Skip to content

fix(scripts): tenant-audit census stores declared type text as written, and resolves names by scope #19650

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
os-support-ai merged 6 commits into from
Sep 22, 2026
Merged

fix(scripts): tenant-audit census stores declared type text as written, and resolves names by scope #19650

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
16fc259
fix(scripts): tenant-audit census reads declared type text and locals…
os-support-ai Sep 22, 2026
2fd22ba
test(scripts): pin route ① at every storage site and the scope defect…
os-support-ai Sep 22, 2026
9db2c62
docs(scripts): the round-trip arm names the tool, not a spelling in t…
os-support-ai Sep 22, 2026
66a2862
docs(permissions): regenerate the tenant-audit census artefacts for t…
os-support-ai Sep 22, 2026
4dab3ec
docs(scripts): the two prose mirrors this repair falsifies
os-support-ai Sep 22, 2026
c42c07a
Merge remote-tracking branch 'origin/main' into claude/issue-19300-ce…
os-support-ai Sep 22, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
34 changes: 17 additions & 17 deletions content/docs/permissions/tenant-audit-census.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -187,8 +187,8 @@ reproduce them. Where it disagrees, it disagrees on the page:
| carried figure | where it survives | this census |
| :--- | :--- | ---: |
| 175 write call sites | quoted in the merged changeset | **227** |
| 24 carrying no tenant context | quoted in the merged changeset | **9** provable and tenancy-enabled; **32** more whose options argument is unreadable |
| 127 of 175 statically decidable, 48 runtime-parameter-name sites | restated on the `isSystem`-scoping card | **151 of 227** decidable, **76** undecidable |
| 24 carrying no tenant context | quoted in the merged changeset | **9** provable and tenancy-enabled; **34** more whose options argument is unreadable |
| 127 of 175 statically decidable, 48 runtime-parameter-name sites | restated on the `isSystem`-scoping card | **153 of 227** decidable, **74** undecidable |
| 135 (77%) silenced by the `isSystem` guard before the posture gate | the lost issue body — **no surviving corroboration** | **not reproduced**: 108 decidably elevated, 0 decidably not, 102 undecidable |
| 141 and 132, two independent re-derivations | the card that filed this work | — |

Expand All @@ -200,7 +200,7 @@ at any commit.

Two structural facts do plausibly widen this reading against any hand or regex
one, and both are counted in the generated tables below: the 44 sites reached
through an erased (`any`) receiver, and the 41 that name their object through a
through an erased (`any`) receiver, and the 43 that name their object through a
`const` rather than inline. An instrument that read either the way a person does
would report a smaller number and would not say so.

Expand All @@ -213,7 +213,7 @@ answer is that a static reading cannot settle it.
⇒ **Cite `9 / 227`, and say what it is**: the sites whose options argument was
READ and holds no tenant context, against a decidably tenancy-enabled object.
That is the control's provable yield surface. ⛔ Do not cite it as "the sites
without tenant context" — **32 further sites** have an options argument this
without tenant context" — **34 further sites** have an options argument this
cannot read, and they are neither in nor out.

{/* BEGIN GENERATED: tenant-audit-census (scripts/tenant-audit-census.mjs) — DO NOT EDIT */}
Expand All @@ -223,29 +223,29 @@ cannot read, and they are neither in nor out.
| what | count |
| :--- | ---: |
| write call sites on the application surface | **227** |
| …whose object name is statically decidable | 151 |
| …whose object name is chosen at run time | 76 |
| …against an object with tenancy ENABLED | 150 |
| …whose object name is statically decidable | 153 |
| …whose object name is chosen at run time | 74 |
| …against an object with tenancy ENABLED | 152 |
| …against an object that declares tenancy off | 1 |
| threading a tenant context | 143 |
| PROVABLY carrying none (options read, no context key) | **17** |
| …of those, against a decidably tenancy-enabled object | **9** |
| options argument UNREADABLE — may or may not carry one | 67 |
| …of those, against a decidably tenancy-enabled object | 32 |
| …of those, against a decidably tenancy-enabled object | 34 |
| threading a decidably ELEVATED (`isSystem`) context | 108 |
| threading a context that is decidably NOT elevated | 0 |
| threading a context whose elevation is a run-time fact | 102 |

