accounts · bind and read the tenant and user under the library's setting names (codefly.current_tenant_id / codefly.current_user_id), not app.current_org_id / app.current_user_id #1293

Read from authority-interface (61100e0, 26 Oct) and main on 2026-11-03 while writing "v2 from the code · volume 2: tenancy and data".

What is wrong

The host binds the caller's organisation and user per transaction and 136 row-level policies read them back (module/services/store/migrations/1_baseline.up.sql: 53 policies on current_setting('app.current_org_id'), 37 on app.current_user_id; pkg/infra/scoped.go seeds them once from the identity; postgres_effect_receipts.go:28 and the WithOrgTx/WithUserTx paths set them). The names are the host's own.

The platform's Postgres library — codefly-dev/service-postgres libs/go/store.go:511-514 — defaults to codefly.current_tenant_id / codefly.current_user_id, and that is what the library's scoped transaction installs and what robin (migration 15) and runtime (migrations 4/20) read. The document store copied the host's names (its migration 52: "so an operator reading either database's policies reads one convention") and is being moved to the library's in a sibling issue (obin-ai/module-document-store). After that the host is the only store on app.*.

What to do

One PR:

1. A migration that drops and recreates every policy reading app.current_org_id or app.current_user_id with codefly.current_tenant_id / codefly.current_user_id, preserving each policy's USING / WITH CHECK shape, FORCE, and the role lists. Generate it from the catalog (pg_policies) rather than by hand so none of the 136 is missed, and ship the .down.sql that recreates the old names. Tables without a policy (the platform-global ones: plans, identity_providers, platform_admins, solution_registrations, …) are untouched.
2. Every Go site that sets or reads the setting: git grep -n -E "app\.current_(org|user)_id" over module/services/accounts/code — scoped.go, postgres_effect_receipts.go, postgres_org.go, postgres_permissions.go, the control-plane paths, and tests. One constant per setting, named once. If the store is built through the service-postgres library with WithScopeSettings, drop the override instead.
3. Qualification and conformance: the host conformance suite's isolation cases ("another installation's and another organization's members never reach the principal's data") and the 44 cross-tenant test files must pass unchanged in meaning; the image qualification that asserts RLS, if any, follows the rename.
4. Docs: docs/, AGENTS.md/README mentions of app.current_org_id, and the migration's own narrative, in the same PR.

Semantics do not change: transaction-local, fail-closed, forced, NOBYPASSRLS roles, app_tenant as the request default and app_control_plane on its own login. This is a rename so that the platform's stores read one convention — the library's.

Note: #1292 (host-interface conformance in CI) is open on this repo; it touches pkg/adapters and CI, not migrations or pkg/infra. Check for overlap before opening the PR.