fix(security): reconcile audience-binding suggestions per organization (#8617) (#8674)

* fix(security): reconcile audience-binding suggestions per organization (#8617)

The reconciler read and wrote through a module-level `SYSTEM_CTX = { isSystem:
true }` carrying no tenant, so a shared-runtime multi-organization install held
ONE organization-less suggestion row that every tenant read: the first admin to
confirm or dismiss answered for all of them, while the binding their confirm
created existed only in their own organization.

- every read and write in `suggested-audience-bindings.ts` now carries
  `{ isSystem: true, tenantId }` — `findAnchorPositions`, `bindingExists`, the
  list/confirm/dismiss paths and the reconcile loop alike;
- `reconcileAudienceBindingSuggestions` is the new entry point: one pass per
  organization under a walled posture, exactly one organization-less pass under
  `single`;
- pre-fix organization-less rows are reaped first. Measured: without the reap
  the platform bucket (ADR-0120 D3) shows that row to every tenant and the
  per-organization passes create nothing at all.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MX1qcBzfwZb5wkRrJTNbhH

* chore(changeset): per-organization audience-binding suggestion reconciler

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MX1qcBzfwZb5wkRrJTNbhH

---------

Co-authored-by: Claude <noreply@anthropic.com>

Author: qq9340100

.changeset/per-organization-audience-binding-suggestions.md

@@ -0,0 +1,29 @@
+---
+"@objectstack/plugin-security": patch
+---
+
+Reconcile audience-binding suggestions per organization (ADR-0090 D5/D9)
+
+`sys_audience_binding_suggestion` rows are per-tenant by construction — a
+package suggests, and a TENANT admin confirms — but the reconciler read and
+wrote through a module-level `{ isSystem: true }` context carrying no tenant.
+On a shared-runtime multi-organization installation that produced ONE
+organization-less row that every tenant read: the first admin to confirm or
+dismiss answered for all of them, while the binding their confirm created
+existed only in their own organization, so every other tenant's users never
+received the package's default permission set and the surface reported the
+suggestion resolved.
+
+- every read and write in the module now carries `{ isSystem: true, tenantId }`
+  — the anchor lookup, the "is it already bound?" lookup, and the
+  list/confirm/dismiss paths, not just the writes;
+- `reconcileAudienceBindingSuggestions` is the new entry point the runtime
+  calls: one pass per organization under a `group`/`isolated` posture, and the
+  publishing organization alone on the package-door publish path;
+- pre-existing organization-less rows are reaped before the passes and
+  regenerated per organization. Without that, ADR-0120 D3's platform bucket
+  keeps showing the old row to every tenant and the per-organization passes
+  create nothing at all. No permission binding is touched by the reap.
+
+A `single`-posture deployment is unchanged: exactly one organization-less pass,
+and no reap.

packages/plugins/plugin-security/src/index.ts

@@ -78,10 +78,19 @@ export type { ExplainEngineDeps, ExplainInput } from './explain-engine.js';
 export type { DelegatedAdminGateDeps } from './delegated-admin-gate.js';
 export {
   syncAudienceBindingSuggestions,
+  reconcileAudienceBindingSuggestions,
+  reapOrganizationLessSuggestions,
+  listSuggestionOrganizationIds,
   listAudienceBindingSuggestions,
   confirmAudienceBindingSuggestion,
   dismissAudienceBindingSuggestion,
   SuggestionNotFoundError,
   SuggestionStateError,
 } from './suggested-audience-bindings.js';
-export type { SuggestionDeps, SuggestionListFilter, SuggestionSyncOutcome } from './suggested-audience-bindings.js';
+export type {
+  SuggestionDeps,
+  SuggestionListFilter,
+  SuggestionSyncOutcome,
+  SuggestionReconcileOutcome,
+  SuggestionReconcileScope,
+} from './suggested-audience-bindings.js';

packages/plugins/plugin-security/src/security-plugin.ts

@@ -37,7 +37,7 @@ import {
 } from './permission-set-projection.js';
 import { registerObjectPostureGate } from './object-posture-gate.js';
 import {
-  syncAudienceBindingSuggestions,
+  reconcileAudienceBindingSuggestions,
   listAudienceBindingSuggestions,
   confirmAudienceBindingSuggestion,
   dismissAudienceBindingSuggestion,
@@ -2546,14 +2546,25 @@ export class SecurityPlugin implements Plugin {
           if (protocol && typeof protocol.registerPublishMaterializer === 'function') {
             protocol.registerPublishMaterializer(
               'permission',
-              async (args: { body: unknown; packageId: string | null }) => {
+              async (args: { body: unknown; packageId: string | null; organizationId: string | null }) => {
                 const r = await upsertPackagePermissionSet(ql, args.body, args.packageId, ctx.logger);
                 const applied = r.seeded + r.updated;
                 // [ADR-0090 D5] A published set carrying the install-time
                 // suggestion flag surfaces (or retires) its pending
                 // suggestion row right away — same convergent sync as boot.
+                //
+                // [#8617] Scoped to the PUBLISHING organization when the draft
+                // carried one: the publish is that tenant's act, and the
+                // suggestion row it produces is that tenant's prompt. A
+                // package-door publish with no org scope is installation-wide,
+                // so it reconciles every organization — the same sweep as boot.
                 if (applied > 0 && (args.body as { isDefault?: boolean } | null)?.isDefault !== undefined) {
-                  try { await syncAudienceBindingSuggestions(ql, this.metadata, ctx.logger); } catch { /* non-fatal */ }
+                  try {
+                    await reconcileAudienceBindingSuggestions(ql, this.metadata, ctx.logger, {
+                      posture: this.tenancyPosture,
+                      organizationId: args.organizationId ?? undefined,
+                    });
+                  } catch { /* non-fatal */ }
                 }
                 // A publish that materialized nothing did NOT go live — report it
                 // as a failure with the reason so the package-door UI never shows
@@ -2688,8 +2699,18 @@ export class SecurityPlugin implements Plugin {
         // confirmation — never auto-bound. Runs after the anchors are seeded
         // and after the baseline binding above, so the app's own fallback set
         // (already bound) never nags.
+        //
+        // [#8617] ONE PASS PER ORGANIZATION under a walled posture. The rows
+        // are per-tenant by construction (ADR-0090 D5/D9: resolved when a
+        // TENANT admin confirms), so a single tenant-less pass wrote one
+        // organization-less row that every tenant read — and the first admin
+        // to answer answered for all of them, while the binding their confirm
+        // created existed only in their own organization. `single` posture is
+        // unchanged: exactly one organization-less pass.
         try {
-          await syncAudienceBindingSuggestions(ql, this.metadata, ctx.logger);
+          await reconcileAudienceBindingSuggestions(ql, this.metadata, ctx.logger, {
+            posture: this.tenancyPosture,
+          });
         } catch (e) {
           ctx.logger.warn('[security] audience-binding suggestion sync failed (non-fatal)', { error: (e as Error).message });
         }