@stigmer/cli 3.23.1-dev.20260923075205 → 3.25.0

package/src/commands/config/context.ts

@@ -1,10 +1,18 @@
-// `stigmer config context show` — display the active CLI context.
+// `stigmer config context show|set` — the active CLI context: the
+// organization every command targets when neither `--org` nor
+// STIGMER_ORG_ID names one.
 //
-// `context set --org` validates the organization against the server before
-// persisting, so it is wired once the backend client lands (see registerConfig).
+// `set --org <slug>` checks the slug against the active backend before it
+// persists: the organization must be one the caller belongs to there
+// (findMyOrganizations), so a typo or a stranger's slug is refused at the
+// moment it is typed, not on the next command. An empty slug clears the
+// context without asking the backend, and the resolver falls back to its
+// default again. The raw `config set context.organization` stays the
+// unchecked escape hatch.
 
 import type { Command } from "commander";
-import { type Config, load, resolveContextOrganization } from "../../config/index.js";
+import { type Config, activeBackendName, ensureAuthenticated, load, resolveContextOrganization, save } from "../../config/index.js";
+import { CliExitError, ExitCode, UsageError } from "../../errors/index.js";
 import { CommandResult, type OutputFlags, renderResult } from "../../output/index.js";
 import { addResultFlags, resultFormat } from "../shared.js";
 
@@ -16,11 +24,48 @@ export function addContextCommands(context: Command): void {
       renderResult(buildShow(load()), resultFormat(options));
     });
   addResultFlags(show);
+
+  const set = context
+    .command("set")
+    .description("set the active context's organization, checked against the backend")
+    .option("--org <slug>", "an organization you belong to on the active backend (empty clears it)")
+    .action((options: OutputFlags & { org?: string }) => runSet(options));
+  addResultFlags(set);
 }
 
 function buildShow(config: Config): CommandResult {
   const organization = resolveContextOrganization(config) || "(not set)";
   const result = CommandResult.success("CLI context");
-  result.addSection("").field("Organization", organization).field("Backend", config.backend.type);
+  result.addSection("").field("Organization", organization).field("Backend", activeBackendName(config));
   return result;
 }
+
+async function runSet(flags: OutputFlags & { org?: string }): Promise<void> {
+  const org = flags.org;
+  if (org === undefined) {
+    throw new UsageError(
+      "--org is required\n\nSet it with:\n  stigmer config context set --org <org>\nClear it with:\n  stigmer config context set --org \"\"",
+    );
+  }
+
+  const config = load();
+  if (org !== "") await assertMembership(config, org);
+
+  (config.context ??= {}).organization = org;
+  save(config);
+  const message = org === "" ? "Context organization cleared" : `Context organization set to '${org}'`;
+  renderResult(CommandResult.success(message), resultFormat(flags));
+}
+
+async function assertMembership(config: Config, org: string): Promise<void> {
+  const { connectBackend } = await import("../../backend.js");
+  const client = connectBackend(config);
+  ensureAuthenticated(client.config);
+  const mine = await client.stigmer.organization.findMyOrganizations();
+  if (mine.entries.some((entry) => entry.metadata?.slug === org)) return;
+  throw new CliExitError(
+    `organization '${org}' is not one you belong to on the '${activeBackendName(config)}' backend`,
+    ExitCode.NotFound,
+    ["See the organizations you belong to with: stigmer list organizations"],
+  );
+}

package/src/commands/marketplace.test.ts

@@ -169,11 +169,11 @@ describe("marketplace show", () => {
     expect(payload.data.warnings[0].subject).toBe("ghost");
   });
 
-  it("shows the built-in marketplace, which installs nothing by default", async () => {
+  it("shows the built-in marketplace", async () => {
     const outcome = await run("show", "stigmer", "--json");
     expect(outcome.exitCode).toBe(ExitCode.Success);
     const payload = JSON.parse(outcome.stdout);
-    expect(payload.data.marketplace.defaults).toEqual([]);
+    expect(payload.data.marketplace.name).toBe("stigmer");
     expect(payload.data.plugins.map((p: { name: string }) => p.name)).toContain(
       "linear",
     );

package/src/commands/up.ts

@@ -74,7 +74,7 @@ async function runUp(run: UpRun, flags: OutputFlags): Promise<void> {
     return;
   }
 
