fix(devx): re-pin the publish smoke to the declared first-run contract

[baozhoutao]

Fixes#14000

Re-pins the packed-tarball smoke to the first-run contract the platform actually declares, per the maintainer-approved ruling (option A, director batch #23, comment 5494456135). No auth or audience runtime code is touched — option B is excluded by the ruling, and the product behaviour under test is correct as it stands.

What was wrong

scripts/publish-smoke.sh asserted that the first POST /auth/sign-up/email after objectstack dev --fresh returns 200. That expectation was authored before #11739/#11767 made invite_only the default audience posture, and it is not the first account that reaches the probe:

objectstack dev --fresh seeds a dev admin in-process at boot (maybeSeedDevAdmin, plugin-auth) through the real signUpEmail pipeline, sharing the isHumanUserRow predicate with the audience gate's bootstrap bypass. That creation is the zero-user one the bypass admits. The smoke's own sign-up is therefore the second self-serve account, which invite_only refuses with SELF_REGISTRATION_CLOSED + 403 — correctly. The release candidate had never once passed this gate with the posture default aboard (~7 days red, measured in the issue thread).

The probe sequence

#	probe	before	after
1	GET /auth/get-session (anonymous)	200	200
2	GET /auth/config (anonymous)	—	200; in pack mode features.audiencePosture must be invite_only
3	POST /auth/sign-in/email (seeded dev admin)	ran later, only to drive CRUD	200 — the packed install's proof the bootstrap bypass fired
4	POST /auth/sign-up/email (uninvited second account)	expected 200 — the stale half	403 + envelope code == SELF_REGISTRATION_CLOSED
5	POST /auth/organization/invite-member (as the admin)	—	200, status == "pending" — the operator path
6	POST /auth/sign-up/email (the invitee)	—	200 — admitted by the invitation carve-out
7	POST /auth/sign-in/email (probe user)	200	200
8	GET /auth/get-session (signed in)	200, is the probe user	unchanged
9–12	REST CRUD as the admin	201/200/200/200	unchanged; reuses the session from probe 3 instead of signing in a second time
13	error/fatal log scan	clean	unchanged

Ruling points 1, 2 and 3 are probes 3, 4 and 5–6. Behaviour is pinned throughout — an HTTP status plus a code this repo owns and publishes. No vendor-internal symbol is asserted anywhere, which is the wiring shape that made #11767's breakage possible.

Two decisions worth reviewing

The operator path is the invitation carve-out, not admin/create-user. The ruling names either. POST /auth/admin/create-user needs better-auth's admin plugin, and a scaffolded project does not get it by default — admin: pluginConfig.admin ?? scimEffective (auth-manager.ts), and the blank template declares no auth config at all — so that route would answer 501 NOT_IMPLEMENTED on the very artifact under test. The organization plugin is on by default (organization: pluginConfig.organization ?? true), and ADR-0081's ensureDefaultOrganization exists precisely so invite-member has an active org on a single-org install. So the carve-out is the operator path a fresh install actually ships.

The posture is read from the artifact, not hard-coded — because the two smoke modes install different products.pack smokes this repo's tree; registry smokes the last published release, whose contract this tree does not define. @objectstack/plugin-auth latest is 17.2.0, published 2026-08-23; #11767 landed 2026-08-25. Hard-coding the RC's posture would have turned the weekly registry canary red — and auto-filed a "fresh install is broken" issue — over a release behaving exactly as its own contract declares.

So the script reads features.audiencePosture off the public /auth/config and asserts that enforcement matches what the artifact advertises. In pack mode the advertised posture must additionally beinvite_only, which is where the ruling's closed-by-default pin bites: widening the default reds the RC before any behaviour probe can report the widening as a cheerful 200. The legacy open-registration branch is reachable only by registry mode against a pre-#11739 release and retires itself the first time a published release carries the posture.

Ruling point 4 — option C's direct bootstrap probe: declined, and why

Folding in a --no-seed-admin variant was conditioned on being cheap. It is not, and it is also redundant:

• Not cheap.--no-seed-admin is a real flag, but exercising it means a secondobjectstack dev --fresh boot — the slowest step in the job — plus restructuring machinery that is single-boot throughout: one SERVER_PID, one DEV_TMPDIR (whose per-run uniqueness is what lets the script prove the server it probes is its own), one SERVER_LOG that the closing error-scan reads, and a cleanup trap keyed on all three.
• Redundant. Probe 3 already proves the bypass fired. The seeded admin's account can only exist because the audience gate admitted its zero-user signUpEmail; if the bypass stops firing (the feat(spec,auth)!: one declared audience posture for self-registration — invite_only|email_domain|open, default invite_only #11767 defect), the seed never lands and probe 3 fails — naming the real defect directly rather than leaving it to be inferred from a sign-up refusal downstream. C's marginal information is only that the bypass admits a self-serve first account rather than the seed's first account.

Landing window — when this fix reaches the tested tree

⚠️ This lands on main, but pack-smoke tests the release branch. publish-smoke.yml's pack-smoke job runs on workflow_run after each Release run and checks out changeset-release/main when an open release PR exists, so merging this does not turn the RC green by itself. The fix reaches the tested tree at the next release-branch re-cut (the next Release run that re-cuts changeset-release/main from a main containing this commit).

⛔ Judge the result by the commit status on the release-branch head, never by the check-run attached to a main SHA — the card's own trap, measured biting three seats, and it will bite this PR's reviewers the same way if they read it the other way.

Verification

See the report comment on #14000 for the full measurement record, including what was measured locally and what is left to CI.

skip-changeset: this PR publishes nothing from any package — the diff is one CI driver script.

