test(OMN-17422): repair the kernel-path real-Postgres RLS proof and pin it to the ruling

[Patel230]

Summary

This repairs the kernel-path real-Postgres RLS proof for OMN-17422 and pins it to the OMN-17422 option (a) ruling. It changes tests only.

tests/integration/db/test_projection_writer_tenant_rls_omn15301.py drives the runtime's own handler_wiring projection adapter against PostgreSQL 16 with FORCE RLS and NOBYPASSRLS logins. It sits in the skip baseline, because the hosted runners have no initdb, so nothing noticed it going stale: on dev 8 of its tests fail, and at #4079's head 3 do.

This was stacked on #4079, which merged into dev on 2026-09-25 as 21d5d621. GitHub retargeted this PR to dev, and it is now rebased there: one commit, f886a2157, changing only the test module. The suite was re-run on that base with PostgreSQL 16: 16 passed.

What changed

• K1. test_missing_authority_is_adjudicated_by_rls_not_by_the_runtime asserted the old refusal of every unbound write. It becomes test_unbound_write_is_scoped_to_its_recorded_tenant, matching the ruling (fix(OMN-16976): scope the unbound tenant write to the attribution it records #3088):
  • an unbound row recording tenant A lands as A;
  • tenant B cannot read it, and A can;
  • a row recording no tenant is refused, on a fresh connection.
• K2. test_environment_tenant_is_not_authority wrote a row recording the same tenant the environment named, so it could no longer tell the two apart. The row now records B while ONEX_TENANT_ID=A: it lands as B, and A cannot read it.
• K3. The fixture builds each relation in the schema physical_grant_schema_for_table says the runtime writes to. For example, generation_events is logically omninode_internal but physically in public. A new self-check, test_fixture_relations_live_where_the_runtime_writes, names any relation that a later remap leaves behind.

How it was verified

• PostgreSQL 16, local: 16 passed. Before the fix it was 3 failed and 12 passed at the old fix(OMN-17887): retire the tenant schema; public is the TENANT domain's schema #4079 head, and 8 failed on dev. Re-run on the current fix(OMN-17887): retire the tenant schema; public is the TENANT domain's schema #4079 head (2d7ae9f62), with omnibase-core 0.47.23: 16 passed.
• Red controls. Each ran in a scratch copy, against an unmodified copy that passes 16:
  • restoring the unbound-write branch from before fix(OMN-16976): scope the unbound tenant write to the attribution it records #3088 fails K1 and K2;
  • promoting ONEX_TENANT_ID into the tenant scope fails K2;
  • building the fixture in the wrong schema fails K3, which names generation_events.
• Lint: ruff check and ruff format --check pass. The 9 SQL lines built from module constants carry the repo's existing # noqa: S608 - module constant form.
• Observed, not changed. On a connection reused after a scoped write, Postgres reads the custom app.tenant_id GUC back as '' rather than NULL. A write with no tenant on such a connection is therefore refused with InvalidTextRepresentation instead of InsufficientPrivilege. It is still refused, just with a different error class, which is why K1 runs its no-tenant case on a fresh connection.

Local gates

• Pre-commit ran on every commit, and every hook passed.
• No gate was bypassed — no --no-verify, no SKIP=, no --no-gpg-sign, no core.hooksPath override. Every pre-commit and pre-push hook ran.

Not in this change

• No production-code change.
• Hosted CI still does not run this module, because the runners have no initdb. That is raised on OMN-17422 as a separate question.
• The ticket's status, and its close-out.

Evidence-Ticket: OMN-17422
Evidence-Source: OCC#11251

[github-actions]

✅ Hostile Reviewer — REVIEWED

Critical findings: 2
Major findings: 7
Total findings: 17
Models succeeded: qwen3-review,qwen3-review-b,glm-review

Action required: findings were posted as review threads. Address or reject each one, then resolve its thread — the Hostile Review Thread Gate fails while hostile-reviewer threads are unresolved (OMN-17492).

