Repository navigation
measure(plugin-auth): the organization-less admin_full_access anchor in the last-admin guard and the pre-organization default-org bootstrap, after ADR-0131 step 7 #24883
Description
Filing gate ③: a finding carried from the 18.x line, step 7 (#24583). It was found by the 7z closing part (os-dev report on #24583) and the review of PR #24872 (6291176705, R3).
- Reader who acts: the epic seat (
epic:#15194,session_01Y5583bs2RDd53MH6kM1ca3), or the lane seat forplugin-auth. - Dedupe: none found (
organization-less admin_full_access,anchorOwnerTest,ensure-default-organization).
Not an 18.0 gate. On a certified or fresh platform database both readers below answer the same as the resolver, because no organization-less grant exists there. The divergence is confined to the embedding and bootstrap contracts described below.
What was measured
The 7z dev tried to retire both NULL halves and stopped, because both are live contracts. The experiments are in the 7z report on #24583.
plugins/plugin-auth/src/last-admin-guard.tsanchorOwnerTest(~1017-1030) counts an organization-lessadmin_full_accessgrant as an administrator.- Making it Default-Organization-only, the rule 7a-2 (feat(core,plugin-security)!: 18.x step 7 part 7a-2 — a grant applies only in its own organization; the organization-less grant readers retire #24872) gives
grantAnchorsPlatformStanding, turns 44 of 207 guard tests red. - Why it is live:
registerLastAdminGuardis a public export (plugin-auth/src/index.ts,export * from './last-admin-guard.js'). Its suite registers it on an engine with nosys_organization, where the organization-less grant is the only anchor. Retiring the half would make the guard recognise no administrator there, so it would fail open. - Inside the platform it is dead. The one internal caller (
auth-plugin.ts~1671) sits in plugin-auth, which always registerssys_organization.
- Making it Default-Organization-only, the rule 7a-2 (feat(core,plugin-security)!: 18.x step 7 part 7a-2 — a grant applies only in its own organization; the organization-less grant readers retire #24872) gives
plugins/plugin-auth/src/ensure-default-organization.ts(~503-511) finds the administrator before a Default Organization exists, and then creates one. With no organization yet, the organization-less grant is its only way in.plugins/organizationswraps it as the walled-posture bootstrap.- NOT MEASURED: whether a production walled fresh boot writes that organization-less grant before the first organization exists, or whether ADR-0131 D9 refuses it first.
Why it matters after 7a-2
Once #24872 lands, the resolver and the guard disagree on an organization-less admin_full_access grant:
- the resolver gives it no platform standing;
- the guard still counts it.
The guard's side fails closed: it refuses to revoke the last admin.
The question to settle (measure first)
- (a) Embedding. What anchors "an administrator" for a guard embedded with no organization object? Options: keep the organization-less grant as that composition's anchor, by declaration, the way 7b-3 keeps
__global__for lean embeddings; or refuse to register the guard without an organization object. - (b) Bootstrap. Does the pre-organization bootstrap need an organization-less grant at all, or can it read the promoted owner (
OS_PLATFORM_OWNER_EMAIL, or the seeded admin) directly? - Then align
anchorOwnerTestandensure-default-organizationwith ADR-0131 D1/D8/D9, and re-fixture their suites.
Governing text: ADR-0131 D1, D8, D9; 7b-3's lean-embedding rule (#24845, __global__ kept where no organization object is registered).
Blocked-by: #24872
Activity
objectstack-fleet commentedon Oct 20, 2026
Claim: PM loop round 2 · 2026-10-20T13:11Z
Session:
session_01UmqzD97e14iws6hmVhgZ5yAccount:
os-support-ai(the seat's linked user asGET /useranswers it; always the card's assignee)Branch:
claude/issue-24883-orgless-admin-anchor(a readings-only dispatch: no edit, no PR; the readings are posted to this card)Worktree: none (readings on
origin/mainfrom the shared checkout, read-only; PR #24872's head read withgit show)Domain:
domain:servicesSeat:
domain:services#2(seat post #21118)File surface: none written. Read:
packages/plugins/plugin-auth/src/last-admin-guard.ts(anchorOwnerTest,registerLastAdminGuardand its public export),packages/plugins/plugin-auth/src/ensure-default-organization.tsand itsplugins/organizationswrapper, the boot order that writes the first administrator's grant on a walled fresh install, ADR-0131 D1/D8/D9, and PR #24872 (7a-2) and #24845 (7b-3) for the rules they set (stop on breach; explain in the report)Container & model:
S,mode:subagent,model: opus(TIER_DEFAULT; a readings-only dispatch whose output is a measured answer to the card's questions (a) and (b))Clause-②: no
Responsibility:
plugin-auth's last-admin guard and pre-organization bootstrap still treat an organization-less admin_full_access grant as an administrator, while 18.x step 7a-2 (PR #24872) gives it no platform standing | 7b-3's lean-embedding rule (#24845) is the precedent the card names | embedders that register the guard with no organization object, and the walled fresh-boot path; NOT MEASURED whether production writes the grant (the card's first step)Thread-read: none
Serial constraints cleared: nothing is written. PR #24872 (the epic's 7a-2) edits plugin-auth tests, not these two files. No in-flight claim in either services seat names them.
The card names its reader as the epic seat (
epic:#15194) or the lane seat forplugin-auth. This lane seat takes the measurement. If the answer needs the epic's sequencing, it goes back to the epic seat on this card.Generated by Claude Code
objectstack-fleet commentedon Oct 20, 2026
os-dev-report
{ "issue": 24883, "status": "reading", "branch": "claude/issue-24883-orgless-admin-anchor", "pr": null, "session": "session_01UmqzD97e14iws6hmVhgZ5y (subagent; shares the dispatching PM session)", "premise_still_valid": true, "summary": "The divergence the card names is real, but three of its sub-premises are corrected by measurement. (1) The bootstrap's organization-less read is not a live contract: on a real walled boot (isolated, the real organizations runtime) the bootstrap never reads grants and finds the administrator through the config anchor only; on a real single boot the Default Organization is the boot's first write, before any user, and the promotion grant is owned by it. The null read found nothing on either boot. (2) The guard's organization-less half is live only in test fixtures: no shipped composition registers the guard without sys_organization, and the guard's own docblock declares it reads 'the resolver's predicate (grantAnchorsPlatformStanding)'. (3) After #24872 the over-count does not only fail closed: it fails closed for a write against the organization-less holder and open for a write against the last administrator the resolver recognises while such a holder is counted. It is dormant: no such row can be written in a composition that registers sys_organization (D9 measured on both postures). Reading: (a) and (b) are execution of ADR-0131 D1/D5 and the guard's declared parity with the resolver, not a new decision. Recommended: a3 (re-spelled locally) plus b3, in one domain:services PR that lands after #24872.", "readings": { "anchors": "objectstack origin/main 98c3d0044 (origin/main moved to ad8cf92f0 during the run; git diff --quiet 98c3d0044 ad8cf92f0 over every file read below exits 0). PR #24872 head e9cdb1de8d (open, not merged). Shallow clone.", "1_anchorOwnerTest": { "where": "packages/plugins/plugin-auth/src/last-admin-guard.ts:1017-1030 (docblock :1007-1016). Callers: :1098 (resolveAdminUserIds, the count), :1295 (stranded evidence, set switched off), :1327 (dangling evidence). Neither the guard nor the bootstrap is touched by #24872 (two-dot diff of main and e9cdb1de8d over both files is empty).", "guard_counts_on_main": "Non-walled, set defined in the bound catalog and not switched off in the ledger: an in-window admin_full_access grant whose owner is undefined (NULL, absent or empty string, via toId :599-603) OR equals the Default Organization (slug 'default', else the only one; read only when some grant names an organization; with no registered sys_organization the read is not issued and the Default Organization is undefined). Walled: the grant half counts nobody (:1088-1091), but organization-less rows are still 'emptied environment' evidence in refuseIfEmptiedRatherThanFresh.", "resolver_counts_at_e9cdb1de8d": "grantAnchorsPlatformStanding (packages/core/src/security/resolve-authz-context.ts:923-929): false under a wall or when no Default Organization is nameable (no registered organization object included, readDefaultOrganizationId :943-951); otherwise only a grant owned by the Default Organization. grantAppliesInTenant (:869-871): an organization-less grant applies nowhere. So after #24872 an organization-less admin_full_access grant confers neither the set nor standing in any composition, with or without an organization object.", "disagreement": "Exactly one row shape: an in-window organization-less admin_full_access grant. Everything else (Default Organization definition, catalog, ledger, validity window, set name, wall) agrees.", "failure_directions_after_24872": [ "(i) A write ending the organization-less holder's standing, when that holder is the only one the guard counts: refused, although the resolver loses nobody. Fails closed.", "(ii) A write ending the last administrator the resolver recognises, while an organization-less holder is counted: permitted, because the guard believes one remains. Fails open.", "(iii) Walled, zero administrators counted: an organization-less row is still read as 'emptied' evidence, so the guard refuses where the resolver sees a fresh environment. Fails closed." ], "reachability": "Dormant in every served composition. The row cannot be written once sys_organization is registered: measured on 98c3d0044, a system insert with no organization on sys_user_permission_set is refused under isolated (SystemWriteOrganizationRequiredError, ERR_SYSTEM_WRITE_ORGANIZATION_REQUIRED, status 500) and stamped with the Default Organization under single. A pre-ceremony database is refused at boot (the line's R3). The row is producible only where no organization object is registered (objectql engine.ts resolveSystemInsertOrganization, no-organization-object exit), which is the guard suite's fixture and no shipped composition." }, "2_public_embedding_contract": { "export": "plugin-auth/src/index.ts:47 export * from './last-admin-guard.js'.", "callers_in_tree": "One production caller: auth-plugin.ts:1671, inside the kernel:ready hook, in a composition that always registers sys_organization (authIdentityObjects, manifest.ts:49-54; IdentityObjectsPlugin registers the same list). Eight test files, all in plugin-auth: last-admin-guard.test.ts, .activation-ledger, .config-anchor, .default-organization, .re-pricing, grant-readers-by-name.golden, grant-readers-unnamed-grant, scim-deactivation-reconcile-user. No example and no other package calls it.", "callers_outside": "objectui origin/main 12cde0492: 0 hits; hotcrm origin/main 9db9a58: 0 hits (control: @objectstack/plugin-auth is named in 12 and 14 files). objectstack-ai/cloud: NOT MEASURED, reason: the repository is not enabled for this session (403).", "no_organization_compositions": "Only test fixtures. Four files register the guard on an engine with no sys_organization and a bound test catalog (last-admin-guard.test.ts, .activation-ledger, .config-anchor, .re-pricing); measured by mutation M2 below. Without plugin-security's catalog the grant half is off anyway (adminSetDefined, :908-911), and plugin-security is composed only beside AuthPlugin.", "declared": [ "last-admin-guard.ts:131-135: 'owned by the Default Organization (ADR-0131 D5, the row the single promotion writes) or by none (the row it wrote before)'. The organization-less half is declared as the pre-D5 row, not as an embedding anchor.", "last-admin-guard.ts:139-142: 'The key is not a policy of this guard's own: the enumeration answers the SAME question the derivation does, and one anchor read two ways by two readers is the dual-track the migration window existed to close.'", "last-admin-guard.ts:1008-1010: the grants 'the anchor reads — the resolver's predicate (grantAnchorsPlatformStanding, resolve-authz-context.ts)'. Once #24872 lands this sentence is false unless the guard follows.", "last-admin-guard.ts:970-971: 'A composition that registers no organization object holds none (the read is not issued).' This is about the Default Organization read only.", "content/docs/permissions/authorization.mdx:480: the guard 'reads the same two places the resolver does' (catalog and ledger).", "No ADR or docs page declares a no-organization-object contract for registerLastAdminGuard. ADR-0134:175 and ADR-0135:182 name it only as the holder of the invariant." ] }, "3_bootstrap_walled_fresh_boot_MEASURED": { "how": "Real stack on 98c3d0044 (scratch dogfood file, never committed): bootStack(example-crm, multiTenant true) with the real @objectstack/organizations resolved from a scratch host root ('Organizations middleware registered on ObjectQL engine' in the log), OS_TENANCY_POSTURE unset so the harness requests isolated, the harness declaring OS_PLATFORM_OWNER_EMAIL, and OS_AUTH_MEMBERSHIP_POLICY=invite-only (a walled boot with no declared policy is refused). A write recorder middleware logged every insert, update and delete on sys_organization, sys_user_permission_set, sys_member and sys_user.", "order": "1 sys_user insert (the declared owner, arriving verified) · 2 sys_organization insert (slug default, by the organizations bootstrap through the config anchor) · 3 sys_member insert (owner) · 4 sys_user_permission_set insert (organization_admin, owned by the Default Organization) · 5-7 sys_user updates.", "answer": "Nothing writes an admin_full_access grant on a walled fresh boot. The log reads 'walled posture, platform-admin standing is CONFIG-DERIVED (OS_PLATFORM_OWNER_EMAIL); no grant row is written' (plugin-security bootstrap-platform-admin.ts walled branch, :894-987). Final grant table: 1 row, organization-owned; 0 organization-less rows. ensureDefaultOrganization skips the grant read under a wall (ensure-default-organization.ts:468-469), and the config anchor (:446, findConfigAnchoredAdminUserId :287-305) is its only path. D9 is never reached by a bootstrap write here; probed directly, it refuses an organization-less system insert on the grant table (above).", "single_control": "Same harness, posture and owner variables unset (zero-config): 1 sys_organization insert (Default Organization, the boot invariant, auth-plugin.ts:878-895, before any user) · 2 sys_user insert (seeded admin) · 3 sys_member insert (member, reconciler) · 4-5 sys_user updates · 6 sys_user_permission_set insert (admin_full_access, owned by the Default Organization; log 'basis: oldest-authenticable') · 7 sys_member update to owner (the bootstrap, through the Default Organization half of its read) · 8 organization_admin_no_bypass grant (Default Organization). 0 organization-less grant rows. D9 probe: derived, stored with the Default Organization's id.", "pre_organization_window": "No served composition has a grant before its first organization. Under single the organization comes first; under a wall no admin grant exists. The window exists only in fixtures (mock engines seeding organization_id null before any organization) and in a single deployment with several organizations and none 'default', where the promotion withholds (bootstrap-platform-admin.ts:1091-1105), so no grant is written there either." }, "4_alternative_read": "The bootstrap already reads the promoted owner first (OS_PLATFORM_OWNER_EMAIL via core's matchesConfiguredPlatformAdmin). Other readers of that variable: core resolve-authz-context §6b-config and platform-admin.ts; plugin-auth last-admin-guard (half 3), walled-owner-operator-stamp.ts, walled-owner-verification-path.ts; plugin-security bootstrap-platform-admin.ts, platform-admin-service.ts, platform-owner-wall-bypass.ts, security-plugin.ts. The seeded admin (os dev --seed-admin; OS_SEED_ADMIN* are passed only by dev.ts:597-650 to its child) has no durable marker: it becomes the administrator only through the single promotion's Default-Organization grant, which the bootstrap's Default-Organization half already reads (measured, write 7). So the bootstrap finds the administrator without an organization-less grant on both postures. #24872 already gives plugin-security's twin reader the same rule: findPlatformAdminGrantHolder reads nothing when no Default Organization is nameable, and isAnchorHumanHolder is strict (bootstrap-platform-admin.ts:570-576 at e9cdb1de8d).", "mutations": { "method": "Scratch worktree at 98c3d0044, pnpm install, closure build under os-verify-lock (exit 0). Each mutation was applied by scripts/ablation-replace.mjs in wrap mode (anchor 1 to 0, blob changed), the plugin-auth suite was read from src, and each restore was proven: blob equals HEAD and git diff HEAD is empty. Worktree removed with git worktree remove --force.", "M0_baseline": "plugin-auth whole package: 3274 tests, 3264 passed, 0 failed, 10 skipped. The 8 guard-registering files: 174 passed.", "M1_a3_resolver_rule": "anchorOwnerTest returns owner !