Found in the 2026-08-27 design review of the security-fix campaign (post-merge audit of Critical/high fixes). Lens: extensibility / readability / function coherence.
auth.policy-verifier's packages/core/src/logging/ (188 lines, added by policy-verifier#130) is consumed only by its server package, and its own doc concedes it is deliberately the same shape as the Logger port in @o3co/auth-provider-core — a second hand-maintained copy of the same port across the stack. Meanwhile @o3co/auth.utils still exports the legacy createLogger that policy-verifier#130 abandoned in the standalone template.
Proposal: promote the Logger/EventLogger port (and optionally consoleLogger) to @o3co/auth.utils, re-export from both cores, deprecate the legacy createLogger.
Cross-repo caution: contract-tightening changes must land in this umbrella's tests/ first — the E2E clones siblings from default branches, so sequence the PRs accordingly.
Found in the 2026-08-27 design review of the security-fix campaign (post-merge audit of Critical/high fixes). Lens: extensibility / readability / function coherence.
auth.policy-verifier's
packages/core/src/logging/(188 lines, added by policy-verifier#130) is consumed only by its server package, and its own doc concedes it is deliberately the same shape as the Logger port in @o3co/auth-provider-core — a second hand-maintained copy of the same port across the stack. Meanwhile@o3co/auth.utilsstill exports the legacycreateLoggerthat policy-verifier#130 abandoned in the standalone template.Proposal: promote the
Logger/EventLoggerport (and optionallyconsoleLogger) to@o3co/auth.utils, re-export from both cores, deprecate the legacycreateLogger.Cross-repo caution: contract-tightening changes must land in this umbrella's
tests/first — the E2E clones siblings from default branches, so sequence the PRs accordingly.