diff --git a/packages/qa/dogfood/test/authz-conformance.test.ts b/packages/qa/dogfood/test/authz-conformance.test.ts index 6bdea819fc..41e9467b24 100644 --- a/packages/qa/dogfood/test/authz-conformance.test.ts +++ b/packages/qa/dogfood/test/authz-conformance.test.ts @@ -162,11 +162,24 @@ const PROBES: readonly Probe[] = [ // never authorization: `sdk` / `server-only` / `public` / `gap` / `mismatch` // say nothing about whether a caller is authenticated. Deriving "gated" from // source syntax instead was measured and rejected — scanning all 80 - // `this.routeManager.register(` sites in `rest-server.ts` for `enforceAuth` - // reads 50/30 and 22 of the 30 ungated are FALSE (a wrapping - // `guardedRouteManager` for 19 of them, a shared handler const for 3), a 73% - // false-ungated rate on the largest registrar. What these two probes supply - // is the POPULATION; the classification stays a reviewed row. + // registration sites in `rest-server.ts` for `enforceAuth` (TWO spellings: 72 + // direct `this.routeManager.register(` sites plus 8 `registerPerItemRoute(` + // calls through the per-item family's switch-carrying helper) reads 51/29 and + // 22 of the 29 ungated are FALSE (a wrapping `guardedRouteManager` for 19 of + // them, a shared handler const for 3), a 76% false-ungated rate concentrated + // on the largest registrar. + // + // ⚠️ RE-MEASURED 2026-09-08. The 22 = 19 + 3 decomposition did NOT move when + // the per-item helper landed — the same 19 routes, 11 still direct and 8 now + // helper-routed through the same wrapping registrar — and the population + // stayed 80. Only the headline split moved, earlier and unrelatedly: 50/30 + // became 51/29 when `registerUiEndpoints`, the one route in that file + // resolving no identity, was guarded. Recorded so the next reader does not + // re-derive a figure that has now been checked; the full reading lives in + // `authz-probe-blind-spot.census.ts`, the authority on this population. + // + // What these two probes supply is the POPULATION; the classification stays a + // reviewed row. { kind: 'ROUTE_ENUMERATION', file: 'packages/rest/src/rest-route-ledger.ts', diff --git a/packages/qa/dogfood/test/authz-probe-blind-spot.census.ts b/packages/qa/dogfood/test/authz-probe-blind-spot.census.ts index a53ff3b722..540e4a9a14 100644 --- a/packages/qa/dogfood/test/authz-probe-blind-spot.census.ts +++ b/packages/qa/dogfood/test/authz-probe-blind-spot.census.ts @@ -136,16 +136,43 @@ // built as one. // // 2. DERIVING "gated" FROM SOURCE SYNTAX IS UNSAFE — measured, not assumed. -// Scanning each of the 80 `this.routeManager.register(` call sites in -// `rest-server.ts` for `enforceAuth` reads 50 gated / 30 ungated, and 22 of -// those 30 are FALSE, in two structural shapes: `registerMetadataEndpoints` +// Scanning each of the 80 registration sites in `rest-server.ts` for +// `enforceAuth` — the SAME two spellings the `populationRule` below counts, +// 72 direct `this.routeManager.register(` call sites plus 8 +// `registerPerItemRoute(` calls — reads 51 gated / 29 ungated, and 22 of +// those 29 are FALSE, in two structural shapes: `registerMetadataEndpoints` // installs a wrapping `guardedRouteManager` so its 19 inner routes are // gated with no `enforceAuth` at the call site, and // `registerSecurityExplainEndpoints` shares one `handler` const declared -// outside its 3 `register(` calls. A 73% false-ungated rate, concentrated +// outside its 3 `register(` calls. A 76% false-ungated rate, concentrated // on the largest registrar, and hand-annotating the exceptions is the same // rot this instrument already has. // +// ⚠️ RE-MEASURED 2026-09-08 against `5abca1792e`, because the 19 is a count +// inside the very registrar the per-item helper re-spelled, and because +// this paragraph attributed all 80 sites to the direct spelling alone +// while `:82` above already knew there were two — the authority on this +// population contradicting itself 57 lines apart. +// +// WHAT DID NOT MOVE: 22 = 19 + 3. The same 19 routes, 11 still direct and +// 8 now helper-routed, all through the same wrapping; the same 3 sharing +// one handler const; the population still 80. The re-spelling moved none +// of the five figures. +// +// WHAT DID MOVE, and not here: 50 gated / 30 ungated became 51 / 29 when +// `registerUiEndpoints` — the one route in this file that resolved no +// identity, the same repair recorded as `enforceAuth` 61 -> 64 on the +// rest-server.ts row below — was guarded. That landed the day AFTER this +// paragraph was first written and hours BEFORE it was copied into +// `rest-route-ledger.ts`, `route-ledger.ts` and `authz-conformance.test.ts`, +// which is why four sites carried 50/30 in step. ⛔ Written down as a +// checked figure rather than left as one nobody dared touch: the two read +// identically on the page, and only this note tells them apart. +// +// ⛔ The rejection stands whatever the numbers do, and the second spelling +// strengthens it: a naive scanner now has to know both spellings before it +// can read the file even this badly. +// // 3. A LEDGER IS A DERIVED DATA FILE, ONE GUARDED STEP BEHIND THE SOURCE. // Adding a route to a registrar in `rest-server.ts` does not touch // `rest-route-ledger.ts`, so a ledger-sourced population mints no new key @@ -184,7 +211,7 @@ // point, where a new route is already being read. // // ⛔ Two readings stay REJECTED and are recorded here so they are not -// re-proposed: deriving "gated" from source syntax (73% false-ungated), and +// re-proposed: deriving "gated" from source syntax (76% false-ungated), and // taking a ledger disposition as an authorization fact (blocker 1). import { readFileSync } from 'node:fs'; diff --git a/packages/rest/src/rest-route-ledger.ts