docs(organizations): stop calling the open multi-org runtime enterprise/closed-source (#16718)

ADR-0132 moved the `org-scoping` registrar into open core:
`packages/plugins/organizations` is Apache-2.0, carries no licence check of
any kind, and declares `['group','isolated']` as its own constant. #16137's
acceptance proved an open-only composition raises the `isolated` wall with no
licence check reachable. The prose did not follow — 65 occurrences across 45
files still described that package as enterprise / closed-source /
cloud-private.

Prose only. Every non-comment hunk is a string literal (an operator message, a
flag description, a conformance-matrix note, a test expectation); no control
flow, no identifier and no behaviour changes anywhere.

Corrected (population 1), led by the two sites the card names:

- `plugin-auth/src/tenancy-service.ts` — open core's own authority for
  resolving the posture. Its header said both walled postures require the
  *enterprise* package and that multi-org operation is *a commercial
  capability*; `isolationActive` argued "ENABLING a multi-organization posture
  is an entitlement". Rewritten around ADR-0132 D2/D3/D4: the mechanism (both
  postures probe the same registrar) is unchanged, the answer to "can an open
  install run isolated?" is now yes, and the `probeEntitledPostures` seam is
  explained as existing for the commercial subclass rather than as a tier.
- `cli/src/commands/serve.ts` — the mount block no longer says the runtime
  "lives in the closed-source package", and the operator-facing install remedy
  no longer ends "this runtime is closed-source and is NOT on the public npm
  registry ... Without one this bullet is not followable". That sentence told
  an open-source operator the remedy they had just been given was unusable.
- `cli/src/utils/tenancy-posture-hints.ts` — the `isolated` hint both
  `os serve` and `os doctor` render. Not in the card's count: its regex cannot
  see `the enterprise ${ORGANIZATIONS_RUNTIME_PKG}`.
- `plugin-dev/src/dev-plugin.ts` — two more operator-facing strings (the
  degraded-tenancy warning and the stage-2 mount refusal).

Because one name now denotes two packages (ADR-0132 D3), every rewritten site
names which one it means; where a site was load-bearing on ADR-0105 D12 the
citation is repointed at D12-as-amended rather than deleted.

Pin tests updated deliberately, with the reason recorded in each file:
`serve-organizations-message-spelling.test.ts` (5 hits) and
`doctor-organizations-message-spelling.test.ts`. The pins were not relaxed —
they still compare whole rendered lines built from
`Serve.ORGANIZATIONS_RUNTIME_PKG`, and both CONTROL blocks still differ from
their expectation only in spacing. The doctor roster assertion still pins
`edition: 'enterprise'`, which stays true: the roster records the ENTITLED
variant.

Left alone on purpose, and why, in the PR body: 2 hits that describe the
genuinely commercial same-named package, and 15 that state the package is
absent/not installable in this workspace as the reason a fixture fakes or
skips a proof — the live capability question the card dispatches as
report-only.

Refs ADR-0132, ADR-0105 D12 (as amended), #16130, #16137, PR #16215.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Author: hotlong

packages/cli/src/commands/doctor-organizations-message-spelling.test.ts

@@ -167,7 +167,7 @@ describe('doctor — the posture description an operator reads names the declara
   // what is pinned.
   it('leg (i) — the `isolated` fix-list bullet names it, with the spacing intact', () => {
     expect(renderIsolatedBullet()).toBe(
-      `        • OS_TENANCY_POSTURE=isolated — organization wall + the enterprise ${PKG} runtime `
+      `        • OS_TENANCY_POSTURE=isolated — organization wall + the ${PKG} runtime `
       + "(the legacy spelling 'multi' is accepted and normalizes to this)",
     );
   });
@@ -183,8 +183,16 @@ describe('doctor — the posture description an operator reads names the declara
         + 'where it ships from (#10921); a command that prints a package name at operators must name a row in it.',
     ).toContain(PKG);
 