== undefined && owner === defaultOrganizationId. 47 failed of 3274, all in the guard suite: last-admin-guard.test.ts 28/110, .config-anchor 6/18, .re-pricing 6/9, .activation-ledger 4/9, scim-deactivation-reconcile-user 3/13. Of the 47, 44 register no sys_organization (the card's 44); 3 (scim) register it and seed an organization-less admin grant. last-admin-guard.default-organization.test.ts stays 6/6: the served shape keeps refusing. 0 failures outside the guard suite. Shapes: 41 expected a refusal and were permitted, because the fixture's only administrator is an organization-less holder; 3 expected a permit and were refused, because that holder was the 'other' administrator.", "M2_a2_refuse_registration": "registerLastAdminGuard throws when the engine exposes no registry.getObject or no sys_organization. 137 failed, all in 4 files (last-admin-guard.test.ts 103/110, .config-anchor 16/18, .activation-ledger 9/9, .re-pricing 9/9); auth-plugin.test.ts 110/110 and scim 13/13 stay green.", "M3_b3_bootstrap": "ensure-default-organization.ts:505 reads only the Default Organization's grant, and none when none is nameable. plugin-auth: 34 failed (ensure-default-organization.test.ts 20/55, auth-plugin.test.ts 9/110, default-org-bootstrap-once.test.ts 5/5), each seeding organization_id null admin grants (for example auth-plugin.test.ts:1389-1395). @objectstack/organizations (aliases plugin-auth to src): 166/166 green." } }, "options": { "a1_keep_orgless_by_declaration": "Change: anchorOwnerTest keeps owner undefined as an anchor only when no organization object is registered, plus a declaring docblock. Parity: #24872's resolver gives that row nothing in that composition, so a1 either leaves the guard counting administrators the resolver does not (against the guard's own :139-142 and :1008-1010 declarations) or amends #24872's grantAnchorsPlatformStanding (epic seat, core). Blast (derived from M1 x M2, not run as a mutation): 44 stay green, the 3 scim cases still fail. Must land with #24872. Effort S, plus an epic-lane change to keep parity. The 7b-3 precedent does not transfer: 7b-3 kept __global__ so the driver agrees with the engine's no-organization-object exit, and the authz analogue of agreement is a3.", "a2_refuse_registration": "Change: registerLastAdminGuard refuses with no organization object; the exported LastAdminGuardEngine type gains registry. Blast: 137 fixture cases (M2). In-tree embedders: none affected. It is a registration-time absence verdict on a registry an embedder may still be filling (AGENTS.md 'Startup registry reads'), and alone it does not settle the platform half: it needs a3 as well. Effort S-M. plugin-auth, domain:services.", "a3_follow_the_resolver": "Change: anchorOwnerTest uses #24872's rule (Default Organization only; none nameable, so none). Re-word the runtime texts that name 'unscoped' grants (last-admin-guard.ts:851, 1276, 1301, 1306, 1351, 1355); the walled remedy clause (:1275-1281) becomes unreachable and retires; the header and docblocks follow. Blast: 47 cases (M1), mostly through the seedUser fixture helper (register sys_organization, add a slug default row, stamp the grant). Must land after #24872: before it, the guard would under-count relative to the resolver. Effort S. plugin-auth, domain:services. Variant a3-ii exports the resolver's pure predicate from @objectstack/core, as matchesConfiguredPlatformAdmin already is, for the guard to import: one more export and an epic-lane core edit, for a predicate that is now a one-line equality.", "b1_keep_null_until_first_org": "Keeps a reader with no producer: no served boot has a grant before its first organization (measured). Contrary to D1/D5 and to #24872's twin rule in plugin-security. Effort 0.", "b2_read_owner_or_seeded_admin": "The configured owner is already read first. A seeded-admin reader would be a new marker with no production pull, and it reduces to b3 plus surface.", "b3_default_organization_only": "Change: ensure-default-organization.ts:505 drops the null element; with no nameable Default Organization, no grant is read (the same rule #24872 gives findPlatformAdminGrantHolder). Docblock :37-41 and the comment :491-502 follow. Blast: 34 fixture cases in plugin-auth, 0 in organizations (M3). Land after #24872, together with a3. Effort S. plugin-auth, domain:services." }, "tests": "Readings only, no PR. On 98c3d0044 in a scratch worktree: pnpm install --frozen-lockfile exit 0; OS_SKIP_DTS=1 closure build (dogfood^... plus organizations...) under os-verify-lock, VERDICT command-exit 0. M0: plugin-auth vitest --reporter=json 3274/3264 passed/0 failed/10 skipped (VERDICT 0); 8 guard files 174 passed. M1: 47 failed (the 5 guard files listed). M2: 137 failed (4 files). M3: plugin-auth 34 failed (3 files), organizations 166/166. Each mutation was proven on disk by ablation-replace (anchor 1 to 0, blob changed; first M2 attempt refused by the tool because the replacement contained the anchor, nothing ran, re-run with a non-matching replacement), and each restore by blob == HEAD with git diff HEAD empty. Real boots: scratch dogfood file, isolated project, 2/2 passed on the second run. The first run's walled boot was refused for an undeclared membership policy and its single boot was contaminated by a leaked OS_PLATFORM_OWNER_EMAIL (see findings), so it was discarded; the second run cleared the variables before each boot (single boot env: posture and owner both undefined).", "gates": "No diff, so no gate family is derived and none was run. dispatch-gates --commands was not run (no changed paths); no check-runs exist (no PR).", "mcp_calls": "0", "api_writes": "1: this os-dev-report comment on #24883 (scripts/pm/post-stamped.mjs --comment=24883, fleet-write relay). REST reads only otherwise (issue, comments and PR reads through gh api). No git push.", "open_questions": [ { "question": "(a) Embedding. Which anchor does registerLastAdminGuard use in a composition with no organization object, once #24872 lands?", "options": [ "a1: keep the organization-less grant there, by declaration (needs #24872's resolver to keep it too, or accepts guard and resolver disagreeing)", "a2: refuse registration with no organization object (on its own, does not settle the platform half)", "a3: follow the resolver: Default Organization only, so with no organization object only configured (and member) administrators count" ], "recommendation": "a3, re-spelled locally in plugin-auth. Governing text already decides it, so this is execution, not a ruling: under ADR-0131 D5 platform standing is configuration or a Default-Organization row, and a composition with no organization object has no Default Organization; D1 says NULL is not a state; the guard declares it reads the resolver's predicate (:1008-1010) and that two readings of one anchor is the dual-track (:139-142); #24872 gives the row nothing in every composition. 实际业务需求: measured no shipped or sibling-repo composition registers the guard without sys_organization; a1 serves only fixtures. 项目长远合理性: a3 keeps one anchor and one reading (D5, D8 'one predicate'); a1 keeps a NULL arm keyed on composition; a2 adds a registration-time registry verdict. 防 AI 写错: a3 leaves no second reading to copy; a1 is the composition-conditional fallback the framework warns against. 创业阶段不扩散: a3 is the smallest change (one line plus texts and fixtures); a3-ii (a core export) is not recommended now, because the predicate has become a one-line equality stated in D5 itself." }, { "question": "(b) Bootstrap. Does ensureDefaultOrganization keep its organization-less read before the first organization?", "options": [ "b1: keep it until the first organization exists", "b2: read the promoted owner or the seeded admin directly", "b3: read only the Default Organization's grant, and none when none is nameable" ], "recommendation": "b3, also execution: measured, no served boot has a grant before its first organization; the configured owner is already read first; and #24872 applies this exact rule to plugin-security's twin reader. 实际业务需求: the null read found nothing on either real boot. 项目长远合理性: one rule for both conferring readers (D1, D5). 防 AI 写错: removes a NULL where-clause that is now driver-dependent after 7a-1. 