b/packages/rest/src/rest-route-ledger.ts index 319c58aca1..0df49cbebc 100644 --- a/packages/rest/src/rest-route-ledger.ts +++ b/packages/rest/src/rest-route-ledger.ts @@ -109,15 +109,30 @@ export interface RestRouteLedgerEntry { * SDK expressibility; none of them says whether a caller must be * authenticated, and `public` states INTENT for a handful of browser-facing * routes rather than measuring a gate. Deriving the answer from source - * syntax instead was measured and rejected: scanning all 80 - * `this.routeManager.register(` sites in `rest-server.ts` for `enforceAuth` - * reads 50 gated / 30 ungated, and 22 of those 30 are FALSE — a wrapping - * `guardedRouteManager` gates 19 of them with no `enforceAuth` at the call - * site, and one registrar shares a handler const across its 3 mounts. A 73% - * false-ungated rate on the largest registrar is a written-down false - * assurance, which is strictly worse than an honest blank. So the posture is - * DECLARED at the producer, where a new route is already reviewed, instead of - * guessed at the consumer. + * syntax instead was measured and rejected: scanning all 80 registration + * sites in `rest-server.ts` for `enforceAuth` — TWO spellings, 72 direct + * `this.routeManager.register(` sites plus 8 `registerPerItemRoute(` calls + * through the per-item family's switch-carrying helper — reads 51 gated / 29 + * ungated, and 22 of those 29 are FALSE: a wrapping `guardedRouteManager` + * gates 19 of them with no `enforceAuth` at the call site, and one registrar + * shares a handler const across its 3 mounts. A 76% false-ungated rate, + * concentrated on the largest registrar, is a written-down false assurance, + * which is strictly worse than an honest blank. So the posture is DECLARED at + * the producer, where a new route is already reviewed, instead of guessed at + * the consumer. + * + * ⚠️ RE-MEASURED 2026-09-08, and the two halves moved differently. The + * 22 = 19 + 3 decomposition did NOT move when the per-item helper landed — + * the same 19 routes, 11 still direct and 8 now helper-routed, all through + * the same wrapping registrar — and the population stayed 80. Only the + * headline split moved, earlier and for an unrelated reason: 50/30 became + * 51/29 when `registerUiEndpoints`, the one route in that file resolving no + * identity, was guarded. Recorded so the next reader does not re-derive a + * figure that has now been checked. ⛔ The rejection stands either way, and + * the second spelling strengthens it — a syntactic scanner has to know both + * before it can read the file even this badly. The full reading lives in + * `packages/qa/dogfood/test/authz-probe-blind-spot.census.ts`, the + * authority on this population. * * ABSENT MEANS "UNDECLARED", and that is the state of nearly the whole * surface. This field is filled INCREMENTALLY, exactly like `responseSchema` diff --git a/packages/runtime/src/route-ledger.ts b/packages/runtime/src/route-ledger.ts index 5bb59dee73..a166eb9371 100644 --- a/packages/runtime/src/route-ledger.ts +++ b/packages/runtime/src/route-ledger.ts @@ -157,15 +157,30 @@ export interface RouteLedgerEntry { * SDK expressibility; none of them says whether a caller must be * authenticated, and `public` states INTENT for a handful of browser-facing * routes rather than measuring a gate. Deriving the answer from source - * syntax instead was measured and rejected: scanning all 80 - * `this.routeManager.register(` sites in `rest-server.ts` for `enforceAuth` - * reads 50 gated / 30 ungated, and 22 of those 30 are FALSE — a wrapping - * `guardedRouteManager` gates 19 of them with no `enforceAuth` at the call - * site, and one registrar shares a handler const across its 3 mounts. A 73% - * false-ungated rate on the largest registrar is a written-down false - * assurance, which is strictly worse than an honest blank. So the posture is - * DECLARED at the producer, where a new route is already reviewed, instead of - * guessed at the consumer. + * syntax instead was measured and rejected: scanning all 80 registration + * sites in `rest-server.ts` for `enforceAuth` — TWO spellings, 72 direct + * `this.routeManager.register(` sites plus 8 `registerPerItemRoute(` calls + * through the per-item family's switch-carrying helper — reads 51 gated / 29 + * ungated, and 22 of those 29 are FALSE: a wrapping `guardedRouteManager` + * gates 19 of them with no `enforceAuth` at the call site, and one registrar + * shares a handler const across its 3 mounts. A 76% false-ungated rate, + * concentrated on the largest registrar, is a written-down false assurance, + * which is strictly worse than an honest blank. So the posture is DECLARED at + * the producer, where a new route is already reviewed, instead of guessed at + * the consumer. + * + * ⚠️ RE-MEASURED 2026-09-08, and the two halves moved differently. The + * 22 = 19 + 3 decomposition did NOT move when the per-item helper landed — + * the same 19 routes, 11 still direct and 8 now helper-routed, all through + * the same wrapping registrar — and the population stayed 80. Only the + * headline split moved, earlier and for an unrelated reason: 50/30 became + * 51/29 when `registerUiEndpoints`, the one route in that file resolving no + * identity, was guarded. Recorded so the next reader does not re-derive a + * figure that has now been checked. ⛔ The rejection stands either way, and + * the second spelling strengthens it — a syntactic scanner has to know both + * before it can read the file even this badly. The full reading lives in + * `packages/qa/dogfood/test/authz-probe-blind-spot.census.ts`, the + * authority on this population. * * ABSENT MEANS "UNDECLARED", and that is the state of nearly the whole * surface. This field is filled INCREMENTALLY, exactly like `responseSchema`