-  // The card renders when the stack is serving and seeded — the moment the
+  // The card renders when the stack is serving and bootstrapped — the moment the
   // detached shape would have returned — and the process then stays up,
   // mirroring the server's and runner's output, until a shutdown signal.
   const code = await launch.upForeground(run, homedir(), {

package/src/config/index.ts

@@ -20,6 +20,7 @@ export {
 } from "./config.js";
 export {
   DEFAULT_CLOUD_CONSOLE_URL,
+  DEFAULT_LOCAL_ORG,
   ensureAuthenticated,
   resolveConsoleURL,
   resolveContextOrganization,

package/src/config/resolve.test.ts

@@ -150,11 +150,11 @@ describe("resolveOrganization", () => {
     );
   });
 
-  it("defaults to the system org in local mode when nothing is configured", () => {
+  it("defaults to the stigmer org in local mode when nothing is configured", () => {
     expect(resolveOrganization(localConfig())).toBe("stigmer");
   });
 
-  it("defaults to the system org on a selfhost backend (it IS the OSS server)", () => {
+  it("defaults to the stigmer org on a selfhost backend (it IS the OSS server)", () => {
     expect(resolveOrganization(selfhostConfig())).toBe("stigmer");
   });
 

package/src/config/resolve.ts

@@ -8,7 +8,6 @@
 
 import { CliExitError, ExitCode } from "../errors/index.js";
 import { SERVER_PORT } from "../local/constants.js";
-import { SYSTEM_ORG } from "../local/system-org.js";
 import { type Config, activeBackend, isCloudMode } from "./config.js";
 
 const DEFAULT_CLOUD_ENDPOINT = "api.stigmer.ai:443";
@@ -17,13 +16,14 @@ const DEFAULT_LOCAL_ENDPOINT = "localhost:7234";
 /** Well-known URL for the Stigmer Cloud web console. */
 export const DEFAULT_CLOUD_CONSOLE_URL = "https://app.stigmer.ai";
 
-// Local mode is single-tenant: the bootstrap `stigmer up` runs creates the
-// system org and installs the default plugins into it, so bare-slug
-// `get`/`run`/`apply` in local mode fall back to that org when nothing else
-// is configured. The same holds for selfhost backends — they ARE the OSS
-// server. Cloud mode has no implicit org — the caller must select one
-// (flag/env/context/login).
-const DEFAULT_LOCAL_ORG = SYSTEM_ORG;
+/**
+ * The organization a local or selfhost backend falls back to when nothing
+ * names one, so bare-slug `get`/`run`/`apply` resolve without ceremony.
+ * `stigmer up` creates it on the local stack and `stigmer bootstrap` on a raw
+ * self-hosted server (local/bootstrap.ts). Cloud mode has no implicit org —
+ * the caller must select one (flag/env/context/login).
+ */
+export const DEFAULT_LOCAL_ORG = "stigmer";
 
 /**
  * Resolve the server endpoint.

package/src/local/bootstrap.test.ts

@@ -1,99 +1,166 @@
-// Pins the local bootstrap's shape: prepare, then run, over one client; a
-// preparation failure skips the run with one warning naming the retry; a
-// run that cannot start is one warning; a default that failed to land is one
-// warning per default naming `stigmer bootstrap`; nothing throws past the
-// bootstrap.
+// Pins the bootstrap's one act over a real Connect backend: an org the
+// identity already sees is `present` with no create; an absent one is created
+// as the Organization as code (slug, name, self-managed) with NO label, since
+// a reserved `stigmer.ai/` label is refused by a self-hosted server with
+// authentication on (stigmer/stigmer#1192); a create that loses the race to
+// another launcher (ALREADY_EXISTS) is `present`, not an error; any other
+// refusal propagates with the server's sentence. And the local shape `up`
+// runs: it announces a created org, stays quiet on a present one, and turns
+// any failure into one warning naming the retry, never a throw.
 