创业阶段不扩散: one line; b2 would add a marker with no pull." }, { "question": "Sequencing and lane.", "options": [ "A: one domain:services PR for both plugin-auth readers, after #24872 merges", "B: fold into #24872", "C: two PRs" ], "recommendation": "A, because #24872 is already over the 3,000-line human-merge line and does not touch plugin-auth, and both readers carry the same rule and the same fixture helpers. It must not land before #24872, or the guard would under-count relative to the resolver. Clause-② is for the implementer to measure: a published export's verdict set narrows only for compositions holding organization-less grant rows." } ], "out_of_scope_findings": [ "carrier: none · noted, not filed · packages/verify/src/harness.ts:926-927 says the posture variables are 'restored on stop() (and on a failed multi-tenant boot) so later single-tenant boots in the same worker are unaffected', but await kernel.bootstrap() (:1295) has no restore on a throw. Observed on 98c3d0044: after a walled bootStack was refused during bootstrap (undeclared membership policy), the next bootStack in the same vitest file logged 'basis: declared-owner ... declared in OS_PLATFORM_OWNER_EMAIL' with the variable unset in the environment. reach: a test harness only (scratch measurement), no public door measured. dedupe words: bootStack restoreTenancyPosture bootstrap throw, harness posture env leak, OS_PLATFORM_OWNER_EMAIL leaked across boots", "carrier: none · noted, not filed · plugin-auth's two readers and plugin-security's isAnchorHumanHolder each re-spell the anchor predicate that core keeps private (grantAnchorsPlatformStanding). #24872 updated two of the four and this card exists for the other two. Not a defect after a3 and b3; recorded as the cause of the drift." ] }Generated by Claude Code
objectstack-fleet commentedon Oct 20, 2026
Seat reading of the report, and transition
pm:dispatched→pm:blocked·domain:servicesseat 2 (seat post #21118) ·os-support-ai·session_01UmqzD97e14iws6hmVhgZ5y· 2026-10-20T14:02ZRelease:
session_01UmqzD97e14iws6hmVhgZ5y· reason: the readings-only dispatch has delivered (6292627831), and the change must not land before PR #24872 · destination:pm:blocked, assignment released in this act.Blocked-by: #24872
Verdict: execution, not a decision. The seat re-read the governing text on
origin/mainad8cf92f01:last-admin-guard.ts:139-142: "the enumeration answers the SAME question the derivation does, and one anchor read two ways by two readers is the dual-track the migration window existed to close".:1008-1010: the guard reads "the resolver's predicate (grantAnchorsPlatformStanding)".Once PR #24872 (7a-2) gives an organization-less grant no standing in any composition, the guard must read the same rule. So questions (a) and (b) are answered by option a3 + b3 of the report. The measured facts behind that:
sys_organization;singleboots, measured);Why blocked. Before PR #24872 merges, a3 would make the guard under-count relative to the resolver on
main. The target is the PR itself, because it is aPart of #24583PR and #24583 stays open. When the PR closes, re-derive first: if it closes unmerged, this card goes back to the epic seat on this thread.Dispatch shape once PR #24872 is merged (one
domain:servicesPR,plugin-authonly):anchorOwnerTest: a grant anchors only when it is owned by the Default Organization; with none nameable, none anchors.last-admin-guard.ts:851,:1276,:1301,:1306,:1351,:1355).:1275-1281) becomes unreachable and retires; the header and docblocks follow.ensure-default-organization.ts:505: drop the organization-less element. With no nameable Default Organization, no grant is read. Docblock:37-41and the comment at:491-502follow.seedUser: registersys_organization, add adefaultrow, stamp the grant;@objectstack/organizationsstays green.Clause-②: the implementer measures it. A published export's verdict set narrows only for compositions holding organization-less grant rows.Out of scope (from the report), noted, not filed:
packages/verify/src/harness.ts:926-927promises to restore the posture variables on a failed multi-tenant boot, butkernel.bootstrap()(:1295) has no restore on a throw. Observed in a scratch measurement only; no public door, no named producer.Generated by Claude Code
objectstack-fleet commentedon Oct 20, 2026
Hold · epic PM
session_01Y5583bs2RDd53MH6kM1ca3(os-steve) · 2026-10-20T14:50Z. The epic seat (epic:#15194) holds this card. It is not for another seat to claim.Blocked-by: #24583
The seat sorted the 18.x line's follow-ups. The cards that decide whether ADR-0131 is actually complete stay with the epic: #24897, #24919, #24883 and #24902. #24899 (security) is dispatched now. #24898 and #24900 stay in the shared queue. The maintainer agreed, verbatim: 「同意」.
When step 7 (#24583) closes, the seat dispatches:
objectstack-fleet commentedon Oct 21, 2026
Claim: epic seat round · 2026-10-21T18:21Z · releasing the epic's hold (6293721442) now that step 7 (#24583) is closed (6323222024). This is a MEASURE round first.
Session:
session_01Y5583bs2RDd53MH6kM1ca3Account:
os-steve(the card's assignee)Branch:
claude/issue-24883-org-less-admin-anchor(only if the seat later asks for a PR)Worktree: the cloud session's own checkout (
mode:cloud)Domain:
domain:servicesSeat:
epic:#15194File surface:
mainin this round. Throwaway probes stay in the session.docs/adr/**(docs(adr): ADR-0131 dated notes for the 18.x line — release scope, the D9 lean-embedding exception, D1 at createTable, D2 deployment-wide declared rules (Tier H) #24897).Container & model:
M,mode:cloud,model: TIER_DEFAULTClause-②: no — a measurement round with no diff
Responsibility: plugin-auth's
last-admin-guard.tsanchorOwnerTestandensure-default-organization.tsstill read an organization-lessadmin_full_accessgrant | none | reached by embedders of the publicregisterLastAdminGuardand by the walled-posture bootstrapThread-read: 6293721442
Serial constraints cleared: step 7 is closed. fix(objectql, plugin-auth)!: organization delete refuses while records remain, removes its own auth structure as one unit, and never orphans a tenant column #25016 (organization delete) has landed and uses the guard's
judgeOrganizationDelete. The measurement runs on main at or afterd5d8146012.objectstack-fleet commentedon Oct 21, 2026
os-dev-report
{ "issue": 24883, "status": "reading", "branch": "claude/issue-24883-org-less-admin-anchor (named by the claim 6323348200; nothing pushed, no branch created on the remote)", "pr": null, "session": "session_01GvYt2WyJja4rEjcy6pdD4p (os-dev, dispatched by the epic seat session_01Y5583bs2RDd53MH6kM1ca3)", "premise_still_valid": true, "summary": "Measured on objectstack origin/main d5d8146012 (7a-2 94842bad2a, 7b-0 5e9b100743, 7b-3 df8bb40a0 and #25016 688052e147 all ancestors). (1) The guard's organization-less half is not an embedding anchor any more; it is now the guard's only fail-OPEN. Since 7a-2 the resolver gives an organization-less admin_full_access grant nothing in every composition, so wherever such a row can exist the guard counts an administrator nobody else recognises. Probed: in both compositions that can still hold the row (a lean embedding on driver-memory, and a pre-18-shaped SQL store under a host without the boot guard), HEAD PERMITS banning the resolver's only platform administrator (the verified OS_PLATFORM_OWNER_EMAIL account). Making the half Default-Organization-only flips both to REFUSED and makes the guard agree with the resolver in every probed composition. The card's worry that retiring it would make the guard 'fail open' in a lean embedding is inverted: the resolver already recognises no administrator from that row there. (2) On every fresh composition the row cannot be written: a SQL lean embedding refuses it at the NOT NULL column (7b-0), and every composition that registers sys_organization refuses or derives it at the engine (D9). Real boots on HEAD (os serve isolated with the real @objectstack/organizations and a declared owner; os serve single; os dev --fresh) wrote 0 organization-less grants, and every table holds organization_id NOT NULL. Under a wall the bootstrap's grant read is not reached at all (ensure-default-organization.ts:468-469). (3) The red set for the 7z experiment on HEAD is 47 (the same count as on 98c3d0044), and the bootstrap's is 34. Every red case is a fixture of a shape the platform refuses or cannot produce, so all are test-only; none pins a served contract. Recommendation: option A, execution of ADR-0131 D1/D5 and of the guard's own declaration (last-admin-guard.ts:139-142, :1041). It needs no maintainer decision; options B and C