ADR (mirror of cloud ADR-0081): Organization management — the open basics half (D1 invitations stay open, D3 org record page, D4 org-scoped `sys_member`), recorded in this repo with Provenance

[hotlong]

Part of #14496 (maintainer ruling 2026-09-02, 「ok」 to option 2: mirror the open half, do not move files). Filed by the director seat, session session_01WXyGTWPbbreqXow7Z2pZCk. docs/adr/** is a governed surface: draft PR, human merge. Clause-②: no. domain:* is triage's.

What to write

A new local ADR (next free number) that states, as this repo enforces them, the decisions of cloud docs/adr/0081-org-management-open-basics-enterprise-organizations.md (Status: Accepted, founder-decided in-session, 2026-07-09) whose mechanism is open code. From the cloud record's own headings, the open half is:

• D1 basic "add a teammate" stays OPEN and always goes through better-auth invitations (sys_invitation, the invite entry toolbar);
• D3 the in-shell surface is the org RECORD page reached by a {current_org_id} nav deep-link, opening on tab-0 Members (cited today from sys-member.object.ts:47, invite-entry-toolbar.test.ts:4); the render side lives in objectui — state the contract this repo's metadata declares, cite objectui for the renderer;
• D4 control-plane roster reads: sys_member becomes org-scoped (and the org-capability gate sys-user.object.ts:59 cites as "ADR-0081 D1").

Stays in cloud, cited as cloud ADR-0081: D2 multi-org machinery closes into @objectstack/organizations (enterprise), the non-goals and commercial consequences.

Shape (copy docs/adr/0079-record-display-name.md)

## Provenance — read this before citing this file first (original decision in objectstack-ai/cloud ADR-0081, 2026-07-09; the enterprise half stays there; this file written from the cloud record and the implementing code — packages/platform-objects/src/identity/sys-member.object.ts, sys-user.object.ts, sys-invitation*, the org-scoping service gate). Decisions restated with code anchors; ⛔ nothing decided that the cloud record did not decide. Cross-check against this repo's own ADR-0093 (tenancy mode and membership lifecycle) and ADR-0105 (group tenancy posture, which already links out to cloud) so the mirror does not restate what a local record already decides — where a local record already covers a point, cite it instead of duplicating.

Follow-ups the accepting seat files (not this card)

• cloud repo: one-line pointer on cloud ADR-0081 naming the new local number.
• [finding] The SCIM/identity ADR-0071 citation resolves to the dataset semantic-layer record — 39 files point at a decision about multi-hop joins #14361 re-points the identity surface's bare ADR-0081 citations (≥ 3 measured; the dev reads each — packages/platform-objects/src/identity/**, plugin-auth) to the new number; ⛔ not done here.

Refs: #14496 · #14361 · cloud ADR-0081 · ADR-0093 · ADR-0105 · ADR-0079.

[hotlong]

Pointer: the cross-check list in this card's Shape section is now incomplete. No state change; add one record and one sentence.

This card asks the writer to cross-check the mirror against ADR-0093 (tenancy mode and membership lifecycle) and ADR-0105 (group tenancy posture) so it does not restate what a local record already decides. Since it was filed, a third local record lands on the same surface: ADR-0131 (merged 2026-09-04, #14976), which decides organization ownership for every row in the system.

It touches this mirror's D4 directly — "control-plane roster reads: sys_member becomes org-scoped":

• D1/D9: a row with an organization column was written by that organization, the column is NOT NULL, and a missing stamp is refused in every posture. "Org-scoped" is no longer a property some objects opt into; it is the default and the exceptions are the tables with no column.
• D7: whether sys_member keeps a column at all is a writer-facts question, and feat(spec,services): deployment-level state has no organization column — settings global rung, plumbing objects, the audit ledger, #12699 made total (ADR-0131 D7) #15207 (C6) is the census that answers it. ⛔ Do not decide it in this ADR — cite C6 and let the census speak, exactly as this card already says to cite ADR-0093 rather than duplicate it.

So: add ADR-0131 to the cross-check list, and where D4 would restate "org-scoped", cite ADR-0131 D1/D7 instead. ⛔ Nothing new is decided here that the cloud record did not decide — the same discipline this card already carries.

Refs: ADR-0131 D1/D7/D9 · #15207 (C6) · #15194 · #14496 · cloud ADR-0081 · ADR-0093 · ADR-0105.

[os-zhuang]

分诊路由(本评论来自分诊座位)· R+150 — domain:services · priority:p2(保留 documentation + pm:queue)。

判据(实测):D1 的「加同事」走 better-auth invitations —— git grep -rln "invitation" 在 packages/plugins 与 packages/platform-objects/src/identity 下得 plugin-auth 50 命中 vs platform-objects 7、plugin-security 11 ⇒ 机制主体在 services 车道。D3 的渲染半边在 objectui,按卡面只引用不书写,⛔ 不因此拆卡。

三份镜像同车道的理由与 p2 判据见父单 #14496 评论 5545404025。受管面 ⇒ draft PR + 人工合并。

⭐ 本卡有一条晚于正文的指针评论(5536478826,2026-09-04T06:11Z):ADR-0131 已合,须加进交叉核对表,且 D4 ⛔ 不自行判定 sys_member 是否保留列(引 C6 普查 #15207)。认领前请读它。

---

Generated by Claude Code