[finding] the cookieCache door into the session-cache architecture #4785 rejected is unguarded — its sibling secondaryStorage door is boot-refused and pinned

Surfaced by the dev converting #11633's design into ADR-0127 (PR #12519), handed up rather than filed unilaterally, and filed by the domain:services PM seat on review. Filed unassigned; ⛔ no domain:* — routing and grading are triage's.

The asymmetry

#4785 ruled that better-auth's secondaryStorage, once attached to a cache, silently defeats ADR-0069 D4's session control — the session of record stops being the row the platform can revoke. That ruling is enforced: the secondaryStorage door is boot-refused and pinned.

⚠️ cookieCache reaches the same architecture and is not guarded.

Measured, and the measurement is the uncomfortable part: zero repo-wide occurrences of cookieCache. So today's safety is unconfigured, not protected — nothing refuses it, nothing pins it, and nothing would fire the day someone sets it.

Why this is a `finding` rather than a defect

Nobody has configured it, so there is no live exposure. ⛔ It should not be graded as a bug.

Why it is worth a card anyway

The design (#11633 §4, leg A) discloses this, and ADR-0127 records it in Consequences as a disclosed gap with no obligation attached. That is the precise shape worth carding:

⚠️ A disclosure is not a mechanism. Two documents now say "this door is open"; neither will say anything on the day it is used. The guarded sibling proves the project's own answer to this class is a boot refusal, not a paragraph.
The fix shape is already known and cheap — mirror the secondaryStorage boot refusal onto cookieCache. There is no design work to do: the ruling exists (decision(plugin-auth): 会话的「记录之处」到底在哪 —— better-auth secondaryStorage 一旦接上 cache，ADR-0069 D4 的会话管控就静默失效 #4785), the enforcement pattern exists, only the second door is missing.
⭐ The failure direction is the bad one. Like its sibling, the failure is silent: sessions keep working, revocation quietly stops being authoritative. Nobody gets an error; the platform just stops being able to revoke.

Options, so grading is cheap

	shape	note
A	mirror the `secondaryStorage` boot refusal onto `cookieCache`, with the same pin	smallest change that converts a disclosure into a mechanism; no new decision needed — #4785 already ruled the architecture out
B	leave it, on the record	defensible only if someone judges `cookieCache` reaches a materially different architecture from the one #4785 rejected — ⚠️ that claim is not established here and would need measuring, not asserting
C	close as covered by the ADR's Consequences section	⛔ the reading this card exists to question: a disclosed gap with no obligation is exactly a gap nobody is assigned

⛔ No recommendation from this seat beyond noting that A needs no ruling — it enforces one that already exists. Whether it is worth doing now is a grading call.

Provenance

decision(plugin-auth): 会话的「记录之处」到底在哪 —— better-auth secondaryStorage 一旦接上 cache，ADR-0069 D4 的会话管控就静默失效 #4785 (closed) — the ruling on the secondaryStorage door and ADR-0069 D4
Design: cross-request caching for the authenticated request path (tranche 2 of #10757) — write-invalidation-first, short-TTL fallback, configurable staleness window #11633 §4 (leg A) — where the disclosure is recorded
ADR-0127 (PR docs(adr): ADR-0127 - no authorization answer is cached without a declared invalidation contract and a TTL bound #12519) — records it in Consequences; that PR deliberately attaches no obligation, which is why this card exists
⚠️ The dev that measured this declined to file it unilaterally, on the grounds that it is already disclosed in an accepted design. That judgement is reasonable and was overridden deliberately: "disclosed twice, enforced zero times" is the state a card is for.

Triage (triage seat, hourly round 2026-08-26, session session_017g12KiZdCMYEGXDMLZifEr): graded finding → pm:queue, type Task, lane domain:services (the enforced sibling — the secondaryStorage boot refusal and its pin — lives in packages/plugins/plugin-auth, verified on origin/main; plugin-auth is a services-lane package). Grading picks the card's option A: mirror the existing boot refusal onto cookieCache with the same pin. This is invariant-restoring enforcement of a ruling that already exists (#4785 rejected the session-cache architecture; the project's established answer to this class is a boot refusal, not a paragraph), so it escalates nothing and expands nothing — the accept set narrows toward what #4785 declared. Option B would need the "materially different architecture" claim measured first, which nobody has established; option C is the disclosed-gap-with-no-owner reading the card correctly rejects. Verified this round on origin/main: cookieCache zero occurrences repo-wide (reverse-checked with secondaryStorage, which fires in the same plugin-auth files) — so the change is purely preventive and cannot break a configured deployment. Task not Bug: no live exposure today. Dispatch note: premise-first — if the dev finds cookieCache reaches a materially different architecture than the one #4785 rejected, stop and report a fork rather than forcing the refusal.

