@cosmicdrift/kumiko-framework 0.306.0 → 0.307.0

package/src/jobs/__tests__/job-public-intake-origin.integration.test.ts

@@ -0,0 +1,536 @@
+// Every job here is retries:0 so a gated failure surfaces on the first attempt.
+
+import { afterAll, beforeAll, beforeEach, describe, expect, test } from "bun:test";
+import { Queue } from "bullmq";
+import { z } from "zod";
+import type { SchemaTable } from "../../db";
+import { createEventStoreExecutor } from "../../db/event-store-executor";
+import { asRawClient, selectMany } from "../../db/query";
+import { buildEntityTable } from "../../db/table-builder";
+import { createTenantDb } from "../../db/tenant-db";
+import { createEntity, createTextField, defineFeature } from "../../engine";
+import { SYSTEM_ROLE } from "../../engine/system-user";
+import type { TenantId } from "../../engine/types";
+import { AccessDeniedError, FrameworkReasons } from "../../errors";
+import { setupTestStack, type TestStack, TestUsers, unsafeCreateEntityTable } from "../../stack";
+import { waitFor } from "../../testing";
+
+// #983: ctx.jobRunner is typed as the narrow JobRunnerRef (handleEvent only);
+// manual dispatch from a handler/job is a dynamic context extension, same
+// cast as setup-test-stack-jobs.integration.test.ts.
+type ManualDispatchRef = {
+  dispatch: (name: string, payload: Record<string, unknown>) => Promise<string>;
+};
+function manualDispatch(ctx: { jobRunner?: unknown }): ManualDispatchRef | undefined {
+  return ctx.jobRunner as ManualDispatchRef | undefined; // @cast-boundary dynamic-key
+}
+
+// Records every gated failure a PII-writing job actually raised — the only
+// way a "blocked" test proves the job ran and was denied, instead of just
+// observing the row count that would also be 0 before the job ever fires.
+type GatedFailure = { job: string; reason: unknown; details: unknown; message: string };
+const gatedFailures: GatedFailure[] = [];
+
+function isAccessDeniedError(err: unknown): err is AccessDeniedError {
+  return err instanceof AccessDeniedError;
+}
+
+function recordGatedFailure(job: string, err: unknown): never {
+  if (isAccessDeniedError(err)) {
+    const details = err.details;
+    const reason =
+      typeof details === "object" && details !== null && "reason" in details
+        ? (details as { reason: unknown }).reason
+        : undefined;
+    gatedFailures.push({ job, reason, details, message: err.message });
+  }
+  throw err;
+}
+
+const TENANT_ID = "00000000-0000-4000-8000-000000000002" as TenantId;
+const RATE_LIMIT = { per: "ip", limit: 1000, windowSeconds: 60 } as const;
+const QUEUE_NAME_PREFIX = `kumiko-write-origin-test-${Date.now()}`;
+const UNSAFE_RAW_REASON =
+  "test: proves ctx.systemDb.unsafeRaw()-derived createTenantDb inherits the job's gate";
+
+// --- Feature holding the PII entity + the job's "foreign handler" target ---
+
+const secretEntity = createEntity({
+  table: "job_origin_secrets",
+  fields: {
+    value: createTextField({ personal: "self", find: "none", default: "" }),
+  },
+});
+const secretTable = buildEntityTable("secret", secretEntity);
+
+const secretsFeature = defineFeature("secrets", (r) => {
+  r.entity("secret", secretEntity);
+  r.writeHandler(
+    "create",
+    z.object({ value: z.string() }),
+    async (event, ctx) => {
+      const crud = createEventStoreExecutor(secretTable, secretEntity, { entityName: "secret" });
+      return crud.create({ value: event.payload.value }, event.user, ctx.db);
+    },
+    { access: { roles: [SYSTEM_ROLE] } },
+  );
+});
+
+// --- Feature owning the jobs under test ---
+
+const jobsFeature = defineFeature("jobsx", (r) => {
+  r.defineEvent("leaked", z.object({ value: z.string() }), { piiFields: "none" });
+
+  r.job("write-direct", { trigger: { manual: true }, retries: 0 }, async (payload, ctx) => {
+    try {
+      await ctx.db.insertOne(secretTable as unknown as SchemaTable, {
+        // @cast-boundary test-fixture
+        value: payload["value"] as string, // @cast-boundary test-fixture