---

Generated by Claude Code

[baozhoutao]

Fixes#14000

Re-pins the packed-tarball smoke to the first-run contract the platform actually declares, per the maintainer-approved ruling (option A, director batch #23, comment 5494456135). No auth or audience runtime code is touched — option B is excluded by the ruling, and the product behaviour under test is correct as it stands.

What was wrong

scripts/publish-smoke.sh asserted that the first POST /auth/sign-up/email after objectstack dev --fresh returns 200. That expectation was authored before #11739/#11767 made invite_only the default audience posture, and it is not the first account that reaches the probe:

objectstack dev --fresh seeds a dev admin in-process at boot (maybeSeedDevAdmin, plugin-auth) through the real signUpEmail pipeline, sharing the isHumanUserRow predicate with the audience gate's bootstrap bypass. That creation is the zero-user one the bypass admits. The smoke's own sign-up is therefore the second self-serve account, which invite_only refuses with SELF_REGISTRATION_CLOSED + 403 — correctly. The release candidate had never once passed this gate with the posture default aboard (~7 days red, measured in the issue thread).

The probe sequence

#	probe	before	after
1	GET /auth/get-session (anonymous)	200	200
2	GET /auth/config (anonymous)	—	200; in pack mode features.audiencePosture must be invite_only
3	POST /auth/sign-in/email (seeded dev admin)	ran later, only to drive CRUD	200 — the packed install's proof the bootstrap bypass fired
4	POST /auth/sign-up/email (uninvited second account)	expected 200 — the stale half	403 + envelope code == SELF_REGISTRATION_CLOSED
5	POST /auth/organization/invite-member (as the admin)	—	200, status == "pending" — the operator path
6	POST /auth/sign-up/email (the invitee)	—	200 — admitted by the invitation carve-out
7	POST /auth/sign-in/email (probe user)	200	200
8	GET /auth/get-session (signed in)	200, is the probe user	unchanged
9–12	REST CRUD as the admin	201/200/200/200	unchanged; reuses the session from probe 3 instead of signing in a second time
13	error/fatal log scan	clean	unchanged

Ruling points 1, 2 and 3 are probes 3, 4 and 5–6. Behaviour is pinned throughout — an HTTP status plus a code this repo owns and publishes. No vendor-internal symbol is asserted anywhere, which is the wiring shape that made #11767's breakage possible.

Two decisions worth reviewing

The operator path is the invitation carve-out, not admin/create-user. The ruling names either. POST /auth/admin/create-user needs better-auth's admin plugin, and a scaffolded project does not get it by default — admin: pluginConfig.admin ?? scimEffective (auth-manager.ts), and the blank template declares no auth config at all — so that route would answer 501 NOT_IMPLEMENTED on the very artifact under test. The organization plugin is on by default (organization: pluginConfig.organization ?? true), and ADR-0081's ensureDefaultOrganization exists precisely so invite-member has an active org on a single-org install. So the carve-out is the operator path a fresh install actually ships.

The posture is read from the artifact, not hard-coded — because the two smoke modes install different products.pack smokes this repo's tree; registry smokes the last published release, whose contract this tree does not define. @objectstack/plugin-auth latest is 17.2.0, published 2026-08-23; #11767 landed 2026-08-25. Hard-coding the RC's posture would have turned the weekly registry canary red — and auto-filed a "fresh install is broken" issue — over a release behaving exactly as its own contract declares.

So the script reads features.audiencePosture off the public /auth/config and asserts that enforcement matches what the artifact advertises. In pack mode the advertised posture must additionally beinvite_only, which is where the ruling's closed-by-default pin bites: widening the default reds the RC before any behaviour probe can report the widening as a cheerful 200. The legacy open-registration branch is reachable only by registry mode against a pre-#11739 release and retires itself the first time a published release carries the posture.

Ruling point 4 — option C's direct bootstrap probe: declined, and why

Folding in a --no-seed-admin variant was conditioned on being cheap. It is not, and it is also redundant:

• Not cheap.--no-seed-admin is a real flag, but exercising it means a secondobjectstack dev --fresh boot — the slowest step in the job — plus restructuring machinery that is single-boot throughout: one SERVER_PID, one DEV_TMPDIR (whose per-run uniqueness is what lets the script prove the server it probes is its own), one SERVER_LOG that the closing error-scan reads, and a cleanup trap keyed on all three.
• Redundant. Probe 3 already proves the bypass fired. The seeded admin's account can only exist because the audience gate admitted its zero-user signUpEmail; if the bypass stops firing (the feat(spec,auth)!: one declared audience posture for self-registration — invite_only|email_domain|open, default invite_only #11767 defect), the seed never lands and probe 3 fails — naming the real defect directly rather than leaving it to be inferred from a sign-up refusal downstream. C's marginal information is only that the bypass admits a self-serve first account rather than the seed's first account.

Landing window — when this fix reaches the tested tree

⚠️ This lands on main, but pack-smoke tests the release branch. publish-smoke.yml's pack-smoke job runs on workflow_run after each Release run and checks out changeset-release/main when an open release PR exists, so merging this does not turn the RC green by itself. The fix reaches the tested tree at the next release-branch re-cut (the next Release run that re-cuts changeset-release/main from a main containing this commit).

⛔ Judge the result by the commit status on the release-branch head, never by the check-run attached to a main SHA — the card's own trap, measured biting three seats, and it will bite this PR's reviewers the same way if they read it the other way.

Verification

See the report comment on #14000 for the full measurement record, including what was measured locally and what is left to CI.

skip-changeset: this PR publishes nothing from any package — the diff is one CI driver script.

