fix(plugin-auth): SCIM active:false disables the account again — route the vendor's reconcileUser hook to the platform ban write (#14360)

[claude]

Fixes#14360

What this does

Stable @better-auth/scim (1.7.0 and later; the repo pins and installs 1.7.2) no longer writes the admin plugin's banned column when an identity provider sends active: false — it hands the user's aggregate lifecycle state to an OPTIONAL host callback, identity.reconcileUser, and then only revokes sessions. plugin-auth passed no identity member, so a deactivation revoked sessions and wrote nothing: sys_user.banned stayed false and a user holding a local password signed straight back in, while ADR-0071, the generated docs and the #13816 construction-time refusal all asserted the ban.

Limb A of the triage ruling, and only limb A:

• auth-manager.ts — the scim({...}) options gain identity.reconcileUser, routed to a new private method reconcileScimUserLifecycle that reads the user through the vendor's transaction-bound adapter and reconciles: active: false on a row that is not banned ⇒ the platform ban write (reason Deactivated via SCIM, the exact string the vendor wrote itself through 1.6.x; no expiry), and on a row already banned WITH an expiry (an administrator's timed ban) ⇒ the ban is made permanent (banExpires cleared, banned and the administrator's reason untouched — the vendor's session hook auto-lifts an expired ban and would otherwise admit a principal the IdP still holds deactivated); active: true on a row banned WITH that reason ⇒ unban; anything else is a no-op (the callback is contractually idempotent and the vendor calls it on EVERY user mutation).
• user-ban-write.ts (new, PACKAGE-INTERNAL — not re-exported from src/index.ts) holds the existing /admin/ban-user / /admin/unban-user write as applyUserBan / applyUserUnban over a minimal UserBanWriter surface; admin-ban-endpoints.ts and the SCIM hook both call that ONE write (field for field the vendor's own banUser shape). No new HTTP endpoint, no new public symbol. The admin mount's behaviour is unchanged (its own suite: 88/88 across the six ban-adjacent files).
• New end-to-end suite scim-deactivation-reconcile-user.test.ts driving @better-auth/scim itself through a real AuthManager over better-sqlite3 (the simulated deprovision() helper in last-admin-guard.test.ts is NOT extended, per triage).
• One changeset for @objectstack/plugin-auth, level patch (see Contract review).

Admin forcing untouched (admin: pluginConfig.admin ?? scimEffective at three sites) — that is the #13816 shape-1 follow-up, not this card. The five stale assertion sites triage listed are untouched and are true again under this change.

Premise (re-verified on origin/main00ff228fe with the package installed)

1. grep -ro "ban" node_modules/@better-auth/scim/dist | wc -l = 0; positive control over node_modules/better-auth/dist/plugins/admin = 117. dist/index.d.mts:267 declares reconcileUser?(input: SCIMIdentityState, context: SCIMTransactionContext); SCIMIdentityState carries userId, the aggregate active (true while ANY participating SCIM source is active), profileSourceId and sources; SCIMTransactionContext carries only database (the DBTransactionAdapter). A throw from the hook: runSCIMApplicationCallback rethrows a better-auth APIError unchanged and wraps anything else as a SCIM 500 with detail SCIM identity reconciliation failed and the original as cause — never swallowed.
2. auth-manager.ts:3265 handed scim() exactly connections: [] and authentication.verifyBearerToken; repo-wide reconcileUser = 0 hits (control verifyBearerToken = 15).
3. admin-ban-endpoints.ts owns the platform ban write and re-runs the last-LOCAL-credential guard; the last-ADMINISTRATOR guard (ADR-0024 D5.2, plugin-auth: break-glass 守卫 —— SCIM/ban 不得停用最后一个管理员(ADR-0024 D5.2,cloud#621 转入) #5892) is an ENGINE beforeUpdate hook in last-admin-guard.ts, registered by auth-plugin.ts at kernel:ready, so it holds on every banned write regardless of caller. Both writes were endpoint-shaped (they parsed a Request); the write itself is now a plain callable.
4. The forced admin plugin supplies the banned column and the sign-in refusal: better-auth/dist/plugins/admin/admin.mjs:36-47 reads user?.banned in the session.create hook and throws FORBIDDEN / BANNED_USER.

