feat(spec,auth)!: one declared audience posture for who may self-register into an app — invite_only|email_domain|open, default invite_only

[os-zhuang]

Part of #11723 (epic — the ruling, the four-axis record, and the public correction of the migration shape all live there; read it first).

Why this exists (measured, 2026-08-24)

"Who may become a user of an app built on ObjectStack" is not declarable today. It is an emergent property of emailAndPassword.disableSignUp + emailVerification + ssoOnlyMode (spec AuthConfig) + plugin-auth's membershipPolicy + an implicit fallback permission set. Nobody chose that combination, and its default is open self-registration with no email verification, with reconcileMembership (policy default auto) auto-binding each registrant into the env's org. There is no email-domain allowlist anywhere in the repo (zero hits; neighbouring-term counter-check passes — disableSignUp hits in the same files). The AI build agent's blueprint has no auth surface at all, so every AI-generated app inherits that default and the AI is structurally unable to declare otherwise.

Deliverable — ONE declared audience posture, enforced in ONE place

Vocabulary (ruled, closed): invite_only | email_domain | open. Default when undeclared: invite_only. Follow the existing MembershipPolicy precedent in this package for the shape: a runtime value list, isX() entry validation, and a loud refusal of off-vocabulary values (never coerce to a permissive branch — that exact fail-open is why that precedent exists).

Invariants to enforce (this is the contract-tightening half — declared = enforced):

1. Posture !== invite_only ⇒ email verification is forced on. A configuration that opens self-registration while disabling verification must be refused loudly at parse/boot, not silently accepted: an unverified allowlisted-domain signup is impersonation of a colleague, and it makes the domain gate decorative.
2. Posture email_domain ⇒ a non-empty domain list is required (completeness predicate; ADR-0078 family — "declared but inert" is the defect class this whole card is closing).
3. Any posture that permits self-registration ⇒ the permission set a self-registrant receives must be explicitly declared, not left to the implicit member_default fallback. Refuse at the same predicate if it is missing or names a non-existent set.
4. Enforcement lives at one point on the signup path, with distinct, registered error codes for: self-registration closed, email domain not allowed. Do not spread the check across call sites.

Placement judgement (yours, argue it in the report): whether the posture belongs on AuthConfig in packages/spec/src/system/auth-config.zod.ts as one object (posture + domains + permission set) or as a sibling declaration. It must be authorable (it will need entries in the authorable-surface manifests) and readable by plugin-auth through a single accessor — the getMembershipPolicy() pattern in auth-manager.ts is the precedent for "one source both paths read", and it exists because a captured constructor option went stale against a live setting.

Breaking change posture (ruled): ship as a minor changeset with a loud release note — the repo is inside its launch window and scripts/check-changeset-no-major.mjs refuses any new major (all publishable packages are in the Changesets fixed group). ⛔ Do not introduce a major; if you believe one is unavoidable, STOP and report needs_decision.

Tests: the posture matrix (each vocabulary value × email signup / SSO JIT / admin-create); off-vocabulary value refused loudly; verification-forced invariant; empty-domain-list refusal; missing/dangling permission-set refusal; domain matching (case-insensitivity, subdomains, +tag addresses — state the ruling you implement and pin it); undeclared config resolves to invite_only; error codes distinct and registered.

Non-goals (ruled on the epic)

Token join links, approval queues, per-app (as opposed to per-environment) postures, SCIM interplay, custom onboarding flows, and — explicitly dropped in the epic's public correction — any "undeclared = legacy open" limbo or warning-banner remediation surface.

Consumer to unblock

cloud sub-issue (new-env provisioning + backfill of existing envs + posture switch) carries Blocked-by: pointing here. Your PR body MUST publish, in a dedicated section: the final field shape/name, the vocabulary values, the error codes, and the accessor cloud should read/write — that card consumes them verbatim.