---

Generated by Claude Code

[baozhoutao]

Fixes#14000

Re-pins the packed-tarball smoke to the first-run contract the platform actually declares, per the maintainer-approved ruling (option A, director batch #23, comment 5494456135). No auth or audience runtime code is touched — option B is excluded by the ruling, and the product behaviour under test is correct as it stands.

What was wrong

scripts/publish-smoke.sh asserted that the first POST /auth/sign-up/email after objectstack dev --fresh returns 200. That expectation was authored before #11739/#11767 made invite_only the default audience posture, and it is not the first account that reaches the probe:

objectstack dev --fresh seeds a dev admin in-process at boot (maybeSeedDevAdmin, plugin-auth) through the real signUpEmail pipeline, sharing the isHumanUserRow predicate with the audience gate's bootstrap bypass. That creation is the zero-user one the bypass admits. The smoke's own sign-up is therefore the second self-serve account, which invite_only refuses with SELF_REGISTRATION_CLOSED + 403 — correctly. The release candidate had never once passed this gate with the posture default aboard (~7 days red, measured in the issue thread).

The probe sequence

#	probe	before	after
1	GET /auth/get-session (anonymous)	200	200
2	GET /auth/config (anonymous)	—	200; in pack mode features.audiencePosture must be invite_only
3	POST /auth/sign-in/email (seeded dev admin)	ran later, only to drive CRUD	200 — the packed install's proof the bootstrap bypass fired
4	POST /auth/sign-up/email (uninvited second account)	expected 200 — the stale half	403 + envelope code == SELF_REGISTRATION_CLOSED
5	POST /auth/organization/invite-member (as the admin)	—	200, status == "pending" — the operator path
6	POST /auth/sign-up/email (the invitee)	—	200 — admitted by the invitation carve-out
7	POST /auth/sign-in/email (probe user)	200	200
8	GET /auth/get-session (signed in)	200, is the probe user	unchanged
9–12	REST CRUD as the admin	201/200/200/200	unchanged; reuses the session from probe 3 instead of signing in a second time
13	error/fatal log scan	clean	unchanged

Ruling points 1, 2 and 3 are probes 3, 4 and 5–6. Behaviour is pinned throughout — an HTTP status plus a code this repo owns and publishes. No vendor-internal symbol is asserted anywhere, which is the wiring shape that made #11767's breakage possible.

Two decisions worth reviewing

The operator path is the invitation carve-out, not admin/create-user. The ruling names either. POST /auth/admin/create-user needs better-auth's admin plugin, and a scaffolded project does not get it by default — admin: pluginConfig.admin ?? scimEffective (auth-manager.ts), and the blank template declares no auth config at all — so that route would answer 501 NOT_IMPLEMENTED on the very artifact under test. The organization plugin is on by default (organization: pluginConfig.organization ?? true), and ADR-0081's ensureDefaultOrganization exists precisely so invite-member has an active org on a single-org install. So the carve-out is the operator path a fresh install actually ships.

The posture is read from the artifact, not hard-coded — because the two smoke modes install different products.pack smokes this repo's tree; registry smokes the last published release, whose contract this tree does not define. @objectstack/plugin-auth latest is 17.2.0, published 2026-08-23; #11767 landed 2026-08-25. Hard-coding the RC's posture would have turned the weekly registry canary red — and auto-filed a "fresh install is broken" issue — over a release behaving exactly as its own contract declares.

So the script reads features.audiencePosture off the public /auth/config and asserts that enforcement matches what the artifact advertises. In pack mode the advertised posture must additionally beinvite_only, which is where the ruling's closed-by-default pin bites: widening the default reds the RC before any behaviour probe can report the widening as a cheerful 200. The legacy open-registration branch is reachable only by registry mode against a pre-#11739 release and retires itself the first time a published release carries the posture.

Ruling point 4 — option C's direct bootstrap probe: declined, and why

Folding in a --no-seed-admin variant was conditioned on being cheap. It is not, and it is also redundant:

• Not cheap.--no-seed-admin is a real flag, but exercising it means a secondobjectstack dev --fresh boot — the slowest step in the job — plus restructuring machinery that is single-boot throughout: one SERVER_PID, one DEV_TMPDIR (whose per-run uniqueness is what lets the script prove the server it probes is its own), one SERVER_LOG that the closing error-scan reads, and a cleanup trap keyed on all three.
• Redundant. Probe 3 already proves the bypass fired. The seeded admin's account can only exist because the audience gate admitted its zero-user signUpEmail; if the bypass stops firing (the feat(spec,auth)!: one declared audience posture for self-registration — invite_only|email_domain|open, default invite_only #11767 defect), the seed never lands and probe 3 fails — naming the real defect directly rather than leaving it to be inferred from a sign-up refusal downstream. C's marginal information is only that the bypass admits a self-serve first account rather than the seed's first account.

Landing window — when this fix reaches the tested tree

⚠️ This lands on main, but pack-smoke tests the release branch. publish-smoke.yml's pack-smoke job runs on workflow_run after each Release run and checks out changeset-release/main when an open release PR exists, so merging this does not turn the RC green by itself. The fix reaches the tested tree at the next release-branch re-cut (the next Release run that re-cuts changeset-release/main from a main containing this commit).

⛔ Judge the result by the commit status on the release-branch head, never by the check-run attached to a main SHA — the card's own trap, measured biting three seats, and it will bite this PR's reviewers the same way if they read it the other way.

Verification

See the report comment on #14000 for the full measurement record, including what was measured locally and what is left to CI.

skip-changeset: this PR publishes nothing from any package — the diff is one CI driver script.