-import { describe, expect, it } from "vitest";
+import {
+  createServer as createHttp2Server,
+  type Http2Server,
+  type ServerHttp2Session,
+} from "node:http2";
+import type { AddressInfo } from "node:net";
+import { create } from "@bufbuild/protobuf";
+import { Code, ConnectError, type ConnectRouter } from "@connectrpc/connect";
+import { connectNodeAdapter } from "@connectrpc/connect-node";
+import {
+  type Organization,
+  OrganizationSchema,
+} from "@stigmer/protos/ai/stigmer/tenancy/organization/v1/api_pb";
+import { OrganizationCommandController } from "@stigmer/protos/ai/stigmer/tenancy/organization/v1/command_pb";
+import { ManagementMode } from "@stigmer/protos/ai/stigmer/tenancy/organization/v1/enum_pb";
+import { OrganizationsSchema } from "@stigmer/protos/ai/stigmer/tenancy/organization/v1/io_pb";
+import { OrganizationQueryController } from "@stigmer/protos/ai/stigmer/tenancy/organization/v1/query_pb";
+import { createNodeClient, normalizeEndpoint } from "@stigmer/sdk/node";
 import type { Stigmer } from "@stigmer/sdk";
+import { afterAll, beforeAll, beforeEach, describe, expect, it } from "vitest";
 import type { BackendClient } from "../client/index.js";
-import {
-  type BootstrapResult,
-  type PreparedBootstrap,
-  bootstrapLocalBackend,
-} from "./bootstrap.js";
+import { DEFAULT_LOCAL_ORG } from "../config/resolve.js";
+import { bootstrapBackend, bootstrapLocalBackend } from "./bootstrap.js";
 
-const stigmer = {} as unknown as Stigmer;
-const client = { stigmer } as unknown as BackendClient;
-const prepared: PreparedBootstrap = { defaults: [] };
+let backend: Http2Server;
+let stigmer: Stigmer;
+const openSessions = new Set<ServerHttp2Session>();
 
-function converged(): BootstrapResult {
-  return { org: "present", plugins: { outcomes: [], failed: [] } };
-}
+/** The orgs the backend holds, by slug. */
+let held: Map<string, Organization>;
+let creates: Organization[];
+/** What `create` answers with instead of creating, when set. */
+let refuseCreate: ConnectError | undefined;
 
-describe("bootstrapLocalBackend", () => {
-  it("prepares, then runs, over the same client", async () => {
-    const order: string[] = [];
-    await bootstrapLocalBackend({
-      client,
-      say: () => {},
-      prepare: async () => {
-        order.push("prepare");
-        return prepared;
-      },
-      run: async (s, p) => {
-        expect(s).toBe(stigmer);
-        expect(p).toBe(prepared);
-        order.push("run");
-        return converged();
+beforeAll(async () => {
+  const routes = (router: ConnectRouter) => {
+    router.service(OrganizationQueryController, {
+      findMyOrganizations: () =>
+        create(OrganizationsSchema, { entries: [...held.values()] }),
+    });
+    router.service(OrganizationCommandController, {
+      create: (org) => {
+        creates.push(org);
+        if (refuseCreate !== undefined) throw refuseCreate;
+        const slug = org.metadata?.slug ?? "";
+        const row = create(OrganizationSchema, org);
+        if (row.metadata !== undefined) row.metadata.id = `org_${slug}`;
+        held.set(slug, row);
+        return row;
       },
     });
-    expect(order).toEqual(["prepare", "run"]);
+  };
+  backend = createHttp2Server(connectNodeAdapter({ routes }));
+  backend.on("session", (session) => {
+    openSessions.add(session);
+    session.on("close", () => openSessions.delete(session));
+  });
+  await new Promise<void>((resolve) => backend.listen(0, "127.0.0.1", resolve));
+  const port = (backend.address() as AddressInfo).port;
+  stigmer = createNodeClient({
+    baseUrl: normalizeEndpoint(`127.0.0.1:${port}`),
+  });
+});
+
+afterAll(async () => {
+  for (const session of openSessions) session.destroy();
+  await new Promise<void>((resolve) => backend.close(() => resolve()));
+});
+
+beforeEach(() => {
+  held = new Map();
+  creates = [];
+  refuseCreate = undefined;
+});
+
+describe("bootstrapBackend", () => {
+  it("is present, with no create, when the identity already sees the org", async () => {
+    held.set(
+      DEFAULT_LOCAL_ORG,
+      create(OrganizationSchema, { metadata: { slug: DEFAULT_LOCAL_ORG } }),
+    );
+    expect(await bootstrapBackend(stigmer)).toBe("present");
+    expect(creates).toHaveLength(0);
+  });
+
+  it("creates the Organization as code, with no label, when absent", async () => {
+    held.set("acme", create(OrganizationSchema, { metadata: { slug: "acme" } }));
+    expect(await bootstrapBackend(stigmer)).toBe("created");
+    expect(creates).toHaveLength(1);
+    const sent = creates[0]!;
+    expect(sent.metadata?.slug).toBe(DEFAULT_LOCAL_ORG);
+    expect(sent.metadata?.org).toBe(DEFAULT_LOCAL_ORG);
+    expect(sent.metadata?.name).toBe("Stigmer");
+    expect(sent.metadata?.labels).toEqual({});
+    expect(sent.spec?.managementMode).toBe(ManagementMode.self_managed);
+    expect(sent.spec?.description).not.toBe("");
   });
 
