feat(seed): never mint usr_system — resolve os.user.id to NULL at seed time

Eliminates the usr_system placeholder entirely (not just lazily). The seed
loader now binds os.user to a NULL identity when none is supplied, so
`owner_id: cel`os.user.id`` resolves to NULL instead of crashing or dropping the
record — semantically "owned by whoever becomes the first admin", which the
first-admin handoff (claimSeedOwnership) then fills in.

- objectql/seed-loader: bind `user: identity?.user ?? { id: null }`; the
  unresolved-expression error message no longer tells authors to provision a
  system user (os.user.id now resolves to null).
- runtime/app-plugin: remove `ensureSeedIdentity` (the only code that inserted a
  usr_system row) and its SystemUserId import; pass no seed identity.
- spec: SystemUserId.SYSTEM redocumented as a reserved id that is NO LONGER
  auto-provisioned — kept only so legacy DBs' exclusion guards / ownership
  handoff still recognize a pre-existing usr_system row.

Tests: new seed-loader-os-user test (os.user.id → null under null identity, →
real id when supplied); updated the runtime seed-loader test that asserted the
old fail-loud-on-unbound contract. objectql 665, runtime 388, plugin-security 97
all green.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: os-zhuang

packages/objectql/src/seed-loader-os-user.test.ts

@@ -0,0 +1,37 @@
+// Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.
+
+import { describe, it, expect } from 'vitest';
+import { resolveSeedRecord } from '@objectstack/formula';
+
+/**
+ * The SeedLoader binds `os.user` to a NULL identity (`{ id: null }`) when no
+ * real user exists at seed time (the normal case). This proves the resolution
+ * behavior that lets us drop the `usr_system` placeholder entirely:
+ * `owner_id: cel`os.user.id`` resolves to NULL (not a crash, not a dropped
+ * record), and the first-admin handoff later claims the NULL-owned row.
+ */
+describe('seed os.user binding (usr_system-free)', () => {
+  const cel = (source: string) => ({ dialect: 'cel', source });
+
+  it('resolves os.user.id to null under a NULL identity (no error, no drop)', () => {
+    const rec = { name: 'Acme', owner_id: cel('os.user.id') };
+    const ctx = { now: new Date(), user: { id: null }, org: undefined, env: {} };
+
+    const result = resolveSeedRecord(rec as any, ctx as any);
+
+    expect(result.ok).toBe(true);
+    expect((result as any).value.owner_id).toBeNull();
+    // Non-identity dynamic values still resolve normally alongside it.
+    expect((result as any).value.name).toBe('Acme');
+  });
+
+  it('still resolves a real os.user.id when an identity IS supplied (per-org replay)', () => {
+    const rec = { owner_id: cel('os.user.id') };
+    const ctx = { now: new Date(), user: { id: 'usr_real_admin' }, org: undefined, env: {} };
+
+    const result = resolveSeedRecord(rec as any, ctx as any);
+
+    expect(result.ok).toBe(true);
+    expect((result as any).value.owner_id).toBe('usr_real_admin');
+  });
+});

packages/objectql/src/seed-loader.ts

@@ -208,14 +208,23 @@ export class SeedLoaderService implements ISeedLoaderService {
     const seedNow = new Date();
 
     // Identity/context bound to seed CEL expressions. `os.user` / `os.org`
-    // resolve from here, so `owner_id: cel\`os.user.id\`` works. When no
-    // identity is supplied, `os.user` / `os.org` are simply unbound and any
-    // record that references them fails loudly below (rather than silently
-    // writing a raw Expression envelope into the column).
+    // resolve from here, so `owner_id: cel\`os.user.id\`` works.
+    //
+    // When no real user identity is supplied (the normal case — seeds run
+    // before the first human sign-up), `os.user` is bound to a NULL identity
+    // (`{ id: null }`) rather than left undefined. This makes `os.user.id`
+    // resolve to `null` instead of crashing the expression, so a seed's
+    // `owner_id: cel\`os.user.id\`` simply lands NULL — semantically "owned by
+    // whoever becomes the first admin", which the first-admin handoff
+    // (`claimSeedOwnership`) then fills in. The platform therefore never has to
+    // mint a placeholder `usr_system` row just to satisfy this expression.
     const seedIdentity = config.identity;
     const baseEvalCtx = {
       now: seedNow,
-      user: seedIdentity?.user,
+      // `id: null` is a legitimate seed-time state (the owning admin does not
+      // exist yet) that the formula EvalContext's `user.id: string` type does
+      // not yet model — cast the fallback so `os.user.id` evaluates to null.
+      user: seedIdentity?.user ?? ({ id: null } as unknown as NonNullable<typeof seedIdentity>['user']),
       // Fall back to the per-tenant organizationId so `os.org.id` resolves
       // during per-org replay even without an explicit identity.org.
       org: seedIdentity?.org ?? (config.organizationId ? { id: config.organizationId } : undefined),
@@ -245,8 +254,9 @@ export class SeedLoaderService implements ISeedLoaderService {
           recordIndex: i,
           message:
             `Cannot resolve dynamic seed values for ${objectName} record #${i}: ${seedResult.error.message}. ` +
-            'Records using cel`os.user.id` / cel`os.org.id` require a seed identity — ' +
-            'ensure a system/admin user exists before seeding (see SeedLoaderConfig.identity).',
+            '`os.user.id` resolves to null at seed time (the owning admin does not exist yet) and ' +
+            'owner-style fields are assigned by the first-admin handoff — so a required, non-owner ' +
+            'field must not depend on it. Provide a literal value or make the field optional.',
         };
         errors.push(error);
         allErrors.push(error);

