All packsMulti-Tenant Auth & RBAC CoreSolve
prevent last admin removed race condition postgres trigger
Two concurrent demotions can both pass an app-level check
An app-level "don't remove the last owner" check reads the current owner count before either of two concurrent requests writes -- both can pass, leaving zero owners.
This is one of the things Multi-Tenant Auth & RBAC Core already handles. Sign-in, organisations, invites and roles — with one customer's data provably unable to reach another's.
Is this you?
"Don't let an org end up with zero owners" sounds like a simple application-level check: count current owners, refuse the change if it would hit zero. But if two co-owners each demote the other at nearly the same time, both requests can read the owner count before either write commits -- each sees "there's still another owner" and both proceed, leaving the org with zero owners despite the check technically running every time.
Why this one is easy to get wrong
A read-then-write check in application code is the natural way to express this rule, and it passes every sequential test (one demotion at a time) -- the failure is a genuine race condition that only appears under concurrent requests, which most test suites don't attempt unless they're specifically written to simulate simultaneous writes.
What you get instead
Core decision 13 moves the guarantee into a database trigger (BEFORE UPDATE OR DELETE ON org_members) that locks the org row (SELECT ... FOR UPDATE) before evaluating whether the change would leave the org ownerless -- the row lock forces the second concurrent demotion to wait for the first to commit and re-evaluate against the now-current state, so two concurrent demotions of co-owners cannot both succeed.
Source: ARCHITECTURE.md core decision 13 — checkable in the pack you receive
How you actually use this
You don’t install a library or wire up an SDK. Your own coding agent builds the code in your project, and you keep it — no runtime dependency on us.
Step 1
Download and unzip
You get a folder: the docs that tell an agent what to build, a starting skeleton, and the test suite that decides when it's done.
Step 2
Open it in Claude Code or Cursor
Point your coding agent at the folder. Nothing to install, no account with us, no API key.
Step 3
Paste one prompt
The pack contains the exact prompt. Paste it as your first message and leave it alone — it works through the build itself, choosing a cheaper or stronger model per task.
Step 4
Run ./verify.sh
One command. It prints a pass or fail for every check. Green means the build is done — the same script we ran to produce the receipt on this page.
Typical build: about 12 minutes of your agent working, mostly unattended. Then you integrate the working module into your app the way you would any code you’d written yourself.
Why you can believe this
2 of 3 runs passedWe ran this pack from an empty folder 3 times and published exactly what happened — every check, the model, the token cost, the wall time. Not a testimonial, and not our opinion: the same verify.sh you run yourself. Read the full receipt →