fix(hono): mount /auth where the auth service serves, and refuse a prefix it cannot serve under - #16380
fix(hono): mount /auth where the auth service serves, and refuse a prefix it cannot serve under#16380os-litant wants to merge 9 commits into
Conversation
…definition `AuthManager.config` was private and nothing else exposed the base path better-auth is configured with, so an HTTP adapter mounting this service had no way to ask where its routes live. `getBasePath()` answers that, and is now the single definition of the value: `createAuthInstance` hands better-auth exactly this string and `betterAuthEndpointPath` reads the same call. The two sites previously normalised independently and disagreed on a configured value written without a leading slash — `api/v1/auth` reached better-auth verbatim while the route-ownership walk tested `/api/v1/auth`. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01D47qPfEWVPmhguWgBZCi5N
…pp prefix
`createHonoApp` mounted `/auth/*` under its own `prefix` (default `/api`)
while `AuthPlugin` configures better-auth with `basePath: '/api/v1/auth'`, so
on the documented embed the two never intersected. The forwarded request could
only 404, that 404 fell through to the terminal dispatcher catch-all, and the
caller got `200 {}` — measured on a real kernel with AuthPlugin driving
`createHonoApp({ kernel })` with both defaults untouched:
POST /api/auth/sign-in/email (valid shape, wrong password) -> 200 {}
GET /api/auth/get-session -> 200 {}
POST /api/auth/sign-up/email -> 200 {}
A failed sign-in answering `200 {}` reads as success on every call. The same
boot now answers `401 INVALID_EMAIL_OR_PASSWORD` through the same embed, at
`/api/v1/auth/sign-in/email`.
Neither default moves. The mount is derived from the auth service's configured
`basePath`, and a `prefix` that base path is not inside refuses at
construction, naming both values and the fix in either direction. An auth
service that does not expose its base path keeps the previous
`${prefix}/auth` mount.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01D47qPfEWVPmhguWgBZCi5N
…no-auth-mount-basepath
📓 Docs Drift CheckThis PR changes 2 package(s): 12 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:
⛔ 4 release-owned page(s) also name something this change touched. These are read-only:
What this run could not see
Coarse fallback — 11 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): Which tree this was computed onThis run read A worktree cut from an older # while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 8065c4616ae456da91aa446a8abdacd90bc1ce82 && git checkout 8065c4616ae456da91aa446a8abdacd90bc1ce82
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 4177ed3a84194910034206f9bae66f2b15d2c886 06154844ecb27e7967406d7743e0cca80177e029 && git checkout -B drift-repro 4177ed3a84194910034206f9bae66f2b15d2c886 && git merge --no-ff 06154844ecb27e7967406d7743e0cca80177e029
node scripts/docs-audit/affected-docs.mjs --json 4177ed3a84194910034206f9bae66f2b15d2c886
|
github-actions
Bot
added
size/l
documentation
⛔ CI is RED —
|
|
VERDICT: CHANGES REQUIRED Independent adversarial contract review of Clause ② —
|
Contract review ADOPTED — CHANGES REQUIRED, at tier, verbatim. Round 2 dispatched, carrying the review AND the CI failure as one round
✅ Tier verification171 harness-stamped Clause ② —
|
…no-auth-mount-basepath
…ledger
Rule B renamed the adapter's auth mount from `${prefix}/auth/*` to
`${authMount}/*` — the mount is now derived from the auth service's own
`basePath` — and `MOUNTS` in scripts/check-wildcard-fallthrough.mjs still
declared the old spelling. The gate reported both halves of the one fact:
the new pattern NOT DECLARED, the old one DECLARED but not found.
`yields: true` carries over, and it is VERIFIED rather than asserted: the
handler takes `next` and hands it to `yieldUnowned`, which awaits it, and
`callsContinuation` counts that hand-off. Driven, not assumed — with the
two `yieldUnowned(c, next, …)` hand-offs mutated so the continuation is no
longer passed anywhere, the gate turns red on this very entry:
all('`${authMount}/*`') is declared { yields: true } but the handler
never calls its continuation — it is TERMINAL.
