Found while working #10188 (branch claude/issue-10188-plugin-auth-stale-attestations), whose carrier is packages/plugins/plugin-auth only. Observation-class: nothing is broken today — the underlying claim was re-measured on 2026-08-23 and still holds (see below). Filed unassigned, for the record. Measured, not inferred.
The two sites
Both stamp better-auth 1.6.11 on the same upstream-gap claim that #10188's site 1 carried (the stock /admin/oauth2/update-client endpoint's Zod body schema does not accept disabled):
packages/platform-objects/src/identity/sys-oauth-application.object.ts:49 — // Upstream gap (better-auth 1.6.11): the stock /admin/oauth2/update-client …packages/platform-objects/src/platform-objects.test.ts:185 — // /api/v1/auth (since better-auth 1.6.11's stock admin endpoint … (a comment inside a test; no assertion pins the string)
The claim itself still holds at the installed version
Re-measured 2026-08-23 against the installed @better-auth/oauth-provider@1.7.1 (the package that carries the endpoint at 1.7.x; resolved physically at node_modules/.pnpm/@better-auth+oauth-provider@1.7.1_…): adminUpdateOAuthClient (dist/authorize-Crqw4_bR.mjs:2860) declares its body schema at :2862-2889, and disabled occurs zero times in that block — while occurring 35 times elsewhere in the same file, so the search reaches the text. Only the stamps are stale; the bridge route they justify is still warranted.
Why not fixed in #10188's PR
That card's body scopes its scan to plugin-auth/src, and the dispatch names packages/plugins/plugin-auth as the sole carrier with per-line justification required for anything outside it. packages/platform-objects is a different package with its own gate family, and other lanes may hold claims on it — so these are recorded rather than swept in.
Gate-design note (same as #10188's)
Both sites spell the stamp bare (better-auth 1.6.11, no @), so a comment-vs-pin gate keyed on the better-auth@ spelling would miss them; and they live outside plugin-auth, so a gate scoped to that package would too. Evidence for the "any dependency name adjacent to any version literal, repo-wide" shape #10188 describes.
Backlink: found during #10188.
Generated by Claude Code
Found while working #10188 (branch
claude/issue-10188-plugin-auth-stale-attestations), whose carrier ispackages/plugins/plugin-authonly. Observation-class: nothing is broken today — the underlying claim was re-measured on 2026-08-23 and still holds (see below). Filed unassigned, for the record. Measured, not inferred.The two sites
Both stamp
better-auth 1.6.11on the same upstream-gap claim that #10188's site 1 carried (the stock/admin/oauth2/update-clientendpoint's Zod body schema does not acceptdisabled):packages/platform-objects/src/identity/sys-oauth-application.object.ts:49—// Upstream gap (better-auth 1.6.11): the stock /admin/oauth2/update-client …packages/platform-objects/src/platform-objects.test.ts:185—// /api/v1/auth (since better-auth 1.6.11's stock admin endpoint …(a comment inside a test; no assertion pins the string)The claim itself still holds at the installed version
Re-measured 2026-08-23 against the installed
@better-auth/oauth-provider@1.7.1(the package that carries the endpoint at 1.7.x; resolved physically atnode_modules/.pnpm/@better-auth+oauth-provider@1.7.1_…):adminUpdateOAuthClient(dist/authorize-Crqw4_bR.mjs:2860) declares its body schema at:2862-2889, anddisabledoccurs zero times in that block — while occurring 35 times elsewhere in the same file, so the search reaches the text. Only the stamps are stale; the bridge route they justify is still warranted.Why not fixed in #10188's PR
That card's body scopes its scan to
plugin-auth/src, and the dispatch namespackages/plugins/plugin-authas the sole carrier with per-line justification required for anything outside it.packages/platform-objectsis a different package with its own gate family, and other lanes may hold claims on it — so these are recorded rather than swept in.Gate-design note (same as #10188's)
Both sites spell the stamp bare (
better-auth 1.6.11, no@), so a comment-vs-pin gate keyed on thebetter-auth@spelling would miss them; and they live outsideplugin-auth, so a gate scoped to that package would too. Evidence for the "any dependency name adjacent to any version literal, repo-wide" shape #10188 describes.Backlink: found during #10188.
Generated by Claude Code