---

Generated by Claude Code

[baozhoutao]

Fixes#14000

Re-pins the packed-tarball smoke to the first-run contract the platform actually declares, per the maintainer-approved ruling (option A, director batch #23, comment 5494456135). No auth or audience runtime code is touched — option B is excluded by the ruling, and the product behaviour under test is correct as it stands.

What was wrong

scripts/publish-smoke.sh asserted that the first POST /auth/sign-up/email after objectstack dev --fresh returns 200. That expectation was authored before #11739/#11767 made invite_only the default audience posture, and it is not the first account that reaches the probe:

objectstack dev --fresh seeds a dev admin in-process at boot (maybeSeedDevAdmin, plugin-auth) through the real signUpEmail pipeline, sharing the isHumanUserRow predicate with the audience gate's bootstrap bypass. That creation is the zero-user one the bypass admits. The smoke's own sign-up is therefore the second self-serve account, which invite_only refuses with SELF_REGISTRATION_CLOSED + 403 — correctly. The release candidate had never once passed this gate with the posture default aboard (~7 days red, measured in the issue thread).

The probe sequence

#	probe	before	after
1	GET /auth/get-session (anonymous)	200	200
2	GET /auth/config (anonymous)	—	200; in pack mode features.audiencePosture must be invite_only
3	POST /auth/sign-in/email (seeded dev admin)	ran later, only to drive CRUD	200 — the packed install's proof the bootstrap bypass fired
4	POST /auth/sign-up/email (uninvited second account)	expected 200 — the stale half	403 + envelope code == SELF_REGISTRATION_CLOSED
5	POST /auth/organization/invite-member (as the admin)	—	200, status == "pending" — the operator path
6	POST /auth/sign-up/email (the invitee)	—	200 — admitted by the invitation carve-out
7	POST /auth/sign-in/email (probe user)	200	200
8	GET /auth/get-session (signed in)	200, is the probe user	unchanged
9–12	REST CRUD as the admin	201/200/200/200	unchanged; reuses the session from probe 3 instead of signing in a second time
13	error/fatal log scan	clean	unchanged

Ruling points 1, 2 and 3 are probes 3, 4 and 5–6. Behaviour is pinned throughout — an HTTP status plus a code this repo owns and publishes. No vendor-internal symbol is asserted anywhere, which is the wiring shape that made #11767's breakage possible.

Two decisions worth reviewing

The operator path is the invitation carve-out, not admin/create-user. The ruling names either. POST /auth/admin/create-user needs better-auth's admin plugin, and a scaffolded project does not get it by default — admin: pluginConfig.admin ?? scimEffective (auth-manager.ts), and the blank template declares no auth config at all — so that route would answer 501 NOT_IMPLEMENTED on the very artifact under test. The organization plugin is on by default (organization: pluginConfig.organization ?? true), and ADR-0081's ensureDefaultOrganization exists precisely so invite-member has an active org on a single-org install. So the carve-out is the operator path a fresh install actually ships.

The posture is read from the artifact, not hard-coded — because the two smoke modes install different products.pack smokes this repo's tree; registry smokes the last published release, whose contract this tree does not define. @objectstack/plugin-auth latest is 17.2.0, published 2026-08-23; #11767 landed 2026-08-25. Hard-coding the RC's posture would have turned the weekly registry canary red — and auto-filed a "fresh install is broken" issue — over a release behaving exactly as its own contract declares.

So the script reads features.audiencePosture off the public /auth/config and asserts that enforcement matches what the artifact advertises. In pack mode the advertised posture must additionally beinvite_only, which is where the ruling's closed-by-default pin bites: widening the default reds the RC before any behaviour probe can report the widening as a cheerful 200. The legacy open-registration branch is reachable only by registry mode against a pre-#11739 release and retires itself the first time a published release carries the posture.

Ruling point 4 — option C's direct bootstrap probe: declined, and why

Folding in a --no-seed-admin variant was conditioned on being cheap. It is not, and it is also redundant:

• Not cheap.--no-seed-admin is a real flag, but exercising it means a secondobjectstack dev --fresh boot — the slowest step in the job — plus restructuring machinery that is single-boot throughout: one SERVER_PID, one DEV_TMPDIR (whose per-run uniqueness is what lets the script prove the server it probes is its own), one SERVER_LOG that the closing error-scan reads, and a cleanup trap keyed on all three.
• Redundant. Probe 3 already proves the bypass fired. The seeded admin's account can only exist because the audience gate admitted its zero-user signUpEmail; if the bypass stops firing (the feat(spec,auth)!: one declared audience posture for self-registration — invite_only|email_domain|open, default invite_only #11767 defect), the seed never lands and probe 3 fails — naming the real defect directly rather than leaving it to be inferred from a sign-up refusal downstream. C's marginal information is only that the bypass admits a self-serve first account rather than the seed's first account.

Landing window — when this fix reaches the tested tree

⚠️ This lands on main, but pack-smoke tests the release branch. publish-smoke.yml's pack-smoke job runs on workflow_run after each Release run and checks out changeset-release/main when an open release PR exists, so merging this does not turn the RC green by itself. The fix reaches the tested tree at the next release-branch re-cut (the next Release run that re-cuts changeset-release/main from a main containing this commit).

⛔ Judge the result by the commit status on the release-branch head, never by the check-run attached to a main SHA — the card's own trap, measured biting three seats, and it will bite this PR's reviewers the same way if they read it the other way.

Verification

See the report comment on #14000 for the full measurement record, including what was measured locally and what is left to CI.

skip-changeset: this PR publishes nothing from any package — the diff is one CI driver script.

