feat(security): wire app-declared default profile through the CLI (ADR-0056 D7)

D7 added `isDefault` to PermissionSet and resolves it in the SecurityPlugin
constructor — but only over the plugin's built-in `defaultPermissionSets`.
The CLI boots `new SecurityPlugin()` with no options, so an `isDefault`
profile declared purely in APP METADATA was silently ignored under
`pnpm dev`. This closes that gap:

- `appDefaultProfileName(permissions)` — exported helper that extracts the
  first `isProfile && isDefault` profile name from a stack's permissions.
- CLI `serve.ts` calls it and passes the name as `fallbackPermissionSet`
  (undefined → built-in default preserved, so non-declaring apps are
  unaffected). At request time the name resolves through the metadata
  service / `sys_permission_set` like any user-defined permission set.
- Showcase declares `showcase_member_default` (isDefault) — a read-mostly
  baseline for fresh sign-ups, so `pnpm dev` demonstrates an app-declared
  default posture instead of the built-in wildcard.

Proofs: unit test for `appDefaultProfileName`, and a showcase dogfood test
that wires the extracted name as the fallback and shows a fresh member is
governed by the declared default (reads announcements, denied private notes
the built-in wildcard would have allowed).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XVdnfUAx85amkerym26vdx

Author: claude

examples/app-showcase/src/security/index.ts

@@ -83,6 +83,33 @@ export const ContributorPermissionSet = {
   ],
 };
 
+// ── App-declared DEFAULT PROFILE (ADR-0056 D7) ──────────────────────────────
+/**
+ * The showcase's default access posture for a freshly signed-up user who holds
+ * no explicit grants. `isDefault: true` makes the app declare what "a new member
+ * can do" instead of inheriting the built-in `member_default` wildcard. The CLI
+ * (`pnpm dev`) reads this off the stack and wires it as the SecurityPlugin
+ * fallback (ADR-0056 D7) — without that wiring an `isDefault` flag in app
+ * metadata is silently ignored. Deliberately read-mostly: a brand-new member can
+ * browse the shared catalog + announcements and file tasks/inquiries, but cannot
+ * edit or delete anyone's records (owner/OWD enforcement still applies on top).
+ */
+export const MemberDefaultProfile = {
+  name: 'showcase_member_default',
+  label: 'Showcase Member (Default)',
+  description: 'App-declared default profile for new sign-ups — read-mostly baseline (ADR-0056 D7).',
+  isProfile: true,
+  isDefault: true,
+  objects: {
+    showcase_account: { allowRead: true },
+    showcase_product: { allowRead: true },
+    showcase_project: { allowRead: true },
+    showcase_task: { allowRead: true, allowCreate: true },
+    showcase_announcement: { allowRead: true },
+    showcase_inquiry: { allowRead: true, allowCreate: true },
+  },
+};
+
 // ── Sharing rules ──────────────────────────────────────────────────────────
 /** criteria-based: red-health projects are shared up to executives. */
 export const RedProjectSharingRule = {
@@ -128,6 +155,6 @@ export const ShowcasePolicy = {
 };
 
 export const allRoles = [ContributorRole, ManagerRole, ExecRole];
-export const allPermissionSets = [ContributorPermissionSet];
+export const allPermissionSets = [ContributorPermissionSet, MemberDefaultProfile];
 export const allSharingRules = [RedProjectSharingRule, ContributorTaskSharingRule];
 export const allPolicies = [ShowcasePolicy];

