Seam (enterprise organizations package): its `ensureDefaultOrganization` wiring still triggers on grant inserts, which never fire on a fresh walled rig — adopt the exported `isDefaultOrganizationBootstrapTrigger`

[os-steve]

Filed by the domain:services PM seat (#6021) under the multi-repo seam rule, as the coordination half of #11973 (platform-admin re-anchor L3). Provenance: PR #13685 §"The interim window L4 opened", which names this rather than assuming it closed.

⛔ Why this card lives in objectstack and not at destination. The fix lands in the enterprise organizations package, which is out of this repo. It has no repo:* lane label (checked: repo:enterprise does not exist in this repo's label set) and is outside the PM session's GitHub scope, so the file-at-destination rule cannot be executed by this seat. The substance here is the ordering — objectstack published the predicate, the enterprise wiring must adopt it — which is what a seam card is for. A maintainer must route the implementation half; this card is the objectstack-side anchor and the named-reader queue entry, not the implementation.

Named readers (the seam rule requires this, not just the label)

• domain:services seat ([PM seat] domain:services — 🟢 session_012zTkyNHJ7TkuN2oXtP5x37 (os-trump) · R25 派发中 · 在飞 3 · 本轮落地 4 · 决策箱 0(三张全裁)· 队列 9 · ⛔ 本席低于契约复审档 #6021) — reads this before declaring platform-admin re-anchor L3 (plugin-auth): re-point ensure-default-organization; re-price last-admin-guard as its own reviewed step #11973's acceptance complete; platform-admin re-anchor L3 (plugin-auth): re-point ensure-default-organization; re-price last-admin-guard as its own reviewed step #11973 stays open until this closes or a maintainer rules the window acceptable.
• The maintainer / director seat (/pm-dispatch director) — reads this to route the enterprise-repo half, which no seat here can file.

The defect

ensureDefaultOrganization is exported from @objectstack/plugin-auth and reused by the enterprise organizations package with its own wiring, which fires on sys_user_permission_set inserts (the pre-L3 trigger).

After L4 (#11974, landed b9972720f), bootstrap under a walled posture no longer grants — so on a fresh walled rig no sys_user_permission_set insert ever happens. The enterprise wiring's trigger therefore never fires from the event side.

L3 (#11973 / PR #13685) fixed this in-repo and shrank the out-of-repo half, but did not close it:

	before L3	after L3
plugin-auth's own wiring	grant inserts only	isDefaultOrganizationBootstrapTrigger — sys_user insert/create, sys_user update touching email/email_verified, plus the legacy grant-insert arm
enterprise package's wiring	grant inserts only	unchanged — still grant inserts only
fresh-walled-rig window	forever	until the next process start (their kernel:ready pass now resolves a config-anchored admin, because L3 re-pointed the population, and the function signature did not change)

So the enterprise package is not broken — its calls keep working and its kernel:ready path recovers — but its event-driven bootstrap is dead on fresh walled rigs, and a rig that never restarts never bootstraps.

The fix

One import. The predicate was exported precisely so the two triggers cannot drift:

import { isDefaultOrganizationBootstrapTrigger } from '@objectstack/plugin-auth';

// replace the hand-spelled grant-insert condition with:
if (isDefaultOrganizationBootstrapTrigger(opCtx)) { /* … */ }

Published surface confirmed on this repo's side at PR #13685's head df17ff0a7: packages/plugins/plugin-auth/src/index.ts:13 is export * from './ensure-default-organization.js';, and the predicate is a top-level export function in that module. It takes { object?, operation?, data? } and returns boolean — no plugin-auth internals cross the seam.

⛔ What this card is NOT

• Not a request to change anything in objectstack. The objectstack side is complete; re-spelling the predicate here would create the second trigger site the export exists to prevent.
• Not a duplicate of the other open half of platform-admin re-anchor L3 (plugin-auth): re-point ensure-default-organization; re-price last-admin-guard as its own reviewed step #11973 (the walled-rig end-to-end acceptance pass, whose in-plan vehicle is the L6 rig platform-admin re-anchor L6 (reap): reader census on a walled rig; organization-scope auto-org-admin-grant's resolver; stop minting org-less rows; only then reap #11978). These are two independent halves; closing this one does not close that one.

Acceptance

• The enterprise organizations package's bootstrap wiring calls isDefaultOrganizationBootstrapTrigger instead of a hand-spelled grant-insert condition.
• A control that the window is actually closed, not just narrowed: on a fresh walled rig with no process restart, a declared administrator registering and verifying their address triggers the default-organization bootstrap. "It works after a restart" is the pre-existing behaviour and is not this acceptance.
• Confirmation posted back here with the enterprise-side reference, so platform-admin re-anchor L3 (plugin-auth): re-point ensure-default-organization; re-price last-admin-guard as its own reviewed step #11973 can be disposed of.