-    // Provenance, read through doctor's own spelling rather than a literal: the
-    // row this advice describes is the enterprise one.
+    // Provenance, read through doctor's own spelling rather than a literal.
+    //
+    // ⚠️ The row stays `edition: 'enterprise'` after ADR-0132 and that is NOT a
+    // contradiction of the reworded hint above. One name now denotes two
+    // packages (ADR-0132 D3): the framework publishes an Apache-2.0 build of it
+    // and a commercial deployment resolves the same name to a private,
+    // licence-gated subclass. The roster row records the ENTITLED variant — its
+    // own note says so — while the operator hint names the PACKAGE, which is
+    // followable on any install. So this assertion still measures roster drift,
+    // and it is deliberately not relaxed to match the prose reword.
     const row = PLATFORM_PLUGIN_WIRED_RUNTIMES[PKG];
     expect(row.edition, `edition drift for the runtime doctor names ('${PKG}')`).toBe('enterprise');
   });
@@ -233,14 +241,14 @@ describe('#12464 CONTROL — these pins can say no', () => {
     // If this instrument could not tell the two apart, leg (i) would be
     // decorative. Anchored on the exact regression interpolation invites.
     const expected =
-      `        • OS_TENANCY_POSTURE=isolated — organization wall + the enterprise ${PKG} runtime `
+      `        • OS_TENANCY_POSTURE=isolated — organization wall + the ${PKG} runtime `
       + "(the legacy spelling 'multi' is accepted and normalizes to this)";
     expect(
-      `        • OS_TENANCY_POSTURE=isolated — organization wall + the enterprise ${PKG} runtime`
+      `        • OS_TENANCY_POSTURE=isolated — organization wall + the ${PKG} runtime`
       + "(the legacy spelling 'multi' is accepted and normalizes to this)",
     ).not.toBe(expected);
     expect(
-      `      • OS_TENANCY_POSTURE=isolated — organization wall + the enterprise ${PKG} runtime `
+      `      • OS_TENANCY_POSTURE=isolated — organization wall + the ${PKG} runtime `
       + "(the legacy spelling 'multi' is accepted and normalizes to this)",
     ).not.toBe(expected);
     // …and says yes to the real thing, so the two `not.toBe`s above are a

packages/cli/src/commands/serve-cluster-host-resolution.test.ts

@@ -46,7 +46,7 @@
  *    binding. A load placed above it is not a compile error — the author writes
  *    a bare `import()`, which resolves from the CLI and is green in any dev
  *    checkout where everything is hoisted into one `node_modules`. The first
- *    time it cost the enterprise organizations load (cloud#1013); the second
+ *    time it cost the organizations load (cloud#1013); the second
  *    time it cost EE multi-node boot outright (#10645).
  *
  *    #10769 closed the class rather than hoisting a third time: the helper is

packages/cli/src/commands/serve-organizations-message-spelling.test.ts

@@ -66,6 +66,28 @@
  * via `test/serve-capability-vocabulary.test.ts` and the shared const's via
  * doctor's leg (ii).
  *
+ * ── The 2026-09-08 reword, and why it was made HERE rather than absorbed ──
+ *
+ * These pins previously expected the word "enterprise" in two operator-facing
+ * sentences: the install remedy ("add … (the enterprise multi-org runtime)")
+ * and the `isolated` posture hint. ADR-0132 moved the multi-org runtime into
+ * open core — `packages/plugins/organizations` is Apache-2.0 and carries no
+ * licence check — so both sentences told an open-source operator that a remedy
+ * they can in fact follow required a subscription.
+ *
+ * ⛔ The pins were NOT relaxed or deleted to accommodate the reword: they still
+ * compare the whole rendered line, whitespace included, against text built from
+ * `Serve.ORGANIZATIONS_RUNTIME_PKG`, and the #12151 CONTROL block below still
+ * proves they can say no. Only the expected PROSE moved, in the same diff as
+ * the prose itself, which is the shape this file is for — a wording change that
+ * does not redden a pin here would mean the pin had stopped reading.
+ *
+ * ⚠️ ONE NAME, TWO PACKAGES (ADR-0132 D3) is why the new wording names no
+ * edition at all: a commercial deployment resolves the same package name to a
+ * private licence-gated subclass, so any adjective this message picks is wrong
+ * for one of the two installs reading it. The roster keeps the edition fact,
+ * and `doctor-organizations-message-spelling.test.ts` leg (ii) still pins it.
+ *
  * ⚠️ This paragraph used to say the literal HAD to stay in `serve.ts`, because
  * `serve-cluster-host-resolution.test.ts` resolved the organizations `import()`
  * through that static and needed the literal in that file or the load dropped
@@ -152,7 +174,7 @@ describe('serve — the multi-org runtime name an operator READS comes from the
   it('site 2 — the "add it to THIS APP" remedy names it, with the spacing intact', () => {
     // The other instruction an operator acts on: the app never declared it.
     expect(lines(remedyUndeclared())[0]).toBe(
-      `      • add ${PKG} (the enterprise multi-org runtime) to THIS APP`,
+      `      • add ${PKG} (the multi-org runtime) to THIS APP`,
     );
   });
 