-  it("skips the run when preparation fails, with one warning", async () => {
+  it("treats a create lost to another launcher as present", async () => {
+    refuseCreate = new ConnectError(
+      `organization '${DEFAULT_LOCAL_ORG}' already exists`,
+      Code.AlreadyExists,
+    );
+    expect(await bootstrapBackend(stigmer)).toBe("present");
+  });
+
+  it("propagates any other refusal with the server's sentence", async () => {
+    refuseCreate = new ConnectError("organization creation is disabled", Code.PermissionDenied);
+    await expect(bootstrapBackend(stigmer)).rejects.toThrow(
+      /organization creation is disabled/,
+    );
+  });
+});
+
+describe("bootstrapLocalBackend", () => {
+  const client = { stigmer: {} as unknown as Stigmer } as unknown as BackendClient;
+
+  it("runs the act over the local client and announces a created org", async () => {
     const said: string[] = [];
-    let ran = 0;
+    let seen: Stigmer | undefined;
     await bootstrapLocalBackend({
       client,
       say: (line) => said.push(line),
-      prepare: async () => {
-        throw new Error("offline");
-      },
-      run: async () => {
-        ran += 1;
-        return converged();
+      bootstrap: async (s) => {
+        seen = s;
+        return "created";
       },
     });
-    expect(ran).toBe(0);
-    expect(said).toEqual([
-      "Warning: could not prepare the default plugins, so the local backend was not bootstrapped. Run 'stigmer up' again to retry.",
-    ]);
+    expect(seen).toBe(client.stigmer);
+    expect(said).toEqual([`Created the '${DEFAULT_LOCAL_ORG}' organization`]);
   });
 
-  it("contains a run that cannot start in one warning naming the retry", async () => {
+  it("says nothing when the org is already present", async () => {
     const said: string[] = [];
     await bootstrapLocalBackend({
       client,
       say: (line) => said.push(line),
-      prepare: async () => prepared,
-      run: async () => {
-        throw new Error("backend unreachable");
-      },
+      bootstrap: async () => "present",
     });
-    expect(said).toEqual([
-      "Warning: failed to bootstrap the local backend. Run 'stigmer up' again to retry.",
-    ]);
+    expect(said).toEqual([]);
   });
 
