measure: is a SESSION whose `activeOrganizationId` points at a left organization admitted the same way an ex-member API key was? — the membership guard is key-gated

[hotlong]

Measurement only. ⛔ No fix lands under this card — the deliverable is a reading posted here. If it finds a hole, the repair is its own card under its own ruling.

The question

The organization_membership_ended guard in packages/core/src/security/resolve-authz-context.ts opens with:

if (keyPrincipal?.tenantId && input.tenancyPosture) {

It is API-key-gated. A session principal never reaches it. And a session's organization is also a stored claim — around line 361 of the same file:

tenantId = tenantId ?? sessionData?.session?.activeOrganizationId;

So the two facts that made #15256 a p0 — the wall compares against a stored claim, and the fact that would expose an ended membership is not an input to the layer that could act on it — appear to hold for sessions as well, and #15365 did not touch that path: it made the posture available, but the guard that consumes it still only runs for API keys.

⚠️ Not asserted as a defect. better-auth's organization plugin may maintain activeOrganizationId itself — clearing or re-pointing it when a membership ends — in which case the claim is vetted at its source and there is nothing here. Nobody has looked. Both prior measurements (#15163 and cloud#1982) drove API keys only, by construction.

The measurement

On the same rig shape cloud#1982 used — a real objectstack serve boot of apps/objectos-ee under a live isolated posture with the real Organizations plugin mounted, OS_DATABASE_URL on a FILE so writes can be read back — with a session (cookie), not an API key:

1. Sign in a user who has a sys_member row for org_alpha, and let the session's activeOrganizationId become org_alpha. Confirm it from the session record, not from the UI.
2. Remove that membership (delete the sys_member row) while the session stays alive. ⛔ Do not sign out.
3. Drive GET and POST on a plain org-stamped object (sys_business_unit served cloud#1982 well). Does the session still read org_alpha's rows? Does a write land, and does the row read back from the store carrying org_alpha?
4. Repeat on the wiring where kernel is bound, if one can be booted — the API-key hole is closed there, and the question is whether the session hole is too.
5. Read the code and state which layer, if any, re-vets activeOrganizationId after a membership ends: better-auth's own organization plugin, a hook in packages/organizations, or nothing.

Controls, both directions, or the run has measured nothing: a session whose membership is intact must still read and write (a rig that serves nobody proves nothing); and a signed-out request must still be refused. Seed rows in a second organization and assert they are never served.

Outcomes

• Vetted at the source (better-auth clears or re-points activeOrganizationId) ⇒ close this card with the reading, and add one sentence beside the guard saying why it is key-gated, so the next reader does not re-open the question.
• Not vetted ⇒ a defect of the same family as [decision · p0] an ex-member API key reads AND writes another organization's rows on the single-kernel wiring under isolated — the wall compares against the caller's own unvetted claim #15256, on a credential that is far more common than an API key. File it with the measured blast radius and its own decision card; ⛔ the repair is not to be improvised here.

Scope note

The wall-enforcing posture needs org-scoping, whose only registrar is the cloud-private packages/organizations — so this is an enterprise-surface question and the rig has to be a cloud one, as cloud#1982's was. ⛔ Do not substitute the framework's SimulatedOrgScopingPlugin stand-in and present it as the answer; state it plainly if that is all you can boot.

Refs: #15256 (the API-key hole and its ruling) · PR #15365 (a72704375) · #15163 · cloud#1982 · packages/core/src/security/resolve-authz-context.ts.

[hotlong]

Claim: PM loop — maintainer direct-dispatch channel (2026-08-10 standing authorization).
Provenance: maintainer, 2026-09-04, live chat with this session, verbatim 「你认为合理必要的问题都应该处理」, given after this seat surfaced that the organization_membership_ended guard is key-gated and the session path was never measured.
Session: 6679d191-11f4-465b-b322-0e0409d76793
Branch: claude/issue-15396-session-active-org-measurement
Worktree: ⚠️ the rig has to be a cloud one (the wall needs org-scoping, whose only registrar is cloud-private packages/organizations), so the working checkout is objectstack-ai/cloud at sibling level — ⛔ not under .claude/worktrees; cloud resolves dependencies by relative path.
Domain: domain:services (the guard lives in packages/core/src/security); provisional under the direct-dispatch channel, triage may correct.
File surface: none — measurement only. Throwaway probes are permitted and ⛔ nothing is committed or pushed.
Container & model: M, mode:subagent, model: opus — a security reading whose wrong answer would either declare a live hole absent or invent one.
Clause-②: no — nothing lands.
Serial constraints cleared: no open PR touches resolve-authz-context.ts (PR #15365 merged 2026-09-04 as a72704375). ⚠️ cloud#1987 is in flight in the cloud repo (the framework pin bump) and will move .objectstack-sha under this rig — read the pin at the start of the run, record it, and if it moves mid-run say so rather than blending two trees.

