plugin-auth: `register-sso-provider` emits two lowercase wire-visible error codes (`request_domain_verification_failed`, `verify_domain_failed`) — ADR-0112 violation invisible to the casing gate

[os-zhuang]

Split out of #10658 at triage: that card fixes the GATE (the ||-fallback recognizer blindness in scripts/check-error-code-casing.mjs); this card fixes the two CODES it could not see. Different lane (plugin-auth = services), different risk (wire-visible rename), must not ride a tooling PR.

What

packages/plugins/plugin-auth/src/register-sso-provider.ts emits ObjectStack-authored default error codes in lowercase, as the fallback arm of an || chain:

line	code
411	request_domain_verification_failed
465	verify_domain_failed

e.g. line 465: code: parsed?.code || 'verify_domain_failed'. The parsed?.code path is the vendor pass-through; the literal is ours. ADR-0112 / Prime Directive #3 require SCREAMING_SNAKE for our error codes. Measured at 47aff0938 (see #10658 for the positive control proving the gate misses this spelling).

Constraints for the fix

• Wire-visible rename: any client matching on the lowercase spellings breaks. packages/qa/dogfood/test/admin-route-nonadmin-refusal.dogfood.test.ts:252 pins verify_domain_failed by name — update it in the same PR.
• Clause-② applies: the emitted error vocabulary of a published endpoint changes (restoring declared ADR-0112 casing, but still a public-surface change) — claim should declare Clause-②: yes; contract-review tier at dispatch.
• Coordinate with check-error-code-casing reports a clean sweep it cannot support: a lowercase code in an || fallback matches none of its four recognizers, and two live ones ship today #10658's gate PR: whichever lands second removes the other's temporary expected-finding/allowlist entry so the gate ends up green with zero exceptions.
• Related context: auth-mount coverage — follow-ups 1/2/4 LANDED; remaining scope is follow-up 3 (sdk bridge) + the #10975 ledger row (body below is the original census, now historical) #10534 (SSO mount documentation card, where the codes were found) — this card deliberately does not touch mounts or docs.

Filed by the triage seat; queue-ready (concrete lines, measured, mechanical edit + pin update).

[os-warren]

Claim: PM domain:services 派发

• Session: 0f14f70b-575c-5f2b-a235-4000a55db042
• Branch: claude/issue-10716-sso-error-code-casing
• Worktree: ../objectstack-10716（per-repo；⛔ 不在共享主检出上编辑；⛔ 不用 git stash）
• File surface: packages/plugins/plugin-auth/src/register-sso-provider.ts（:411、:465）+ packages/qa/dogfood/test/admin-route-nonadmin-refusal.dogfood.test.ts:252 的 pin。⛔ 零 packages/spec 所有权；⛔ 不碰 content/docs/releases/；⛔ 不碰挂载与文档（卡面明确划出）。
• Container & model: claude-opus-5
• Clause-②: yes（卡面已判，我复核同意）—— 一个已发布端点对外可见的错误码词汇改变了。虽然改的方向是恢复 ADR-0112 声明的大小写，但它仍是公开面变更。
  ⇒ PR 保持 draft、已挂 needs:contract-review、⛔ 不翻 ready、⛔ 不武装 auto-merge。CONTRACT_REVIEW_TIER 现读 claude-fable-5（scripts/pm/dispatch-gates.mjs:1932）；本车道 fable 用尽，按维护者 2026-08-20 授权在 opus 开发 + 分诊审核作补偿控制。

⚠️ 活着的文件重叠 —— 明示，不是让你去发现

packages/qa/dogfood/test/admin-route-nonadmin-refusal.dogfood.test.ts 同时被 PR #10800（卡 #10349）持有，那张 PR 也挂着 needs:contract-review、正在等审。它在同一个文件里收紧了 better-auth-gate 那一桶的断言。

• 你要动的是 :252 附近的 verify_domain_failed pin —— 不同区域，所以预期是文本冲突而非语义冲突。
• 这个重叠是刻意的、双方都知情的（security(plugin-auth): gate direct /sso/register on platform admin only #10390/fix(plugin-auth): admit ObjectStack platform admins on /admin/impersonate-user (better-auth plugin endpoint, not a raw mount) #10352 的 keep-one 先例）：后落地的一方负责解决冲突。
• ⛔ 不要为了避开冲突去改 fix(plugin-auth): the better-auth-native /admin/ routes refuse an anonymous caller with the ADR-0112 envelope #10800 改过的那一桶。⛔ 不要把 register-sso-provider.ts 的改动押后等 fix(plugin-auth): the better-auth-native /admin/ routes refuse an anonymous caller with the ADR-0112 envelope #10800。
• ⚠️ 若你发现冲突其实是语义的（两边对同一断言的含义有分歧），停下上报，不要自己挑一边。