PM hypotheses

• H1 — proven with a correction. The vendor invokes the callback inside its runIdentityMutationTransaction with enough identity (userId + aggregate active) to drive the ban write; active: false ⇒ ban with the SCIM reason, active: true ⇒ unban — but only of a ban carrying the SCIM reason. An administrator's ban (any other reason) is deliberately NOT lifted by the IdP: every SCIM PUT carries active: true, so unconditional reconciliation would re-admit a user banned for cause on the next attribute sync. Pinned in face (d). Listed as an open question below in case the maintainer wants IdP-authoritative semantics instead.
• H2 — proven, with a measured residual filed separately. The guard's refusal is LOUD through SCIM: HTTP 403 with the SCIM 2.0 error envelope (schemas contains the Error URN, status: "403", detail = the guard's own text naming last administrator, ADR-0024 D5.2 and SCIM deprovision is too broad); the ban never lands and the administrator still signs in. Residual: the vendor's OWN scimUser.active = false write, made before the callback inside what it believes is a transaction, survives the refusal — because the adapter's SCIM: 停在 @better-auth/scim rc.1,等正式版再整体迁移 —— rc.2 换掉了整套模型 #3653 SCIM transaction scoping never opens an engine transaction on 1.7.2 (measured: 0 engine.transaction and 0 driver.beginTransaction calls across a SCIM POST + PATCH; inScimRequestScope() false at every sys_user / sys_scim_user write). That is a pre-existing defect outside this card's file surface, filed as SCIM provisioning writes run outside any engine transaction on @better-auth/scim 1.7.2 — the #3653 scimRequestScope stamped in verifyBearerToken is not observed at write time (0 engine.transaction calls across POST + PATCH /Users) #14522 (out of scope here); face (c) pins the residual as observed (line 487 on this head) so SCIM provisioning writes run outside any engine transaction on @better-auth/scim 1.7.2 — the #3653 scimRequestScope stamped in verifyBearerToken is not observed at write time (0 engine.transaction calls across POST + PATCH /Users) #14522's landing flips that line deliberately. Operator-visible consequence of that residual: after a refused last-administrator deactivation, every later SCIM mutation of that user — an attribute-only PATCH included — re-attempts the ban and answers 403 until the IdP sends active: true for that user or a second administrator exists (it refuses rather than admits; stated on SCIM provisioning writes run outside any engine transaction on @better-auth/scim 1.7.2 — the #3653 scimRequestScope stamped in verifyBearerToken is not observed at write time (0 engine.transaction calls across POST + PATCH /Users) #14522 as well).
• H3 — proven. No change to the admin-forcing sites was needed; the forced plugin already supplies the column and the refusal (face (a) shows the refusal firing on a SCIM-banned row).

One consequence stated rather than left implicit: on 1.7.2 a SCIM DELETE /Users/{id} tombstones the source instead of deleting the better-auth user, so the aggregate state turns inactive and the hook disables that account (face (f)); re-provisioning through the tombstone re-links the same user and the SCIM ban is lifted.

Tests (head 21c7dbe76)

• pnpm --filter @objectstack/plugin-auth exec vitest run --maxWorkers=2 src/scim-deactivation-reconcile-user.test.ts + the five ban-adjacent siblings (admin-ban-endpoints, admin-remove-user-gate-ordering, break-glass-guard-self-service-target, break-glass-local-credential, session-tombstone) — Test Files 6 passed (6) · Tests 88 passed (88), VERDICT command-exit 0.
• The six SCIM-adjacent siblings (auth-manager, better-auth-schema-parity, credential-at-rest-posture, last-admin-guard, managed-extension-fields, scim-case-insensitive-identifier) — Test Files 6 passed (6) · Tests 469 passed (469), VERDICT command-exit 0.
• tsc --noEmit (src program) exit 0; pnpm --filter @objectstack/plugin-auth check:test-typecheck — OK — the test layer compiles under tsconfig.test.json (the new test file is in that program; the src program excludes tests by design). The tsconfig.examples.json half of the typecheck script resolves the package's own dist types, which this worktree has not built — NOT MEASURED locally; CI builds it.
• Reverse verification on the committed tree (round-1 head 51000d482; the wiring line it removes is unchanged on 21c7dbe76, so the reading was not re-run) (scratchpad/issue-14360/ablation.sh, trap-restored): removed the three-line identity member from the scim() options — proven on disk (marker count 1 → 0, git diff --stat = 3 deletions) — and ran the suite: 6 red / 3 green, exactly (a), (b), the idempotency case, (c) [the request answers 200 instead of the guard's 403], the (c) positive control and (f) red; (d) attribute-only, (d) administrator-ban and (e) green. Restore via git checkout HEAD -- path: git diff HEAD empty, disk blob = HEAD blob e9d5c5eb…, marker count back to 1. No dist rebuild is involved: the suite imports ./auth-manager.js from src, and no workspace dependency was mutated.

Gates (head 21c7dbe76)

node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands derived 36 commands from the changeset (re-derived on 21c7dbe76 after the changed-file set grew by user-ban-write.ts: identical list); each run at 21c7dbe76 with its exit captured before any pipe. 33 green, including check-system-context-census (OK — 109 elevation read sites … all anchored; 0 anchors on the two edited files, no census fix needed), check:cross-package-test-inputs, check:test-source-alias, check:engine-double-contract, check:logger-receiver-detach, check-adr-0087-registration (non-breaking changeset), check-changeset-no-major. Three answered exit 3 = PREREQUISITE NOT MET by their own verdict text, recorded as NOT MEASURED locally (CI owns them): check-test-completeness (needs a saved turbo test log), check:dual-build-cjs-loads (needs pnpm build), check:type-check-debt (needs the full built closure). Control-character self-scan over the four changed files: clean.