[hotlong]

os-dev-report

Outcome: NOT VETTED

Nothing re-vets activeOrganizationId after a membership ends. A session cookie whose
activeOrganizationId points at an organization the user has left reads that organization's
rows and writes into it, on a live isolated boot with the real cloud-private
Organizations plugin mounted. This is #15256's defect on a session instead of an API key,
and the credential is far more common.

Measured on both removal paths, not one:

after the membership ended	GET	POST	the row, read back from the sqlite file
direct sys_member DELETE	200, total 3	201	organization_id: org_alpha, created_by: u_exmember_probe
better-auth's own /organization/remove-member	200, total 4	201	organization_id: org_alpha, created_by: u_victim_probe

The second row is the one that closes the card's open question: better-auth's own removal
endpoint, driven by the organization's owner, returned 200 and really deleted the row — and
the victim's session came out of it still stamped org_alpha, still revoked_at: null, still
served. The "better-auth maintains the claim at its source" hypothesis is measured false.

Rig

Sibling-level cloud worktree, container layout so link:../../../objectstack/... resolves.
Pin read at the start of the run and re-read at the end — it did not move; cloud#1987 had
already landed before this run began:

$ cd .../cloud && git rev-parse --short origin/main && git show origin/main:.objectstack-sha
51a49d9f
8a96e666bfe6f85e635db82007523410fb666d11

Real objectstack serve of apps/objectos-ee, licensed, OS_TENANCY_POSTURE=isolated,
OS_DATABASE_URL on a FILE. Boot banner (no stand-in — the real Organizations plugin,
never SimulatedOrgScopingPlugin):

  Driver:  SqlDriver(better-sqlite3)  -> file:.../probe-data/probe.db
  Tenancy: isolated
  Plugins: 44 loaded
           ObjectQL, SqlDriver, HonoServer, PlatformObjects, Auth, @objectstack/setup,
           @objectstack/account, Organizations, Security, Audit, ...

Seed: org_alpha and org_beta, five principals, four sys_business_unit rows (two per
organization). RBAC opened symmetrically — one permission set on sys_business_unit
with organization_id NULL, held identically by all five principals — so RBAC is not what
separates any two of them. OS_AUTHZ_GRANTS_CACHE_TTL_MS left at its default 0, so no
cached envelope is in play.

Step 1 — the session's organization, confirmed from the session RECORD

Not from a UI: read straight out of the sqlite file, server running.

$ sqlite3 -json probe.db "SELECT u.email, s.active_organization_id, s.revoked_at FROM sys_session s JOIN sys_user u ON u.id=s.user_id"
{"email":"betauser@probe.test","active_organization_id":"org_beta","revoked_at":null}
{"email":"exmember@probe.test","active_organization_id":"org_alpha","revoked_at":null}
{"email":"member@probe.test","active_organization_id":"org_alpha","revoked_at":null}
{"email":"owner@probe.test","active_organization_id":"org_alpha","revoked_at":null}
{"email":"victim@probe.test","active_organization_id":"org_alpha","revoked_at":null}

Steps 2 and 3 — remove the membership, keep the session, drive GET and POST

No sign-out anywhere. Path E1, the card's step 2 verbatim:

sys_member for ex, before: [{"id":"mem_a_ex","organization_id":"org_alpha"}]
sys_member for ex, after : []
session record for ex, after the delete: [{"email":"exmember@probe.test","active_organization_id":"org_alpha","revoked_at":null}]

get-session [EX-MEMBER, sys_member DELETED] -> 200 positions=["user"] activeOrganizationId="org_alpha"
GET  [EX-MEMBER, sys_member deleted, SAME cookie] -> 200 total=3 rows=[bu_alpha_1@org_alpha bu_alpha_2@org_alpha lEIwZo0ZsFDC8dre@org_alpha]
POST [EX-MEMBER, sys_member deleted, SAME cookie] -> 201 id=ebscqQSvEM4hcfxI

Path E2, better-auth's own endpoint, driven by the org owner's session:

POST /api/v1/auth/organization/remove-member -> 200 {"member":{"organizationId":"org_alpha","userId":"u_victim_probe","role":"member","id":"mem_a_victim", ...}}
sys_member for victim, after: []
victim's session record: [{"email":"victim@probe.test","active_organization_id":"org_alpha","revoked_at":null}]

get-session [VICTIM removed by better-auth] -> 200 positions=["user"] activeOrganizationId="org_alpha"
GET  [VICTIM, SAME cookie] -> 200 total=4 rows=[bu_alpha_1@org_alpha bu_alpha_2@org_alpha ebscqQSvEM4hcfxI@org_alpha lEIwZo0ZsFDC8dre@org_alpha]
POST [VICTIM, SAME cookie] -> 201 id=nQTkBouV2IR7wgbx