1 problem, exit 1, restored by blob hash. `exempt` and `ratchet` would both
have been false here: this mount does not own its namespace and is not
terminal.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01D47qPfEWVPmhguWgBZCi5N
The rule-A refusal named both values and then gave two suggestions, and
each was wrong on a composition inside its own domain:
- For a prefix written without a leading slash (`prefix: 'api/v1'`) it
suggested `new AuthPlugin({ basePath: 'api/v1/auth' })`. That refuses
again: a base path is normalised to start with `/` and `isUnderPrefix`
compares the two as written, so NO base path can sit inside `api/v1`.
The only thing that fixes that composition is the leading slash on the
prefix, and the message never said so.
- For a single-segment base such as `/auth` it suggested `prefix: '/'`.
That constructs, but `/` makes every other route of the app `//…` —
the dispatcher catch-all becomes `'//*'` — which 404s.
`authMountFixes` now builds each suggestion and offers it only when the
same predicate the refusal uses accepts it, and says explicitly when the
prefix itself needs the leading slash.
⛔ Which compositions REFUSE is unchanged. This changes only what the
refusal says about getting out of one.
The pin no longer asserts the message's words. It parses the `Fix —`
clauses back out and re-drives each one through `createHonoApp` at the top:
whatever the refusal tells a caller to do has to produce an app. Five
refusing compositions are covered, including the two the round-1 control
missed (a bare `api/v1` prefix, and a nested mount's inner `/v1`), plus a
single-segment base. The over-refusal control is widened alongside it with
the trailing-slash and root prefixes.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01D47qPfEWVPmhguWgBZCi5N
…s remain Commit f1a3d91 on this branch says two things that are not true, and this branch may not be rewritten, so this commit is the correction and the quotes below are what it corrects. "`getBasePath()` answers that, and is now the single definition of the value" "`AuthManager.config` was private and nothing else exposed the base path better-auth is configured with" What is measured, on the real manager at this commit: 1. FOUR readers of `this.config.basePath` existed in auth-manager.ts, not two. `getBasePath()` collapses two of them. `getAuthIssuer()` (:5810) and `getMcpResourceUrl()` (:5820) still derive their own, each with a different normaliser: basePath '/api/v1/auth/' -> getAuthIssuer() = …/api/v1/auth/ (trailing slash KEPT, while better-auth is now configured without one) basePath 'api/v1/auth' -> getMcpResourceUrl() = http://localhost:3000api/v1/mcp (malformed; pre-existing, unchanged here) They are deliberately NOT collapsed. `getAuthIssuer()` is the OAuth `iss` this AS advertises and `getMcpResourceUrl()` is the RFC 8707 resource identifier a token's `aud` is matched against — both compared by exact string by relying parties, so retiring either copy moves a published identifier. That is a decision, not a tidy-up, and it is reported to the PM rather than taken on a mount card. 2. The value was NOT unreachable before the accessor. `getAuthIssuer()` is public on the merge base (auth-manager.ts:5776) and its URL path IS the configured base path; auth-plugin.ts:3176 already reads a path that way, off `getMcpResourceUrl()`. A dedicated accessor is still the cleaner design — being the only exposure was never the reason for it. 3. The two readers it does collapse disagreed as STRINGS, not as behaviour. Bare better-auth 1.7.2 probe: basePath 'api/v1/auth' and '/api/v1/auth' both route GET /api/v1/auth/get-session -> 200, with an identical ctx.baseURL. The divergence was latent; no input class moved there. The changeset also declares the one re-selected class that was unnamed: a basePath configured WITH a trailing slash now configures better-auth without it, so ctx.baseURL loses the slash and better-auth's URL building (callbacks, magic-link, oauth-proxy) stops emitting a doubled `//`. Measured on the same probe; routing is unchanged, better-call strips trailing slashes itself. Prose only — docblock, changeset and two test headers. No behaviour moves. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01D47qPfEWVPmhguWgBZCi5N