---

Semantics (OMN-17492 — the model finds, thread resolution gates)

Surface	Meaning	Blocks merge?
Review threads	Per-finding, posted by the reviewer	No (informational)
Hostile Review Thread Gate	Deterministic: unresolved hostile-reviewer threads exist	Fails until resolved (not yet a required context)
degraded verdict	Fewer than 2 models succeeded (infra)	Fails this job with a named reason

Powered by omniintelligence.review_pairing.cli_review — multi-model adversarial review: qwen3-review, qwen3-review-b, glm-review (OMN-8468/OMN-8524/OMN-17492)

[github-actions]

Hostile Reviewer — adversarial findings (OMN-17492)

Models succeeded: qwen3-review, qwen3-review-b, glm-review
Models failed: none
New finding threads: 0
Deduped (already posted on this PR): 0
Below quorum (one model only, reported not threaded): 15
Nit-level findings suppressed: 3

The model is the FINDER, never the gate: merge is gated only by the
deterministic Hostile Review Thread Gate, which blocks while
hostile-reviewer threads are unresolved. Resolve each thread after
addressing (or rejecting, with a reply) its finding.

Below quorum: 15 finding(s) raised by one model only (OMN-18479)

These are reported and NOT dropped, but they get no thread and do not block: a single model's finding no other model reproduced is not evidence enough to stop a merge. Read them; act on them if they are right.

• [CRITICAL] tests/integration/db/test_projection_writer_tenant_rls_omn15301.py::test_unbound_write_is_scoped_to_its_recorded_tenant (glm-review) — Unbound write path allows arbitrary tenant attribution, and the test blesses it | The rewritten test codifies a contract where an adapter with no verified authority can insert a row as any tenant it n
• [MAJOR] tests/integration/db/test_projection_writer_tenant_rls_omn15301.py:359-420 (qwen3-review) — Test asserts row lands under recorded tenant, but RLS policy still compares against GUC | The test test_unbound_write_is_scoped_to_its_recorded_tenant asserts that an unbound adapter (authority=None
• [MAJOR] tests/integration/db/test_projection_writer_tenant_rls_omn15301.py:64-70 (qwen3-review) — RLS policy allows tenant_id=NULL rows to bypass isolation | The RLS policy uses USING (tenant_id = current_setting('app.tenant_id', true)::uuid). If a row has tenant_id=NULL, the comparison `NULL =
• [MAJOR] tests/integration/db/test_projection_writer_tenant_rls_omn15301.py:632-663 (qwen3-review) — Test test_environment_tenant_is_not_authority asserts row lands as TENANT_B, but environment is TENANT_A | The test sets ONEX_TENANT_ID=TENANT_A and ENFORCE_TENANT_ISOLATION=false, then upserts
• [MAJOR] tests/integration/db/test_projection_writer_tenant_rls_omn15301.py (qwen3-review-b) — Tautological assertion in new fixture test | The test test_fixture_relations_live_where_the_runtime_writes constructs its expected set by calling physical_grant_schema_for_table with the same lo
