Retire `sys_scim_provider` — consumer sweep first, no data migration (leg 1a of #11632, ruled on #11693)

[os-sam]

Cut out of the #11632 SCIM epic by its owning domain:services seat, on the maintainer's ruling at #11693 (5396402751). The epic's scope item 1 called this "decided INSIDE this epic"; it is now decided, so this is the implementation leg.

The ruling

Maintainer, 2026-08-24, live PM chat, verbatim: 「11700 11693 不需要考虑历史数据，其他按照你的建议继续」

Ruled: A — retire sys_scim_provider, with the explicit amendment that historical/existing data is not a consideration.

Two consequences, both load-bearing for whoever takes this:

1. ⛔ No data-migration path is owed for existing sys_scim_provider rows. Do not write one. Do not add a backfill, a reaper, or a "migrate your providers" command.
2. ⭐ The census-first gate is struck as a blocker, but the consumer sweep is not optional — it moved. It is step 1 of this implementation, as normal retirement discipline, not a separate measurement card that must land first.

Why the disposition went this way

PR #11429 (merged, fixes #11380) repaired the SCIM parity gate so it reaches its model diff on the stable line. Its output against published @better-auth/scim@1.7.1 includes:

expected [ 'user', 'session', 'account', …(9) ] to include 'scimProvider'

⭐ The upstream scimProvider model does not exist on stable. So there is nothing left to mirror — B (facade) would have been a brand-new mapping for a table ruled disposable, and C (managed-catalog adoption) bundles a managedConnections posture decision nobody has asked for.

⇒ Note for leg scoping generally: managedConnections is not adopted. The stable surface is the seven models, not ten.

Step 1 — the consumer sweep, as retirement discipline

Find every reader of the platform object, repair or delete each with evidence, and pin the absence so it cannot come back.

⭐ Pin identities, not counts — a sweep that reports "0 readers remain" without naming what it found and what it did to each is not a sweep. And ⚠️ a zero-hit needs a positive control first: prove the search instrument finds a known reader of some other platform object before concluding this one has none.

⚠️ The census the ruling struck was struck as a blocker on the decision, not as work. "Is any shipped deployment relying on it" is answered by fiat. "What in this repo reads it" is still yours to measure and repair.

Fences

• ⛔ Zero packages/spec ownership in this lane. If retirement needs a spec edit, that is the spec seat's — name it and stop.
• ⛔ Never edit content/docs/releases/ — your release-notes input is the changeset.
• ⚠️ Clause-② is likely YES and must be assessed against the tree at claim time, not inherited from this line: retiring a platform object can remove an authorable/queryable surface. Re-read CONTRACT_REVIEW_TIER live at scripts/pm/dispatch-gates.mjs rather than recalling it.
• ⚠️ ADR-0087 registration applies if this is a declared-breaking removal — check the gate's own verdict, do not assume either way.

Not measured

• Which in-repo readers exist. That is step 1 of this card, deliberately not pre-measured here so the implementer does it with a live instrument rather than inheriting a stale list.
• Whether any objectui or cloud surface reads it. Out of this repo's reach — name it if the sweep suggests one, do not guess at it.

Sequencing inside #11632

• SCIM spec parity: field-level pass between SCIMGroupSchema and stable @better-auth/scim's group wire shape (leg 3 of #11632) #11697 (spec parity, domain:spec) is FIRST in the epic's chain and does not block this — different object, different seat.
• This leg unblocks the Setup surface leg, whose backend seam was scoped by exactly this disposition.
• ⚠️ Riding the same migration and NOT a dev card: every SCIM-enabled deployment's IdP must reissue its token on migration day (unsalted SHA-256 → keyed HMAC; digests are not portable on any path). Scheduled operational action, human owner.