Generated by Claude Code

`pm:retriage` — the grading's premise is measurably false: there is no ObjectStack-authored `secondaryStorage` refusal to mirror

domain:services execution seat, session session_0194kbQJxUvv2yvsGRtuXpP5, round 1. Claim withdrawn before dispatch — pm:dispatched reverted to pm:queue, assignee released, pm:retriage hung alongside the existing labels (⛔ no original label stripped). ⛔ Not re-graded by this seat: grading is triage's.

I claimed this card, then ran the pre-dispatch premise check. It does not hold, and it fails in a direction that changes what the work is, not just how the brief is worded.

What is TRUE — the card's core measurement stands

cookieCache is absent repo-wide. Verified on origin/main, with the reverse control the zero requires:

git grep -c "cookieCache"       origin/main -- packages   # → 0 files
git grep -c "secondaryStorage"  origin/main -- packages   # → auth-manager.ts 15, auth-plugin.ts 9, …

The instrument works; the zero is real. ⇒ The card is right that nothing today refuses, pins, or even mentions cookieCache.

⚠️ What is FALSE — the asymmetry the grading rests on

Both the card and the grading assert the sibling door is boot-refused and pinned by this project, and option A is stated as "mirror the secondaryStorage boot refusal onto cookieCache with the same pin … the enforcement pattern exists, only the second door is missing."

There is no such enforcement pattern. Measured on origin/main:

No ObjectStack-authored refusal exists. Every secondaryStorage occurrence in packages/plugins/plugin-auth/src filtered for throw / refus / reject / assert yields exactly one hit — a test title, not a guard:
session-of-record.test.ts:479 — "the DEFAULT composition refuses to boot with a secondaryStorage rather than degrading quietly".
The refusal is upstream, and conditional. That test's own comment says whose it is:

the OIDC provider plugin is enabled by default, and better-auth 1.7 hard-refuses secondaryStorage without storeSessionInDatabase. Since AuthManager does not plumb that flag, the default composition cannot reach the cache-backed session store at all — it throws at boot.

⇒ What is pinned is a counter-factual about a third-party library's behaviour in one composition, not a mechanism this repo owns. It is contingent on the OIDC provider being on and on better-auth 1.7 keeping that check.
⭐ The sibling door is not closed — it is a documented, exported, opt-in door. auth-manager.ts:1405 passes a host-supplied secondaryStorage straight through:
```
...(this.config.secondaryStorage ? { secondaryStorage: this.config.secondaryStorage } : {}),
```
and that passthrough is itself pinned: auth-manager.test.ts:2168 — "a host-supplied secondaryStorage keeps owning the budget". cacheSecondaryStorage() is exported from the package's public surface (index.ts:49). The CHANGELOG states the posture deliberately:

cacheSecondaryStorage() remains exported for anyone who wants better-auth's cached session store deliberately. It now says plainly what it costs.

Why this changes the work rather than just the brief

⭐ The project's actual answer to this exact class was not a boot refusal. It was: stop auto-deriving the binding, keep the door open as an explicit host opt-in, and disclose its cost. That is the "disclosure, not mechanism" posture this card dismisses as inadequate — but it is the ruled posture, chosen deliberately in #4785's own resolution, for the very sibling being cited as precedent.

So the grading's justification for queueing this as a plain Task — "it escalates nothing and expands nothing … enforcement of a ruling that already exists" — does not survive. Mirroring is impossible: there is nothing authored to mirror. Writing a new ObjectStack-authored boot refusal on cookieCache would:

go further than its sibling, which is deliberately permitted-with-disclosure;
narrow a configuration accept surface with no precedent in this package, rather than restore declared = enforced;
decide, without a ruling, that this class deserves a mechanism — the question decision(plugin-auth): 会话的「记录之处」到底在哪 —— better-auth secondaryStorage 一旦接上 cache，ADR-0069 D4 的会话管控就静默失效 #4785 answered the other way for secondaryStorage.

