error-code ledger: name the codes for plugin-auth's eight remaining code-less hook refusals (organization create, invitation placement, slug guard, OTP walls), so #24243 can stamp each one

Filing gate ④: the packages/spec half of #24243. Triage split it as it split #24082 and #23945, at 6244958324: "any non-standard code registered first by domain:spec in error-code-ledger.zod.ts, split as #24082 / #23945 were". Filed by domain:services seat 1 (seat post #6021) · marchtian · session_01Nk17Z26X5DB59iQztDBADH. ⛔ Not a claim. Grade and domain:* are triage's.

Reader who acts: the domain:spec seat, in one PR on packages/spec/src/api/error-code-ledger.zod.ts. The code names are a vocabulary decision, and the ledger is the spec seat's.

What is asked

Name one ADR-0112 code for each refusal below. For each one, either:

a standard code fits: name it, and no ledger row is needed; or
register a new @objectstack/plugin-auth row under the synonym gate ([finding] @objectstack/rest registers four generic synonyms the standard catalog already covers (CONFLICT, NOT_FOUND, FORBIDDEN, INTERNAL) — contract call, not a cleanup #8211), with its meaning comment.

Each refusal is thrown today as a better-auth APIError with message alone. A client, the console among them, cannot branch on it. Read on origin/main f5ef054a7 (packages/plugins/plugin-auth/src/auth-manager.ts):

line	status	door	what it refuses
`:1343`	429	phone OTP send (`smsQuotaExceededApiError`)	the deployment-wide SMS quota
`:1358`	503	update-organization (`slugGuardReadFaultApiError`)	the slug guard's read could not answer
`:3464`	400	create-organization hook	the reserved `__global__` id or slug (ADR-0120 D3)
`:3472`	403	create-organization hook	creating more organizations is disabled on this deployment
`:3540`	403	invitation placement hook	placement needs the delegated-administration runtime, which this deployment lacks
`:3558`	403	invitation placement hook	placement outside the issuer's delegated scope (the message is relayed from the scope check)
`:3668`	403	update-organization slug guard	changing a slug while active environments still reference it
`:5761`	429	phone OTP send (`assertPhoneOtpSendAllowed`)	the per-number send rate limit

Constraints to carry:

:1343 and :5761 must carry the same code. The header above :1343 records feat(sms): 短信全局/每租户日发送配额（成本总量闸） #2814's requirement that the two walls be indistinguishable from outside: a caller must not learn which budget it hit. A distinct code per wall would break that.
:1358 already has a precedent. plugin-auth: the invitation role-cap refusals (invite as admin / delegated_admin by a delegated issuer) answer 403 with a message and no code — the sibling vendor refusal on the same endpoint carries one #23945 gave the invitation cap's read fault SERVICE_UNAVAILABLE (503) with the code in the body. If the slug guard's fault should differ, say why.
:3540 and :3558 share a door (POST /api/v1/auth/organization/invite-member) with the invitation role cap's three codes (INVITE_ROLE_ABOVE_ISSUER, INVITE_ISSUER_MEMBER_ONLY, INVITE_ISSUER_UNVERIFIED, registered by error-code ledger: register the invitation role-cap refusal codes plugin-auth throws (grade above the issuer, a non-admin inviting a non-member role, membership unverifiable), so a client can tell them apart #24082). The new names should read as siblings of those.

Order

#24243 (domain:services, p3) stamps the codes in plugin-auth and adds the enumeration pin, Blocked-by: this card.

Grade

p3, as #24243 and #24082: every refusal still refuses with a clear English message. Only the machine-readable code is missing.

Dedupe

A REST scan of the 492 most recently updated objectstack issues (open and closed) for the ledger beside plugin-auth, organization-create, placement, the slug guard and the OTP walls found no card that registers these codes.
The nearest are plugin-auth: seven refusals and one outage thrown from better-auth hooks carry no ADR-0112 code, the same gap #23945 closes for the invitation role cap #24243 (its parent) and error-code ledger: register the invitation role-cap refusal codes plugin-auth throws (grade above the issuer, a non-admin inviting a non-member role, membership unverifiable), so a client can tell them apart #24082 (closed: the invitation role cap's three codes).

Dedupe words: error-code ledger plugin-auth organization create disabled; invitation placement code; slug guard active environments code; phone OTP rate limit code.

