@@ -0,0 +1,23 @@
+---
+'@objectstack/plugin-security': minor
+'@objectstack/core': minor
+'@objectstack/spec': minor
+---
+
+feat(plugin-security)!: under a walled tenancy posture every external object states its organization scope
+
+Clause-②: no (narrowing) — under the `isolated` and `group` postures an external object (an `external` block) that states no organization scope is refused by name when the boot completes, and one registered after the boot answers no row and accepts no write; nothing is widened, and the `single` posture is unchanged.
+Metadata-protocol: narrowed
+
+<!-- adr-0087: registered external-object-organization-scope-declared -->
+
+**BREAKING** for a deployment running the `isolated` or `group` tenancy posture (`OS_TENANCY_POSTURE`) with an external object that states nothing about its organization scope.
+
+- **The rule (ADR-0015 §10 as amended, ADR-0095 D1).** The platform provisions no storage for an external object, so the `organization_id` it injects into the registered schema is a column the remote may not carry. Whose rows an external object serves — one organization's or every organization's — is a fact only its author knows, and under a walled posture the object states it, in one of three ways: its own `organization_id` field (the remote rows carry the organization column and the driver returns it; a remote column of another name is mapped onto it with `external.columnMap: { <remote column>: 'organization_id' }`); `tenancy: { enabled: false }` (shared by every organization); or `systemFields: { tenant: false }` (the same opt-out on the system fields). These are the wall's own two opt-out clauses and the one column it reads; the whole-block `systemFields: false` states nothing.
+- **What the rule does.** `SecurityPlugin` refuses the boot from its `kernel:ready` handler, beside the ADR-0131 D5 refusal, naming every external object that states nothing and the three ways out (`ExternalObjectOrganizationScopeUndeclaredError`). An external object registered after the boot — a Studio import, a runtime datasource — that states nothing answers no row and accepts no write: the Layer 0 verdict is `deny` (`computeTenantLayer0Verdict`), the write wall refuses every insert, update and delete with a sentence naming the undeclared scope and the three ways out, and the plugin says so once in a warning. An object declaring its own `organization_id` is walled: a member of organization A reads only A's rows, through a driver that honours `where` and through one that ignores it (the engine's floor re-applies the predicate), and a row missing the column reads to no one. An object declaring `tenancy: { enabled: false }` or `systemFields: { tenant: false }` is shared.
+- **`tenancy.tenantField` on an external object is closed the same way.** The organization wall keys on `organization_id` alone, and a declared tenant field is read only by storage the platform provisions, which an external object has none of; so on an external object a `tenantField` naming another column is refused at boot and denied after it, with the remedy spelled out (`external.columnMap` onto `organization_id`, or `tenancy: { enabled: false }`). Local objects are unchanged.
+- **Who moves.** Every walled deployment with an external object stating nothing: declare one of the three and restart. The showcase's two federated analytics objects now declare `tenancy: { enabled: false }`. A `single`-posture deployment owes no declaration and behaves exactly as before.
+- **`@objectstack/core`.** `TenantLayer0Input` gains the optional `externalOrganizationScopeUndeclared`; set, the verdict is `deny` under a walled posture, ahead of the platform-admin crossing. Omitted, every existing caller reads as before.
+- **`@objectstack/spec`.** The ADR-0087 D3 entry `external-object-organization-scope-declared` tells an upgrading operator what to declare.
+
+Skills-docs: follow-up #29866 — `content/docs/data-modeling/virtual-objects.mdx` (a multi-organization section), `skills/objectstack-data/rules/datasources.md` (the three declarations), `docs/adr/0015-external-datasource-federation.md` (the §10 and D7 amendment); the sibling docs PR on `claude/sec-hardening-g-docs`, governed (Tier H), landed by the maintainer's hand.
@@ -15,6 +15,13 @@ export const ExternalCustomer = ObjectSchema.create({
   // object is RLS-owned / intentionally public; without this the new secure
   // default (unset OWD => private) would owner-filter it.
   sharingModel: 'public_read_write',
+  // [ADR-0015 §10] Under a walled tenancy posture every external object states
+  // its organization scope. The remote `customers` table carries no
+  // organization column — it is the deployment's analytics catalogue, read by
+  // every organization alike — so this object declares itself shared. (The
+  // other declaration is an `organization_id` field of its own, when the
+  // remote rows carry one.)
+  tenancy: { enabled: false },
   label: 'External Customer',
   pluralLabel: 'External Customers',
   icon: 'database',
 
@@ -13,6 +13,11 @@ export const ExternalOrder = ObjectSchema.create({
   // object is RLS-owned / intentionally public; without this the new secure
   // default (unset OWD => private) would owner-filter it.
   sharingModel: 'public_read_write',
+  // [ADR-0015 §10] Under a walled tenancy posture every external object states
+  // its organization scope. The remote `orders` table carries no organization
+  // column — the deployment's shared analytics catalogue — so this object
+  // declares itself shared, as `showcase_ext_customer` does.
+  tenancy: { enabled: false },
   label: 'External Order',
   pluralLabel: 'External Orders',
   icon: 'shopping-cart',
 
