_raw_exmember_key   HTTP 401  code=UNAUTHENTICATED org=None id=None
  POST probe_raw_noorg_key      HTTP 401  code=UNAUTHENTICATED org=None id=None

1. The ex-member key — reaches data, refused by no layer

GET returns both org_alpha rows. POST lands a row inside org_alpha, read back through the
legitimate member's key:

total: 4
   note_a1            | org: org_alpha | created_by: None       | name: alpha note 1
   note_a2            | org: org_alpha | created_by: None       | name: alpha note 2
   Z4BIfXqYrPXkz39Q   | org: org_alpha | created_by: u_member   | name: w-probe_raw_member_key
   p2ra-XQfes4O4CJJ   | org: org_alpha | created_by: u_exmember | name: w-probe_raw_exmember_key

Which layer could have refused, and why none did:

• better-auth session validation — never consulted. resolveAuthzContext
  (packages/core/src/security/resolve-authz-context.ts:271) takes the API-key branch first and the
  session path is if (!userId && ...), already satisfied.
• REST computeExecCtx posture branch — packages/rest/src/rest-server.ts:2401-2407. This is
  the skip; see section 4.
• Layer 0 in plugin-security — computeTenantLayer0Filter,
  packages/plugins/plugin-security/src/tenant-layer.ts:114. It ran, and it passed the caller.
  Under isolated it is packages/plugins/plugin-security/src/tenant-layer.ts:145-147:

  // `isolated`: the hard wall. Missing active org → fail closed.
  if (!input.organizationId) return { ...RLS_DENY_FILTER };
  return { organization_id: input.organizationId };

  organizationId is ExecutionContext.tenantId, and on this wiring tenantId is
  sys_api_key.active_organization_id copied through verbatim
  (packages/core/src/security/api-key.ts:277). The wall therefore compiles to
  organization_id = org_alpha — the caller's own claim, checked against nothing. Layer 0 under
  isolated deliberately never reads accessible_org_ids (that set is the group wall,
  tenant-layer.ts:135-141), so the one fact that would expose the ended membership is not an input
  to the layer that could act on it.

That division of labour is coherent as designed: the membership cross-check is not Layer 0's job,
it is resolveAuthzContext's (resolve-authz-context.ts:341-343), and it is gated on
input.tenancyPosture — which this wiring never supplies.

2. The org-less key — no refusal on reads, a real refusal on writes

• GET: HTTP 200, total 0. tenantId is undefined, so Layer 0 returns RLS_DENY_FILTER
  (tenant-layer.ts:146) and the read resolves to nothing. Not a refusal: a 200 with an empty page,
  which is verbatim the 200 + total 0 silent-empty the organization_required refusal exists to
  replace.
• POST: HTTP 403 PERMISSION_DENIED, and this one is a real refusal reached by another
  layer — plugin-security's ADR-0123 D2 write guard,
  packages/plugins/plugin-security/src/security-plugin.ts (isTenantWallDenial over the Layer 0
  filter, then PermissionDeniedError):

  [Security] Access denied: 'probe_note' is scoped to an organization, and this session has no
  active organization — so this insert has no organization to place the record in. Join or select
  an active organization and retry.
  

So for organization_required the answer is split, and only the write half is covered.

3. Control — the probe can show a refusal where one exists

Adding a kernel-manager (plus a default-project so a request resolves to an environment id)
flips both cases to 401 on the very same app, seed and posture, while the healthy member key
still returns 200 with two records. A probe that could not produce a refusal would have measured
nothing; this one does.

I added a third arm the card did not ask for, because it isolates the mechanism from the wiring
label. KM-ONLY registers a kernel-manager and no default-project, so
resolveRequestEnvironmentId yields undefined, neither kernel branch binds kernel, and the
behaviour is byte-identical to SUBJECT. The trigger is therefore precisely kernel being bound in
computeExecCtx, not "a kernel-manager service exists" — which also means B-prime's boot check
(presence of the service) was not even the right predicate for its own premise.