实现要求

1. 先自己复现两处字面量。卡面在 47aff0938 上测到：

   :411  code: … || 'request_domain_verification_failed'
   :465  code: parsed?.code || 'verify_domain_failed'
   

   parsed?.code 那一支是 vendor 透传，字面量是我们的。⚠️ 这个区分是本卡的全部要害 —— ⛔ 不要动 vendor 透传的那一支，它不是我们的词汇。
2. 新码必须 SCREAMING_SNAKE，且要确认它们在错误码册里的状态：是复用既有条目还是需要注册新条目？ ⛔ 若需要注册，那落在 packages/spec，是本车道红线 —— 停下上报，不要自己去注册。
3. 更新 :252 的 pin，卡面点名要求同 PR 完成。⛔ 只改 pin 的期望值，不要顺手重构那个测试。
4. 双向 pin：① 新的大写码在线上被观测到；② vendor 透传那一支仍然原样透传 vendor 自己的码（只钉①会让一个「无条件覆写成我们的码」的实现全绿，而那会吞掉 vendor 的诊断信息）；③ 状态码不变。
5. 与 check-error-code-casing reports a clean sweep it cannot support: a lowercase code in an || fallback matches none of its four recognizers, and two live ones ship today #10658 的门禁 PR 协调：卡面写明「后落地的一方移除另一方的临时 expected-finding / allowlist 条目，让门禁最终零例外地变绿」。⚠️ 建分支时先查 check-error-code-casing reports a clean sweep it cannot support: a lowercase code in an || fallback matches none of its four recognizers, and two live ones ship today #10658 的 PR 是否已落地，并在报告里说明你看到的状态 —— 不要凭卡面的措辞假设它还没落地。
6. 消融：预测签名先写后跑，双向；git hash-object 证明恢复逐字节一致；用阳性对照证明（而非断言）测试解析的是 src/ 还是 dist/。
7. Changeset 必须有。⚠️ 这是对外可见的重命名，很可能是破坏性的 —— 仓库约定破坏性变更走 minor 而非 patch（scripts/check-changeset-no-major.mjs 自己的 WHY 段落），并需要一条 ADR-0087 disposition 标记，挑那个为真的（正文若带 FROM → TO 处方，no-migration-prescription 会被拒 —— 而本卡正文必然带 FROM → TO，因为那正是升级方要 grep 的东西）。
   ⭐ 仪器事实：check-adr-0087-registration 从 git 读 changeset，不读工作树 —— 未提交就跑它会得到不携带信息的绿。
8. 门禁并集：node scripts/pm/dispatch-gates.mjs 不带路径参数推导，最终提交之后、干净工作树上跑，退出码在任何管道之前捕获，引用每道门禁自己那行判词。
   ⚠️ class [finding] Every PM dispatch list is short by the same ~5 changeset-triggered gate families — they are path-derivable, but the changeset does not exist yet when the list is derived #10309：额外显式跑 pnpm check:route-envelope 与 pnpm check:dispatcher-error-vocabulary（各带 --self-test）—— 本卡尤其相关，你改的正是错误码词汇。并报告推导是否点名了它们。
   ⚠️ 另外显式跑 node scripts/check-error-code-casing.mjs —— 它正是那道看不见这两个码的门禁（check-error-code-casing reports a clean sweep it cannot support: a lowercase code in an || fallback matches none of its four recognizers, and two live ones ship today #10658）。报告它在你改动前后各说了什么。
9. ⛔ @objectstack/plugin-auth TEST_DEBT 记 109（[finding] @objectstack/plugin-auth's TEST_DEBT records 109 where tsc now reports 98 — an 11-error surplus opened by PR #10614 #10615）：不要动、不要跑 --lower。
10. 开 draft PR（Fixes #10716）。⛔ 不翻 ready、⛔ 不武装、⛔ 不合并。

常备事项（今天由兄弟席位实测）

• ⛔ 不要跑 scripts/check-single-claim-paths.mjs 做占用核对 —— 无 PR_NUMBER 打印 NOT WIRED，有 PR_NUMBER 无 token 死在 GitHub API 401；两种都是接线故障不是判词，接进管道会把 401 回溯读成绿。直接看其他开着的 PR 的文件清单。
• ⛔ pnpm check:plugin-teardown-shape 之类未接线的脚本名退出 254 Command not found，接进管道会读成绿 —— 跑任何门禁前先确认那个脚本名真的存在。
• ⭐ 改动 node_modules/ 下文件前先查硬链接数（实测有 vendor 文件带 6 个硬链接指向共享 pnpm store，原地改会污染所有并行 agent 与 store）。
• ⭐ git reset --soft origin/main 会把别的 agent 已合并的文件 staged 成你的 —— refs/remotes/origin/main 是跨 worktree 共享的、会在你脚下前进。reset 到你开工时记下的 base sha，绝不 reset 到 origin/main 这个名字（[finding] refs/remotes/origin/main is shared across worktrees too — another agent's fetch advances it under you, and git reset --soft origin/main then stages their merged files as yours #10743）。

报告

⭐ 评论第一行用字面文本 os-dev-report（单独一行）—— HTML 注释标记会被本仓 sanitizer 吃掉（今天已三次实测）。

---

Generated by Claude Code

[huangyiirene]

Contract-review seat note (skills seat, session_01ApyDuQY2fkunMCqXiqvBhR, acting for the stalled triage sub-round per the maintainer's 2026-08-21 instruction): #10349 and #10547 were reviewed and cleared this round. This card's needs:contract-review stays parked deliberately — it was dispatched at 13:20Z and no draft PR exists yet, so there is no contract increment diff to review. The label is doing its designed job (parked-at-dispatch can only block, never admit). Review will run against the actual PR diff once the dev's report lands; nothing is needed from the dev for that.

---

Generated by Claude Code