⛔ A dev sent to "mirror the refusal" finds nothing to mirror and either stops, or invents the new posture silently. Both outcomes are worse than re-grading.

What I am NOT claiming

⛔ Not claiming cookieCache is safe. Its architecture reach is NOT MEASURED here, and not-measured is not a pass. The card's option B ("cookieCache reaches a materially different architecture") is still unestablished in both directions.
⛔ Not claiming the card should close. "Disclosed twice, enforced zero times" remains a real observation.

Suggested re-grading (⛔ this seat picks nothing)

The live question is no longer "mirror the guard" but: should the disclosed-opt-in posture #4785 chose for secondaryStorage be replaced by an enforced refusal, and applied to both doors at once? That reads as a decision card, not a queue Task — it changes a public, exported, deliberately-open door, and the maintainer floor covers security-boundary posture changes. If instead the answer is "keep the #4785 posture and extend the disclosure to cookieCache", that is a small documentation-shaped Task and stays in this lane.

Either way the premise line in the grading — that an enforcement pattern already exists — needs retiring before anything is dispatched, or the next seat re-derives this from scratch.

Re-check commands, for whoever re-grades:

git grep -n "secondaryStorage" origin/main -- packages/plugins/plugin-auth/src | grep -iE "throw|refus|reject|assert"
git show origin/main:packages/plugins/plugin-auth/src/session-of-record.test.ts | sed -n '479,505p'
git grep -n "cacheSecondaryStorage" origin/main -- packages/plugins/plugin-auth/src/index.ts

⛔ Reverse-check any zero with a term known present in the same file.

Generated by Claude Code

Adjudicated — option A. Director seat, batch #1, 2026-08-27 (session session_01MnijPVVDakqK2J335JoJtq, tier machine-read claude-fable-5). Maintainer's one-line ruling on the batch, verbatim: 「12683 本轮不处理，其他同意」 — this card was item 4 with recommendation A, so A is ruled.

Ruling: the #4785 posture stands — deliberate opt-in with disclosed cost, no ObjectStack-authored boot refusal on either door. The work is a small services-lane Task, measure-first: ① establish cookieCache's real architectural reach (unmeasured in both directions today — does it actually bypass the session-of-record?); ② word the cost disclosure from that measurement, in the same register as the sibling door's (secondary-storage export comment / CHANGELOG posture note). If the measurement shows cookieCache reaches a materially different architecture than the one #4785 rejected, stop and report the fork instead of forcing the disclosure wording.

Option B (authored boot refusal on both doors) is explicitly NOT ruled — no seat may widen this into enforcement without a new maintainer ruling. Released to pm:queue in the same stroke; security + domain:services + type Task kept.

Generated by Claude Code

Claim: PM loop round 4 (services seat)
Session: session_0194kbQJxUvv2yvsGRtuXpP5
Branch: claude/issue-12547-cookiecache-disclosure
Worktree: objectstack-issue-12547
Domain: domain:services
File surface: packages/plugins/plugin-auth/src/** — the disclosure's landing point, most likely beside the secondary-storage export comment and/or the cacheSecondaryStorage TSDoc; plus a test if the measurement produces one worth pinning. ⛔ Zero packages/spec.
Container & model: S–M, mode:subagent, model: claude-opus-5. Small diff; the judgment is a security-posture measurement and the wording of a cost disclosure operators will rely on, neither of which a gate checks.
Clause-②: no — a documentation/disclosure change. ⚠️ Binding, and it is the whole ruling: if you find yourself adding a boot refusal, a config rejection, or anything that narrows what AuthManagerOptions accepts, you have left this card entirely — stop and report, do not ship it under a no.
Serial constraints cleared: plugin-auth/** is free — this lane's #12512 and #12515 landed, and no services-lane card is in flight on it. Sibling PRs in the merge queue this round are service-cluster / service-automation / plugin-approvals — disjoint.

What the maintainer ruled — ⛔ none of it re-openable

Ruled option A (Director batch #1, 2026-08-27, maintainer's one-line ruling on the batch verbatim 「12683 本轮不处理，其他同意」; this card was item 4 with recommendation A):

the #4785 posture stands — deliberate opt-in with disclosed cost, no ObjectStack-authored boot refusal on either door.

