Repair the authz-conformance ratchet's route population — decide where it comes from before widening any regex (80 entry points measured invisible)

[os-trump]

Filed by the domain:cli 执行 PM 席位（#6024），会话 session_01TvqBFLRzXdSPcbusDoED9k。这是 #13260 的修复半边 —— 测量半边已由 PR #13369 落地（a1df501e47），本卡承接它量出来的东西。

⚠️ 直到 #13369 合并前本卡都不能开：它要改 authz-conformance.test.ts / .matrix.ts，而 #13369 刻意让这两个文件逐字节不动。现已合并 ⇒ 解锁。

已测量的缺口

packages/qa/dogfood/test/authz-conformance.matrix.ts 的头部承诺：该棘轮*「ratchets completeness over a CURATED table of HTTP/transport entry points」，且一条新的未加门路由「is UNCLASSIFIED … and breaks CI」*。

PR #13369 对 PROBES 点名的全部 11 个文件做了普查：16 条探针 / 11 文件 / 9 个可铸键，而落在所有可铸键之外的入口点是 80 个（运行时读数；静态读数 75）。其中 rest-server.ts 一家就占 66 —— 它有 17 个 registrar，探针表只够得到 1 个。

⭐ 承重结论：registerUiEndpoints 不特殊，它只是某次普查恰好走过的那个 registrar。

⛔ 明确不主张的

⛔ 本卡不主张那 80 个入口点里任何一条未受保护。路由级执行大多在 handler 内（enforceAuth / shouldDenyAnonymous / 逐对象权限检查）。被主张的是棘轮看不见它们 —— 一个保证缺陷，⛔ 不是一次突破。⇒ 本卡是加强门，⛔ 不是削弱门。

⭐ 要先回答的问题：population 从哪来

⛔ 不要从"把正则加宽"起步。 PR #13369 记录了一条决定性读数：

packages/rest/src/rest-route-ledger.ts 持有 94 行审计过的行，覆盖 @objectstack/rest 挂载的每一条路由，经 RestServer.getRoutes() 运行时枚举，并由 rest-route-ledger.conformance.test.ts 守护（实测绿 7/7）；packages/runtime/src/route-ledger.ts 对 dispatcher 做同样的事，80 行。

⇒ authz 棘轮的路由 population 是一张正则表，够得到 17 个 registrar 里的 1 个；而一份完整的、运行时导出的、已经有人守着的同一批路由的枚举就在隔壁包里。

⚠️ 加宽正则、或手工把文件补进表里，都会在下一次有人加文件时重新腐烂 —— 这正是本卡要终结的机制，⛔ 不是要再演一遍。

⭐ 一个必须带上的分类，否则会数错

PROBES 表混了三种承诺不同的仪器（#13369 立的分类）：

类型	承诺	「盲区 0」的含义
ROUTE_ENUMERATION	自动发现：「ANY new route matching this pattern mints a new key」	缺口就是盲区
GATE_PIN	对某个具名门的防回归，按构造只铸一个键	⛔ 「本文件汇流到那道门」，不是「每条路由都被枚举了」
TRIPWIRE	今天故意匹配不到东西	⭐ 0 键是正确读数，⛔ 不是洞

⛔ 用一个口径去数，会把 6 条正常工作的绊线读成 6 个洞。

三条一并处理的附带缺陷（#13369 已测，未修）

1. data:hono-plugin.ts 是死探针。提交 e5a4d26901（2026-07-31）删掉了它的 population（匹配挂载 3 → 0），探针留下来至今一言不发 —— 因为 STALE 只对「某行 covers 的键」触发，而从没有行 cover 过它的键。⭐ 这是第二条独立的盲区机制：不是探针太窄，是它的 population 被删了而没人吭声。
2. matrix 头部写「15 probes」，而表里自 2026-08-18 起是 16 条。test(qa): census the authz-conformance probe table's reach across all 11 probe files #13369 把这个漂移钉在 census 里、⛔ 刻意没改那句话（好让它的无修复围栏毫不含糊）。本卡改。
3. [finding] The authz-conformance PROBES table names 4 of the 17 runtime domain files — the same blind spot one layer out, at file selection rather than probe reach #13376 —— PROBES 只点名了 packages/runtime/src/domains/ 下 17 个文件中的 4 个（该目录 15 个声明了 DomainRoute prefix）。⚠️ 这是同一缺陷的上一层：在文件选择而非探针伸展。⭐ 且它有下一层没有的性质：一个从未被点名的文件不产生任何信号 —— 没有 STALE、没有 UNCLASSIFIED、没有键 ⇒ 它的缺席在结构上不可观测。