… have none Commit 6e28797 on this branch says, of the rule-A refusal: "a `prefix` that base path is not inside refuses at construction, naming both values and the fix in either direction" The first half holds; the second does not, and history may not be rewritten here, so this commit is the correction and the quote above is what it corrects. A single-segment base path such as `/auth` has NO usable parent prefix: `''` is coerced straight back to `/api` by `options.prefix || '/api'`, and `'/'` makes the dispatcher catch-all `'//*'` and every other route of the app `//…`, which 404s. So for that composition only one direction exists — configuring better-auth under the prefix the caller asked for — and the refusal now offers exactly the directions that construct rather than one per side regardless. The changeset carried the same sentence and is corrected with it. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01D47qPfEWVPmhguWgBZCi5N
…ere filed as The docblock and the changeset both said the surviving `getAuthIssuer()` / `getMcpResourceUrl()` derivations were "reported" without saying where. They are #16399, and a reader of either should be able to get there without asking. Prose only. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01D47qPfEWVPmhguWgBZCi5N
|
VERDICT: CHANGES REQUIRED Independent delta review of 1. C1 —
|
| run | Reconciliation | --commands lines |
check:wildcard-fallthrough in the flat list |
Declared WIDE population |
Artifact rosters |
|---|---|---|---|---|---|
| round-1's 7 paths, explicit | 68 | 68 | absent | 10 — wildcard listed, "walk(join(ROOT, 'packages')) admits every non-test .ts source" | 37 |
head, git-derived, --repo |
87 (73 path + 9 kind + 7 whole-tree, 2 both ways) | 87 | present — "matched via scripts/check-wildcard-fallthrough.mjs ⇢ gate script" | 9 | 37 |
The WIDE block's own text: "their absence from the matched block above is NOT a clearance". The Reconciliation closing line (dispatch-gates.mjs:11038): "The pending-changeset families, the unreachable listing and the always-runs tail below are each OUTSIDE it, each with its own count" — three named, and the self-test at :21222 pins exactly those three. Artifact rosters — 37 and Declared WIDE population — N are printed by the same run under their own headings and are not in that sentence. The card is correct as filed.
4. The nine commit messages. PASS, with two low-severity inaccuracies
All nine read (seven with bodies; the two merges have none). Closing keywords in any subject or body: 0 (close|closes|closed|fix|fixes|fixed|resolve|resolves|resolved + #N); the only #N in any body is #16399 (06154844ecb). ea848f7dd01 quotes both f1a3d91 sentences verbatim (checked against f1a3d91); 38463491893 quotes 6e28797's "the fix in either direction" verbatim (checked). A reader of the squash body sees each false sentence followed by its correction. What remains false is in the tree, not in a message (point 2).
ea848f7dd01: "Prose only — docblock, changeset and two test headers". Its stat is three files: the changeset,auth-manager.ts, and ONE test file (auth-manager-base-path.test.ts— its file header and oneit()comment). Low.06154844ecb: "The docblock and the changeset both said … were 'reported' without saying where". At38463491893only the docblock said "reported to the PM"; the changeset said "is not a tidy-up that belongs on this card" (no "reported"). The correction is right; the quote is not. Low.
5. The two control warnings, and the counts. VERIFIED
check-changeset-no-major.mjs --base 4998efa7177 --event <payload> with this PR's real label set (documentation, size/l, tests, tooling, needs:contract-review) and a body excerpt carrying Clause-②: yes; each mutation asserted on the payload before reading a verdict:
| carriers present | verdict text |
|---|---|
| label + line | ✓ LEVEL AXIS: this PR declares clause-② \yes`, and no package … is graded `patch`` |
| label only (line removed) | ✓ … \yes`—carrier: needs:contract-review IS on this PR/the PR body carries no Clause-②: line` |
| line only (label removed) | ✓ … \yes`` |
| neither | ℹ️ LEVEL AXIS: NOT MEASURED — no clause-② declaration was readable for this PR |
⇒ Confirmed: the label is a carrier on its own (declarationFromPullRequest, :895-908; pinned by the gate's self-test at :1980 — 157 assertions green). Consequence for every Check Changeset verdict in this repo: on any PR carrying needs:contract-review the LEVEL AXIS reads yes whatever the body says, so that green never discriminates the body line, and a body-only negative control is not a control. Clause ② still lands: the mechanical floor is a fact about export *, unchanged in round 2.