packages/runtime/src/app-plugin.ts

@@ -5,7 +5,6 @@ import { readEnvWithDeprecation } from '@objectstack/types';
 import { SeedLoaderService } from './seed-loader.js';
 import { loadDisabledPackageIds } from './package-state-store.js';
 import type { IMetadataService, II18nService } from '@objectstack/spec/contracts';
-import { SystemUserId } from '@objectstack/spec/system';
 import { QuickJSScriptRunner } from './sandbox/quickjs-runner.js';
 import { hookBodyRunnerFactory, actionBodyRunnerFactory } from './sandbox/body-runner.js';
 
@@ -472,20 +471,14 @@ export class AppPlugin implements Plugin {
                      object: d.object,
                  }));
 
-             // Resolve the seed identity (os.user) ONLY when a seed actually
-             // references it. The modern ownership model leaves `owner_id`
-             // unset in seeds and lets the first-admin handoff
-             // (`claimSeedOwnership`) re-own NULL rows to the promoted admin —
-             // so most bundles never touch `os.user`, and the non-loginable
-             // `usr_system` placeholder need not exist at all. We provision it
-             // lazily (backward-compatible) only for the rare seed that embeds
-             // `cel`os.user.id`` (detected via the serialized CEL `source`).
-             // `os.org` is unaffected — the loader derives it from
-             // `organizationId`, not from this identity.
-             const seedsReferenceOsUser = JSON.stringify(normalizedDatasets).includes('os.user');
-             const seedIdentity = seedsReferenceOsUser
-                 ? await this.ensureSeedIdentity(ql, ctx.logger)
-                 : undefined;
+             // No seed identity is provisioned. The platform never mints a
+             // placeholder `usr_system`: seeds leave `owner_id` unset (or use
+             // `cel`os.user.id``, which the loader resolves to NULL since the
+             // owning admin does not exist yet), and the first-admin handoff
+             // (`claimSeedOwnership`) re-owns those NULL rows to the promoted
+             // admin. `os.org` is still derived from `organizationId` inside the
+             // loader, independent of this.
+             const seedIdentity = undefined;
 
              // Stash datasets on a kernel service so SecurityPlugin's
              // sys_organization insert hook can replay them per-tenant
@@ -667,78 +660,6 @@ export class AppPlugin implements Plugin {
         this.emitCatalogEvent(ctx, 'app:unregistered', sys);
     }
 
-    /**
-     * Lazily provision the identity bound to `os.user` for seed CEL values.
-     *
-     * Called ONLY when a seed dataset actually embeds `cel`os.user.id`` (see the
-     * caller's `seedsReferenceOsUser` guard). The modern ownership model does
-     * not need this: seeds leave `owner_id` NULL and the first-admin bootstrap
-     * (`claimSeedOwnership` in plugin-security) re-owns those rows to the
-     * promoted human admin — so a typical bundle never references `os.user`, and
-     * the `usr_system` placeholder is never created.
-     *
-     * It survives only as a backward-compatible fallback for the rare seed that
-     * still embeds `cel`os.user.id``: such a seed runs before the first human
-     * sign-up, so we upsert a single non-loginable **system user**
-     * (`usr_system`) and bind it as `os.user` so the expression resolves instead
-     * of dropping the record.
-     *
-     * Why a dedicated system user rather than the login admin:
-     *  - `sys_user` is better-auth-managed and schema-locked (ADR-0010); the
-     *    password lives in `sys_account`, so a *loginable* admin can only be
-     *    minted through better-auth (the CLI does this via HTTP sign-up after
-     *    boot). A raw insert here would bypass those invariants.
-     *  - `usr_system` is an owner identity only (no credential row), analogous
-     *    to Salesforce's "Automated Process" user. The human admin is created
-     *    independently and need not be the seed owner.
-     *
-     * Idempotent: matches by the stable id, inserts once, reuses thereafter.
-     * Failures are non-fatal (logged) — records that actually need `os.user`
-     * then fail loudly in the loader with an actionable message.
-     */
-    private async ensureSeedIdentity(
-        ql: any,
-        logger: PluginContext['logger'],
-    ): Promise<{ user: { id: string; role: string; email: string } }> {
-        // Deterministic, non-loginable service identity that owns seeded data.
-        const SYSTEM_USER_ID = SystemUserId.SYSTEM;
-        const SYSTEM_USER_EMAIL = 'system@objectstack.local';
-        const identity = { user: { id: SYSTEM_USER_ID, role: 'system', email: SYSTEM_USER_EMAIL } };
-        const opts = { context: { isSystem: true } } as any;
-
-        try {
-            const existing = await (ql as any).find(
-                'sys_user',
-                { where: { id: SYSTEM_USER_ID }, limit: 1 },
-                opts,
-            );
-            if (Array.isArray(existing) && existing.length > 0) {
-                return identity;
-            }
-            await (ql as any).insert(
-                'sys_user',
-                {
-                    id: SYSTEM_USER_ID,
-                    name: 'System',
-                    email: SYSTEM_USER_EMAIL,
-                    email_verified: true,
-                    role: 'system',
-                },
-                opts,
-            );
-            logger.info(
-                `[Seeder] Provisioned deterministic system user (${SYSTEM_USER_ID}) as seed owner — binds os.user for identity-derived seed values`,
-            );
-        } catch (err: any) {
-            // Non-fatal: identity-dependent records will fail loudly in the
-            // loader; identity-free records still seed normally.
-            logger.warn('[Seeder] Failed to ensure system seed user; os.user-dependent seeds may be dropped', {
-                error: err?.message ?? String(err),
-            });
-        }
-        return identity;
-    }
-
     /**
      * Emit a kernel hook so the control-plane `AppCatalogService` can
      * upsert / delete the corresponding `sys_app` row. Silently no-ops