⛔ 停手条件

若实测发现那两份 route ledger 并不覆盖本棘轮需要的 population（例如它们不含 transport 层的 dispatcher handler、或粒度对不上），⇒ 停手回报，⛔ 不要退回去加宽正则当作次优解。那说明这是一个需要重新设计 population 来源的问题，值得单独判。

Refs

• authz-conformance discover() reaches 1 of 17 route registrars in rest-server.ts — the ratchet's route-completeness guarantee is false for 66 of 85 mounted routes #13260 / PR test(qa): census the authz-conformance probe table's reach across all 11 probe files #13369 —— 测量半边，本卡全部读数的出处
• [finding] The authz-conformance PROBES table names 4 of the 17 runtime domain files — the same blind spot one layer out, at file selection rather than probe reach #13376 —— 上一层的盲区（文件选择）
• [finding] GET /api/v1/ui/view/:object/:type resolves a UI view with no identity resolution and no anonymous-deny at the REST seam #13214 —— registerUiEndpoints 那条被走过的路由，仍在等维护者裁。⛔ 本卡不重开、不重判它

Generated by Claude Code

[os-trump]

os-dev-report

{
 "issue": 13411,
 "status": "needs_decision",
 "branch": "claude/issue-13411-authz-ratchet-route-population",
 "pr": "https://github.com/objectstack-ai/objectstack/pull/13436",
 "premise_still_valid": true,
 "summary": "STEP ONE answered by measurement, and it is the STOP CONDITION on the card's own named prong. The ledgers COVER the route population richly — rest-route-ledger.ts 94 rows over 19 families, per-route completeness enumerated through RestServer.getRoutes() and guarded; route-ledger.ts 80 rows over 21 domains with a DOMAIN-level machine contract via live registry introspection, covering all 15 async handle*( dispatcher methods and all 16 DomainRoute prefixes; nine further ledgers repo-wide, 290 rows total. They CANNOT supply this ratchet's guarantee, for three independently sufficient measured reasons. (1) NO NOTION OF GATED: dispositions grade SDK expressibility (REST sdk 84 / server-only 7 / public 3), and cross-checking the 8 REST mounts that carry no enforceAuth against the ledger gives server-only 3, public 3, sdk 2 — one of those two sdk rows being GET /api/v1/ui/view/:object/:type, the ONE route in this population ever measured unguarded, shape-identical to the 83 gated sdk rows. (2) A SYNTACTIC gate reading is unsafe: scanning all 80 this.routeManager.register( sites for enforceAuth reads 50/30, and 22 of the 30 ungated are FALSE — registerMetadataEndpoints wraps 19 inner routes in a guardedRouteManager swap, registerSecurityExplainEndpoints shares one handler const outside its 3 register( calls — a 73% false-ungated rate on the largest registrar. (3) A LEDGER LAGS SOURCE BY ONE GUARDED STEP: Leg A's mutation edits rest-server.ts and never touches the ledger, so any ledger-sourced population leaves authz-conformance GREEN on exactly the mutation it must catch; the red lands in rest-route-ledger.conformance.test.ts, a different gate with a different promise. I therefore did NOT touch the population — no probe added, removed, re-pointed or widened — and shipped only the population-INDEPENDENT half, with the full reading recorded in the census header so it cannot rot. What shipped: (a) the three-kind taxonomy moved from census prose into the PROBES table AS DATA (3 ROUTE_ENUMERATION / 6 GATE_PIN / 7 TRIPWIRE), derived back by the census and asserted; (b) checkProbeInstrumentIntegrity — a ROUTE_ENUMERATION or GATE_PIN probe minting ZERO keys now fails as DEAD PROBE, closing the second blind-spot mechanism neither UNCLASSIFIED nor STALE can reach (both are keyed on a key: one that appears, one that disappears); (c) the dead data:hono-plugin.ts probe re-declared TRIPWIRE with its dated evidence, NOT deleted — deleting would make the gate see less; (d) matrix header 15 to 16 with the census pin INVERTED from not.toBe (drift recorded) to toBe (drift closed and now asserted). PM-side half-state noted: the card was assigned but carried NO claim comment when I picked it up; I proceeded as instructed. Also noted: the dispatch asked for a closing keyword on this card, but since the population decision is still owed I used 'Part of' so a merge cannot retire the card out of the open-card filter — reported rather than picked silently, per the conflict rule.",
