[iililiiilili]

Related: #348 (fresh-login organization sync), #405 (local mock org forwarding).

AI-assisted implementation and verification with Codex; maintainers can edit this branch.

What Problem This Solves

Fixes an issue where signed-in employees could remain outside their organization after organization synchronization failed or the control service restarted. Incomplete parent information could also prevent a valid Part from being created or later attached to its known Group and Team.

Why This Change Was Made

Record the current authenticated LDAP/verified-SSO decision and selected trusted organization fact atomically, then synchronize membership through the existing directory owner. Bounded local recovery replays only a fact authorized by the current authentication epoch, preserving the browser cookie, manual grants, and fail-open sign-in behavior. Stable external IDs and source revisions govern renames, moves, nullable-parent refinements, and exclusions; compatible unknown parent fields retain stronger verified facts without inventing relationships.

The maintainer explicitly approved schema v4 for this repair. Schema v4 permits externally managed parentless Parts and records source-parent certainty. Its migration creates and integrity-checks a SQLite-consistent pre-v4 backup, validates the replacement tables, and commits the version only after successful validation. Rollback requires restoring that verified backup together with the matching prior release. The additive authentication-fact tables require no additional version bump. Private project configs retain effective root compiler settings and every selected lint target without suppressing checks.

User Impact

Employees with a current recorded verified organization fact recover enrollment automatically, including after a failed graph write and restart, without signing in again. Organization settings show a recorded outcome and automatically managed membership; optional profile labels no longer make a valid session appear unavailable.

Legacy sessions with no reusable verified organization fact remain signed in and receive an explicit explanation plus the existing company sign-in action when SSO is configured. A fresh verified LDAP/SSO response is required in that case. This change does not fabricate organization membership from department/profile strings, promise silent SSO, or introduce an unverified lookup API.

Evidence

• Linux: 2,776 unique tests in 236 files passed. The complete official control/UI development quick command passed, including both full typechecks, i18n, native type-aware lint, and owner tests. Both native lint runs used 245 rules; all 41 changed TypeScript paths and 15 changed tests were covered, with zero unmatched selected files.
• Coding/control/UI builds and real Chromium against built Gateway/AdminRPC/control/UI and SQLite passed. Only external LDAP/SSO used loopback fixtures. Observed same-cookie recovery, parentless-Part creation and same-source parent attachment, real SQLite write-failure recovery, and the verified SSO recovery action. Freshly served UI bytes matched the built asset; owned private state and processes were cleaned up.
• Migration regressions cover verified pre-v4 backup/integrity, failed replacement rollback and retry, manual-grant/provenance retention, and reopen stability. HTTP regressions cover concurrent/equal-clock authentication, current exclusions, conflicting/stale claims, compatible partial claims, and atomic decision-write failure.
• Production: +1,020/-164 (net +856); tests: +2,181/-28. Growth provides durable current-auth authority/recovery, parentless managed hierarchy, visible recovery outcomes and correct checker ownership. No new dependency or operator configuration is introduced.
• CI follow-up removes a test-only recovery wrapper and keeps its tests on the actual lifecycle owner; the SQLite row type is private. The focused Linux snapshot regression passed all 14 cases after this cleanup.
• Approved structured Codex reviews of the original patch, the three-file CI cleanup, and the two-file dependency repair each completed with exit 0 and no accepted P0 findings. This is the review skill's default P0-only threshold; runtime proof and lower-priority source review remain separate evidence.