Server stopped, both writes read straight back out of the store:

$ sqlite3 -json probe.db "SELECT id,name,organization_id,created_by FROM sys_business_unit ORDER BY created_at,id"
{"id":"ebscqQSvEM4hcfxI","name":"exmember-write-after-removal","organization_id":"org_alpha","created_by":"u_exmember_probe"}
{"id":"nQTkBouV2IR7wgbx","name":"victim-write-after-removal","organization_id":"org_alpha","created_by":"u_victim_probe"}

The sharpest line in the run

positions is derived from the same sys_member read that builds accessible_org_ids.
Within one run, same principal, same cookie, before and after:

get-session [ex-member-TO-BE, membership INTACT] -> 200 positions=["user","org_member"] activeOrganizationId="org_alpha"
get-session [EX-MEMBER, sys_member DELETED]      -> 200 positions=["user"]               activeOrganizationId="org_alpha"

org_member is gone on the very request that is then served org_alpha's rows. The resolver
had the fact that the membership ended, on that request, in hand — and did not act on it,
because the only code that would act on it is gated on an API key. This is not a staleness or
caching problem, and a repair does not need a new read.

Controls — all four directions held, or this would have measured nothing

D  ex-member-to-be   GET   200 total=2   (rows: bu_alpha_1@org_alpha bu_alpha_2@org_alpha)
D  victim-to-be      GET   200 total=2
D  member (control)  GET   200 total=2   -> after both removals: 200 total=5, POST 201
D  beta   (control)  GET   200 total=2   (rows: bu_beta_1@org_beta bu_beta_2@org_beta) -- never an alpha row, before or after
D  signed out        GET   401 UNAUTHENTICATED   -> after: still 401
D  bogus cookie      GET   401 UNAUTHENTICATED

• A session with intact membership reads and writes throughout, so the rig serves somebody.
• Signed-out and bogus-cookie are refused throughout, so it does not serve everybody.
• The org_beta member is served exactly bu_beta_1 and bu_beta_2 and never one alpha row,
  before or after — so the wall genuinely works for a principal whose stored claim matches a
  membership they still hold. What fails is specifically the ended-membership case.
• Every sign-in returned 200. An earlier run lost two principals to better-auth's per-IP
  sign-in limit (3 per 10s) and their controls were vacuous; the probe now retries a 429 and
  refuses to run at all with a missing principal, and the reading above is from the run where
  all five signed in.

Step 5 — which layer re-vets. Answer: none. Named.

packages/core/src/security/resolve-authz-context.ts — resolveAuthzContext. At pin
8a96e666, line 294 takes the claim and line 341 gates the only check on an API key:

294:      tenantId = tenantId ?? sessionData?.session?.activeOrganizationId;
341:  if (keyPrincipal?.tenantId && input.tenancyPosture) {
343:    if (postureEnforcesWall(posture) && !grants.accessible_org_ids.includes(keyPrincipal.tenantId)) {
351:          reason: 'organization_membership_ended',

Line 343 is the only comparison of a tenant claim against accessible_org_ids anywhere in
the framework:

$ grep -rn 'accessible_org_ids' packages --include='*.ts' | grep -v /dist/ | grep -v '\.test\.' | grep 'includes\|indexOf\|has('
packages/core/src/security/resolve-authz-context.ts:343:    if (postureEnforcesWall(posture) && !grants.accessible_org_ids.includes(keyPrincipal.tenantId)) {

better-auth 1.7.2 organization plugin — does NOT maintain the claim. One writer,
adapter.setActiveOrganization (dist/plugins/organization/adapter.mjs:397, which calls
updateSession(sessionToken, ...)). Every call site passes session.session.token, i.e. the
acting session only:

crud-members.mjs:223  if (session.user.id === toBeRemovedMember.userId && session.session.activeOrganizationId === toBeRemovedMember.organizationId) await adapter.setActiveOrganization(session.session.token, null, ctx);
crud-members.mjs:434  if (session.session.activeOrganizationId === ctx.body.organizationId) await adapter.setActiveOrganization(session.session.token, null, ctx);

Line 223 is removeMember: it clears only when the caller is removing themselves, and even
then only on the one session token making the call. An admin removing someone else clears
nothing, and a second live session of a self-removing user keeps its stamp. Line 434 is
leaveOrganization, same single-token shape. Outside plugins/organization, no better-auth
code reads activeOrganizationId at all — there is no session-read-time validation to fall
back on. This is the code half of what E2 measured behaviourally.

Framework stamping is CREATE-time only: packages/plugins/plugin-auth/src/auth-manager.ts,
defaultActiveOrg, composed into databaseHooks.session.create.before (ADR-0093 D9). It sets
the claim at login and never revisits it.

packages/organizations (cloud-private) adds nothing: its only membership code is a BOOT
gate (membership-policy-gate.ts, assertWalledMembershipPolicyDeclared), not a request-time
check.