Counts: hono-auth-mount-basepath.test.ts at c9dd9d36508 has 14 it( cases (round 2's correction is right; round 1's "22" was wrong); at head 22 (5 + 2 + 5 it.each rows + 4 + 6), package 104 ⇒ pre-existing 82.
6. Also verified. PASS
- F3, driven wider than the pin: a 330-cell grid (15 base paths × 22 prefixes, including
api/v1,custom/,//api,' /api',/api//v1,/api/v1/auth/x, single-segment/x,auth) throughcreateHonoAppwith the pin's ownFix —parser: 275 refusals, 468 Fix clauses, 0 refuse again, 0 unparseable, 0 emptyFix —, and every constructed fix reaches the dispatcher catch-all under its effective prefix (0 "constructs but unusable").authMountFixescannot return empty (direction B is always offered) — read, and held by the grid. - Skills:
git diff --stat c9dd9d36508..HEAD -- skills/is empty.check-skills-token-ratchet: "skills/objectstack-platform/SKILL.md is 12980 tokens (ceiling 12984; headroom 4)", price tag12980 / 12984 (-4), bundle total151038. - Suites at head:
@objectstack/hono104 passed (104), 4 files; plugin-authauth-manager-base-path.test.ts6 passed; verifyauth-base-path-contract.test.ts7 passed(real boot). Wildcard gate--self-test17 cases;eslint --no-inline-configover the 8 changed files exit 0 (the whole-repo 6233-file count was not re-measured). - Typecheck programs: hono's package
tsconfig.jsonlists the test file (1 hit) — that program exits 2 on 3 pre-existing errors insrc/hono.test.ts, which is not in this diff and which no script runs (hono has notypecheck) — observation only. plugin-auth and verify: the test files are intsconfig.test.json(1 hit each), the programcheck:test-typecheckruns — both OK; plugin-auth's shrink-only ledger holds 94 pre-existing errors in 10 files, 0 in the new file.
What I attacked and could NOT break
- The
yieldsdeclaration (three mutations, per-path reading of the handler). - Every
Fix —clause across 330 compositions. - The [finding] dispatch-gates' reconciliation line enumerates what sits OUTSIDE the runnable total and omits two blocks it printed itself — the WIDE-population block and the artifact rosters #16398 derivation claim, on both diffs, in both output forms.
- The four carrier controls and the 14 / 22 / 104 counts.
- The five claim corrections (no sixth instance), the changeset's F4 routing claim (better-call does strip the slash;
token_endpointdoubles//on base and not on head). - Every quoted number: 68, 87 (73+9+7, 2), 37, 10/9, 12980/12984/4, 151038, 104, 6, 7, 0 closing keywords.
Blocking
Point 2. As it stands the diff breaks MCP OAuth token verification for the trailing-slash basePath class it itself declares, and ships a CHANGELOG sentence saying the opposite. Points 1, 3, 5 and 6 pass; point 4 passes with two low-severity misquotes in correction commits.
Worktrees: round 1's review-16380-base was removed; review-16380 was reused at head and is removed with this post.