+      });
+    } catch (err) {
+      recordGatedFailure("jobsx:job:write-direct", err);
+    }
+  });
+
+  r.job("write-foreign", { trigger: { manual: true }, retries: 0 }, async (payload, ctx) => {
+    const result = await ctx.write("secrets:write:create", {
+      value: payload["value"] as string, // @cast-boundary test-fixture
+    });
+    if (!result.isSuccess) {
+      recordGatedFailure(
+        "jobsx:job:write-foreign",
+        new AccessDeniedError({ message: result.error.message, details: result.error.details }),
+      );
+    }
+  });
+
+  r.job("chain-dispatch", { trigger: { manual: true }, retries: 0 }, async (payload, ctx) => {
+    await manualDispatch(ctx)?.dispatch("jobsx:job:write-direct", { value: payload["value"] });
+  });
+
+  r.job(
+    "on-trigger-no-declare",
+    { trigger: { on: "jobsx:write:trigger-source-no-declare" }, retries: 0 },
+    async (payload, ctx) => {
+      try {
+        await ctx.db.insertOne(secretTable as unknown as SchemaTable, {
+          // @cast-boundary test-fixture
+          value: payload["value"] as string, // @cast-boundary test-fixture
+        });
+      } catch (err) {
+        recordGatedFailure("jobsx:job:on-trigger-no-declare", err);
+      }
+    },
+  );
+  r.job(
+    "on-trigger-declare",
+    { trigger: { on: "jobsx:write:trigger-source-declare" }, retries: 0 },
+    async (payload, ctx) => {
+      try {
+        await ctx.db.insertOne(secretTable as unknown as SchemaTable, {
+          // @cast-boundary test-fixture
+          value: payload["value"] as string, // @cast-boundary test-fixture
+        });
+      } catch (err) {
+        recordGatedFailure("jobsx:job:on-trigger-declare", err);
+      }
+    },
+  );
+  r.job(
+    "on-defined-event",
+    { trigger: { on: "jobsx:event:leaked" }, retries: 0 },
+    async (payload, ctx) => {
+      try {
+        await ctx.db.insertOne(secretTable as unknown as SchemaTable, {
+          // @cast-boundary test-fixture
+          value: payload["value"] as string, // @cast-boundary test-fixture
+        });
+      } catch (err) {
+        recordGatedFailure("jobsx:job:on-defined-event", err);
+      }
+    },
+  );
+
+  r.writeHandler(
+    "dispatch-no-declare",
+    z.object({ value: z.string() }),
+    async (event, ctx) => {
+      await manualDispatch(ctx)?.dispatch("jobsx:job:write-direct", { value: event.payload.value });
+      return { isSuccess: true as const, data: { ok: true as const } };
+    },
+    { access: { roles: ["anonymous"] }, rateLimit: RATE_LIMIT },
+  );
+  r.writeHandler(
+    "dispatch-declare",
+    z.object({ value: z.string() }),
+    async (event, ctx) => {
+      await manualDispatch(ctx)?.dispatch("jobsx:job:write-direct", { value: event.payload.value });
+      return { isSuccess: true as const, data: { ok: true as const } };
+    },
+    { access: { roles: ["anonymous"], personalData: "public-intake" }, rateLimit: RATE_LIMIT },
+  );
+
+  r.writeHandler(
+    "foreign-no-declare",
+    z.object({ value: z.string() }),
+    async (event, ctx) => {
+      await manualDispatch(ctx)?.dispatch("jobsx:job:write-foreign", {
+        value: event.payload.value,
+      });
+      return { isSuccess: true as const, data: { ok: true as const } };
+    },
+    { access: { roles: ["anonymous"] }, rateLimit: RATE_LIMIT },
+  );
+  r.writeHandler(
+    "foreign-declare",
+    z.object({ value: z.string() }),
+    async (event, ctx) => {
+      await manualDispatch(ctx)?.dispatch("jobsx:job:write-foreign", {
+        value: event.payload.value,
+      });
+      return { isSuccess: true as const, data: { ok: true as const } };
+    },
+    { access: { roles: ["anonymous"], personalData: "public-intake" }, rateLimit: RATE_LIMIT },
+  );
+
+  r.writeHandler(
+    "chain-no-declare",
+    z.object({ value: z.string() }),
+    async (event, ctx) => {
+      await manualDispatch(ctx)?.dispatch("jobsx:job:chain-dispatch", {
+        value: event.payload.value,