@@ -0,0 +1,61 @@
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+
+/**
+ * The Layer 0 verdict ladder (ADR-0095 D1 / ADR-0131 D8), rung by rung — in
+ * particular the rung an external object reaches when it states no
+ * organization scope under a walled posture (ADR-0015 §10): the wall DENIES,
+ * it does not stand down.
+ */
+
+import { describe, it, expect } from 'vitest';
+import { computeTenantLayer0Verdict, type TenantLayer0Input } from './tenant-layer0-verdict.js';
+
+const member = (over: Partial<TenantLayer0Input> = {}): TenantLayer0Input => ({
+  tenancyPosture: 'isolated',
+  organizationId: 'org-1',
+  objectHasOrgIdField: true,
+  tenancyDisabled: false,
+  posturePermitsCrossTenant: false,
+  isPlatformAdmin: false,
+  ...over,
+});
+
+describe('computeTenantLayer0Verdict — an external object that states no organization scope', () => {
+  it('under `isolated` the wall denies: no provable scope, no row', () => {
+    expect(computeTenantLayer0Verdict(member({ externalOrganizationScopeUndeclared: true, objectHasOrgIdField: false })))
+      .toEqual({ kind: 'deny' });
+  });
+
+  it('under `group` the wall denies too — the union predicate has no column to name', () => {
+    expect(computeTenantLayer0Verdict(member({
+      tenancyPosture: 'group', accessibleOrgIds: ['org-1', 'org-2'],
+      externalOrganizationScopeUndeclared: true, objectHasOrgIdField: false,
+    }))).toEqual({ kind: 'deny' });
+  });
+
+  it('the denial precedes the platform-admin crossing: an undeclared object is a configuration defect, not a posture', () => {
+    expect(computeTenantLayer0Verdict(member({
+      externalOrganizationScopeUndeclared: true, objectHasOrgIdField: false,
+      isPlatformAdmin: true, posturePermitsCrossTenant: true,
+    }))).toEqual({ kind: 'deny' });
+  });
+
+  it('a declared opt-out (`tenancy.enabled: false`) still contributes nothing — the object is shared by every organization', () => {
+    expect(computeTenantLayer0Verdict(member({ tenancyDisabled: true, externalOrganizationScopeUndeclared: false, objectHasOrgIdField: false })))
+      .toEqual({ kind: 'none' });
+  });
+
+  it('a declared `organization_id` keeps the wall', () => {
+    expect(computeTenantLayer0Verdict(member({ externalOrganizationScopeUndeclared: false })))
+      .toEqual({ kind: 'organization', organizationId: 'org-1' });
+  });
+
+  it('CONTROL: under `single` nothing is read — an undeclared object answers `none` like every other', () => {
+    expect(computeTenantLayer0Verdict(member({ tenancyPosture: 'single', externalOrganizationScopeUndeclared: true, objectHasOrgIdField: false })))
+      .toEqual({ kind: 'none' });
+  });
+
+  it('CONTROL: the flag omitted reads as every caller before it — a column-less object answers `none`', () => {
+    expect(computeTenantLayer0Verdict(member({ objectHasOrgIdField: false }))).toEqual({ kind: 'none' });
+  });
+});
@@ -69,6 +69,19 @@ export interface TenantLayer0Input {
    * are NOT tenant objects; Layer 0 contributes nothing.
    */
   tenancyDisabled: boolean;
+  /**
+   * [ADR-0015 §10] The object is EXTERNAL (ADR-0015 `external`: the platform
+   * provisions none of its storage) and states no organization scope the wall
+   * can enforce — neither its own `organization_id` field, nor
+   * `tenancy.enabled: false`, nor `systemFields.tenant: false`; or it names a
+   * `tenancy.tenantField` other than `organization_id`, which the wall does not
+   * read. Under a walled posture such an object is DENIED: whose rows it serves
+   * is a fact only its author can state, and an unstated scope fails toward
+   * isolation, never toward exposure (the shape the owner anchor takes when no
+   * owner is provable). The boot refuses such an object by name; this rung
+   * meets the one registered after the boot. Omitted, nothing changes.
+   */
+  externalOrganizationScopeUndeclared?: boolean;
   /**
    * Whether the object's POSTURE permits a platform admin to cross the tenant
    * wall — `private`, platform-global (`tenancy.enabled:false`), or
@@ -123,18 +136,28 @@ const LAYER0_DENY: TenantLayer0Verdict = Object.freeze({ kind: 'deny' as const }
  *   (ADR-0105 D2).
  * - `deny` → a walled posture on a tenant object, but the context carries no
  *   organization scope to enforce with (no active org under `isolated`, empty
- *   access set under `group`) → fail closed (zero rows / write denied).
+ *   access set under `group`); or a walled posture on an external object that
+ *   states no organization scope (ADR-0015 §10) → fail closed (zero rows /
+ *   write denied).
  */
 export function computeTenantLayer0Verdict(input: TenantLayer0Input): TenantLayer0Verdict {
   // `single` posture (incl. a degraded deployment, which resolves to `single`)
   // → parity with today's policy stripping.
   if (!postureEnforcesWall(input.tenancyPosture)) return LAYER0_NONE;
 
-  // Not a tenant object: platform-global (tenancy disabled) or simply carries no
-  // `organization_id` column (e.g. better-auth identity tables like `sys_user`).
-  // Layer 0 contributes nothing — the object's own business RLS (Layer 1, e.g.
+  // Not a tenant object: platform-global (tenancy disabled). Layer 0
+  // contributes nothing — the object's own business RLS (Layer 1, e.g.
   // `_self` carve-outs) is its only scoping.
   if (input.tenancyDisabled) return LAYER0_NONE;
+
+  // [ADR-0015 §10] An external object that states no organization scope is
+  // denied under a wall — ahead of the column question (its `organization_id`
+  // is the registry's, not the remote's) and ahead of the platform-admin
+  // crossing (an unstated scope is a configuration defect, not a posture).
+  if (input.externalOrganizationScopeUndeclared) return LAYER0_DENY;
+
+  // Simply carries no `organization_id` column (e.g. better-auth identity
+  // tables like `sys_user`): not a tenant object, Layer 0 contributes nothing.
   if (input.objectHasOrgIdField === false) return LAYER0_NONE;
 
   // Exemption is a Layer 0 rule (W2 fix): only a TRUE PLATFORM_ADMIN caller on an