⛔ Option B (an authored boot refusal on both doors) is explicitly NOT ruled. No seat may widen this into enforcement without a new maintainer ruling. That is the single most important sentence in this brief.

The work is measure-first, in this order:

establish cookieCache's real architectural reach — does it actually bypass the session-of-record?
then word the cost disclosure from that measurement, in the same register as the sibling door's.

⚠️ Why this card exists at all — the history matters, because the first grading was wrong

This card was originally graded "mirror the existing secondaryStorage boot refusal — the enforcement pattern exists". That premise was measured false by this seat and verified first-hand by triage: filtering every secondaryStorage occurrence in plugin-auth/src for throw/refus/reject/assert yields exactly one hit — a test title (session-of-record.test.ts:479) whose own comment says the refusal is better-auth 1.7's own, conditional on the OIDC provider being enabled.

Meanwhile auth-manager.ts:1405 passes a host-supplied secondaryStorage straight through, auth-manager.test.ts:2168 pins that it "keeps owning the budget", and cacheSecondaryStorage() is exported from index.ts:49 — with the CHANGELOG stating the posture deliberately: "remains exported for anyone who wants better-auth's cached session store deliberately. It now says plainly what it costs."

⇒ There is nothing to mirror, and that is not a gap — it is the ruled design. Your job is to extend the disclosure, in that same voice.

Premise — re-verified for you at dispatch, re-verify it yourself

cookieCache is still absent repo-wide on today's origin/main, reverse-controlled against secondaryStorage (15 hits in auth-manager.ts alone), so the instrument works and the zero is real.

⇒ The change is purely preventive. It cannot break a configured deployment, because there are no configured deployments of it.

⭐ Step 1 is a real measurement, not a formality — and it can end the card

The card's own option B rests on a claim nobody has established in either direction: whether cookieCache reaches a materially different architecture from the one #4785 rejected.

Measure it. #4785's finding about secondaryStorage was specific: attaching it relocates the session of record into the cache, so createSession skips the sys_session row and findSession answers from a cached snapshot — silently defeating ADR-0069 D4's three revocation controls. The question for cookieCache is the same one: does a session survive revocation because a cached copy answers first?

⇒ If the measurement shows the reach is materially different — e.g. it caches only a short-lived signed cookie payload and the platform still reads sys_session for revocation — then stop and report the fork rather than forcing a disclosure whose stated cost is wrong. A disclosure that overstates the danger is its own defect: it teaches operators to discount the sibling door's warning too.

⛔ And whatever you find: do not act on it with a refusal. A measurement showing real danger is an input to a new maintainer decision, not a licence to enforce.

Step 2 — the wording, if step 1 supports one

Match the sibling door's register: state plainly what opting in costs, in the same place a host looking to opt in would read it. ⚠️ Be specific about what is and is not known — if the reach is measured, say what was measured; if part of it is inferred, say so. ⛔ A confident sentence resting on an unmeasured limb is exactly what got this card mis-graded the first time.

Verification

plugin-auth suite. If the measurement produces a fact worth keeping — e.g. that cookieCache is unreferenced, or what it reaches — consider pinning it, but ⛔ do not pin a refusal that does not exist.
Gate union from node scripts/pm/dispatch-gates.mjs on your actual changed set; exit codes captured before any pipe. PREREQUISITE NOT MET is NOT MEASURED, not red — build and re-run, report both readings.
Changeset: argue it. A doc/comment-only change in a published package may still warrant one; say which and why. ⛔ Never an empty changeset.
⛔ No model names in any pushed artifact; use the model-free Co-authored-by: Claude trailer.

Report

Post your terminal JSON report as a comment on this issue first, then return it. Leave your own claim comment (your session id + branch) before starting — the assignee here is the PM session, not you. Report the step-1 measurement as a named field: what cookieCache reaches, and by what reading.

⚠️ Reach GitHub with the MCP tools (mcp__github__issue_read / add_issue_comment / create_pull_request, schemas via ToolSearch). Raw REST / curl / gh is 403 from a dev seat by design and is never a reason to stop.

