Walled postures must not elevate the first self-registrant: platform admin comes ONLY from an env-declared owner email; self-signups never join the Default Organization — ruled fix for cloud#1509

[os-zhuang]

Filed by the triage seat as the framework leg of objectstack-ai/cloud#1509 (measured p0: on a walled multi-tenant SaaS with OS_TENANCY_POSTURE=isolated + OS_AUTH_MEMBERSHIP_POLICY=invite-only, the FIRST self-registrant received platform_admin + isPlatformAdmin: true and was merged into the deployment's Default Organization — full curl evidence on the cloud card).

Maintainer ruling (2026-08-23, live PM chat, verbatim: 「1509 选择 env 指定 owner 邮箱」— option A with the env-owner-email bootstrap):

1. Under walled postures (isolated / group), the "first registrant becomes owner/platform admin" path is REMOVED. Platform admin is granted only to the account matching an env-declared owner email (exact variable name is the implementer's to propose in the PR — follow existing OS_* naming conventions and document it in the composed template).
2. Under walled + invite-only, NO self-registrant is auto-merged into the Default Organization — it belongs to the operator only. (Second registrant behavior measured today — 0 orgs, routed to create-workspace — is the correct shape for ALL self-registrants including the first.)
3. Single-org posture keeps "first user is owner" — that default is ruled reasonable and out of scope here.
4. Fail-closed clause: walled posture + no owner email declared ⇒ refuse startup with a message naming the variable (matching the existing walled "undeclared knob ⇒ refuse" style), rather than silently reverting to first-registrant elevation.

Establish-first

Locate the elevation site(s) (plugin-auth bootstrap / first-user logic) and the Default-Org auto-join site before writing; report the map in the PR. Pin both directions: (a) walled + declared owner email ⇒ only that account elevates, self-signups get positions: ["user"] and no org; (b) single-org posture unchanged.

Security surface: dispatch per lane discipline at judgment tier; refusal cases carry code+status.

Downstream: objectstack-ai/cloud#1509 is the acceptance leg (blocked on this card) — composed template docs (composed.env.example wording) and the live re-verification happen there after the pin bump.

Refs: objectstack-ai/cloud#1509 (measurement + ruling record).

[os-sam]

Claim: PM loop round 1
Session: session_01APWX2AwT3a4xDcjPCe8bk4
Branch: claude/issue-11184-env-owner-email-walled-elevation
Worktree: objectstack-issue-11184
Domain: domain:services
File surface: packages/plugins/plugin-security/src/bootstrap-platform-admin.ts, the plugin-auth Default-Organization auto-join site (ensureDefaultOrganization), the posture/knob declaration site, and their tests + changeset (stop on breach; explain in the report)
Container & model: L, mode:subagent, model: fable — ⛔ Clause-② mandate, not a judgment call. Tier read live this round at scripts/pm/dispatch-gates.mjs:2732 (CONTRACT_REVIEW_TIER = 'claude-fable-5'); the previous seat recorded 2732's predecessor 2722 forty minutes ago and 1932 before that — the line moves, so it is re-read, never recalled.
Clause-②: yes
Serial constraints cleared: PR #11183 (draft, awaiting contract review) holds plugin-security/src/security-plugin.ts — a different file in the same package, so this claim takes bootstrap-platform-admin.ts and ⛔ must not touch security-plugin.ts. #11097 and #11096 are serialized behind this card (same bootstrap-* region of plugin-security) and are not dispatched this round. plugin-auth/** is one hot surface and no other card holds it. No other in-flight card in this lane.

Clause-② determination

dispatch-gates --tier on this surface returns "no path-derived mandate". ⛔ That line is a floor, never a clearance — it says so itself. Judged from card content, this is yes on three independent grounds, any one of which would suffice:

1. It removes an elevation path (first-registrant ⇒ platform_admin) under walled postures — a change to runtime accept/reject on a declared security semantic.
2. It adds a startup refusal (walled posture + no declared owner email ⇒ refuse to boot), which is new reject behaviour.
3. It introduces a new public OS_* knob, widening the operator-facing surface.

Consequence, and this seat holds to it: the PR stays draft, needs:contract-review is on this card from claim time (⛔ not deferred to PR-open — a gate label that is missing reads as clearance, and "stripped" is indistinguishable from "never applied"), and this seat cannot clear it — it runs at claude-opus-5, below CONTRACT_REVIEW_TIER. ⛔ No self-clear, no ready-flip, no auto-merge. Next owner after ACCEPT is a contract-review seat at tier.

⚠️ Note that dispatching the dev at fable does not retire the review: a mode:subagent dev cannot self-evidence its served tier (get_session inside a subagent measures the dispatching session), so the Clause-② review chain is preserved regardless.

Premise check — done at claim time, on origin/main

Card filed 01:26Z, ~45 min old, so the action face is fresh; checked anyway:

• Elevation site located and confirmed present: plugin-security/src/bootstrap-platform-admin.ts (299 lines) — :285 [security] first user promoted to platform admin, :264 the "no human users yet" precondition, :287 the seeded-record ownership handoff via claimSeedOwnership.
• Default-Org auto-join is a separate plugin by that file's own docblock (:16–18), which names ensureDefaultOrganization — so the ruling's clause 1 and clause 2 land in two different packages. That split is the load-bearing part of the map and is why this is graded L, not M.
• plugin-auth has taken 12 commits recently (top: 26dea14956, bbe643c087, 03bdd148ee); no landing removes or relocates the elevation path. Premise holds.

---

Generated by Claude Code