[elliotBraem]

Closes #122 — C3 phase 0 of the cutover plan (#118). Must land before the AUTH_DATABASE_URL flip.

Change

Top-level auth key in bos.app.ts (sibling of ui/api):

auth: {
  extends: "bos://nearbuilding.near/nearbuilders.org#app.auth",
  ui: false,
},

Why this is the correct mechanism (verified against the rc.39 resolver)

• release-composition.ts treats any entry naming extends (REMOTE_SOURCE_KEYS) as child-authored; authored remotes are skipped by stampInheritedRemotes in both the deploy train and consumer boots. So authoring the auth slot removes it from OUR release plane — the slot live-follows nearbuilders.org's published entry instead of being re-pointed at our pin's bytes.
• ui: false drops nearbuilders.org's attached site UI (per the plugin opt-out convention); without it, their app.ui would compose as the auth plugin's UI. The generated runtime map correspondingly loses its auth-ui source (committed regenerated artifacts).
• _resolved.extendsChain unchanged (per-entry extends, not a lineage edge); base platform extends, release pin, and our own ui/api surface untouched.

Resolved state today

The resolved app.auth equals the base rc.39 bytes — expected: nearbuilders.org publishes no custom auth yet (nearbuilders.org/bos.app.ts has none; both apps are rc.39). The pin's value is prospective: when nearbuilders.org bumps their framework and republishes, our auth follows their entry with no code change here, and only nearbuilders.org boots can migrate the shared auth DB.

Verify

• pnpm run types:gen → .bos/bos.resolved-config.json: app.auth.extends recorded, _resolved.extendsChain unchanged, app.ui still ours
• pnpm run typecheck green; pnpm run test green (204 api + 110 ui)
• Post-deploy smoke: SIWN sign-in, session, org switcher lists expected orgs
• On deploy: bos publish snapshots the pinned auth remote

Upstream residual (journal-ahead boot guard): NEARBuilders/everything-dev#805.