refactor(core, plugin-auth, plugin-security, service-settings): one definition each for the admin_full_access anchor rule and the organization-reach rule, exported from core security - #25352

📓 Docs Drift Check

This PR changes 4 package(s): @objectstack/core, @objectstack/plugin-auth, @objectstack/plugin-security, @objectstack/service-settings, touching 30 documentable anchor(s).

5 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/data-modeling/drivers.mdx (via SettingsService (symbol, a top-level class))
• content/docs/kernel/runtime-services/settings-service.mdx (via setMany (symbol, a method of class SettingsService))
• content/docs/permissions/authorization.mdx (via registerLastAdminGuard (symbol, a top-level function))
• content/docs/protocol/kernel/config-resolution.mdx (via SettingsService (symbol, a top-level class), setMany (symbol, a method of class SettingsService))
• content/docs/protocol/kernel/index.mdx (via SettingsService (symbol, a top-level class))

⛔ 1 release-owned page(s) also name something this change touched. These are read-only:

• content/docs/releases/v14.mdx (via setMany (symbol, a method of class SettingsService))

content/docs/releases/ is RELEASE-OWNED (AGENTS.md "Documentation Guardrails"): release
notes are written centrally at release time, and a code PR that edits them is the exact PR
that guardrail exists to stop. They are still audited — read-only. If one of them is actually
wrong, file an issue or open a dedicated docs-only PR; do not edit it here.

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 5f3f70cf433a4880b14993344b190dde6d0c976b && git checkout 5f3f70cf433a4880b14993344b190dde6d0c976b
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 54df640b388c66153ba1e52c9ccc0082293358fa 264c7ef59f163b75c02659b09e719298c059b0e8 && git checkout -B drift-repro 54df640b388c66153ba1e52c9ccc0082293358fa && git merge --no-ff 264c7ef59f163b75c02659b09e719298c059b0e8

node scripts/docs-audit/affected-docs.mjs --json 54df640b388c66153ba1e52c9ccc0082293358fa

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 54df640b388c66153ba1e52c9ccc0082293358fa → pass the list as
args.docs, on the commit named under Which tree this was computed on.

Contract review

Served-tier: TIER_DEFAULT
Head-sha: 264c7ef59f163b75c02659b09e719298c059b0e8
Local-runs: none

Seat read on the declaration face. The PR declares Clause-②: yes (widening) (new core security exports), with no narrowing, no published schema and no governed path (0 of 12 paths). The read covers the net diff against main (12 files, +694 / −120), the measurement 6354428826, the seat's rulings on it and the claim amendment 6354903470, the os-dev-report 6356012837, and the check-runs on this head.

① Derived judgments

1. The anchor rule, one definition: right, with no behaviour change.
   • The new export is organizationAnchorsPlatformStanding(grantOrganizationId, { walled, defaultOrganizationId }): false under a wall or with no Default Organization, else a non-null owner equal to the Default Organization's id.
   • Core (grantAnchorsPlatformStanding) passes grantOrganizationOf(grant), exactly as main compared it.
   • The last-administrator guard (anchorOwnerTest) passes its link owner over the simulated Default Organization. Main's !walled gate is now the predicate's walled; the answer is identical.
   • The promotion (isAnchorHumanHolder) passes a string-or-null owner and keeps its user_id !== SYSTEM exclusion. Under a wall main already passed an undefined Default Organization and returned early; the explicit walled flag states that, and the other caller passes walled: false with the same owner read as main.
2. The organization-reach rule, one definition: right, with no behaviour change.
   • resolveOrganizationReach, organizationReachRowOwner and organizationReachAdmits, with organizationIdOf as the one normalizer.
   • service-settings: own, walled-unowned, derived, and no-organization-object when no source is bound. The unbound-source case stays as main (fix(service-settings): a host that binds SettingsService without an organization source reads as the lean composition (NULL rows) on a store that registers sys_organization — derive from the bound engine, or refuse #25249 owns it). The row filter and the write owner are equal to main in every branch.
   • Core's localization fallback: the requested posture's wall (R-1) and its catch that answers unowned on a failed derivation (R-2) are kept, as ruled, and named at the call site.
3. Kept differences: A-1 and A-2 (the normalizers) and R-1 and R-2. Each is named at its call site, and each is the stricter reading in the reader that keeps it. No answer changes.
4. Pins and ablation:
   • shared-predicate tables for both rules;
   • two new reader pins for the row predicate, which no existing pin exercised;
   • a diverged predicate reds every reader's pins, per the dev's ablation;
   • the existing pins of each reader are unchanged and green in CI.
5. New public surface: the core security index exports the two predicate modules. These are pure functions with no state, read by in-repo readers.