Contract review (Clause ②)

• Behaviour change, as accept/reject: a principal an identity provider has deactivated over SCIM (active: false, or deleted) is now REJECTED at sign-in with the vendor's 403 BANNED_USER (before: sessions revoked, sign-in ACCEPTED); an IdP active: true re-ACCEPTS a principal whose ban carries the SCIM reason (an administrator's ban stays a rejection). Deactivating the last administrator over SCIM is REJECTED with a 403 SCIM error (before: accepted, disabling nothing).
• Exported-symbol delta (git diff -U0 00ff228fe...HEAD | grep -E '^[+-].*\bexport\b'): five export lines, ALL in the new package-internal module packages/plugins/plugin-auth/src/user-ban-write.ts (UserBanWriter, UserBanFields, SCIM_DEACTIVATION_BAN_REASON, applyUserBan, applyUserUnban). NO new export is reachable through src/index.ts: the barrel is untouched (84 lines before and after, zero references to user-ban-write), and the same grep over admin-ban-endpoints.ts, auth-manager.ts and index.ts prints nothing. No removals, no signature changes to existing exports. The scim() options gain the vendor's identity member (not an ObjectStack-authored config key).
• Changeset level:patch — a bug fix restoring the declared behaviour with no new public symbol. Clause-② stays yes: sign-in accept/reject changes for a class of principals; the needs:contract-review carriers stay on the card and the PR.
• Log levels: no new log site of any level; the last-admin refusal is an error RESPONSE through the vendor's SCIM error mapping.

Out of scope, filed

• SCIM provisioning writes run outside any engine transaction on @better-auth/scim 1.7.2 — the #3653 scimRequestScope stamped in verifyBearerToken is not observed at write time (0 engine.transaction calls across POST + PATCH /Users) #14522 — SCIM provisioning writes run outside any engine transaction on 1.7.2 (the SCIM: 停在 @better-auth/scim rc.1,等正式版再整体迁移 —— rc.2 换掉了整套模型 #3653scimRequestScope stamped in verifyBearerToken is not observed at write time). Unassigned; the residual it leaves on a refused deactivation is pinned in face (c) of the new suite (line 487), and the post-refusal behaviour above is posted on that card.

Patch round 2 (head 21c7dbe76) — the in-seat contract review's round-1 verdict, item by item

• A (blocking finding 1 — implemented exactly as written).reconcileScimUserLifecycle reads banExpires too; in the !state.active branch a banned row with a non-null expiry gets { banExpires: null, updatedAt } and returns, otherwise returns — banned and the administrator's banReason untouched. Docblock first bullet and the changeset sentence say a deactivation also makes an existing expiring ban permanent. New face under (d): administrator ban with ban_expires 1.5s ahead, PATCH active: false → 200, expiry cleared and reason kept, then after the expiry has passed sign-in still answers 403 BANNED_USER (status AND code).
• B (note 1, required). Shared write moved to the non-barrelled user-ban-write.ts; admin-ban-endpoints.ts, auth-manager.ts and the suite import it. Barrel export surface unchanged; changeset patch; the "New exports" paragraph removed.
• C (notes 2, 3, 4, 6, 7). (2) changeset: the last-LOCAL-credential guard is deliberately not applied on the SCIM path — an IdP deprovision can disable the last password-holding account while non-administrator SSO users remain. (3) marker collision documented in the method docblock and the changeset (an administrator who types Deactivated via SCIM produces a ban the IdP can lift); the string is NOT reserved on the admin mount. (4) post-refusal behaviour stated above and on SCIM provisioning writes run outside any engine transaction on @better-auth/scim 1.7.2 — the #3653 scimRequestScope stamped in verifyBearerToken is not observed at write time (0 engine.transaction calls across POST + PATCH /Users) #14522. (6) new face (g): POST /Users with active: false provisions the account disabled — banned with the SCIM reason, sign-in 403 BANNED_USER. (7) SCIM provisioning writes run outside any engine transaction on @better-auth/scim 1.7.2 — the #3653 scimRequestScope stamped in verifyBearerToken is not observed at write time (0 engine.transaction calls across POST + PATCH /Users) #14522 carries the line-487 pin citation.
• D (verification at 21c7dbe76, verify-lock sessions each under the cap, exits before any pipe). New suite + five ban-adjacent siblings: Test Files 6 passed (6) · Tests 88 passed (88), VERDICT command-exit 0. Six SCIM-adjacent siblings: Test Files 6 passed (6) · Tests 469 passed (469), VERDICT command-exit 0. tsc --noEmit exit 0 (0 errors); check:test-typecheckOK — the test layer compiles under tsconfig.test.json. Gates re-derived on 21c7dbe76 (identical 36) and all run there: 33 green, the same three prerequisite-not-met (check-test-completeness, check:dual-build-cjs-loads, check:type-check-debt). git merge-tree --write-tree --name-only origin/main HEAD after git fetch origin main (origin/main = fed4fa409): clean, no conflicted paths. GitHub mergeable_state read after the push: clean.