 "tests": "All readings on final HEAD 4f69a33484 (branch head), after merging current origin/main (6 commits) and RE-DERIVING the gate union — stderr banner confirms commit 4f69a33484, this checkout, --repo objectstack-ai/objectstack assertion holds. GREEN: pnpm --filter @objectstack/dogfood exec vitest run --maxWorkers=2 test/authz-conformance.test.ts test/authz-probe-blind-spot.test.ts => 'Test Files 2 passed (2) / Tests 62 passed (62)' (baseline before my change on the same tree was 54/54, reproducing PR 13369 exactly). pnpm --filter @objectstack/dogfood typecheck => exit 0. NOT-VACUITY PROOF for that green: tsc --noEmit --listFiles lists 1277 files and contains all four edited files at 1 hit each (authz-conformance.test.ts, authz-conformance.matrix.ts, authz-probe-blind-spot.census.ts, authz-probe-blind-spot.test.ts) with a negative control at 0 — dogfood's tsconfig does NOT exclude test files, checked. pnpm lint repo-wide (eslint . --no-inline-config) => exit 0 in 89s, so NO narrowing was used and none needs declaring. GATE FAMILIES, all run, all exit 0, each read from its own printed verdict line with the exit captured BEFORE any pipe: check:doc-authoring, check:cross-package-test-inputs, check:nul-bytes, check:test-source-alias, check:logger-receiver-detach, check:objectql-double-limit, check:page-declaration-shape, check:published-files, check:slot-lookup, check:type-source-resolution, check:where-matcher, check:query-options-erasure, check:engine-double-contract, check:type-check-coverage, spec check:empty-state / check:liveness / check:strictness-ledger / check:variant-docs, check-ci-filter-parity, check-comment-mask-adoption, check-keyed-text-bounds, check-plugin-teardown-shape, check-shard-attestation, check-undeclared-dep-imports, check-affected-docs, check-drift-comment, check-cross-package-test-inputs. check:doc-authoring was in the union as you predicted and is demonstrably NOT a vacuous green — its sibling-package prose-id leg read 79,572 strings across 1,050 parsed sources over 831 pinned sites and reports 'no growth'; no internal tracker id was added to any runtime string (all ids in this diff live in // comments) and NO baseline entry was added. NOT MEASURED, each self-declared by the gate as a prerequisite failure and NONE of them in the green list: check:test-completeness (exit 3, 'the local reading for this gate is NOT MEASURED ... it is not a red'), check:dual-build-cjs-loads (exit 3, 'PREREQUISITE NOT MET ... This is NOT a pass: nothing was measured', 11 packages without dist/), check:type-check-debt (refuses --re-measure while 4 workspace deps have no built type entry point because it 'would silently measure a DIFFERENT WORLD'; its structural half check:type-check-coverage is green and @objectstack/dogfood carries no DEBT/TEST_DEBT entry at all). ABLATIONS — three legs, direction predicted before each run. NO REBUILD LEG APPLIES AND HERE IS WHY: both instruments are pure source-text scanners (readFileSync over the probe files, no import of the packages under test), so nothing resolves through dist/ and a stale build cannot produce a false green; this is the same standing PR 13369 recorded. Every leg ran under trap '<restore>' EXIT INT TERM with ABSOLUTE paths, restored via git checkout HEAD -- <abs path> (never bare), and proved BOTH mutation and restore ON DISK by blob hash, never by exit code. LEG A (the load-bearing one, predicted GREEN and IS GREEN): one ungated route injected into registerUiEndpoints in packages/rest/src/rest-server.ts; mutation proven on disk by counting BOTH directions — this.routeManager.register( sites 80 -> 81 AND the injected marker 0 -> 1 — with blob b9809d0e52cd7157f7262ac805f46d9e5e384765 -> 565f267d4519a7fe1ba261054f3fe6f57680ece7 (the HEAD blob is byte-identical to the one PR 13369 recorded). Result: authz-conformance.test.ts 33 tests 0 failed, GREEN WITH AN UNGATED ROUTE ON DISK; authz-probe-blind-spot.test.ts RED with 'AssertionError: expected 81 to be 80'. This NEGATIVE result is the single most important reading in the run: my repair does not touch the population, so it cannot and does not close the route blind spot, and Leg A reproduces PR 13369's reading unchanged. LEG B (predicted RED, IS RED): registerMetadataEndpoints renamed, mutation proven 7 -> 0 occurrences of the old spelling plus the replacement present; authz-conformance.test.ts RED with 7 failures including 'AssertionError: STALE covers — surface no longer in source: meta:rest-server.ts:registerMetadataEndpoints' — and my new check fired INDEPENDENTLY on the same regression with 'DEAD PROBE — packages/rest/src/rest-server.ts: a ROUTE_ENUMERATION probe minting ZERO keys', so that regression now has two signals where it had one. LEG C (my repair's own ablation, predicted RED, IS RED): the hono probe's kind reverted to ROUTE_ENUMERATION (its pre-PR state); mutation proven at the exact two-line anchor in both directions, TRIPWIRE 1 -> 0 and ROUTE_ENUMERATION 0 -> 1, blob 15fdb0a6a70578baf35ca0febff7c5930c6bd965 -> 6bd99b61d2b390d96c8008497a1b0e2595d6d7c0; result RED with 'DEAD PROBE — packages/plugins/plugin-hono-server/src/hono-plugin.ts: a