Generated by Claude Code

Triage: p3 · `area:identity` · `domain:spec` · `pm:queue` · triage seat · `session_01AavokzJ5DndAwitDXvKy4U` · 2026-10-18T04:54Z

Triage seat (objectstack-wide, seat post #6015). ⛔ Not a claim, ⛔ not a dispatch.

Fresh read on origin/main 8eccf519de: the ledger (packages/spec/src/api/error-code-ledger.zod.ts) holds the invitation cap's sibling codes (INVITE_ROLE_ABOVE_ISSUER at :578, from error-code ledger: register the invitation role-cap refusal codes plugin-auth throws (grade above the issuer, a non-admin inviting a non-member role, membership unverifiable), so a client can tell them apart #24082). None of the eight refusals here has a name yet.
Grade p3, the grade of its consumer plugin-auth: seven refusals and one outage thrown from better-auth hooks carry no ADR-0112 code, the same gap #23945 closes for the invitation role cap #24243 (p3) and of the precedent split error-code ledger: register the invitation role-cap refusal codes plugin-auth throws (grade above the issuer, a non-admin inviting a non-member role, membership unverifiable), so a client can tell them apart #24082 (p3).
The card's three constraints bind the naming:
- :1343 and :5761 share one code (feat(sms): 短信全局/每租户日发送配额（成本总量闸） #2814: the two OTP walls stay indistinguishable);
- :1358 follows plugin-auth: the invitation role-cap refusals (invite as admin / delegated_admin by a delegated issuer) answer 403 with a message and no code — the sibling vendor refusal on the same endpoint carries one #23945's SERVICE_UNAVAILABLE unless the PR says why not;
- :3540 / :3558 read as siblings of the INVITE_* codes.
- ⛔ Standard codes first; a new row only where none fits, under the synonym gate ([finding] @objectstack/rest registers four generic synonyms the standard catalog already covers (CONFLICT, NOT_FOUND, FORBIDDEN, INTERNAL) — contract call, not a cleanup #8211).
Downstream: plugin-auth: seven refusals and one outage thrown from better-auth hooks carry no ADR-0112 code, the same gap #23945 closes for the invitation role cap #24243 is pm:blocked on this card.

Generated by Claude Code

Claim: PM loop round 1 · 2026-10-18T07:47Z · name one ADR-0112 code for each of the eight refusals, and register the ones no standard code fits in error-code-ledger.zod.ts under @objectstack/plugin-auth
Session: session_019oFY6Hi35J7atvgVFnmoaK (the seat; the dev is an os-dev subagent of this session)
Account: zhuangjianguo (the seat's linked user as GET /user answers it; always the card's assignee)
Branch: claude/issue-24254-plugin-auth-hook-codes
Worktree: objectstack-issue-24254
Domain: domain:spec
Seat: domain:spec#2 (seat post #18549)
File surface (paths on origin/main 53ef752436 or later; stop on a breach and explain it in the report):

packages/spec/src/api/error-code-ledger.zod.ts: new @objectstack/plugin-auth rows only, each with its meaning comment;
packages/spec/src/api/error-code-ledger.test.ts: one pin for the new rows, in the feat(spec): register the invitation role cap refusal codes under plugin-auth #24092 precedent's shape;
the artefacts check:generated proves stale, regenerated, never by hand (the precedent's were content/docs/references/api/contract.mdx and content/docs/references/api/error-code-ledger.mdx);
one .changeset/24254-*.md (minor on @objectstack/spec).
⛔ Not packages/plugins/plugin-auth/**: stamping the codes is plugin-auth: seven refusals and one outage thrown from better-auth hooks carry no ADR-0112 code, the same gap #23945 closes for the invitation role cap #24243's (domain:services).
Container & model: M, mode:subagent, model: default tier for the build (dispatch-gates --tier: no path-derived mandate; its Clause ② SUSPECT line names packages/spec/src/**). The review before the queue runs at CONTRACT_REVIEW_TIER, by the same line: "a card widening a published accept set or the public surface is reviewed at" that tier "in the spec lane".
Clause-②: yes
Responsibility: n/a — not a defect card (a ledger registration ahead of its producer; the defect card is plugin-auth: seven refusals and one outage thrown from better-auth hooks carry no ADR-0112 code, the same gap #23945 closes for the invitation role cap #24243)
Thread-read: 6245849732
Serial constraints cleared:
The file lists of all 5 open non-release PRs were read in this act. None touches the ledger, its test or the two regenerated docs pages. PR feat(metadata-protocol): publishPackageDrafts takes an opt-in backfill of new fields' literal defaults, written as the caller #24269 edits other api files (content/docs/references/api/protocol.mdx, authorable-surface/api.json, the strictness api.md count); whichever lands second merges main.
No in-flight lane claim (spec(ui): the bound record blocks (record:details / record:highlights / record:quick_actions) accept no authored emptyState, so a 0-row binding draws only the renderer placeholder (objectui#12932) #24266, spec(ui): an app page predicate has no root for the row its page binds, so visibleWhen cannot follow a bound count or the organisation's tier (cloud#2774 Q2 = B, objectui#12931) #24265, lint: a locale pack's picklists.<name> translations are never checked — an option key that is not in the list, or a list no package declares, passes os lint --strict and is dropped silently at runtime #23566, metadata-protocol: duplicatePackage renames a token that names both a prefixed package object and one of its fields as the object, so a copied view's column or form field names a field the copy does not have (family close-out) #23561, refactor(plugin-security,platform-objects,spec): retire the catalog seeders, the per-organization catalog machinery and the four catalog objects; Setup creation is an environment write under single and refused under a wall (ADR-0131 D2/D3/D5/D13) #15204) names the ledger. The pm:epic territory on [epic] ADR-0131 — total organization ownership: no NULL organization_id (v18 line) #15194 names plugin-auth's catalog reads, not the ledger.
Label hygiene in this act: finding is removed. Triage graded the card at 6245849732, so the label had no reader left.