---

Generated by Claude Code

[baozhoutao]

Fixes#14000

Re-pins the packed-tarball smoke to the first-run contract the platform actually declares, per the maintainer-approved ruling (option A, director batch #23, comment 5494456135). No auth or audience runtime code is touched — option B is excluded by the ruling, and the product behaviour under test is correct as it stands.

What was wrong

scripts/publish-smoke.sh asserted that the first POST /auth/sign-up/email after objectstack dev --fresh returns 200. That expectation was authored before #11739/#11767 made invite_only the default audience posture, and it is not the first account that reaches the probe:

objectstack dev --fresh seeds a dev admin in-process at boot (maybeSeedDevAdmin, plugin-auth) through the real signUpEmail pipeline, sharing the isHumanUserRow predicate with the audience gate's bootstrap bypass. That creation is the zero-user one the bypass admits. The smoke's own sign-up is therefore the second self-serve account, which invite_only refuses with SELF_REGISTRATION_CLOSED + 403 — correctly. The release candidate had never once passed this gate with the posture default aboard (~7 days red, measured in the issue thread).

The probe sequence

#	probe	before	after
1	GET /auth/get-session (anonymous)	200	200
2	GET /auth/config (anonymous)	—	200; in pack mode features.audiencePosture must be invite_only
3	POST /auth/sign-in/email (seeded dev admin)	ran later, only to drive CRUD	200 — the packed install's proof the bootstrap bypass fired
4	POST /auth/sign-up/email (uninvited second account)	expected 200 — the stale half	403 + envelope code == SELF_REGISTRATION_CLOSED
5	POST /auth/organization/invite-member (as the admin)	—	200, status == "pending" — the operator path
6	POST /auth/sign-up/email (the invitee)	—	200 — admitted by the invitation carve-out
7	POST /auth/sign-in/email (probe user)	200	200
8	GET /auth/get-session (signed in)	200, is the probe user	unchanged
9–12	REST CRUD as the admin	201/200/200/200	unchanged; reuses the session from probe 3 instead of signing in a second time
13	error/fatal log scan	clean	unchanged

Ruling points 1, 2 and 3 are probes 3, 4 and 5–6. Behaviour is pinned throughout — an HTTP status plus a code this repo owns and publishes. No vendor-internal symbol is asserted anywhere, which is the wiring shape that made #11767's breakage possible.

Two decisions worth reviewing

The operator path is the invitation carve-out, not admin/create-user. The ruling names either. POST /auth/admin/create-user needs better-auth's admin plugin, and a scaffolded project does not get it by default — admin: pluginConfig.admin ?? scimEffective (auth-manager.ts), and the blank template declares no auth config at all — so that route would answer 501 NOT_IMPLEMENTED on the very artifact under test. The organization plugin is on by default (organization: pluginConfig.organization ?? true), and ADR-0081's ensureDefaultOrganization exists precisely so invite-member has an active org on a single-org install. So the carve-out is the operator path a fresh install actually ships.

The posture is read from the artifact, not hard-coded — because the two smoke modes install different products.pack smokes this repo's tree; registry smokes the last published release, whose contract this tree does not define. @objectstack/plugin-auth latest is 17.2.0, published 2026-08-23; #11767 landed 2026-08-25. Hard-coding the RC's posture would have turned the weekly registry canary red — and auto-filed a "fresh install is broken" issue — over a release behaving exactly as its own contract declares.

So the script reads features.audiencePosture off the public /auth/config and asserts that enforcement matches what the artifact advertises. In pack mode the advertised posture must additionally beinvite_only, which is where the ruling's closed-by-default pin bites: widening the default reds the RC before any behaviour probe can report the widening as a cheerful 200. The legacy open-registration branch is reachable only by registry mode against a pre-#11739 release and retires itself the first time a published release carries the posture.

Ruling point 4 — option C's direct bootstrap probe: declined, and why

Folding in a --no-seed-admin variant was conditioned on being cheap. It is not, and it is also redundant:

• Not cheap.--no-seed-admin is a real flag, but exercising it means a secondobjectstack dev --fresh boot — the slowest step in the job — plus restructuring machinery that is single-boot throughout: one SERVER_PID, one DEV_TMPDIR (whose per-run uniqueness is what lets the script prove the server it probes is its own), one SERVER_LOG that the closing error-scan reads, and a cleanup trap keyed on all three.
• Redundant. Probe 3 already proves the bypass fired. The seeded admin's account can only exist because the audience gate admitted its zero-user signUpEmail; if the bypass stops firing (the feat(spec,auth)!: one declared audience posture for self-registration — invite_only|email_domain|open, default invite_only #11767 defect), the seed never lands and probe 3 fails — naming the real defect directly rather than leaving it to be inferred from a sign-up refusal downstream. C's marginal information is only that the bypass admits a self-serve first account rather than the seed's first account.

Landing window — when this fix reaches the tested tree

⚠️ This lands on main, but pack-smoke tests the release branch. publish-smoke.yml's pack-smoke job runs on workflow_run after each Release run and checks out changeset-release/main when an open release PR exists, so merging this does not turn the RC green by itself. The fix reaches the tested tree at the next release-branch re-cut (the next Release run that re-cuts changeset-release/main from a main containing this commit).

⛔ Judge the result by the commit status on the release-branch head, never by the check-run attached to a main SHA — the card's own trap, measured biting three seats, and it will bite this PR's reviewers the same way if they read it the other way.

Verification

See the report comment on #14000 for the full measurement record, including what was measured locally and what is left to CI.

skip-changeset: this PR publishes nothing from any package — the diff is one CI driver script.

