Multi-org (enterprise) will re-hit #2734: tenant_isolation RLS strict equality still hides NULL-org platform rows once org-scoping is active

[os-zhuang]

Context

#2745 fixed the open-edition half of #2734 at the DRIVER layer: applyTenantScope now treats organization_id IS NULL as a global/platform row. But in true multi-org mode (OS_MULTI_ORG_ENABLED=true + the enterprise @objectstack/organizations registering the org-scoping service), SecurityPlugin STOPS stripping the wildcard tenant_isolation RLS (organization_id == current_user.organization_id, from organization_admin/member_default in default-permission-sets.ts) — and that RLS layer still uses strict equality.

Consequence (predicted, not yet reproduced — needs an enterprise-mode repro)

An enterprise deployment's org admins will see ZERO rows in the org-less platform RBAC tables (sys_position, sys_permission_set, sys_business_unit) over REST — Setup → Access Control empty — the same symptom #2734 had in the open edition, resurfacing one layer up.

Fix directions (pick one, enterprise track)

1. Enterprise per-org seed replay stamps the platform RBAC rows per organization (matches ADR-0081's per-org bootstrap), or
2. tenant_isolation gains per-table global-row carve-outs for platform tables (organization_id == current_user.organization_id OR organization_id == null — mirrors the driver-layer semantics of fix(security)!: ADR-0090 follow-ups — driver tenant wall, batch-insert marshaling, scoped counts, vocabulary leftovers #2745), or
3. platform tables opt out of tenancy (tenancy.enabled: false) and rely on RBAC/managed_by gates alone.

Option 2 keeps one coherent "NULL = global" semantic across both layers.

Related: #2734, #2745, ADR-0081, ADR-0057 (BU tree), ADR-0090.

[os-zhuang]

Investigation result (2026-07-10): cannot reproduce — the multi-org runtime does not currently exist to activate.

• @objectstack/organizations (the enterprise plugin serve.ts tries to import under OS_MULTI_ORG_ENABLED=true) is not present in the cloud repo — packages/security-enterprise ships hierarchy / ai-seat / license only. The env flag today lands on the loud "running single-org" warning path.
• The cloud runtime's own multi-tenant wiring (packages/objectos-runtime/src/artifact-kernel-factory.ts ~L406) still imports @objectstack/plugin-org-scoping, which ADR-0081 retired from the framework — that dynamic import can only fail into its catch. Tracked on the cloud side (issue filed there).

So the predicted recurrence is real but gated behind work that hasn't landed: whoever builds the organizations package must pick one of the three fix directions in this issue at that time (per-org RBAC replay / RLS global-row carve-outs mirroring #2745's driver semantics / platform-table tenancy opt-out). Until then there is nothing enforceable to change in the framework — the open edition strips the wildcard tenant RLS and #2745 handles the driver layer. Leaving this open as the enterprise-track reminder with the design options recorded.