chore(spec): register the sys_scim_provider retirement in the ADR-0087 ledger + changeset

Semantic entry scim-provider-object-retired (major 18), registry regions
regenerated (major-18 entries project into spec-changes.json/upgrade guide
only when that major ships — registry.ts is the only artifact that moves).
Breaking changeset ships as minor per the launch-window convention, with
the adr-0087 registered marker.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LpRNHxWZgSUgVnFT9mQQo4

Author: claude

.changeset/retire-sys-scim-provider-object.md

@@ -0,0 +1,23 @@
+---
+'@objectstack/platform-objects': minor
+'@objectstack/spec': minor
+'@objectstack/plugin-auth': minor
+'@objectstack/plugin-security': minor
+---
+
+**BREAKING (platform object removed):** the `sys_scim_provider` platform object is retired (#11757, ruled on #11693 — leg 1a of the #11632 SCIM epic).
+
+FROM → TO, per surface:
+
+- `SysScimProvider` (export of `@objectstack/platform-objects` / `.../identity`) → removed, no replacement export. Fix: delete the import. Stable SCIM state lives on the seven `sys_scim_*` stable-model objects (#3653), and connection credentials on `sys_scim_connection_credential`.
+- `sys_scim_provider` in `PLATFORM_PROVIDED_OBJECT_NAMES` (`@objectstack/spec/system`) → removed. `isPlatformProvidedObjectName('sys_scim_provider')` is now `false`, so a stack referencing the name is flagged as a probable typo instead of resolving.
+- plugin-auth: the object is no longer provisioned, and `AUTH_MODEL_TO_PROTOCOL` carries no `scimProvider` entry — the installed stable `@better-auth/scim@1.7.1` derives no such model, so the entry bridged nothing.
+- plugin-security: the `BETTER_AUTH_MANAGED_OBJECTS` write-deny entry for it is gone with the object (the list is pinned bidirectionally against `managedBy: 'better-auth'` declarations).
+
+The rc.1-era row was written only by the retired `/scim/generate-token` endpoint; after the stable-1.7.1 migration (PR #12726) nothing could write to it. Per the maintainer's ruling (2026-08-24, 「不需要考虑历史数据」; reaffirmed 2026-08-25 — SCIM has no real customers), **no data migration ships**: existing `sys_scim_provider` tables in deployed databases are left untouched — no backfill, no reaper, no migrate command. SCIM-enabled deployments re-register connections on the stable surface; the IdP token reissue is a migration-day operator action regardless of this change.
+
+The ADR-0066 D3 capability-gate pin moves from the retired object to its surviving sibling `sys_sso_provider`, so the gate posture stays test-pinned.
+
+Breaking ships as `minor` per the launch-window convention (`scripts/check-changeset-no-major.mjs`) and the #12726 precedent on the same ruling.
+
+<!-- adr-0087: registered scim-provider-object-retired -->

packages/spec/src/migrations/entries/semantic/18.scim-provider-object-retired.ts

@@ -0,0 +1,51 @@
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+
+import type { SemanticMigration } from '../../types.js';
+
+export const entry: SemanticMigration = {
+  id: 'scim-provider-object-retired',
+  surface:
+    'the `sys_scim_provider` platform object (`SysScimProvider` in '
+    + '`@objectstack/platform-objects/identity`, re-exported from the package '
+    + 'root) and its name in `PLATFORM_PROVIDED_OBJECT_NAMES` '
+    + '(`@objectstack/spec/system` constants). The rc.1-era `@better-auth/scim` '
+    + 'connection row: one row per SCIM bearer connection, written only by the '
+    + 'retired `/scim/generate-token` endpoint.',
+  replacement:
+    '(removed — no direct replacement row. The stable `@better-auth/scim` '
+    + '1.7.x line (#3653, PR #12726) derives no `scimProvider` model: SCIM '
+    + 'state lives in the seven stable platform objects '
+    + '(`sys_scim_connection_binding`, `sys_scim_group`, '
+    + '`sys_scim_group_member`, `sys_scim_identity_tombstone`, '
+    + '`sys_scim_projection_grant`, `sys_scim_subject`, `sys_scim_user`) and '
+    + 'connection credentials in the ObjectStack-owned '
+    + '`sys_scim_connection_credential`, minted/verified by '
+    + '`scim-connection-service.ts` behind the application-owned '
+    + '`verifyBearerToken`. A SCIM-enabled deployment re-registers its '
+    + 'connections on the stable surface; rc.1 token digests are not portable '
+    + 'on any path, so the IdP reissues its token — a migration-day operator '
+    + 'action, not a code rewrite.)',
+  reason:
+    'Maintainer ruling 2026-08-24 on #11693 (verbatim: 「11700 11693 不需要考虑'
+    + '历史数据，其他按照你的建议继续」) — disposition A: retire, with no '
+    + 'data-migration path owed for existing rows (reaffirmed 2026-08-25: SCIM '
+    + 'has no real customers; the binding constraint is a smooth upgrade). '
+    + 'Executed as #11757 after the stable-1.7.1 migration landed (#3653 / '
+    + 'PR #12726): the installed library derives no `scimProvider` model, so '
+    + 'the object backed nothing — nothing could write a row to it any more. '
+    + 'Retiring it also removes its `provider_id` unique index, whose '
+    + 'stricter-than-upstream uniqueness was flagged on #3653 and parked '
+    + 'pending exactly this retirement.',
+  acceptanceCriteria:
+    'No code imports `SysScimProvider` from `@objectstack/platform-objects` '
+    + '(TS2305 after upgrade); `isPlatformProvidedObjectName(\'sys_scim_provider\')` '
+    + 'returns false, so a stack referencing the name is flagged as a probable '
+    + 'typo rather than resolved; plugin-auth provisions no `sys_scim_provider` '
+    + 'object and `AUTH_MODEL_TO_PROTOCOL` carries no `scimProvider` entry; the '
+    + 'spec registry conformance test (`platform-object-names.test.ts`) pins '
+    + 'the absence bidirectionally — re-adding either the object file or the '
+    + 'registry name alone reds `registry group "platform-objects" is out of '
+    + 'date` (measured both ways on #11757). Existing `sys_scim_provider` '
+    + 'tables in deployed databases are left in place untouched, by ruling — '
+    + 'no backfill, no reaper, no migrate command.',
+};

