Organization Sync (SaaS IDE)

Organization management for the CFactory SaaS IDE lives in a hosted control plane (or the cfactory-admin React + shadcn UI in this monorepo). The CLI runtime (packages/opencode) is the only sync consumer. Editors inherit via cfactory serve.

Hard invariants

1. Organization artifacts never enter a git worktree (no writes to .cfactory/, AGENTS.md, or marketplace-style project installs).
2. Org and user content coexist (source: "organization" vs user). Same basename does not clobber.
3. Free-form mergeDeep of /api/config is rejected. Only allowlisted keys apply.

Allowlisted /api/config

Accepted:

• skills.urls (HTTPS indexes pulled into ~/.cache/cfactory/org/<orgId>/skills/)
• instructions (HTTPS URLs only)
• cfactory.org (models, providers, mcp, extra skill/instruction URLs)

cfactory.org.models fields:

• allow / deny / defaultModel
• allowLocalModelOverrideByProject — map of projectId → boolean (resolved against org-bindings.json)
• allowLocalModelOverride — optional global fallback

cfactory.org.providers fields (structured; never free-form provider merge):

• enabled — CFly staff master switch for the org
• allowCustom — org admin: members may add local custom providers
• catalog — org-published provider entries (id, name, npm, baseURL, models) with no secrets

Ignored (examples): permission, mcp, agent, formatter, tui, provider, skills.paths.

CLI entrypoints

Sync runs on Config load for TUI, cfactory run, and cfactory serve. Acceptance: org skills/rules appear without the VS Code extension installed.

Org model/provider policy is applied at runtime:

• When allowLocalModelOverride is false for the bound project, local model / small_model / subagent_model / agent.*.model overrides are ignored and defaultModel is applied.
• Provider catalog entries are additive; local OpenAI-compatible custom providers are stripped when staff has not enabled the feature or the admin has disabled custom adds.
• consoleManagedProviders is populated from the org catalog.
• The model catalog is pre-filtered with modelAllowed().

Project bind

~/.config/cfactory/org-bindings.json maps directory or git remote → organizationId + projectId. The CLI sets CFACTORY_PROJECT_ID for gateway usage headers.

Model policy

Gateway returns 403 for disallowed models. Catalog endpoints filter the list. Client UI filter alone is insufficient.

Provider policy

Admin UI: Governance → Providers. Staff toggle lives on the Organization page when profile.user.staff is true.

Admin UI kit

packages/cfactory-admin uses React + shadcn + Tailwind, dark-first, primary #d2006f (CFly brand pink). It does not use Solid cfactory-ui.