@@ -164,7 +186,7 @@ describe('serve — the multi-org runtime name an operator READS comes from the
     // package's own `exports` names no runtime entry Node can load — and it
     // fell into the else leg, rendering the UNDECLARED remedy verbatim:
     //
-    //       • add @objectstack/organizations (the enterprise multi-org runtime) to THIS APP
+    //       • add @objectstack/organizations (the multi-org runtime) to THIS APP
     //         — declare it in the app's package.json and install; the CLI resolves it from the
     //
     // i.e. "declare it and install it" to an operator who has already done
@@ -264,7 +286,7 @@ describe('serve — the posture description an operator reads names the declarat
     expect(verdict.ok, 'the gate accepted a value that is not a posture').toBe(false);
     if (verdict.ok) return;
     expect(lines(verdict.fatal)).toContain(
-      `      • set OS_TENANCY_POSTURE=isolated — organization wall + the enterprise ${PKG} runtime `
+      `      • set OS_TENANCY_POSTURE=isolated — organization wall + the ${PKG} runtime `
       + "(the legacy spelling 'multi' is accepted and normalizes to this)",
     );
   });
@@ -301,9 +323,9 @@ describe('#12151 CONTROL — these pins can say no', () => {
     // The exact regression the card names: interpolating into a template is
     // where a stray space or a lost backtick hides. If this instrument could
     // not tell the two apart, every assertion above would be decorative.
-    const expected = `      • add ${PKG} (the enterprise multi-org runtime) to THIS APP`;
-    expect(`      • add ${PKG}(the enterprise multi-org runtime) to THIS APP`).not.toBe(expected);
-    expect(`      • add ${PKG}  (the enterprise multi-org runtime) to THIS APP`).not.toBe(expected);
+    const expected = `      • add ${PKG} (the multi-org runtime) to THIS APP`;
+    expect(`      • add ${PKG}(the multi-org runtime) to THIS APP`).not.toBe(expected);
+    expect(`      • add ${PKG}  (the multi-org runtime) to THIS APP`).not.toBe(expected);
     expect(lines(remedyUndeclared())[0]).toBe(expected);
   });
 

packages/cli/src/commands/serve.ts

@@ -3677,16 +3677,23 @@ export default class Serve extends Command {
               }
             }
 
