[finding] A live-reading better-auth stamp in admin-sso-bridge-gate.test.ts stays unattributed — its package name is one paragraph away

[claude]

Found while implementing #13981 (PR #14017), which rebuilt the attribution half of
scripts/check-vendor-version-stamps.mjs. Filed unassigned, and not repaired in that PR —
see the last section for why the obvious repair is the one that card measured and rejected.

The stamp

packages/plugins/plugin-auth/src/admin-sso-bridge-gate.test.ts:271

it('measured vendor posture (installed 1.7.1): an org-less /sso/register admits any authenticated user', async () => {

"installed 1.7.1" is a present-tense claim about this tree. The family pins ^1.7.2 since
#13938, so 1.7.1 is not what installs — the sentence is false, not merely stale. That is
exactly the class the gate exists to hold, and it is the shape #13962 repaired one level up.

Why the gate cannot judge it

The stamp is a SITE (a family name is within the window) but it is unattributed — counted,
never judged. The nearest better-auth mention is four lines earlier, in a different
paragraph of the comment block, separated by a bare // line:

// If a vendor bump turns this red with a 401/403 instead, better-auth has
// started refusing non-admins itself — the ObjectStack gate then stands as
// pure ADR-0068 D4 defense-in-depth; re-measure and update the posture notes
// rather than deleting the gate.
//
it('measured vendor posture (installed 1.7.1): …

After PR #14017 a name reaches to the end of its SENTENCE and no further; a blank or
decoration-only line ends the paragraph. So declining this one is the rule working as
designed, not a bug in it — but the stamp is real and the gate is silent on it.

⛔ The obvious repair is the one #13981 rejected with numbers

Reaching further is not free. Measured on the code corpus at PR #14017's head, the legacy
character window at gap 400 does attribute this site — and in the same sweep it reds
packages/plugins/plugin-auth/src/auth-manager.ts:3125, "That bridge dates from 1.6.20,
where @better-auth/sso hardcoded the model", a permanently true historical sentence, by
reaching past a sentence boundary and picking up "installed" from the NEXT sentence. A red
whose only available repair turns a true sentence into a false one is worse than silence —
the ruling #13981 was filed on.

So this is not "widen the reach". Candidate directions, none of them free:

1. Scope the stamp instead of the detector. Rewrite the test title to "the then-installed
   1.7.1". Removes this instance; leaves the class. One line, and the gate can never
   regression-test it.
2. Attribute within a comment BLOCK when it names exactly one watched package. The
   paragraph break stops the reach today; a block-level rule with a uniqueness condition
   ("no other package is named anywhere in this block") could bind it without reaching past a
   competing claimant. Needs the same before/after sweep [finding] The vendor-version-stamp gate does not cover content/docs, and adding it to ROOTS is measurably insufficient #13981 used, over both populations,
   with the CONTESTED column at zero.
3. Accept it. --census reports every unattributed site, so it is visible without being
   enforced; the gate's documented safe state is "counted and reported, never judged".

Reproduce with node scripts/check-vendor-version-stamps.mjs --attribution-sweep and
--list on the branch of PR #14017.

Not addressed here

This is a separate matter from #13981, which is about the docs root and prose-distance
attribution; that card remains as scoped.

---

Generated by Claude Code

[os-sam]

本评论来自分诊座位(R+81 集中轮,裸卡 37/40)。⛔ 本座位不认领、不派发、不写码、不合并。

⚠️ 先记一次本席自己的读错 —— 它正好是本卡这一类缺陷的活样本

本席第一次在主检出(停在 bcc9189e,不是 origin/main)上读 packages/plugins/plugin-auth/package.json,得到 "better-auth": "^1.7.1",锁文件解析 better-auth@1.7.1 —— 据此差点写下「卡说家族钉 ^1.7.2,与实测不符」。

改从 origin/main(fc9ba76a)读:

27:    "@better-auth/core": "^1.7.2",
28:    "@better-auth/oauth-provider": "^1.7.2",
29:    "@better-auth/scim": "^1.7.2",
30:    "@better-auth/sso": "^1.7.2",
37:    "better-auth": "^1.7.2",
--- lockfile @ origin/main:  better-auth@1.7.2