---

Generated by Claude Code

[baozhoutao]

Fixes#14000

Re-pins the packed-tarball smoke to the first-run contract the platform actually declares, per the maintainer-approved ruling (option A, director batch #23, comment 5494456135). No auth or audience runtime code is touched — option B is excluded by the ruling, and the product behaviour under test is correct as it stands.

What was wrong

scripts/publish-smoke.sh asserted that the first POST /auth/sign-up/email after objectstack dev --fresh returns 200. That expectation was authored before #11739/#11767 made invite_only the default audience posture, and it is not the first account that reaches the probe:

objectstack dev --fresh seeds a dev admin in-process at boot (maybeSeedDevAdmin, plugin-auth) through the real signUpEmail pipeline, sharing the isHumanUserRow predicate with the audience gate's bootstrap bypass. That creation is the zero-user one the bypass admits. The smoke's own sign-up is therefore the second self-serve account, which invite_only refuses with SELF_REGISTRATION_CLOSED + 403 — correctly. The release candidate had never once passed this gate with the posture default aboard (~7 days red, measured in the issue thread).

The probe sequence

#	probe	before	after
1	GET /auth/get-session (anonymous)	200	200
2	GET /auth/config (anonymous)	—	200; in pack mode features.audiencePosture must be invite_only
3	POST /auth/sign-in/email (seeded dev admin)	ran later, only to drive CRUD	200 — the packed install's proof the bootstrap bypass fired
4	POST /auth/sign-up/email (uninvited second account)	expected 200 — the stale half	403 + envelope code == SELF_REGISTRATION_CLOSED
5	POST /auth/organization/invite-member (as the admin)	—	200, status == "pending" — the operator path
6	POST /auth/sign-up/email (the invitee)	—	200 — admitted by the invitation carve-out
7	POST /auth/sign-in/email (probe user)	200	200
8	GET /auth/get-session (signed in)	200, is the probe user	unchanged
9–12	REST CRUD as the admin	201/200/200/200	unchanged; reuses the session from probe 3 instead of signing in a second time
13	error/fatal log scan	clean	unchanged

Ruling points 1, 2 and 3 are probes 3, 4 and 5–6. Behaviour is pinned throughout — an HTTP status plus a code this repo owns and publishes. No vendor-internal symbol is asserted anywhere, which is the wiring shape that made #11767's breakage possible.

Two decisions worth reviewing

The operator path is the invitation carve-out, not admin/create-user. The ruling names either. POST /auth/admin/create-user needs better-auth's admin plugin, and a scaffolded project does not get it by default — admin: pluginConfig.admin ?? scimEffective (auth-manager.ts), and the blank template declares no auth config at all — so that route would answer 501 NOT_IMPLEMENTED on the very artifact under test. The organization plugin is on by default (organization: pluginConfig.organization ?? true), and ADR-0081's ensureDefaultOrganization exists precisely so invite-member has an active org on a single-org install. So the carve-out is the operator path a fresh install actually ships.

The posture is read from the artifact, not hard-coded — because the two smoke modes install different products.pack smokes this repo's tree; registry smokes the last published release, whose contract this tree does not define. @objectstack/plugin-auth latest is 17.2.0, published 2026-08-23; #11767 landed 2026-08-25. Hard-coding the RC's posture would have turned the weekly registry canary red — and auto-filed a "fresh install is broken" issue — over a release behaving exactly as its own contract declares.

So the script reads features.audiencePosture off the public /auth/config and asserts that enforcement matches what the artifact advertises. In pack mode the advertised posture must additionally beinvite_only, which is where the ruling's closed-by-default pin bites: widening the default reds the RC before any behaviour probe can report the widening as a cheerful 200. The legacy open-registration branch is reachable only by registry mode against a pre-#11739 release and retires itself the first time a published release carries the posture.

Ruling point 4 — option C's direct bootstrap probe: declined, and why

Folding in a --no-seed-admin variant was conditioned on being cheap. It is not, and it is also redundant:

• Not cheap.--no-seed-admin is a real flag, but exercising it means a secondobjectstack dev --fresh boot — the slowest step in the job — plus restructuring machinery that is single-boot throughout: one SERVER_PID, one DEV_TMPDIR (whose per-run uniqueness is what lets the script prove the server it probes is its own), one SERVER_LOG that the closing error-scan reads, and a cleanup trap keyed on all three.
• Redundant. Probe 3 already proves the bypass fired. The seeded admin's account can only exist because the audience gate admitted its zero-user signUpEmail; if the bypass stops firing (the feat(spec,auth)!: one declared audience posture for self-registration — invite_only|email_domain|open, default invite_only #11767 defect), the seed never lands and probe 3 fails — naming the real defect directly rather than leaving it to be inferred from a sign-up refusal downstream. C's marginal information is only that the bypass admits a self-serve first account rather than the seed's first account.

Landing window — when this fix reaches the tested tree

⚠️ This lands on main, but pack-smoke tests the release branch. publish-smoke.yml's pack-smoke job runs on workflow_run after each Release run and checks out changeset-release/main when an open release PR exists, so merging this does not turn the RC green by itself. The fix reaches the tested tree at the next release-branch re-cut (the next Release run that re-cuts changeset-release/main from a main containing this commit).

⛔ Judge the result by the commit status on the release-branch head, never by the check-run attached to a main SHA — the card's own trap, measured biting three seats, and it will bite this PR's reviewers the same way if they read it the other way.

Verification

See the report comment on #14000 for the full measurement record, including what was measured locally and what is left to CI.

skip-changeset: this PR publishes nothing from any package — the diff is one CI driver script.