Refs: #11632 (epic) · #11693 (the ruled disposition) · #3653 (decision anchor + seven-model measurements) · #11380 / PR #11429 (the gate repair that produced the diff) · ADR-0071

[os-sam]

Claim + dispatch

• Session: session_01APWX2AwT3a4xDcjPCe8bk4 (os-sam, domain:services execution seat)
• Branch: claude/issue-11757-retire-sys-scim-provider
• Worktree: ../objectstack-11757 (per-repo; ⛔ never the shared checkout; ⛔ never git stash)
• Container & model: claude-opus-5 — the measured quota exemption from earlier this shift stands (a dev terminated at ~11:50Z on You've reached your Fable 5 limit; fable unavailable ⇒ opus, never lower).
• pm:queue → pm:dispatched, needs:contract-review added — see below.

Clause-② — this seat's call: YES, and I am adding the label rather than leaving it to be discovered

Retiring a platform object removes a queryable/authorable surface. That is the clause-② content limb, and the gate's own text — re-read live this round at scripts/pm/dispatch-gates.mjs — is unambiguous that paths do not reach it and cannot clear it:

Clause ② is NOT reachable from paths: a card that changes contract accept/reject behaviour or widens the public surface is fable-mandatory too, judged from the card CONTENT. This line is a FLOOR, never a clearance.

⚠️ A removal is the mirror of a widening and I am treating it as in-scope rather than arguing the wording narrowly — the direction that would be embarrassing here is under-applying the control on an object deletion. CONTRACT_REVIEW_TIER read live in the same pass: claude-fable-5; this seat is below it. So on this card I will not clear the label, not flip the PR ready, and not arm auto-merge.

⚠️ ADR-0087 registration may also apply if the removal grades as declared-breaking. That is the gate's verdict to give, not mine to assume in either direction — the dev reports its own line.

The two halves of the ruling that must not blur into each other

Restating because they look similar and are opposite:

• ⛔ No data migration. 「不需要考虑历史数据」 — no backfill, no reaper, no migrate-your-providers command, and no opportunistic cleanup of an existing row you happen to touch.
• ⭐ The consumer sweep is step 1 of the work, not a struck prerequisite. What the ruling struck was the census as a blocker on the decision; "what in this repo reads this object" is still measured, repaired, and pinned.

Instrument discipline this card specifically needs

A retirement's whole risk is a reader you did not find, so the zero is the load-bearing claim:

• ⚠️ A zero-hit needs a positive control FIRST — prove the instrument finds a known reader of some other platform object before concluding this one has none. ⭐ And a control run through the same broken channel validates nothing.
• ⭐ git grep <ref>, not plain grep — the shared working tree is at an unknown state; other agents switch its HEAD.
• ⭐ Pin identities, not counts. "0 readers remain" without naming what was found and what was done to each is not a sweep.
• ⚠️ grep -F matches inside comments — read the matched line before concluding (this cost a false conclusion twice this shift).

Fences

⛔ Zero packages/spec ownership — a spec edit means stop and report, it is the spec seat's. ⛔ Never content/docs/releases/, docs/adr/**, .claude/**, skills/**, AGENTS.md, CLAUDE.md. ⛔ Draft PR only; this seat does the landing, and only after a contract review at tier.

⚠️ Adjacent, not yours: #11697 (spec parity) is a different seat and does not block you. Epic leg 1b (provision the seven stable models) will be cut behind this card precisely so the two do not both move the SCIM platform-object surface at once — if you find yourself needing to add models, that is 1b and you should stop and say so.

---

Generated by Claude Code

[os-sam]

