fix(plugin-security): skip external federated objects in seed-ownership backfill

claimSeedOwnership walks every registered object exposing an owner_id column
and re-owns unowned rows to the first admin. owner_id is auto-injected into
external (ADR-0015 federated) object schemas, so they passed the filter and the
backfill ran `select id from <remote_table> where owner_id is null` against a
read-only remote datasource whose table may not be provisioned at boot — e.g.
the showcase example logged `Find operation failed … no such table: customers /
orders` on startup. External objects are read-only and their ownership is not
the platform's to reassign, so skip them alongside managedBy / sys_* objects.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0111PrLebaDQAsjWmYrrcZmE

Author: claude

.changeset/claim-seed-ownership-skip-external.md

@@ -0,0 +1,7 @@
+---
+"@objectstack/plugin-security": patch
+---
+
+`claimSeedOwnership` now skips **external (federated) objects** — those with an `external` remote-table binding (ADR-0015) — the same way it already skips `managedBy` and `sys_*` objects.
+
+The seed-ownership backfill walks every registered object that exposes an `owner_id` column and re-owns its unowned rows to the first admin. Federated objects get `owner_id` auto-injected into their schema, so they passed the filter and the backfill issued `select id from <remote_table> where owner_id is null` against a read-only remote datasource whose table may not be provisioned yet at boot — producing startup errors like `Find operation failed … no such table: customers`. External objects are read-only (DDL forbidden, writes double-opt-in) and their ownership is not the platform's to reassign, so they are excluded from the scan entirely.

packages/plugins/plugin-security/src/claim-seed-ownership.test.ts

@@ -55,6 +55,25 @@ describe('claimSeedOwnership', () => {
     expect(updates).toHaveLength(0);
   });
 
+  it('skips external (federated) objects even when they expose owner_id', async () => {
+    // Federated read-only objects (ADR-0015) bind to a remote table; the
+    // platform must not scan or re-own them — and the remote table may not even
+    // exist at boot, so a scan would error with "no such table".
+    const schemas = [
+      {
+        name: 'showcase_ext_customer',
+        external: { remoteName: 'customers' },
+        fields: [{ name: 'owner_id' }],
+      },
+    ];
+    const { ql, updates } = makeQL(schemas, {
+      showcase_ext_customer: [{ id: 'c1', owner_id: null }],
+    });
+    expect(await claimSeedOwnership(ql, ADMIN)).toEqual([]);
+    expect(ql.find).not.toHaveBeenCalled();
+    expect(updates).toHaveLength(0);
+  });
+
   it('skips objects without an owner_id field', async () => {
     const schemas = [{ name: 'crm_pricebook', fields: [{ name: 'name' }] }];
     const { ql, updates } = makeQL(schemas, { crm_pricebook: [{ id: 'p1' }] });

packages/plugins/plugin-security/src/claim-seed-ownership.ts

@@ -54,7 +54,9 @@ function hasOwnerField(schema: ServiceObject): boolean {
  * Walks `ql.registry.getAllObjects()`, filters to schemas that
  *   (a) are not `managedBy` (skip sys_/auth/platform tables),
  *   (b) are not `sys_*`-namespaced,
- *   (c) declare an `owner_id` field,
+ *   (c) are not `external` (federated remote-table bindings — read-only, DDL
+ *       forbidden, and their `owner_id` is not ours to reassign),
+ *   (d) declare an `owner_id` field,
  * and updates the unowned rows as `isSystem`. Returns a per-object summary.
  */
 export async function claimSeedOwnership(
@@ -80,6 +82,13 @@ export async function claimSeedOwnership(
     if (!schema?.name) continue;
     if ((schema as any).managedBy) continue;
     if (schema.name.startsWith('sys_')) continue;
+    // External (federated) objects bind to a remote table on another datasource
+    // (ADR-0015): reads are remapped, DDL is forbidden, and writes need a double
+    // opt-in. Their `owner_id` — if the remote even has the column — is not the
+    // platform's to reassign, and the remote table may not be provisioned when
+    // this runs at boot (e.g. a fixture that seeds later), so a scan errors with
+    // "no such table". Skip them entirely.
+    if ((schema as any).external) continue;
     if (!hasOwnerField(schema)) continue;
 
     try {