Census on 1bc3c092a, confirming SUBJECT is the only wiring the open core can build:

$ git grep -n "registerService('kernel-manager'|registerService(\"kernel-manager\"|'kernel-manager':" -- packages/** apps/** examples/**
packages/cloud-connection/src/cloud-connection-plugin.test.ts:110
packages/cloud-connection/src/error-envelope.conformance.test.ts:183
packages/rest/src/rest-api-plugin-slot-lookups.test.ts:122
packages/rest/src/rest-env-resolution.test.ts:460
packages/rest/src/rest-resolve-environment-single-window.test.ts:198

Five hits, all tests. Positive control, same grep shape for org-scoping: four hits — also all
tests/harnesses here, because the real registrar is the cloud-private package the stand-in replaces.

4. computeExecCtx, from the code

packages/rest/src/rest-server.ts:2240. Three branches can resolve an auth service; only the first
two bind kernel:

2263  if (environmentId && environmentId !== 'platform' && this.kernelManager) {
2264      kernel = await this.kernelManager.getOrCreate(environmentId);
...
2268  if (!authService && this.defaultEnvironmentIdProvider && this.kernelManager) {
2271          kernel = await this.kernelManager.getOrCreate(def);
...
2287  if (!authService && this.authServiceProvider) {          // the single-kernel branch
2288      authService = await seamOrUndefined(() => this.authServiceProvider!(environmentId));

The single-kernel branch resolves authService from ctx.getService('auth')
(packages/rest/src/rest-api-plugin.ts:276) and leaves kernel undefined. The posture is the one
input read off kernel:

2401  let tenancyPosture;
2402  try {
2404      tenancyPosture = effectiveTenancyPosture(await kernel.getServiceAsync('tenancy') as any);
2405  } catch {
2406      tenancyPosture = undefined;
2407  }

With kernel undefined, line 2404 throws a TypeError on property access before any service
lookup happens, the catch absorbs it, and tenancyPosture is undefined.

Derived on this branch without a posture (all of it, and all of it correct): authService and
therefore session validation; ql via objectQLProvider
(rest-api-plugin.ts:321, the local kernel's objectql); and out of resolveAuthzContext at line
2418 — userId, tenantId, permissions (key scopes plus permission sets), positions,
systemPermissions, org_user_ids, accessible_org_ids, email, the ADR-0095 posture rung;
plus localization, the ADR-0069 authGate, and __authEnvironmentId.

Cannot be derived at all: tenancyPosture — the only authorization input this branch sources
from kernel. (__kernel is also unavailable, but its own docblock says it is not an authorization
input.) Everything downstream follows mechanically:

• resolveApiKeyAdmission skips the org-less refusal, packages/core/src/security/api-key.ts:305:
  if (!tenantId && tenancyPosture).
• resolveAuthzContext skips the ex-member refusal, resolve-authz-context.ts:341:
  if (keyPrincipal?.tenantId && input.tenancyPosture).

Both are guarded on the posture being present, and the absent-posture default is a documented,
deliberate ADMIT (api-key.ts:257-263): "An ABSENT posture means 'the caller could not tell us
which posture is in force', and the answer to that is to admit ... refusing on an unknown posture
would break every org-less key on every single deployment whose transport has not been wired."
The measurement's sharpest point is against that justification's premise: the transport it calls
"not yet wired" is not a residual case, it is every deployment the open core can build.

One more thing worth knowing before anyone reads the control's 401 as a good error: authRefusal has
no consumer. Outside its own module the only hits on 1bc3c092a are two assertions in
packages/rest/src/execctx-authz-input-seam-reachability.test.ts. Both refusals surface by leaving
userId unset, so computeExecCtx returns undefined and enforceAuth
(rest-server.ts:1527) answers the generic anonymous 401 — byte-identical to sending no credential
at all. The refusal messages the two sites compose are never rendered anywhere.