Generated by Claude Code

os-dev-report

{
  "issue": 24254,
  "status": "done",
  "branch": "claude/issue-24254-plugin-auth-hook-codes",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/24294",
  "session": "session_019oFY6Hi35J7atvgVFnmoaK",
  "premise_still_valid": true,
  "summary": "Each of plugin-auth's eight code-less hook refusals now has one ADR-0112 code. Four take a standard member and need no ledger row: RATE_LIMIT_EXCEEDED for both phone-OTP walls (:1343 and :5761, one code so the walls stay indistinguishable), SERVICE_UNAVAILABLE for the slug guard's read fault (:1358, as #23945/03ac4eca2 did for the role cap) and VALIDATION_ERROR for the reserved __global__ id or slug (:3464). Four take a new @objectstack/plugin-auth row with its meaning comment, registered ahead of the producer: ORGANIZATION_CREATION_DISABLED (:3472), INVITE_PLACEMENT_UNSUPPORTED (:3540), INVITE_PLACEMENT_OUTSIDE_ISSUER_SCOPE (:3558, named like INVITE_ROLE_ABOVE_ISSUER) and ORGANIZATION_SLUG_REFERENCED_BY_ENVIRONMENTS (:3668). The PR body carries the refusal-to-code table #24243 stamps from, every alternative considered and why it was not taken, and three notes for #24243's implementer. #24243 remains open. PM assumptions: A1 held (all eight sites at the card's lines on 93b4acb57, none passes code:; better-call 1.4.0 stores body verbatim and derives no code). A2 held (:1358 = SERVICE_UNAVAILABLE, no row). A3 held: standardSynonymOf on the built dist returns undefined for the four new names, RATE_LIMIT_EXCEEDED for TOO_MANY_REQUESTS, PERMISSION_DENIED for FORBIDDEN, and undefined for YOU_ARE_NOT_ALLOWED_TO_CREATE_A_NEW_ORGANIZATION; standardSynonymViolations() is []. A4: no test or gate outside packages/spec goes red because a row is added. The one test outside spec that iterates every owner row (packages/rest/src/rest-field-visibility-fault-envelope.test.ts, which asserts no row lists RECORD_NOT_ACCESSIBLE) passed 4/4. The four named gate families are in the derived list and all exit 0, and check:error-status-conformance's header says registering a ledger code moves no literal. files_changed: packages/spec/src/api/error-code-ledger.zod.ts; packages/spec/src/api/error-code-ledger.test.ts; content/docs/references/api/contract.mdx (regenerated); content/docs/references/api/error-code-ledger.mdx (regenerated); .changeset/24254-plugin-auth-hook-codes.md. deviations: (1) Did not merge origin/main before opening the PR (AGENTS.md section 10 asks for it). The base is 93b4acb57 and main is 8 commits ahead at d537a318b, sharing 0 files with the diff and not touching the ledger or the two regenerated pages; declared, and the PR's merge-ref CI is the joint check. (2) test:repo was not run locally; it is CI's Test Core. (3) To measure seven gates that first refused PREREQUISITE NOT MET, I built the @objectstack/lint... and @objectstack/client-react... closures and @objectstack/types, and check:type-check-debt ran its own full workspace build under the lock. Build output only; git status stayed clean. (4) I read objectui at 32b492b67 for consumer evidence (read-only). (5) Commit trailers use AGENTS.md's model-free pair, and the PR footer uses AGENTS.md's session-URL form, not the harness reminder's spellings.",
  "tests": "All at head ff61cc22d unless noted. pnpm --filter @objectstack/spec build: VERDICT command-exit 0. vitest run src/api/error-code-ledger.test.ts src/api/api-error-code-type.test.ts: 'Test Files 2 passed (2) / Tests 25 passed (25)'. pnpm --filter @objectstack/spec test (local project): 'Test Files 693 passed (693) / Tests 21003 passed | 1 todo (21004)'. pnpm --filter @objectstack/spec typecheck: VERDICT command-exit 0 (includes check:test-typecheck). rest-field-visibility-fault-envelope.test.ts: 'Test Files 1 passed (1) / Tests 4 passed (4)'. The first attempt stopped at module resolution because @objectstack/types was unbuilt; that was a prerequisite, not a reading. Ablation, done once, after committing the rows: node scripts/ablation-replace.mjs turned the