We are many.
We move as one.

›add end-to-end multi-tenant org isolation to the API — org_id on every model, a deny-by-default guard on every resolver, a backfill migration, and an isolation test suite. then open a PR

●Big one — it touches the schema, the request context, and every resolver, and it's security-sensitive. I'll take it through Legion: plan and grill the intent, fan the slices across the cohort in parallel, cross-verify, self-heal anything that fails your gates, then stop at a PR you approve.

●Update Todos

⎿☐Map the blast radius — models + resolver sites

☐Run the task through legion-run

☐Review the verified diff + heal any failures

☐Open the PR

●First — how wide is this? A scope guard is only safe if it covers every read.

●Bash(rg -l "prisma\.\w+\.(findMany|findFirst|count)" src/resolvers | wc -l)

37

●Bash(rg -n "^model (User|Org|Project|Invoice|ApiKey|Webhook)" prisma/schema.prisma)

12:model User { 41:model Org { 63:model Project {

98:model Invoice { 124:model ApiKey { 151:model Webhook {

⎿37 resolver files · 6 models with no org scope

no tenant column anywhere yet — cross-cutting, not local. Deny-by-default so a missed site fails closed, not open. Good fit for fan-out.

●Bash(legion-run --repo . \ --task "multi-tenant org isolation across the API, deny-by-default" \ --validate "npm test && npm run build && legion-doctor")

⎿→ run 20260810-143207 · legion.heavy_task.v1

▸doctor

codex · cursor · router healthy · 7 harnesses linked

self-learn: loaded 3 lessons from .legion/memory (2 on data-loss migrations)

✓doctor· healthy · cohort ready

▸plan

grilling the prompt across claude-opus-5 + gpt-5.6-sol until the intent is sharp …

locked: isolate by org_id · deny-by-default · backfill from the ownership graph · admin bypass behind a role

decomposed the goal → 9 slices:

01 schema org_id + relations on 6 models

02 migration backfill org_id, then set NOT NULL

03 context resolve org from session → request ctx

04 guard withOrgScope() — deny-by-default

05 resolvers apply the scope to all 37 sites

06 admin audited cross-org bypass for internal role

07 tests isolation + leakage suite

08 seed multi-org fixtures

09 docs threat model + migration runbook

✓plan· 9 slices · deny-by-default

▸route

cost/capability policy → a model per slice:

01 schema → gpt-5.6-terra mechanical, scoped

02 migration → gpt-5.6-terra high effort

04 guard → gpt-5.6-terra security-sensitive

05 resolvers → gpt-5.6-terra bulk, patterned

07 tests → gpt-5.6-terra spec-driven

03·06·08·09 → terra · terra · luna · terra

✓route· 9 assigned · est $1.90

▸fanout-apply · 9 worktrees · parallel

spun 9 isolated worktrees under .legion/worktrees/143207/ …

✓01schemagpt-5.6-terra+48 −2 · verified

✓03contextgpt-5.6-terra+61 −4 · verified

✓04guardgpt-5.6-terra+73 −11 · verified

✓08seedgpt-5.6-luna+52 −0 · verified

✗05resolversgpt-5.6-terranpm test: 3 red · Invoice.list leaks across orgs

↻ heal: reroute 05 → gpt-5.6-sol at max, with the 3 failing specs as context

✓02migrationgpt-5.6-terra+96 −1 · verified

✓06admingpt-5.6-terra+40 −6 · verified

✓09docsgpt-5.6-terra+120 −0 · verified

✓07testsgpt-5.6-terra+180 −0 · verified

↻05resolversgpt-5.6-sol+214 −58 · 3 red → green · healed

✓fanout· 9/9 applied · 1 healed · +884 −90

▸review · cross-model

claude-opus-5 auditing the gpt-5.6-terra slices for scope gaps …

finding: Project.search() builds its own query, skips withOrgScope() → patched

cursor-grok-4.6-high taking an independent second opinion on the healed access path … clean

leakage probe: 240 cross-org access attempts → 240 denied (0 leaked)

✓review· clean · 1 gap closed

▸validate

$npm test

Test Suites: 34 passed, 34 total

Tests: 412 passed, 412 total (28 new isolation specs)

$npm run build

✓ compiled successfully · no type errors

$legion-doctor

── 0 fail, 0 warn ──

✓validate· 412 passed · build green

▸evaluate + report + share

eval harness: no regressions vs baseline · read p95 +2ms (index added)

wrote legion-observability.html · 47 spans emitted (legion.span.v1)

metered: gpt-5.6-terra $0.38 · claude-opus-5 $1.12 · gpt-5.6-sol $0.21 · cursor-grok-4.6-high $0.34

✓share· $2.05 metered across 4 models

▸self-learn + heal-plan

mined the run → 2 lessons: scope every new list resolver; escalate failed security slices to sol at max

heal-plan: 0 open defects

✓self-learn· 2 lessons written · 0 defects

legion-run ok · .legion/runs/20260810-143207 · 9 slices · 1 healed

●Here's the verified diff: the deny-by-default guard, and the resolver that leaked, failed your tests, and self-healed onto gpt-5.6-sol:

diff src/middleware/org-scope.ts (new · gpt-5.6-terra)

@@ -0,0 +1,26 @@

+// Deny-by-default: a query with no org in context returns nothing.

+export function withOrgScope<T>(ctx: Ctx, where: T): T & { orgId: string } {

+ if (!ctx.orgId) throw new ForbiddenError("no org in context");

+ return { ...where, orgId: ctx.orgId };

+}

diff src/resolvers/invoice.ts (healed · gpt-5.6-terra → gpt-5.6-sol)

@@ -18,7 +18,7 @@ export const invoiceResolvers = {

list: (_p, args, ctx) =>

- db.invoice.findMany({ where: { status: args.status } }),

+ db.invoice.findMany({ where: withOrgScope(ctx, { status: args.status }) }),

get: (_p, { id }, ctx) =>

- db.invoice.findFirst({ where: { id } }),

+ db.invoice.findFirst({ where: withOrgScope(ctx, { id }) }),

diff prisma/migrations/20260810_org_isolation/migration.sql (gpt-5.6-terra)

@@ -0,0 +1,9 @@

+ALTER TABLE "Invoice" ADD COLUMN "orgId" TEXT;

+UPDATE "Invoice" i SET "orgId" = p."orgId"

+ FROM "Project" p WHERE i."projectId" = p."id";

+ALTER TABLE "Invoice" ALTER COLUMN "orgId" SET NOT NULL;

18 files changed · +884 −90 · 1 slice healed

●GPT-5.6 Terra handled the scoped implementation, Luna took the bounded seed work, and Sol healed the failed security slice. Claude Opus 5 planned and signed off. Cursor Grok 4.6 High supplied an independent second opinion. Every slice was cross-verified. The leak was caught by your own tests and rerouted automatically. Nothing shipped on one model's say-so.

●Update Todos

⎿☒Map the blast radius — models + resolver sites

☒Run the task through legion-run

☒Review the verified diff + heal any failures

☒Open the PR

●Bash(gh pr create --fill \ --title "feat(api): multi-tenant org isolation (deny-by-default)")

⎿https://github.com/your-org/your-repo/pull/491

●Done — a verified PR: 9 slices, +884 −90, 412 tests green (28 new isolation specs), one cross-org leak caught and self-healed, $2.05 metered across four models. Yours to review and merge.