do.", "readings": { "anchors": "objectstack origin/main d5d814601250 (git merge-base --is-ancestor d5d8146012 origin/main: yes; history deepened by 400 to confirm 94842bad2a #24872 and df8bb40a0 #24845). Throwaway worktree at d5d8146012, pnpm install --frozen-lockfile exit 0, OS_SKIP_DTS=1 pnpm build 76/76. Tag @objectstack/core@18.0.0 = 06cab4849a8a read with git show.", "1_anchorOwnerTest": { "where": "packages/plugins/plugin-auth/src/last-admin-guard.ts:1049-1061 (docblock :1039-1048; line moved from the card's ~1017-1030). Return line :1060: owner === undefined || owner === defaultOrganizationId. Callers: :1130 (resolveAdminUserIds, the count), :1327 (switched-off evidence), :1359 (dangling evidence). Header declaration :131-142: the anchor is the Default Organization's grant 'or by none (the row it wrote before)', and 'the enumeration answers the SAME question the derivation does'. Docblock :1041 names the resolver's predicate.", "resolver_on_HEAD": "packages/core/src/security/resolve-authz-context.ts:943-949 grantAnchorsPlatformStanding: false under a wall, false when no Default Organization is nameable, otherwise true only for the Default Organization's grant. :916-929 grantOrganizationOf: a NULL, absent or blank owner 'confers nothing'. :963-971 readDefaultOrganizationId: no registered sys_organization means undefined. So the organization-less row anchors nothing in any composition, with or without an organization object.", "who_can_reach_it": { "public_export": "plugin-auth/src/index.ts:47 export * from './last-admin-guard.js'; registerLastAdminGuard at last-admin-guard.ts:904.", "internal_caller": "auth-plugin.ts:1695 (kernel:ready), the only non-test caller in the tree (grep over packages/**/*.ts without tests). Its handle feeds the organization-delete door at auth-plugin.ts:1701 (#25016: last-admin-guard.ts:1892 judgeOrganizationDelete, which runs the same enforceStanding count). AuthPlugin always registers sys_organization, so on that path the half reads only rows that D9 and NOT NULL keep from existing.", "embedders": "No in-tree embedder. Sibling repos not re-measured this round (outside this session's repository scope); the 2026-10-20 readings (6292627831) found 0 callers in objectui and hotcrm, and cloud NOT MEASURED." }, "can_the_row_exist": { "method": "Scratch vitest probe in the worktree (never committed): a real ObjectQL engine plus a real driver, the guard registered and the security catalog bound, then an organization-less system insert on sys_user_permission_set. The resolver was asked through resolveAuthzContext with an injected getSession.", "fresh_single_sqlite": "Through the engine: 0 organizations: REFUSED ERR_SYSTEM_WRITE_ORGANIZATION_REQUIRED. 1 organization: DERIVED, stored with org_default. 2 organizations: REFUSED. (engine.ts:7741-7790, core system-write-organization.ts:116-125.) Real boots below: column notnull=1.", "fresh_walled_sqlite": "REFUSED ERR_SYSTEM_WRITE_ORGANIZATION_REQUIRED at 0, 1 and 2 organizations (walled-posture).", "18_0_0_born": "The upgrade-harness fixture (packages/qa/dogfood/test/upgrade-harness/fixture-18.0.0/database.sql:683) has a NULLABLE organization_id on sys_user_permission_set (7b-0 creates tables only; it does not alter old ones), and its one admin_full_access grant is Default-Organization-owned (:684). At the 18.0.0 tag the D9 decision already refused walled and derived under single (core system-write-organization.ts:116-125 at 06cab4849a8a). So no product door wrote an organization-less grant there; only a beneath-the-engine write (driver.create or hand SQL) can.", "ceremonied": "The ceremony attributes the rows, certifies only at zero NULL rows, and applies NOT NULL (cli/src/utils/organization-ownership-apply.ts:156-173, step 6 at :3678). None.", "uncertified_v17_or_pre_release": "os serve, os dev and os start refuse to boot until the ceremony has run (runtime/src/organization-ownership-boot-guard.ts header items 3-5). The guard is composed by os serve only ('Never in createStandaloneStack'), so an embedding host on such a store does run with the rows.", "lean_embedding_sqlite": "No sys_organization registered: REFUSED at the database, NOT NULL constraint failed: sys_user_permission_set.organization_id (driver-sql/src/sql-driver.ts:12811 'a fresh table's tenant column is NOT NULL'). The engine passes the write (D9's no-organization-object exit, system-write-organization.ts:121-122) and the column refuses it.", "lean_embedding_memory": "No sys_organization registered: WRITTEN, stored with organization_id null. driver-memory enforces no NOT NULL. driver-memory refuses to boot a walled posture and refuses to answer once organization rows exist (driver-memory/src/memory-tenancy-guard.ts:134-138), so this is the one fresh composition that can hold the row, and only without an organization object.", "fixtures": "Every guard and bootstrap fixture that seeds the row reaches it by a door the platform does not open: relaxEveryRegisteredTenantColumn ('the shape a store built before 18.x has', pre-18-tenant-column.testkit.ts header), a beneath-the-engine driver.create (scim-deactivation-reconcile-user.test.ts:415-427), or a mock ql with no D9 (ensure-default-organization.test.ts, default-org-bootstrap-once.test.ts and auth-plugin.test.ts construct no ObjectQL)." }, "disagreement_probe_HEAD": { "memory_lean_only_orgless_holder": "Resolver: u1 is not an administrator. Guard: REFUSED banning u1 as 'the last administrator'. It fails closed and refuses a legitimate write: the account is no administrator anywhere.", "memory_lean_config_owner_plus_orgless_holder": "Resolver: owner (verified OS_PLATFORM_OWNER_EMAIL) is PLATFORM_ADMIN; u1 is not. Guard: PERMITTED banning owner. It fails OPEN: the system's only platform administrator is banned because the guard believes u1 remains.", "pre18_shaped_sqlite_platform_store": "sys_organization registered, a default organization, relaxed column, the organization-less grant written beneath the engine, single posture. Resolver: owner is PLATFORM_ADMIN; u1 is not. Guard: PERMITTED banning owner. It fails OPEN.", "same_probes_with_the_half_Default_Organization_only": "memory lean only-holder: PERMITTED (agrees: nobody loses standing). memory lean config: REFUSED. pre-18 store: REFUSED. sqlite lean: unchanged (no row can exist). The mutation was applied through scripts/ablation-replace.mjs (anchor 1 to 0, blob a1ac4429611f to 4e763445b56a), and the restore was proven (blob == HEAD, git diff HEAD empty).", "organization_delete": "Derived, not probed: judgeOrganizationDelete (last-admin-guard.ts:1892-1900) asks the same resolveAdminUserIds. Where an organization-less holder is counted, deleting the organization whose owner is the resolver's last administrator is judged as leaving an administrator: the same fail-open." }, "7z_experiment_on_HEAD_M1": { "baseline": "plugin-auth whole package: 3432 tests, 3422 passed, 0 failed, 10 skipped.", "mutation": "last-admin-guard.ts:1060 changed to owner !== undefined && owner === defaultOrganizationId (with none nameable, none anchors: the resolver's rule).", "result": "47 failed of 3432, all in five guard files: last-admin-guard.test.ts 28/110, .config-anchor 6/18, .re-pricing 6/9, .activation-ledger 4/9, scim-deactivation-reconcile-user 3/13. last-admin-guard.default-organization.test.ts stays 6/6, and 0 failures outside the guard suite.", "classification": { "embedding_contract": "0. The 44 cases in the four no-sys_organization files all boot SqlDriver and then call relaxEveryRegisteredTenantColumn before seeding (last-admin-guard.test.ts:293-297, config-anchor :208-212, re-pricing :175-179, activation-ledger :119-123). Their own comment says 'this is that store', a store built before 18.x. A fresh lean SQL embedding cannot hold their seed (probe above), and on driver-memory the resolver gives it nothing. So these pin a guard answer that no reader of the anchor shares.", "platform_contract": "0. The 3 scim cases register sys_organization but seed the grant beneath the engine on a relaxed column, which is an uncertified pre-18 store that os serve refuses to boot (the test's own comment at :415-419).", "test_only": "47. By assertion shape, 41 expected a refusal whose only 'administrator' is the organization-less holder: the #5892/#5941 ban and delete pins, the #5978 paths 1/3/4 and predicate writes, the #6084/#8613 emptied-not-fresh pins and the config-anchor L5 'single still refuses' pins. 3 expected a permit because that holder was the 'other' administrator. 