+      });
+      return { isSuccess: true as const, data: { ok: true as const } };
+    },
+    { access: { roles: ["anonymous"] }, rateLimit: RATE_LIMIT },
+  );
+  r.writeHandler(
+    "chain-declare",
+    z.object({ value: z.string() }),
+    async (event, ctx) => {
+      await manualDispatch(ctx)?.dispatch("jobsx:job:chain-dispatch", {
+        value: event.payload.value,
+      });
+      return { isSuccess: true as const, data: { ok: true as const } };
+    },
+    { access: { roles: ["anonymous"], personalData: "public-intake" }, rateLimit: RATE_LIMIT },
+  );
+
+  r.writeHandler(
+    "trigger-source-no-declare",
+    z.object({ value: z.string() }),
+    async (event) => ({ isSuccess: true as const, data: { value: event.payload.value } }),
+    { access: { roles: ["anonymous"] }, rateLimit: RATE_LIMIT },
+  );
+  r.writeHandler(
+    "trigger-source-declare",
+    z.object({ value: z.string() }),
+    async (event) => ({ isSuccess: true as const, data: { value: event.payload.value } }),
+    { access: { roles: ["anonymous"], personalData: "public-intake" }, rateLimit: RATE_LIMIT },
+  );
+
+  r.writeHandler(
+    "definedevent-no-declare",
+    z.object({ value: z.string() }),
+    async (event, ctx) => {
+      await ctx.unsafeAppendEvent({
+        aggregateId: crypto.randomUUID(),
+        aggregateType: "jobsx-leak",
+        type: "jobsx:event:leaked",
+        payload: { value: event.payload.value },
+      });
+      return { isSuccess: true as const, data: { ok: true as const } };
+    },
+    { access: { roles: ["anonymous"] }, rateLimit: RATE_LIMIT },
+  );
+  r.writeHandler(
+    "definedevent-declare",
+    z.object({ value: z.string() }),
+    async (event, ctx) => {
+      await ctx.unsafeAppendEvent({
+        aggregateId: crypto.randomUUID(),
+        aggregateType: "jobsx-leak",
+        type: "jobsx:event:leaked",
+        payload: { value: event.payload.value },
+      });
+      return { isSuccess: true as const, data: { ok: true as const } };
+    },
+    { access: { roles: ["anonymous"], personalData: "public-intake" }, rateLimit: RATE_LIMIT },
+  );
+
+  r.queryHandler(
+    "query-dispatch-no-declare",
+    z.object({ value: z.string() }),
+    async (event, ctx) => {
+      await manualDispatch(ctx)?.dispatch("jobsx:job:write-direct", { value: event.payload.value });
+      return { ok: true as const };
+    },
+    { access: { roles: ["anonymous"] }, rateLimit: RATE_LIMIT },
+  );
+
+  r.writeHandler(
+    "authenticated-dispatch",
+    z.object({ value: z.string() }),
+    async (event, ctx) => {
+      await manualDispatch(ctx)?.dispatch("jobsx:job:write-direct", { value: event.payload.value });
+      return { isSuccess: true as const, data: { ok: true as const } };
+    },
+    { access: { roles: ["Admin"] } },
+  );
+});
+
+// --- Feature-level r.systemScope() job: proves ctx.systemDb.unsafeRaw()'s
+// createTenantDb-derived TenantDb also inherits the job's gate (tenant-db.ts's
+// runnerPersonalDataGates, same mechanism pass 1 pinned for handlers). ---
+
+const systemJobFeature = defineFeature("systemjob", (r) => {
+  r.systemScope();
+  r.job("write-systemdb", { trigger: { manual: true }, retries: 0 }, async (payload, ctx) => {
+    const raw = ctx.systemDb?.unsafeRaw(UNSAFE_RAW_REASON);
+    if (!raw) throw new Error("test setup error: ctx.systemDb missing on a systemScope() job");
+    try {
+      await createTenantDb(raw, ctx.systemUser.tenantId, "system").insertOne(
+        secretTable as unknown as SchemaTable, // @cast-boundary test-fixture
+        { value: payload["value"] as string },
+      );
+    } catch (err) {
+      recordGatedFailure("systemjob:job:write-systemdb", err);
+    }
+  });
+});
+
+const dispatchSystemDbFeature = defineFeature("systemjobdispatch", (r) => {
+  r.writeHandler(
+    "no-declare",
+    z.object({ value: z.string() }),
+    async (event, ctx) => {
+      await manualDispatch(ctx)?.dispatch("systemjob:job:write-systemdb", {
+        value: event.payload.value,