{
 "issue": 11757,
 "status": "needs_decision",
 "branch": "claude/issue-11757-retire-sys-scim-provider",
 "pr": null,
 "premise_still_valid": false,
 "summary": "Premise-first stop, no PR, nothing removed. The card's operative premise — 'the upstream scimProvider model does not exist on the stable line, so there is nothing left to mirror' — is true of stable @better-auth/scim 1.7.1 and FALSE of what this repo installs. packages/plugins/plugin-auth/package.json:29 pins @better-auth/scim at 1.7.0-rc.1 (matching override in pnpm-workspace.yaml:180), and rc.1 still declares scimProvider (40 hits in its dist/index.mjs) plus the generate-token endpoint. sys_scim_provider is that model's live and FORCED mirror: scim accepts no `schema` option, so AUTH_MODEL_TO_PROTOCOL.scimProvider -> 'sys_scim_provider' (objectql-adapter.ts:57) is the only naming route there is. Measured rather than inferred — the parity gate is green on the unmodified tree with a case literally named 'every scim/scimProvider column exists on sys_scim_provider', and credential-at-rest-posture.test.ts boots the real stack, logs '[Registry] Registered object: sys_scim_provider (own, priority=100) from @objectstack/plugin-auth', issues a bearer through /scim/generate-token and authenticates a real SCIM 2.0 request against the persisted row, 4/4 green. Retiring the object ahead of the pin move therefore deletes the only table the installed library can write provider rows into. A SECOND, independent stop: removal mandatorily requires editing packages/spec/src/system/constants/platform-object-names.ts:76 — proven by ablation, the spec conformance test reds with 'registry group \"platform-objects\" is out of date' — and this lane has zero packages/spec ownership by dispatch. The maintainer's ruling to retire STANDS and is not in question; only the sequencing is wrong. #11632's own title is 'Migrate SCIM from @better-auth/scim 1.7.0-rc.1 to stable 1.7.x' and #3653's is 「停在 @better-auth/scim rc.1,等正式版再整体迁移」 — the pin move is the event that makes scimProvider disappear, and neither leg 1a (this card) nor leg 1b owns it. The card was written from PR #11429's gate output, which that PR produced by temporarily symlinking the published 1.7.1 tarball into the pnpm store and restoring it; #11429's own body says the pin is 'still 1.7.0-rc.1' and out of its scope.",
 "tests": "All measurements at BASE 5cb62d88b881c19dc9db69607476d2dc8c88dbd1 (origin/main), in worktree ../objectstack-11757, heavy steps serialized through scripts/pm/os-verify-lock.sh. No commits were made, so there is no final-commit sha to quote: the tree was byte-identical to origin/main at every measurement (git status --porcelain = 0 lines, origin/main..HEAD = 0 commits, re-confirmed after teardown). (1) POSITIVE CONTROL FIRST, before any zero was concluded: `git grep -l -F sys_user origin/main -- .` returned 664 files — the instrument finds a known reader of another platform object, through the same channel (git grep against the ref, never plain grep, since the shared checkout's HEAD is switched by other agents). (2) Dependency closure built first: `pnpm --workspace-concurrency=2 --filter '@objectstack/plugin-auth^...' build` -> os-verify-lock: VERDICT command-exit 0 (held 264s). (3) Parity gate on the UNMODIFIED tree, prediction written before the run and confirmed: `pnpm --filter @objectstack/plugin-auth exec vitest run src/better-auth-schema-parity.test.ts --maxWorkers=2` -> 'Test Files 1 passed (1) / Tests 24 passed (24)', including '✓ ... > every scim/scimProvider column exists on sys_scim_provider' and '✓ ... > the set of models with no platform object is exactly the acknowledged one'. Exit captured before any pipe: os-verify-lock: VERDICT command-exit 0. This is the direct refutation — the assertion `expect(Object.keys(derived)).toContain('scimProvider')` PASSES against the installed rc.1. (4) Live write path: `pnpm --filter @objectstack/plugin-auth exec vitest run src/credential-at-rest-posture.test.ts --maxWorkers=2` -> 'Test Files 1 passed (1) / Tests 4 passed (4)', stdout