feat(kernel): kernel:bootstrapped anchor + fix everyone auto-bind ordering (#2926 follow-ups) (#2989)

* feat(kernel): add kernel:bootstrapped lifecycle anchor

kernel:ready handlers run sequentially in plugin-registration order, so a
handler that consumes data produced by a later-starting plugin (security
bootstrap seeds sys_position; the app plugin's seed loader inserts records)
races the very rows it needs. Add kernel:bootstrapped — fired after every
kernel:ready handler has settled but before kernel:listening (HTTP socket
open) — as the correct anchor for reconcile/backfill work. Both ObjectKernel
and LiteKernel trigger it; ordering is locked by tests in kernel.test.ts and
lite-kernel.test.ts. The sharing-rule boot backfill moves from kernel:listening
to kernel:bootstrapped (semantics-only).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017bJWtKmZ2mFpRFAmmmoeqe

* fix(plugin-security): bind fallback set to everyone AFTER the anchor is seeded

The ADR-0090 D5 baseline auto-bind ran earlier in runBootstrap than
bootstrapBuiltinRoles, which creates the everyone position — so the everyone
lookup returned nothing and the app's isDefault set (resolved as
fallbackPermissionSet) was never bound. A fresh deploy booted with everyone
empty (personas silently degraded) plus a redundant sys_audience_binding_suggestion
for the same set. Move the auto-bind after bootstrapBuiltinRoles and before
syncAudienceBindingSuggestions so the documented app-level auto-bind actually
happens and the suggestion sync skips the already-bound set.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017bJWtKmZ2mFpRFAmmmoeqe

* chore(app-showcase): bind persona sets on kernel:bootstrapped; drop redundant everyone binding

The security plugin now auto-binds the app's isDefault set (showcase_member_default)
to everyone at boot, so the app glue no longer needs to. Keep only the persona →
set bindings the framework cannot infer, and move them from kernel:listening to
the kernel:bootstrapped anchor.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017bJWtKmZ2mFpRFAmmmoeqe

---------

Co-authored-by: Claude <noreply@anthropic.com>

Author: os-zhuang

.changeset/kernel-bootstrapped-anchor.md

@@ -0,0 +1,7 @@
+---
+'@objectstack/spec': minor
+'@objectstack/core': minor
+'@objectstack/plugin-sharing': patch
+---
+
+feat(kernel): add `kernel:bootstrapped` lifecycle anchor — the phase that fires after every `kernel:ready` handler has settled but before `kernel:listening` (HTTP socket open). `kernel:ready` handlers run sequentially in plugin-registration order, so a handler that consumes data produced by a later-starting plugin (e.g. the security bootstrap seeds `sys_position`; the app plugin's seed loader inserts records) would race the very rows it needs. `kernel:bootstrapped` is the correct anchor for reconcile/backfill work: every producer's ready handler has finished by the time it fires. Both `ObjectKernel` and `LiteKernel` trigger it. The sharing-rule boot backfill moves from `kernel:listening` to `kernel:bootstrapped` (semantics-only; behaviour unchanged).

.changeset/security-everyone-autobind-ordering.md

@@ -0,0 +1,5 @@
+---
+'@objectstack/plugin-security': patch
+---
+
+fix(plugin-security): bind the fallback permission set to the `everyone` anchor AFTER the anchor is seeded. The baseline auto-bind (ADR-0090 D5) ran earlier in `runBootstrap` than `bootstrapBuiltinRoles`, which creates the `everyone` position — so the `everyone` lookup returned nothing and the app's `isDefault` set was never bound, leaving a fresh deploy's `everyone` empty (personas silently degraded) and a redundant `sys_audience_binding_suggestion` filed for the same set. The auto-bind now runs after `bootstrapBuiltinRoles` and before `syncAudienceBindingSuggestions`, so the documented app-level auto-bind actually happens and the suggestion sync correctly skips the already-bound set.