Session: https://claude.ai/code/session_01AUF1NoViznQK32gqpK8wS8

Generated by Claude Code

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/plugin-auth, touching 15 documentable anchor(s).

3 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/kernel/contracts/auth-service.mdx(via AuthManager (symbol, a top-level class))
• content/docs/kernel/services-checklist.mdx(via AuthManager (symbol, a top-level class))
• content/docs/permissions/authentication.mdx(via AuthManager (symbol, a top-level class))

What this run could not see

• the SDK route bridge reached 47 of 219 client-bound route-ledger rows — the other 172 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 172: 14 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 56 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 102 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 11 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json fed4fa40924bd1366354ac9b8a55db9d94a7e404 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 32800235fc78c29dffbfc4bdfd601e0028eb72ca — the merge of head 21c7dbe76b7d44df32fbd9f6497db6372b9f2d0f into base fed4fa40924bd1366354ac9b8a55db9d94a7e404, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 32800235fc78c29dffbfc4bdfd601e0028eb72ca && git checkout 32800235fc78c29dffbfc4bdfd601e0028eb72ca
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin fed4fa40924bd1366354ac9b8a55db9d94a7e404 21c7dbe76b7d44df32fbd9f6497db6372b9f2d0f && git checkout -B drift-repro fed4fa40924bd1366354ac9b8a55db9d94a7e404 && git merge --no-ff 21c7dbe76b7d44df32fbd9f6497db6372b9f2d0f
node scripts/docs-audit/affected-docs.mjs --json fed4fa40924bd1366354ac9b8a55db9d94a7e404

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs fed4fa40924bd1366354ac9b8a55db9d94a7e404 → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[os-sales]

Contract review round 1 at 51000d482: FAIL — patch round 2 in flight

The in-seat isolated Clause-② review (fable tier, transcript-verified 78/78) is posted verbatim on #14360. One blocking finding: a SCIM active: false over a row that already carries an expiring administrator ban leaves the expiry in place, so the vendor's session.create hook auto-unbans and admits the principal once the expiry passes while the identity provider still holds them deactivated. Fix (a pure tightening): on deactivation, make an existing expiring ban permanent (banExpires: null) without touching banned or the administrator's reason; one new suite face pins it.

Also taken up in the same round: the five new symbols move into a non-barrelled module so the package surface does not grow (changeset → patch; Clause-② stays yes for the sign-in accept-set change), plus one-sentence documentation of the last-LOCAL-credential guard exemption on the SCIM path, the marker-collision case, the post-refusal 403 behaviour (also noted on #14522), and a POST /Usersactive: false pin.

needs:contract-review stays on the PR and the card until a delta review passes on the patched head; the PR stays draft.

---

Generated by Claude Code

[os-sales]

Landing provenance — ready + auto-merge at head 21c7dbe76

• Card: [finding] SCIM active:false no longer disables the account — the vendor ban coupling was removed upstream in @better-auth/scim 1.7.0 and nothing in this repo replaced it #14360 (Fixes, closes on merge).
• Contract review (Clause-② yes, accept-set change for SCIM-deactivated principals): in-seat isolated fable review — round 1 FAIL at 51000d482 (14360#issuecomment-5508485458, one blocking finding), patch round 2, round 2 (delta) PASS at 21c7dbe76 (14360#issuecomment-5508938514); transcript verified 105/105 claude-fable-5-1; verdicts adopted verbatim. Provenance for clearing the carriers: the 2026-08-31 maintainer ruling that the dispatching seat completes the contract review in-seat, plus that PASS.
• Carriers: needs:contract-review removed from [finding] SCIM active:false no longer disables the account — the vendor ban coupling was removed upstream in @better-auth/scim 1.7.0 and nothing in this repo replaced it #14360 and from this PR in the same stroke, read back; node scripts/pm/check-clause2-carriers.mjs --pair 14540 → "the clause-② declaration is readable in the fixed spelling and both carriers agree", exit 0.
• Surface: 5 files, all inside the fence (auth-manager.ts, admin-ban-endpoints.ts, new package-internal user-ban-write.ts, the new suite, the changeset patch); src/index.ts byte-identical to origin/main; no packages/spec, no content/docs/releases/; admin-forcing sites untouched.
• CI on 21c7dbe76: every check green — Lint & Repo Gatessuccess at 11:26:32Z, TypeScript Type Checksuccess, Test Core (1/6)success at 11:21:56Z, aggregate Test Coresuccess; mergeable_state: clean.
• Action: draft → ready and auto-merge enabled at ~11:44Z. On MERGED: card auto-closes; strip pm:dispatched from [finding] SCIM active:false no longer disables the account — the vendor ban coupling was removed upstream in @better-auth/scim 1.7.0 and nothing in this repo replaced it #14360; the seat files one follow-up finding for the review's §5 notes 1–5 (docblock word, timed-ban face clock margin and positive control, DELETE-of-last-administrator pin, stale last-admin-guard.ts header, DELETE docblock clause). SCIM provisioning writes run outside any engine transaction on @better-auth/scim 1.7.2 — the #3653 scimRequestScope stamped in verifyBearerToken is not observed at write time (0 engine.transaction calls across POST + PATCH /Users) #14522 (SCIM writes outside an engine transaction on 1.7.2) stays with triage.