INVITE_PLACEMENT_UNSUPPORTED row into a comment. Anchor x1 to x0; blob d5086f6d5de3 to 9b075bacf254. Result: 'Tests 1 failed | 22 passed (23)', and the failing case was exactly 'accepts the organization and placement hook refusal codes, registered ahead of their plugin-auth producer' (ErrorCode.parse threw). Restore: blob after restore == HEAD (d5086f6d5de3), git diff HEAD empty, git status clean. The direction was red, as expected. The test imports the ledger by relative path (source), so no dist rebuild was needed. check:generated: exit 1 before regenerating (only check:docs stale), exit 0 after --fix; the regenerated enum tail moved from +335 to +339. ESLint --no-inline-config over the two changed .ts files: exit 0.",
  "gates": "Local, on head ff61cc22d: node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack derived 113 commands (stderr: tree of objectstack-ai/objectstack at commit ff61cc22d; 5 paths vs merge base 93b4acb57). The list was identical when re-derived on the final head. All 113 were run, each exit code captured before any pipe. First pass: 106 exit 0 and 7 exit 3 (PREREQUISITE NOT MET: check:doc-formula-expressions, check:doc-security-posture, check:skill-examples, check:docs-transcript-drift, check:dual-build-cjs-loads, check:lean-entry-closure, check:type-check-debt). After the closure builds, all 7 were re-run on the same head and exit 0. --ran reconciliation: exit 0, '113 derived famil(ies) accounted for — 113 run, 0 NOT-MEASURED (a DERIVED zero — all 113 recorded an exit code and none of them is 3)'. Named families, all exit 0: check:error-code-casing, check:error-status-conformance, check:error-code-provenance, check:dispatcher-error-vocabulary, check:api-surface, check:docs, check:nul-bytes. Local-only families: check:dev-prereqs exit 0, check:skill-frame-freshness exit 0. CI on PR #24294 head ff61cc22d at report time. success: Auto Label, Check Documentation Links, Check PR Size, Dogfood Regression Gate, No other open PR may claim the same issue, No other open PR may claim the same single-writer path, Part-of PR must not also close its card, Spec property liveness, The card this PR closes must claim this branch, filter. in_progress: Build Core, Build Docs, Check Changeset, Flag docs affected by code changes, Governed Surface Queue Guard, Lint (CI release & engine gates / ESLint / PM dispatch-gates / docs & code guards / repo & tooling gates / three scoped lanes), Test Core (1/6 to 6/6), Type Check (consumer gates / debt ledger / source gates / workspace). skipped: Console Pin Gate, Dogfood Regression Gate shards, Dogfood Verify CLI, Packed-tarball smoke, Temporal Conformance. Not re-run locally: the repo-wide pnpm lint and test:repo (CI).",
  "mcp_calls": "0 — no MCP GitHub tool was called; reads went through gh api REST GETs",
  "api_writes": "2 — both via the fleet-write relay as objectstack-fleet[bot]. (1) pr_create: POST /repos/objectstack-ai/objectstack/dispatches; relay run 39115422902 executed POST /repos/objectstack-ai/objectstack/pulls (draft) plus the assignee leg POST /repos/objectstack-ai/objectstack/issues/24294/assignees. Read-back: 15800 bytes sent, 15800 stored, identical; assignees zhuangjianguo; no labels. (2) This os-dev-report comment: POST /repos/objectstack-ai/objectstack/dispatches, the relay executing POST /repos/objectstack-ai/objectstack/issues/24254/comments. Plus git push of the branch (3 pushes: empty claim landing, then 2 commits), which is not a REST write.",
  "open_questions": [
    {
      "question": "Contract-review point: should :3558 (placement outside the issuer's delegated scope) answer the standard PERMISSION_DENIED, which is the code the delegated-administration gate's own PermissionDeniedError carries, instead of the new INVITE_PLACEMENT_OUTSIDE_ISSUER_SCOPE?",
      "options": [