content/docs/kernel/events.mdx

@@ -19,7 +19,8 @@ Triggered by the Kernel during bootstrap and shutdown:
 | Event | Description |
 | :--- | :--- |
 | `kernel:ready` | All plugins have successfully started. System is live. |
-| `kernel:listening` | Fired after every `kernel:ready` handler has completed (e.g. the HTTP server is accepting connections). |
+| `kernel:bootstrapped` | Fired after every `kernel:ready` handler has settled, before `kernel:listening`. The "all bootstrap + seed data is ready" anchor — use it for reconcile/backfill work that consumes data a later-starting plugin produces during `kernel:ready`. |
+| `kernel:listening` | Fired after every `kernel:ready` and `kernel:bootstrapped` handler has completed (e.g. the HTTP server is accepting connections). |
 | `kernel:shutdown` | Shutdown signal received. Plugins should clean up resources. |
 
 ### Listening to Kernel Events

content/docs/references/kernel/plugin-lifecycle-events.mdx

@@ -142,6 +142,7 @@ Plugin lifecycle event type
 ### Allowed Values
 
 * `kernel:ready`
+* `kernel:bootstrapped`
 * `kernel:listening`
 * `kernel:shutdown`
 * `kernel:before-init`

examples/app-showcase/src/data/seed/index.ts

@@ -165,7 +165,7 @@ const orgUnits = SeedSchema.parse({
 // [#2926 ②] Position ↔ permission-set bindings are NOT seeded here: the seed
 // loader runs before the security bootstrap creates the sys_position /
 // sys_permission_set rows, so the required name references cannot resolve.
-// They are ensured imperatively on kernel:listening instead (after every
+// They are ensured imperatively on kernel:bootstrapped instead (after every
 // kernel:ready handler, incl. the security bootstrap, has settled) — see
 // `src/security/bind-position-sets.ts` (wired via `onEnable`).
 

examples/app-showcase/src/security/bind-position-sets.ts

@@ -18,21 +18,18 @@
  * registration order (`kernel.ts` `trigger`). The showcase AppPlugin starts
  * BEFORE the Security plugin, so an app hook on `kernel:ready` runs *before*
  * the security bootstrap has created the position/set rows — the rows never
- * appear from inside that hook. We therefore bind on **`kernel:listening`**,
- * the phase the kernel fires only AFTER every `kernel:ready` handler has
- * completed (`kernel.ts` Phase 4 / `lite-kernel.ts`), so the bootstrap rows are
+ * appear from inside that hook. We therefore bind on **`kernel:bootstrapped`**,
+ * the anchor the kernel fires only AFTER every `kernel:ready` handler has
+ * settled (`kernel.ts` Phase 3.5 / `lite-kernel.ts`), so the bootstrap rows are
  * guaranteed present.
  *
- * `everyone → showcase_member_default` IS bound here. The security plugin only
- * auto-binds an app's `isDefault` set to `everyone` when that set is
- * application-owned; the showcase ships as a package, so its default lands in
- * `sys_audience_binding_suggestion` (pending admin confirmation) and is NOT
- * live until confirmed. Binding it here keeps the demo's baseline working out
- * of the box, idempotently and alongside the suggestion.
+ * `everyone → showcase_member_default` is NOT bound here: the security plugin
+ * auto-binds the app's `isDefault` set (resolved as its `fallbackPermissionSet`)
+ * to `everyone` at boot. This list only carries the persona → set bindings the
+ * framework cannot infer.
  */
 
 const BINDINGS: ReadonlyArray<readonly [position: string, permissionSet: string]> = [
-  ['everyone', 'showcase_member_default'],
   ['contributor', 'showcase_contributor'],
   ['manager', 'showcase_manager'],
   ['exec', 'showcase_executive'],
@@ -106,12 +103,12 @@ export function registerShowcasePositionBindings(ctx: BindHostContext): void {
     ctx.logger?.info?.('[showcase] position bindings ensured', { created, total: BINDINGS.length });
   };
 
