Publish Clusterflux c8e7f9b

CLUSTERFLUX_PUBLIC_TREE.json

@@ -1,7 +1,7 @@
 {
   "kind": "clusterflux-filtered-public-tree",
-  "source_commit": "5d40a47fb4bdeebabb181286d1fb49af81c4901b",
+  "source_commit": "c8e7f9b3b3c0715af80ea3ec8b1c26e5849c270f",
-  "release_name": "release-5d40a47fb4bd",
+  "release_name": "release-c8e7f9b3b3c0",
   "filtered_out": [
     "private/**",
     "internal/**",

scripts/cli-happy-path-live-smoke.js

@@ -1753,11 +1753,41 @@ async function runSecondTenantIsolation({
     assert(!JSON.stringify(nodes).includes(targetProject));
     const foreignProcess = `vp-foreign-isolation-${Date.now()}`;
     const foreignArtifact = `artifact-foreign-isolation-${Date.now()}`;
-    const tasksAndLogs = assertDenied(
+    const tasksAndLogsResponse = await call({
-      await call({ type: "list_task_events", process: foreignProcess }),
+      type: "list_task_events",
+      process: foreignProcess,
+    });
+    let tasksAndLogs;
+    if (tasksAndLogsResponse.type === "error") {
+      tasksAndLogs = {
+        ...assertDenied(
+          tasksAndLogsResponse,
           /outside|scope|tenant|project|not active|requires an active|unknown/i,
           "single-account foreign task and log listing"
+        ),
+        enforcement: "explicit_error",
+      };
+    } else {
+      assert.strictEqual(
+        tasksAndLogsResponse.type,
+        "task_events",
+        JSON.stringify(tasksAndLogsResponse)
       );
+      assert.deepStrictEqual(
+        tasksAndLogsResponse.events,
+        [],
+        "single-account foreign-looking task listing must disclose no events"
+      );
+      assert(!JSON.stringify(tasksAndLogsResponse).includes(targetTenant));
+      assert(!JSON.stringify(tasksAndLogsResponse).includes(targetProject));
+      tasksAndLogs = {
+        denied: true,
+        reason: "authenticated scope returned no visible task or log events",
+        enforcement: "scoped_empty_result",
+        response_type: tasksAndLogsResponse.type,
+        event_count: tasksAndLogsResponse.events.length,
+      };
+    }
     const debugResponse = await call({
       type: "debug_attach",
       process: foreignProcess,