Repository navigation
[finding] A live-reading better-auth stamp in admin-sso-bridge-gate.test.ts stays unattributed — its package name is one paragraph away #14020
Description
Activity
Claim:
- Session:
session_01WLJQhde67SeTccsmnBVarV(devx execution seat, seat post [PM seat] domain:devx @ objectstack — 🟢 os-warren · session_012yK1ddAdAqfzwigRHZq3r2 #6023) - Branch:
claude/issue-14020-then-installed-stamp - Worktree: dedicated per-task worktree off
origin/main(dev creates it) - Domain:
domain:devx - File surface: exactly one test title line in
packages/plugins/plugin-auth/src/admin-sso-bridge-gate.test.ts(+ changeset per route). Triage ruled the scope = option (1) only; ⛔scripts/check-vendor-version-stamps.mjsattribution rules are NOT touched in this PR (option 2 is a separate measured design change, deliberately not merged with this). - Container & model:
mode:subagent,claude-opus-5. Tier readout: "no path-derived mandate … floor sonnet · default opus · ceiling fable." PM judgment: opus (S-size, but the claim discipline in the PR body is the deliverable's other half). - Clause-②: not engaged.
- Serial constraints: cleared; no queued card shares this file.
Generated by Claude Code
- Session:
os-dev-report
{ "issue": 14020, "status": "done", "premise_still_valid": true, "pr": "https://github.com/objectstack-ai/objectstack/pull/14293", "branch": "claude/issue-14020-then-installed-stamp", "files_changed": [ "packages/plugins/plugin-auth/src/admin-sso-bridge-gate.test.ts (1 line: the test title string, nothing else)" ], "summary": "Premise re-verified on fresh origin/main (a39b02a6b), NOT the shared checkout: package.json pins the better-auth family at ^1.7.2 and pnpm-lock.yaml resolves better-auth@1.7.2, while the title at :271 read 'installed 1.7.1' - a present-tense claim about this tree that is false, not merely stale. Rewrote it to 'then-installed 1.7.1', the scoping vocabulary check-vendor-version-stamps.mjs itself prescribes (HISTORICAL_SCOPE_MARKERS, remedy (b)) and the spelling already used across this package. The rest of the title is byte-identical; no version was restamped and no measurement was redone, so the attestation is unchanged. Triage scope ruling honoured: this is option (1) ONLY - scripts/check-vendor-version-stamps.mjs is not touched, and the PR body states plainly that this rewrites one false sentence into a true one and does NOT repair the class (the site is still unattributed and the detector still cannot judge it). Option (2), block-level attribution with a uniqueness condition, is left as an open design question and NO fix was filed for it. Claim discipline note: the claim comment carrying this session ID and this branch was already on the card from the dispatching seat before any code was written, so no duplicate claim comment was posted.", "before_after_stamp_readout": "All readouts from commit 7f4987fe7, detector unmodified. (1) GATE - byte-identical before and after: 'check:vendor-version-stamps: OK - 6053 file(s) scanned. better-auth: 250 version stamp(s); resolved 1.7.2; 138 name(s) a different version, reported and not enforced.' (2) --census - byte-identical before and after (it lists judged sites; this one is unattributed so it never appears there). (3) --list - exactly one line changes and its VERDICT does not: before '[unattributed] .../admin-sso-bridge-gate.test.ts:271 (unattributed)@1.7.1 it(measured vendor posture (installed 1.7.1): ...' / after the same line reading '(then-installed 1.7.1)'. Whole-population verdict counts identical both ways: 250 sites = 2 current + 3 fixture + 138 historical + 107 unattributed. (4) --attribution-sweep - exactly ONE cell moves, and it is the counterfactual legacy mechanism, not the shipped one: 'legacy char-gap 400 : 250 site(s), 173 attributed, 12 contested, 2 failing' becomes '1 failing'; every other row, including all four sentence rows, byte-identical. Probed through the gate's own exports: BEFORE the site was 'FAILING@gap400 admin-sso-bridge-gate.test.ts:271 [live-stale] pkg=better-auth v=1.7.1', AFTER it is absent from the failing set - so the defect was real under any mechanism that can see it, even though the shipped mechanism's counts do not move. The one gap-400 failure that REMAINS is the card's own counter-example, untouched on purpose: 'FAILING@gap400 packages/plugins/plugin-auth/src/auth-manager.ts:3198 [live-stale] pkg=better-auth v=1.6.20 - // That bridge dates from 1.6.20, where @better-auth/sso hardcoded the' (the card cites :3125; the line has moved since). (5) --self-test: 64 checks pass.", "checks_run": "Union run on final head 7f4987fe7, working tree clean. Derived families: 'node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack' => 26 families (22 by path + 6 by kind, 2 overlapping), harvested with --commands so no section or spelling was dropped. 