+      });
+      return { isSuccess: true as const, data: { ok: true as const } };
+    },
+    { access: { roles: ["anonymous"] }, rateLimit: RATE_LIMIT },
+  );
+  r.writeHandler(
+    "declare",
+    z.object({ value: z.string() }),
+    async (event, ctx) => {
+      await manualDispatch(ctx)?.dispatch("systemjob:job:write-systemdb", {
+        value: event.payload.value,
+      });
+      return { isSuccess: true as const, data: { ok: true as const } };
+    },
+    { access: { roles: ["anonymous"], personalData: "public-intake" }, rateLimit: RATE_LIMIT },
+  );
+});
+
+describe("job/event write-origin inheritance", () => {
+  let stack: TestStack;
+
+  beforeAll(async () => {
+    stack = await setupTestStack({
+      features: [secretsFeature, jobsFeature, systemJobFeature, dispatchSystemDbFeature],
+      anonymousAccess: { defaultTenantId: TENANT_ID },
+      jobs: { consumerLane: "worker", queueNamePrefix: QUEUE_NAME_PREFIX },
+    });
+    await unsafeCreateEntityTable(stack.db, secretEntity, "secret");
+  });
+
+  afterAll(() => stack.cleanup());
+
+  beforeEach(async () => {
+    await asRawClient(stack.db).unsafe(`DELETE FROM "${secretTable.tableName}"`);
+    gatedFailures.length = 0;
+  });
+
+  async function rowCount(): Promise<number> {
+    const rows = await selectMany(stack.db, secretTable as unknown as SchemaTable); // @cast-boundary test-fixture
+    return rows.length;
+  }
+
+  async function post(type: string, value: string, endpoint = "/api/write"): Promise<void> {
+    const res = await stack.http.raw("POST", endpoint, { type, payload: { value } });
+    expect(res.status).toBe(200);
+  }
+
+  // Waits for the job's own gated failure, not just an unchanged row count —
+  // rowCount()==0 also holds before the job has run at all, so asserting on
+  // it alone would pass even if the gate never fired.
+  async function expectBlocked(
+    type: string,
+    value: string,
+    job: string,
+    rootHandler: string,
+    endpoint = "/api/write",
+  ): Promise<void> {
+    await post(type, value, endpoint);
+    await waitFor(async () => {
+      await stack.eventDispatcher?.runOnce();
+      expect(gatedFailures.some((f) => f.job === job)).toBe(true);
+    });
+    const failure = gatedFailures.find((f) => f.job === job);
+    expect(failure?.reason).toBe(FrameworkReasons.publicIntakeRequired);
+    expect((failure?.details as { job?: string } | undefined)?.job).toBe(job);
+    expect((failure?.details as { rootHandler?: string } | undefined)?.rootHandler).toBe(
+      rootHandler,
+    );
+    expect((failure?.details as { fields?: readonly string[] } | undefined)?.fields).toContain(
+      "value",
+    );
+    expect(failure?.message).toContain(`via job "${job}"`);
+  }
+
+  async function expectAllowed(type: string, value: string): Promise<void> {
+    await post(type, value);
+    await waitFor(async () => {
+      await stack.eventDispatcher?.runOnce();
+      expect(await rowCount()).toBe(1);
+    });
+  }
+
+  test("ctx.jobRunner.dispatch from an anonymous root — blocked without declaration", async () => {
+    await expectBlocked(
+      "jobsx:write:dispatch-no-declare",
+      "leak-dispatch",
+      "jobsx:job:write-direct",
+      "jobsx:write:dispatch-no-declare",
+    );
+    expect(await rowCount()).toBe(0);
+  });
+
+  test("ctx.jobRunner.dispatch from an anonymous root — allowed once declared", async () => {
+    await expectAllowed("jobsx:write:dispatch-declare", "leak-dispatch-declared");
+    expect(gatedFailures).toHaveLength(0);
+  });
+
+  test("anonymous query root dispatching a PII job — blocked", async () => {
+    await expectBlocked(
+      "jobsx:query:query-dispatch-no-declare",
+      "leak-query-dispatch",
+      "jobsx:job:write-direct",
+      "jobsx:query:query-dispatch-no-declare",
+      "/api/query",
+    );
+    expect(await rowCount()).toBe(0);
+  });
+
+  test("sync handler-QN job trigger (afterCommit) — blocked without declaration", async () => {