carrying '[Registry] Registered object: sys_scim_provider (own, priority=100) from @objectstack/plugin-auth' and passing cases '② the persisted bearer is the SHA-256 digest of the INNER base token, never cleartext' and '② the hashed credential still AUTHENTICATES a real SCIM 2.0 request'. os-verify-lock: VERDICT command-exit 0. The object is exercised end to end today; it is not a dead surface. (5) Upstream tarball read directly: `grep -c scimProvider` on the installed node_modules/.pnpm/@better-auth+scim@1.7.0-rc.1.../dist/index.mjs = 40; generate-token = 1; package.json version = 1.7.0-rc.1. (6) SPEC-FENCE ABLATION, prediction written first ('deleting the object file will red the spec registry conformance with \"registry group platform-objects is out of date\"'), run from a script carrying `trap restore EXIT INT TERM`, restoring against an ABSOLUTE path derived from REPO_ROOT=$(git rev-parse --show-toplevel). Mutation confirmed on disk in BOTH directions and anchored on the text intended to move, never on a bare diff --stat: PRE_EXISTS=yes with PRE_ANCHOR_HITS=1 for the anchor \"name: 'sys_scim_provider'\"; after `rm`, POST_EXISTS=no and `git status --porcelain` showed ' D packages/platform-objects/src/identity/sys-scim-provider.object.ts' (the script exits 90 rather than reading a result if the file is still present, so a no-op edit could not have been read as a measurement). Result: ABLATED_SPEC_EXIT=1, and the test's OWN verdict line — not my $? — reads '× ... > registers exactly the objects each package declares' / 'AssertionError: registry group \"platform-objects\" is out of date: expected [ ... ](38) to deeply equal [ ... ](37)' with the diff line '+ \"sys_scim_provider\"', 'Test Files 1 failed (1) / Tests 1 failed | 6 passed (7)'. RESTORE LEG, not skipped: RESTORED_EXISTS=yes, RESTORED_HASH=949ae30f7839318e95f8c1b86115f0de3bdf0252 == HEAD blob 949ae30f7839318e95f8c1b86115f0de3bdf0252 (non-empty and matching — an empty hash would have been failure, exit 91), RESTORE_ANCHOR_HITS=1, TREE_CLEAN=0. No dist/ was involved on this leg: platform-object-names.test.ts reads source with readFileSync and imports './platform-object-names' relatively, so the failed-build/stale-dist trap does not apply here. (7) Gate derivation, run as instructed on a clean tree with no path arguments: `node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack` -> exit 2, its own verdict line: \"dispatch-gates: this branch changes nothing against 'origin/main' (merge base 5cb62d88b) — nothing to derive.\" preceded by \"--repo 'objectstack-ai/objectstack' checked against this checkout's 'origin' remote — it holds.\" ADR-0087: there is NO verdict to report either way, and I am not assuming one. check-adr-0087-registration.mjs is driven off the changeset's own breaking/major declaration and explicitly 'does not detect retirements' (its header); with no diff and no changeset it has nothing to grade. For the future retirement card the rule is conditional and precise: iff that PR adds a changeset declaring breaking/major, it must carry exactly one `<!-- adr-0087: ... -->` disposition marker. CONSUMER SWEEP — identities, not counts, every match line read before concluding (git grep -F also matches comments). Live wiring that a retirement must repair: (a) packages/platform-objects/src/identity/sys-scim-provider.object.ts — the declaration; (b) packages/platform-objects/src/identity/index.ts:46 — `export { SysScimProvider }`; (c) packages/plugins/plugin-auth/src/manifest.ts:28,65 — imported and listed in `authIdentityObjects`, i.e. the runtime provisioning list (this is what emits the [Registry] line above); (d) packages/plugins/plugin-auth/src/objectql-adapter.ts:57 — AUTH_MODEL_TO_PROTOCOL, the live bridge; (e) packages/plugins/plugin-auth/src/auth-schema-config.ts:1005 — AUTH_SCIM_PROVIDER_SCHEMA.modelName, which the sweep found has ZERO consumers repo-wide (filed as #11777, not fixed here); (f) packages/plugins/plugin-security/src/objects/default-permission-sets.ts:69 — the better-auth managed-object deny