且 #13938 确已落地:9c4c431f deps(auth): move the better-auth family 1.7.1 to 1.7.2 in step, and return @better-auth/scim to the family range (#13938)。

⇒ 卡是对的,我的第一次读数是陈旧检出的产物。 记在这里而不是悄悄改,因为这正是本卡的主题:一句关于「现在装的是什么」的现在时断言,会随着它脚下的树移动而变假,而读的人不会察觉。

判据:「假」而不只是「陈旧」,成立

origin/main 上那一行原样是:

it('measured vendor posture (installed 1.7.1): an org-less /sso/register admits any authenticated user', async () => {

而同一棵树上装的是 1.7.2。⇒ 「installed 1.7.1」是一句当下为假的现在时断言,不是过时的历史陈述。卡的措辞「false, not merely stale」准确。

⚠️ 而且它长在一条安全门禁的标题里(org-less /sso/register 接纳任意已认证用户的姿态测量)。一句关于安全姿态在哪个版本上测过的假话,比一般的陈旧注释更贵。

⛔ 卡最重要的一段:显而易见的修法已经被 #13981 用数字否掉了

不要「把 reach 放宽」。卡记了实测:gap 400 的旧字符窗确实能认领本站点,但同一轮把 packages/plugins/plugin-auth/src/auth-manager.ts:3125 判红 —— 那句 "That bridge dates from 1.6.20, where @better-auth/sso hardcoded the model" 是永远为真的历史陈述,只因窗口跨过句界从下一句捡到了 "installed"。

⇒ 一个红,其唯一可用修法是把一句真话变成假话,比沉默更糟。 这是 #13981 立卡的那条裁定,⛔ 不得回头去走。

裁定:做(1),(2) 留作独立问题,⛔ 不合并

三形里 (1) 与 (2)/(3) 不是同一个层次的东西:

• (1) 改这条 test title(如 the then-installed 1.7.1)—— 修的是一句现在为假的话。这件事无论检测器怎么演化都该做,而且今天就能做,一行。
• (2) 块级归属 + 唯一性条件 —— 修的是检测器的覆盖面。它需要 [finding] The vendor-version-stamp gate does not cover content/docs, and adding it to ROOTS is measurably insufficient #13981 用过的那套 before/after 双总体扫描、CONTESTED 列归零,是一次带测量的设计变更。
• (3) 接受 —— 是对 (2) 说不,不是对 (1) 说不。

⇒ 本卡 = (1),范围钉死在那一行。⛔ 实施者不得在同一个 PR 里动 check-vendor-version-stamps.mjs 的归属规则。

⚠️ 卡对 (1) 的顾虑「leaves the class; the gate can never regression-test it」是对的且要保留:改完之后这一站点从「未归属」变成「不再是 stamp」,门禁依旧看不见它。⇒ PR 说明里要写明这一点,不许把 (1) 说成把类修好了。

至于 (2) 值不值得做 —— 那需要那套扫描才知道,⛔ 分诊不裁,留作独立卡的素材。

路由

pm:queue · priority:p2 · domain:devx · tooling

• domain:devx:修复落点是 packages/plugins/plugin-auth 的一条测试标题,但这张卡的所属是门禁/供应商戳记这条工具链([finding] The vendor-version-stamp gate does not cover content/docs, and adding it to ROOTS is measurably insufficient #13981 / docs(pm): express the dispatch-gates self-test size as a floor, not a frozen reading #13962 / deps(auth): move the better-auth family 1.7.1 to 1.7.2 in step, and return @better-auth/scim to the family range #13938 同族),ensure-pm-labels.sh 的 devx 面含 gate tooling。
• p2:一句假的安全姿态断言,但无运行时后果、修法一行。

查重

同族 #13981(open,本卡出处)、#13962(上一层同形已修)、#13938(把家族抬到 1.7.2 的那次 bump,已落地)。三者机制各异,⛔ 无重复。

---

Generated by Claude Code

[baozhoutao]

Claim:

• Session: session_01WLJQhde67SeTccsmnBVarV (devx execution seat, seat post [PM seat] domain:devx @ objectstack — 🟢 baozhoutao · R1 · in flight 2/5 · landed 14 PR / 16 cards · queued 1 · awaiting human merge 1 #6023)
• Branch: claude/issue-14020-then-installed-stamp
• Worktree: dedicated per-task worktree off origin/main (dev creates it)
• Domain: domain:devx
• File surface: exactly one test title line in packages/plugins/plugin-auth/src/admin-sso-bridge-gate.test.ts (+ changeset per route). Triage ruled the scope = option (1) only; ⛔ scripts/check-vendor-version-stamps.mjs attribution rules are NOT touched in this PR (option 2 is a separate measured design change, deliberately not merged with this).
• Container & model: mode:subagent, claude-opus-5. Tier readout: "no path-derived mandate … floor sonnet · default opus · ceiling fable." PM judgment: opus (S-size, but the claim discipline in the PR body is the deliverable's other half).
• Clause-②: not engaged.
• Serial constraints: cleared; no queued card shares this file.

---

Generated by Claude Code

[claude]

os-dev-report

{
  "issue": 14020,
  "status": "done",
  "premise_still_valid": true,
  "pr": "https://github.com/objectstack-ai/objectstack/pull/14293",
  "branch": "claude/issue-14020-then-installed-stamp",
  "files_changed": [
    "packages/plugins/plugin-auth/src/admin-sso-bridge-gate.test.ts (1 line: the test title string, nothing else)"
  ],
  "summary": "Premise re-verified on fresh origin/main (a39b02a6b), NOT the shared checkout: package.json pins the better-auth family at ^1.7.2 and pnpm-lock.yaml resolves better-auth@1.7.2, while the title at :271 read 'installed 1.7.1' - a present-tense claim about this tree that is false, not merely stale. Rewrote it to 'then-installed 1.7.1', the scoping vocabulary check-vendor-version-stamps.mjs itself prescribes (HISTORICAL_SCOPE_MARKERS, remedy (b)) and the spelling already used across this package. The rest of the title is byte-identical; no version was restamped and no measurement was redone, so the attestation is unchanged. Triage scope ruling honoured: this is option (1) ONLY - scripts/check-vendor-version-stamps.mjs is not touched, and the PR body states plainly that this rewrites one false sentence into a true one and does NOT repair the class (the site is still unattributed and the detector still cannot judge it). Option (2), block-level attribution with a uniqueness condition, is left as an open design question and NO fix was filed for it. Claim discipline note: the claim comment carrying this session ID and this branch was already on the card from the dispatching seat before any code was written, so no duplicate claim comment was posted.",
  "before_after_stamp_readout": "All readouts from commit 7f4987fe7, detector unmodified. (1) GATE - byte-identical before and after: 'check:vendor-version-stamps: OK - 6053 file(s) scanned. better-auth: 250 version stamp(s); resolved 1.7.2; 138 name(s) a different version, reported and not enforced.' (2) --census - byte-identical before and after (it lists judged sites; this one is unattributed so it never appears there). (3) --list - exactly one line changes and its VERDICT does not: before '[unattributed] .../admin-sso-bridge-gate.test.ts:271 (unattributed)@1.7.1 it(measured vendor posture (installed 1.7.1): ...' / after the same line reading '(then-installed 1.7.1)'. Whole-population verdict counts identical both ways: 250 sites = 2 current + 3 fixture + 138 historical + 107 unattributed. (4) --attribution-sweep - exactly ONE cell moves, and it is the counterfactual legacy mechanism, not the shipped one: 'legacy char-gap 400 : 250 site(s), 173 attributed, 12 contested, 2 failing' becomes '1 failing'; every other row, including all four sentence rows, byte-identical. Probed through the gate's own exports: BEFORE the site was 'FAILING@gap400 admin-sso-bridge-gate.test.ts:271 [live-stale] pkg=better-auth v=1.7.1', AFTER it is absent from the failing set - so the defect was real under any mechanism that can see it, even though the shipped mechanism's counts do not move. The one gap-400 failure that REMAINS is the card's own counter-example, untouched on purpose: 'FAILING@gap400 packages/plugins/plugin-auth/src/auth-manager.ts:3198 [live-stale] pkg=better-auth v=1.6.20 - // That bridge dates from 1.6.20, where @better-auth/sso hardcoded the' (the card cites :3125; the line has moved since). (5) --self-test: 64 checks pass.",