[os-zhuang]

Claim: PM loop round 1 (epic #11723, maintainer direct-dispatch channel)
Session: session_71836b57-5db6-459d-ae4d-c6d9d7dd2cc6
Branch: claude/issue-11739-audience-posture
Worktree: objectstack-issue-11739
Domain: domain:services
File surface: packages/spec/src/system/** (+ authorable-surface manifests), packages/plugins/plugin-auth/src/**, packages/platform-objects/src/** if a permission-set predicate lands there (stop on breach; explain in the report)
Container & model: L, mode:subagent, model: claude-fable-5 — Clause-② mandatory tier: this card changes contract accept/reject behaviour (a configuration that was accepted is now refused) AND widens the authorable public surface
Clause-②: yes
Serial constraints cleared: open PRs re-read at dispatch time; none claims packages/plugins/plugin-auth/src/** or packages/spec/src/system/auth-config.zod.ts. The sibling cloud card (objectstack-ai/cloud#1649) is pm:blocked on this one — never same batch. Note mode:subagent tier is not self-provable ⇒ the needs:contract-review chain applies at ACCEPT regardless of dispatched tier.

Audit (direct-dispatch): maintainer instruction, 2026-08-24 chat, quoted verbatim: 「新环境默认 invite_only，存量也默认切换到 invite_only，按这个拆卡派发」 and 「目前云还没正式上线」. The spec-touching card is dispatched by the epic PM under that instruction rather than transferred to the spec seat; deviation recorded on the epic parent.

[os-zhuang]