-  it("names each default that did not land and the verb that retries it", async () => {
+  it("contains a failure in one warning naming the retry", async () => {
     const said: string[] = [];
     await bootstrapLocalBackend({
       client,
       say: (line) => said.push(line),
-      prepare: async () => prepared,
-      run: async () => ({
-        org: "created",
-        plugins: {
-          outcomes: [
-            { name: "assistant", action: "failed", error: "refused" },
-          ],
-          failed: ["assistant"],
-        },
-      }),
+      bootstrap: async () => {
+        throw new Error("backend unreachable");
+      },
     });
     expect(said).toEqual([
-      "Warning: failed to install default plugin 'assistant'. Run 'stigmer bootstrap' to retry.",
+      "Warning: failed to bootstrap the local backend. Run 'stigmer up' again to retry.",
     ]);
   });
 });

package/src/local/bootstrap.ts

@@ -1,173 +1,98 @@
-// What makes a backend a ready Stigmer: the system org exists and the
-// official marketplace's default plugins are installed into it, public.
-// `stigmer up` runs this against the local server it just started;
-// `stigmer bootstrap` runs the same two phases against whatever backend the
-// CLI is pointed at, for a raw self-hosted server or the platform's daily
-// lane. One definition, so a laptop, a container and the hosted platform
-// cannot drift in what "ready" means.
+// What makes a backend ready for the CLI: the organization it falls back to
+// on a local or selfhost backend (DEFAULT_LOCAL_ORG, `stigmer`) exists.
+// Nothing is installed into it: a session with no agent runs the built-in
+// assistant, so a fresh install needs no default content. `stigmer up` runs
+// this against the local server it just started; `stigmer bootstrap` runs it
+// against whatever backend the CLI is pointed at, a raw self-hosted server.
+// One definition, so a laptop, a container and a raw server cannot drift in
+// what "ready" means.
 //
-// Two phases, and the order matters:
+// "Ensure" is find-then-create with the race closed by the server: two
+// launchers racing the same check see one `already-exists`, and that IS the
+// desired end state, so it is reported as `present`, never rethrown. Any
+// other refusal propagates with the server's sentence; the caller decides
+// how loud to be.
 //
-//   1. prepare: resolve the official marketplace (acquiring `@stigmer/plugins`
-//      at the CLI's version on a release's first run) and prepare every
-//      default. No backend is touched.
-//   2. run: ensure the system org, then push the prepared defaults, each
-//      skipped when the backend already holds it at the same digest. The
-//      push adopts a system-content row it replaces in place (a default
-//      agent an earlier release seeded keeps its id, its instances and every
-//      conversation bound to them), so nothing here ever deletes a row.
+// The create carries no label. Writing a label in the reserved `stigmer.ai/`
+// namespace needs a platform permission that a self-hosted server with
+// authentication on grants to nobody, and nothing reads one on an
+// organization (stigmer/stigmer#1192). Organizations created by older CLIs
+// keep the `stigmer.ai/system` label they were given; it is inert.
 //
-// Inside `up` both phases are best-effort with their own warning naming the
-// retry, because the stack is already serving by the time either runs and a
-// seeding failure must never tear it down. Both `up` shapes (detached
-// and foreground) call this one function, and both seed the local server
-// `up` just started, never the active backend context: a CLI pointed at
-// cloud still gets its local stack seeded, and never has system resources
-// applied to its cloud org. The client is pinned to a fresh local config
-// (localhost:SERVER_PORT) with no auth, the trusted-local identity.
+// Inside `up` the bootstrap is best-effort with one warning naming the
+// retry, because the stack is already serving and a failure here must never
+// tear it down. Both `up` shapes (detached and foreground) call the same
+// function, and both target the local server `up` just started, never the
+// active backend context: a CLI pointed at a remote backend still gets its
+// local stack bootstrapped and never creates an organization elsewhere. The
+// client is pinned to a fresh local config (localhost:SERVER_PORT) with no
+// auth, the trusted-local identity.
 
