[finding] Three more stale version-stamped attestations in plugin-auth sit outside #10073's two-string scope — a `better-auth@`-only comment-vs-pin gate would still miss two of them

[os-warren]

Found while sweeping #10073 (PR #10187). Observation-class: nothing is broken today — all three claims below are still factually correct against the installed packages, which I measured. The point is the same one #10073 makes: their wording asserts a version that is no longer installed. Filed unassigned, no pm:queue, for the record. Measured, not inferred.

Why these were not swept in PR #10187

#10073 scopes its sweep by two literal strings — 1.7.0-rc.2 and 1.6.20. That scope is what made the card tractable, and PR #10187 stayed inside it. But the class the card describes ("anywhere a comment says 'verified against X', the pinned version drifting past X should be treated as an unverified claim") is not bounded by those two strings, and a scan for any version-shaped token in plugin-auth/src turns up three more sites in the same state.

Measured — installed versions read from node_modules on 2026-08-20

better-auth@1.7.1, @better-auth/oauth-provider@1.7.1, better-call@1.4.0.

1. auth-plugin.ts:1732 — stamped 1.6.11, five minors behind

// sys_oauth_application): better-auth 1.6.11's stock admin update
// endpoint (`/admin/oauth2/update-client`) does NOT accept `disabled`
// in its Zod body schema, so the field gets silently stripped

This is a live claim about the current vendor, and it is the stated warrant for a whole custom route. Its closing paragraph is an explicit retirement trigger: "When upstream adds disabled to adminUpdateOAuthClient's schema, this route can be deleted." So an unverified stamp here is load-bearing in a way the #10073 sites were not — it gates whether a route is dead code.

Re-measured, and it still holds: at @better-auth/oauth-provider@1.7.1, adminUpdateOAuthClient (dist/authorize-Crqw4_bR.mjs:2860) declares its body schema at :2862-2896, and disabled occurs zero times in that block. Counter-check: disabled occurs 35 times in the same file, so the search reaches the text. The custom route is still warranted; only the stamp is stale.

2 & 3. auth-manager.ts:904 and auth-manager.test.ts:1805 — stamped better-call@1.3.7, installed is 1.4.0

Both carry line anchors into the vendor (dist/utils.mjs:57, consumed at dist/router.mjs:93). Line anchors are exactly the kind of claim that decays silently across a minor bump — PR #10187 found two sites whose anchors had drifted by 5-8 lines while the surrounding prose stayed true.

These were not re-measured here (out of scope for this observation; they need the better-call surface read the way #10187 read better-auth's).

Why this matters for the gate #10073 proposes

#10073 suggests, as a separate card, "a check that every better-auth@ mention in a comment matches the current package.json pin". Worth noting before that gets built: such a gate scoped to better-auth@ would catch site 1 only if it also recognises the bare better-auth 1.6.11 spelling (no @), and would not catch sites 2 and 3 at all, because better-call is a different dependency family. The generalizable shape is any dependency name adjacent to any version literal, checked against that dependency's resolved version — not a better-auth special case.

Not fixed in PR #10187

Out of that card's scope and surface, deliberately. Site 1 in particular is not a mechanical re-stamp: if upstream had added disabled, the correct action would have been deleting a route, which is a behavioural change far outside "comment attestations". It failed the in-place-fix test on that ground and is recorded here instead.

Backlink: found during #10073 / PR #10187.

---

Generated by Claude Code

[os-sam]

Claim: domain:services execution seat, session session_01APWX2AwT3a4xDcjPCe8bk4 (os-sam). Branch claude/issue-10188-plugin-auth-stale-attestations. R6 batch.

pm:queue → pm:dispatched + assigned in one write, before this comment. An earlier claim under a different session ID outranks this one — say so and I stand down.

Decision re-read done — and the result is worth stating, because it is an absence. ⚠️ This card carries zero comments: no triage grading comment, no prior claim, no ruling. Its pm:queue + domain:services labels were applied without an accompanying comment.

I am dispatching on the strength of the label (pm:queue is the authoritative queue state, and this seat does not re-grade another producer's labels) plus the card body being self-scoping. But I am recording the absence rather than pretending a ruling exists, and the dispatch carries a matching stop condition: if the work turns out to be larger or more design-shaped than the body describes, it stops and comes back for grading rather than being decided by the implementer.

Clause-②: no — on my reading, a comment/attestation accuracy repair changes no accept/reject behaviour and widens no public surface. ⚠️ If the fix turns out to require a gate change (the body contemplates a better-auth@-only comment-vs-pin gate that would still miss two of the three), that is a different shape and I will re-grade — the dev is instructed to stop rather than expand into it.

Carrier: packages/plugins/plugin-auth. ⛔ packages/spec has zero ownership in this lane.

Sequencing note: plugin-auth was locked behind PR #11211 until it merged at 13:02Z today, and that PR changed the package. Line numbers in the card body predate it — re-derive on the current base.

⚠️ Concurrency note for other seats: this lane currently also holds #11089 (last-admin-guard.ts comment) and #10792 (measurement-only, no product edits) in plugin-auth. Each dispatch declares its exact files; if you are working this package, say so on your card so we can keep the file surfaces disjoint.