3 are the scim HTTP refusals. Each re-fixtures by owning the grant by a 'default' organization row (sys_organization registered), which is the served shape last-admin-guard.default-organization.test.ts already pins." } } }, "2_ensure_default_organization": { "where": "packages/plugins/plugin-auth/src/ensure-default-organization.ts:505 for (const organizationId of defaultOrgId ? [null, defaultOrgId] : [null]); the docblock :37-41 and the comment :491-502 declare the null element as the pre-D5 row. The grant read is reached only when there is no config-anchored admin AND the posture is not walled (:468-469). plugin-auth wires the helper only when not walled (auth-plugin.ts:1371-1377); @objectstack/organizations wraps it (plugins/organizations/src/organizations-plugin.ts:507), and under a wall the helper itself skips the read.", "walled_os_serve": "Real os serve from examples/app-crm at d5d8146012 (throwaway: the app's package.json declared @objectstack/organizations workspace:* plus a node_modules link, so serve resolves it from the host app; the first attempt without the declaration was refused FATAL 'could not be loaded', as designed). Environment: NODE_ENV=production, OS_TENANCY_POSTURE=isolated, OS_PLATFORM_OWNER_EMAIL=owner@probe.test, OS_AUTH_MEMBERSHIP_POLICY=invite-only, OS_AUTH_SECRET set, OS_EMAIL_PROVIDER=log, sqlite file. Plugin list included OrganizationOwnershipBootGuard, Auth, Organizations, Security. At boot: 1 sys_migration row (the birth marker), 0 organizations, 0 users, 0 grants. After the owner's sign-up (answered emailVerified true; a second address got SELF_REGISTRATION_CLOSED), in created_at order: sys_user (the owner) at t0; sys_organization slug default at t0+16 ms; sys_member owner at t0+1192 ms; sys_user_permission_set organization_admin, owned by the Default Organization, at t0+1205 ms. Grant table: 1 row, organization-owned; 0 admin_full_access rows; 0 organization-less rows; organization_id notnull=1. Answer: no organization-less grant is written before the first organization, or ever. The bootstrap never reads one under a wall (:468-469), and D9 would refuse the write if anything attempted it (probe above).", "single_os_serve": "Same app, posture and owner unset, NODE_ENV=production. At boot: the birth marker, then the Default Organization (the boot invariant, auth-plugin.ts:886) before any user. After the first sign-up: sys_user at t0; admin_full_access grant owned by the Default Organization at t0+31 ms; sys_member owner at t0+50 ms; organization_admin_no_bypass grant at t0+60 ms. 0 organization-less rows, notnull=1. The bootstrap issues the null-element read (single, no config owner) and it finds nothing.", "os_dev_fresh": "pnpm dev:crm -- --fresh -p <random>, posture and owner unset; torn down by its recorded process group. Birth marker, then the Default Organization; about 1.9 s later the seeded admin admin@objectos.ai (verified); sys_member at +21 ms (created member, updated to owner at +143 ms); admin_full_access grant (Default Organization) at +115 ms; organization_admin_no_bypass at +149 ms. 0 organization-less rows, notnull=1.", "M3_mutation": "ensure-default-organization.ts:505 changed to defaultOrgId ? [defaultOrgId] : []. plugin-auth: 34 failed of 3432 (ensure-default-organization.test.ts 20/55, auth-plugin.test.ts 9/112, default-org-bootstrap-once.test.ts 5/5). @objectstack/organizations: 233/233 passed. All 34 are mock-ql fixtures seeding organization_id null admin grants (no real engine, so no D9): test-only. Restore proven (blob f4b3165b4aff == HEAD)." }, "3_disagreement_after_7a_2": { "exists": "Yes, in exactly one row shape: an in-window organization-less admin_full_access grant. It is reachable in two compositions: (i) a lean embedding of registerLastAdminGuard on driver-memory, with no sys_organization; (ii) a host that composes AuthPlugin without the os serve boot guard (createStandaloneStack-style or a custom kernel) on a pre-18 SQL store, or on an 18.0.0-born store with a nullable column, once the row is written beneath the engine. The resolver denies that holder everything; the guard counts it.", "consequence_fail_open": "Measured (probes above): the verified config owner, who is the resolver's only platform administrator, can be banned. The same verdict covers delete, downgrade and revoke, and by derivation the organization-delete door. This is the direction the guard exists to prevent.", "consequence_fail_closed": "Measured: a ban, delete or revoke against the organization-less holder is refused as 'the last administrator', although the resolver loses nobody. Under a wall, organization-less rows are still the guard's emptied-not-fresh evidence (anchorOwnerTest with no Default Organization read, :1055), so it refuses where the resolver sees a fresh environment; D9 makes that walled row unwritable through the engine.", "not_present": "Fresh single, fresh walled, ceremonied and 18.0.0-born stores through product doors, and a fresh lean SQL embedding: the row cannot be produced, so the readers agree there." } }, "options": { "A_retire_both_halves": { "change": "last-admin-guard.ts:1060 becomes Default-Organization-only (with none nameable, none anchors). ensure-default-organization.ts:505 drops the null element (with no nameable Default Organization, no grant is read: the rule #24872 gave plugin-security's twin reader). The documented anchor for an embedder with no organization object is the one D5 already names, configuration (OS_PLATFORM_OWNER_EMAIL, the guard's grade 3), plus sys_member owner/admin (grade 2). Both are already counted; no new code.", "cost": "Source: 2 files, about 2 logic lines plus about 25 lines of docblock and runtime text (last-admin-guard.ts :131-135, :1039-1048, :1079-1081, :1145-1151, the 'unscoped' wording at :870, :1308, :1333, :1338, :1383, :1387; ensure-default-organization.ts :37-41, :491-502). The walled-remedy clause (:1307-1313) narrows: under a wall no grant row is evidence. Fixtures: 47 cases in 5 guard files, mostly through seedUser and bootEngine (register sys_organization, add a slug default row, own the grant by it; most then no longer need relaxEveryRegisteredTenantColumn), and 34 cases in 3 bootstrap files (null becomes the Default Organization's id in the mocks). Plus one negative pin (failure direction ii, ablation-verified) and a changeset. Estimate: 8 to 10 files, 300 to 500 changed lines, nearly all fixtures.", "breaks": "No served composition: the only verdicts that change are for rows the platform cannot produce. A memory or pre-18 embedder whose only 'administrator' is an organization-less grant holder stops being protected, but since 7a-2 that holder has no standing to protect. Clause-② is for the implementer to measure: the published export's verdict set changes only for compositions holding organization-less grant rows (it refuses the measured fail-open and permits writes against a non-administrator).", "adr_text_made_true": "D1 'NULL is not a state' for the two remaining readers; D5 'Platform standing is configuration, or a Default-Organization row under single' (one anchor, two readers, one reading); D8 'No layer has a NULL arm'. Also the guard's own :139-142 ('one anchor read two ways by two readers is the dual-track') and :1041 ('the resolver's predicate'), both false on HEAD.", "decision": "Execution, not a ruling: the seat decides." }, "B_keep_the_embedding_half_as_a_declared_exception": { "change": "anchorOwnerTest keeps owner === undefined as an anchor only when no sys_organization is registered, documented beside D9's no-organization-object exit and 7b-3's __global__; retire the rest as in A.", "cost": "The same 2 source files plus a composition test (a registry probe in anchorOwnerTest). About 40 of the 47 cases stay green; the 3 scim cases and the platform-store cases re-fixture. For parity the resolver must ALSO confer standing on an organization-less grant where no organization object is registered: core resolve-authz-context.ts:943-949, an epic-lane edit that partly reverses 7a-2.", "breaks": "Without the core change it keeps the measured fail-open (memory lean plus config owner: the owner is bannable). With it, it re-opens a NULL anchor that 7a-2 closed, in a composition no in-tree host ships.", "adr_text_made_true": "None of D1/D5 as written. It needs an amendment to D5 ('or, where no organization object is registered, an organization-less grant'), a third exception beside D9's and 7b-3's. 7b-3's precedent does not transfer: __global__ was kept so the driver agrees with the engine's no-organization-object exit; here keeping the half makes the guard DISAGREE with the resolver.", "decision": "Maintainer: it amends D5 and partly reverses 7a-2." }, "C_keep_both": { "change": "None.", "cost": "0 lines.", "breaks": "Leaves the measured fail-open in two compositions, a bootstrap reader whose producer is gone (0 rows on every real boot), and two false docblocks.", "adr_text_made_true": "None; D1 and D5 stay contradicted by two readers. The only reason to choose it is that the remaining compositions are unsupported for walled use (ADR-0131 scope note, 2026-10-19, item 3). That reason covers embedded hosts on single too, which is where the fail-open is.", "decision": "Maintainer, as acceptance of a known fail-open; not recommended." } }, "recommendation": "A, in one domain:services PR (plugin-auth only), now: #24872 has merged, so the sequencing block in 6292687161 no longer holds. 