rote-org — Organization management
All rote-<name> references in this document — including every name in the Handoff
Contract — are companion skills, never CLI commands (rote-shell is not rote shell).
Invoke them through the runtime's skill mechanism; only literal rote … commands run in a
terminal.
All operations go through rote registry org <subcommand>. These commands handle auth, validation, and error rendering.
Login first: rote login (auth is shared with the main rote skill).
Run one org command at a time, read the result before deciding the next action, and never assume
membership, role, quota, or pending-invite state from memory. Use the base rote companion skill
only when a caller needs the full workflow graph.
Roles: admin | developer | reader. Invite default role: developer.
Slug = URL-safe org identifier (e.g. my-org). --help calls this <org> for invite/members commands and <slug> for the rest — same thing.
Handoff Contract
- Use when: the user asks to create, delete, inspect, invite to, remove from, change roles in, or
view plan/usage for a rote registry organization.
- Preconditions: the user is authenticated or login is surfaced as the blocker; target org slug and
requested admin operation are known; destructive deletes and privileged role changes are explicitly
confirmed.
- Owns: standalone org administration, member and invite management, role changes, pending-invite
revocation, plan/usage reporting, and permission/quota error reporting.
- Hands off to:
rote-registry when org administration was requested as part of artifact push/share
or when the user returns to registry publication after org setup.
- Returns to:
rote-registry or the user with org slug, operation run, before/after member or invite
state, role/quota result, permission blocker, and next recommended registry action.
- Stop when: the org operation completes, auth/permission/quota blocks, destructive confirmation is
missing, or registry publication should resume.
- Completion signal: org command result summarized from live output with affected org, affected user
or quota metric, and any follow-up registry handoff.
Command reference
| Goal |
Command |
| List your orgs |
rote registry org list [--json] |
| Create org |
rote registry org create --slug <slug> --name "<Name>" |
| Delete org (owner only) |
rote registry org delete <slug> |
| Plan, usage, feature flags |
rote registry org usage <slug> [--json] |
| Invite member |
rote registry org invite <slug> <email> [--role <role>] |
| Revoke a pending invite |
rote registry org invite revoke <slug> <email> |
| List pending invites |
rote registry org invite pending <slug> [--json] |
| List members |
rote registry org members <slug> [--pending] [--json] |
| Remove a member |
rote registry org members remove <slug> <email> |
| Change a member's role |
rote registry org members role <slug> <email> <admin|developer|reader> |
| Show SSO status |
rote registry org sso show <slug> [--json] |
| Verify SSO domain |
rote registry org sso verify <slug> <domain> [--check] [--json] |
| Enable / disable SSO enforcement |
rote registry org sso enable <slug> <domain> [--json] / disable <slug> <domain> [--json] |
| Unbind SSO domain |
rote registry org sso unbind <slug> <domain> [--json] |
| Revoke SSO sessions |
rote registry org sso revoke-user <slug> --email <addr> [--json] / revoke-domain <slug> <domain> [--json] |
--pending on members appends still-pending invites to the listing.
SSO
Org SSO is self-service domain management for SAML-backed organizations after
an operator grants the org a provider. Domain verification is two-step:
verify prints a DNS TXT record to publish, then verify --check re-checks
DNS and completes the verification. Owners can then enable or disable
enforcement, unbind domains, and revoke sessions for cutover or offboarding.
show is available to owners/admins; revoke-user is owner/admin; domain
verification, enforcement, unbind, and domain-wide revocation are owner-only.
Behavior to know
- Invites auto-onboard: invitee gets an email; on signup they become a
member with the assigned role. There is no separate accept step.
- Role changes and member removals require admin or owner of the target org.
delete is owner-only and irreversible
Related (push targeting)
Pushing an adapter to an org namespace is not under org itself. Instead:
rote registry adapter push <adapter-path> <slug> [--private]
If the user is about to push and wants to check quota first, run
rote registry org usage <slug> and report the plan and usage numbers from the response.