packages/runtime/src/seed-loader.test.ts

@@ -1102,7 +1102,7 @@ describe('SeedLoaderService', () => {
       );
     });
 
-    it('fails loudly (no raw envelope written) when os.user is unbound', async () => {
+    it('resolves os.user.id to NULL (not a drop) when no identity is supplied', async () => {
       const metadata = createMockMetadata({
         note: { name: 'note', fields: { name: { type: 'text' }, author: { type: 'text' } } },
       });
@@ -1119,16 +1119,20 @@ describe('SeedLoaderService', () => {
             records: [{ name: 'N1', author: cel('os.user.id') }],
           },
         ],
-        // No identity → os.user unbound → record must be dropped, not written.
+        // No identity → the loader binds os.user to a NULL identity, so
+        // `os.user.id` resolves to null and the record seeds with author=null.
+        // The platform never mints a `usr_system` placeholder; owner-style
+        // fields are filled later by the first-admin handoff.
         config: baseConfig(),
       });
 
-      expect(result.success).toBe(false);
-      expect(result.summary.totalErrored).toBe(1);
-      expect(result.errors).toHaveLength(1);
-      expect(result.errors[0].message).toContain('os.user');
-      // Critically: the unresolved Expression envelope is NEVER persisted.
-      expect(engine.insert).not.toHaveBeenCalled();
+      expect(result.success).toBe(true);
+      expect(result.summary.totalErrored).toBe(0);
+      expect(engine.insert).toHaveBeenCalledWith(
+        'note',
+        expect.objectContaining({ name: 'N1', author: null }),
+        expect.anything(),
+      );
     });
 
     it('falls back os.org.id to organizationId during per-tenant replay', async () => {

packages/spec/src/system/constants/system-names.ts

@@ -80,18 +80,20 @@ export type SystemObjectName = typeof SystemObjectName[keyof typeof SystemObject
  */
 export const SystemUserId = {
   /**
-   * Deterministic, non-loginable service identity — a lazily-provisioned
-   * fallback for seeds that embed `cel`os.user.id``.
+   * Reserved well-known id for the legacy non-loginable system service account.
    *
-   * The default ownership model does NOT use this: seeds leave `owner_id` NULL
-   * and the first-admin bootstrap (`claimSeedOwnership`) re-owns those rows to
-   * the promoted human admin, so a typical bundle never references `os.user`
-   * and this row is never created. It is upserted (by the runtime's
-   * `ensureSeedIdentity`) ONLY when a seed still embeds `cel`os.user.id``, so
-   * that expression resolves before the first human sign-up instead of dropping
-   * the record. Has no `sys_account` credential, so it cannot sign in;
-   * analogous to Salesforce's "Automated Process" user. The human login admin
-   * is minted separately through better-auth.
+   * NO LONGER AUTO-PROVISIONED. Ownership now works without it: seeds leave
+   * `owner_id` NULL (and `cel`os.user.id`` resolves to NULL at seed time, since
+   * the owning admin does not exist yet), and the first-admin bootstrap
+   * (`claimSeedOwnership`) re-owns those NULL rows to the promoted human admin.
+   * The runtime never mints a `usr_system` row.
+   *
+   * This constant survives only for backward compatibility: DBs created by an
+   * older runtime may still contain a `usr_system` row, so the first-admin
+   * exclusion guards (it must never be mistaken for a human admin) and the
+   * ownership handoff (which also claims any `owner_id = usr_system` rows) keep
+   * referencing it. On a fresh boot no such row exists and those references are
+   * harmless no-ops.
    */
   SYSTEM: 'usr_system',
 } as const;