[Epic] Universal org invite link — shareable self-serve join (V1)

[os-zhuang]

Ruling (maintainer, 2026-08-24, chat — quoted verbatim)

「我想要的是一个统一的邀请链接，发到群里，个人自己注册登录，而不需要我输入邮箱。」
「可以，你开一个epic任务，用objectstack项目经理技能统一派发处理」

The maintainer approved the V1 shape proposed in that conversation (four-axis analysis summarized below). This parent is the epic's coordination node — it is never dispatched; work happens on the sub-issues.

Outcome

An org owner/admin mints ONE shareable join link, posts it to a group chat; anyone opening it registers/logs in and becomes a member of that org. The admin never types an email address.

Verified premises (2026-08-24)

• better-auth 1.7.1 (installed) and current upstream docs: every organization invitation endpoint requires email; no link/multi-use concept exists. Upstream demand tracked at Allow users to get invited to an organization without sending emails better-auth/better-auth#3672 (open). Community plugins (bard/better-auth-invite alpha, vcode-sh/better-auth-invitation-only) gate SIGNUP, not org membership — not adoptable, and a new runtime dependency is maintainer-floor anyway.
• Security context: better-auth advisory GHSA-fmh4-wcc4-5jm3 + PR check-engine-double-contract cannot read three mock-initializer spellings, and one of them hides a live unguarded engine delete double #9877 (invitation acceptance vs email verification) — the join flow's verified-email posture must be explicit.

V1 scope (ruled)

• One active link per org; role pinned to member (a link NEVER grants admin/owner); default expiry 7 days; revocable/rotatable; optional max-uses.
• Membership writes go through the governed better-auth member path (server-side addMember) — never hand-inserted sys_member rows.
• Non-goals V1 (enterprise later): domain allowlists, approval queues, per-link roles, multiple concurrent links.

Four-axis decision record (中文,按 2026-08-20 裁定)

• 实际业务需求:「链接发群里」是团队拉人的主流方式;逐个录邮箱+邮件送达率是双重摩擦;维护者本人即第一个撞上该需求的用户;受邀者注册即获客(增长原语)。
• 长远合理性:标准 IdP 能力(Slack/Notion/飞书同款);better-auth 不原生支持,自建但贴着既有治理面(成员写入走 addMember 同族路径;策略面与 enterprise organizations 的 membership_policy 对齐)。
• 防错/安全:链接=不记名凭证,V1 必带四件套(过期/可撤销旋转/角色钉死 member/次数上限可选);邮箱验证姿态显式设计(prod 开验证);OS_ORG_LIMIT 只数 owner,成员加入不撞组织上限。
• 创业阶段不扩散:V1 收窄(单链接/固定角色/不做域名限制与审批队列),高杠杆增长原语而非投机面。

Sub-issues (contract-first: backend first, downstream Blocked-by)

• A — objectstack: sys_join_link object + create/rotate/revoke/info/join endpoints (Clause-② YES: widens the public API surface ⇒ contract-tier dispatch)
• B — objectui: console UI (link dialog on the org Team surface + /join/:token landing route) — Blocked-by A
• C — cloud: control-plane org-scoping (org-scope plugin + PROXY_POLICY for the new object), plan-gate verification, staging E2E — Blocked-by A

Epic PM & territory

Epic PM session: session_71836b57-5db6-459d-ae4d-c6d9d7dd2cc6 (maintainer direct-dispatch; this session also dispatches the spec-adjacent sub-issue under the same instruction — deviation from the default spec-seat transfer is recorded here with the ruling quote above).
Territory: objectstack packages/plugins/plugin-auth/**, packages/platform-objects/src/identity/**, packages/spec/src/kernel/public-auth-features.ts; objectui packages/app-shell/src/console/** (org surfaces + join route); cloud packages/service-cloud/** (org-scope plugin / proxy policy).

[os-zhuang]

PAUSED by the maintainer — the audience assumption behind this epic was corrected.

Maintainer, 2026-08-24 chat, quoted verbatim: 「协作者不会多，我在云端手工加入都可以，主要是 业务用户怎么方便的注册进来，你先和我讨论方案。」

This epic builds the cloud-organization join link — membership in the control plane, i.e. the COLLABORATOR layer (env list, development, billing visibility). The maintainer states that layer is low-volume and manual invitation is acceptable, so the epic's justification is withdrawn for now. The real need is the business-user layer: convenient self-registration into a tenant ENVIRONMENT (e.g. steedos.objectos.ai), which is a different runtime, different tables, different auth surface — the code here does not transfer.

Dispatch stopped mid-run; branch claude/issue-11587-org-join-link-v1 exists with partial work and is left in place. No PR was opened.

Restart-when: the business-user onboarding design (under discussion with the maintainer 2026-08-24) concludes and the maintainer rules that a cloud-org join link is still wanted.

Live readings that informed the correction (measured on steedos.objectos.ai /api/v1/auth/config, 2026-08-24): emailPassword.disableSignUp=false, requireEmailVerification=false, socialProviders=[objectstack-cloud], features.ssoEnforced=false, tenancyPosture=single. Env-side self-registration is open and unverified today, and reconcileMembership (policy default auto) auto-binds each new user into the env's single org — that is the surface the business-user design must address.

[os-zhuang]

Closing not planned — the hold's Restart-when: condition has fired, and the answer is "not wanted now".

That condition was: the business-user onboarding design concludes and the maintainer rules whether a cloud-org join link is still wanted. The design concluded today as #11723 (audience posture, ruled and dispatched). The maintainer's ruling on the collaborator layer, quoted verbatim from the 2026-08-24 chat, is:

「协作者不会多，我在云端手工加入都可以，主要是 业务用户怎么方便的注册进来，你先和我讨论方案。」

Manual invitation covers the collaborator (cloud-organization) layer at current volume, so this epic has no pull. Per the maintainer's standing guidance (2026-08-16, verbatim: 「我建议有些暂时不准备开发的应该直接关闭。」), work with no firable restart condition is closed rather than held — the card IS the record, and reopening is free.

Preserved for whoever revives this: the V1 token shape reasoned out here (one active link per org, role pinned to member, default 7-day expiry, revoke/rotate, optional max-uses, membership written through the governed addMember path, verified-email posture per better-auth GHSA-fmh4-wcc4-5jm3) is directly reusable if a link value is ever added to the audience-posture vocabulary in #11723. Branch claude/issue-11587-org-join-link-v1 holds partial work; no PR was opened.