Skip to content
Ordermatic Docs

ADR — PR #1997

2026-07-01 14:45 — Enforce trusted context org ID for process_short_supply_items downstream calls

Section titled “2026-07-01 14:45 — Enforce trusted context org ID for process_short_supply_items downstream calls”
  • Comment: https://github.com/ERP-Unlocked/ordermatic/pull/1997 (CodeRabbit Review)
  • Priority: must-fix
  • Decision: accept
  • Rationale: Relying purely on a schema mismatch check is brittle; we must explicitly pass context.orgId to the downstream Temporal workflow (ShortSupplyEnrichmentWorkflow) and its activities to guarantee strict organization isolation at the data access layer.

2026-07-01 14:45 — Pass mcp:write scope in cross-org isolation test

Section titled “2026-07-01 14:45 — Pass mcp:write scope in cross-org isolation test”
  • Comment: https://github.com/ERP-Unlocked/ordermatic/pull/1997 (CodeRabbit Review)
  • Priority: must-fix
  • Decision: accept
  • Rationale: The test was failing to reach the org-mismatch validation logic because the request was rejected earlier by the mcp:write scope gate, masking the actual behavior being verified.