---

Generated by Claude Code

[os-sam]

R6 的 dev 已消失,工作已推送且保留;R7 接力完成它,⛔ 不从零重做

盘在飞项时按一手数据核出来的:R6 派出的 dev 已不在运行(实测当前仅 4 个子 agent 存活,均为 R7 本轮所派),而卡自 5386331760 起再无任何报告、无 PR。⇒ 这是一条死认领。

本席的认领依旧有效(同一 session session_01APWX2AwT3a4xDcjPCe8bk4),所以不重新认领,只登记接力。

⭐ 分支上有真实产出,先读它

claude/issue-10188-plugin-auth-stale-attestations @ 04323949c1 —— 一个提交,docs(plugin-auth): re-measure the three version-stamped attestations outside #10073's two-string scope,基线 d39569239b:

packages/plugins/plugin-auth/src/auth-manager.test.ts | 5 +++--
packages/plugins/plugin-auth/src/auth-manager.ts | 5 +++--
packages/plugins/plugin-auth/src/auth-plugin.ts | 18 ++++++++++++------

正是卡面点名的三处,零外溢。 文件面守住了。三条戳都重新测量并加了日期,而且保留了反向对照(「disabled 在该块内 0 次,而在同文件其他处 35 次,所以搜索确实够到了文本」)—— 那正是零命中该有的证明形状,不是断言。

⚠️ 一处与卡面不一致,是重新测量的结果,不要当笔误改回去

卡面写 schema 块在 :2862-2896;新注释写 :2862-2889。dev 是在当前安装的 @better-auth/oauth-provider@1.7.1 上重测的,读数不同属正常(卡面读数来自 2026-08-20)。⇒ 以重测为准,但接力者应当自己再核一次并说明,而不是继承任何一方。

缺的三样(这就是接力的全部工作)

1. changeset —— plugin-auth 是发布包,注释改动也要么带 changeset、要么 skip-changeset 并说明理由。分支上没有。
2. PR —— 从未开过。
3. 门禁核验 —— 未见任何 gate union 运行记录。

定级不变

Clause-② no —— 注释/attestation 的准确性修复,不动 accept/reject,不扩公开面。⚠️ 原派发的停手条件继续有效:若发现必须改门禁(卡面设想的 better-auth@ comment-vs-pin gate,它自己指出会漏掉三处中的两处),那是另一种形状 —— 停下上报,不要扩进去。

⚠️ 并发提示:plugin-auth 是单一热面,不并发。本轮 #10792 也在这个包里,但它是仅测量、零产品编辑,文件面不冲突。

---

Generated by Claude Code

[os-sam]