packages/cli/src/commands/serve.ts

@@ -1297,8 +1297,14 @@ export default class Serve extends Command {
             // Pair: SecurityPlugin (RBAC) — optional
             try {
               const securityPkg = '@objectstack/plugin-security';
-              const { SecurityPlugin } = await import(/* webpackIgnore: true */ securityPkg);
-              await kernel.use(new SecurityPlugin());
+              const { SecurityPlugin, appDefaultProfileName } = await import(/* webpackIgnore: true */ securityPkg);
+              // ADR-0056 D7 — honor an app-declared default profile. A stack
+              // permission set marked `isProfile && isDefault` becomes the
+              // fallback for users with no explicit grants. The SecurityPlugin's
+              // own scan only sees its built-in sets, so the CLI passes the
+              // declared name through explicitly (undefined → built-in default).
+              const appDefaultProfile = appDefaultProfileName((config as any)?.permissions);
+              await kernel.use(new SecurityPlugin(appDefaultProfile ? { fallbackPermissionSet: appDefaultProfile } : undefined));
               trackPlugin('Security');
             } catch {
               // optional

packages/dogfood/test/showcase-d7-default-profile.dogfood.test.ts

@@ -0,0 +1,61 @@
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+//
+// SHOWCASE proof for ADR-0056 D7 — the app-declared default profile, wired the
+// way the CLI wires it. The showcase declares `showcase_member_default` with
+// `isDefault: true`; `appDefaultProfileName(stack.permissions)` (the helper the
+// CLI calls) extracts its name, and passing it as the SecurityPlugin
+// `fallbackPermissionSet` makes a fresh sign-up governed by THAT profile instead
+// of the built-in `member_default` wildcard. Read-mostly default ⇒ the member
+// can read announcements but is DENIED the private-note object (which the
+// wildcard would have allowed) — proving the app's declared default is in force.
+
+import { describe, it, expect, beforeAll, afterAll } from 'vitest';
+import showcaseStack from '@objectstack/example-showcase';
+import { bootStack, type VerifyStack } from '@objectstack/verify';
+import { SecurityPlugin, securityDefaultPermissionSets, appDefaultProfileName } from '@objectstack/plugin-security';
+import { PermissionSetSchema, type PermissionSet } from '@objectstack/spec/security';
+
+// Mirror the CLI: pull the app-declared default profile (name + object) off the
+// stack metadata via the same helper the CLI uses.
+const stackPerms = ((showcaseStack as { permissions?: unknown[] }).permissions ?? []) as Array<{ name?: string }>;
+const appDefault = appDefaultProfileName(stackPerms);
+const declaredDefault = stackPerms.find((p) => p?.name === appDefault) as unknown;
+
+describe('showcase: app-declared default profile, CLI-wired (ADR-0056 D7)', () => {
+  let stack: VerifyStack;
+  let memberToken: string;
+
+  beforeAll(async () => {
+    // The full CLI boot loads stack permission sets into the metadata service, so
+    // `fallbackPermissionSet: <name>` resolves there. The lightweight harness does
+    // not seed permission metadata, so we hand the declared default to the plugin
+    // directly — then wire it by NAME exactly as the CLI's appDefaultProfileName
+    // path does (constructor uses the explicit name, not its own isDefault scan).
+    stack = await bootStack(showcaseStack, {
+      security: new SecurityPlugin({
+        defaultPermissionSets: [...securityDefaultPermissionSets, PermissionSetSchema.parse(declaredDefault) as PermissionSet],
+        fallbackPermissionSet: appDefault,
+      }),
+    });
+    await stack.signIn();
+    memberToken = await stack.signUp('d7-showcase-member@verify.test');
+  }, 60_000);
+
+  afterAll(async () => { await stack?.stop(); });
+
+  it('appDefaultProfileName extracts the showcase default profile from stack metadata', () => {
+    expect(appDefault).toBe('showcase_member_default');
+  });
+
+  it('a fresh member is governed by the app-declared default (reads announcements)', async () => {
+    const r = await stack.apiAs(memberToken, 'GET', '/data/showcase_announcement');
+    expect(r.status, 'declared default grants announcement read').toBe(200);
+  });
+
+  it('and NOT by the built-in member_default wildcard (private_note is denied)', async () => {
+    const r = await stack.apiAs(memberToken, 'GET', '/data/showcase_private_note');
+    // member_default has a wildcard grant → would be 200. The app default grants
+    // no private_note access → denied, proving the declared default is in force.
+    expect(r.status, 'declared default does NOT grant private_note').not.toBe(200);
+  });
+});

