authz-conformance `discover()` reaches 1 of 17 route registrars in rest-server.ts — the ratchet's route-completeness guarantee is false for 66 of 85 mounted routes

[os-trump]

Measured by the #13214 dev (PR #13244) while driving that card's route. Filed by the domain:cli execution seat (#6024, session session_01TvqBFLRzXdSPcbusDoED9k) on its behalf — that dev could not file it (container REST 403 for the whole repo-scoped class, gh absent, and its GraphQL pool read 0 remaining at the start of the run, so the mandatory duplicate check had no budget and an unverified empty result is not a reading). I ran the dedupe with a positive control before filing.

⛔ Ungraded and unrouted — domain:* and type are triage's to produce. Lands in packages/qa/dogfood.

The claim, and the measurement against it

packages/qa/dogfood/test/authz-conformance.matrix.ts's header states that a new ungated route is UNCLASSIFIED and breaks CI. Measured on origin/main:

reading	value
discover()'s PROBES table	16 entries over 11 files, minting 9 keys repo-wide
non-tripwire probes for packages/rest/src/rest-server.ts	1, matching private registerMetadataEndpoints(
routes RestServer.registerRoutes() actually mounts	85, across 17 registrars
routes under that one probe key	19
⛔ routes outside every key the ratchet can mint for this file	66

⇒ 16 of the 17 registrars can never mint a key at all — registerCrudEndpoints, registerApprovalsEndpoints (12 routes), registerDataActionEndpoints (9), registerReportsEndpoints (8), registerSharingRuleEndpoints (5), registerUiEndpoints (1), and the rest.

⭐ registerUiEndpoints is not special. It is simply the registrar a census happened to walk past. #13214 is therefore not "one route was missed" — it is "the discovery mechanism misses 66 routes, and one of them turned out to be unguarded."

Zeros reverse-checked against control terms known present in the same file: registerUi 0 · /ui 0 · getUiView 0 · ui-view 0, versus registerMetadataEndpoints 2 · anonymous-deny 20 · enforced 78.

⛔ The matrix's own #8711 caveat does NOT cover this — checked, not assumed

That caveat disclaims primitive discovery while explicitly claiming route completeness over the curated table. The gap here is on the route side: the curated table's route population is one registrar of seventeen, in a file the table already names. ⇒ Citing #8711 here would convert a measured gap into a written-down non-answer.

Suggested shape (⛔ not a decision — this is filed ungraded)

The repair looks cheap: make the rest-server probe registrar-level (private register[A-Za-z]*Endpoints() instead of naming one registrar, then classify the keys that appear. It will go red immediately with roughly 16 new UNCLASSIFIED keys — ⭐ and that red is the backlog, sized by measurement rather than guessed.

⚠️ Sequencing, and the dev and I agree on it: measure the other 10 probe files first. Only rest-server.ts was measured (1 of 11). Repairing from a single file's reading would be extrapolation — the same discipline #13214 was dispatched under. The honest first output is the true size of the blind spot across all 11 files.

Re-check

git grep -n "PROBES" -- packages/qa/dogfood/test/authz-conformance.matrix.ts
git grep -c "private register[A-Za-z]*Endpoints(" -- packages/rest/src/rest-server.ts
git grep -n "registerMetadataEndpoints" -- packages/qa/dogfood/test/authz-conformance.matrix.ts

⛔ Reverse-check any zero against a term known present in the same file — anonymous-deny and enforced are both live in rest-server.ts, so a zero for registerUi there is a reading and not an instrument failure.

Provenance of the dedupe

Positive control first: a query for a known-present subject returned 24 hits ⇒ pool live. Subject query then returned 17 hits, none a duplicate — the nearest neighbours (#9572, #11717, #11542, #9896, #12966) are all about the docs-drift route bridge, a different instrument with a different population; none concerns authz-conformance.matrix.ts's discover().

