Filed unassigned and unlabelled for triage routing by the dev seat on #9055 (session session_011RB4waLuNbdruCo6X9oobm), branch claude/issue-9055-realtime-authz-ci-claim. Not a claim — measured while re-deriving the tripwire population for #9055, which is fenced prose-only.
The gap
The fifth #2992 transport tripwire in packages/qa/dogfood/test/authz-conformance.test.ts watches packages/rest/src/rest-server.ts for a route literal containing /realtime:
{file: 'packages/rest/src/rest-server.ts',re: /['"`][^'"`]*\/realtime[^'"`]*['"`]/g,key: ()=>'realtime:rest-server.ts:route(TRANSPORT-WIRED)',}Its comment reasons from today's emptiness: "packages/rest/src has ZERO realtime refs today (#2992) — a /realtime route literal appearing there is a subscribe endpoint."
But the endpoints the protocol page actually documents as the planned transports are not spelled /realtime. content/docs/protocol/kernel/realtime-protocol.mdx:13:
no WebSocket (/ws) or SSE (/api/v1/stream) transport is wired up yet
Neither '/ws' nor '/api/v1/stream' contains /realtime, so mounting either in rest-server.ts produces no key, no UNCLASSIFIED surface, and no CI failure. The only documented path the pattern does match is /api/v1/realtime/events — the planned debug/event-log endpoint (page section "Server-Side Events"), i.e. the one realtime route that carries no subscription fan-out.
So the tripwire is aimed at the least dangerous of the three documented paths and blind to the two that actually deliver events to end users.
Measured on origin/main2cb69c31c
packages/rest/src/rest-server.ts today: zero /realtime literals, zero /api/v1/stream, zero '/ws', zero text/event-stream. (Its 31 occurrences of the substring "stream" are unrelated response-streaming code, none inside a route literal.) The probe matches nothing today, as intended — the defect is which future spellings it would catch.
Why it matters
The other four tripwires key off transport mechanics (handleUpgrade, new WebSocketServer, text/event-stream, new WebSocket, new EventSource) and so fire on the act of wiring regardless of naming. This one keys off a path spelling that the project's own documentation contradicts. A reviewer reading the tripwire list would reasonably conclude rest-server.ts is covered.
Live the moment #8347 (WS/SSE transport, scheduled v18) mounts a route.
Possible direction (not a ruling)
Widen the pattern to the transport mechanics rather than one path spelling — e.g. also match text/event-stream, an SSE content-type write, an upgrade handler, or the documented /ws and /api/v1/stream literals. Gate behaviour is the matrix owner's call, so filing rather than patching.
Related: #9055 (the prose claim, PR #9082) · #9083 (sibling gap: classification by the experimental row is accepted) · #8347 (transport, v18) · ADR-0096 D4 · framework#2992.
Filed unassigned and unlabelled for triage routing by the dev seat on #9055 (session
session_011RB4waLuNbdruCo6X9oobm), branchclaude/issue-9055-realtime-authz-ci-claim. Not a claim — measured while re-deriving the tripwire population for #9055, which is fenced prose-only.The gap
The fifth
#2992transport tripwire inpackages/qa/dogfood/test/authz-conformance.test.tswatchespackages/rest/src/rest-server.tsfor a route literal containing/realtime:Its comment reasons from today's emptiness: "packages/rest/src has ZERO realtime refs today (#2992) — a
/realtimeroute literal appearing there is a subscribe endpoint."But the endpoints the protocol page actually documents as the planned transports are not spelled
/realtime.content/docs/protocol/kernel/realtime-protocol.mdx:13:Neither
'/ws'nor'/api/v1/stream'contains/realtime, so mounting either inrest-server.tsproduces no key, no UNCLASSIFIED surface, and no CI failure. The only documented path the pattern does match is/api/v1/realtime/events— the planned debug/event-log endpoint (page section "Server-Side Events"), i.e. the one realtime route that carries no subscription fan-out.So the tripwire is aimed at the least dangerous of the three documented paths and blind to the two that actually deliver events to end users.
Measured on
origin/main2cb69c31cpackages/rest/src/rest-server.tstoday: zero/realtimeliterals, zero/api/v1/stream, zero'/ws', zerotext/event-stream. (Its 31 occurrences of the substring "stream" are unrelated response-streaming code, none inside a route literal.) The probe matches nothing today, as intended — the defect is which future spellings it would catch.Why it matters
The other four tripwires key off transport mechanics (
handleUpgrade,new WebSocketServer,text/event-stream,new WebSocket,new EventSource) and so fire on the act of wiring regardless of naming. This one keys off a path spelling that the project's own documentation contradicts. A reviewer reading the tripwire list would reasonably concluderest-server.tsis covered.Live the moment #8347 (WS/SSE transport, scheduled v18) mounts a route.
Possible direction (not a ruling)
Widen the pattern to the transport mechanics rather than one path spelling — e.g. also match
text/event-stream, an SSE content-type write, an upgrade handler, or the documented/wsand/api/v1/streamliterals. Gate behaviour is the matrix owner's call, so filing rather than patching.Related: #9055 (the prose claim, PR #9082) · #9083 (sibling gap: classification by the experimental row is accepted) · #8347 (transport, v18) · ADR-0096 D4 · framework#2992.