ROUTE_ENUMERATION probe minting ZERO keys' — i.e. the condition that was SILENT on origin/main is now loud. HONEST NOTE ON LEG C: my first attempt used file-wide kind counts as the landing check and ABORTED with 'FAIL: injected text not on disk' because the same strings also occur in the new bite-proof cases; the trap restored the tree cleanly (git diff HEAD 0 lines, blob back to HEAD) and I re-ran with a precise two-line anchor. The first attempt measured nothing and is reported rather than quietly re-run. RESTORE PROVEN ON ALL THREE LEGS: restored blob identical to the HEAD blob (non-empty, checked — an empty hash would have been read as FAILURE), git diff HEAD 0 lines, git status --porcelain empty. CENSUS BEFORE -> AFTER (re-derived, never hand-edited to pass): MATRIX_HEADER_PROBE_CLAIM 15 -> 16 with the pin inverted; PROBE_TABLE entries/files/keys 16/11/9 UNCHANGED (population untouched); hono-plugin.ts kinds ROUTE_ENUMERATION -> TRIPWIRE; TRIPWIRE probes 6 over 5 files -> 7 over 6 files; BLIND_SPOT_TOTAL_STATIC/RUNTIME 75/80 UNCHANGED, and Leg A is the proof that it is unchanged; suite 54 -> 62 tests. Every per-file population/reachable/blindSpot number and every per-file positive control is unchanged and still non-zero.",
 "mcp_calls": "6 — pull_request_read(13369), create_pull_request, pull_request_read(13436), issue_read get_labels(13436) which failed loudly as the documented PR-label routing signal, issue_write(labels), add_issue_comment. All bulk card and comment reads went through the zero-quota public-repo payload channel; PR labels were read via the PR-side data-name= spelling and compare-read-back after the union write (size/m, tests, skip-changeset all present, nothing stripped).",
 "open_questions": [
 {
 "question": "Where should the authz ratchet's ROUTE population come from, now that the ledgers are measured to cover the routes but to carry no notion of 'gated', to be one guarded step behind the source, and to sit at wire-route granularity while the matrix classifies authz primitives? This is the card's central deliverable and I deliberately did not absorb it.",
 "options": [
 "A. Route-granular, ledger-sourced: every ledger row becomes a key. COST: ~174 keys (94 REST + 80 dispatcher) all needing a covers classification; #13260's triage forbade bulk-classifying even 16, and Leg A still stays GREEN because the ledger lags the source — the red moves to rest-route-ledger.conformance.test.ts. Buys route-level completeness at the price of the largest classification backlog in the repo.",
 "B. Family/domain-granular, ledger-sourced: one key per REST family (19) and dispatcher domain (21). COST: ~40 keys, ~31 new UNCLASSIFIED. Auto-grows and cannot rot; fixes #13376 by construction. Does NOT make Leg A red — a route added inside an existing family mints nothing — so the matrix header's route-completeness sentence would have to be narrowed to match what is actually delivered.",
 "C. Registrar-granular from SOURCE (the shape #13260 sketched): derive `private register*Endpoints(` mechanically (17) plus dispatcher handlers (15). COST: ~32 keys. Cheapest, but measured NOT to fix the file-selection layer (#13376) and, like B, leaves Leg A green — so it buys less than it looks.",
 "D. Composed two-gate guarantee, zero new fields: keep this ratchet on gates/tripwires only, and require in the LEDGER's own package that no ledger row lands without an authz classification. COST: near-zero new machinery, uses guards that already exist; but it changes the promise the matrix header states, and the guarantee becomes two gates in two packages rather than one.",
 "E. Derive 'gated' syntactically from source — MEASURED AND REJECTED, recorded so it is not re-proposed: 73% false-ungated (22 of 30) on rest-server.ts because of the umbrella guardedRouteManager swap and shared handler consts. Would convert a visible gap into written-down false assurance.",
 "F. Add an authz disposition FIELD to the ledger rows, phased exactly like `responseSchema` already is in that same file: optional, filled only where conformance coverage exists, with a shrink-only undeclared ledger and a later ratchet. COST: 174 rows eventually carry one more declared fact, burnt down incrementally rather than mass-produced. Makes 'gated' a DECLARED, reviewed fact at the producer instead of a syntactic guess at the consumer."
 ],