-import type { Stigmer } from "@stigmer/sdk";
+import { ManagementMode } from "@stigmer/protos/ai/stigmer/tenancy/organization/v1/enum_pb";
+import { type Stigmer, StigmerError } from "@stigmer/sdk";
 import type { BackendClient } from "../client/index.js";
+import { DEFAULT_LOCAL_ORG } from "../config/resolve.js";
 import { log } from "../logger.js";
-import type { ResolveOfficialOptions } from "../marketplace/official.js";
-import type {
-  DefaultPluginsResult,
-  InstallingVerb,
-  PreparedDefault,
-} from "./plugins/defaults.js";
-import { type EnsureSystemOrgOutcome, SYSTEM_ORG } from "./system-org.js";
 
 export type Say = (line: string) => void;
 
-/** Everything phase 2 needs, gathered without a backend. */
-export interface PreparedBootstrap {
-  readonly defaults: readonly PreparedDefault[];
-}
-
-export interface BootstrapResult {
-  readonly org: EnsureSystemOrgOutcome;
-  readonly plugins: DefaultPluginsResult;
-}
-
-export interface PrepareBootstrapOptions {
-  /** How the official tree is found (injectable for tests). */
-  readonly official?: ResolveOfficialOptions;
-}
-
-/** Phase 1. Throws when the catalogue cannot be resolved or a default cannot be prepared. */
-export async function prepareBootstrap(
-  options: PrepareBootstrapOptions = {},
-): Promise<PreparedBootstrap> {
-  const { prepareDefaultPlugins } = await import("./plugins/defaults.js");
-  return { defaults: await prepareDefaultPlugins(options.official) };
-}
+export type BootstrapOutcome = "present" | "created";
 
 /**
- * Phase 2. Throws when the system org cannot be ensured; a default that
- * fails to land is reported in the result, not thrown, so the caller can
- * name each one. `verb` is the command running this, stamped into each
- * installed plugin's version message.
+ * Make sure the organization the CLI falls back to exists on the backend
+ * `stigmer` is bound to: what `stigmer bootstrap` runs. Idempotent; a lost
+ * create race counts as `present`.
  */
-export async function runBootstrap(
-  stigmer: Stigmer,
-  prepared: PreparedBootstrap,
-  say: Say,
-  verb: InstallingVerb,
-): Promise<BootstrapResult> {
-  const [{ ensureSystemOrg }, { installPreparedDefaults }] = await Promise.all(
-    [import("./system-org.js"), import("./plugins/defaults.js")],
-  );
-  const org = await ensureSystemOrg(stigmer);
-  if (org === "created") say(`Created the '${SYSTEM_ORG}' organization`);
-  const plugins = await installPreparedDefaults(
-    { stigmer, info: say, verb },
-    prepared.defaults,
-    SYSTEM_ORG,
-  );
-  return { org, plugins };
-}
-
-/** Both phases, against the backend `stigmer` is bound to: what `stigmer bootstrap` runs. */
-export async function bootstrapBackend(
-  stigmer: Stigmer,
-  say: Say,
-  options: PrepareBootstrapOptions = {},
-): Promise<BootstrapResult> {
-  return runBootstrap(
-    stigmer,
-    await prepareBootstrap(options),
-    say,
-    "stigmer bootstrap",
-  );
+export async function bootstrapBackend(stigmer: Stigmer): Promise<BootstrapOutcome> {
+  const mine = await stigmer.organization.findMyOrganizations();
+  if (mine.entries.some((org) => org.metadata?.slug === DEFAULT_LOCAL_ORG)) {
+    return "present";
+  }
+  try {
+    // Organizations are self-owning: the org field is the slug itself, the
+    // shape the console's create form and the e2e harness both use.
+    await stigmer.organization.create({
+      name: "Stigmer",
+      slug: DEFAULT_LOCAL_ORG,
+      org: DEFAULT_LOCAL_ORG,
+      description: "The organization the Stigmer CLI uses when none is named",
+      managementMode: ManagementMode.self_managed,
+    });
+    return "created";
+  } catch (error) {
+    if (error instanceof StigmerError && error.code === "already-exists") {
+      return "present";
+    }
+    throw error;
+  }
 }
 