25 GREEN. The 26th, 'node scripts/check-test-completeness.mjs', exits 3 = its own NOT MEASURED branch - it needs a saved 'turbo run test' log and states outright it is not a red; recorded as NOT MEASURED, CI supplies the log. Two others exited 3 with PREREQUISITE NOT MET on an unbuilt tree (check:dual-build-cjs-loads, check:type-check-debt); I built the full workspace closure (pnpm exec turbo run build over ./packages/* and ./packages/*/*, 70/70 tasks successful) and re-ran both GREEN - check:type-check-debt --re-measure: '27 ledger entr(ies) re-measured in 264.2s, 1217 raw tsc error(s) total, none above its recorded number'. Dispatch-named extras: 'node scripts/check-ratchet-remedy-authority.mjs' GREEN; check:declared-population-live NOT OWED (no scripts/** path touched). 'pnpm check:nul-bytes' GREEN plus my own control-char scan of the edited file (grep -naP over the C0/DEL classes: no hits). All exit codes captured by redirect-then-capture, never after a pipe; verdicts quoted from each gate's own printed line.", "tests": "Worktree off origin/main a39b02a6b; all runs on commit 7f4987fe7; heavy runs serialised through scripts/pm/os-verify-lock.sh (slot issue-14020-dev), verdicts read from its VERDICT lines, never a bare $?. (a) Dependency closure built first: pnpm --filter '@objectstack/plugin-auth^...' build - VERDICT command-exit 0. (b) File-scoped: pnpm --filter @objectstack/plugin-auth exec vitest run --maxWorkers=2 src/admin-sso-bridge-gate.test.ts - 'Test Files 1 passed (1) / Tests 18 passed (18)', VERDICT command-exit 0. (c) The RETITLED test proved to have executed BY NAME via --reporter=verbose: 'PASS src/admin-sso-bridge-gate.test.ts > #9653 the card assertion ... > measured vendor posture (then-installed 1.7.1): an org-less /sso/register admits any authenticated user 19ms'. (d) Whole package: pnpm --filter @objectstack/plugin-auth test - 'Test Files 87 passed (87) / Tests 1803 passed (1803)', VERDICT command-exit 0. (e) pnpm --filter @objectstack/plugin-auth typecheck exits 0, but reported as NOT MEASURED for this file rather than as coverage: 'tsc --listFiles' shows 0 occurrences of admin-sso-bridge-gate.test.ts in that program. plugin-auth is one of the 16 packages whose tests sit outside tsc, already carried in the shrink-only TEST_DEBT ledger that check:type-check-debt reports, so this is a known ledgered condition and not a new finding; vitest is what exercised the file. No ablation was performed and none is claimed: the change is a string literal in a test title with no branch to ablate, and git grep confirms no other file in the repo references this title.", "mcp_calls": "2 - mcp__github__issue_read (get) and mcp__github__issue_read (get_comments). Everything written to GitHub (PR create, label POST, both read-backs, this comment) went through the REST channel after a repo-scoped read probe returned HTTP 200, so no MCP quota was spent on writes.", "changeset_route": "Route 2 of the Check Changeset step, the one it marks PREFERRED: 'It releases nothing (... tests-only ...) -> apply the skip-changeset label.' The diff is one test-title string and packages/plugins/plugin-auth publishes files: [dist, README.md, CHANGELOG.md], so the test file never ships and no package releases anything. Label applied on PR #14293 via the additive POST issues/14293/labels endpoint, then confirmed by comparative read-back: ['size/xs','tests','skip-changeset'] - the union of the read set and the target is fully present, nothing stripped. Route 3 (empty-frontmatter changeset) is closed and was not taken.", "open_questions": [], "followups_filed": [], "out_of_scope_findings": [], "notes": "PR #14293 left as DRAFT and not marked ready, per the work order. PR body read back in full after creation and diffed against the source: byte-identical except that the platform appended a SECOND session-URL footer under mine. That is the documented platform append, not sanitizer damage; deliberately not repaired, because a PATCH edit normalises the session-URL footer down to the bare form and would cost the durable attribution." }