• [MAJOR] tests/integration/db/test_projection_writer_tenant_rls_omn15301.py (qwen3-review-b) — RLS bypass risk from transaction-local GUC scoping | The new test test_unbound_write_is_scoped_to_its_recorded_tenant asserts that an unbound adapter (no authority) can successfully upsert a row wit
• [MAJOR] tests/integration/db/test_projection_writer_tenant_rls_omn15301.py::test_fixture_relations_live_where_the_runtime_writes (glm-review) — New consistency test is circular and cannot fail on remap | test_fixture_relations_live_where_the_runtime_writes computes its expected set from physical_grant_schema_for_table, the same function used
• [MAJOR] tests/integration/db/test_projection_writer_tenant_rls_omn15301.py::test_unbound_write_is_scoped_to_its_recorded_tenant (glm-review) — GUC stale-state hazard on reused connections is documented but untested | The inline comment admits that on a connection where a scoped write previously ran, the custom GUC reads back as '' rather tha
• [MINOR] tests/integration/db/test_projection_writer_tenant_rls_omn15301.py:271-316 (qwen3-review) — New test test_fixture_relations_live_where_the_runtime_writes does not verify schema existence | The test checks that relations exist in the expected schemas, but it does not verify that the schemas
• [MINOR] tests/integration/db/test_projection_writer_tenant_rls_omn15301.py:271-316 (qwen3-review) — Multiple database connections opened and closed in each test | Each test opens multiple connections (owner, tenant, internal, catalog) and closes them. This is acceptable for integration tests, but th
• [MINOR] tests/integration/db/test_projection_writer_tenant_rls_omn15301.py (qwen3-review-b) — Inconsistent error handling for no-tenant upsert | In test_unbound_write_is_scoped_to_its_recorded_tenant, the first upsert (with no tenant_id in the payload) is expected to raise `InsufficientPri
• [MINOR] tests/integration/db/test_projection_writer_tenant_rls_omn15301.py (qwen3-review-b) — Missing test for catalog reader write denial | The test test_catalog_reader_can_read_and_has_no_writer_operation inserts a row as the owner and then verifies that the catalog reader can read it. How
• [MINOR] tests/integration/db/test_projection_writer_tenant_rls_omn15301.py::test_unbound_write_is_scoped_to_its_recorded_tenant (glm-review) — Unbound query path has no isolation assertion | The rewritten test asserts tenant-scoped reads (A sees, B does not) but never asserts that an unbound session, which 'opens no scope', cannot read rows
• [MINOR] tests/integration/db/test_projection_writer_tenant_rls_omn15301.py::_SCHEMA_SQL (glm-review) — Fixture DDL still hard-codes CREATE SCHEMA while table placement is derived | Table placement now derives from physical_grant_schema_for_table, but the schema creation statements remain literal. If th
• [MINOR] tests/integration/db/test_projection_writer_tenant_rls_omn15301.py::test_fixture_relations_live_where_the_runtime_writes (glm-review) — Cross-schema name collision can produce false failures in the relation check | The pg_class query filters only on relname = ANY(%s) with no namespace restriction. In a shared test database where any o