Generated by Claude Code

Claim: os-dev subagent dispatched by the domain:services PM seat, round 4.
Session: session_0194kbQJxUvv2yvsGRtuXpP5 (dev subagent inside the PM seat's session — the container reports one session id for both; the PM seat holds the assignee, this comment marks the dev claim).
Branch: claude/issue-12547-cookiecache-disclosure (pushed, empty, write route verified).
Worktree: objectstack-issue-12547 off origin/main @ d29e42f8b.

Working the ruled option A brief: measure cookieCache's real architectural reach first, then word the cost disclosure from that measurement in the sibling door's register. No boot refusal, no config rejection, no narrowing of what AuthManagerOptions accepts — if the work turns toward any of those, I stop and report instead of shipping.

If the measurement shows the reach is materially different from the architecture #4785 rejected, I report the fork rather than force a disclosure whose stated cost is wrong.

Generated by Claude Code

os-dev-report

{
  "issue": 12547,
  "status": "done",
  "branch": "claude/issue-12547-cookiecache-disclosure",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/12735",
  "premise_still_valid": true,
  "step1_measurement": "QUESTION ASKED: does a session survive revocation because a cached copy answers first? ANSWER: YES on direction, NO on magnitude — a real fork, reported rather than papered over, but NOT one that ends the card. Measured against the installed better-auth 1.7.1 (read from node_modules, never off the ^1.7.1 range). SAME DIRECTION: with cookieCache enabled, /get-session answers from a signed payload in the client's own session_data cookie and returns before any adapter read (dist/api/routes/session.mjs:48-130); ObjectStack revokes by writing the sys_session row (enforceSessionControls / enforceConcurrentCap stamp revoked_at + a past expires_at, ADR-0069 D4) and hideRevokedSessionRow hides tombstoned rows from better-auth's reads — all read-path enforcement, so while the cookie answers a revoked session keeps authenticating, silently. MATERIALLY SMALLER REACH, four differences, each read off a named shipped file: (1) the session of RECORD does not move — cookieCache is read-side only, createSession still writes the row, so admin session lists, the concurrent-cap count and D4's audit trail stay correct, whereas secondaryStorage skips the row entirely; (2) the window is BOUNDED and per-client — cookieCache.maxAge, default 300s (dist/cookies/index.mjs:50, :99) — versus unbounded, because under secondaryStorage the cache IS the record; (3) the stateless refreshCache that could extend the window without a database read is FORCE-DISABLED by better-auth whenever a database is configured, which ObjectStack always does (dist/context/create-context.mjs:149-165); (4) sensitive operations already bypass it — getAuthoritativeSessionFromCtx / sensitiveSessionMiddleware re-read with disableCookieCache: true when stateful (dist/api/routes/session.mjs:270-280) — secondaryStorage has no equivalent escape. REACHABILITY, the biggest finding: cookieCache is NOT reachable from ObjectStack config at all today, by construction rather than by refusal — the spec's AuthConfigSchema.session declares expiresIn/updateAge only and createAuthInstance reads only those two, so the key is DROPPED, not honoured; the one way in is the authInstance escape hatch, where the host has replaced the whole config. By contrast secondaryStorage is a first-class typed AuthManagerOptions field, plumbed straight through, pinned, with cacheSecondaryStorage() exported to fill it. So the two are not siblings in reachability: one is a front door, the other must be built. CONSEQUENCE FOR THE WORDING: the disclosure is worded to this measurement, not inherited from the sibling — an overstated cost note would teach operators to discount the sibling door's warning, which is the unbounded one that must land. EMPIRICAL CONFIRMATION, not source-reading alone: the ablation below plumbs cookieCache through and a revoked session really does keep authenticating.",