 "recommendation": "F, phased, with B as the immediate step — and the four axes are what decide it, not cost alone. REAL BUSINESS NEED: the need is not 'enumerate routes' (the ledgers already do, and no one is failing to enumerate); it is that a route's AUTHZ POSTURE gets reviewed when it lands. The ledger is already the one place a new route cannot pass without a reviewed disposition — measured live, per route, on a booted server — so it is where that review actually happens. LONG-TERM SOUNDNESS: this is contract-first. The defect is that 'gated' exists nowhere as a declared fact, which is exactly why the consumer is tempted into a tolerant syntactic guess; the fix belongs at the producer, and E is the concrete demonstration of what happens otherwise. It also ends the rot mechanism for good: the ledger is runtime-enumerated, so no human edits a regex or a file list to keep it complete. AI-WRITTEN METADATA APPS HARD TO GET WRONG: this is the axis that decides between D and F. Under D the authz posture stays inferred; under F you cannot add a route without saying what guards it, and declared = enforced is checkable. The measured case is the argument — GET /api/v1/ui/view/:object/:type is graded `sdk` and is shape-identical to 83 gated `sdk` rows, so today the ledger cannot tell a reviewer that this one is different; that is precisely the silent-wrong-default an AI-authored route would inherit. STARTUP SCOPE DISCIPLINE: F is only proportionate BECAUSE the incremental pattern already exists in that same file and is already ruled on — `responseSchema` was explicitly ruled not-to-be-mass-produced, filled as families land coverage, with a 'no coverage, no fill' rule. Reusing that shape adds no new mechanism and no speculative surface. I therefore recommend NOT adopting A (a 174-key classification backlog bought in one card is the same over-reach the triage already forbade), and taking B now to end the rot and settle #13376 by construction, with F as the direction that eventually makes Leg A red honestly. WHERE THE AXES CONFLICT, PLAINLY: B narrows what the matrix header may claim, and someone must accept that narrowing in writing rather than leave the sentence overstating the guarantee — that acceptance is a maintainer call, not mine."
 },
 {
 "question": "Does the matrix header's route-completeness sentence get narrowed to match whatever population is chosen? Under every option except A it will overstate the guarantee, and I left the sentence's route-completeness claim intact because rewriting it would be pre-deciding option A vs B/C/D.",
 "options": [
 "Narrow the sentence to the granularity actually delivered (registrar/family-level), keeping it honest and checkable.",
 "Keep the route-level claim and accept option A's classification backlog as the way to make it true.",
 "Keep the claim and record the shortfall as a known, dated caveat in the header — the #8711 pattern."
 ],
 "recommendation": "Decide this in the SAME change as the population source, never separately. #13260 already established that citing a caveat over a measured gap converts it into a written-down non-answer, so the third option is the one to avoid unless the shortfall is both dated and sized. I added no new caveat and made no narrowing, so nothing here is pre-decided."
 }
 ],
 "out_of_scope_findings": [
 "NOT FILED — handed to you to file, with the reason. A fresh worktree cannot build the @objectstack/dogfood test closure in one command: pnpm --filter '@objectstack/dogfood^...' build fails because @objectstack/verify's DTS step needs @objectstack/rest and @objectstack/plugin-auth types, and @objectstack/rest is NOT in dogfood's dependency closure (verify reaches it as an optional peer). It took five separate builds in this order to get a runnable, type-clean tree: service-datasource, plugin-auth, rest, runtime + plugin-auth again, verify, cloud-connection. Each build is a JS-emitted / DTS-failed pair, so the JS is usable while every downstream typecheck reports TS7016 'Could not find a declaration file' — a shape that reads like a defect in the change under test rather than a missing build artifact, which is what makes it expensive. I did NOT file it because I have not run a duplicate check for it: repo-scoped REST is 403 on this seat and gh is absent, so a dedupe costs a targeted MCP search that must first be validated with a known-hit control term, and an unverified empty search result is not a reading. Adjacent recent work suggests it may already be tracked — 'fix(datasource,runtime): declare the guarded optional-driver loads as optional peers' landed in the merge I picked up — so a dedupe is genuinely needed rather than a formality. Suggested framing if you file it: either @objectstack/verify declares the peers it type-imports so the closure resolves them, or the dogfood typecheck stops depending on built .d.ts for optional peers."
 ]
}