Local organization proof used main e0266d17b5633112f57e3093b9631e59f0787574 plus the frozen 45-path organization patch. main was rechecked at 65910160dbfa268542b0e760855fab61d9ced3af; its three changed paths do not overlap the organization patch. The preceding exact head 688c6875 passed normal PlatformClaw CI (2,776 tests, native lint/types/i18n and all three builds), Docker Smoke, Knip, and remaining generic lint/type/test checks. Its only root failure was the existing production dependency advisory, which this approved follow-up repairs. Current exact head 1a664d1416206c5739f3ee615b2de51adfe26eb4 adds only the two dependency files; all 45 organization-source bytes remain unchanged. Its normal PlatformClaw CI passed all 2,776 owner tests, native lint/types/i18n and all three builds; Docker Smoke also passed. Its generic CI also passed, including production audit, full lint, Knip, production/test types and all selected generic tests. All 79 check contexts are now green and terminal with zero pending, including Dependency Guard. Prior-head results are not relabeled as current-head passes. Real company proxy forwarding and passwordless company SSO were not live-verified. The required non-quick --changed --base e0266d17 --head 8242481fff2 command was attempted before publication. Patch whitespace and formatting passed; normal root SDK declaration preparation was stopped only because host available memory stayed at 216-231 MiB, below the 256 MiB protection threshold. The owned container was stopped (command exit 137), with no cgroup OOM or source-check finding. The complete local normal pre-push gate did not finish; hosted normal prerequisite completion is recorded separately above.

The maintainer explicitly approved a one-time exception to completion of the local non-quick pre-push gate, with ready-PR publication and complete exact-head hosted CI required. This does not represent a local full-gate pass.

The maintainer approved the CI security repair: update the existing follow-redirects override from 1.16.1 to 1.16.2 and regenerate pnpm-lock.yaml with Linux pnpm 11.15.1. Only those two files change; all other package versions, resolutions, importers, and peer metadata remain unchanged. Canonical regeneration also records an existing Smithy deprecation notice.

• The exact production audit command now passes: node scripts/pre-commit/pnpm-audit-prod.mjs --audit-level=high, using the live npm advisory service.
• Public npm tarballs match the old and new lockfile SRIs. All seven files of the actual owner-resolved 1.16.2 package match the verified tarball. Feishu and both Teams paths resolve through unchanged Axios 1.20.0 to 1.16.2.
• Eight real loopback cases reproduce the 1.16.1 cross-realm credential leak and verify the fix with object/array headers, same/cross-realm arrays, harmless-header preservation and built-in credential removal. Three real Axios redirect cases verify compatibility. Values are synthetic; this does not claim an Axios exploit.

The local owner-filtered frozen install populated the verified target package but remained alive after printing Done; its task-owned process/container was stopped. It is not counted as an install pass. The new exact-head hosted pnpm install --frozen-lockfile completed successfully in 9 seconds with pnpm 11.15.1. The complete current-head hosted CI is green, including the repository Dependency Guard approval.

Named nonblocking follow-up: review the pre-existing @smithy/core@3.30.0 custom-logger redaction deprecation (AWS SDK issue #8393). Its version and resolution are unchanged; no additional dependency change is included.

The PR remains ready and unmerged. Repository admin devSejung approved this exact head in the required comment, and Dependency Guard attempt 2 passed. All 79 current-head check contexts are green with zero pending. No guard policy, approver list, audit rule or workflow was changed.

[github-actions]

Dependency Guard

This PR changes dependency-related files. Maintainers should confirm these changes are intentional.

Changed files:

• pnpm-lock.yaml
• pnpm-workspace.yaml

Maintainer follow-up:

• Review whether the dependency changes are intentional.
• Inspect resolved package deltas when lockfiles or workspace dependency policy changes are present.
• Treat pnpm-lock.yaml and package-lock.json diffs as dependency security-review surfaces.
• Run pnpm deps:changes:report -- --base-ref origin/main --markdown /tmp/dependency-changes.md --json /tmp/dependency-changes.json locally for detailed release-style evidence.

[github-actions]

Dependency graph change authorized

This PR includes dependency graph changes. A repository admin or member of @openclaw/openclaw-secops authorized this exact head SHA with /allow-dependencies-change.

• Approved SHA: 1a664d1416206c5739f3ee615b2de51adfe26eb4
• Approved by: @devSejung

A later push changes the PR head SHA and requires a fresh security approval.

[devSejung]

/allow-dependencies-change