[Decision] What is an authenticated session with NO active organization? Three subsystems answered it three contradictory ways in one shift (fail-open / fail-closed / permanently-invisible ledger rows)

[hotlong]

Filed by the triage seat (scheduled fire, session session_01BJ9jjXsUuc4Mkiyzvv1xUW, 2026-08-12 ~22:47Z round). This decision has no single natural anchor — it sits upstream of three measured cards in three subsystems — so it gets a standalone card per the escalation protocol.

Background

One and the same state — an authenticated session whose activeOrganizationId is null — produced three different, mutually contradictory behaviors, all measured live on 2026-08-12:

Card	Subsystem	Behavior under the state	Consequence
#8158	plugin-sharing adminOrgScope	fell OPEN	org-scoped manage_sharing read/wrote ALL tenants' sharing rules (fixed to reject, PR #8237)
#8208	Layer 0 tenant wall + write stamping	falls CLOSED, silently	HTTP-created record stamped organization_id: NULL, immediately invisible to its own creator
#8245	audit ledger	writes rows no reader can ever see	every audit row from a user's FIRST session carries a NULL tenant, permanently invisible to RLS readers

None of the three implementations is individually wrong; the platform has never declared what the state means, so each layer improvised. The state is structurally guaranteed to occur: better-auth defers the ADR-0093 membership reconciler past the signup transaction, so every new user's first session predates their membership (ADR-0081 D1 defaultActiveOrg finds no sys_member row). It can also arise later (member removed from their org, etc.), so it cannot be defined away by fixing signup alone.

Premises (re-check before ruling)

• The signup ordering is still live: git log --oneline -5 -- packages/plugin-auth/src and re-read AuthManager.composeDatabaseHooks / the ADR-0093 reconciler for a synchronous-settle change.
• plugin-sharing: a manage_sharing holder whose session has no ACTIVE organization reads every tenant's sharing rules (adminOrgScope falls open) #8158's reject-direction fix is merged: check PR fix(plugin-sharing): a manage_sharing holder with no active organization no longer reads every tenant's sharing rules (#8158) #8237 state.
• A record an admin creates over HTTP is immediately invisible to its own creator when the caller has no active organization and the Layer 0 wall is active (organization_id stamped NULL) #8208 / audit: a user's FIRST session predates their membership, so every audit row written in that window carries a NULL tenant and is invisible to RLS readers #8245 are still open findings with no disposition: re-read both cards.

The question

Is "authenticated, but no active organization" a legal session state with defined semantics, or an illegal intermediate to be eliminated at the mint point?

Options

• A. Illegal — eliminate at source. Settle membership (or an explicit org selection) before the first session mints; reject or refresh sessions that lose their org. Closes the whole class, but touches the signup hot path and better-auth's deferred-hook ordering; and "member removed mid-session" still needs an answer.
• B. Legal, with declared fail-closed semantics. Write the rule down (ADR-class): under this state, tenant-scoped reads resolve to nothing, tenant-scoped writes are refused loudly (no silent NULL stamping). plugin-sharing: a manage_sharing holder whose session has no ACTIVE organization reads every tenant's sharing rules (adminOrgScope falls open) #8158's landed fix already conforms; A record an admin creates over HTTP is immediately invisible to its own creator when the caller has no active organization and the Layer 0 wall is active (organization_id stamped NULL) #8208's silent NULL stamp becomes a 4xx refusal; audit writes need a carve-out (see C) because refusing to write a ledger row loses history.
• C. B + a targeted signup-ordering fix. The general rule is B, and specifically for signup the membership settles synchronously before the first session (or the ledger row's tenant is back-filled once the session gains its org), because account-creation audit rows are exactly the ones a fail-closed refusal would permanently lose.

Recommendation: C

• Platform long-term coherence: one declared rule replaces three improvisations, and the next subsystem that meets this state inherits an answer instead of inventing a fourth. A alone cannot cover the non-signup producers of the state.
• Measured business pull: three independent hits in one working day, one of them (plugin-sharing: a manage_sharing holder whose session has no ACTIVE organization reads every tenant's sharing rules (adminOrgScope falls open) #8158) a cross-tenant security leak — this is not speculative surface.
• AI-agent error-resistance: a declared fail-closed contract with loud refusals is exactly the shape agents cannot silently get wrong; today's silent NULL stamp (A record an admin creates over HTTP is immediately invisible to its own creator when the caller has no active organization and the Layer 0 wall is active (organization_id stamped NULL) #8208) is the archetype of the quiet corruption this axis exists to prevent.
• Startup scope discipline: C adds no new capability — it is one ruling plus one ordering fix; the per-user "pick your org" UX and multi-org session semantics stay out of scope.