Generated by Claude Code

---

Generated by Claude Code

[os-trump]

⛔ 先认一个本席位的协议违规：认领了却没发认领评论

domain:cli 执行 PM 席位（#6024） · 会话 session_01TvqBFLRzXdSPcbusDoED9k。

立本卡后我做了 assign + 换标签，然后直接派发了 dev —— ⛔ 没有发认领评论。dev 接卡时发现了并如实报回：「the card was assigned but carried NO claim comment when I picked it up」。

规则原文是三件事，不是两件：assign 加一条带会话 ID 与分支名的认领评论，再回读评论做竞态复核。而"所有 agent 共用一个 GitHub 身份"正是这条规则存在的原因 —— assignee 字段本身无法告诉任何人这个认领是谁的。⇒ 我漏掉的恰好是那条唯一能标识认领者的证据。

⚠️ 本次实测无损（无第二个席位介入，dev 按指令继续），但 ⛔ 无损不等于没违规。⭐ 而且我今天整天在别人的卡上执行这条纪律，自己在新立并自派的卡上漏了它 —— 因为立卡和派发是同一个动作流，认领那步在心里被当成"已经做过了"。

补记，格式与当时应有的一致：

Claim: domain:cli 执行 PM 席位（#6024） · 会话 session_01TvqBFLRzXdSPcbusDoED9k · 分支 claude/issue-13411-authz-ratchet-route-population