-            // Pair: OrganizationsPlugin (multi-org, ENTERPRISE) — must register
-            // BEFORE SecurityPlugin. The multi-org runtime (`organization_id`
+            // Pair: OrganizationsPlugin (multi-org) — must register BEFORE
+            // SecurityPlugin. The multi-org runtime (`organization_id`
             // auto-stamp, per-org seed replay, multi-org default-org bootstrap)
-            // lives in the closed-source `@objectstack/organizations` package
-            // (ADR-0105 D12; it registers the historical `org-scoping` service
-            // SecurityPlugin probes at start() to keep vs strip the wildcard
-            // `tenant_isolation` RLS — so registration order matters). Without
-            // it, deployments are single-org: the open member-management
+            // lives in the `@objectstack/organizations` package (ADR-0105 D12
+            // as amended by ADR-0132; it registers the historical `org-scoping`
+            // service SecurityPlugin probes at start() to keep vs strip the
+            // wildcard `tenant_isolation` RLS — so registration order matters).
+            // Without it, deployments are single-org: the open member-management
             // basics (plugin-auth's default-org bootstrap + better-auth
             // invitations) still work.
+            // ⚠️ ONE NAME, TWO PACKAGES (ADR-0132 D3): the framework publishes
+            // an Apache-2.0 package of that name (`packages/plugins/organizations`),
+            // and a commercial deployment resolves the same name to a private,
+            // licence-gated subclass of it through its own `workspace:*`
+            // declaration. `serve` does not choose between them and must not
+            // try — the host app's own manifest decides, which is exactly what
+            // the host-anchored importer below reads (#4719).
             // [ADR-0105 D1] Key off the resolved POSTURE, not the legacy boolean.
             // Both walled postures (`group` and `isolated`) need this package:
             // gating on `OS_MULTI_ORG_ENABLED` alone would let
@@ -4076,7 +4083,7 @@ export default class Serve extends Command {
       //
       // #4719 — this used to be a local re-implementation of that read. It was
       // right, and it was the ONLY place in the boot path that asked the question
-      // the right way: the enterprise organizations load two blocks up asked
+      // the right way: the organizations load two blocks up asked
       // "does it resolve", which a hoisted store answered yes to regardless. Both
       // now go through the one owner in `@objectstack/types/node`, so "declared"
       // cannot mean two different things in one file (Prime Directive #12).
@@ -5441,14 +5448,15 @@ export function formatOrganizationsInstallRemedy(
       '        the remedy is in the package, and the cause below is the authority on what it\n' +
       '        has to publish — or\n';
   }
-  return `      • add ${pkg} (the enterprise multi-org runtime) to THIS APP\n` +
+  return `      • add ${pkg} (the multi-org runtime) to THIS APP\n` +
     "        — declare it in the app's package.json and install; the CLI resolves it from the\n" +
     '          app, not from the framework it is linked out of. Being merely reachable\n' +
     '          through NODE_PATH / a hoisted workspace store is deliberately not enough\n' +
     '          (#4719) — that made this wall depend on how the process was launched.\n' +
-    '          NOTE: this runtime is closed-source and is NOT on the public npm registry —\n' +
-    '          it is distributed with an enterprise / cloud subscription. Without one this\n' +
-    '          bullet is not followable, and one of the two below is your path — or\n';
+    '          NOTE: this runtime is Apache-2.0 and published on the public npm registry\n' +
+    '          (ADR-0132), so this bullet is followable on any install — no subscription.\n' +
+    '          A commercial deployment resolves the same package name to its own private,\n' +
+    '          licence-gated build; the manifest that declares it decides which — or\n';
 }
 
 /**

packages/cli/src/commands/verify.ts

@@ -87,7 +87,7 @@ export default class Verify extends Command {
       default: false,
     }),
     'multi-tenant': Flags.boolean({
-      description: 'Boot org-scoped (register the enterprise @objectstack/organizations plugin) so tenant-isolation RLS policies apply (also honors a walled $OS_TENANCY_POSTURE, and the legacy $OS_MULTI_ORG_ENABLED it falls back to)',
+      description: 'Boot org-scoped (register the @objectstack/organizations plugin) so tenant-isolation RLS policies apply (also honors a walled $OS_TENANCY_POSTURE, and the legacy $OS_MULTI_ORG_ENABLED it falls back to)',
       default: false,
     }),
     json: Flags.boolean({ description: 'Emit the structured report as JSON', default: false }),

