What deploys onto an attendee org.

1.What deploys onto an attendee org

Every artifact below is Sandbox-grade metadata, deployed via the standard sf CLI against the attendee's OrgFarm scratch. No production tenants touched, no cross-org access, no shared state.

• Sales Cloud SDM — standard OrgFarm-shipped Semantic Data Model. 12 data objects, 16 metrics, 35 calc measurements, 15 calc dimensions. shipped by image Attendees author on top of it; nothing rewrites its base state.
• CK-DataCloud-Access 2GP — 04tJ80000011MXvIAM, Unlocked, no namespace, promoted on qbranch-eca-dev’s devorg Dev Hub. Assigns GenieUserEnhancedSecurity perm set + GenieDataPlatformStarterPsl license. 83% code coverage verified against workshoplwc2
• ~142 Lightning Web Components — deployed via sf project deploy start from force-app/. Canonical Tableau Next semantic-query LWCs plus supporting Apex controllers. All namespace-safe.
• ~25 industry data kit schemas — DLOs + SDMs, schema only. NO row data at deploy time. Row load is gated behind the OAuth scope ask (see §2). pending scope grant
• Optional post-install Apex bootstrap — sf apex run against a self-contained snippet that assigns GenieUserEnhancedSecurity + PSL to the installing user. Documented in packages/ck-datacloud-access/README.md. Idempotent (queries PermissionSetAssignment count before insert).

# Attendee session start — invoked by the `cold-open` skill in Claude Code
sf org login web # 2 clicks in a browser popup; produces a session for the current OrgFarm
sf package install --package 04tJ80000011MXvIAM --wait 10 --no-prompt
sf project deploy start --source-dir force-app/ --wait 10
sf apex run --file bootstrap/assign-perms.apex

2.OAuth scope ask (with curl evidence)

The 25 industry data kits load row data through the CDP tenant Bulk-Ingest API. That endpoint refuses a token minted without cdp_ingest_api scope. This is the only outstanding platform dependency.

# Token from `sf` CLI session, no CDP scopes
$ TOKEN=$(sf org display --json | jq -r '.result.accessToken')
$ TENANT="gjrg8nzsgfqw0n3dg82gcnbqg8.c360a.salesforce.com"

$ curl -X POST "https://$TENANT/api/v1/ingest/jobs" \
    -H "Authorization: Bearer $TOKEN" \
    -H "Content-Type: application/json" \
    -d '{"object":"CK_Industry_Reviews","operation":"upsert"}' \
    -w "\nHTTP %{http_code}\n"

HTTP 400
# empty body — CDP tenant rejects under-scoped token with no error body

Full 8-path research (Paths A–H, each with curl + HTTP status): /vibecoding/why/ and docs/dc-ingestion-research-2026-07-13.md.

3.What happens when scope IS granted (technical flow)

Four programmatic stages against the CDP tenant. All headless. Idempotent by name. Documented Path A in the research doc.

# Stage 1: create connector — HTTP 201, returns tenantSpecificEndpoint
POST /services/data/v67.0/ssot/connections
{ "connectorType": "IngestApi", "name": "ck_industry_reviews", "label": "CK Reviews" }
→ 201  { id, name, tenantSpecificEndpoint }

# Stage 2: register schema — HTTP 200
PUT /services/data/v67.0/ssot/connections/{id}/schema
{ "schemas": [ { "schemaType": "IngestApi", "name": "Reviews",
    "label": "Reviews", "fields": [ ... ] } ] }
→ 200

# Stage 3: create data stream — HTTP 201, auto-materializes DLO
POST /services/data/v67.0/ssot/data-streams
{ "datastreamType": "INGESTAPI", "connectorDetails": { "events": [...] } }
→ 201

# Stage 4: bulk-ingest rows — HTTP 202, then chunked PUT of CSV parts
POST https://{tenantSpecificEndpoint}/api/v1/ingest/jobs
→ 201  { jobId }
PUT  /api/v1/ingest/jobs/{jobId}/batches  # CSV body
→ 202
PATCH /api/v1/ingest/jobs/{jobId}  { "state": "UploadComplete" }
→ 200

4.Blast radius + reversibility

This is the core concern — and it is bounded by design. Every scope, every write, every artifact is contained to the attendee's 15-day scratch org.

# List active tokens for the Connected App
$ curl -s "$INSTANCE_URL/services/data/v67.0/query" \
    -H "Authorization: Bearer $TOKEN" \
    --data-urlencode "q=SELECT COUNT() FROM OauthToken WHERE AppName='Salesforce CLI'"

# Revocation is Setup-UI; API path via ToolingApi.ConnectedApplication:
$ curl -X PATCH "$INSTANCE_URL/services/data/v67.0/tooling/sobjects/ConnectedApplication/$ID" \
    -H "Authorization: Bearer $TOKEN" \
    -d '{"OauthConfig": {"Scopes": ["Api","RefreshToken"]}}'  # CDP scopes dropped

5.Precedent

This pattern is not novel. Two internal Salesforce precedents already ship elevated scopes into demo / workshop orgs through 2GP.

Full audit of the hackathon-Q pattern (2GP file layout, install lifecycle, InstallHandler behavior on first-install-vs-upgrade): docs/q-hackathon-2gp-audit.md.

6.Timeline

Decision needed T-8. Everything downstream is already built and dependency-documented.

7.Read the source

Every claim above is backed by a committed artifact. Nothing on this page is speculative unless flagged.

• docs/antoine-ask.md — the ask (Slack DM + email versions + fallback + SE-leader blurb)
• docs/scope-grant-risk-analysis.md — one-page risk table for security review
• docs/dc-ingestion-research-2026-07-13.md — the 8-path research with curl transcripts per path
• docs/q-hackathon-2gp-audit.md — hackathon-Q package inventory + install-lifecycle audit
• .claude/skills/tableau-next-author/references/platform-gotchas.md — empirical corpus of 40+ platform limits + workarounds
• packages/ck-datacloud-access/README.md — the 2GP package spec, install commands, verification query
• packages/ck-datacloud-access/RISKS.md — R1–R5 risks + resolution status
• GitHub repo: tcufrogger/tableau-vibe-coding-workshop-starter-kit (public)