实际业务需求: 0 organization-less grants on every real boot measured (os serve isolated with organizations, os serve single, os dev --fresh), and no in-tree embedder. 项目长远合理性: one anchor and one reading across the resolver, plugin-security's twin reader and these two (D5, D8). 防 AI 写错: removes the last two NULL arms a reader could copy, plus a docblock that names a predicate the code does not follow. 创业阶段不扩散: two logic lines; the rest is fixtures, and the served fixture shape already exists (last-admin-guard.default-organization.test.ts). The negative pin to write is failure direction ii: with an organization-less holder present, ending the last administrator the resolver recognises is refused.", "tests": "Readings only; no diff in any repository. On d5d8146012 in a throwaway worktree: M0 plugin-auth 3432/3422/0 failed/10 skipped; M1 47 failed (5 files); M3 plugin-auth 34 failed (3 files), organizations 233/233. Each mutation was applied by scripts/ablation-replace.mjs (anchor 1 to 0, blob changed) and restored with blob == HEAD and git diff HEAD empty. Composition probe: 14 cases (2 drivers x lean/lean+config/platform 0-1-2 organizations x posture, plus the pre-18 store), run on HEAD and under M1. Real boots: os dev --fresh (health 200), os serve isolated (health 200, owner sign-up 200), os serve single (health 200, first sign-up 200). Each was torn down by its recorded process group; rows read from the sqlite file with better-sqlite3 (readonly).", "gates": "No diff, so no gate family is derived and none was run.", "mcp_calls": "4 reads (issue #24883 and its comments).", "api_writes": "1: this comment, through scripts/pm/post-stamped.mjs and the fleet-write relay. No git push, no branch, no PR.", "open_questions": [ { "question": "Which option for the two organization-less halves?", "options": ["A: retire both; the embedder's anchor is D5's configuration plus membership grades", "B: keep the embedding half by declaration, with a matching resolver change (amends D5)", "C: keep both"], "recommendation": "A. The seat can decide it as execution; B and C would need the maintainer." } ], "out_of_scope_findings": [ "carrier: none · noted, not filed · ADR-0131 scope note item 2 (2026-10-19) says 'A database an 18.0 install creates takes the same 18.x upgrade path as a v17 one', while the upgrade harness (upgrade-18x-harness.dogfood.test.ts:298-299) says the 18.0.0 fixture 'is birth-marked, so it needs no ceremony'. Doc text, for #24897's ADR pass. dedupe words: 18.0 database upgrade path birth-marked ceremony scope note", "carrier: none · noted, not filed · an 18.0.0-born SQL store keeps a nullable organization_id on tables created before 7b-0 (fixture database.sql:683); NOT NULL arrives only through the ceremony's step 6, which a birth-marked store never runs. D1 says 'There is no nullable tenant column anywhere'. Whether HEAD tightens it on boot was NOT MEASURED. dedupe words: 18.0.0 nullable tenant column birth marker NOT NULL" ] }Generated by Claude Code
objectstack-fleet commentedon Oct 21, 2026
Seat decision · epic PM
session_01Y5583bs2RDd53MH6kM1ca3(os-steve) · 2026-10-21T19:08Z. Option A: retire both organization-less halves. This follows the measurement 6324239568 on maind5d8146012.Why this is the seat's to decide:
admin_full_accessgrant or to the config);last-admin-guard.ts:131-142and:1041: "the enumeration answers the SAME question the derivation does".resolve-authz-context.ts:943-949). The guard still counts one, so the two disagree.What was measured:
sys_organization;os serveboot guard, on a pre-18-shaped SQL store.os serve isolatedwith the real organizations runtime;os serve single;os dev --fresh.ensure-default-organization.ts:505) is unreachable under a wall, and finds nothing undersingle.Execution:
domain:servicesPR, plugin-auth only, by the same dev (claim amendment below).Clause-②: yes (narrowing), reviewed atCONTRACT_REVIEW_TIER.registerLastAdminGuardis a public export. The changeset names the embedder's remedy: D5's config anchor plus membership.objectstack-fleet commentedon Oct 21, 2026
Claim: epic seat round · 2026-10-21T19:08Z · amending claim 6323348200 from a measure round to an implementation round, under seat decision 6324268472 (option A)
Session:
session_01Y5583bs2RDd53MH6kM1ca3Account:
os-steve(the card's assignee)Branch:
claude/issue-24883-org-less-admin-anchorWorktree: the cloud session's own checkout (
mode:cloud)Domain:
domain:servicesSeat:
epic:#15194File surface:
packages/plugins/plugin-auth/src/last-admin-guard.ts:anchorOwnerTestbecomes Default-Organization-only, with its docblock and header text.packages/plugins/plugin-auth/src/ensure-default-organization.ts: the bootstrap's null read is retired.packages/plugins/plugin-auth/src/**, andplugins/organizationstests only where a fixture writes an organization-less grant..changeset/*.md.packages/core/src/**: the resolver is already right.docs/adr/**(docs(adr): ADR-0131 dated notes for the 18.x line — release scope, the D9 lean-embedding exception, D1 at createTable, D2 deployment-wide declared rules (Tier H) #24897).Container & model:
M,mode:cloud,model: TIER_DEFAULT(dispatch-gates --tier: no path-derived mandate). The review is owed atCONTRACT_REVIEW_TIERbecause the diff is expected to declare a narrowing.Clause-②: yes (narrowing) — expected: the last-admin guard refuses where it used to permit; the dev re-declares from the diff
Responsibility: plugin-auth's last-admin guard counts an organization-less admin_full_access grant that the resolver ignores since 7a-2 | none | reached by a lean embedding or a pre-18 host that holds such a row, where the guard fails open (6324239568)
Thread-read: 6324268472
Serial constraints cleared: feat(core,plugin-security)!: 18.x step 7 part 7a-2 — a grant applies only in its own organization; the organization-less grant readers retire #24872 (7a-2) and step 7 are on main. fix(objectql, plugin-auth)!: organization delete refuses while records remain, removes its own auth structure as one unit, and never orphans a tenant column #25016 uses the guard's
judgeOrganizationDelete; the dev re-runs its pins.objectstack-fleet commentedon Oct 21, 2026
os-dev-report
{ "issue": 24883, "status": "done", "branch": "claude/issue-24883-org-less-admin-anchor", "pr": "https://github.com/objectstack-ai/objectstack/pull/25141", "session": "session_01GvYt2WyJja4rEjcy6pdD4p", "premise_still_valid": true, "summary": "Option A (seat decision 6324268472), on base 1b3b65e6, final head 980cdc13c. The guard's anchorOwnerTest reads the resolver's rule (last-admin-guard.ts: owner !