Blocked-by: #9652
QA-source: #9401 · identity-auth.admin-lifecycle-operations · C0–C7, C9
The Tier-1 pinned sweep (#9401) found this item's pin (admin-identity-audit-trail, 3/3 green) covers exactly one clause (C8, audit-log shapes). Security-priority per the maintainer's 2026-08-18 approval of the QA landing plan.
Unpinned clauses to cover with real tests
From the run record's gap list: ban persistence/reversal · password rotation · explicit-password-wins · set-role flipping gate outcomes · revoke-user-sessions mid-flight · owner_id FK clear on user removal · impersonation attribution + console visibility · non-admin refusal of every /admin/ route (both sides, server-asserted).
The last clause is the highest-value single test: a route-walking probe that asserts every admin surface refuses a non-admin principal is exactly the shape that catches a silently unguarded new route.
Acceptance: tests land in the package owning the admin surface (likely plugin-auth or packages/qa/dogfood — triage to confirm lane); the item's automated.ref is extended so the next Tier-1 run scores it honestly.
Status after PR #9664 (2026-08-18)
PR #9664 landed as Part of, not Fixes — it pins C1, C2 and C9's refusal half, and re-scopes the item's automated.ref honestly. It deliberately does not close this card.
Remaining, and why:
| clause | state |
|---|
| C1, C2, C9 (refusal half) | ✅ pinned by #9664 |
| C8 | ✅ already pinned |
| C7 — console impersonation indicator | manual by construction (screenshot oracle) |
| C0, C3, C4, C5, C6, C9's allowed half | ⛔ blocked on #9652 |
#9652: better-auth's admin plugin authorizes on the legacy user.role === 'admin' scalar that ADR-0068 D2 deliberately stopped synthesizing, so those routes refuse the platform admin himself. Pinning those clauses would require changing an admin route's behaviour — a security/authorization decision, not a test-authoring one.
Blocked-by: #9652
QA-source: #9401 · identity-auth.admin-lifecycle-operations · C0–C7, C9
The Tier-1 pinned sweep (#9401) found this item's pin (
admin-identity-audit-trail, 3/3 green) covers exactly one clause (C8, audit-log shapes). Security-priority per the maintainer's 2026-08-18 approval of the QA landing plan.Unpinned clauses to cover with real tests
From the run record's gap list: ban persistence/reversal · password rotation · explicit-password-wins · set-role flipping gate outcomes · revoke-user-sessions mid-flight · owner_id FK clear on user removal · impersonation attribution + console visibility · non-admin refusal of every
/admin/route (both sides, server-asserted).The last clause is the highest-value single test: a route-walking probe that asserts every admin surface refuses a non-admin principal is exactly the shape that catches a silently unguarded new route.
Acceptance: tests land in the package owning the admin surface (likely
plugin-authorpackages/qa/dogfood— triage to confirm lane); the item'sautomated.refis extended so the next Tier-1 run scores it honestly.Status after PR #9664 (2026-08-18)
PR #9664 landed as
Part of, notFixes— it pins C1, C2 and C9's refusal half, and re-scopes the item'sautomated.refhonestly. It deliberately does not close this card.Remaining, and why:
#9652: better-auth's admin plugin authorizes on the legacy
user.role === 'admin'scalar that ADR-0068 D2 deliberately stopped synthesizing, so those routes refuse the platform admin himself. Pinning those clauses would require changing an admin route's behaviour — a security/authorization decision, not a test-authoring one.