$ grep -rn 'activeOrganizationId|getSession|resolveAuthzContext|sys_session' packages/organizations/src/*.ts | grep -v '\.test\.'
(no matches)

So the chain is: better-auth stamps at login and clears only the actor's own token;
plugin-auth stamps at create; the resolver takes the stamp unvetted for sessions; the
enterprise plugin adds nothing. Nothing anywhere re-vets it.

Step 4 — the kernel-bound wiring: still UNMEASURED, and why

Same wall cloud#1982 hit, re-confirmed at this pin. kernel-manager has exactly one registrar,
packages/objectos-runtime/src/objectos-stack.ts:451, reachable only through
createObjectOSStack, which apps/objectos-ee/objectstack.config.ts:1466 enters only in its
else if (cloudUrl) branch, and cloudUrl is set only under OS_MULTI_TENANT. Booted:

$ OS_MULTI_TENANT=1 ... objectstack serve
MULTI-TENANT arm outcome = exited:1 code = 1
  x [driver-memory] Refusing to start: this driver has NO row-level tenant isolation.
  Detected: tenancy posture `isolated` - a multi-tenant deployment

createHostEnginePlugins() (objectos-stack.ts:196-203) hardcodes InMemoryDriver for the
host kernel and no environment variable redirects it. No stand-in was substituted. The
hosted SaaS arm remains unmeasured and must not be assumed safe — the same paragraph
cloud#1982 carried forward, unchanged and still owed.

Blast radius

• Credential: an ordinary browser session cookie. Every human user of a walled deployment
  holds one; API keys are the rare case.
• Window: from the moment membership ends until the session record expires or is revoked.
  Default expiresIn is 7 days (auth-manager.ts), and the measured sessions carried
  expires_at 7 days out. Nothing in either removal path shortens it — revoked_at stayed
  null on both.
• Reach: read AND write, on a plain org-stamped object, with the write landing stamped
  with the left organization and attributed to the ex-member.
• Postures: the walled ones (isolated, and by construction group), i.e. every walled
  deployment, cloud included.
• Everyday trigger: an admin removing a member through the normal product path (E2) is
  enough. No direct database access and no unusual deployment shape is required.
• Not closed by fix(rest,core): the single-kernel wiring derives the tenancy posture — an ex-member's org-stamped API key no longer reads or writes another organization's rows #15365: that PR made the posture available and fixed the REST door for API
  keys. The guard it feeds is still keyPrincipal-gated, and this run drove sessions only.

Discipline

Measurement only. Nothing committed, nothing pushed, no PR, no branch. The probe rig was a
throwaway sibling worktree of cloud, verified clean (git status --porcelain empty, no diff
against origin/main) and then torn down with git worktree remove without --force. The
probe scripts live outside every repository and are in no tree.

---

Generated by Claude Code

[hotlong]

Measurement delivered — closing. The reading is comment 5541998221; no code landed, as this card's scope required.

Outcome: NOT VETTED, and the hypothesis that would have made it a non-defect was falsified behaviourally, not just by reading code — better-auth's own /organization/remove-member, driven by the org owner, returned 200 and really deleted the row, and the removed user's session went on reading and writing that organization.

⇒ Filed as #15409, p0 · security · needs-user-decision, with the fork (A refuse / B drop the unbacked claim / C revoke sessions) and the four-facet analysis. The repair is a re-ruling of the same question #15256 answered for API keys, so it is the maintainer's, ⛔ not a dispatch this seat makes.

Verified by this seat after the report, on today's framework origin/main rather than the rig's pin: the framework's only tenant-claim-vs-membership comparison is still the single keyPrincipal-gated line in resolve-authz-context.ts (one hit across all non-test, non-dist sources, against 59 files that merely mention accessible_org_ids). So PR #15365 does not change this reading, and the finding holds on the fixed tree.

Carried into #15409 rather than lost here: the four controls; the positions ["user","org_member"] → ["user"] transition observed on the very request that was still served; the better-auth analysis (removeMember requires session.user.id === toBeRemovedMember.userId, so an admin removing someone else clears nothing); and the honest gap — the kernel-bound wiring still refuses to boot ([driver-memory] Refusing to start … posture isolated), so it is unknown, not safe, exactly as cloud#1982 left it.

⭐ Worth recording for the next measuring seat: an earlier run of this probe lost two principals to better-auth's per-IP sign-in cap, which made two controls pass vacuously. The dev caught it, made the probe abort rather than run short, and reported only the complete run. A control that cannot fail is not a control.

pm:dispatched stripped in the same stroke as the close; security, domain:services, priority:p1 retained.