From 6bb2d053d6817f4177f8b73752865ad18abeb38e Mon Sep 17 00:00:00 2001 From: Claude Date: Thu, 6 Aug 2026 13:36:32 +0000 Subject: [PATCH] docs(plugins): teach OS_TENANCY_POSTURE, not the demoted OS_MULTI_ORG_ENABLED (#5887) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The `@objectstack/organizations` bullet was the last place in content/docs teaching the legacy boolean as the enable switch. Under `resolveTenancyPosture()` it is only a fallback INPUT, read when `OS_TENANCY_POSTURE` is unset, and it can only derive `isolated` — the `group` posture (`organization_id IN accessible_org_ids`, ADR-0105 D2) is unreachable from any spelling of it, so a reader following this page could reach only one of the two walled postures. packages/types/src/env.ts:89-122 additionally calls gating application code on that boolean a bug (cloud#1020, #5233). Switch the bullet to `OS_TENANCY_POSTURE=group|isolated`, keep the accurate `OS_ALLOW_DEGRADED_TENANCY=1` escape hatch, mention the legacy boolean only as a compat input, and link the authoritative page rather than repeat its resolution table. The Features bullet's "rows never leak across organizations" was isolated-only wording; restated in terms of the caller's organization scope so it holds under `group` too. Co-Authored-By: Claude Fable 5 Claude-Session: https://claude.ai/code/session_01BDmDsu2575gDxeMCxXhDE3 --- content/docs/plugins/packages.mdx | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/content/docs/plugins/packages.mdx b/content/docs/plugins/packages.mdx index 36b09dfb24..7c634055bf 100644 --- a/content/docs/plugins/packages.mdx +++ b/content/docs/plugins/packages.mdx @@ -331,8 +331,8 @@ All services implement contracts from `@objectstack/spec/contracts` and are kern **Organization Scoping** — Multi-org (a.k.a. "soft" multi-tenant) row-level scoping. Ships as a **separate, closed-source enterprise package** — it is not part of the open framework repo. It composes with the Layer 0 tenant wall in `plugin-security` (`tenant-layer.ts`). -- **Features**: `organization_id` auto-stamp on insert; every query is AND-composed against the tenant wall so rows never leak across organizations -- **When to use**: Multi-organization SaaS where every row is scoped to an organization. Enable by setting `OS_MULTI_ORG_ENABLED=true` and installing `@objectstack/organizations`; if the flag is set but the package is missing, the platform refuses to boot (override with `OS_ALLOW_DEGRADED_TENANCY=1`) +- **Features**: `organization_id` auto-stamp on insert; every query is AND-composed against the tenant wall, so no row outside the caller's organization scope is ever returned +- **When to use**: Multi-organization SaaS where every row is scoped to an organization. Enable by setting `OS_TENANCY_POSTURE` to a walled posture — `group` (union read across every organization the caller belongs to) or `isolated` (the hard per-organization wall) — and installing `@objectstack/organizations`; if a walled posture is requested but the package is missing, the platform refuses to boot (override with `OS_ALLOW_DEGRADED_TENANCY=1`). The legacy `OS_MULTI_ORG_ENABLED` boolean is still honoured, but only as a fallback **input** when `OS_TENANCY_POSTURE` is unset, and it can only ever select `isolated` — never gate application code on it (ADR-0105 D1). See [Tenancy Postures & Membership](/docs/deployment/tenancy-modes) for how the posture resolves ### @objectstack/plugin-audit