Generated by Claude Code
Delta review ADOPTED — CHANGES REQUIRED, at tier, verbatim. Round 3 dispatched
✅ Tier verification186 harness-stamped ⛔ The blocking finding: this PR breaks MCP OAuth token verification, and the changeset says the opposite
⇒ On a trailing-slash The changeset sentence — "The OAuth ⭐ Route (b)'s own justification inverts here — and that is the sharpest thing in this reviewRound 2 declined to collapse the two readers because moving
How round 3 is scoped, and why that is not this seat answering a product question
⭐ M3 is worth naming as a pattern: a correction commit that misquotes what it corrects has now happened twice on this branch. Round 3 is told to check its own quotations character by character against ⭐ A verified mechanism reading that changes how this repo's CI should be read
⇒ On any PR carrying that label, a green LEVEL AXIS never discriminates the body line, and a body-only negative control is not a control. Only removing both carriers returns What passedC1
⛔ Carriers stay hung. ⛔ Nothing flipped ready, enqueued or armed — and, Generated by Claude Code |
2 participants
Fixes #16025
Clause-②: yes
06154844ecbskills/objectstack-platform/SKILL.mdis in this PR because the ruling puts it here. This PR is for the maintainer, not the merge queue.Round 2 — what changed since the at-tier review
The contract review of
c9dd9d36508returned CHANGES REQUIRED and was adopted verbatim. CI was red on the same head. Both are addressed here.check:wildcard-fallthroughred — rule B renamed the mount, theMOUNTSledger still declared the old spellingyieldsclaim ablatedgetAuthIssuer()did expose itFix:advice did not work on two compositions⛔ F1 — the "single definition" claim, and where each instance now stands
The claim was false:
getBasePath()collapses two of four readers ofthis.config.basePath. Re-derived myself, not inherited — the reviewer's anchors are exact:Measured on the real manager at this head (
baseURL: 'http://localhost:3000'):Route taken: (b) — correct every sentence, do not collapse the readers. Argued:
getAuthIssuer()is the OAuthissthis AS advertises (and one ofvalidAudiences) andgetMcpResourceUrl()is the RFC 8707 resource identifier a token'saudis matched against. Both are compared by exact string by relying parties, so normalising either re-selects tokens already issued. That is a published-identifier decision with a security blast radius, on a card whose scope is where an HTTP adapter mounts/auth/*— and it would add an OAuth/MCP-metadata verification surface this PR's gate family does not carry. Filed as #16399 instead, and both the docblock and the changeset now point there by number.Every instance of the claim, and what it says now:
f1a3d91message (composes into the squash body)ea848f7dd01, which quotes both false sentences verbatim and states what was measured. Amend/rebase are not available on this branchgetBasePath()docblockauth-manager-base-path.test.tsheader — "the one definition of…"F2 — the justifying sentence
"
configis private and nothing else exposed the value" is false.getAuthIssuer()is public on the merge base (auth-manager.ts:5776, verified withgit show) and its URL path is the configured base path;auth-plugin.ts:3176already reads a path that way (new URL(manager.getMcpResourceUrl()).pathname). The docblock now says the accessor is the cleaner design and that being the only exposure was never the reason for it. Commitea848f7dd01corrects the commit-message instance.F3 — a refusal whose advice constructs
Both suggestions were wrong on a composition inside the refusal's own domain:
prefix: 'api/v1'(no leading slash) was told to configurenew AuthPlugin({ basePath: 'api/v1/auth' }). That refuses again — a base path is normalised to start with/andisUnderPrefixcompares the two as written, so no base path can sit insideapi/v1. The only thing that fixes it is the leading slash on the prefix, which the message never said./authwas toldprefix: '/'. That constructs, but/makes the dispatcher catch-all'//*'and every other route//…— 404 for everything.authMountFixesnow builds each suggestion and offers it only when the same predicate the refusal uses accepts it, and says explicitly when the prefix itself needs the leading slash. ⛔ Which compositions refuse is unchanged — this changes only what the refusal says about getting out of one.The pin no longer asserts the message's words. It parses the
Fix —clauses back out and re-drives each throughcreateHonoAppat the top: whatever the refusal tells a caller to do has to build an app. Five refusing compositions, including the two the round-1 control missed (bareapi/v1; a nested mount's inner/v1) and a single-segment base. Two more cases pin the specific bad advice out (prefix: '/'is never suggested; the refusing basePath is never suggested), and the over-refusal control is widened with'',/,/api/,/api/v1/.F4 — the undeclared class, and F5 — the overstated disagreement