packages/plugins/plugin-security/src/app-default-profile.test.ts

@@ -0,0 +1,31 @@
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+import { describe, it, expect } from 'vitest';
+import { appDefaultProfileName } from './app-default-profile.js';
+
+describe('appDefaultProfileName (ADR-0056 D7)', () => {
+  it('returns the name of the first isProfile+isDefault permission set', () => {
+    const perms = [
+      { name: 'add_on', isProfile: false, isDefault: true }, // not a profile → skipped
+      { name: 'member', isProfile: true },                   // not default → skipped
+      { name: 'app_default', isProfile: true, isDefault: true },
+      { name: 'second_default', isProfile: true, isDefault: true },
+    ];
+    expect(appDefaultProfileName(perms)).toBe('app_default');
+  });
+
+  it('treats a profile with no explicit isProfile flag as a profile', () => {
+    expect(appDefaultProfileName([{ name: 'd', isDefault: true }])).toBe('d');
+  });
+
+  it('returns undefined when no default profile is declared', () => {
+    expect(appDefaultProfileName([{ name: 'a', isProfile: true }])).toBeUndefined();
+    expect(appDefaultProfileName([])).toBeUndefined();
+    expect(appDefaultProfileName(undefined)).toBeUndefined();
+    expect(appDefaultProfileName(null)).toBeUndefined();
+    expect(appDefaultProfileName('nope')).toBeUndefined();
+  });
+
+  it('ignores a default flag on a non-profile add-on permission set', () => {
+    expect(appDefaultProfileName([{ name: 'addon', isProfile: false, isDefault: true }])).toBeUndefined();
+  });
+});

packages/plugins/plugin-security/src/app-default-profile.ts

@@ -0,0 +1,36 @@
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+
+/**
+ * ADR-0056 D7 — resolve the app-declared default profile NAME from a stack's
+ * `permissions[]` array.
+ *
+ * A permission set marked `isProfile && isDefault` declares the app's default
+ * access posture for users with no explicit grants. The {@link SecurityPlugin}
+ * constructor scans its `defaultPermissionSets` option for that flag — but the
+ * CLI constructs `new SecurityPlugin()` with NO options, so an `isDefault`
+ * profile declared purely in app METADATA would never be honored. The CLI calls
+ * this helper to pull the name out of the stack and pass it as
+ * `fallbackPermissionSet`, wiring the declaration through to `pnpm dev`.
+ *
+ * Returns the first matching profile's `name`, or `undefined` when none is
+ * declared (callers then keep the built-in `member_default` fallback).
+ */
+export function appDefaultProfileName(permissions: unknown): string | undefined {
+  if (!Array.isArray(permissions)) return undefined;
+  for (const p of permissions) {
+    if (p && typeof p === 'object') {
+      const ps = p as { name?: unknown; isProfile?: unknown; isDefault?: unknown };
+      // `isProfile !== false` mirrors the stack convention where profiles double
+      // as the user's baseline; permission-set add-ons set `isProfile: false`.
+      if (
+        ps.isDefault === true &&
+        ps.isProfile !== false &&
+        typeof ps.name === 'string' &&
+        ps.name.length > 0
+      ) {
+        return ps.name;
+      }
+    }
+  }
+  return undefined;
+}

packages/plugins/plugin-security/src/index.ts

@@ -25,3 +25,4 @@ export {
 } from './auto-org-admin-grant.js';
 export { bootstrapPlatformAdmin } from './bootstrap-platform-admin.js';
 export { claimSeedOwnership } from './claim-seed-ownership.js';
+export { appDefaultProfileName } from './app-default-profile.js';