---

Generated by Claude Code

[baozhoutao]

Fixes#14000

Re-pins the packed-tarball smoke to the first-run contract the platform actually declares, per the maintainer-approved ruling (option A, director batch #23, comment 5494456135). No auth or audience runtime code is touched — option B is excluded by the ruling, and the product behaviour under test is correct as it stands.

What was wrong

scripts/publish-smoke.sh asserted that the first POST /auth/sign-up/email after objectstack dev --fresh returns 200. That expectation was authored before #11739/#11767 made invite_only the default audience posture, and it is not the first account that reaches the probe:

objectstack dev --fresh seeds a dev admin in-process at boot (maybeSeedDevAdmin, plugin-auth) through the real signUpEmail pipeline, sharing the isHumanUserRow predicate with the audience gate's bootstrap bypass. That creation is the zero-user one the bypass admits. The smoke's own sign-up is therefore the second self-serve account, which invite_only refuses with SELF_REGISTRATION_CLOSED + 403 — correctly. The release candidate had never once passed this gate with the posture default aboard (~7 days red, measured in the issue thread).

The probe sequence

#	probe	before	after
1	GET /auth/get-session (anonymous)	200	200
2	GET /auth/config (anonymous)	—	200; in pack mode features.audiencePosture must be invite_only
3	POST /auth/sign-in/email (seeded dev admin)	ran later, only to drive CRUD	200 — the packed install's proof the bootstrap bypass fired
4	POST /auth/sign-up/email (uninvited second account)	expected 200 — the stale half	403 + envelope code == SELF_REGISTRATION_CLOSED
5	POST /auth/organization/invite-member (as the admin)	—	200, status == "pending" — the operator path
6	POST /auth/sign-up/email (the invitee)	—	200 — admitted by the invitation carve-out
7	POST /auth/sign-in/email (probe user)	200	200
8	GET /auth/get-session (signed in)	200, is the probe user	unchanged
9–12	REST CRUD as the admin	201/200/200/200	unchanged; reuses the session from probe 3 instead of signing in a second time
13	error/fatal log scan	clean	unchanged

Ruling points 1, 2 and 3 are probes 3, 4 and 5–6. Behaviour is pinned throughout — an HTTP status plus a code this repo owns and publishes. No vendor-internal symbol is asserted anywhere, which is the wiring shape that made #11767's breakage possible.

Two decisions worth reviewing

The operator path is the invitation carve-out, not admin/create-user. The ruling names either. POST /auth/admin/create-user needs better-auth's admin plugin, and a scaffolded project does not get it by default — admin: pluginConfig.admin ?? scimEffective (auth-manager.ts), and the blank template declares no auth config at all — so that route would answer 501 NOT_IMPLEMENTED on the very artifact under test. The organization plugin is on by default (organization: pluginConfig.organization ?? true), and ADR-0081's ensureDefaultOrganization exists precisely so invite-member has an active org on a single-org install. So the carve-out is the operator path a fresh install actually ships.

The posture is read from the artifact, not hard-coded — because the two smoke modes install different products.pack smokes this repo's tree; registry smokes the last published release, whose contract this tree does not define. @objectstack/plugin-auth latest is 17.2.0, published 2026-08-23; #11767 landed 2026-08-25. Hard-coding the RC's posture would have turned the weekly registry canary red — and auto-filed a "fresh install is broken" issue — over a release behaving exactly as its own contract declares.

So the script reads features.audiencePosture off the public /auth/config and asserts that enforcement matches what the artifact advertises. In pack mode the advertised posture must additionally beinvite_only, which is where the ruling's closed-by-default pin bites: widening the default reds the RC before any behaviour probe can report the widening as a cheerful 200. The legacy open-registration branch is reachable only by registry mode against a pre-#11739 release and retires itself the first time a published release carries the posture.

Ruling point 4 — option C's direct bootstrap probe: declined, and why

Folding in a --no-seed-admin variant was conditioned on being cheap. It is not, and it is also redundant:

• Not cheap.--no-seed-admin is a real flag, but exercising it means a secondobjectstack dev --fresh boot — the slowest step in the job — plus restructuring machinery that is single-boot throughout: one SERVER_PID, one DEV_TMPDIR (whose per-run uniqueness is what lets the script prove the server it probes is its own), one SERVER_LOG that the closing error-scan reads, and a cleanup trap keyed on all three.
• Redundant. Probe 3 already proves the bypass fired. The seeded admin's account can only exist because the audience gate admitted its zero-user signUpEmail; if the bypass stops firing (the feat(spec,auth)!: one declared audience posture for self-registration — invite_only|email_domain|open, default invite_only #11767 defect), the seed never lands and probe 3 fails — naming the real defect directly rather than leaving it to be inferred from a sign-up refusal downstream. C's marginal information is only that the bypass admits a self-serve first account rather than the seed's first account.

Landing window — when this fix reaches the tested tree

⚠️ This lands on main, but pack-smoke tests the release branch. publish-smoke.yml's pack-smoke job runs on workflow_run after each Release run and checks out changeset-release/main when an open release PR exists, so merging this does not turn the RC green by itself. The fix reaches the tested tree at the next release-branch re-cut (the next Release run that re-cuts changeset-release/main from a main containing this commit).

⛔ Judge the result by the commit status on the release-branch head, never by the check-run attached to a main SHA — the card's own trap, measured biting three seats, and it will bite this PR's reviewers the same way if they read it the other way.

Verification

See the report comment on #14000 for the full measurement record, including what was measured locally and what is left to CI.

skip-changeset: this PR publishes nothing from any package — the diff is one CI driver script.