[github-actions]

Hostile Reviewer — adversarial findings (OMN-17492)

Models succeeded: qwen3-review, qwen3-review-b, glm-review
Models failed: none
New finding threads: 5
Deduped (already posted on this PR): 0
Below quorum (one model only, reported not threaded): 10
Nit-level findings suppressed: 2

The model is the FINDER, never the gate: merge is gated only by the
deterministic Hostile Review Thread Gate, which blocks while
hostile-reviewer threads are unresolved. Resolve each thread after
addressing (or rejecting, with a reply) its finding.

Below quorum: 10 finding(s) raised by one model only (OMN-18479)

These are reported and NOT dropped, but they get no thread and do not block: a single model's finding no other model reproduced is not evidence enough to stop a merge. Read them; act on them if they are right.

• [CRITICAL] tests/integration/db/test_projection_writer_tenant_rls_omn15301.py (qwen3-review) — Test asserts a security property that the diff does not implement | The new test test_unbound_write_is_scoped_to_its_recorded_tenant asserts that an unbound adapter (authority=None) can successfully
• [CRITICAL] tests/integration/db/test_projection_writer_tenant_rls_omn15301.py::test_unbound_write_is_scoped_to_its_recorded_tenant (glm-review) — Write-time tenant attribution is now self-declared; no test pins a scoped writer to its own tenant | The rewritten contract decouples attribution from authorization: an adapter with no authority write
• [MAJOR] tests/integration/db/test_projection_writer_tenant_rls_omn15301.py (qwen3-review) — New test test_fixture_relations_live_where_the_runtime_writes is tautological | The test asserts that the fixture relations are in the schema that physical_grant_schema_for_table resolves. But the
• [MAJOR] tests/integration/db/test_projection_writer_tenant_rls_omn15301.py (qwen3-review-b) — RLS policy bypass via NULL tenant_id in unbound writes | The new test test_unbound_write_is_scoped_to_its_recorded_tenant asserts that an unbound write (no authority) succeeds when the row includes
• [MAJOR] tests/integration/db/test_projection_writer_tenant_rls_omn15301.py, module header comment (glm-review) — Rewritten security tests never execute; the module is skipped in CI | The diff's own comment states 'nothing noticed because the module is skipped in CI', and the diff makes no change to enable it. Th
• [MAJOR] tests/integration/db/test_projection_writer_tenant_rls_omn15301.py, comment above test_unbound_write_is_scoped_to_its_recorded_tenant (glm-review) — Connection-history-dependent refusal mode documented but left unpinned and untested | The new comment concedes that a no-tenant upsert raises InsufficientPrivilege on a pristine connection but Invalid
• [MINOR] tests/integration/db/test_projection_writer_tenant_rls_omn15301.py (qwen3-review) — F-string SQL with module constants is flagged but not parameterized | Multiple SQL statements use f-strings with module-level constants (e.g., TENANT_SCHEMA, TENANT_TABLE). The diff adds `# noqa:
• [MINOR] tests/integration/db/test_projection_writer_tenant_rls_omn15301.py::test_environment_tenant_is_not_authority (glm-review) — Environment-promotion test omits the positive control | test_environment_tenant_is_not_authority asserts that tenant A's scoped session cannot read the row written under ONEX_TENANT_ID=A with row tena
• [MINOR] tests/integration/db/test_projection_writer_tenant_rls_omn15301.py, _SCHEMA_SQL (glm-review) — Fixture creates omninode_internal and platform_catalog schemas even when the mapping resolves tables elsewhere | _SCHEMA_SQL unconditionally emits CREATE SCHEMA omninode_internal and CREATE SCHEMA pla
• [MINOR] tests/integration/db/test_projection_writer_tenant_rls_omn15301.py::test_fixture_relations_live_where_the_runtime_writes (glm-review) — Fixture-location equivalence test does not constrain extra relations sharing the names | test_fixture_relations_live_where_the_runtime_writes asserts set equality of (relname, nspname) pairs returned

Findings demoted from threads (anchor rejected)

• [MAJOR] hostile-reviewer (qwen3-review)

  Test test_environment_tenant_is_not_authority relies on untested runtime behavior | The test sets ONEX_TENANT_ID to TENANT_A and writes a row with tenant_id=TENANT_B. It asserts the row lands under TENANT_B and that TENANT_A cannot read it. This assumes the runtime ignores the environment variable and uses the row's tenant_id to set the GUC. If the runtime instead uses the environment variable (or a combination), the GUC would be set to TENANT_A, and the WITH CHECK clause (`tenant_id = current_set

  Resolve this thread when addressed — the Hostile Review Thread Gate blocks while hostile-reviewer threads are unresolved (OMN-17492).

• [MAJOR] hostile-reviewer (qwen3-review-b)

  Tautological assertion in new fixture test | The test test_fixture_relations_live_where_the_runtime_writes constructs its expected set by calling physical_grant_schema_for_table with the same arguments used to define the module-level constants TENANT_SCHEMA, INTERNAL_SCHEMA, and CATALOG_SCHEMA. The test then asserts that the database state matches this expected set. Since the fixture DDL uses these same constants, the test is guaranteed to pass by construction unless the database is in a broken

  Resolve this thread when addressed — the Hostile Review Thread Gate blocks while hostile-reviewer threads are unresolved (OMN-17492).

• [MAJOR] hostile-reviewer (qwen3-review-b)

  Inconsistent error handling for NULL vs empty GUC | The test test_unbound_write_is_scoped_to_its_recorded_tenant explicitly notes that a fresh connection with no GUC set results in InsufficientPrivilege (NULL GUC), but a connection that has previously run a scoped write results in InvalidTextRepresentation (empty string GUC). The test only asserts the InsufficientPrivilege case for the 'no-tenant' refusal. This leaves the behavior of the system when the GUC is an empty string (which is a common stat

  Resolve this thread when addressed — the Hostile Review Thread Gate blocks while hostile-reviewer threads are unresolved (OMN-17492).