1---2name: rote-org3description: Manage rote registry organizations — create / delete an org, list and change member roles, invite or remove users, revoke or list pending invites, view plan and usage, and manage org SSO. Use when the user says things like "create an org", "invite teammate to my org", "list org members", "remove user from org", "change role", "revoke invite", "what's my org usage", "set up SSO", "verify an SSO domain", or otherwise references organization administration in rote.4---56# rote-org — Organization management78All `rote-<name>` references in this document — including every name in the Handoff9Contract — are companion **skills**, never CLI commands (`rote-shell` is not `rote shell`).10Invoke them through the runtime's skill mechanism; only literal `rote …` commands run in a11terminal.1213All operations go through `rote registry org <subcommand>`. These commands handle auth, validation, and error rendering.1415Login first: `rote login` (auth is shared with the main rote skill).1617Run one org command at a time, read the result before deciding the next action, and never assume18membership, role, quota, or pending-invite state from memory. Use the base `rote` companion skill19only when a caller needs the full workflow graph.2021Roles: `admin` | `developer` | `reader`. Invite default role: `developer`.22Slug = URL-safe org identifier (e.g. `my-org`). `--help` calls this `<org>` for invite/members commands and `<slug>` for the rest — same thing.2324## Handoff Contract2526- Use when: the user asks to create, delete, inspect, invite to, remove from, change roles in, or27 view plan/usage for a rote registry organization.28- Preconditions: the user is authenticated or login is surfaced as the blocker; target org slug and29 requested admin operation are known; destructive deletes and privileged role changes are explicitly30 confirmed.31- Owns: standalone org administration, member and invite management, role changes, pending-invite32 revocation, plan/usage reporting, and permission/quota error reporting.33- Hands off to: `rote-registry` when org administration was requested as part of artifact push/share34 or when the user returns to registry publication after org setup.35- Returns to: `rote-registry` or the user with org slug, operation run, before/after member or invite36 state, role/quota result, permission blocker, and next recommended registry action.37- Stop when: the org operation completes, auth/permission/quota blocks, destructive confirmation is38 missing, or registry publication should resume.39- Completion signal: org command result summarized from live output with affected org, affected user40 or quota metric, and any follow-up registry handoff.4142## Command reference4344| Goal | Command |45|---|---|46| List your orgs | `rote registry org list [--json]` |47| Create org | `rote registry org create --slug <slug> --name "<Name>"` |48| Delete org (owner only) | `rote registry org delete <slug>` |49| Plan, usage, feature flags | `rote registry org usage <slug> [--json]` |50| Invite member | `rote registry org invite <slug> <email> [--role <role>]` |51| Revoke a pending invite | `rote registry org invite revoke <slug> <email>` |52| List pending invites | `rote registry org invite pending <slug> [--json]` |53| List members | `rote registry org members <slug> [--pending] [--json]` |54| Remove a member | `rote registry org members remove <slug> <email>` |55| Change a member's role | `rote registry org members role <slug> <email> <admin\|developer\|reader>` |56| Show SSO status | `rote registry org sso show <slug> [--json]` |57| Verify SSO domain | `rote registry org sso verify <slug> <domain> [--check] [--json]` |58| Enable / disable SSO enforcement | `rote registry org sso enable <slug> <domain> [--json]` / `disable <slug> <domain> [--json]` |59| Unbind SSO domain | `rote registry org sso unbind <slug> <domain> [--json]` |60| Revoke SSO sessions | `rote registry org sso revoke-user <slug> --email <addr> [--json]` / `revoke-domain <slug> <domain> [--json]` |6162`--pending` on `members` appends still-pending invites to the listing.6364## SSO6566Org SSO is self-service domain management for SAML-backed organizations after67an operator grants the org a provider. Domain verification is two-step:68`verify` prints a DNS TXT record to publish, then `verify --check` re-checks69DNS and completes the verification. Owners can then enable or disable70enforcement, unbind domains, and revoke sessions for cutover or offboarding.71`show` is available to owners/admins; `revoke-user` is owner/admin; domain72verification, enforcement, unbind, and domain-wide revocation are owner-only.7374## Behavior to know7576- Invites auto-onboard: invitee gets an email; on signup they become a77 member with the assigned role. There is no separate accept step.78- Role changes and member removals require admin or owner of the target org.79- `delete` is owner-only and irreversible8081## Related (push targeting)8283Pushing an adapter to an org namespace is not under `org` itself. Instead:8485```bash86rote registry adapter push <adapter-path> <slug> [--private]87```8889If the user is about to push and wants to check quota first, run90`rote registry org usage <slug>` and report the plan and usage numbers from the response.
modiqo