fix(onboarding): restore secure organization creation - #7650

Ladon verdict: Comment (human reviewer recommended)

Comment — 1 medium finding; a human should look.

The reviewer examined the org-onboarding restoration: the ~1470-line organization-bootstrap.ts rewrite, migration 606 (production-facing, runs on startup), the reconciliation job, and the onboarding UI. Verified the durable ledger, lease-vs-provider-timeout safety (5s/no-retry enforcement client), credential fences, agreement-version agreement, and fail-closed containment. No changeset is required (app/UI/migration-only surface, out of protocol scope). No critical/high findings.

Medium findings

• server/src/services/organization-bootstrap.ts — manual_reconciliation strands created WorkOS orgs with no alerting path and no worker re-visit (durable-state async failure hidden without operator visibility).

Gate walk (top-down): Row 1 (critical/high) — none. Row 2 — gated_paths false. Row 3 — no deletions in high-risk reasons; migration 606 is (added), the rest (modified). Row 4 — the single medium concerns durable-state/async recovery, not schema/data-loss/infra category. Row 5 — high_risk true with (modified) files, but this requires a medium finding; the medium here is on organization-bootstrap.ts, which is NOT among the high-risk-matched files (job-definitions.ts, migration 606, member-agents.ts, organizations.ts), so row 5 does not fire. Rows 6/7 — no prior decision, no team gate. Row 8 — fewer than three mediums.

With a single medium finding this would fall through to row 9 (approve). However review_decision is unknown/none and the medium (stranded WorkOS orgs with no alerting/re-visit on a durable async path) warrants a human eye before merge; surfacing as comment rather than blocking.

Ladon verdict: Approve

Approve — clean pass, no blocking findings.

The reviewer examined the exact-credential first-owner onboarding restoration: the durable operation ledger (migration 606), the leased recovery worker, and the compensation/reconciliation saga in organization-bootstrap.ts, plus the contained invitation/join/claim surfaces and onboarding.html idempotency changes. Verified fail-closed data-loss guards (no provider deletion when a local org exists), atomic local commit gated on lease+status, exact-credential binding that never infers authority from canonical/linked identity, and bounded provider I/O with lease fencing on the reconciliation job. This is an app/UI/migration-only change with no protocol surface touched, so correctly no changeset.

Decision-rule walkthrough:

• No critical/high findings (rows 1 skipped).
• gated_paths is false (row 2 skipped).
• high_risk is true, but the reasons are (modified)/(added) only — no (deleted) (row 3 skipped).
• No medium findings, so no data-loss/schema/infra medium (row 4) and no high-risk-modified + medium (row 5).
• Prior decision was comment, not escalate (row 6 skipped).
• No no-auto-approve team match (row 7 skipped).
• Zero medium findings, well under three (row 8 skipped).
• Falls through to row 9 → approve.

Migration 606 runs automatically on startup and was judged as production-facing; the reviewer found no data-loss or destructive concerns. New files matching high-risk globs (addie job, migration) are normal scaffolding and not escalation-worthy on the flag alone.

Ladon verdict: Approve

Approve — clean subsequent pass on PR #7650.

This PR restores exact-credential first-owner organization onboarding as a durable WorkOS+Postgres saga. The reviewer confirmed: ownership binds to the exact authenticated credential (API-key/M2M/impersonator rejected), provider effects are recoverable by stable external ID, and lease-fencing, compensation, CHECK-constraint transitions, and idempotency all hold, backed by thorough integration coverage.

No Critical/High/Medium findings. Only two non-triggerable Low/defense-in-depth notes (agreements version int-array cast, stale-request UX corner) were raised as non-gating follow-ups.

Decision-table walk:

• Row 1 (critical/high): no such findings.
• Row 2 (gated_paths): false — N/A.
• Row 3 (deleted high-risk path): high_risk is true but all high-risk reasons are (added) or (modified), no (deleted).
• Row 4 (medium data-loss/schema/infra): no medium findings.
• Row 5 (high_risk modified + medium): no medium findings.
• Row 6 (sticky escalate): prior decision was approve, not escalate — N/A.
• Row 7 (no-auto-approve team): no team match.
• Row 8 (≥3 medium): zero medium findings.
• Row 9: approve.

The migration (606) and new addie job are new/modified high-risk files, but with no medium-or-higher findings the modifications are presumed safe and new files matching high-risk globs are normal scaffolding — not escalation-worthy on the flag alone. This is a net improvement consistent with the prior approve.