---

Generated by Claude Code

[baozhoutao]

Fixes#14000

Re-pins the packed-tarball smoke to the first-run contract the platform actually declares, per the maintainer-approved ruling (option A, director batch #23, comment 5494456135). No auth or audience runtime code is touched — option B is excluded by the ruling, and the product behaviour under test is correct as it stands.

What was wrong

scripts/publish-smoke.sh asserted that the first POST /auth/sign-up/email after objectstack dev --fresh returns 200. That expectation was authored before #11739/#11767 made invite_only the default audience posture, and it is not the first account that reaches the probe:

objectstack dev --fresh seeds a dev admin in-process at boot (maybeSeedDevAdmin, plugin-auth) through the real signUpEmail pipeline, sharing the isHumanUserRow predicate with the audience gate's bootstrap bypass. That creation is the zero-user one the bypass admits. The smoke's own sign-up is therefore the second self-serve account, which invite_only refuses with SELF_REGISTRATION_CLOSED + 403 — correctly. The release candidate had never once passed this gate with the posture default aboard (~7 days red, measured in the issue thread).

The probe sequence

#	probe	before	after
1	GET /auth/get-session (anonymous)	200	200
2	GET /auth/config (anonymous)	—	200; in pack mode features.audiencePosture must be invite_only
3	POST /auth/sign-in/email (seeded dev admin)	ran later, only to drive CRUD	200 — the packed install's proof the bootstrap bypass fired
4	POST /auth/sign-up/email (uninvited second account)	expected 200 — the stale half	403 + envelope code == SELF_REGISTRATION_CLOSED
5	POST /auth/organization/invite-member (as the admin)	—	200, status == "pending" — the operator path
6	POST /auth/sign-up/email (the invitee)	—	200 — admitted by the invitation carve-out
7	POST /auth/sign-in/email (probe user)	200	200
8	GET /auth/get-session (signed in)	200, is the probe user	unchanged
9–12	REST CRUD as the admin	201/200/200/200	unchanged; reuses the session from probe 3 instead of signing in a second time
13	error/fatal log scan	clean	unchanged

Ruling points 1, 2 and 3 are probes 3, 4 and 5–6. Behaviour is pinned throughout — an HTTP status plus a code this repo owns and publishes. No vendor-internal symbol is asserted anywhere, which is the wiring shape that made #11767's breakage possible.

Two decisions worth reviewing

The operator path is the invitation carve-out, not admin/create-user. The ruling names either. POST /auth/admin/create-user needs better-auth's admin plugin, and a scaffolded project does not get it by default — admin: pluginConfig.admin ?? scimEffective (auth-manager.ts), and the blank template declares no auth config at all — so that route would answer 501 NOT_IMPLEMENTED on the very artifact under test. The organization plugin is on by default (organization: pluginConfig.organization ?? true), and ADR-0081's ensureDefaultOrganization exists precisely so invite-member has an active org on a single-org install. So the carve-out is the operator path a fresh install actually ships.

The posture is read from the artifact, not hard-coded — because the two smoke modes install different products.pack smokes this repo's tree; registry smokes the last published release, whose contract this tree does not define. @objectstack/plugin-auth latest is 17.2.0, published 2026-08-23; #11767 landed 2026-08-25. Hard-coding the RC's posture would have turned the weekly registry canary red — and auto-filed a "fresh install is broken" issue — over a release behaving exactly as its own contract declares.

So the script reads features.audiencePosture off the public /auth/config and asserts that enforcement matches what the artifact advertises. In pack mode the advertised posture must additionally beinvite_only, which is where the ruling's closed-by-default pin bites: widening the default reds the RC before any behaviour probe can report the widening as a cheerful 200. The legacy open-registration branch is reachable only by registry mode against a pre-#11739 release and retires itself the first time a published release carries the posture.

Ruling point 4 — option C's direct bootstrap probe: declined, and why

Folding in a --no-seed-admin variant was conditioned on being cheap. It is not, and it is also redundant:

• Not cheap.--no-seed-admin is a real flag, but exercising it means a secondobjectstack dev --fresh boot — the slowest step in the job — plus restructuring machinery that is single-boot throughout: one SERVER_PID, one DEV_TMPDIR (whose per-run uniqueness is what lets the script prove the server it probes is its own), one SERVER_LOG that the closing error-scan reads, and a cleanup trap keyed on all three.
• Redundant. Probe 3 already proves the bypass fired. The seeded admin's account can only exist because the audience gate admitted its zero-user signUpEmail; if the bypass stops firing (the feat(spec,auth)!: one declared audience posture for self-registration — invite_only|email_domain|open, default invite_only #11767 defect), the seed never lands and probe 3 fails — naming the real defect directly rather than leaving it to be inferred from a sign-up refusal downstream. C's marginal information is only that the bypass admits a self-serve first account rather than the seed's first account.

Landing window — when this fix reaches the tested tree

⚠️ This lands on main, but pack-smoke tests the release branch. publish-smoke.yml's pack-smoke job runs on workflow_run after each Release run and checks out changeset-release/main when an open release PR exists, so merging this does not turn the RC green by itself. The fix reaches the tested tree at the next release-branch re-cut (the next Release run that re-cuts changeset-release/main from a main containing this commit).

⛔ Judge the result by the commit status on the release-branch head, never by the check-run attached to a main SHA — the card's own trap, measured biting three seats, and it will bite this PR's reviewers the same way if they read it the other way.

Verification

See the report comment on #14000 for the full measurement record, including what was measured locally and what is left to CI.

skip-changeset: this PR publishes nothing from any package — the diff is one CI driver script.

---

Generated by Claude Code