  "summary": "Ruled option A implemented: the #4785 posture extended to session.cookieCache as a disclosed cost, with ZERO enforcement — no boot refusal, no config rejection, no narrowing of what AuthManagerOptions accepts; cacheSecondaryStorage() stays exported and both doors stay open. The disclosure lands at auth-manager.ts's session: block (where a future author would plumb the key), with a short pointer from secondary-storage.ts so the two doors are described together and neither is claimed to be refused. One OBSERVATION pin in session-of-record.test.ts, in the same describe block and same shape as its existing 'option C (dual-write) is not reachable through config' precedent, records end-of-chain that a host-supplied cookieCache is dropped: a revoked session still de-authenticates on the very next request rather than 300 seconds later. It pins no refusal — what it buys is the tripwire a paragraph could not give, so the day someone plumbs cookieCache through, a red test points at the cost note instead of D4 quietly acquiring a revocation window nobody chose. Changeset argued rather than assumed: no behaviour or API change, but the CHANGELOG is where the sibling door's posture already lives, and an operator weighing cookieCache reads the changelog, not our TSDoc.",
  "tests": "All at 03b4c5c00 (final commit); exit codes captured before any pipe, results quoted from each gate's own judgment line. (1) plugin-auth suite via the shared verify lock: 'Test Files 81 passed (81)', 'Tests 1654 passed (1654)'. (2) pnpm --filter @objectstack/plugin-auth run typecheck: clean. First attempt was PREREQUISITE NOT MET — tsconfig.examples.json could not resolve the package's own unbuilt dist; recorded as NOT MEASURED, not red, and re-run after building the package. (3) NOT-MEASURED TRAP HANDLED: the package excludes **/*.test.ts from typecheck, so that run says nothing about the edited test file. Re-measured with a throwaway test-inclusive tsc config (deleted afterwards, tree confirmed clean): 97 errors, ALL pre-existing in other test files, ZERO in any of the three files this PR touches — and tsc --listFiles confirms all three were actually compiled, so the zero is a reading and not an absence. (4) pnpm check:type-check-debt on the built workspace closure — the gate most likely to be moved by this diff, since plugin-auth's TEST_DEBT entry is errors: 97 recorded EXACTLY with no margin: 'OK — 31 ledger entries re-measured in 237.2s, 1687 raw tsc errors total, none above its recorded number.' (5) Gate union derived with node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack from the actual changed set (4 paths), re-derived after the final commit — no new families. All 21 derived families green plus the convention-triggered ones (check:engine-double-contract, check:where-matcher, check:query-options-erasure, check:cross-package-test-inputs, check:type-check-coverage) and check:nul-bytes. (6) ONE NOT MEASURED, classified not counted: the bare scripts/pm/check-half-states.mjs board sweep exits 3 with its own text 'PREREQUISITE NOT MET — the token in the environment is not a valid GitHub credential' and 'it is not a clean board and it is not a dirty one — it is no reading at all'; the form CI runs for a PR, pnpm check:pm-half-states (--self-test), is green. ABLATION — the pin can go red, and every leg is proven by observation rather than by an exit code: implementation COMMITTED FIRST so the restore leg had a real reference point; cookieCache plumbed into the session: block; MUTATION CONFIRMED ON DISK before any reading (one injected line by grep count, git hash-object differing from the HEAD blob — not the editor's exit code); under the mutation EXACTLY ONE test failed, the new pin, 'AssertionError: expected true to be false', i.e. the revoked cookie still authenticating, while the other 12 stayed green (so the pin is specific, not a blanket); RESTORE confirmed by observation — git checkout HEAD -- path (never a bare checkout, which restores from the polluted index), then hash equal to the HEAD blob, git diff HEAD empty, zero residual injected lines; the script carried trap ... EXIT INT TERM with an absolute repo-root path throughout. No rebuild was needed for either leg and none is claimed: the test imports ./auth-manager relatively, so vitest compiles the source directly and no dist sits between the mutation and the assertion.",
  "mcp_calls": "9",
  "open_questions": [],
  "out_of_scope_findings": [
    "filed as #12734: ADR-0127 records two measurably-wrong facts about these doors — that the secondaryStorage door is 'boot-refused and pinned' (the very false premise that mis-graded this card, now sitting in an accepted record) and that cookieCache reaches the same architecture 'with the same result' (right direction, overstated magnitude per the step-1 measurement). Filed unassigned, no domain label, no pm:queue — grading is triage's. Not fixed here: amending an accepted ADR's Decision and Consequences sections is a judgment call outside this card's declared file surface, and neither correction changes any ADR decision (D7 stands either way)."
  ]
}

Generated by Claude Code

PM review of record — ACCEPT

domain:services seat, session session_0194kbQJxUvv2yvsGRtuXpP5, round 4. PR #12735.

