Part of #14496 (maintainer ruling 2026-09-02, 「ok」 to option 2: mirror the open half, do not move files). Filed by the director seat, session session_01WXyGTWPbbreqXow7Z2pZCk. docs/adr/** is a governed surface: draft PR, human merge. Clause-②: no. domain:* is triage's.
What to write
A new local ADR (next free number) that states, as this repo enforces them, the decisions of cloud docs/adr/0071-enterprise-identity-scim-v1.md (Status: Proposed, founder to accept; 2026-06-27; entered this repo through PR #2356) whose mechanism is open code. From the cloud record's own headings, the open half is:
- D1 adopt
@better-auth/scim as the mechanism, do not build a SCIM server;
- D2 the SCIM Service Provider lives in the env, never in the cloud (identical for cloud-managed and self-host);
- D3 single-organization mode; deactivate via
active:false, never DELETE — deprovision removes membership and keeps the user record; deactivation = account disabled + session revocation;
- D4 V1 provisions a default role; group→role mapping deferred behind a seam;
- the open part of D7: the SCIM conformance / smoke test in CI.
Stays in cloud, cited as cloud ADR-0071: D5 open/closed boundary (mechanism open, governance closed), D6 commercial repositioning (paid = governed / supported / audited SCIM), the real-IdP E2E in cloud's staging, the Enterprise Identity pillar framing.
One fact the mirror must state honestly (measured, #14360)
The cloud record says deactivation is "active:false → ban (via the admin plugin) + session revocation" — true of @better-auth/scim 1.6.x, removed upstream in 1.7.0: at the pinned 1.7.2 the vendor calls an optional host hook identity.reconcileUser and revokes sessions, and writes no ban. #14360 (limb A, dispatched at CONTRACT_REVIEW_TIER) restores the decision through this platform's own ban write (admin-ban-endpoints.ts, last-admin guard included). The mirror records D3 as this platform's enforcement — the ban is written by this repo's hook, not assumed from the vendor — and names the vendor-version fact, so the 39 comments that currently say "runs through the better-auth admin plugin (ADR-0071)" have a true sentence to be re-pointed at. ⛔ Do not wait for #14360's PR to write the record; do state which side writes the ban.
Shape (copy docs/adr/0079-record-display-name.md)
## Provenance — read this before citing this file first (original decision in objectstack-ai/cloud ADR-0071, 2026-06-27; commercial half stays there; this file written from the cloud record and the implementing code — packages/plugins/plugin-auth/src/auth-manager.ts scim({...}) options, assertScimAdminCoherence, packages/platform-objects/src/identity/sys-scim-*.object.ts, packages/spec/src/system/auth-config.zod.ts plugins.scim / plugins.admin describe strings). Decisions restated with their code anchors; ⛔ nothing decided that the cloud record did not decide.
Follow-ups the accepting seat files (not this card)
Refs: #14496 · #14361 · #14360 · #13816 · #14150 · cloud ADR-0071 · ADR-0079.
Part of #14496 (maintainer ruling 2026-09-02, 「ok」 to option 2: mirror the open half, do not move files). Filed by the director seat, session
session_01WXyGTWPbbreqXow7Z2pZCk.docs/adr/**is a governed surface: draft PR, human merge. Clause-②: no.domain:*is triage's.What to write
A new local ADR (next free number) that states, as this repo enforces them, the decisions of cloud
docs/adr/0071-enterprise-identity-scim-v1.md(Status: Proposed, founder to accept; 2026-06-27; entered this repo through PR #2356) whose mechanism is open code. From the cloud record's own headings, the open half is:@better-auth/scimas the mechanism, do not build a SCIM server;active:false, neverDELETE— deprovision removes membership and keeps the user record; deactivation = account disabled + session revocation;Stays in cloud, cited as
cloud ADR-0071: D5 open/closed boundary (mechanism open, governance closed), D6 commercial repositioning (paid = governed / supported / audited SCIM), the real-IdP E2E in cloud's staging, the Enterprise Identity pillar framing.One fact the mirror must state honestly (measured, #14360)
The cloud record says deactivation is "
active:false→ ban (via the admin plugin) + session revocation" — true of@better-auth/scim1.6.x, removed upstream in 1.7.0: at the pinned 1.7.2 the vendor calls an optional host hookidentity.reconcileUserand revokes sessions, and writes no ban. #14360 (limb A, dispatched atCONTRACT_REVIEW_TIER) restores the decision through this platform's own ban write (admin-ban-endpoints.ts, last-admin guard included). The mirror records D3 as this platform's enforcement — the ban is written by this repo's hook, not assumed from the vendor — and names the vendor-version fact, so the 39 comments that currently say "runs through the better-auth admin plugin (ADR-0071)" have a true sentence to be re-pointed at. ⛔ Do not wait for #14360's PR to write the record; do state which side writes the ban.Shape (copy
docs/adr/0079-record-display-name.md)## Provenance — read this before citing this filefirst (original decision inobjectstack-ai/cloudADR-0071, 2026-06-27; commercial half stays there; this file written from the cloud record and the implementing code —packages/plugins/plugin-auth/src/auth-manager.tsscim({...})options,assertScimAdminCoherence,packages/platform-objects/src/identity/sys-scim-*.object.ts,packages/spec/src/system/auth-config.zod.tsplugins.scim/plugins.admindescribe strings). Decisions restated with their code anchors; ⛔ nothing decided that the cloud record did not decide.Follow-ups the accepting seat files (not this card)
ADR-0071citations (incl. the operator-facing refusal text inauth-manager.ts:359and theauth-config.mdxproducer strings) to the new number; ⛔ not done here.Refs: #14496 · #14361 · #14360 · #13816 · #14150 · cloud ADR-0071 · ADR-0079.