packages/cli/src/utils/tenancy-posture-hints.ts

@@ -136,6 +136,6 @@ export const TENANCY_POSTURE_FIX_HINTS: Readonly<Record<string, string>> = {
   single: 'one organization, no organization wall — the default',
   group: 'organization wall enforced by the open engine, one shared database',
   isolated:
-    `organization wall + the enterprise ${ORGANIZATIONS_RUNTIME_PKG} runtime `
+    `organization wall + the ${ORGANIZATIONS_RUNTIME_PKG} runtime `
     + "(the legacy spelling 'multi' is accepted and normalizes to this)",
 };

packages/cli/test/serve-organizations-mount-failure.e2e.test.ts

@@ -2,7 +2,7 @@
 
 /**
  * #4818 — `os serve` must tell an operator WHICH of two different things went
- * wrong with the enterprise multi-org runtime, over the REAL CLI process.
+ * wrong with the multi-org runtime, over the REAL CLI process.
  *
  * The defect: `importFromHost('@objectstack/organizations')` and
  * `kernel.use(new mod.OrganizationsPlugin())` shared a single `try`, so an
@@ -27,10 +27,13 @@
  * `serve-organizations-host-resolution.e2e.test.ts`): every other test of the
  * walled postures hands the plugin in as `extraPlugins` or mocks the module,
  * which bypasses the CLI's own load/mount sequence — the only thing under test
- * here. The fixtures stand in for the closed-source enterprise package: one app
- * simply does not ship it, another ships a version whose plugin throws on
- * construction (the shape cloud#1020 gave its license gate). What is asserted
- * is the CLI's CLASSIFICATION and its message, not any enterprise semantics.
+ * here. The fixtures stand in for a mounted multi-org runtime: one app simply
+ * does not ship it, another ships a version whose plugin throws on construction
+ * — which is specifically the COMMERCIAL package's shape, since ADR-0132 D2
+ * leaves construction-time licence refusal to the private subclass and the open
+ * `packages/plugins/organizations` carries no licence check of any kind (the
+ * shape cloud#1020 gave its license gate). What is asserted is the CLI's
+ * CLASSIFICATION and its message, not any runtime's semantics.
  */
 
 import { describe, it, expect, beforeAll, afterAll } from 'vitest';

packages/core/src/security/api-key.test.ts

@@ -195,8 +195,8 @@ describe('resolveApiKeyAdmission — organization (#8287)', () => {
 
   /**
    * The posture must be the ENFORCED one, not the requested one. ADR-0093 D4/D5:
-   * a deployment that asks for `isolated` without the enterprise organizations
-   * runtime runs with NO wall, and `tenancy.isolationActive` is how the service
+   * a deployment that asks for `isolated` without any organizations runtime
+   * runs with NO wall, and `tenancy.isolationActive` is how the service
    * says so. Reading `OS_TENANCY_POSTURE` instead would refuse org-less keys on
    * a deployment that has no wall at all.
    */

packages/core/src/security/api-key.ts

@@ -217,7 +217,7 @@ export interface TenancyPostureSource {
  * ⚠️ Deliberately NOT `resolveTenancyPosture()` from `@objectstack/types`, which
  * reads `OS_TENANCY_POSTURE` directly. That answers what the operator ASKED
  * for, not what is ENFORCED: under ADR-0093 D4/D5 a deployment that requests
- * `isolated` without the enterprise `@objectstack/organizations` runtime
+ * `isolated` without the `@objectstack/organizations` runtime
  * resolves to `single` and runs with NO organization wall. Reading the env
  * there would refuse org-less API keys on a deployment whose wall is not even
  * active — breaking working automation to enforce a boundary that does not

packages/mcp/src/stdio-tenancy-posture-api-key-matrix.test.ts

@@ -543,7 +543,7 @@ describe('[#15348] §5 — the posture and the membership are both re-read per c
     const { bridge } = await h.start();
     expect((await readAll(bridge)).total).toBe(2);
 
-    // The enterprise multi-org runtime registers and the wall goes live.
+    // The multi-org runtime registers and the wall goes live.
     service.posture = 'isolated';
 
     await expect(bridge.query(OBJECT, {})).rejects.toThrow(/no longer valid/);