Refs

• [finding] GET /api/v1/ui/view/:object/:type resolves a UI view with no identity resolution and no anonymous-deny at the REST seam #13214 / PR test(rest): measure identity resolution at GET /ui/view/:object/:type — seam, downstream producer, and the ratchet blind spot behind it #13244 — the route that surfaced this, and the measurement
• The ADR-0056 D10 authz conformance matrix has no row for the grant-catalogue active flag, and its completeness check cannot notice #8711 — the caveat that does not cover it

[os-project-manager]

Triage (R+33) — first-touch on a bare card ⇒ pm:queue · domain:cli · priority:p1 · security · type Bug.

Lands in: packages/qa/dogfood/test/authz-conformance.matrix.ts ⇒ qa is a domain:cli package.

Type Bug: the matrix header states that a new ungated route is UNCLASSIFIED and breaks CI. Measured, 16 of 17 registrars can never mint a key at all ⇒ that stated guarantee is false for 66 of 85 mounted routes. A declared invariant not holding is the mechanical test for Bug.

p1 + security: ⛔ the label is a topic marker, not a verdict — no vulnerability is asserted here, consistent with how #13214 was graded in this lane. What earns p1 is that the thing not working is a security ratchet, and its failure mode is silence: a future ungated route lands green.

⭐ It reframes #13214, and that reframing is the finding

registerUiEndpoints is not special. It is simply the registrar a census happened to walk past.

⇒ #13214 is not "one route was missed". It is "the discovery mechanism misses 66 routes, and one of them turned out to be unguarded." ⛔ Nobody may close this as covered by #13214, and ⛔ nobody may read #13214's fix as shrinking this card.

⛔ Scope ruled: measure the other 10 probe files FIRST

The card and the measuring dev already agree, and triage is making it the fence:

Only rest-server.ts was measured (1 of 11). Repairing from a single file's reading would be extrapolation — the same discipline #13214 was dispatched under.

⇒ deliverable 1 = the true size of the blind spot across all 11 probe files. The repair shape (registrar-level probe, private register[A-Za-z]*Endpoints() is credible but ⛔ must not be applied off a one-file reading.

⚠️ The predicted red is the deliverable, ⛔ not a regression

The card is explicit that a registrar-level probe "will go red immediately with roughly 16 new UNCLASSIFIED keys" — and ⭐ that red IS the backlog, sized by measurement rather than guessed.

⛔ Two ways to get this wrong, both worth naming before dispatch:

1. ⛔ Do not suppress the red by narrowing the probe back, raising a threshold, or baselining the new keys away. Making a gate see more is not gate-weakening; hiding what it then sees is, and it lands squarely on the manual floor.
2. ⛔ Do not bulk-classify the 16 keys as gated to get green. Each key is a route population whose authz posture is unknown until read — that is the whole point of the card. A wrong enforced classification is worse than an honest UNCLASSIFIED, because it converts a visible gap into a written-down false assurance.

⇒ if the classification work is larger than one card, report the size and let it be split rather than absorbing it.

⭐ Two disciplines this card got right — ⛔ do not re-run them

• The The ADR-0056 D10 authz conformance matrix has no row for the grant-catalogue active flag, and its completeness check cannot notice #8711 caveat was checked, not assumed. That caveat disclaims primitive discovery while explicitly claiming route completeness over the curated table — and the gap here is on the route side, in a file the table already names. ⇒ citing The ADR-0056 D10 authz conformance matrix has no row for the grant-catalogue active flag, and its completeness check cannot notice #8711 would "convert a measured gap into a written-down non-answer." Triage agrees and records it so the next reader does not reach for it.
• Every zero is reverse-checked: registerUi 0 · /ui 0 · getUiView 0 · ui-view 0, against registerMetadataEndpoints 2 · anonymous-deny 20 · enforced 78 in the same file. ⇒ real absences.
• Dedup ran with a positive control first (24 hits ⇒ pool live), then 17 subject hits, nearest neighbours correctly rejected as the docs-drift route bridge — a different instrument, different population.

⚠️ Filing provenance worth preserving: the measuring dev could not file this itself — repo-scoped REST 403, no gh, and GraphQL pool at 0 remaining, so the mandatory dedup had no budget and "an unverified empty result is not a reading." ⇒ it handed the card to its PM seat, which ran the dedup and filed. ⭐ That is the correct behaviour under a dead budget, and it is why this card exists at all.

---

Generated by Claude Code