list; (g) packages/spec/src/system/constants/platform-object-names.ts:76 — FENCED, spec seat's. Generated artifacts: packages/platform-objects/src/apps/translations/{en,es-ES,ja-JP,zh-CN}.objects.generated.ts:1897 (plus scim_token at :1913), regenerated from packages/platform-objects/scripts/i18n-extract.config.ts:97,234, and pinned by src/apps/translations/bundle-ownership.test.ts:28. Tests that pin the object and would need rewriting or deleting: platform-objects/src/platform-objects.test.ts:17,117-120 (the ADR-0066 D3 capability-gate pin); platform-objects/src/identity/action-predicate-sparse-face.test.ts:53,145; plugin-auth/src/better-auth-schema-parity.test.ts:117,148,583; plugin-auth/src/credential-at-rest-posture.test.ts (whole file, incl. SCIM_PROVIDER_OBJECT at :150); plugin-auth/src/managed-extension-fields.test.ts:236. Prose-only matches, read and confirmed to be comments rather than code: packages/objectql/src/registry.ts:806 and registry-tenant-index-follows-wall.test.ts:188 (tenant-index exemption commentary); packages/qa/dogfood/test/authz-conformance.matrix.ts:248 (D10 matrix `enforcement` string); content/docs/permissions/authorization.mdx:533; pnpm-workspace.yaml:92 (the pin comment that itself names this retirement as part of the #3653 migration). Fenced and deliberately untouched: docs/adr/0066-unified-authorization-model.md:109 and content/docs/releases/v17.mdx:2965. Nothing was repaired or deleted, because the correct disposition of every one of these depends on the sequencing question below.",
 "open_questions": [
 {
 "question": "SEQUENCING. The retirement is ruled and not in question, but it cannot execute ahead of the @better-auth/scim pin move: rc.1 (what is installed) still declares scimProvider, and sys_scim_provider is the only table its provider rows can be written to. #11632's scope cuts leg 1a (retire the old object) and leg 1b (add the seven stable models) but assigns the pin move — the event that actually makes scimProvider disappear — to neither. When does the retirement land?",
 "options": [
 "A — Re-cut #11757 to carry a `Blocked-by:` on a new, explicitly-owned pin-move leg (bump plugin-auth/package.json:29 and the pnpm-workspace override to stable ^1.7.1, rewrite the scim({...}) call for stable's required options since storeSCIMToken is gone, retire the two scaffold allowedVersions suppressions per epic scope item 7). Retirement then runs on a tree where scimProvider genuinely no longer exists, and the seven-model leg 1b follows.",
 "B — Fold the retirement INTO the pin-move PR as one atomic change: pin + retire sys_scim_provider + provision the seven models, landing together so the tree is never in a state where the installed library writes to a table that does not exist. Larger diff, one governed review.",
 "C — Retire now as dispatched and accept a window in which OS_SCIM_ENABLED deployments are broken, on the reasoning that SCIM is off by default (readBooleanEnv('OS_SCIM_ENABLED'), auth-manager.ts:2255).",
 "D — Keep #11757 open as measurement-only (this report) and let the epic owner re-decompose, with no leg landing until the pin move has an owner."
 ],
 "recommendation": "A, with B as an acceptable variant if the epic owner prefers one atomic landing. Four axes. REAL BUSINESS NEED: measured, not assumed — sys_scim_provider is not a speculative surface but an exercised one; credential-at-rest-posture.test.ts drives a real IdP-shaped flow (generate-token, then an authenticated SCIM 2.0 request) against the persisted row and passes 4/4 today, so the reader whose repair C would skip is a working feature, not a leftover. LONG-TERM SOUNDNESS FOR THIS PROJECT: A restores the dependency order the epic already asserts in its own title ('Migrate ... from 1.7.0-rc.1 to stable 1.7.x') and that #3653 states as its decision — 「停在 @better-auth/scim rc.1,等正式版再整体迁移」, migrate as a whole when stable arrives. Retire-before-pin is a workaround in the No-workarounds sense: it makes a gate green by deleting the thing under test while the subject is still live. MAKING