{
 "issue": 11739,
 "status": "done",
 "branch": "claude/issue-11739-audience-posture",
 "pr": "https://github.com/objectstack-ai/objectstack/pull/11767",
 "premise_still_valid": true,
 "summary": "Shipped the ruled audience-posture vocabulary end to end: authorable `audience` on AuthConfig (posture invite_only|email_domain|open, default invite_only — no limbo), completeness predicates in the Zod schema AND at plugin-auth config entry (constructor + applyConfigPatch; off-vocabulary/inert/verification-off shapes refused loudly, never coerced), one decision owner (decideAudienceAdmission) wired at better-auth 1.7.1's user.validateUserInfo admission seam, registered 403 codes SELF_REGISTRATION_CLOSED / EMAIL_DOMAIN_NOT_ALLOWED (AUTH_CONFIG_ERROR for unusable config), forced email verification for self-reg-permitting postures mirrored into getPublicConfig, the declared self-registrant permission set actually GRANTED via sys_user_permission_set (dangling declaration refuses admission), features.audiencePosture served publicly, ADR-0087 semantic entry audience-posture-default-invite-only + minor changeset with disposition marker. PM assumption 1 held (auth-config.zod.ts home; gen:schema carried the authorable-surface keys automatically). Assumption 2 REFINED by measurement: better-auth 1.7.1 ships user.validateUserInfo — a purpose-built, method-discriminated admission gate invoked by internalAdapter.createUser on EVERY creation path — which is a better single enforcement point than the disableSignUp wiring; but the vendor's sign-up route anti-enumeration shield (shouldReturnGenericDuplicateResponse, sign-up.mjs:163/235) converts any 403 from that seam into a synthetic 200 whenever requireEmailVerification is on (measured), so the SAME decision function is additionally raised in the /sign-up/email before-hook. Assumption 3 determined and implemented: admin/scim are operator class (never gated); SSO JIT through OPERATOR-REGISTERED IdPs (sso-oidc/sso-saml, and oauth whose providerId is a configured oidcProviders entry — the cloud platform IdP included, already app-assignment-gated at the OP by D5.1) is provider class and NOT posture-gated, because IdP registration is a platform-admin-only act and the closed vocabulary cannot otherwise express closed-self-reg-plus-IdP-JIT (gating it would brick SSO-enforced fleets); social-provider OAuth and every unrecognized method ARE posture-gated (fail closed). Judgement call implemented and documented: a pending unexpired sys_invitation admits self-serve sign-up under every posture (and trumps the domain list) — invite_only otherwise kills the invitation lane for new users since accept-invitation needs an existing account; plus the zero-user bootstrap bypass mirroring the disableSignUp precedent. Domain matcher pinned: last-@ extraction, case-insensitive exact per-entry equality, no implied subdomains, +tag irrelevant, no IDN normalization. Deviations declared in the PR: touched packages/spec/src/api/error-code-ledger.zod.ts (the required code registration), packages/spec/src/kernel/public-auth-features.ts (prompt-sanctioned #11562 motion), packages/spec/src/migrations/** (ADR-0087 gate), regenerated artifacts + engine-double pinned ledger; packages/platform-objects untouched. The dispatch prompt's standard-clause conflicts: none beyond those declared.",
 "tests": "All heavy runs via scripts/pm/os-verify-lock.sh which printed its lock-unusable verdict on this macOS host (no util-linux flock): DECLARED UNLOCKED — e.g. 'VERDICT command-exit 0 · UNLOCKED (declared) · no usable flock on this host'. Union at final head 38e5fea48 (tree clean, sha from that run): pnpm --filter @objectstack/plugin-auth test → 'Test Files 75 passed (75)' / 'Tests 1559 passed (1559)'; pnpm --filter @objectstack/spec check:generated → all 14 artifact gates ✓; check-engine-double-contract → '385 (file, verb) row(s) held by the RETAINED ledger' (+2 new pins via --write); check-error-code-casing, check-nul-bytes → OK. Spec: typecheck green; targeted suites src/system+src/api+src/kernel+src/migrations+type-alias pin → 'Test Files 128 passed (128)' / 'Tests 3597 passed (3597)' (includes 12 new AudienceConfigSchema tests: off-vocabulary refusal, empty-domain refusal, inert-declaration refusals, admin_full_access refusal, undeclared⇒invite_only, domain shape/dupes). New plugin-auth suite audience-posture.test.ts (42 tests): posture×creation-class matrix incl. SSO JIT/scim/admin/unknown-method, pinned domain-matching rules, entry refusal matrix, wire outcomes (403+code envelope asserted per ADR-0112: SELF_REGISTRATION_CLOSED / EMAIL_DOMAIN_NOT_ALLOWED / AUTH_CONFIG_ERROR distinct and ledger-registered), invitation carve-out incl. expired+case-insensitive, bootstrap, dangling-set refusal, granted sys_user_permission_set row landing, forced-verification (public config mirrors true AND sign-up mints no token), off-vocabulary-smuggled fail-closed. Negative evidence captured during dev: with posture open the validateUserInfo refusal was measured coming back 200 {token:null, synthetic user} before the before-hook raise landed (scratch repro, logged GATE CALLED → AUTH_CONFIG_ERROR vs STATUS 200), red→green after. Full workspace: pnpm build --concurrency=2 and pnpm typecheck --concurrency=2 → 'Tasks: 129 successful, 129 total'; full pnpm lint (eslint . --no-inline-config) exit 0 (complete run, no narrowing). dispatch-gates.mjs (no paths, derivation header named this tree at 38e5fea48): 40 gates run, 39 green; 1 environmental red declared — check:objectui-changeset self-test needs bash mapfile (absent on macOS bash 3.2, status 127), not a verdict about the diff; CI owns it on Linux. check-adr-0087-registration → '1 declared-breaking changeset(s), each carrying an ADR-0087 disposition'; check-changeset-no-major → no major.",
 "open_questions": [],
 "out_of_scope_findings": [
 "filed as #11768: expose the audience posture in the auth settings namespace (auth.manifest.ts + bindAuthSettings) so self-host operators can switch it from the console — service-settings was outside this card's file surface"
 ]
}

[os-zhuang]

ACCEPT — PR #11767. ⛔ NOT enqueued: needs:contract-review is hung on both carriers and this seat cannot clear it (see the fuse reading at the end).