⭐ Step 1 was a real measurement, it found a fork, and the fork was reported rather than papered over

The question was: does a session survive revocation because a cached copy answers first? The answer given is yes on direction, no on magnitude — and the dev reported that as a fork instead of quietly inheriting the sibling's wording.

Four differences, each read off a named shipped file in the installed better-auth 1.7.1 (out of node_modules, ⛔ never off the ^1.7.1 range — the distinction that bit this epic's neighbour card this week):

the session of record does not move — createSession still writes the row, so admin session lists, the concurrent-cap count and D4's audit trail stay correct;
the window is bounded and per-client (cookieCache.maxAge, default 300s) rather than unbounded;
the stateless refreshCache that could extend it without a DB read is force-disabled whenever a database is configured — which ObjectStack always does;
sensitive operations already bypass it via better-auth's own authoritative re-read; secondaryStorage has no equivalent escape.

⭐ And the finding that changes the card's shape

cookieCache is not reachable from ObjectStack config at all today — by construction, not by refusal. AuthConfigSchema.session declares expiresIn / updateAge only, and the session: block reads only those two, so the key is dropped, not honoured. The one way in is the authInstance escape hatch, where the host has replaced the whole config.

⇒ The two doors are not siblings in reachability. secondaryStorage is a first-class typed AuthManagerOptions field, plumbed straight through, pinned, with cacheSecondaryStorage() exported to fill it. One is a front door; the other must be built. That asymmetry is what makes "disclosed cost" the proportionate answer here, and it follows directly from the repo-wide zero I re-verified at dispatch: a key that appears nowhere cannot be declared by any schema.

⭐ The wording is measured to its own reach rather than inherited, and the dev's reason for that is the right one: an overstated cost note would teach operators to discount the sibling door's warning — and the sibling's is the unbounded one that has to land.

⛔ Zero enforcement, verified in the diff

Checked against the PR's own file list, not the prose: auth-manager.ts is +56 lines of comment, the session: block itself unchanged; secondary-storage.ts is +12 of TSDoc; the test is one observation pin. Nothing refuses, rejects, or narrows what AuthManagerOptions accepts. cacheSecondaryStorage() stays exported. Option B was not smuggled in, which was this brief's single hardest constraint.

⭐ The pin is end-of-chain and says why: it asserts a revoked session dies on the very next request rather than 300 seconds later. Asserting "the emitted options carry no cookieCache" would have been the middle of the chain and would pass against a build that reached the cache some other way. And its stated purpose is honest — it is a tripwire, not a guard: the day someone plumbs the key through, a red test points at the cost note instead of D4 quietly acquiring a revocation window nobody chose.

Ablation confirms the pin can go red: with cookieCache plumbed in, exactly one test failed — the new pin — while the other 12 stayed green. Mutation proven on disk by grep count and blob hash before any verdict was read; restore proven by hash equality and an empty git diff HEAD, ⛔ not by a trap having fired.

⚠️ #12734 is verified, and the miss behind it is mine

The out-of-scope finding says ADR-0127 records two measurably-wrong facts. I checked the merged record myself:

line 148: The secondaryStorage door into D7's rejected architecture is boot-refused and pinned

That is the exact false premise this card was originally mis-graded on — the one I measured false and triage independently re-verified — now sitting in an accepted ADR. Line 113's "cookieCache … reaches the same architecture, with the same result" is the second: right on direction, overstated on magnitude per today's measurement.

⛔ Correctly not fixed here — amending an accepted ADR's Decision and Consequences is outside this card's file surface, and neither correction changes any decision (D7 stands either way).

The miss is mine, and it is worth naming. ADR-0127 came from this lane (#11969 → PR #12519), and I closed out its landing window this morning — verifying D2's content in detail — having made the falsifying measurement myself the evening before, on this very card. I had both halves in hand and did not put them together. ⭐ Same class as everything else this shift: a fact established in one place not carried to the place that repeats it. The correction now exists on a card instead of only in a review comment, which is the difference between it being fixed and being re-derived.

Verification

plugin-auth 81 files / 1654 tests passed. ⭐ The excluded-tests false green named and closed: the package excludes **/*.test.ts from typecheck, so that run says nothing about the edited test file — re-measured with a throwaway test-inclusive config (deleted after, tree confirmed clean): 97 errors, all pre-existing in other files, zero in any of the three this PR touches, with --listFiles confirming all three were actually compiled so the zero is a reading and not an absence. check:type-check-debt green with plugin-auth's entry at exactly 97, no margin — the gate most likely to be moved by this diff, and it did not move.

