[nmnmcc]

New and upgraded installations now require an invitation or an explicit administrator grant to create an account. Existing accounts and memberships remain available; organization creation defaults to platform administrators.

This adds one admission check for OIDC, organization SSO and invitation callbacks; independent approval requests with version checks; account suspension with credential revocation; and exact SSO group mappings that preserve manual roles. It also adds optional email code sign-in for teams without an identity provider, bound to verified email and the same admission policy.

The public API includes admission settings, users, grants, approvals and platform audit records. Four additive migrations preserve old users and roles. Setup accepts a private JSON file and a provider-bound administrator identity. openbot-inspect returns a redacted deployment snapshot. The mail and invitation work is included, with English, Chinese and German documentation and generated API reference updates.

Validation:

• PR CI passes the workspace build, type checks, Effect rules and tests, including all 983 server tests and 159 E2E tests (one skipped).
• Admission, authentication callbacks, email sign-in, mapping and old-data migration tests pass. Regressions check the setup admin against domain rules and keep email codes out of trusted SSO.
• Production Docker checks pass, including two nodes, private RPC, repeated migrations, redacted inspection and the maintenance lock. Image layer and vulnerability checks pass.

A separate tag run hit an intermittent Bot grant E2E failure. The same commit passed PR CI and the full release test rerun. The full E2E suite also passed with two CPU cores (159 passed, one skipped), and the focused test passed repeated runs. No production workaround or test skip was added. The internal email deployment stays closed until its real mail, employee and Cloudflare Access settings pass live checks.