Blast radius

Every wall-enforcing os serve deployment the open core can build — isolated and group, since
both satisfy postureEnforcesWall — reaches neither API-key admission refusal on the read path.
Concretely, an API key outlives the membership that justified it: after a sys_member row is
deleted, a SCIM deprovision, a better-auth org removal or an ADR-0091 validity window lapsing, the
key keeps full read and write access to that organization until someone revokes the key by hand.
Verify-time membership checking was chosen over revoke-on-removal precisely because "a revoke-on-
removal hook has to catch EVERY one of those or it silently misses"
(resolve-authz-context.ts:322-331) — and on this wiring the verify-time check never runs, so the
deployment is back to the failure mode that reasoning rejected.

Not affected: single deployments (no wall, nothing to cross); the write path for an org-less key
(Layer 0 refuses, 403); the multi-kernel wiring (both refusals fire).

Per the card, no code and no PR — this is the reading only. The repair the outcome section names is
to make the single-kernel branch derive the posture, and I would add one thing to whatever card
picks that up: authRefusal needs a consumer in the same change, or the fix arrives as a 401 that
is indistinguishable from an unauthenticated request and tells the operator nothing about the ended
membership.

Reproduction

Throwaway probe, never committed, worktree removed. To rebuild it: a defineStack app with one
public_read_write object and an isDefault permission set granting it; a config plugins: [...]
entry that seeds sys_user / sys_organization / sys_member / sys_api_key / rows on
kernel:ready through context: { isSystem: true }, and — for the control arms only — registers
kernel-manager and default-project in init(); plus a local package named
@objectstack/organizations exporting an OrganizationsPlugin that registers org-scoping.

[hotlong]

Measurement delivered — closing. The reading is comment 5537114769 above; no code landed under this card, as its scope required.

Outcome: the second of the two this card named — a refusal reached by NO layer, and wider than the card anticipated. It scoped the question to two API-key admission refusals; the measurement found an ex-member's key both reads and writes another organization's rows on the single-kernel wiring under isolated, with a written row landing stamped org_alpha.

⇒ The docs-card outcome ("the wiring carries no posture and needs none") does not apply. Filed as #15256, p0 · security · needs-user-decision, because the repair — making the single-kernel branch derive the posture — is the option the 2026-09-02 ruling explicitly declined, so it is a re-ruling and ⛔ not a dispatch this seat can make.

Carried into #15256 rather than lost here:

• The mechanism, re-verified by this seat on origin/main after the report: isolated's Layer 0 compares organization_id to the caller's active org and never reads accessible_org_ids; tenantId is active_organization_id copied verbatim off the key; and both posture-gated guards need a tenancyPosture the single-kernel branch never derives.
• The trigger is kernel being bound in computeExecCtx, not kernel-manager being present — measured by a third arm this card did not ask for (KM-ONLY), and it means B′'s boot check tested the wrong predicate for its own premise. ⛔ A boot refusal stays excluded as a remedy regardless.
• authRefusal has zero consumers, so deriving the posture on its own would convert a silent leak into a 401 indistinguishable from sending no credential. That is question 2 on [decision · p0] an ex-member API key reads AND writes another organization's rows on the single-kernel wiring under isolated — the wall compares against the caller's own unvetted claim #15256, deliberately not a separate card.
• ⚠️ The scope limit that sizes the whole thing: the probe used a local stand-in for the cloud-private @objectstack/organizations (a behavioural copy of SimulatedOrgScopingPlugin), so this reading covers the three open-core layers only. Whether the real enterprise plugin refuses is step 1 of [decision · p0] an ex-member API key reads AND writes another organization's rows on the single-kernel wiring under isolated — the wall compares against the caller's own unvetted claim #15256 and decides whether the blast radius is open-core self-hosters or every walled deployment.

B′'s question, moved here when the maintainer withdrew the boot refusal from PR #15020, is answered: the wiring skips more than anyone had measured, and the answer is a defect rather than a docblock.

pm:dispatched stripped in the same stroke as the close; domain:cli retained.