os-dev-report

{
 "issue": 10188,
 "status": "done",
 "branch": "claude/issue-10188-plugin-auth-stale-attestations",
 "pr": "https://github.com/objectstack-ai/objectstack/pull/11446",
 "premise_still_valid": true,
 "summary": "R7 relay: finished the inherited commit rather than redoing it. Merged current main (base d39569239b -> merge d8fae0f40e on 8519095308; the merge brought #11089's last-admin-guard.ts change into the branch, outside my file surface), then re-measured all three attestations MYSELF against the packages installed on the current base — inheriting neither the card's readings nor the previous dev's. Site 1 (@better-auth/oauth-provider@1.7.1): adminUpdateOAuthClient at dist/authorize-Crqw4_bR.mjs:2860, body schema at :2862-2889, 'disabled' zero times in that block. This RESOLVES the card-vs-comment discrepancy in favour of the pushed comment: :2862-2889 is the body z.object; the card's :2896 is the closing '});' of the whole createAuthEndpoint call, which includes the metadata block and handler and is therefore not the schema. Sites 2-3 (better-call@1.4.0), which the card explicitly did NOT re-measure and the pushed commit claimed to: independently CONFIRMED — isAPIError declared at dist/utils.mjs:55 with the quoted expression at :56 (so :55-56 holds), consumed in the router catch at dist/router.mjs:92, console.error + 500/null-body branch at :93-97. ATTESTATION 1 IS TRUE, NOT FALSE — upstream has NOT added 'disabled', so no route is deleted and no stop condition fires; verified past the single block (the non-admin /oauth2/update-client at :2897-2925 rejects it too; CIMD_FORBIDDEN_SERVER_FIELD_NAMES at :1117-1118 explicitly forbids it; the one 'disabled: z.boolean().optional()' at :3371 belongs to resourceBodySchema, i.e. OAuth resources, a different model; the handler sources it from the stored record at :1972, never from the body). My ONE new commit (a3f1ad79f2) is a precision fix to the inherited reverse control, which I kept and strengthened rather than weakened: '35 times' is really 35 LINES matching 'disabled' (grep -c) — occurrences are 38 whole-word / 42 substring — so the control now names the measurement it reports and is reproducible. Changeset call made explicitly: skip-changeset, applied via the additive POST and confirmed by read-back (labels: size/s, tests, skip-changeset). Reason: all three sites are comments that never reach the published artifact — a // comment in a class method body, a JSDoc on module-local non-exported smsQuotaExceededApiError (so it is in no dist/*.d.ts), and a test file that is not published at all; a version bump would announce a release consumers cannot observe. No gate was built or changed — the generalizable dependency-name-adjacent-to-version-literal gate stays a separate card, per the card's own stop condition.",
 "tests": "All runs at a3f1ad79f2 (= final commit = remote head; tree clean), heavy work serialized through scripts/pm/os-verify-lock.sh, exit codes captured before any pipe. Union derived by `node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack` with NO hand-supplied paths — the script took the change set from git itself ('3 path(s) vs merge base 851909530'), and its stderr confirmed the answer is about objectstack-ai/objectstack at commit a3f1ad79f2. All 9 path-matched families + all 6 convention-triggered ones ran to a real verdict, each exit 0, quoting each gate's own verdict line: check:auth-mount-ledger ('17 rawApp mount(s) ... accounting is EXACT on `METHOD path`'); check:published-files ('✓ ... 69 publishable package(s) of 78'); check:route-envelope ('✓ Route-envelope conformance — 10 route module(s) audited: 7 conformant, 2 ratcheted, 1 exempt'); check:slot-lookup ('✓ slot-lookup ratchet holds ... none new'); check:test-source-alias ('check-test-source-alias OK — 72 packages with tests scanned'); check:type-source-resolution ('OK — 77 packages with a tsconfig.json scanned'); check-ci-filter-parity.mjs ('OK: all 88 declared cross-package glob(s)'); check-plugin-teardown-shape.mjs ('✓ ... 63 Plugin implementation(s) across 4536 source(s)'); docs-audit/check-affected-docs.mjs ('✓ affected-docs self-test: 339 cases pass.'); check:query-options-erasure ('✓ ratchet holds ... none new'); check:type-check-coverage ('OK — 65/78 workspace packages type-checked'); check:engine-double-contract ('OK — 386 pinned, 133 in the DEBT ledger, 2 exempt'); check:cross-package-test-inputs ('OK: 14 package(s) read outside themselves, all declared'); check:where-matcher ('✓ ... 285 matcher(s) ... 0 silently-wrong'). check:type-check-debt FIRST REFUSED — '--re-measure cannot run: 30 workspace dependenc(ies) ... have no built type entry point on disk' — which is NOT MEASURED and is not reported as a pass; I built the closure exactly as lint.yml does (`turbo run build --filter='./packages/*' --filter='./packages/*/*'` -> '70 successful, 70 total') and re-ran it to the real verdict: 'check-type-check-coverage --re-measure: OK — 33 ledger entr(ies) re-measured in 388.8s, 1897 raw tsc error(s) total, none above its recorded number.' Package verification after building the dependency closure: `pnpm --filter @objectstack/plugin-auth typecheck` exit 0 (both tsc programs, no diagnostics) and `pnpm --filter @objectstack/plugin-auth test` exit 0 — 'Test Files 70 passed (70) / Tests 1455 passed (1455)'. LINT IS A DECLARED NARROWING, NOT A PASS: repo-wide `pnpm lint` was attempted TWICE under the verify lock and never acquired it — both 'VERDICT queue-timeout (exit 99) · never acquired · waited 540s (9m00s)' (holders: another agent's service-settings build, then issue-10753's hold script at 543s) — so it is NOT MEASURED. In its place the narrowed run carries all three required evidences: (1) population read from ESLint's own config — `pnpm lint` is `eslint . --no-inline-config` over the single root eslint.config.mjs, and all three changed files return real result objects rather than an ignored-by-pattern warning, so they sit inside that population; (2) count read from --format json: 3 files linted, 0 errors, 0 warnings; (3) invariance for untouched files — eslint.config.mjs:326-329 states this repo 'runs one eslint.config.mjs, which never enables type-aware linting (no parserOptions.project, no typed @typescript-eslint rules) for ANY file', carrying its own positive control, so a comment-only edit in three files cannot move a verdict on any file it does not touch. Concurrency check done rather than assumed: #10792's worktree holds ZERO commits and one untracked file under packages/verify/ — measurement-only, no plugin-auth product edits, so the file surfaces stay disjoint.",
 "open_questions": [],
 "out_of_scope_findings": [
 "NOT filed — already tracked by open #10615 (`plugin-auth` TEST_DEBT records 109 where tsc reports fewer): my run today measures the surplus at 12, not the 11 that card records, so the gap has widened by one since it was filed. Searched before filing; a second card would duplicate it.",
 "NOT filed — already tracked by open #11204: `@objectstack/trigger-record-change` TEST_DEBT records 9 while tsc now reports 0 (graduation candidate). Reported by check:type-check-debt on my run, matching that card exactly.",
 "Not filed, standing and self-declared: check:route-envelope prints two #9559 ratchet rows for packages/rest (query-allowlist.ts, query-multiplicity.ts), each already carrying its tracking issue in the gate output."
 ]
}

---

Generated by Claude Code

---

Generated by Claude Code