| how the instrument reached the site | count |
| :--- | ---: |
| receiver carried a readable engine type | 183 |
| receiver erased, placed by the object NAME | 18 |
| receiver erased, placed by the object NAME | 24 |
| receiver erased, placed by an `object: string` PARAMETER | 15 |
| receiver erased, placed by an `UNTYPED_RECEIVERS` row | 11 |
| receiver erased, placed by an `UNTYPED_RECEIVERS` row | 5 |

| object name spelled inline | 110 |
| object name spelled through a `const` | 41 |
| object name is an `object: string` parameter | 19 |
| object name spelled through a `const` | 43 |
| object name is an `object: string` parameter | 17 |
| object name is some other run-time expression | 57 |

### Subtractions the census could NOT defend — enforced
Expand All @@ -262,10 +262,10 @@ or dependency-owned declaration is one this census never saw, and «never saw it
must not be spelled the same way as «read it, not an engine».

⚠️ One arm here says something else again: `type-text-not-round-trippable` is a
receiver whose declared type the census STORED whitespace-collapsed and could
not read back — the source parsed, the re-serialisation of it did not, so the
door rule could never be read off it. That is a fault in this tool rather than
a fact about the corpus, and it is the one row here that also fails the gate.
receiver whose declared type THIS TOOL derived and then could not read back —
the source parsed, the re-serialisation of it did not, so the door rule could
never be read off it. That is a fault in this tool rather than a fact about the
corpus, and it is the one row here that also fails the gate.

| what | count |
| :--- | ---: |
Expand Down Expand Up @@ -296,7 +296,7 @@ holds still. They are required to be HERE and to say WHEN they were true;
their values are not compared. The reasoning, and the measurement behind it,
are in `scripts/check-tenant-audit-census.mjs`.

Measured on 2026-09-20 at `215840f43`.
Measured on 2026-09-22 at `9db2c6234`.

| corpus scale (not enforced) | count |
| :--- | ---: |
Expand Down
22 changes: 11 additions & 11 deletions docs/audits/2026-08-tenant-audit-write-call-sites.counts.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,15 +34,15 @@ silent, and `node scripts/tenant-audit-census.mjs --write` is the resolution.
| Measure | Value |
|---|---:|
| Write call sites | 227 |
| Object name statically decidable | 151 |
| Object name chosen at run time | 76 |
| Against a tenancy-enabled object | 150 |
| Object name statically decidable | 153 |
| Object name chosen at run time | 74 |
| Against a tenancy-enabled object | 152 |
| Against an object declaring tenancy off | 1 |
| Threading a tenant context | 143 |
| Provably carrying none | 17 |
| …and decidably tenancy-enabled | 9 |
| Options argument unreadable | 67 |
| …and decidably tenancy-enabled | 32 |
| …and decidably tenancy-enabled | 34 |
| Threading a decidably elevated context | 108 |
| Threading a decidably non-elevated context | 0 |
| Threading a context of undecidable elevation | 102 |
Expand All @@ -61,10 +61,10 @@ or dependency-owned declaration is one this census never saw, and «never saw it
must not be spelled the same way as «read it, not an engine».

⚠️ One arm here says something else again: `type-text-not-round-trippable` is a
receiver whose declared type the census STORED whitespace-collapsed and could
not read back — the source parsed, the re-serialisation of it did not, so the
door rule could never be read off it. That is a fault in this tool rather than
a fact about the corpus, and it is the one row here that also fails the gate.
receiver whose declared type THIS TOOL derived and then could not read back —
the source parsed, the re-serialisation of it did not, so the door rule could
never be read off it. That is a fault in this tool rather than a fact about the
corpus, and it is the one row here that also fails the gate.

| what | count |
| :--- | ---: |
Expand All @@ -90,7 +90,7 @@ holds still. They are required to be HERE and to say WHEN they were true;
their values are not compared. The reasoning, and the measurement behind it,
are in `scripts/check-tenant-audit-census.mjs`.