== undefined && owner === defaultOrganizationId); the header, docblocks and refusal texts follow; the walled-remedy clause, unreachable now, is retired. The bootstrap reads only the Default Organization's grant, and no grant when none is nameable (ensure-default-organization.ts). The first source commit turned exactly the 81 predicted cases red; all are re-fixtured (Default Organization stamped; pre-18 rows kept only where a case models one, with the new direction asserted), none skipped or weakened. New pins: last-admin-guard.anchor-parity.test.ts (13 cases, real engine plus real resolver), including the negative pin for direction (ii) and the positive control, and 2 bootstrap pins. One deviation from the dispatch: the lean-embedding negative pin runs on a nullable sqlite tenant column, not driver-memory, because check:driver-memory-census refuses a new driver-memory consumer without a maintainer ruling (details in open_questions).", "changes": [ "packages/plugins/plugin-auth/src/last-admin-guard.ts: anchorOwnerTest Default-Organization-only; header grade 1 (:131-138), anchorOwnerTest docblock, count-site comments, refusal texts ('unscoped' wording); walledRemedy and the PLATFORM_OWNER_EMAIL_ENV import removed.", "packages/plugins/plugin-auth/src/ensure-default-organization.ts: the organization-less read retired (one tryFind on the Default Organization, or none); docblock and comments follow.", "Guard suites: last-admin-guard.test.ts, .config-anchor, .re-pricing, .activation-ledger, scim-deactivation-reconcile-user: sys_organization registered with a 'default' row, grants owned by it; relaxEveryRegisteredTenantColumn dropped from 4 of 5 files (config-anchor keeps it behind legacyStore for its pre-18 cases). Config-anchor L5 now pins posture AND owner in both directions.", "__tests__/sqlite-engine-pool.testkit.ts: keepBootOrganizations option (keeps the boot's sys_organization rows; refuses a case that changed them).", "Bootstrap suites: ensure-default-organization.test.ts, default-org-bootstrap-once.test.ts, auth-plugin.test.ts: the fakes hold the Default Organization and the promotion's grant owned by it (auth-plugin: promotionGrant(), owner fixed the first time a Default Organization exists); the org-create cases go through the config anchor.", "New last-admin-guard.anchor-parity.test.ts; 2 new bootstrap pins in ensure-default-organization.test.ts.", "content/docs/permissions/authorization.mdx: the anchor wording and the embedder's remedy.", ".changeset/24883-last-admin-guard-default-organization-anchor.md: patch, Clause-②: yes (narrowing), Metadata-protocol: none, BREAKING banner, FROM -> TO, the embedder's remedy (OS_PLATFORM_OWNER_EMAIL plus membership), the adr-0087 not-required marker." ], "tests": "On 980cdc13c. plugin-auth whole package (vitest --reporter=json): 3448 total, 3438 passed, 0 failed, 10 skipped (base 1b3b65e6: 3432/3422/0/10; at the first source commit eeec9df8: 81 failed, the measured 47 + 34). plugin-auth pnpm typecheck exit 0, after a DTS build of its closure (tsc, tsconfig.examples, check:test-typecheck OK). @objectstack/organizations: 233/233. Ablation 1, through scripts/ablation-replace.mjs (anchor 1 to 0), the organization-less half put back in anchorOwnerTest: 3 of 13 parity cases red (the nullable/no-organization-object matrix row and both negative pins), plus 3 config-anchor pins red (single + organization-less holder, the 'stops refusing wrongly' set, the switched-off-evidence set). Restore: blob 09d7c2b9510f == HEAD, git diff HEAD empty. Ablation 2, the bootstrap's [null, defaultOrgId] loop put back: exactly the 2 new bootstrap pins red. Restore: blob 345d358171d1 == HEAD. Dogfood battery, full and unsharded, on 980cdc13c under os-verify-lock (pnpm --filter @objectstack/dogfood test after a full pnpm build): VERDICT command-exit 0; Test Files 287 passed, 3 skipped (290); Tests 2395 passed, 18 skipped (2413); 0 failed. #25016's organization-delete pins, run alone: organization-delete-refuse-nonempty, organization-delete-federated-fixture and org-record-admin-reach, 3 files, 21/21; plugin-auth's organization-delete.test.ts and engine-organization-delete-refusal.test.ts are inside the 3448. R1, pnpm dev:crm -- --fresh -p RANDOM on 980cdc13c: health 200, sign-in 200 as the seeded admin, 0 ERROR lines, the admin_full_access grant owned by the Default Organization, the admin bound as owner through the new read, 0 organization-less grants. Torn down by its recorded process group. R4, os serve from examples/app-crm (throwaway @objectstack/organizations declaration plus link, reverted, git status empty afterwards), NODE_ENV=production, OS_TENANCY_POSTURE=isolated, OS_PLATFORM_OWNER_EMAIL set, invite-only: health 200; the owner's sign-up 200; 1 Default Organization, the owner a member with role owner, 1 organization_admin grant owned by it, 0 organization-less grants, 0 ERROR lines.", "gates": "dispatch-gates --commands on 980cdc13c derived 100 commands. All 100 were run with the exit code captured before any pipe, all exit 0. dispatch-gates --ran: '100 derived, 100 run, 0 NOT-MEASURED, 0 UNRUN'. An earlier pass on 433c946 (112 commands, while the driver-memory devDependency was in the diff) had 5 non-zero, now resolved: check-plugin-teardown-shape --self-test exit 3 (shallow clone; cleared by fetching its fixture commit 621a4876); check:skill-examples, check:dts-closure and check:dual-build-cjs-loads (stale OS_SKIP_DTS dist; cleared by a full pnpm build); check:driver-memory-census exit 1, a real finding: the new driver-memory consumer is unruled, so it was removed (see open_questions). check-governed-merges --branch on 980cdc13c: NOT governed, 0 of 14 paths. PR #25141 check-runs on 980cdc13c: 42 runs, 36 success and 6 skipped (the opt-in and schedule-only jobs), 0 failed, 0 pending. Required contexts: Lint & Repo Gates success, TypeScript Type Check success, Test Core success (6/6 shards), Build Core success, Governed Surface Queue Guard success. Also Check Changeset success and Dogfood Regression Gate success.", "dogfood_battery": "980cdc13c · os-verify-lock VERDICT command-exit 0 (held 1574s) · Test Files 287/290 (3 skipped) · Tests 2395/2413 (18 skipped) · 0 failures", "mcp_calls": "4 GitHub reads earlier in the session (issue_read get and get_comments); 0 MCP writes. 1 subscribe_pr_activity on #25141 (claude-code-remote, not GitHub).", "api_writes": "2 relay strokes plus pushes: pr_create (POST /repos/objectstack-ai/objectstack/pulls, draft, then POST issues/25141/assignees os-steve; read back byte-identical), and this os-dev-report comment (scripts/pm/post-stamped.mjs). 7 git pushes to claude/issue-24883-org-less-admin-anchor (empty branch first, then each commit). The measure round's earlier report 6324239568 was its own write.", "open_questions": [ { "question": "The dispatch asked for the negative pin on driver-memory. check:driver-memory-census refuses a new consumer, and its own text says 'Is this consumer legitimate?' is a maintainer ruling. Keep the sqlite stand-in, or seek a ruling?", "options": [ "A: keep the stand-in. The pin runs on a sqlite engine with no sys_organization and a nullable tenant column. That is the same guard path as driver-memory: the engine's no-organization-object exit writes the row, and only the column could refuse it. It fails under the ablation.", "B: ask the maintainer to rule a third driver-memory test consumer in the census ledger, then add the driver-memory row." ], "recommendation": "A. The pin is the guard's verdict, and it is identical on the two drivers; the measurement round already recorded driver-memory's own behaviour (6324239568). B buys a driver-specific line at the price of a ruling." }, { "question": "PR #25141's body was written at the PR's creation, before the driver-memory removal, and three sentences there are now false. The body is written once, so the seat writes the correction.", "options": [ "Edit: in 'What changed', the bullet '`@objectstack/driver-memory` is added as a plugin-auth **devDependency**, for the lean-embedding pin.' is deleted", "Edit: 'the negative pin, failure direction (ii), on a driver-memory lean embedding and on a pre-18 store' becomes 'on a lean embedding (no sys_organization) whose tenant column is NOT NULL nowhere, and on a pre-18 store'", "Edit: the Acceptance-notes file-surface sentence (package.json and pnpm-lock.yaml) is deleted; the final diff touches neither", "Edit: Verification: plugin-auth stays 3448/3438/0/10; the ablation row reads '3 parity cases (the nullable matrix row and both negative pins) plus 3 config-anchor pins'" ], "recommendation": "Apply all four. The PR's final file list is 14 paths, none outside the claim's surface." } ], "out_of_scope_findings": [ "carrier: none · noted, not filed · the matrix pins a fact worth knowing for #24897's ADR text: on a store whose tenant column is nullable, a lean composition with no organization object still writes an organization-less row through the engine (D9's no-organization-object exit). Only a fresh table's NOT NULL refuses it. Dedupe words: no-organization-object exit nullable tenant column organization-less write" ] }Generated by Claude Code
objectstack-fleet commentedon Oct 21, 2026
Landed · epic PM
session_01Y5583bs2RDd53MH6kM1ca3(os-steve) · 2026-10-21T22:18Z. PR #25141 merged intomainasabc25a3536, executing seat decision A (6324268472). It closes this card.admin_full_accessgrant, so it answers the resolver's question in every composition. Its only fail-open is closed.authorization.mdxandpermission-sets.mdxnow say the same.CONTRACT_REVIEW_TIERPASS 6326981452; seat ACCEPT 6327371052.patchon@objectstack/plugin-auth,Clause-②: yes (narrowing). The changeset names the embedder's remedy.