• [MINOR] hostile-reviewer (qwen3-review)

  Test test_unbound_write_is_scoped_to_its_recorded_tenant does not test the no-tenant refusal path | The test asserts that a write with no tenant_id field is refused. But the test does not actually perform a write without a tenant_id field; it only asserts that the initial state is empty. The docstring claims 'a row that records no tenant opens no scope, and Postgres refuses it', but there is no test case that writes a row without a tenant_id and asserts the refusal. The test is incomplete. | Evidenc

  Resolve this thread when addressed — the Hostile Review Thread Gate blocks while hostile-reviewer threads are unresolved (OMN-17492).

• [MINOR] hostile-reviewer (qwen3-review-b)

  Missing test for cross-tenant read isolation in unbound writes | The test test_unbound_write_is_scoped_to_its_recorded_tenant verifies that a tenant B adapter cannot read a row written by an unbound adapter as tenant A. However, it does not verify that a tenant C adapter (a third tenant) also cannot read it. While this is likely covered by the general RLS policy, the specific scenario of an unbound write being isolated from all other tenants is not explicitly tested. The test only checks tenant A and tena

  Resolve this thread when addressed — the Hostile Review Thread Gate blocks while hostile-reviewer threads are unresolved (OMN-17492).

[Patel230]

Close-out. Merged 2026-09-25T16:02:25Z as 6ccfacb6, for OMN-17422. One commit, tests only.

In short: the hostile reviewer's findings went unanswered before merge, and nothing was changed for them. Most are answered by the ruling or by tests already in the module. Three are right and still stand: hosted CI skips this module, the error class of a no-tenant write on a reused connection isn't pinned, and K3 guards the fixture rather than the mapping, so its docstring overstates it. Details per point below.

Point by point

The reviewer read f886a215, the commit that merged. Line numbers are from test_projection_writer_tenant_rls_omn15301.py at 6ccfacb6. The five findings meant to become threads never did: the poster's review POST got a 422 and they were folded into the review body (job 108142860213), so the thread gate passed with nothing to resolve. Points raised by more than one model are grouped.

1. "The unbound write lets the row choose its own tenant, and the test blesses it" (glm critical x2, qwen critical, qwen and qwen-b major)
That's the ruling the test is pinned to. OMN-17422 AC1 chose option (a) on 2026-09-01 (comment 2e544ded), and omnibase_infra#3088 implemented it. The ruling says it plainly: the GUC restates the row's own tenant. It confines the statement and scopes reads, and it does nothing against a producer that records the wrong tenant. Attribution is the producer's job (OMN-16831). And yes, this diff doesn't implement it. That PR did; this one only stops the test asserting the refusal from before the ruling. Restoring the unbound branch as it was before that PR fails K1 and K2 (red control in the description).
A writer bound to a tenant is still held to it, in two tests here. test_untrusted_row_tenant_cannot_choose_context (L333-343): bound to A, the row records B, it raises ProjectionTenantContextError and nothing lands. test_real_rls_with_check_rejects_tenant_b_insert_and_update_under_a (L465-505): under GUC A, Postgres refuses both inserting a B row and updating A's row to B.

2. "A NULL tenant_id bypasses isolation" / "the no-tenant refusal isn't tested" (qwen, qwen-b)
It doesn't bypass. tenant_id = NULL evaluates to NULL, not true, so USING hides the row and WITH CHECK refuses it. K1 tests exactly this at L387-397: a row with no tenant is refused with InsufficientPrivilege and zero rows land. The fixture column is also NOT NULL (L70).