Both re-measured here with a bare better-auth 1.7.2 probe (memory adapter,
baseURL: http://localhost:3000), not inherited:ctx.baseURL, andauth.api.getSession.pathis/get-session— basePath-relative, which is why the ownership walk agreed too. The divergence was latent. The docblock, the changeset and the pin's comment now say so; the earlier "they normalised DIFFERENTLY" framing claimed more than was measured. ⭐ This also corrects the dispatching seat's round-1 report, which said the collapse "changes behaviour for that input class" — it does not.basePathwith a trailing slash now configures better-auth with the stripped form, soctx.baseURLloses the slash and better-auth's URL building (callbacks, magic-link, oauth-proxy) stops emitting a doubled//. Routing is identical — better-call strips trailing slashes itself. Declared in the changeset.F6 — precision
new AuthPlugin({}).options.basePath === '/api/v1/auth', butnew AuthPlugin({ basePath: undefined }).options.basePath === undefined(both measured on this head). So residual 3's "the plugin always supplies the option" holds for an absent key, not an explicitundefined— for that spelling the manager's fallback is live. M1's inertness verdict is correct for the default path that leg ran on, which is the absent-key path.The defect, re-driven on the current tree
200 {}to404. Re-driven at the branch point — a realObjectKernelwithAuthPluginthrough@objectstack/verify'sbootStack, the documented embedcreateHonoApp({ kernel })with both defaults untouched:Triage's prediction is falsified: all three still answer
200 {}. #16265 narrowed the/authdomain's claim to/authand its slash-separated sub-paths, and/auth/sign-in/emailis one of those — so the domain still claims the path, still forwards it to an auth service that does not route it, and the terminal catch-all still renders the resultingResponseasc.json(res, 200). The card's mechanism and its symptom are both unchanged. The at-tier review reproduced all three rows on the merge base independently.Same boot, at the auth service's own base — unreachable through the documented embed before this change:
After
And rule A, on the same boot:
What changed
packages/adapters/hono/src/index.ts— the/auth/*mount is derived from the auth service's configuredbasePath(rule B), read synchronously at construction.resolveAuthMountcarries the ruling, the measurement and the residual.packages/adapters/hono/src/index.ts— aprefixthe base path is not inside refuses at construction (rule A), naming both values and every fix that constructs. Under B the two line up by construction on both defaults, so A fires only where a caller reintroduces the mismatch.packages/plugins/plugin-auth/src/auth-manager.ts—AuthManager.getBasePath()is new and public:createAuthInstancehands better-auth exactly this string andbetterAuthEndpointPathreads the same call. ⛔ It is not the single definition of that value — see F1.scripts/check-wildcard-fallthrough.mjs— theMOUNTSledger follows the mount's rename (round 2, C1).skills/objectstack-platform/SKILL.md— the embed section states the rule. ⛔ Untouched in round 2.⛔ Neither default moves.
prefixstill defaults to/api; the authbasePathstill defaults to/api/v1/auth. Options C and D were rejected in the ruling.${prefix}/auth/*still answers200 {}when it is not the mount. That200is manufactured one layer out —toResponserenders a dispatcherResponseresult asc.json(res, 200). Filed separately as [finding] The hono adapter'stoResponserenders a dispatcher result that is already aResponseasc.json(res, 200)— discarding its real status and body, which is what manufactures the200 {}#16383;HttpDispatcher.dispatchclaims every path whose first segment merely STARTS WITHauth—/authx,/authentication/fooall answer200 {}instead ofROUTE_NOT_FOUND#16026 remains open on it. Nothing here asserts otherwise.getBasePathkeeps the previous${prefix}/authmount and buys no refusal, because nothing in the adapter can tell an aligned custom service from a misaligned one. Same optional-member disciplineownsRoute?already carries; a factory-registeredauthservice lands in the same place.AuthPlugin's constructor default andAuthManager's fallback are two literals of one value. They agree; see F6 for exactly when the fallback is live. Filed as [finding]/api/v1/authis declared as two independent literals — AuthPlugin's constructor default and AuthManager's fallback — and a divergence between them is silent #16384.basePathnormalisers remain onAuthManager. Filed as [finding]AuthManagerstill carries two more independentbasePathnormalisers —getAuthIssuer()andgetMcpResourceUrl()— and one of them builds a malformed URL #16399, with the measurements. See F1 for why they are not collapsed here.Line anchors, re-derived