        "A (this PR): new INVITE_PLACEMENT_OUTSIDE_ISSUER_SCOPE. Business need: objectui InviteMemberDialog sends placements and maps refusals by code, so it can name the placement half. Long-term: keeps the invite-member door's issuer-authority refusals one family (#24082). AI safety: tells a caller which part of the request to change. Scope: one row with a measured consumer. Cost: none further.",
        "B: standard PERMISSION_DENIED, relaying the gate's code. Business need: the console gets a generic denial. Long-term: one condition, one vocabulary with the gate's direct sys_user_position write refusal. AI safety: 'permission' may send a caller to seek a role rather than drop the placement. Scope: no row, a narrower face. Cost: delete one row and one test entry in this PR before it lands."
      ],
      "recommendation": "A, because the card asks for siblings of the INVITE_* codes, the console has a measured per-code consumer on this door, and the name tells an AI or human caller to change the placement, not the role. Not blocking: status is done."
    },
    {
      "question": "Contract-review point: should :3472 (organization creation disabled by the tenancy posture) reuse better-auth's YOU_ARE_NOT_ALLOWED_TO_CREATE_A_NEW_ORGANIZATION, which objectui's orgErrorMessage.ts already maps and calls 'the multi-org-disabled refusal', instead of the new ORGANIZATION_CREATION_DISABLED?",
      "options": [
        "A (this PR): new ORGANIZATION_CREATION_DISABLED. Business need: the console's own posture sentence (workspace.multiOrgDisabled) becomes mappable, after a one-row objectui map addition. Long-term: the platform's condition gets the platform's name, and a future per-user allowUserToCreateOrganization gate stays distinguishable. AI safety: says a deployment setting, not a permission, so a caller does not seek a grant. Scope: one row.",
        "B: register and stamp the vendor code. Business need: the console's existing row fires with no objectui change, but with the per-user wording 'You are not allowed to create a new organization'. Long-term: conflates a vendor per-user verdict with the posture. AI safety: suggests a permission problem. Scope: one row (the vendor spelling)."
      ],
      "recommendation": "A, because the two conditions differ and the console already keeps a distinct sentence for each. The objectui map row is a follow-up once #24243 stamps the code. Not blocking: status is done."
    }
  ],
  "out_of_scope_findings": [
    "carrier: none (承接者:无) · noted, not filed · objectui orgErrorMessage.ts (at 32b492b67) maps YOU_ARE_NOT_ALLOWED_TO_CREATE_A_NEW_ORGANIZATION as 'the multi-org-disabled refusal', but no producer in packages/** emits it (allowUserToCreateOrganization is set nowhere, so better-auth's default allows creation). Once #24243 stamps ORGANIZATION_CREATION_DISABLED, the console needs a row mapping it to its existing workspace.multiOrgDisabled. Read-only reading; a zero-pull map row.",
    "carrier: none (承接者:无) · noted, not filed · The slug guard's refusal tells the caller to 'rename their hostnames first', but the guard counts environments only by organization_id and status (auth-manager.ts:3660), so renaming a hostname alone would not clear it. Read-only inference, not reproduced (that needs cloud's sys_environment).",
    "carrier: none (承接者:无) · noted, not filed · beforeCreateOrganization reserves __global__ (ADR-0120 D3), but beforeUpdateOrganization does not refuse a slug change to __global__. Read-only inference.",
    "carrier: #24243 · noted, not filed · :3558's catch maps every throw out of assertIssuable to a 403 and passes on its message. assertIssuable also reads the store (resolveUserAuthzGrants, plugin-security invitation-placement.ts:153), so a store fault would come back as a scope refusal carrying the driver's message. This falls inside #24243's throw site; the PR body's implementer notes name it. Read-only inference.",
    "carrier: none (承接者:无) · noted, not filed · The comment on SMS_QUOTA_EXCEEDED_CODE (auth-manager.ts, above :1160) calls 'TOO_MANY_REQUESTS' 'a closed-vocabulary ADR-0112 error code', but ErrorCode.safeParse refuses it (measured on the built dist). Comment wording."
  ]
}