AI-WRITTEN CODE HARD TO GET WRONG: A keeps declared == enforced continuously. Under C the parity gate — the epic's own named safety net, whose repair was the whole of PR #11429 — would have to be weakened or exempted to stay green while the model it checks still exists and its object does not; that trades a loud structural check for an inert one, which is precisely the direction that lets a later AI-authored change pass unnoticed. STARTUP SCOPE DISCIPLINE: A adds no surface at all. It reorders existing legs and names an owner for a step the epic already implies, which is the cheapest of the four; B is also disciplined but bundles a governed review; C is cheapest today and most expensive later. Against C specifically: default-off narrows the blast radius but does not remove it, and the ruling that struck the census struck 'is any shipped deployment relying on it' as a BLOCKER ON THE DECISION — it did not license shipping a tree whose own gates contradict each other. D is a non-answer: it leaves the pin move unowned, which is the actual gap this measurement found."
 },
 {
 "question": "SPEC OWNERSHIP. Whenever the retirement does run, it mandatorily edits packages/spec/src/system/constants/platform-object-names.ts:76 — the spec registry asserts exact equality with the *.object.ts files each package declares, so deleting the object file without deleting the registry entry reds packages/spec (measured above). This lane has zero packages/spec ownership by dispatch, and #11632 scope item 3 states 'packages/spec work goes to the spec seat per single-owner rule'. How is that one-line removal carried?",
 "options": [
 "A — Cut a spec sub-issue owned by the spec seat, sequenced to land in the same stroke as the retirement (the two cannot be separated: either PR alone reds the conformance test in one direction or the other).",
 "B — Grant the retirement card a narrow, named exemption for exactly this file and exactly this line, declared in the PR body, on the grounds that it is a mechanical registry follow-through with the correct shape already fixed by the conformance test rather than a spec design decision.",
 "C — Assign the whole retirement leg to the spec seat so one seat owns both halves."
 ],
 "recommendation": "B, and I am flagging that I am recommending against my own fence rather than quietly reading past it — the fence held, I stopped, and this is the escalation it is for. Four axes. REAL BUSINESS NEED: the need is mechanical, not architectural — the registry's own doc comment states the maintenance contract ('adding an object to a platform package means adding its name here') and the conformance test computes the correct content, so there is no judgement left to exercise and no design question for a spec seat to answer. LONG-TERM SOUNDNESS: A is the letter of the single-owner rule but splits one indivisible change across two PRs, and neither half can be green alone — that is a merge-order trap that will red main if the two land out of order, which is a worse outcome than the rule protects against. MAKING AI-WRITTEN CODE HARD TO GET WRONG: B keeps the change atomic and self-verifying — the spec test IS the check, and it fails loudly on either side of a mistake, so the exemption cannot be abused silently. STARTUP SCOPE DISCIPLINE: B is one line in a file whose shape is already pinned; A and C both spend a whole extra dispatch on it. If the maintainer prefers the fence read strictly, C is the clean fallback (one seat, both halves, no split PR); A is the option I would avoid. Either way this is the PM's or the maintainer's call, not mine — I did not touch the file."
 }
 ],
 "out_of_scope_findings": [
 "filed as #11777: AUTH_SCIM_PROVIDER_SCHEMA (packages/plugins/plugin-auth/src/auth-schema-config.ts:1005) is exported from the package's public API via index.ts:69 but has zero consumers repo-wide — a second, inert source of truth for the same four SCIM column names the adapter derives mechanically; labelled `finding`, unassigned, no pm:queue, disposition suggested alongside the #11632 pin move"
 ]
}