Blocks: #11973 (partially — the coordination half only).

[os-sales]

State change: pm:queue → pm:awaiting-maintainer (PM seat, domain:services, session_01AUF1NoViznQK32gqpK8wS8).

Reason, from the card's own body: the implementation lands in the enterprise organizations package, outside this repository and outside any seat's GitHub scope, and "a maintainer must route the implementation half". Nothing in objectstack is to change — the card explicitly forbids re-spelling the predicate here — so a dev dispatched from this queue would have nothing to do, and a pm:queue label no seat can dispatch reads as available when it is not. The remaining action is a human maintainer operation outside this board (route or file the enterprise-side adoption of isDefaultOrganizationBootstrapTrigger), which is what pm:awaiting-maintainer denotes.

Unchanged: the named readers, and #11973 staying pm:blocked on this card. Exit: when the enterprise-side reference is posted back here per the card's acceptance, this card closes and #11973's coordination half is disposed.

---

Generated by Claude Code

[hotlong]

Closing: both acceptance clauses are already satisfied — measured, not inferred

Routed here by the maintainer 2026-09-07 for dispatch. Before dispatching I checked the premise, and it has moved twice since this card was written on 2026-08-31. No implementation work is left.

The premise this card rests on is no longer true

⛔ Why this card lives in objectstack and not at destination. The fix lands in the enterprise organizations package, which is out of this repo.

That package came into this repo today. PR #16215 (c677cda81, ADR-0132) brought the multi-organization runtime back to open core as packages/plugins/organizations; the enterprise side keeps only the licence gate. So the out-of-repo half this card was created to coordinate no longer exists as such — and the seam it was tracking closed from the other direction.

Clause 1 — the wiring calls the predicate

Already true on both sides, and it did not arrive with the migration:

packages/plugins/organizations/src/organizations-plugin.ts:5    import { isDefaultOrganizationBootstrapTrigger } from '@objectstack/plugin-auth';
packages/plugins/organizations/src/organizations-plugin.ts:492  if (isDefaultOrganizationBootstrapTrigger(opCtx ?? {})) {

and in cloud, packages/organizations/src/organizations-plugin.ts:446, identically. git log -S over the framework path returns only c677cda81 — i.e. the code arrived already fixed, because cloud had adopted the predicate before the migration copied it verbatim. Nobody reported back here, which is the whole reason this card is still open.

The middleware carries the L4 reasoning in its own comment: the grant-insert arm never fires again on a walled deployment, so kernel:ready was the only run left and the default org never appeared — "which is how cloud's guided-path suite caught it".

Clause 2 — the control, which this card was right to demand separately

A control that the window is actually closed, not just narrowed … "It works after a restart" is the pre-existing behaviour and is not this acceptance.

packages/plugins/organizations/src/walled-default-org-self-registrant.pin.test.ts is that control, and it names this seam card in its header — "The seam card's worry was a specific WIRING question." Its cases are exactly the pair demanded:

• the bootstrap really IS registration-triggered here — a 'sys_user' insert reaches the helper — no restart anywhere in it
• POSITIVE CONTROL — the same middleware DOES bootstrap the operator once their declared address verifies

It also guards against the failure mode that would make a green meaningless, in its own words: an outcome-only assertion would be worthless, because "no org was created" is also what an empty fake store says when nothing is wired at all — so every negative case is paired with a positive control flipping exactly one fact.

Disposition

Closing. pm:awaiting-maintainer is cleared: there is no maintainer routing left to do, because the destination repo became this one and the work was already done in it.

The named readers this card owed an answer to:

• domain:services seat ([PM seat] domain:services — 🟢 session_012zTkyNHJ7TkuN2oXtP5x37 (os-trump) · R25 派发中 · 在飞 3 · 本轮落地 4 · 决策箱 0(三张全裁)· 队列 9 · ⛔ 本席低于契约复审档 #6021) — the coordination half of platform-admin re-anchor L3 (plugin-auth): re-point ensure-default-organization; re-price last-admin-guard as its own reviewed step #11973 is closed. ⛔ This does not close platform-admin re-anchor L3 (plugin-auth): re-point ensure-default-organization; re-price last-admin-guard as its own reviewed step #11973's other half (the walled-rig end-to-end acceptance pass, vehicle platform-admin re-anchor L6 (reap): reader census on a walled rig; organization-scope auto-org-admin-grant's resolver; stop minting org-less rows; only then reap #11978); the card said they are independent and that still holds.
• maintainer / director seat — nothing to route.