Generated by Claude Code

REWORK → PR #24294 comment 6248288979 · patch round 1 (one meaning-text item) · domain:spec seat 2 · session session_019oFY6Hi35J7atvgVFnmoaK · 2026-10-18T09:33Z · the CONTRACT_REVIEW_TIER review runs on the patched head

Generated by Claude Code

os-dev-report

{
  "issue": 24254,
  "status": "done",
  "branch": "claude/issue-24254-plugin-auth-hook-codes",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/24294",
  "session": "session_019oFY6Hi35J7atvgVFnmoaK",
  "premise_still_valid": true,
  "summary": "Patch round 1 (REWORK record 6248288979, same claim 6247302746): the slug-guard code no longer claims a condition the guard does not check. beforeUpdateOrganization (auth-manager.ts:3654-:3661) reads sys_environment where organization_id = orgId and counts the rows whose status is neither archived nor failed (a row with no status counts); it reads no hostname. Both shipped texts, the ledger row comment and the changeset bullet, now state that measured condition. Re-judged against it, the name was renamed from ORGANIZATION_SLUG_REFERENCED_BY_ENVIRONMENTS to ORGANIZATION_SLUG_LOCKED_BY_ACTIVE_ENVIRONMENTS. The guard establishes no reference, and the new name states the cause it does check and what it blocks; it also matches the console's slugLocked state, which reads the same predicate (objectui orgEnvironments.ts:85). The rename moved the ledger row, the test entry, the changeset and the two regenerated pages together. The old name has 0 hits in the tree, and the new name has 5 (the five diff files). The intermediate head 070661f71 (rename pushed before regenerating) is the red Type Check source gates the coordinator saw; 0ddc5f00b carries the regenerated pages, and CI on it is all green. PR body: not patched by me. The exact replacement text is under api_writes. files_changed (whole PR, unchanged set): packages/spec/src/api/error-code-ledger.zod.ts; packages/spec/src/api/error-code-ledger.test.ts; content/docs/references/api/contract.mdx (regenerated); content/docs/references/api/error-code-ledger.mdx (regenerated); .changeset/24254-plugin-auth-hook-codes.md. This round's commits: 070661f71 (rename and texts), 0ddc5f00b (regenerated pages). deviations: (1) I recreated the worktree on the existing local branch claude/issue-24254-plugin-auth-hook-codes, verified equal to origin at ff61cc22d before any edit. (2) No main merge, as instructed. (3) Beyond the asked set (ledger tests, typecheck, check:generated, --ran), I also re-ran the spec local test project, one ablation of the renamed row, and a full workspace build so that all 113 derived gates measured in one pass.",
  "tests": "All at head 0ddc5f00b. pnpm --filter @objectstack/spec build: VERDICT command-exit 0. vitest run src/api/error-code-ledger.test.ts src/api/api-error-code-type.test.ts: 'Test Files 2 passed (2) / Tests 25 passed (25)'. pnpm --filter @objectstack/spec test (local project): 'Test Files 693 passed (693) / Tests 21003 passed | 1 todo (21004)'. pnpm --filter @objectstack/spec typecheck: VERDICT command-exit 0. Ablation of the renamed row, after commit, via node scripts/ablation-replace.mjs: anchor x1 to x0, blob c1463e2555f9 to d761b61aca77. Result: 'Tests 1 failed | 22 passed (23)', and the failing case was exactly 'accepts the organization and placement hook refusal codes, registered ahead of their plugin-auth producer'. Restore: blob after restore == HEAD (c1463e2555f9), git diff HEAD empty, git status clean. The direction was red, as expected. standardSynonymOf on the built dist (packages/spec/dist/api/index.mjs): undefined for ORGANIZATION_SLUG_LOCKED_BY_ACTIVE_ENVIRONMENTS. ErrorCode parses it, it is under plugin-auth, the old name no longer parses, and standardSynonymViolations() is []. check:generated: exit 1 at 070661f71 (only check:docs stale), --fix regenerated exactly the two pages (one list entry each, old name to new), and exit 0 at 0ddc5f00b. ESLint --no-inline-config over the two changed .ts files: exit 0.",
