feat(auth): per-org MFA + dispatcher/MCP gate (ADR-0069 D3)

[os-zhuang]

ADR-0069 (tracking #2281, follow-up #2375): the two remaining tails that make enforced MFA total.

What

• Per-org sys_organization.require_mfa — an org can require MFA above the global floor. computeAuthGate now treats the active org's require_mfa as an effective MFA requirement even when global mfa_required is off. isAuthGateActive() stays cheap (synchronous) via a 60s-TTL "any org requires MFA" cache with a lazy background refresh — a brand-new per-org requirement activates the gate on the next request, with no per-request org query when the feature is off.
• Dispatcher / MCP gate — the auth-policy gate now also runs in the runtime dispatcher (after resolveExecutionContext), so MCP / GraphQL / embedded data paths enforce PASSWORD_EXPIRED / MFA_REQUIRED consistently with the REST seam (feat(auth): password expiry via the session-validation gate (ADR-0069 D1, P1) #2388). Reuses the shared core evaluateAuthGate + allow-list. Previously only the REST surface (the Console) was gated.

Default-off / additive; ADR-0049 (enforcement ships with the setting).

Verification

• Unit: plugin-auth 195 + runtime 444 + core 299 + platform-objects 63 + service-settings 129 green; full build incl. strict DTS green. New tests: per-org computeAuthGate (active-org require_mfa → MFA_REQUIRED with global off; not-requiring org → pass; cache trips isAuthGateActive).
• Live dogfood:
  • Per-org: global MFA off; an org with require_mfa=true → its member's data request is 403 MFA_REQUIRED, while an admin with no org is 200 (correct scoping).
  • Dispatcher: global MFA on → POST /api/v1/mcp returns 403 { error: { details: { code: 'MFA_REQUIRED' } } } (the dispatcher seam fires, matching the REST gate).

ADR-0069 enforced MFA — now complete across all surfaces

✅ global + per-org enforcement · ✅ REST (Console) gate (#2388) · ✅ dispatcher/MCP gate (this PR) · ✅ Console remediation UI (objectstack-ai/objectui#2037). Remaining on #2375 is P2/P3 only.

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
spec	Ready	Preview, Comment	Jun 27, 2026 5:21pm

[github-actions]

📓 Docs Drift Check

This PR changes 3 package(s): @objectstack/platform-objects, @objectstack/plugin-auth, @objectstack/runtime.

23 hand-written doc(s) reference the affected code and may need an implementation-accuracy re-verification:

• content/docs/concepts/cloud-artifact-api.mdx(via packages/runtime)
• content/docs/concepts/implementation-status.mdx(via @objectstack/plugin-auth, @objectstack/runtime)
• content/docs/concepts/north-star.mdx(via packages/runtime)
• content/docs/concepts/packages.mdx(via @objectstack/platform-objects, @objectstack/plugin-auth, @objectstack/runtime)
• content/docs/concepts/setup-app.mdx(via @objectstack/platform-objects)
• content/docs/getting-started/cli.mdx(via @objectstack/plugin-auth)
• content/docs/guides/api-reference.mdx(via @objectstack/runtime)
• content/docs/guides/auth-sso.mdx(via @objectstack/plugin-auth)
• content/docs/guides/authentication.mdx(via @objectstack/plugin-auth, @objectstack/runtime)
• content/docs/guides/cloud-deployment.mdx(via @objectstack/runtime)
• content/docs/guides/deployment-vercel.mdx(via @objectstack/runtime)
• content/docs/guides/driver-configuration.mdx(via @objectstack/runtime)
• content/docs/guides/hook-bodies.mdx(via @objectstack/runtime)
• content/docs/guides/kernel-services.mdx(via @objectstack/plugin-auth)
• content/docs/guides/packages.mdx(via @objectstack/platform-objects, @objectstack/plugin-auth, @objectstack/runtime)
• content/docs/guides/plugin-chatbot-integration.mdx(via @objectstack/runtime)
• content/docs/guides/plugins.mdx(via @objectstack/plugin-auth)
• content/docs/guides/production-readiness.mdx(via @objectstack/plugin-auth, @objectstack/runtime)
• content/docs/guides/single-project-mode.mdx(via @objectstack/runtime)
• content/docs/protocol/objectos/http-protocol.mdx(via @objectstack/runtime)
• content/docs/protocol/objectos/index.mdx(via @objectstack/runtime)
• content/docs/protocol/objectos/lifecycle.mdx(via @objectstack/runtime)
• content/docs/releases/v9.mdx(via @objectstack/plugin-auth)

Advisory only. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs origin/main → pass the list as args.docs.