packages/spec/src/migrations/registry.ts

@@ -6987,6 +6987,53 @@ const step18: MigrationStep = {
         + '`collapsible: true` explicitly — an unset key now defers to the renderer, which does '
         + 'not collapse.',
     },
+    {
+      id: 'scim-provider-object-retired',
+      surface:
+        'the `sys_scim_provider` platform object (`SysScimProvider` in '
+        + '`@objectstack/platform-objects/identity`, re-exported from the package '
+        + 'root) and its name in `PLATFORM_PROVIDED_OBJECT_NAMES` '
+        + '(`@objectstack/spec/system` constants). The rc.1-era `@better-auth/scim` '
+        + 'connection row: one row per SCIM bearer connection, written only by the '
+        + 'retired `/scim/generate-token` endpoint.',
+      replacement:
+        '(removed — no direct replacement row. The stable `@better-auth/scim` '
+        + '1.7.x line (#3653, PR #12726) derives no `scimProvider` model: SCIM '
+        + 'state lives in the seven stable platform objects '
+        + '(`sys_scim_connection_binding`, `sys_scim_group`, '
+        + '`sys_scim_group_member`, `sys_scim_identity_tombstone`, '
+        + '`sys_scim_projection_grant`, `sys_scim_subject`, `sys_scim_user`) and '
+        + 'connection credentials in the ObjectStack-owned '
+        + '`sys_scim_connection_credential`, minted/verified by '
+        + '`scim-connection-service.ts` behind the application-owned '
+        + '`verifyBearerToken`. A SCIM-enabled deployment re-registers its '
+        + 'connections on the stable surface; rc.1 token digests are not portable '
+        + 'on any path, so the IdP reissues its token — a migration-day operator '
+        + 'action, not a code rewrite.)',
+      reason:
+        'Maintainer ruling 2026-08-24 on #11693 (verbatim: 「11700 11693 不需要考虑'
+        + '历史数据，其他按照你的建议继续」) — disposition A: retire, with no '
+        + 'data-migration path owed for existing rows (reaffirmed 2026-08-25: SCIM '
+        + 'has no real customers; the binding constraint is a smooth upgrade). '
+        + 'Executed as #11757 after the stable-1.7.1 migration landed (#3653 / '
+        + 'PR #12726): the installed library derives no `scimProvider` model, so '
+        + 'the object backed nothing — nothing could write a row to it any more. '
+        + 'Retiring it also removes its `provider_id` unique index, whose '
+        + 'stricter-than-upstream uniqueness was flagged on #3653 and parked '
+        + 'pending exactly this retirement.',
+      acceptanceCriteria:
+        'No code imports `SysScimProvider` from `@objectstack/platform-objects` '
+        + '(TS2305 after upgrade); `isPlatformProvidedObjectName(\'sys_scim_provider\')` '
+        + 'returns false, so a stack referencing the name is flagged as a probable '
+        + 'typo rather than resolved; plugin-auth provisions no `sys_scim_provider` '
+        + 'object and `AUTH_MODEL_TO_PROTOCOL` carries no `scimProvider` entry; the '
+        + 'spec registry conformance test (`platform-object-names.test.ts`) pins '
+        + 'the absence bidirectionally — re-adding either the object file or the '
+        + 'registry name alone reds `registry group "platform-objects" is out of '
+        + 'date` (measured both ways on #11757). Existing `sys_scim_provider` '
+        + 'tables in deployed databases are left in place untouched, by ruling — '
+        + 'no backfill, no reaper, no migrate command.',
+    },
     {
       id: 'send-template-input-org-retired',
       surface: 'contracts.emailService.sendTemplate input.org',