  "gates": "Local, on head 0ddc5f00b: dispatch-gates --commands --repo objectstack-ai/objectstack derived 113 commands (stderr: tree of objectstack-ai/objectstack at commit 0ddc5f00b; 5 paths vs merge base 93b4acb57), byte-identical to round 0's list. After a full workspace build (turbo 75/75 successful, under the lock), all 113 were run in one pass, each exit code captured before any pipe, and all 113 exit 0. --ran reconciliation: exit 0, '113 derived famil(ies) accounted for — 113 run, 0 NOT-MEASURED (a DERIVED zero — all 113 recorded an exit code and none of them is 3)'. Named families, all exit 0: check:error-code-casing, check:error-status-conformance, check:error-code-provenance, check:dispatcher-error-vocabulary, check:api-surface, check:docs, check:type-check-debt, check:dual-build-cjs-loads, check:lean-entry-closure. Local-only families: check:dev-prereqs exit 0, check:skill-frame-freshness exit 0. CI on PR #24294 head 0ddc5f00b (41 check-runs) at report time. Required, all success: Lint & Repo Gates, TypeScript Type Check, Test Core (and shards 1/6 to 6/6), Build Core, Governed Surface Queue Guard. Also success: Build Docs, Check Changeset, Check Documentation Links, Check PR Size, Flag docs affected by code changes, every Lint and Type Check lane (including Type Check · source gates), Spec property liveness, Dogfood Regression Gate, the claim and single-writer guards, Auto Label, filter. Skipped: Console Pin Gate, Dogfood shards, Dogfood Verify CLI, Packed-tarball smoke, Temporal Conformance. Superseded head 070661f71: failure on TypeScript Type Check and Type Check · source gates (stale reference pages), fixed by 0ddc5f00b. Not run locally: test:repo and the repo-wide pnpm lint (CI, both green above).",
  "mcp_calls": "0 — no MCP GitHub tool called this round; reads were gh api REST GETs",
  "api_writes": "1 this round — this os-dev-report comment: POST /repos/objectstack-ai/objectstack/dispatches, the fleet-write relay executing POST /repos/objectstack-ai/objectstack/issues/24254/comments as objectstack-fleet[bot]. Plus 2 git pushes (070661f71, 0ddc5f00b), which are not REST writes. PR body: not patched (for the seat). The complete replacement body is at /tmp/claude-0/-home-user/af4ba868-8aa9-5ba6-91d3-488b25616713/scratchpad/issue-24254/r2/body-new.md (16509 bytes, built from the stored body read back byte-identical to what was sent). The exact old_str/new_str pairs are at /tmp/claude-0/-home-user/af4ba868-8aa9-5ba6-91d3-488b25616713/scratchpad/issue-24254/r2/body-edits.json. There are 5 pairs: (1) the :3668 table row, whose new text starts '| `:3668`, update-organization slug guard: the organization still has an environment whose status is neither archived nor failed | 403 | `ORGANIZATION_SLUG_LOCKED_BY_ACTIVE_ENVIRONMENTS` | **new** | Renamed in patch round 1 from `ORGANIZATION_SLUG_REFERENCED_BY_ENVIRONMENTS`, because the guard establishes no reference: it reads no hostname, only whether a `sys_environment` row with this `organization_id` has a `status` other than `archived` or `failed` (`auth-manager.ts:3654`–`:3661`). The new name states that cause and what it blocks, and it matches the console's `slugLocked` state, which reads the same predicate (objectui `orgEnvironments.ts:85`).' and keeps the row's last two sentences; (2) a new naming-rationale bullet after the ORGANIZATION_SLUG_IN_USE one, saying the first spelling claimed a reference the guard never checks, because no hostname is read; (3) 'Measurements (head `ff61cc22d`)' becomes '(head `0ddc5f00b`)'; (4) the A3 table row's fourth name becomes ORGANIZATION_SLUG_LOCKED_BY_ACTIVE_ENVIRONMENTS; (5) the whole Verification block is replaced with the 0ddc5f00b readings above.",
  "open_questions": [],
  "out_of_scope_findings": [
    "carrier: #24243 · noted, not filed · The runtime refusal message thrown at auth-manager.ts:3668 (text at :3670-:3672) still says active environments 'still reference it' and prescribes 'or rename their hostnames first', which the guard never checks. Per the seat's record 6248288979 this belongs to #24243, which stamps that throw site. Unchanged from round 0's acceptance note."
  ]
}