Security/permission-boundary semantics ⇒ human floor; not auto-adjudicable.

Downstream

Disposition of findings #8208 and #8245 is gated on this ruling; #8158's fix stands either way. Related: #8241 (RLS policy-composition trap, same family but a different mechanism — not gated on this).

[hotlong]

Maintainer ruling — Option C

Ruled by the maintainer in a live PM session, 2026-08-13 (session session_015XyMgCSMGGn9oSwbQEeWYg), verbatim: 「其他全部接受你的建议。」 — accepting the recommendation presented there, restated below so this card is self-contained.

Ruling: C — the state is legal with declared fail-closed semantics, plus a targeted signup-ordering fix.

1. Declared rule (ADR-class): under an authenticated session with activeOrganizationId == null, tenant-scoped reads resolve to nothing and tenant-scoped writes are refused loudly (4xx naming the missing active organization). ⛔ No silent NULL stamping anywhere.
2. Signup ordering: membership settles synchronously before the first session mints (or the first-session ledger rows' tenant is back-filled once the session gains its org) — account-creation audit rows are exactly what a bare fail-closed refusal would permanently lose.
3. plugin-sharing: a manage_sharing holder whose session has no ACTIVE organization reads every tenant's sharing rules (adminOrgScope falls open) #8158's landed reject-direction fix conforms and stands.

Implementation notes for dispatch:

• The ADR draft is part of the implementation card: AI drafts, pushes, opens the PR — ⛔ the ADR PR is merged by the maintainer only, never queued or auto-merged.
• A record an admin creates over HTTP is immediately invisible to its own creator when the caller has no active organization and the Layer 0 wall is active (organization_id stamped NULL) #8208 (silent NULL stamp → becomes a 4xx refusal) and audit: a user's FIRST session predates their membership, so every audit row written in that window carries a NULL tenant and is invisible to RLS readers #8245 (NULL-tenant audit rows → covered by the ordering fix / back-fill) are dispositioned by this ruling; direction comments left on both.
• Re-run the card's premise re-checks at claim time (signup ordering still live; PR fix(plugin-sharing): a manage_sharing holder with no active organization no longer reads every tenant's sharing rules (#8158) #8237 merged).

Label swap: needs-user-decision → pm:queue.

---

Generated by Claude Code

[os-zhuang]

Claim

Claimed by the dev seat, session session_01PEVB6w7D7uCszR9Mw1BL73, branch claude/issue-8247-no-active-org-semantics.

Implementing the maintainer's Option C ruling (comment above). Re-reading the card's comments before the first edit; no earlier claim comment with a different session ID is present.

Premise re-checks (ruling asks for both)

• PR fix(plugin-sharing): a manage_sharing holder with no active organization no longer reads every tenant's sharing rules (#8158) #8237 merged — confirmed: merged: true, merged_at: 2026-08-12T22:35:13Z, merged by os-zhuang, base main. ✅
• Signup ordering still live — being re-measured now against origin/main @ 1d1ca8e99. Static read so far: AuthManager.composeDatabaseHooks still composes the ADR-0093 reconciler into user.create.after and defaultActiveOrg into session.create.before, and defaultActiveOrg still returns early (leaving activeOrganizationId null) when no sys_member row resolves. No synchronous-settle change has landed in packages/plugins/plugin-auth/src since the card was filed. Reporting the measured half in the dev report.

Declared file surface (pre-first-edit; re-checked against in-flight branches)

Expected to touch, in this repo only:

• docs/adr/0123-*.md — the ADR-class declared rule (rule 1). New file.
• packages/plugins/plugin-security/src/ — the write half of rule 1 (the read half already fails closed in tenant-layer.ts: computeTenantLayer0Filter returns RLS_DENY_FILTER on a walled posture with no active org). Plus its tests.
• packages/plugins/plugin-auth/src/ — rule 2, signup ordering.
• packages/plugins/plugin-audit/src/ — rule 2, ledger tenant back-fill, if the ordering fix alone does not cover it.
• .changeset/*.md.

⚠️ packages/plugins/plugin-security is named by my dispatch as a possible other-lane package. I am measuring whether the write refusal is irreducibly there before writing anything into it, and will report the irreducible per-lane surface to the PM rather than widening silently.

PR shape

Prime Directive #14 reserves the landing of any docs/adr/** diff to the maintainer, and the PM seat cannot arm or queue such a PR. I will state the chosen shape and the reasoning in the dev report and in the PR bodies.

---

Generated by Claude Code