packages/adapters/hono/src/index.ts:135:135const prefix = options.prefix || '/api';packages/adapters/hono/src/index.ts:97:97theAUTH SERVICE's configured basePath, not from this adapter's prefixcommentpackages/plugins/plugin-auth/src/auth-plugin.ts:327:327basePath: '/api/v1/auth',packages/plugins/plugin-auth/src/auth-manager.ts:1254:1252auth-manager.ts:5810/:5820(round 2):5810getAuthIssuer(),:5820getMcpResourceUrl()Tests
At head
06154844ecb, under the shared verify lock:@objectstack/hono(whole package)plugin-authauth-manager-base-path.test.tsverifyauth-base-path-contract.test.tstypecheck— plugin-auth, verify@objectstack/hono(74 pre-existing, 22 new inhono-auth-mount-basepath.test.ts)". Measured: atc9dd9d36508the package had 96 and that file had 14, so pre-existing was 82, not 74. Round 2 adds 8 cases to it (fiveit.eachrows plus three), giving 22 in the file and 104 in the package. The review's5 of 22/2 of 22ablation denominators inherited the wrong number; the absolute counts it reported (5 failed, 91 passed;2 failed, 94 passed) are unaffected and still sum to 96.tsc --listFileslists all three test files in the program meant to reach them (1 hit each), so none is an excluded-tests false green.Round-2 ablation — the
yieldsdeclaration is verified, not assertedPrediction written before the run: direction RED, exactly 1 problem, the
${authMount}/*site declared{ yields: true }but no longer handing off its continuation.Mutated the side the ledger mirrors (the adapter source, not the ledger): both
yieldUnowned(c, next, …)hand-offs rewritten sonextis passed nowhere. On-disk proof by anchor counts (old spelling 2 → 0, injected 0 → 2) and blob hash (e832356d823→fb78ee8af0b) before reading any result. Observed, exactly as predicted:Restored under
trap … EXIT INT TERMwith absolute paths, proven by blob-hash equality back toe832356d823and an emptygit diff HEADfor that path. ⇒exemptandratchetwould both have been false: the mount neither owns its namespace nor is terminal.Gates
Derived from the actual diff with
node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack, on a tree merged up toorigin/main(the round-1 derivation ran STALE and said so; that is cleared).check:dual-build-cjs-loadsandcheck:type-check-debtboth exit 3 withPREREQUISITE NOT MET— each needs the whole workspace built, which does not fit this container's foreground ceiling. CI builds and runs both.check:wildcard-fallthrough. This block is the round-2 lesson; see the measurement below.check-partof-closing-keywordandcheck-single-claim-pathsprintNOT WIREDin their bare spelling without PR context and pass in theirpnpm check:spelling (both verified);check:react-declaration-parityrefuses withMANIFEST is not setand this diff touches no React block declaration.check-changeset-no-major.mjsLEVEL AXIS driven in the--eventform against a payload carrying this PR's labels and itsClause-②:line:✓ LEVEL AXIS: this PR declares clause-② yes, and no package whose packages/*/src/** it moves is graded patch.yes—needs:contract-reviewis itself a carrier (the gate's own self-test pins this). A control that removes both carriers returnsℹ️ LEVEL AXIS: NOT MEASURED, so the green is discriminating. My first control mutated nothing at all (asedpattern that matched no bytes) and returned a clean green; caught by asserting the mutation, not by reading the verdict.pnpm exec eslint . --no-inline-config— whole-repo, run in full rather than narrowed: 6233 files, 0 errors, 0 warnings, exit 0. File count read from--format json.skills/objectstack-platform/SKILL.mduntouched in round 2 (git diff HEAD -- skills/empty). Reading unchanged at 12980 tokens against ceiling 12984 (headroom 4); bundle total 151038. ⛔ Ceiling untouched.⭐ The measurement the review asked for: is
check:wildcard-fallthroughin the derived family list?On round 1's diff: no — and that is by design, not a bug in the derivation.
The family was printed by the very same run, under a heading that is deliberately outside the runnable total:
So the derivation named it, in a block whose own text says the block is not a clearance. What failed was the harvest: round 1 ran the 68 and the 37 artifact rosters and never ran that block.
⇒ The coverage gap is real but narrower than hypothesised, and it is mechanical. The Reconciliation block's closing sentence — the one that tells a harvester what its total does not cover — enumerates three outside blocks and omits two that the same run prints with their own counts:
Artifact rosters(37) andDeclared WIDE population(9) are not in that list. The rosters block is saved today only by seats hand-carrying the instruction in their dispatch briefs. Filed as #16398 with both runs.(On round 2's diff the family moves into the matched 87, because the diff now edits the gate script itself — so the WIDE block reads 9. Both readings are in #16398.)