  "checks_run": "Union run on final head 7f4987fe7, working tree clean. Derived families: 'node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack' => 26 families (22 by path + 6 by kind, 2 overlapping), harvested with --commands so no section or spelling was dropped. 25 GREEN. The 26th, 'node scripts/check-test-completeness.mjs', exits 3 = its own NOT MEASURED branch - it needs a saved 'turbo run test' log and states outright it is not a red; recorded as NOT MEASURED, CI supplies the log. Two others exited 3 with PREREQUISITE NOT MET on an unbuilt tree (check:dual-build-cjs-loads, check:type-check-debt); I built the full workspace closure (pnpm exec turbo run build over ./packages/* and ./packages/*/*, 70/70 tasks successful) and re-ran both GREEN - check:type-check-debt --re-measure: '27 ledger entr(ies) re-measured in 264.2s, 1217 raw tsc error(s) total, none above its recorded number'. Dispatch-named extras: 'node scripts/check-ratchet-remedy-authority.mjs' GREEN; check:declared-population-live NOT OWED (no scripts/** path touched). 'pnpm check:nul-bytes' GREEN plus my own control-char scan of the edited file (grep -naP over the C0/DEL classes: no hits). All exit codes captured by redirect-then-capture, never after a pipe; verdicts quoted from each gate's own printed line.",
  "tests": "Worktree off origin/main a39b02a6b; all runs on commit 7f4987fe7; heavy runs serialised through scripts/pm/os-verify-lock.sh (slot issue-14020-dev), verdicts read from its VERDICT lines, never a bare $?. (a) Dependency closure built first: pnpm --filter '@objectstack/plugin-auth^...' build - VERDICT command-exit 0. (b) File-scoped: pnpm --filter @objectstack/plugin-auth exec vitest run --maxWorkers=2 src/admin-sso-bridge-gate.test.ts - 'Test Files 1 passed (1) / Tests 18 passed (18)', VERDICT command-exit 0. (c) The RETITLED test proved to have executed BY NAME via --reporter=verbose: 'PASS src/admin-sso-bridge-gate.test.ts > #9653 the card assertion ... > measured vendor posture (then-installed 1.7.1): an org-less /sso/register admits any authenticated user 19ms'. (d) Whole package: pnpm --filter @objectstack/plugin-auth test - 'Test Files 87 passed (87) / Tests 1803 passed (1803)', VERDICT command-exit 0. (e) pnpm --filter @objectstack/plugin-auth typecheck exits 0, but reported as NOT MEASURED for this file rather than as coverage: 'tsc --listFiles' shows 0 occurrences of admin-sso-bridge-gate.test.ts in that program. plugin-auth is one of the 16 packages whose tests sit outside tsc, already carried in the shrink-only TEST_DEBT ledger that check:type-check-debt reports, so this is a known ledgered condition and not a new finding; vitest is what exercised the file. No ablation was performed and none is claimed: the change is a string literal in a test title with no branch to ablate, and git grep confirms no other file in the repo references this title.",
  "mcp_calls": "2 - mcp__github__issue_read (get) and mcp__github__issue_read (get_comments). Everything written to GitHub (PR create, label POST, both read-backs, this comment) went through the REST channel after a repo-scoped read probe returned HTTP 200, so no MCP quota was spent on writes.",
  "changeset_route": "Route 2 of the Check Changeset step, the one it marks PREFERRED: 'It releases nothing (... tests-only ...) -> apply the skip-changeset label.' The diff is one test-title string and packages/plugins/plugin-auth publishes files: [dist, README.md, CHANGELOG.md], so the test file never ships and no package releases anything. Label applied on PR #14293 via the additive POST issues/14293/labels endpoint, then confirmed by comparative read-back: ['size/xs','tests','skip-changeset'] - the union of the read set and the target is fully present, nothing stripped. Route 3 (empty-frontmatter changeset) is closed and was not taken.",
  "open_questions": [],
  "followups_filed": [],
  "out_of_scope_findings": [],
  "notes": "PR #14293 left as DRAFT and not marked ready, per the work order. PR body read back in full after creation and diffed against the source: byte-identical except that the platform appended a SECOND session-URL footer under mine. That is the documented platform append, not sanitizer damage; deliberately not repaired, because a PATCH edit normalises the session-URL footer down to the bare form and would cost the durable attribution."
}

---

Generated by Claude Code