RIFF · org-scoped membership · use-case-first spec · 2026-07-07 · status: DESIGN v1.1, Codex-reviewed (verdict: ORG; 6 findings folded) · siblings: session facts, session_facts module, org-telecom-identity.md

Org-Scoped Membership: every business keeps its own list

Born from a live incident (2026-07-07): erasing a caller "from the bike shop" erased them from the law office too, because caller_identity is one global phone-keyed table. Membership is a relationship between a PERSON and a BUSINESS — this design scopes it that way and tags every stored row with the business it belongs to.

membership(
  org_id        TEXT NOT NULL,     -- business.id ("flow101_bluebonnet_bikes", "legal_intake")
  phone         TEXT NOT NULL,     -- E.164
  display_name  TEXT,
  sms_consent   INTEGER,           -- tri-state: NULL unknown / 1 granted / 0 DENIED (denial durable)
  consent_at    REAL, verified_at REAL,
  enrolled_via_flow TEXT,          -- provenance, not scope
  created_at REAL, updated_at REAL,
  PRIMARY KEY (org_id, phone))

intake_sessions += org_id TEXT     -- every session row tagged; answers/transcripts
                                   -- inherit via their token join

Case B1 — Isolation is the default TB1

1. A caller enrolls in the bike shop's Riders Club.
2. They call the law office for the first time.
3. The law office greets them as a stranger — no name, no consent, nothing.

Never: any business reading another business's membership row — the resolver takes (org_id, phone); there is no phone-only lookup in the call path.

Case B2 — One phone, many memberships, different data TB2

The same number can be "Dave" with cruiser preferences at the bike shop and "David B. Marr" at the law office. Names, consents, and preferences never bleed between orgs. Updating one leaves the other byte-identical.

Case B3 — Erasure is per-org; compliance erase is everywhere TB3

1. "Erase me from the bike shop" deletes the bike shop membership + the bike shop's tagged sessions /answers/transcripts — and NOTHING else. The law office still knows the caller.
2. A compliance erase (--all-orgs) removes every membership and every tagged row for the phone, and reports counts per org.
3. Suppression tombstones (Codex): erasing deletes CONTENT (name, preferences, sessions) but retains a minimal suppression record {org_id, phone_hash, sms_suppressed, erased_at} — "erase me" must never resurrect textability by erasing a durable opt-out. Tombstones carry no PII (hashed phone) and are readable only by the send gate.

Never: a per-org erase touching another org's rows; orphaned answers/transcripts surviving either erase (the token join is part of the delete, fixing the purge-tool gap found 2026-07-07); an erase that re-enables texting a caller who had opted out.

Case B4 — Consent is per-org and denial sticks TB4

1. Caller grants SMS consent at the bike shop, denies at the law office.
2. The bike shop's DID may text them; the law office's may not — the send path resolves consent by the org that owns the sending DID (composing with the existing fail-closed sms_from resolver).
3. Denial is durable per org: the law office never re-asks on later calls; the bike shop is unaffected.

Never: consent granted to one brand authorizing a text from another.

Case B5 — Members survive new lines and flow renames TB5

The business adds a second flow (or renames/rebuilds one) under the same org_id: every member is recognized on the new line with zero migration — because scope was never the flow.

Case B6 — Migration from the global table TB6

1. Each existing caller_identity row becomes a membership in every org where that phone has a completed profile-intake session (provenance from intake_sessions).
2. A phone with identity but NO attributable session gets a membership in the org of the flow that verified it if determinable, else it is reported for operator review — never silently dropped, never silently globalized.
3. During a deprecation window the resolver reads membership FIRST, legacy global table second (logged as legacy_identity_hit so the window's end is data-driven); writes go ONLY to membership. Fallback discipline (Codex #2 — "the biggest incident risk"): the legacy fallback serves GREETINGS only; it is disabled in the send path and the erase path, metriced, and time-boxed — a phone-only read can never again decide who gets texted or what gets deleted.
4. Consent migrates conservatively (Codex #3): sms_consent=1 copies only where org-specific evidence exists (a consent answer row in that org's sessions); otherwise the membership starts NULL (asked once, fresh). A legacy denial becomes per-org suppression wherever attribution is plausible.

Case B7 — The session_facts tie-in TB7

The fact registry gains a scope column: identity and sms_consent become scope: org; selected_route/journey stay scope: call. auth_level=known now means "this org knows you." The membership desk (option 0) is the writer of org-scoped facts; the transport prefill reads only the dialed org's row.

Edge-case register (Codex #5 — specified now, most deferred with owners)

Out of scope (v1), recorded deliberately

• Cross-business "RIFF ID" (opt-in platform identity) — a future layer on top, never a default.
• Org files (PR4) — this design keys on business.id now and is unchanged by org files landing.
• Membership tiers/points — the schema leaves room (a later tier column), not built.

Test matrix (TDD — written red before implementation)