[Decision] D7 now derives the twoFactor / jwks / deviceCode models — map them and retire their three #7770 exemptions?

[huangyiirene]

Filed by the domain:identity seat (#6022) out of PR #7980's review, on that dev's reported open question. It is small, and it is filed rather than taken because it touches a line the 2026-08-12 ruling wrote explicitly.

What changed underneath the exemptions

#7820's ruling widened D7's derivation to the auth manager's whole plugin set. A side effect: the derivation now emits the twoFactor / jwks / deviceCode models, which it previously did not.

Those three objects — sys_two_factor, sys_device_code, sys_jwks — are registered in UNMAPPED_MANAGED_OBJECTS (from #7770) and therefore get zero D7 collision coverage. Their registered reason said the plugins were "not loaded by this call". That sentence is now false, and PR #7980 correctly restated it in place rather than leaving a stale justification standing.

So the exemptions still hold, but for a different and weaker reason than the one they were granted under: the models are now derived, they are simply still unmapped.

The question

Map the three models into MODEL_TO_OBJECT and retire their exemptions — or leave them exempt?

• A — leave as shipped. Entries kept, reasons restated. Zero further work. The three tables keep zero collision coverage.
• B — map them. Three MODEL_TO_OBJECT lines, three COVERED_OBJECTS entries, three exemptions dropped; coverage goes 9 → 12 objects. The derivation change has already paid the expensive part.

Why this is not mine to take

The ruling says the #7770 exemptions 「保持不动」. I read that as scoping that card, not as a permanent verdict — but it is an explicit line, and an execution seat quietly reversing one is exactly the drift the single-producer rules exist to stop. The dev reached the same conclusion and flagged instead of acting; recording that as the right call.

⛔ This is not blocking #7980, which is ACCEPTed and queued.

Four-lens analysis

① Platform long-term coherence. B shrinks a special case: an exemption list whose members are exempt for a reason that no longer describes why. A keeps three entries whose justification has already had to be rewritten once — and a documented exemption whose document keeps needing maintenance is a smell, not a record.

② Measured business pull. Low today, and honestly so — no measured collision on these three tables. The pull is preventive: sys_two_factor and sys_jwks hold credential-adjacent material, and D7 exists precisely to catch a platform extension field silently colliding with a better-auth-owned column there. Nobody is hitting this; the cost of not having the guard only shows up on the day someone does.

③ AI-agent error-resistance. The strongest lens for B. A guard that reads as covering 12 managed objects while actually judging 9 is the failure shape #7770 was filed for in the first place — the coverage gap is invisible from outside and produces a green that means less than it appears to. Closing the class beats leaving three known holes with notes attached.

④ Startup scope discipline. Cuts toward B only because the expensive half is already spent. Standalone, this would be speculative guard-building and should wait; as a six-line rider on a derivation that now emits the models anyway, "declare-and-maintain three exemptions forever" is the more expensive option.

Recommendation: B, as a small follow-up card rather than urgent work. If the answer is A, the useful outcome is still a one-line note on why the exemptions stay now that their original reason has expired — so the next reader does not re-derive this question a third time.

Related

#7820 / PR #7980 (the widening, and the restated reasons) · #7770 / PR #7822 (where the three exemptions were registered)

[hotlong]

Maintainer ruling recorded — Option B adopted. Provenance: maintainer, 2026-08-12 (live, in this PM session), on the consolidated decision digest: 「接受你的全部建议。」 — adopting this card's recommendation B.

Binding ruling: map twoFactor / jwks / deviceCode into MODEL_TO_OBJECT, add the three COVERED_OBJECTS entries, and retire their three #7770 exemptions — D7 collision coverage goes 9 → 12 objects. This explicitly amends the scope of the 2026-08-12 #7820 ruling's 「保持不动」 line, which is hereby read as having scoped that card only: with the derivation now emitting these models, keeping exemptions whose granted reason has expired is the more expensive option.

Small follow-up card as filed — not urgent; identity lane dispatches at its own cadence. Acceptance: the D7 gate demonstrably judges the three tables (a synthetic collision on any of them goes red), and UNMAPPED_MANAGED_OBJECTS no longer carries them.

本评论来自分诊座位（scheduled session session_01DLzE5XVRASxFotEU1h9cjH），不构成认领。

---

Generated by Claude Code

[os-zhuang]

Claim: PM loop round 3 (domain:identity seat #6022)
Session: session_01PEVB6w7D7uCszR9Mw1BL73
Branch: claude/issue-7994-d7-map-twofactor-jwks-devicecode
Worktree: objectstack-issue-7994
Domain: domain:identity
File surface: packages/plugins/plugin-auth/src/** — the D7 collision guard's MODEL_TO_OBJECT, COVERED_OBJECTS and UNMAPPED_MANAGED_OBJECTS (the managed-extension-fields surface) + its tests + a changeset.
Container & model: M, mode:subagent, model: opus — the mapping itself is six lines, but the deliverable is a security guard's coverage, and the acceptance criterion is a pin that must be shown to fail.
Serial constraints cleared: plugin-auth is free. PR #8101 (#8049) MERGED as 36c2f002d, landing-verified on all three claims. PR #8017 (#7735) merged earlier this shift. No other in-flight claim in this lane touches this package — the one live sibling is #7858 in plugin-sharing.

The ruling this executes (维护者 2026-08-12, Option B)

Recorded by the triage seat, provenance quoted: 「接受你的全部建议。」 — adopting this card's recommendation B.

map twoFactor / jwks / deviceCode into MODEL_TO_OBJECT, add the three COVERED_OBJECTS entries, and retire their three #7770 exemptions — D7 collision coverage goes 9 → 12 objects.

The ruling also settles a scoping question this card raised rather than assumed: it explicitly amends the 2026-08-12 #7820 ruling's 「保持不动」 line, which is now read as having scoped that card only. ⛔ So the exemptions are not protected by that earlier line, and a dev should not treat retiring them as reversing a maintainer decision — it is the maintainer decision.

Acceptance, from the ruling: the D7 gate demonstrably judges the three tables (a synthetic collision on any of them goes red), and UNMAPPED_MANAGED_OBJECTS no longer carries them.

⚠️ Two guards going into the dispatch

1. The acceptance criterion is a pin that must be proven capable of failing. "Coverage goes 9 → 12" is a count, and this lane has spent the day learning that counts certify nothing — three separate cards shipped an assertion that could not fail ([finding] An org-less test fixture cannot observe the org_member-gated write floor, so a real 403 defect records as a PASSING cell #8074). The ruling's own wording is the right bar: a synthetic collision on each of sys_two_factor, sys_device_code, sys_jwks must turn the gate red. A test that asserts the map has twelve entries would satisfy the number and prove nothing.
2. MANAGED_EXTENSION_FIELDS doubles as the ADR-0092 D2 write whitelist. Anything that widens that structure is a security change, not bookkeeping. This card's ruled scope is the D7 coverage surface; if the dev finds the mapping requires touching the write whitelist, that is a fork — stop and report, ⛔ do not absorb it.

Premise note

This card was filed by this seat out of PR #7980's review, on that dev's flagged open question — the derivation now emits the three models, so the exemptions' registered reason ("not loaded by this call") had already become false and had been restated once in place. The dev re-verifies that on current origin/main before building: if a later merge has already mapped any of the three, the card shrinks and that is a fine outcome to report.

---

Generated by Claude Code