---

⭐ 停手条件正确触发了 —— 这是本轮最有价值的结果

派发令写的是：「若实测发现那两份 route ledger 并不覆盖本棘轮需要的 population ⇒ 停手回报，⛔ 不要退回去加宽正则当作次优解」。

dev 测出来的结果比"不覆盖"更精确：ledger 覆盖路由覆盖得很好（rest-route-ledger.ts 94 行 / 19 个 family，route-ledger.ts 80 行 / 21 个 domain，全仓另有九份 ledger 共 290 行），但它们供不了这道棘轮要的那个保证，三条各自独立充分的理由：

① ledger 里根本没有「是否加门」这个概念。 它的 disposition 判的是 SDK 可表达性（REST sdk 84 / server-only 7 / public 3）。把 8 条没有 enforceAuth 的 REST 挂载拿去对 ledger，得到 server-only 3 / public 3 / sdk 2 —— ⭐ 而那 2 条 sdk 里有一条就是 GET /api/v1/ui/view/:object/:type，本 population 里唯一被实测为未加门的那条路由，在 ledger 里与另外 83 条已加门的 sdk 行形状完全相同。⇒ 今天的 ledger 没有能力告诉复核者这一条不一样。

② 从源码语法推「是否加门」是不安全的。 扫全部 80 个 this.routeManager.register( 站点找 enforceAuth，读到 50 加门 / 30 未加门 —— 而那 30 条里 22 条是假的：registerMetadataEndpoints 把 19 条内层路由包在一次 guardedRouteManager 替换里，registerSecurityExplainEndpoints 把 handler const 共享在它 3 个 register( 调用之外。⇒ 在最大的那个 registrar 上，假未加门率 73%。⭐ 这条读数本身就是对"加宽正则"那条路的证伪：它会把一个可见的缺口换成一句写下来的假保证。

③ ledger 比源码晚一个加门步。 Leg A 的变异改的是 rest-server.ts、从不碰 ledger ⇒ 任何以 ledger 为 population 的方案，在它必须抓住的那次变异上都会让 authz-conformance 保持绿；红会落到 rest-route-ledger.conformance.test.ts —— 另一道门、另一个承诺。

⇒ dev 没有动 population（探针没加、没删、没重指、没加宽），只交付了与 population 无关的那一半。⭐ 这是对的：三条理由里任何一条成立，"照 ledger 接上去"就会产出一个看起来更好、实际更差的保证。

---

⇒ 转 needs-user-decision

剩下的是本卡的中心可交付物，而它是一个人工地板上的判断：它决定这道 authz 棘轮承诺什么。dev 给了六个选项与四棱推荐（推荐 F 分阶段、B 作为当下一步），并明确说「a maintainer call, not mine」——本席同意。

六个选项（dev 已测，⛔ 我不代裁）

	做什么	代价
A	路由粒度、取自 ledger：每行一个键	~174 个键都要分类。⚠️ #13260 的分诊已明令禁止批量分类，那时只有 16 个。且 Leg A 仍绿
B	family/domain 粒度、取自 ledger	~40 键（~31 新 UNCLASSIFIED）。⭐ 自动生长、不会腐烂、顺带解决 #13376。⚠️ Leg A 仍绿 ⇒ matrix 头部那句话必须收窄
C	registrar 粒度、取自源码（#13260 草拟的形状）	~32 键。最便宜，⚠️ 但实测解决不了文件选择那一层（#13376），Leg A 也仍绿
D	两道门复合：本棘轮只管 gate/tripwire，authz 分类要求落在 ledger 自己的包里	几乎零新机制，⚠️ 但改变 matrix 头部所述的承诺，且把保证拆到两个包
E	从源码语法推「gated」	⛔ 已测并否决：73% 假未加门。会把可见缺口换成写下来的假保证
F	给 ledger 行加一个 authz disposition 字段，完全照 responseSchema 在同一文件里已有的分阶段模式	可选、只在有 conformance 覆盖处填、shrink-only、later ratchet。⭐ 让「是否加门」成为生产者侧被复核过的声明事实，而不是消费者侧的语法猜测

⭐ dev 推荐 F 的核心论证值得原样转达，因为它不是按成本选的：

真实需求不是「枚举路由」（ledger 已经做到了），而是一条路由落地时它的 authz 姿态会被复核 —— 而 ledger 已经是那个「新路由不带一个被复核过的 disposition 就过不去」的唯一地方。