-/** Seams of the local bootstrap, injectable for tests; the defaults are the real phases over the real local client. */
+/** Seams of the local bootstrap, injectable for tests; the defaults are the real act over the real local client. */
 export interface BootstrapDeps {
   readonly client?: BackendClient;
   readonly say?: Say;
-  readonly prepare?: () => Promise<PreparedBootstrap>;
-  readonly run?: (
-    stigmer: Stigmer,
-    prepared: PreparedBootstrap,
-    say: Say,
-  ) => Promise<BootstrapResult>;
+  readonly bootstrap?: (stigmer: Stigmer) => Promise<BootstrapOutcome>;
 }
 
 const sayToStderr: Say = (line) => {
   process.stderr.write(`${line}\n`);
 };
 
-/** What `stigmer up` does once the local server answers. Never throws past its own warnings. */
-export async function bootstrapLocalBackend(
-  deps: BootstrapDeps = {},
-): Promise<void> {
+/** What `stigmer up` does once the local server answers. Never throws past its own warning. */
+export async function bootstrapLocalBackend(deps: BootstrapDeps = {}): Promise<void> {
   const client = deps.client ?? (await freshLocalClient());
   const say = deps.say ?? sayToStderr;
 
-  let prepared: PreparedBootstrap;
-  try {
-    prepared = await (deps.prepare ?? prepareBootstrap)();
-  } catch (err) {
-    log.warn("bootstrap preparation failed", { error: String(err) });
-    say(
-      "Warning: could not prepare the default plugins, so the local backend was not bootstrapped. Run 'stigmer up' again to retry.",
-    );
-    return;
-  }
-
-  let result: BootstrapResult;
+  let outcome: BootstrapOutcome;
   try {
-    result = await (deps.run ?? runLocalBootstrap)(
-      client.stigmer,
-      prepared,
-      say,
-    );
+    outcome = await (deps.bootstrap ?? bootstrapBackend)(client.stigmer);
   } catch (err) {
     log.warn("bootstrap failed", { error: String(err) });
-    say(
-      "Warning: failed to bootstrap the local backend. Run 'stigmer up' again to retry.",
-    );
+    say("Warning: failed to bootstrap the local backend. Run 'stigmer up' again to retry.");
     return;
   }
-  log.debug("bootstrap complete", {
-    org: result.org,
-    outcomes: result.plugins.outcomes,
-  });
-  for (const name of result.plugins.failed) {
-    say(
-      `Warning: failed to install default plugin '${name}'. Run 'stigmer bootstrap' to retry.`,
-    );
-  }
-}
-
-// Phase 2 in the seam's shape, naming the verb: everything this file's
-// local bootstrap installs was installed by `stigmer up`.
-function runLocalBootstrap(
-  stigmer: Stigmer,
-  prepared: PreparedBootstrap,
-  say: Say,
-): Promise<BootstrapResult> {
-  return runBootstrap(stigmer, prepared, say, "stigmer up");
+  log.debug("bootstrap complete", { org: outcome });
+  if (outcome === "created") say(`Created the '${DEFAULT_LOCAL_ORG}' organization`);
 }
 
 async function freshLocalClient(): Promise<BackendClient> {

package/src/local/daemon/launch.ts

@@ -83,11 +83,11 @@ export interface UpForegroundDeps {
   runDaemon?: (deps: InternalDaemonDeps) => Promise<number>;
   /** Resolves when the stack should shut down (default: the first SIGTERM/SIGINT). */
   waitForShutdown?: () => Promise<void>;
-  /** Post-readiness bootstrap (default: `bootstrapLocalBackend`: prepare the defaults, ensure the org, install). */
+  /** Post-readiness bootstrap (default: `bootstrapLocalBackend`, which ensures the `stigmer` org). */
   bootstrap?: () => Promise<void>;
   /** Receives each line the server and runner write (default: a `[component]`-prefixed stdout mirror). */
   mirror?: OutputMirror;
-  /** Invoked once the stack is serving and seeded — the moment a detached `up` would have returned. */
+  /** Invoked once the stack is serving and bootstrapped — the moment a detached `up` would have returned. */
   onReady?: () => void | Promise<void>;
 }