+    await expectBlocked(
+      "jobsx:write:trigger-source-no-declare",
+      "leak-trigger",
+      "jobsx:job:on-trigger-no-declare",
+      "jobsx:write:trigger-source-no-declare",
+    );
+    expect(await rowCount()).toBe(0);
+  });
+
+  test("sync handler-QN job trigger (afterCommit) — allowed once declared", async () => {
+    await expectAllowed("jobsx:write:trigger-source-declare", "leak-trigger-declared");
+    expect(gatedFailures).toHaveLength(0);
+  });
+
+  test("job's ctx.write into a foreign handler — blocked without declaration", async () => {
+    await expectBlocked(
+      "jobsx:write:foreign-no-declare",
+      "leak-foreign",
+      "jobsx:job:write-foreign",
+      "jobsx:write:foreign-no-declare",
+    );
+    expect(await rowCount()).toBe(0);
+  });
+
+  test("job's ctx.write into a foreign handler — allowed once declared", async () => {
+    await expectAllowed("jobsx:write:foreign-declare", "leak-foreign-declared");
+    expect(gatedFailures).toHaveLength(0);
+  });
+
+  test("job's ctx.systemDb.unsafeRaw()-derived createTenantDb — blocked without declaration", async () => {
+    await expectBlocked(
+      "systemjobdispatch:write:no-declare",
+      "leak-systemdb",
+      "systemjob:job:write-systemdb",
+      "systemjobdispatch:write:no-declare",
+    );
+    expect(await rowCount()).toBe(0);
+  });
+
+  test("job's ctx.systemDb.unsafeRaw()-derived createTenantDb — allowed once declared", async () => {
+    await expectAllowed("systemjobdispatch:write:declare", "leak-systemdb-declared");
+    expect(gatedFailures).toHaveLength(0);
+  });
+
+  test("job chaining (A dispatches B, B writes PII) — blocked without declaration", async () => {
+    await expectBlocked(
+      "jobsx:write:chain-no-declare",
+      "leak-chain",
+      "jobsx:job:write-direct",
+      "jobsx:write:chain-no-declare",
+    );
+    expect(await rowCount()).toBe(0);
+  });
+
+  test("job chaining (A dispatches B, B writes PII) — allowed once declared", async () => {
+    await expectAllowed("jobsx:write:chain-declare", "leak-chain-declared");
+    expect(gatedFailures).toHaveLength(0);
+  });
+
+  test("r.defineEvent job trigger via ctx.appendEvent — blocked without declaration", async () => {
+    await expectBlocked(
+      "jobsx:write:definedevent-no-declare",
+      "leak-event",
+      "jobsx:job:on-defined-event",
+      "jobsx:write:definedevent-no-declare",
+    );
+    expect(await rowCount()).toBe(0);
+  });
+
+  test("r.defineEvent job trigger via ctx.appendEvent — allowed once declared", async () => {
+    await expectAllowed("jobsx:write:definedevent-declare", "leak-event-declared");
+    expect(gatedFailures).toHaveLength(0);
+  });
+
+  test("authenticated root dispatching the same job — unaffected", async () => {
+    const token = await stack.jwt.sign(TestUsers.admin);
+    const res = await stack.app.request("/api/write", {
+      method: "POST",
+      headers: { "Content-Type": "application/json", Authorization: `Bearer ${token}` },
+      body: JSON.stringify({
+        type: "jobsx:write:authenticated-dispatch",
+        payload: { value: "leak-authenticated" },
+      }),
+    });
+    expect(res.status).toBe(200);
+    await waitFor(async () => {
+      expect(await rowCount()).toBe(1);
+    });
+  });
+
+  test("a legacy job dispatched directly (no request context, no _writeOrigin) runs ungated", async () => {
+    if (!stack.jobRunner) throw new Error("test setup error: stack.jobRunner missing");
+    await stack.jobRunner.dispatch("jobsx:job:write-direct", { value: "leak-legacy" });
+    await waitFor(async () => {
+      expect(await rowCount()).toBe(1);
+    });
+  });
+
+  test("a tampered _writeOrigin fails the job closed instead of running ungated", async () => {
+    // bullmq bundles its own ioredis; a shared Redis instance's class type
+    // doesn't structurally match its ConnectionOptions, but plain
+    // host/port/db data does (mirrors job-runner.ts's parseRedisOpts).