---

Generated by Claude Code

[claude]

Fixes#14360

What this does

Stable @better-auth/scim (1.7.0 and later; the repo pins and installs 1.7.2) no longer writes the admin plugin's banned column when an identity provider sends active: false — it hands the user's aggregate lifecycle state to an OPTIONAL host callback, identity.reconcileUser, and then only revokes sessions. plugin-auth passed no identity member, so a deactivation revoked sessions and wrote nothing: sys_user.banned stayed false and a user holding a local password signed straight back in, while ADR-0071, the generated docs and the #13816 construction-time refusal all asserted the ban.

Limb A of the triage ruling, and only limb A:

• auth-manager.ts — the scim({...}) options gain identity.reconcileUser, routed to a new private method reconcileScimUserLifecycle that reads the user through the vendor's transaction-bound adapter and reconciles: active: false on a row that is not banned ⇒ the platform ban write (reason Deactivated via SCIM, the exact string the vendor wrote itself through 1.6.x; no expiry), and on a row already banned WITH an expiry (an administrator's timed ban) ⇒ the ban is made permanent (banExpires cleared, banned and the administrator's reason untouched — the vendor's session hook auto-lifts an expired ban and would otherwise admit a principal the IdP still holds deactivated); active: true on a row banned WITH that reason ⇒ unban; anything else is a no-op (the callback is contractually idempotent and the vendor calls it on EVERY user mutation).
• user-ban-write.ts (new, PACKAGE-INTERNAL — not re-exported from src/index.ts) holds the existing /admin/ban-user / /admin/unban-user write as applyUserBan / applyUserUnban over a minimal UserBanWriter surface; admin-ban-endpoints.ts and the SCIM hook both call that ONE write (field for field the vendor's own banUser shape). No new HTTP endpoint, no new public symbol. The admin mount's behaviour is unchanged (its own suite: 88/88 across the six ban-adjacent files).
• New end-to-end suite scim-deactivation-reconcile-user.test.ts driving @better-auth/scim itself through a real AuthManager over better-sqlite3 (the simulated deprovision() helper in last-admin-guard.test.ts is NOT extended, per triage).
• One changeset for @objectstack/plugin-auth, level patch (see Contract review).

Admin forcing untouched (admin: pluginConfig.admin ?? scimEffective at three sites) — that is the #13816 shape-1 follow-up, not this card. The five stale assertion sites triage listed are untouched and are true again under this change.

Premise (re-verified on origin/main00ff228fe with the package installed)

1. grep -ro "ban" node_modules/@better-auth/scim/dist | wc -l = 0; positive control over node_modules/better-auth/dist/plugins/admin = 117. dist/index.d.mts:267 declares reconcileUser?(input: SCIMIdentityState, context: SCIMTransactionContext); SCIMIdentityState carries userId, the aggregate active (true while ANY participating SCIM source is active), profileSourceId and sources; SCIMTransactionContext carries only database (the DBTransactionAdapter). A throw from the hook: runSCIMApplicationCallback rethrows a better-auth APIError unchanged and wraps anything else as a SCIM 500 with detail SCIM identity reconciliation failed and the original as cause — never swallowed.
2. auth-manager.ts:3265 handed scim() exactly connections: [] and authentication.verifyBearerToken; repo-wide reconcileUser = 0 hits (control verifyBearerToken = 15).
3. admin-ban-endpoints.ts owns the platform ban write and re-runs the last-LOCAL-credential guard; the last-ADMINISTRATOR guard (ADR-0024 D5.2, plugin-auth: break-glass 守卫 —— SCIM/ban 不得停用最后一个管理员(ADR-0024 D5.2,cloud#621 转入) #5892) is an ENGINE beforeUpdate hook in last-admin-guard.ts, registered by auth-plugin.ts at kernel:ready, so it holds on every banned write regardless of caller. Both writes were endpoint-shaped (they parsed a Request); the write itself is now a plain callable.
4. The forced admin plugin supplies the banned column and the sign-in refusal: better-auth/dist/plugins/admin/admin.mjs:36-47 reads user?.banned in the session.create hook and throws FORBIDDEN / BANNED_USER.

