feat(authz): scoped invitations — placement intent gated by the issuer's adminScope, applied on acceptance (ADR-0105 D8)

[os-zhuang]

ADR-0105 D8 engine (the open half of "scoped invitations — engine seam open; UX commercial"). Builds on #3645. Tracking: #3541.

Why the gate and the carrier ship in one PR

I started this as a carrier-only change (fields + whitelist) with placement application planned cloud-side, and found that split is unsafe:

organization_admin is deliberately read-only on the RBAC tables (auto-org-admin-grant.ts: "so a freshly-granted org admin cannot rebind themselves to admin_full_access"). If the platform applied an invitation's placement payload under system context without checking the issuer, an org admin could assign any position to anyone by routing it through an invitation — recovering exactly the authority that read-only stance denies them. And a framework that declares placement fields nothing applies is the declared ≠ enforced trap AGENTS.md #10 exists to prevent. So: carrier + gate + application, together, open.

What

• Issuance is authorized against the ISSUER's adminScope (ADR-0090 D12) — judged at issuance, while the actor is the inviter, not at acceptance when the actor is the invitee. The check dry-runs the existing DelegatedAdminGate against the very sys_user_position rows the acceptance would write, which is ADR-0105 D8's "the existing anti-escalation gate, reused verbatim" taken literally: one copy of the subtree/allowlist/containment logic, so a future tightening of the gate tightens invitations in the same commit. A refusal rejects the whole invitation (no row created).
• Acceptance applies it under system context — idempotent (a replayed acceptance converges instead of duplicating assignments) and failure-isolated (a placement miss never undoes a valid membership; the onInvitationAccepted host seam still fires).
• Fail closed: an invitation requesting placement in a deployment without the delegated-administration runtime is refused, never silently placed unchecked.

Surface

Package	Change
platform-objects	sys_invitation.business_unit_id + .positions
plugin-auth	ADR-0092 whitelist entry (D7 collision guard covers it automatically); not in the editable map — placement is settable only at issuance, through the gate. better-auth schema.invitation.additionalFields so the columns are real and the invite endpoint carries the request; beforeCreateInvitation / afterAcceptInvitation wiring; lazy invitation-placement resolver (plugin-security starts after plugin-auth)
plugin-security	new invitation-placement service — assertIssuable / apply

An invitation without placement intent never consults the gate and behaves exactly as before.

Verification

• plugin-security 602, plugin-auth 528, platform-objects 215, spec 6659, core 386, runtime 654 — all green.
• New coverage: intent parsing (camel/snake/JSON-round-tripped/absent), the gate receives the right operation shape and its refusal propagates, apply is idempotent + system-context + stamps granted_by, and the four hook paths (authorized, refused, no-runtime-⇒-refused, ordinary invitation untouched, placement-failure-keeps-membership).
• Five repo grep guards clean; changeset included (minor ×3).

Follow-up (cloud, commercial)

The issuance UX on cloud#874: BU/position pickers constrained to the issuer's scope, over this now-gated seam. End-to-end HTTP verification belongs with that PR — ee-group-showcase is the natural home, since it already boots the enterprise runtime that registers this service.

🤖 Generated with Claude Code

https://claude.ai/code/session_015FebXPaaGrLhGKw1LHPbpL

---

Generated by Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
objectstack	Ignored		Jul 27, 2026 1:20pm

[github-actions]

📓 Docs Drift Check

This PR changes 3 package(s): @objectstack/platform-objects, @objectstack/plugin-auth, @objectstack/plugin-security.

17 hand-written doc(s) reference the affected code and may need an implementation-accuracy re-verification:

• content/docs/deployment/cli.mdx (via @objectstack/plugin-auth, @objectstack/plugin-security)
• content/docs/deployment/production-readiness.mdx (via @objectstack/plugin-auth)
• content/docs/kernel/services-checklist.mdx (via @objectstack/plugin-auth)
• content/docs/permissions/access-recipes.mdx (via packages/plugins/plugin-security)
• content/docs/permissions/authentication.mdx (via @objectstack/plugin-auth)
• content/docs/permissions/authorization.mdx (via @objectstack/plugin-security)
• content/docs/permissions/explain.mdx (via @objectstack/plugin-security)
• content/docs/permissions/permissions-matrix.mdx (via packages/plugins/plugin-security)
• content/docs/permissions/sharing-rules.mdx (via @objectstack/plugin-security)
• content/docs/permissions/sso.mdx (via @objectstack/plugin-auth)
• content/docs/plugins/index.mdx (via @objectstack/plugin-auth, @objectstack/plugin-security)
• content/docs/plugins/packages.mdx (via @objectstack/platform-objects, @objectstack/plugin-auth, @objectstack/plugin-security)
• content/docs/releases/implementation-status.mdx (via @objectstack/plugin-auth, @objectstack/plugin-security)
• content/docs/releases/v9.mdx (via @objectstack/plugin-auth)
• content/docs/ui/audience-based-interfaces.mdx (via packages/plugins/plugin-security)
• content/docs/ui/dashboards.mdx (via @objectstack/plugin-security)
• content/docs/ui/setup-app.mdx (via @objectstack/platform-objects)

Advisory only. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs origin/main → pass the list as args.docs.