+    const { host, port, db } = stack.redis.redis.options;
+    const queue = new Queue(`${QUEUE_NAME_PREFIX}-worker`, { connection: { host, port, db } });
+    try {
+      const job = await queue.add("jobsx:job:write-direct", {
+        value: "leak-tampered",
+        _writeOrigin: "not-an-object",
+      });
+      await waitFor(async () => {
+        const state = await job.getState();
+        expect(state).toBe("failed");
+      });
+      expect(await rowCount()).toBe(0);
+    } finally {
+      await queue.close();
+    }
+  });
+});

package/src/jobs/job-runner.ts

@@ -1,3 +1,4 @@
+import type { WriteOrigin } from "@cosmicdrift/kumiko-types/event-store-types";
 import { type JobsOptions, Queue, Worker } from "bullmq";
 import { Redis } from "ioredis";
 import { requestContext } from "../api/request-context";
@@ -18,6 +19,7 @@ import {
   SYSTEM_TENANT_ID,
   type TenantId,
 } from "../engine/types";
+import { InternalError } from "../errors";
 import { isKumikoError } from "../errors/kumiko-error";
 import { createFileContext } from "../files/file-handle";
 import { createFallbackLogger } from "../logging";
@@ -33,8 +35,22 @@ import {
 import { createEscapeHatchReporter } from "../observability/escape-hatch-report";
 import { createDistributedLock, type DistributedLock } from "../pipeline/distributed-lock";
 import { RedisKeys } from "../pipeline/redis-keys";
+import {
+  buildPersonalDataGate,
+  isPersonalDataGated,
+  parseWriteOrigin,
+} from "../pipeline/write-origin";
 import { bridgeStub } from "../testing/handler-context";
 
+// A payload's own `_writeOrigin` is never trusted; only the ambient gated origin is stamped.
+function stampGatedWriteOrigin(data: Record<string, unknown>): void {
+  delete data["_writeOrigin"];
+  const origin = requestContext.get()?.writeOrigin;
+  if (origin && isPersonalDataGated(origin)) {
+    data["_writeOrigin"] = origin;
+  }
+}
+
 // Queue-name convention: <prefix>-<lane>. The prefix is fixed in prod
 // ("kumiko-jobs") — it must match between enqueuers and consumers, and an
 // accidental drift would silently drop jobs. Tests override via
@@ -731,6 +747,21 @@ export function createJobRunner(options: JobRunnerOptions): JobRunner {
     // multi-trigger dispatch; exposed as jobContext.triggerName so handlers
     // don't dig through the raw payload themselves.
     const triggerName = rawData["_triggerName"] as string | undefined; // @cast-boundary dynamic-key
+
+    // Absent = legacy or ungated root; present but invalid fails the run closed.
+    const rawWriteOrigin = rawData["_writeOrigin"]; // @cast-boundary dynamic-key
+    let jobOrigin: WriteOrigin | undefined;
+    let writeOriginInvalid = false;
+    if (rawWriteOrigin !== undefined) {
+      const parsed = parseWriteOrigin(rawWriteOrigin);
+      if (parsed) {
+        jobOrigin = { ...parsed, viaJob: jobName };
+      } else {
+        writeOriginInvalid = true;
+      }
+    }
+    const jobPersonalDataGate = jobOrigin ? buildPersonalDataGate(registry, jobOrigin) : undefined;
+
     // Mirror dispatch-shared.ts buildHandlerContext: ctx.files must resolve
     // through the same _fileProviderResolver for jobs as for write-handlers,
     // otherwise event-triggered jobs silently get an unresolved ctx.files.
@@ -749,8 +780,19 @@ export function createJobRunner(options: JobRunnerOptions): JobRunner {
     // systemScope() status (pre-existing, not something this change alters)
     // — isSystemJob below is what actually keeps ctx.systemDb off a
     // non-system job; it is the only thing standing between this db and an
-    // unchecked cross-tenant escape hatch for such a job.
-    const tenantScopedDb = configDb ? createTenantDb(configDb, tenantId, "system") : undefined;
+    // unchecked cross-tenant escape hatch for such a job. Gated like jobDb so
+    // ctx.systemDb, built from it, is gated too.