PM hypotheses

• H1 — proven with a correction. The vendor invokes the callback inside its runIdentityMutationTransaction with enough identity (userId + aggregate active) to drive the ban write; active: false ⇒ ban with the SCIM reason, active: true ⇒ unban — but only of a ban carrying the SCIM reason. An administrator's ban (any other reason) is deliberately NOT lifted by the IdP: every SCIM PUT carries active: true, so unconditional reconciliation would re-admit a user banned for cause on the next attribute sync. Pinned in face (d). Listed as an open question below in case the maintainer wants IdP-authoritative semantics instead.
• H2 — proven, with a measured residual filed separately. The guard's refusal is LOUD through SCIM: HTTP 403 with the SCIM 2.0 error envelope (schemas contains the Error URN, status: "403", detail = the guard's own text naming last administrator, ADR-0024 D5.2 and SCIM deprovision is too broad); the ban never lands and the administrator still signs in. Residual: the vendor's OWN scimUser.active = false write, made before the callback inside what it believes is a transaction, survives the refusal — because the adapter's SCIM: 停在 @better-auth/scim rc.1,等正式版再整体迁移 —— rc.2 换掉了整套模型 #3653 SCIM transaction scoping never opens an engine transaction on 1.7.2 (measured: 0 engine.transaction and 0 driver.beginTransaction calls across a SCIM POST + PATCH; inScimRequestScope() false at every sys_user / sys_scim_user write). That is a pre-existing defect outside this card's file surface, filed as SCIM provisioning writes run outside any engine transaction on @better-auth/scim 1.7.2 — the #3653 scimRequestScope stamped in verifyBearerToken is not observed at write time (0 engine.transaction calls across POST + PATCH /Users) #14522 (out of scope here); face (c) pins the residual as observed (line 487 on this head) so SCIM provisioning writes run outside any engine transaction on @better-auth/scim 1.7.2 — the #3653 scimRequestScope stamped in verifyBearerToken is not observed at write time (0 engine.transaction calls across POST + PATCH /Users) #14522's landing flips that line deliberately. Operator-visible consequence of that residual: after a refused last-administrator deactivation, every later SCIM mutation of that user — an attribute-only PATCH included — re-attempts the ban and answers 403 until the IdP sends active: true for that user or a second administrator exists (it refuses rather than admits; stated on SCIM provisioning writes run outside any engine transaction on @better-auth/scim 1.7.2 — the #3653 scimRequestScope stamped in verifyBearerToken is not observed at write time (0 engine.transaction calls across POST + PATCH /Users) #14522 as well).
• H3 — proven. No change to the admin-forcing sites was needed; the forced plugin already supplies the column and the refusal (face (a) shows the refusal firing on a SCIM-banned row).

One consequence stated rather than left implicit: on 1.7.2 a SCIM DELETE /Users/{id} tombstones the source instead of deleting the better-auth user, so the aggregate state turns inactive and the hook disables that account (face (f)); re-provisioning through the tombstone re-links the same user and the SCIM ban is lifted.

Tests (head 21c7dbe76)

• pnpm --filter @objectstack/plugin-auth exec vitest run --maxWorkers=2 src/scim-deactivation-reconcile-user.test.ts + the five ban-adjacent siblings (admin-ban-endpoints, admin-remove-user-gate-ordering, break-glass-guard-self-service-target, break-glass-local-credential, session-tombstone) — Test Files 6 passed (6) · Tests 88 passed (88), VERDICT command-exit 0.
• The six SCIM-adjacent siblings (auth-manager, better-auth-schema-parity, credential-at-rest-posture, last-admin-guard, managed-extension-fields, scim-case-insensitive-identifier) — Test Files 6 passed (6) · Tests 469 passed (469), VERDICT command-exit 0.
• tsc --noEmit (src program) exit 0; pnpm --filter @objectstack/plugin-auth check:test-typecheck — OK — the test layer compiles under tsconfig.test.json (the new test file is in that program; the src program excludes tests by design). The tsconfig.examples.json half of the typecheck script resolves the package's own dist types, which this worktree has not built — NOT MEASURED locally; CI builds it.
• Reverse verification on the committed tree (round-1 head 51000d482; the wiring line it removes is unchanged on 21c7dbe76, so the reading was not re-run) (scratchpad/issue-14360/ablation.sh, trap-restored): removed the three-line identity member from the scim() options — proven on disk (marker count 1 → 0, git diff --stat = 3 deletions) — and ran the suite: 6 red / 3 green, exactly (a), (b), the idempotency case, (c) [the request answers 200 instead of the guard's 403], the (c) positive control and (f) red; (d) attribute-only, (d) administrator-ban and (e) green. Restore via git checkout HEAD -- path: git diff HEAD empty, disk blob = HEAD blob e9d5c5eb…, marker count back to 1. No dist rebuild is involved: the suite imports ./auth-manager.js from src, and no workspace dependency was mutated.