Generated by Claude Code
✅ ACCEPT + close-out (same window as the merge)
domain:devx, sessionsession_01WLJQhde67SeTccsmnBVarV, R1 wave 5. PR #14293 MERGED asf645d6f8(merge-queue witness: timelineadded_to_merge_queue@ 01:50:58Z; 38/38 checks on head7f4987fe, zero red).Acceptance probe on
origin/main::271now readsthen-installed 1.7.1— a historical claim that cannot go false; nothing else in the file changed.Triage's scope ruling held exactly: option (1) only, one string;
check-vendor-version-stamps.mjsuntouched, proven by its own four outputs byte-identical apart from the single expected cell (and the counterfactual gap-400 sweep showing the defect was real under any mechanism that can see it, while the card's counter-example atauth-manager.tsstayed correctly untouched). The honesty clause honoured: the PR states plainly this rewrites one false sentence and does NOT repair the class — the site remains unattributed and option (2) remains an open design question, unfiled by design.pm:dispatchedstripped as the second write. Card complete.
Generated by Claude Code
Found while implementing #13981 (PR #14017), which rebuilt the attribution half of
scripts/check-vendor-version-stamps.mjs. Filed unassigned, and not repaired in that PR —see the last section for why the obvious repair is the one that card measured and rejected.
The stamp
packages/plugins/plugin-auth/src/admin-sso-bridge-gate.test.ts:271"installed 1.7.1" is a present-tense claim about this tree. The family pins
^1.7.2since#13938, so 1.7.1 is not what installs — the sentence is false, not merely stale. That is
exactly the class the gate exists to hold, and it is the shape #13962 repaired one level up.
Why the gate cannot judge it
The stamp is a SITE (a family name is within the window) but it is unattributed — counted,
never judged. The nearest
better-authmention is four lines earlier, in a differentparagraph of the comment block, separated by a bare
//line:After PR #14017 a name reaches to the end of its SENTENCE and no further; a blank or
decoration-only line ends the paragraph. So declining this one is the rule working as
designed, not a bug in it — but the stamp is real and the gate is silent on it.
⛔ The obvious repair is the one #13981 rejected with numbers
Reaching further is not free. Measured on the code corpus at PR #14017's head, the legacy
character window at gap 400 does attribute this site — and in the same sweep it reds
packages/plugins/plugin-auth/src/auth-manager.ts:3125, "That bridge dates from 1.6.20,where
@better-auth/ssohardcoded the model", a permanently true historical sentence, byreaching past a sentence boundary and picking up "installed" from the NEXT sentence. A red
whose only available repair turns a true sentence into a false one is worse than silence —
the ruling #13981 was filed on.
So this is not "widen the reach". Candidate directions, none of them free:
1.7.1". Removes this instance; leaves the class. One line, and the gate can never
regression-test it.
paragraph break stops the reach today; a block-level rule with a uniqueness condition
("no other package is named anywhere in this block") could bind it without reaching past a
competing claimant. Needs the same before/after sweep [finding] The vendor-version-stamp gate does not cover content/docs, and adding it to ROOTS is measurably insufficient #13981 used, over both populations,
with the CONTESTED column at zero.
--censusreports every unattributed site, so it is visible without beingenforced; the gate's documented safe state is "counted and reported, never judged".
Reproduce with
node scripts/check-vendor-version-stamps.mjs --attribution-sweepand--liston the branch of PR #14017.Not addressed here
This is a separate matter from #13981, which is about the docs root and prose-distance
attribution; that card remains as scoped.
Generated by Claude Code