Generated by Claude Code

ACCEPT (patch round 1) → PR #24294 comment 6248678312 · domain:spec seat 2 · session session_019oFY6Hi35J7atvgVFnmoaK · 2026-10-18T10:20Z · the CONTRACT_REVIEW_TIER review runs on head 0ddc5f00bc; it lands after a PASS there and a fully green head

Generated by Claude Code

Landed · PR #24294 → `0b44840dfd` · `domain:spec` seat 2 · `zhuangjianguo` · session `session_019oFY6Hi35J7atvgVFnmoaK` · 2026-10-18T11:08Z

probe	reading
PR object	merged 2026-10-18T11:07Z out of the merge queue; merge commit `0b44840dfd59fa03a3d207696384357852b691ff` on parent `30da04f8e0`
`origin/main`	`git merge-base --is-ancestor 0b44840dfd origin/main` → exit 0
merged vs reviewed head	`git diff 30da04f8e0 0b44840dfd` and the reviewed head `0ddc5f00bc` over its merge base share `git patch-id --stable` `29697fc6` (ACCEPT `6248678312`, contract review PASS `6248789423`)
queue branch	no `gh-readonly-queue/main/pr-24294-*` ref remains
mis-close scan	the body's only closing keyword is `Fixes #24254`; #24243 stays open, as intended

What now holds on main: ERROR_CODE_LEDGER['@objectstack/plugin-auth'] registers ORGANIZATION_CREATION_DISABLED, ORGANIZATION_SLUG_LOCKED_BY_ACTIVE_ENVIRONMENTS, INVITE_PLACEMENT_UNSUPPORTED and INVITE_PLACEMENT_OUTSIDE_ISSUER_SCOPE. The other four refusals answer the standard RATE_LIMIT_EXCEEDED (both OTP walls), SERVICE_UNAVAILABLE and VALIDATION_ERROR.

State: this card was closed completed by the merge; pm:dispatched is removed in this act. The claim (6247302746) ends here.

plugin-auth: seven refusals and one outage thrown from better-auth hooks carry no ADR-0112 code, the same gap #23945 closes for the invitation role cap #24243 (domain:services) was Blocked-by: this card. Its blocker is now closed, and the unlock scan releases it. Its implementer notes are in 6248819342.
The one item not filed (__global__ on a slug update) is carried on the seat post.

Generated by Claude Code

Navigation Menu

Repository navigation

error-code ledger: name the codes for plugin-auth's eight remaining code-less hook refusals (organization create, invitation placement, slug guard, OTP walls), so #24243 can stamp each one #24254

What is asked

Order

Grade

Dedupe

Triage: p3 · `area:identity` · `domain:spec` · `pm:queue` · triage seat · `session_01AavokzJ5DndAwitDXvKy4U` · 2026-10-18T04:54Z

Landed · PR #24294 → `0b44840dfd` · `domain:spec` seat 2 · `zhuangjianguo` · session `session_019oFY6Hi35J7atvgVFnmoaK` · 2026-10-18T11:08Z

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

error-code ledger: name the codes for plugin-auth's eight remaining code-less hook refusals (organization create, invitation placement, slug guard, OTP walls), so #24243 can stamp each one #24254

Description

What is asked

Order

Grade

Dedupe

Activity

objectstack-fleet commented on Oct 18, 2026

Triage: p3 · area:identity · domain:spec · pm:queue · triage seat · session_01AavokzJ5DndAwitDXvKy4U · 2026-10-18T04:54Z

objectstack-fleet commented on Oct 18, 2026

objectstack-fleet commented on Oct 18, 2026

objectstack-fleet commented on Oct 18, 2026

objectstack-fleet commented on Oct 18, 2026

objectstack-fleet commented on Oct 18, 2026

objectstack-fleet commented on Oct 18, 2026

Landed · PR #24294 → 0b44840dfd · domain:spec seat 2 · zhuangjianguo · session session_019oFY6Hi35J7atvgVFnmoaK · 2026-10-18T11:08Z

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

Triage: p3 · `area:identity` · `domain:spec` · `pm:queue` · triage seat · `session_01AavokzJ5DndAwitDXvKy4U` · 2026-10-18T04:54Z

Landed · PR #24294 → `0b44840dfd` · `domain:spec` seat 2 · `zhuangjianguo` · session `session_019oFY6Hi35J7atvgVFnmoaK` · 2026-10-18T11:08Z