Gates (head 21c7dbe76)

node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands derived 36 commands from the changeset (re-derived on 21c7dbe76 after the changed-file set grew by user-ban-write.ts: identical list); each run at 21c7dbe76 with its exit captured before any pipe. 33 green, including check-system-context-census (OK — 109 elevation read sites … all anchored; 0 anchors on the two edited files, no census fix needed), check:cross-package-test-inputs, check:test-source-alias, check:engine-double-contract, check:logger-receiver-detach, check-adr-0087-registration (non-breaking changeset), check-changeset-no-major. Three answered exit 3 = PREREQUISITE NOT MET by their own verdict text, recorded as NOT MEASURED locally (CI owns them): check-test-completeness (needs a saved turbo test log), check:dual-build-cjs-loads (needs pnpm build), check:type-check-debt (needs the full built closure). Control-character self-scan over the four changed files: clean.

Contract review (Clause ②)

• Behaviour change, as accept/reject: a principal an identity provider has deactivated over SCIM (active: false, or deleted) is now REJECTED at sign-in with the vendor's 403 BANNED_USER (before: sessions revoked, sign-in ACCEPTED); an IdP active: true re-ACCEPTS a principal whose ban carries the SCIM reason (an administrator's ban stays a rejection). Deactivating the last administrator over SCIM is REJECTED with a 403 SCIM error (before: accepted, disabling nothing).
• Exported-symbol delta (git diff -U0 00ff228fe...HEAD | grep -E '^[+-].*\bexport\b'): five export lines, ALL in the new package-internal module packages/plugins/plugin-auth/src/user-ban-write.ts (UserBanWriter, UserBanFields, SCIM_DEACTIVATION_BAN_REASON, applyUserBan, applyUserUnban). NO new export is reachable through src/index.ts: the barrel is untouched (84 lines before and after, zero references to user-ban-write), and the same grep over admin-ban-endpoints.ts, auth-manager.ts and index.ts prints nothing. No removals, no signature changes to existing exports. The scim() options gain the vendor's identity member (not an ObjectStack-authored config key).
• Changeset level:patch — a bug fix restoring the declared behaviour with no new public symbol. Clause-② stays yes: sign-in accept/reject changes for a class of principals; the needs:contract-review carriers stay on the card and the PR.
• Log levels: no new log site of any level; the last-admin refusal is an error RESPONSE through the vendor's SCIM error mapping.

Out of scope, filed

• SCIM provisioning writes run outside any engine transaction on @better-auth/scim 1.7.2 — the #3653 scimRequestScope stamped in verifyBearerToken is not observed at write time (0 engine.transaction calls across POST + PATCH /Users) #14522 — SCIM provisioning writes run outside any engine transaction on 1.7.2 (the SCIM: 停在 @better-auth/scim rc.1,等正式版再整体迁移 —— rc.2 换掉了整套模型 #3653scimRequestScope stamped in verifyBearerToken is not observed at write time). Unassigned; the residual it leaves on a refused deactivation is pinned in face (c) of the new suite (line 487), and the post-refusal behaviour above is posted on that card.

Patch round 2 (head 21c7dbe76) — the in-seat contract review's round-1 verdict, item by item

• A (blocking finding 1 — implemented exactly as written).reconcileScimUserLifecycle reads banExpires too; in the !state.active branch a banned row with a non-null expiry gets { banExpires: null, updatedAt } and returns, otherwise returns — banned and the administrator's banReason untouched. Docblock first bullet and the changeset sentence say a deactivation also makes an existing expiring ban permanent. New face under (d): administrator ban with ban_expires 1.5s ahead, PATCH active: false → 200, expiry cleared and reason kept, then after the expiry has passed sign-in still answers 403 BANNED_USER (status AND code).
• B (note 1, required). Shared write moved to the non-barrelled user-ban-write.ts; admin-ban-endpoints.ts, auth-manager.ts and the suite import it. Barrel export surface unchanged; changeset patch; the "New exports" paragraph removed.
• C (notes 2, 3, 4, 6, 7). (2) changeset: the last-LOCAL-credential guard is deliberately not applied on the SCIM path — an IdP deprovision can disable the last password-holding account while non-administrator SSO users remain. (3) marker collision documented in the method docblock and the changeset (an administrator who types Deactivated via SCIM produces a ban the IdP can lift); the string is NOT reserved on the admin mount. (4) post-refusal behaviour stated above and on SCIM provisioning writes run outside any engine transaction on @better-auth/scim 1.7.2 — the #3653 scimRequestScope stamped in verifyBearerToken is not observed at write time (0 engine.transaction calls across POST + PATCH /Users) #14522. (6) new face (g): POST /Users with active: false provisions the account disabled — banned with the SCIM reason, sign-in 403 BANNED_USER. (7) SCIM provisioning writes run outside any engine transaction on @better-auth/scim 1.7.2 — the #3653 scimRequestScope stamped in verifyBearerToken is not observed at write time (0 engine.transaction calls across POST + PATCH /Users) #14522 carries the line-487 pin citation.
• D (verification at 21c7dbe76, verify-lock sessions each under the cap, exits before any pipe). New suite + five ban-adjacent siblings: Test Files 6 passed (6) · Tests 88 passed (88), VERDICT command-exit 0. Six SCIM-adjacent siblings: Test Files 6 passed (6) · Tests 469 passed (469), VERDICT command-exit 0. tsc --noEmit exit 0 (0 errors); check:test-typecheckOK — the test layer compiles under tsconfig.test.json. Gates re-derived on 21c7dbe76 (identical 36) and all run there: 33 green, the same three prerequisite-not-met (check-test-completeness, check:dual-build-cjs-loads, check:type-check-debt). git merge-tree --write-tree --name-only origin/main HEAD after git fetch origin main (origin/main = fed4fa409): clean, no conflicted paths. GitHub mergeable_state read after the push: clean.