Measured on 2026-09-20 at `215840f43`.
Measured on 2026-09-22 at `9db2c6234`.

| corpus scale (not enforced) | count |
| :--- | ---: |
Expand Down Expand Up @@ -195,8 +195,8 @@ Measured on 2026-09-20 at `215840f43`.
| `packages/plugins/plugin-sharing/src/sharing-service.ts` | `delete` | `sys_record_share` | enabled | elevated | 2 |
| `packages/plugins/plugin-sharing/src/sharing-service.ts` | `insert` | `sys_record_share` | enabled | elevated | 1 |
| `packages/plugins/plugin-sharing/src/sharing-service.ts` | `update` | `sys_record_share` | enabled | elevated | 1 |
| `packages/plugins/plugin-webhooks/src/bootstrap-declared-webhooks.ts` | `insert` | `subscriptionsObject` | undecidable | options unreadable | 1 |
| `packages/plugins/plugin-webhooks/src/bootstrap-declared-webhooks.ts` | `update` | `subscriptionsObject` | undecidable | options unreadable | 1 |
| `packages/plugins/plugin-webhooks/src/bootstrap-declared-webhooks.ts` | `insert` | `sys_webhook` | enabled | options unreadable | 1 |
| `packages/plugins/plugin-webhooks/src/bootstrap-declared-webhooks.ts` | `update` | `sys_webhook` | enabled | options unreadable | 1 |
| `packages/plugins/plugin-webhooks/src/migrate-webhook-secrets.ts` | `update` | `subscriptionsObject` | undecidable | options unreadable | 1 |
| `packages/services/service-automation/src/builtin/crud-nodes.ts` | `delete` | `objectName` | undecidable | context, elevation undecidable | 1 |
| `packages/services/service-automation/src/builtin/crud-nodes.ts` | `insert` | `objectName` | undecidable | context, elevation undecidable | 1 |
Expand Down
14 changes: 7 additions & 7 deletions scripts/check-tenant-audit-census.mjs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -642,13 +642,13 @@ export function censusRefusals(census) {
}
for (const u of notRoundTrippableSites(census)) {
problems.push(
`[type-text-not-round-trippable] ${u.file}:${u.line} \`${u.receiver}\`.${u.verb}() -- the census `
+ `stored this receiver's declared type whitespace-collapsed and cannot re-parse it as a type `
+ `alias, so the door rule could not be read off it and the census cannot say whether this site `
+ `is an engine write at all: \`${u.type}\`. The SOURCE parsed -- what did not is the census's own `
+ 're-serialisation of a fragment of it, so this is a fault in the tool and not a fact about the '
+ 'corpus. Give the receiver a NAMED type the engine type index can be keyed on, or spell the '
+ "literal's members with `;` separators so the stored text round-trips.",
`[type-text-not-round-trippable] ${u.file}:${u.line} \`${u.receiver}\`.${u.verb}() -- this tool `
+ `cannot re-parse the declared type it derived for this receiver, so the door rule could not be `
+ `read off it and the census cannot say whether this site is an engine write at all: `
+ `\`${u.type}\`. The SOURCE parsed -- what did not is the census's own re-serialisation of a `
+ 'fragment of it, so this is a fault in the tool and not a fact about the corpus. ⛔ Nothing is '
+ 'wrong with the code at this site and nothing here asks you to restyle it: file this against '
+ 'the census, with the located parse verdict the generator prints under the site.',
);
}
for (const r of census.staleLedgerRows ?? []) {
Expand Down
Loading
Loading