+    const tenantScopedDb = configDb
+      ? createTenantDb(
+          configDb,
+          tenantId,
+          "system",
+          undefined,
+          undefined,
+          undefined,
+          jobPersonalDataGate ? { personalDataGate: jobPersonalDataGate } : undefined,
+        )
+      : undefined;
     const isSystemJob = registry.isJobSystemScoped(jobName);
     // One reporter for ctx.systemDb and ctx.db.unsafeRaw() so both dedupe in the same window.
     const reportEscapeHatch = createEscapeHatchReporter({
@@ -768,6 +810,7 @@ export function createJobRunner(options: JobRunnerOptions): JobRunner {
       ? createTenantDb(configDb, tenantId, "tenant", context.tracer, context.meter, undefined, {
           unsafeRaw: jobDef.escapeHatch,
           report: reportEscapeHatch,
+          ...(jobPersonalDataGate && { personalDataGate: jobPersonalDataGate }),
         })
       : undefined;
     const config =
@@ -818,7 +861,7 @@ export function createJobRunner(options: JobRunnerOptions): JobRunner {
             "JobContext.write called before dispatcher attached — call attachDispatcher() first",
           );
         }
-        return dispatchWriteRef.write(jobSystemUser, qn, payload);
+        return dispatchWriteRef.write(jobSystemUser, qn, payload, jobOrigin);
       },
       writeAs: (user: SessionUser, qn: string, payload: unknown) => {
         if (!dispatchWriteRef) {
@@ -826,7 +869,7 @@ export function createJobRunner(options: JobRunnerOptions): JobRunner {
             "JobContext.writeAs called before dispatcher attached — call attachDispatcher() first",
           );
         }
-        return dispatchWriteRef.write(user, qn, payload);
+        return dispatchWriteRef.write(user, qn, payload, jobOrigin);
       },
       queryAs: (user: SessionUser, qn: string, payload: unknown) => {
         if (!dispatchWriteRef) {
@@ -834,7 +877,7 @@ export function createJobRunner(options: JobRunnerOptions): JobRunner {
             "JobContext.queryAs called before dispatcher attached — call attachDispatcher() first",
           );
         }
-        return dispatchWriteRef.queryAs(user, qn, payload);
+        return dispatchWriteRef.queryAs(user, qn, payload, jobOrigin);
       },
       queryAsMember: (userId: string, qn: string, payload: unknown) => {
         if (!dispatchWriteRef) {
@@ -866,6 +909,13 @@ export function createJobRunner(options: JobRunnerOptions): JobRunner {
 
     const runInSpan = async (): Promise<void> => {
       try {
+        if (writeOriginInvalid) {
+          throw new InternalError({
+            message:
+              `Job "${jobName}" received an unparseable _writeOrigin — refusing to run without ` +
+              "a trustworthy anonymous-root gate.",
+          });
+        }
         await requestContext.run(
           {
             requestId: jobRequestId,
@@ -873,6 +923,7 @@ export function createJobRunner(options: JobRunnerOptions): JobRunner {
             // #3043 — events a job writes carry the job as their origin.
             handler: jobName,
             feature: qnScope(jobName),
+            writeOrigin: jobOrigin,
           },
           () => jobDef.handler(payload, jobContext),
         );
@@ -1107,9 +1158,11 @@ export function createJobRunner(options: JobRunnerOptions): JobRunner {
 
       // perTenant: dispatch the fan-out wrapper instead
       if (jobDef.perTenant) {
+        const perTenantData: Record<string, unknown> = { ...(payload ?? {}) };
+        stampGatedWriteOrigin(perTenantData);
         const job = await targetQueue.add(
           `_perTenant:${jobName}`,
-          payload ?? {},
+          perTenantData,
           buildRetryBullOpts(jobDef),
         );
         return job.id ?? "unknown";
@@ -1184,6 +1237,7 @@ export function createJobRunner(options: JobRunnerOptions): JobRunner {
       // stamp the same correlation as the HTTP request that scheduled it.
       const reqCtx = requestContext.get();
       if (reqCtx?.correlationId) data["_correlationId"] = reqCtx.correlationId;
+      stampGatedWriteOrigin(data);
 
       const job = await targetQueue.add(jobName, data, bullOpts);
       return job.id ?? "unknown";
@@ -1228,6 +1282,7 @@ export function createJobRunner(options: JobRunnerOptions): JobRunner {
             continue;
           }
         }
+        stampGatedWriteOrigin(data);
         // Route to the job's declared lane, not a fixed queue — that's
         // the whole reason both queues are held.
         await queues[laneForJob(jobDef)].add(name, data, buildRetryBullOpts(jobDef));