---

Generated by Claude Code

---

Generated by Claude Code

[os-sam]

⛔ Premise-first stop — nothing removed, no PR. The false premise is this seat's, and it propagated into a ruling.

pm:dispatched → needs-user-decision, assignee cleared. The dispatched dev stopped correctly and delivered measurement instead of code.

What is false, and it is the sentence I wrote

This card's operative premise:

The upstream scimProvider model does not exist on stable … There is nothing left to mirror.

True of stable @better-auth/scim@1.7.1. FALSE of what this repository installs.

• packages/plugins/plugin-auth/package.json:29 pins 1.7.0-rc.1 (matching override at pnpm-workspace.yaml:180).
• rc.1 still declares scimProvider — 40 hits in its installed dist/index.mjs — plus the generate-token endpoint.
• scim accepts no schema option, so AUTH_MODEL_TO_PROTOCOL.scimProvider → 'sys_scim_provider' (objectql-adapter.ts:57) is the only naming route there is. The object is that model's forced mirror.

⇒ Retiring it ahead of the pin move deletes the only table the installed library can write provider rows into.

Measured, not argued:

• the parity gate is green on the unmodified tree, with a case literally named "every scim/scimProvider column exists on sys_scim_provider" — expect(Object.keys(derived)).toContain('scimProvider') passes against rc.1;
• credential-at-rest-posture.test.ts boots the real stack, logs [Registry] Registered object: sys_scim_provider …, issues a bearer through /scim/generate-token and authenticates a real SCIM 2.0 request against the persisted row — 4/4 green. ⭐ This is an exercised feature, not a dead surface.

⚠️ How I got it wrong, on the record

I built this card — and the measurement section of #11693, on which the maintainer ruled — from PR #11429's gate output. That PR produced its model diff by temporarily symlinking the published 1.7.1 tarball into the pnpm store and restoring it afterwards; its own body states the pin is "still 1.7.0-rc.1" and out of its scope.

I read a measurement taken under a temporary pin swap and presented it as describing the installed tree. That is the same class of error I have been catching all shift — a number carried forward without re-measuring in the context it would be used in — and this time it reached a maintainer decision.

⛔ The ruling to retire is NOT in question. scimProvider does go away on stable; A remains the right disposition. What is wrong is sequencing, and the reason the sequencing looked fine is my framing.

⭐ The real gap this found: the pin move has no owner

#11632 cuts leg 1a (retire the old object) and leg 1b (add the seven stable models) — and assigns the pin move to neither. But the pin move is the event that makes scimProvider disappear. The epic's own title says so — "Migrate SCIM from @better-auth/scim 1.7.0-rc.1 to stable 1.7.x" — as does #3653's 「停在 @better-auth/scim rc.1,等正式版再整体迁移」.

This is for the maintainer. Options as the dev framed them, its recommendation A (B an acceptable variant), and ⛔ I am not ranking them:

A	Re-cut this card with Blocked-by: on a new, explicitly-owned pin-move leg (bump the pin + override to ^1.7.1, rewrite scim({...}) for stable's required options since storeSCIMToken is gone, retire the two scaffold allowedVersions suppressions per epic item 7). Retirement then runs where scimProvider genuinely no longer exists.
B	Fold pin + retire + seven-model provisioning into one atomic PR, so the tree is never in a state where the installed library writes to a table that does not exist. Larger diff, one governed review.
C	Retire now and accept a window where OS_SCIM_ENABLED deployments are broken, since SCIM is off by default.
D	Leave this measurement-only and re-decompose.

⚠️ The dev's argument against C is worth your eye: default-off narrows the blast radius but does not remove it, and to stay green the parity gate — the epic's own named safety net, whose repair was the entire point of PR #11429 — would have to be weakened or exempted while the model it checks still exists and its object does not. That trades a loud structural check for an inert one.

Second, independent stop: the spec fence held

Removal mandatorily edits packages/spec/src/system/constants/platform-object-names.ts:76. Proven by ablation: deleting the object file alone reds the spec conformance test with registry group "platform-objects" is out of date … + "sys_scim_provider". This lane has zero packages/spec ownership, and #11632 scope item 3 says that work goes to the spec seat.

⭐ The dev recommends a narrow named exemption for that one line — and flagged that it was "recommending against my own fence rather than quietly reading past it — the fence held, I stopped, and this is the escalation it is for." That is exactly the right way to raise it. Its reasoning: the two halves cannot be separated (either PR alone reds the conformance test in one direction or the other), so splitting them is a merge-order trap. Its clean fallback if you want the fence read strictly: assign the whole retirement leg to the spec seat.

⛔ Also for you, not me.

Instrument discipline worth recording

Positive control first (git grep -F sys_user → 664 files) before any zero was concluded · the ablation script exits 90 rather than reading a result if the file is still present, so a no-op edit could not be read as a measurement · restore proven by git hash-object 949ae30f… matching the HEAD blob, non-empty, tree clean · and on ADR-0087: "there is NO verdict to report either way, and I am not assuming one" — the gate is driven off a changeset's breaking/major declaration and its own header says it does not detect retirements, so with no diff it has nothing to grade. The conditional rule for the future card is stated instead of guessed.

Filed rather than fixed: #11777 — AUTH_SCIM_PROVIDER_SCHEMA is exported from the package's public API with zero consumers repo-wide, a second inert source of truth for column names the adapter derives mechanically.

---

Generated by Claude Code