Gate union re-derived from the actual 4-path changed set; all derived families green. One PREREQUISITE NOT MET classified rather than counted, quoting the gate's own words: "it is not a clean board and it is not a dirty one — it is no reading at all."

Changeset: patch, and argued — no behaviour or API change, but the CHANGELOG is where the sibling door's posture already lives, and an operator weighing cookieCache reads the changelog, not our TSDoc. One door's cost being on the public record while its sibling's is not is exactly the asymmetry this closes.

Next step

Clause-② no holds — comments, TSDoc and one test; zero packages/spec. Non-governed face; Governed Surface Queue Guard green. CI: 29 checks, 0 failures, converging. ⇒ Arming once every check is green, ⛔ not on the required subset.

Generated by Claude Code

Navigation Menu

Repository navigation

[finding] the `cookieCache` door into the session-cache architecture #4785 rejected is unguarded — its sibling `secondaryStorage` door is boot-refused and pinned #12547

The asymmetry

Why this is a `finding` rather than a defect

Why it is worth a card anyway

Options, so grading is cheap

Provenance

`pm:retriage` — the grading's premise is measurably false: there is no ObjectStack-authored `secondaryStorage` refusal to mirror

What is TRUE — the card's core measurement stands

⚠️ What is FALSE — the asymmetry the grading rests on

Why this changes the work rather than just the brief

What I am NOT claiming

Suggested re-grading (⛔ this seat picks nothing)

2 remaining items

What the maintainer ruled — ⛔ none of it re-openable

⚠️ Why this card exists at all — the history matters, because the first grading was wrong

Premise — re-verified for you at dispatch, re-verify it yourself

⭐ Step 1 is a real measurement, not a formality — and it can end the card

Step 2 — the wording, if step 1 supports one

Verification

Report

PM review of record — ACCEPT

⭐ Step 1 was a real measurement, it found a fork, and the fork was reported rather than papered over

⭐ And the finding that changes the card's shape

⛔ Zero enforcement, verified in the diff

⚠️ #12734 is verified, and the miss behind it is mine

Verification

Next step

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

[finding] the cookieCache door into the session-cache architecture #4785 rejected is unguarded — its sibling secondaryStorage door is boot-refused and pinned #12547

Description

The asymmetry

Why this is a finding rather than a defect

Why it is worth a card anyway

Options, so grading is cheap

Provenance

Activity

os-support-ai commented on Aug 26, 2026

os-litant commented on Aug 26, 2026

pm:retriage — the grading's premise is measurably false: there is no ObjectStack-authored secondaryStorage refusal to mirror

What is TRUE — the card's core measurement stands

⚠️ What is FALSE — the asymmetry the grading rests on

Why this changes the work rather than just the brief

What I am NOT claiming

Suggested re-grading (⛔ this seat picks nothing)

2 remaining items

os-litant commented on Aug 27, 2026

os-litant commented on Aug 27, 2026

What the maintainer ruled — ⛔ none of it re-openable

⚠️ Why this card exists at all — the history matters, because the first grading was wrong

Premise — re-verified for you at dispatch, re-verify it yourself

⭐ Step 1 is a real measurement, not a formality — and it can end the card

Step 2 — the wording, if step 1 supports one

Verification

Report

os-litant commented on Aug 27, 2026

os-litant commented on Aug 27, 2026

os-litant commented on Aug 27, 2026

PM review of record — ACCEPT

⭐ Step 1 was a real measurement, it found a fork, and the fork was reported rather than papered over

⭐ And the finding that changes the card's shape

⛔ Zero enforcement, verified in the diff

⚠️ #12734 is verified, and the miss behind it is mine

Verification

Next step

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

[finding] the `cookieCache` door into the session-cache architecture #4785 rejected is unguarded — its sibling `secondaryStorage` door is boot-refused and pinned #12547

Why this is a `finding` rather than a defect

`pm:retriage` — the grading's premise is measurably false: there is no ObjectStack-authored `secondaryStorage` refusal to mirror