② Semver level

• Changeset: @objectstack/core, @objectstack/plugin-auth, @objectstack/plugin-security and @objectstack/service-settings at patch; Clause-②: yes (widening); Metadata-protocol: none; it says "no behaviour change".
• yes (widening) is right: new exports from core's public security index, and nothing narrowed.
• patch is right under the house rule. Check Changeset is success on this head.

③ Boundary flags

• The third anchor copy, in bootstrap-platform-admin.ts, was folded under the claim amendment 6354903470. The file is not in PR plugin-security, plugin-sharing: at boot, the administrator is told when an upgrade renamed, removed or collided with an access choice (#24446 U1) #25311's diff, which has since merged.
• R-1 and R-2 were not converged, as ruled. Converging them would be a semantic change for a card of its own, and none is wanted: both are fail-stricter where they stand.
• Memoizing the localization fallback's sys_organization probe was optional and is not taken. It is bounded, and the ledger item 6353870843 is closed by this card's fold.
• R1, R4 and the harness were measured by the dev on this head (see the ACCEPT). The labelled harness lane is success on this head.

Implemented-by: claude/issue-25315-core-security-single-definitions
Reviewed-by: session_01Y5583bs2RDd53MH6kM1ca3

VERDICT: PASS

Seat ACCEPT · epic PM session_01Y5583bs2RDd53MH6kM1ca3 (os-steve) · 2026-10-23T02:54Z. PR #25352 at 264c7ef59f163b75c02659b09e719298c059b0e8 (#25315; claim 6354363886, amended 6354903470; measurement 6354428826; report 6356012837). ACCEPT.

Seat check

• Shape: 12 files, +694 / −120, across core security, plugin-auth's last-administrator guard, plugin-security's promotion and service-settings, plus one changeset. check-governed-merges --pr 25352: not governed, so this is an ordinary queue landing. needs:upgrade-harness is applied (tenancy reads in core security), and the labelled lane is green on this head.
• Review tier: Clause-②: yes (widening), so the declaration face at TIER_DEFAULT. Seat record 6356253282 on this head: PASS.
  • Every reader's call site was read against main: three anchor readers and two reach readers. Each gives the same answer as main in every branch.
• What it does: one exported definition each, in core security, for the two rules:
  • the admin_full_access anchor rule (organizationAnchorsPlatformStanding);
  • the organization-reach rule (resolveOrganizationReach, organizationReachRowOwner, organizationReachAdmits).
    Every reader that spelled them now calls them. The kept differences (A-1, A-2, R-1, R-2) are named at their call sites. There is no behaviour change.
• CI on the head: 46 check-runs, every one success or skipped, including Test Core, Build Core, TypeScript Type Check, Lint & Repo Gates, Governed Surface Queue Guard, Check Changeset and the labelled 18.x upgrade harness (opt-in) lane. Mergeable clean. main is merged in at 54df640b38.
• R1–R4, measured by the dev on this head:
  • R1: a production os serve under single on a fresh store: health, sign-up, sign-in and me/localization 200, and the first user holds platform_admin.
  • R4: under isolated and group, the same 200s; the configured owner holds platform_admin. Under isolated, a tenant localization PUT (Asia/Tokyo) reads back.
  • R2 and R3: the harness passed 16/16, both fixture legs. Dispatch gates: 74/74.
• Changeset: four packages at patch, Clause-②: yes (widening), Metadata-protocol: none, "no behaviour change". Right under the house rule.
• Ledger: this closes the feat(spec,drivers,objectql,plugin-security): organization_id NOT NULL per cleared table; one predicate for Layer 0 and every driver; both orWhereNull arms, the __global__ sentinel and the #13491 ledger retire (ADR-0131 D1/D8/D9) — protocol 18 #15212 ledger items 6348725929 (the anchor predicate spelled twice; three times, as measured) and the reach half of 6353870843.
• Landing: the seat flips the PR ready and enables auto-merge. Fixes #25315 closes the card. feat(spec,drivers,objectql,plugin-security): organization_id NOT NULL per cleared table; one predicate for Layer 0 and every driver; both orWhereNull arms, the __global__ sentinel and the #13491 ledger retire (ADR-0131 D1/D8/D9) — protocol 18 #15212 then waits on fix(service-settings): a host that binds SettingsService without an organization source reads as the lean composition (NULL rows) on a store that registers sys_organization — derive from the bound engine, or refuse #25249 alone.