feat(spec,auth): guard that every feature-gated capability is UI-gated (generalize the create-user phone fix)

[os-zhuang]

Context

The create-user phone bug (fixed in objectui #2406 + framework #2871) was one instance of a broader class:

The UI advertises a capability the runtime doesn't have because the backing plugin is off.

The create_user form offered a phoneNumber field, but the default backend rejects phone numbers unless the phoneNumber auth plugin is loaded (auth.plugins.phoneNumber). The fix gated the param with the established visible: 'features.phoneNumber == true' predicate.

The problem is that nothing guarantees coverage — which is exactly why phoneNumber slipped through while its neighbours were correctly gated (create_user itself is visible: 'features.admin == true', org fields are visible: 'features.organization != false'). Gating is hand-authored per call site, so gaps are silent until a user hits the error.

The class of bug

getPublicConfig().features exposes 8 capability flags (packages/plugins/plugin-auth/src/auth-manager.ts):

twoFactor · passkeys · magicLink · phoneNumber · phoneNumberOtp · sso · organization · admin

Any form field / action param / object field whose backend path requires one of these must be gated with a matching predicate. Today that discipline is unenforced.

Proposed work

1. Audit the remaining high-risk flags — twoFactor, passkeys, magicLink, sso — across action params, object fields, and forms for capability-dependent inputs that ship ungated. (phoneNumber is done.)
2. Guard — add a CI/test check (spec-liveness style) that regresses when a capability-dependent input has no feature gate.
3. (Optional, more durable) introduce a declarative requiresFeature: 'phoneNumber' on param/field schemas; the renderer auto-hides when the feature is off. This turns "remember to gate" from a per-site discipline into a mechanism, replacing hand-written visible: features.X CEL.

Acceptance criteria

• Audit report: every features.*-dependent input is gated, or the exception is documented.
• A CI check that fails if a new capability-dependent input ships ungated.
• (If declarative path chosen) requiresFeature supported in spec and honored by the objectui renderer.

References

• Phone fix: framework feat(spec,platform-objects): action param 'visible' predicate; gate create-user phone on features.phoneNumber #2871 (spec + create_user gate), objectui fix(security): platform admins see all rows of better-auth-managed identity objects (ADR-0024 / cloud#551) #2406 (filterVisibleParams renderer)
• Gating today: packages/platform-objects/src/identity/sys-user.object.ts (create_user params); features assembled in packages/plugins/plugin-auth/src/auth-manager.ts
• Renderer: objectui packages/app-shell/src/views/ActionParamDialog.tsx → filterVisibleParams

Surfaced during go-live UAT while confirming the phone-field fix.