Review of record — verified against GitHub and the branch, not the report's self-description:

• PR shape: draft ✓, base main ✓, Fixes #11739 / Part of #11723 as the first two body lines ✓. 39 files; packages/platform-objects untouched as claimed; the declared deviations (error-code ledger, public-auth-features.ts, migrations/**, regenerated artifacts, docs) are all mechanically obliged by the gates the card named.
• Default is the ruled one, with no limbo: resolveAudience(undefined) returns invite_only; an off-vocabulary posture ALSO returns invite_only plus an invalid marker that refuses admission with AUTH_CONFIG_ERROR — fail-closed in both directions, and it never coerces a typo into a permissive branch (the MembershipPolicy precedent's whole point).
• Invitation carve-out is correctly bounded: keyed on status: 'pending', exact email match after trim+lowercase, expiry enforced, and the catch returns false so an error falls back to the posture. It grants no permission set. One real defect found here and filed as Invitation carve-out silently stops admitting past 200 pending invitations (in-memory scan of a capped read) #11770 rather than sent back (fail-closed, bounded): the lookup reads at most 200 pending rows and scans in memory, so past 200 concurrently-pending invitations the invitation lane silently stops admitting.
• The strongest evidence in this PR is the vendor-shield measurement. better-auth 1.7.1's sign-up route converts a 403 from the validateUserInfo admission seam into a synthetic 200 whenever requireEmailVerification is on — and this card's own invariant FORCES verification on for every self-registration-permitting posture, so the gate would have been inert exactly where it matters, with nothing red. The dev measured it (scratch repro logging the gate's verdict beside STATUS 200), raised the same decision function in the /sign-up/email before-hook, and pinned it red→green. That is the ADR-0078 "valid-but-inert" failure mode caught by measurement rather than by reasoning.
• Creation-class routing is a real design judgement and it is defensible: operator (admin/scim) and provider (sso-oidc/sso-saml, plus oauth whose providerId is an operator-registered oidcProviders entry) are exempt; social OAuth and every UNRECOGNIZED method are posture-gated, so a future creation path fails closed. The exemption is load-bearing, not a hole: gating IdP JIT would brick every SSO-enforced fleet the moment the ruled invite_only default lands, and IdP registration is itself a platform-admin act — for the cloud platform IdP the cross-tenant wall is the OP-side app-assignment gate (oidc-authorize-gate.ts, membership-or-creator, fail-closed), which I read independently earlier today.
• Semantic worth stating plainly (documented, not a defect): invite_only means "no self-registration via credentials or social" — federated users from an operator-registered IdP still JIT in. A stricter value is a future vocabulary addition, not a bug in this PR.
• Gates: 40 in the dispatch-gates family, 39 green; the single red is check:objectui-changeset's self-test needing mapfile (absent on this macOS bash 3.2 host, exit 127) — environmental, not a verdict on the diff, and CI owns it on Linux. check-changeset-no-major green and check-adr-0087-registration reports the declared-breaking changeset carrying its disposition, so the ruled minor tier is mechanically confirmed. Verify-lock printed its lock-unusable verdict on this host; all heavy runs were declared UNLOCKED.

Clause-② / contract review — the fuse fired, so this stops here. The diff touches packages/spec/src/** (path limb) and the card was claimed Clause-②: yes (content limb: a configuration previously accepted is now refused, and the authorable surface widened). Dispatch tier was claude-fable-5, but mode:subagent tier is not self-provable, so the review chain applies regardless. This seat's own served model, machine-read from the host-recorded transcript field rather than self-described, is now claude-opus-5 — the session model was changed mid-round — against CONTRACT_REVIEW_TIER = 'claude-fable-5'. Reading ≠ tier ⇒ this seat SKIPS the contract review entirely and leaves the label in place. The card waits outside the queue, which is the safe state. Clearing requires a reviewer measured at the contract-review tier.