3. test_environment_tenant_is_not_authority "relies on untested runtime behaviour" (qwen, qwen-b)
That behaviour is what it runs. _tenant_adapter builds the runtime's own _build_projection_db_adapter (L223-231). If ONEX_TENANT_ID were promoted into the scope, the GUC would be A, the row B, and WITH CHECK would refuse the upsert, so the test would fail. That was run as a red control before merge.
Positive control (glm): not added to K2. The matching positive, the recording tenant's own scoped read returning the row, is in K1 at L415-420, and K2 checks the row landed as B from the owner read at L657.

4. K3 "is tautological / circular / can't fail on a remap" (qwen, qwen-b, glm)
Fair on scope. The fixture and the expected set both come from physical_grant_schema_for_table, so if the mapping moves, the fixture moves with it and K3 passes. That part is intended. What K3 catches is the fixture drifting from the mapping, i.e. a literal schema written back into _SCHEMA_SQL, which is how this suite got stranded twice. The red control is that case: building the fixture in the wrong schema fails K3 and names generation_events. The docstring's "when a family is remapped" is looser than that. Not changed.

• No namespace filter on the pg_class query (glm): on purpose. A copy in the wrong schema shows up as its own pair and breaks the set equality. The cluster is a fresh initdb per module run (L110-158) with a fresh database (L173), so nothing else can collide.
• "Doesn't constrain extra relations with the same names" (glm): set equality does. Any extra (relname, nspname) pair fails it.
• "Doesn't check the schemas exist" (qwen): a relation found in a schema means the schema exists, and a missing one fails CREATE TABLE in the fixture first.
• CREATE SCHEMA omninode_internal and platform_catalog are still literal (glm x2): true, L65-66. If the mapping ever puts a table in a schema that isn't created there, fixture setup fails and names it. An unused schema in a throwaway cluster costs nothing. Not changed.

5. NULL vs '' GUC on a reused connection, "documented but unpinned" (glm x2, qwen-b x2)
Correct. The note at L381-386 and the description record it: after a scoped write Postgres reads the custom GUC back as '', so a no-tenant write on that connection fails with InvalidTextRepresentation instead of InsufficientPrivilege. Still refused, different error class. K1 pins the fresh-connection case only. What is pinned for reuse is that no scope leaks: the GUC reads back None or '' after scoped writes and after a rollback (L442-462, L508-537). The error class on a reused connection is not asserted.

6. "The rewritten tests never run in CI" (glm)
Correct. The module is listed in config/skip_count_baseline.yaml on dev, and this PR's own test job logged SKIPPED ... initdb/pg_ctl not available for it (job 108142997872). It runs outside hosted CI instead: the closing re-run on OMN-17422 got 16 passed, 0 skipped on dev 90f79b29e9 on 2026-09-26, and onex_change_control#11470, still open, binds it to AC2 as a Done-gate check that passes only on 16 passed, so a skip is red. Getting hosted CI to run it is still open.

7. The unbound read with no scope isn't asserted here (glm)
Correct for this module. It's covered at unit level by test_unbound_read_is_scoped_only_when_the_caller_named_a_tenant (tests/unit/runtime/auto_wiring/test_projection_domain_adapters.py:809 on dev): a read whose filter names no tenant issues no set_config. Not added against real Postgres.

8. Smaller ones

• f-string SQL and the # noqa: S608 - module constant wording (qwen, qwen-b, glm): only module constants are interpolated (L39-57) and every value goes through a %s parameter. It's the same form test_chain_canary_attribution_query_omn18172.py and test_chain_canary_stored_traffic_class_omn18172.py already use. Not changed.
• No catalog-reader write denial (qwen-b): covered twice. The adapter refuses the write (L581-586), and Postgres refuses a raw insert from the catalog role (test_cross_domain_roles_are_denied, L596).
• A third tenant C (qwen-b): B stands in for every tenant other than the recorded one. The policy is a single equality, so C would run the same comparison. Not added.
• Several connections per test (qwen): kept. Separate connections keep each test's GUC state apart, and the reuse tests depend on that.

Thank you!