⇒ 而决定 D 与 F 的那一棱是「让 AI 写的元数据应用难以出错」：D 之下姿态仍是推断的；F 之下你加一条路由就必须说清楚是什么在守它。⭐ 那条实测就是论据 —— GET /ui/view/:object/:type 被判为 sdk、与 83 条已加门的 sdk 行形状相同，这正是一条 AI 写出来的路由会继承的、静默的错误默认值。

⚠️ F 之所以“不算过度设计”，只因为那个分阶段模式已经存在并且已被裁过：responseSchema 在同一个文件里被明确裁为不批量生产、随 family 有覆盖再填、"no coverage, no fill"。⇒ 复用它不新增机制、不新增投机面。

第二个待判（dev 建议与上一条同一次裁决，⛔ 不要分开）

matrix 头部那句路由完备性的话要不要收窄？ 除 A 之外每个选项都会让它言过其实。dev 刻意没改它，因为改了就等于预判了 A vs B/C/D。⚠️ 并提醒：#13260 已确立在一个已测量的缺口上引 caveat 会把它变成一句写下来的非答案 ⇒ ⛔ 除非缺口同时带日期和规模，否则不要走"加个 caveat"那条。

低摩擦裁决格式：回「F 分阶段（B 先行）」（dev 与本席推荐）/「B」/「C」/「D」/「A」/「先只收窄头部那句话，population 押后」。

---

已交付的那一半（与 population 无关，⛔ 不预判上面的裁决）

本席独立核验，非转述：change set 恰好 4 个文件，全在 packages/qa/dogfood/test/。PROBES 的 file: 条目 base 16 / PR 16 ⇒ population 确实没动。盲区总数 BLIND_SPOT_TOTAL_STATIC=75 / RUNTIME=80 未变 —— 与"这次不关闭路由盲区"一致。

• 三种探针的分类从注释变成了表里的数据（3 ROUTE_ENUMERATION / 6 GATE_PIN / 7 TRIPWIRE），由 census 反向导出并断言 ⇒ ⛔ 它不再是一段会腐烂的散文。
• ⭐ checkProbeInstrumentIntegrity —— 一个 ROUTE_ENUMERATION 或 GATE_PIN 探针铸出零个键现在会以 DEAD PROBE 失败。⭐ 这关掉的是 UNCLASSIFIED 与 STALE 都够不到的那条机制：那两者都以「某个键」为支点（一个是键出现、一个是键消失），而一个从来不铸键的探针两边都不触发 —— 正是 data:hono-plugin.ts 沉默七个月的原因。
• 那条死探针被重新声明为 TRIPWIRE 并带上日期证据，⛔ 没有删 —— 删了会让门看得更少。
• matrix 头部 15 → 16，且 census 的钉从 not.toBe（记录漂移）反转为 toBe（漂移已闭合并被断言）。

Leg A 是绿的，而 dev 把这个负面结果当成本轮最重要的读数报出来 —— ⭐ 这一点我要明确表扬：它没有把"我修了一部分"说成"缺口小了"。往 registerUiEndpoints 注入未加门路由后，authz-conformance.test.ts 33 项 0 失败、依然绿，与 PR #13369 的读数逐字一致。⇒ 缺口原封不动，等上面的裁决。

Leg B：新检查在同一次回归上独立触发 ⇒ 那个回归现在有两个信号而不是一个。Leg C：那条在 origin/main 上沉默的条件，现在会响。

⚠️ dev 还诚实报了 Leg C 的第一次尝试测量失败（用全文件计数当落地判据，与新用例的字符串撞了，脚本按设计中止、trap 干净还原），并明说「that attempt measured nothing and is reported rather than quietly re-run」。⭐ 一次中止的消融被如实记为"没测到"，而不是悄悄重跑当没发生。

⭐ 它还把派发令里的一处冲突报了上来而没有默默照做：派发令写的是 Fixes #13411，但既然 population 的裁决还欠着，它用了 Part of —— 合并不会把这张卡从待办里退休掉。这个判断是对的，⛔ 我的派发令那一处是错的。

Generated by Claude Code

---

Generated by Claude Code