-  // Bind on `kernel:listening` — the phase that fires only after every
+  // Bind on `kernel:bootstrapped` — the anchor that fires only after every
   // `kernel:ready` handler (incl. the security bootstrap that seeds the
-  // position/set rows) has completed. Fall back to a deferred immediate run
+  // position/set rows) has settled. Fall back to a deferred immediate run
   // if the host context somehow omits the hook registrar.
   if (typeof ctx.hook === 'function') {
-    ctx.hook('kernel:listening', run);
+    ctx.hook('kernel:bootstrapped', run);
   } else {
     setTimeout(() => void run(), 0);
   }

packages/core/src/kernel.test.ts

@@ -417,6 +417,24 @@ describe('ObjectKernel', () => {
             expect(kernel.getState()).toBe('stopped');
         });
 
+        it('fires kernel:ready → kernel:bootstrapped → kernel:listening in order', async () => {
+            const order: string[] = [];
+            const plugin: Plugin = {
+                name: 'lifecycle-order-plugin',
+                version: '1.0.0',
+                init: async (ctx) => {
+                    ctx.hook('kernel:listening', async () => { order.push('kernel:listening'); });
+                    ctx.hook('kernel:bootstrapped', async () => { order.push('kernel:bootstrapped'); });
+                    ctx.hook('kernel:ready', async () => { order.push('kernel:ready'); });
+                },
+            };
+
+            await kernel.use(plugin);
+            await kernel.bootstrap();
+
+            expect(order).toEqual(['kernel:ready', 'kernel:bootstrapped', 'kernel:listening']);
+        });
+
         it('should trigger shutdown hook', async () => {
             let hookCalled = false;
 

packages/core/src/kernel.ts

@@ -363,6 +363,15 @@ export class ObjectKernel {
             this.logger.debug('Triggering kernel:ready hook');
             await this.context.trigger('kernel:ready');
 
+            // Phase 3.5: Trigger kernel:bootstrapped AFTER every kernel:ready
+            // handler has settled — the "all bootstrap + seed data is ready"
+            // anchor. Reconcile/backfill work that consumes data produced by a
+            // later-starting plugin's kernel:ready handler belongs here, not in
+            // kernel:ready (where handler order would race the data). See
+            // packages/spec/src/contracts/plugin-lifecycle-events.ts.
+            this.logger.debug('Triggering kernel:bootstrapped hook');
+            await this.context.trigger('kernel:bootstrapped');
+
             // Phase 4: Trigger kernel:listening hook AFTER all kernel:ready
             // handlers have completed. This is the cue for HTTP server
             // plugins to actually open the listening socket — by now every

packages/core/src/lite-kernel.test.ts

@@ -251,4 +251,24 @@ describe('LiteKernel with Configurable Logger', () => {
             await kernel.shutdown();
         });
     });
+
+    describe('Lifecycle event ordering', () => {
+        it('fires kernel:ready → kernel:bootstrapped → kernel:listening in order', async () => {
+            const order: string[] = [];
+            const plugin: Plugin = {
+                name: 'lifecycle-order-plugin',
+                init: async (ctx) => {
+                    ctx.hook('kernel:listening', async () => { order.push('kernel:listening'); });
+                    ctx.hook('kernel:bootstrapped', async () => { order.push('kernel:bootstrapped'); });
+                    ctx.hook('kernel:ready', async () => { order.push('kernel:ready'); });
+                },
+            };
+
+            kernel.use(plugin);
+            await kernel.bootstrap();
+            await kernel.shutdown();
+
+            expect(order).toEqual(['kernel:ready', 'kernel:bootstrapped', 'kernel:listening']);
+        });
+    });
 });

packages/core/src/lite-kernel.ts

@@ -77,6 +77,10 @@ export class LiteKernel extends ObjectKernelBase {
 
         // Trigger ready hook (route/middleware registration phase)
         await this.triggerHook('kernel:ready');
+        // Trigger bootstrapped hook — "all bootstrap + seed data is ready"
+        // anchor, strictly after every kernel:ready handler has settled and
+        // before any HTTP socket opens (see plugin-lifecycle-events.ts).
+        await this.triggerHook('kernel:bootstrapped');
         // Trigger listening hook (HTTP servers open their socket here —
         // strictly after every kernel:ready handler has completed).
         await this.triggerHook('kernel:listening');