fix(auth): tenancy-mode-aware create-user bind + ADR-0093 integration tests

[os-zhuang]

Follow-up to #2884 (merged). Carries the one real bug found by multi-org runtime verification plus the ADR-0093 integration-test hardening.

The bug (found by verification, fixed here)

The #2884 endpoint bind resolved its target org via resolveDefaultOrgId — which prefers the slug='default' org regardless of how many orgs exist. In a multi-org deployment the bootstrap Default Organization coexists with real tenant orgs, so /admin/create-user would have bound every new user into the default org — violating ADR-0093 D3 ("the framework never guesses in multi mode"). Notably this was a case the old #2882 count-heuristic ("exactly one org") would also have hit whenever only the bootstrap org existed yet.

Fix: the bind now consults the tenancy service (new optional getTenancy on AdminUserEndpointDeps, wired in auth-plugin.ts): single mode → default org; multi mode → defaultOrgId() returns null → no bind. Fallback to the old resolution only when tenancy isn't wired (lean embeddings). Two unit regression tests pin it.

Multi-org runtime verification (how the bug was caught)

Built @objectstack/organizations from the cloud repo (its link: deps pointed at this worktree), linked it into the showcase example, booted with OS_MULTI_ORG_ENABLED=true, and verified on a clean instance:

Check	Result
Boot with plugin loaded (no fail-fast, no degraded)	✅ Tenancy: multi-tenant, multiOrgEnabled=true, degradedTenancy=false
Admin sign-in	✅ 200
/admin/create-user → membership	✅ none (organizationId: null) — with this fix; would have mis-bound without it
Sign-up → membership	✅ none (reconciler no-ops in multi mode)
DB truth (sys_member)	✅ only the bootstrap admin owner row; created/signed-up users correctly member-less

(Single-org e2e was verified previously: create-user and sign-up both produce default-org memberships.)

Integration tests (dogfood)

New packages/dogfood/test/membership-reconciler.dogfood.test.ts — drives the real better-auth pipeline via bootStack(showcase):

1. Sign-up membership via the user.create.after reconciler alone — the invariant e2e (no endpoint bind exists on this path, so the membership proves the hook).
2. Backfill (D6) — binds a pre-existing member-less user, idempotent on re-run.
3. Invite-only (D1) — reconciler policy-skip + backfill reason: 'policy', no rows.
4. Yield rule (D2) — a host-bound membership wins; the reconciler never double-binds.

Harness note: bootStack deliberately keeps autoDefaultOrganization: false (the ADR-0057 org-less single-tenant posture) and no better-auth admin plugin, so the tests mint the default org themselves (system context) and the create-user endpoint path stays covered by its 31 unit tests.

Also exports reconcile-membership + tenancy-service from the package index as the ADR-0093 host API, and adds the @objectstack/plugin-auth workspace dep to dogfood.

Testing

• dogfood: 46 files / 234 tests pass (incl. the 4 new).
• plugin-auth: 435 tests pass (incl. 2 new endpoint regressions).

🤖 Generated with Claude Code

https://claude.ai/code/session_01XbLd2KKeVs39EztDYMQ1YU

---

Generated by Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
spec	Ready	Preview, Comment	Jul 13, 2026 3:13pm

[github-actions]

📓 Docs Drift Check

This PR changes 2 package(s): @objectstack/dogfood, @objectstack/plugin-auth.

11 hand-written doc(s) reference the affected code and may need an implementation-accuracy re-verification:

• content/docs/deployment/production-readiness.mdx (via @objectstack/plugin-auth)
• content/docs/getting-started/cli.mdx (via @objectstack/plugin-auth)
• content/docs/kernel/services-checklist.mdx (via @objectstack/plugin-auth)
• content/docs/permissions/authentication.mdx (via @objectstack/plugin-auth)
• content/docs/permissions/authorization.mdx (via packages/dogfood)
• content/docs/permissions/delegated-administration.mdx (via packages/dogfood)
• content/docs/permissions/sso.mdx (via @objectstack/plugin-auth)
• content/docs/plugins/index.mdx (via @objectstack/plugin-auth)
• content/docs/plugins/packages.mdx (via @objectstack/plugin-auth)
• content/docs/releases/implementation-status.mdx (via @objectstack/plugin-auth)
• content/docs/releases/v9.mdx (via @objectstack/plugin-auth)

Advisory only. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs origin/main → pass the list as args.docs.