Session: https://claude.ai/code/session_01AUF1NoViznQK32gqpK8wS8

Generated by Claude Code

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/plugin-auth, touching 15 documentable anchor(s).

3 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/kernel/contracts/auth-service.mdx(via AuthManager (symbol, a top-level class))
• content/docs/kernel/services-checklist.mdx(via AuthManager (symbol, a top-level class))
• content/docs/permissions/authentication.mdx(via AuthManager (symbol, a top-level class))

What this run could not see

• the SDK route bridge reached 47 of 219 client-bound route-ledger rows — the other 172 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 172: 14 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 56 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 102 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 11 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json fed4fa40924bd1366354ac9b8a55db9d94a7e404 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 32800235fc78c29dffbfc4bdfd601e0028eb72ca — the merge of head 21c7dbe76b7d44df32fbd9f6497db6372b9f2d0f into base fed4fa40924bd1366354ac9b8a55db9d94a7e404, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 32800235fc78c29dffbfc4bdfd601e0028eb72ca && git checkout 32800235fc78c29dffbfc4bdfd601e0028eb72ca
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin fed4fa40924bd1366354ac9b8a55db9d94a7e404 21c7dbe76b7d44df32fbd9f6497db6372b9f2d0f && git checkout -B drift-repro fed4fa40924bd1366354ac9b8a55db9d94a7e404 && git merge --no-ff 21c7dbe76b7d44df32fbd9f6497db6372b9f2d0f
node scripts/docs-audit/affected-docs.mjs --json fed4fa40924bd1366354ac9b8a55db9d94a7e404

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs fed4fa40924bd1366354ac9b8a55db9d94a7e404 → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[os-sales]

Contract review round 1 at 51000d482: FAIL — patch round 2 in flight

The in-seat isolated Clause-② review (fable tier, transcript-verified 78/78) is posted verbatim on #14360. One blocking finding: a SCIM active: false over a row that already carries an expiring administrator ban leaves the expiry in place, so the vendor's session.create hook auto-unbans and admits the principal once the expiry passes while the identity provider still holds them deactivated. Fix (a pure tightening): on deactivation, make an existing expiring ban permanent (banExpires: null) without touching banned or the administrator's reason; one new suite face pins it.

Also taken up in the same round: the five new symbols move into a non-barrelled module so the package surface does not grow (changeset → patch; Clause-② stays yes for the sign-in accept-set change), plus one-sentence documentation of the last-LOCAL-credential guard exemption on the SCIM path, the marker-collision case, the post-refusal 403 behaviour (also noted on #14522), and a POST /Usersactive: false pin.

needs:contract-review stays on the PR and the card until a delta review passes on the patched head; the PR stays draft.

---

Generated by Claude Code

[os-sales]

Landing provenance — ready + auto-merge at head 21c7dbe76

• Card: [finding] SCIM active:false no longer disables the account — the vendor ban coupling was removed upstream in @better-auth/scim 1.7.0 and nothing in this repo replaced it #14360 (Fixes, closes on merge).
• Contract review (Clause-② yes, accept-set change for SCIM-deactivated principals): in-seat isolated fable review — round 1 FAIL at 51000d482 (14360#issuecomment-5508485458, one blocking finding), patch round 2, round 2 (delta) PASS at 21c7dbe76 (14360#issuecomment-5508938514); transcript verified 105/105 claude-fable-5-1; verdicts adopted verbatim. Provenance for clearing the carriers: the 2026-08-31 maintainer ruling that the dispatching seat completes the contract review in-seat, plus that PASS.
• Carriers: needs:contract-review removed from [finding] SCIM active:false no longer disables the account — the vendor ban coupling was removed upstream in @better-auth/scim 1.7.0 and nothing in this repo replaced it #14360 and from this PR in the same stroke, read back; node scripts/pm/check-clause2-carriers.mjs --pair 14540 → "the clause-② declaration is readable in the fixed spelling and both carriers agree", exit 0.
• Surface: 5 files, all inside the fence (auth-manager.ts, admin-ban-endpoints.ts, new package-internal user-ban-write.ts, the new suite, the changeset patch); src/index.ts byte-identical to origin/main; no packages/spec, no content/docs/releases/; admin-forcing sites untouched.
• CI on 21c7dbe76: every check green — Lint & Repo Gatessuccess at 11:26:32Z, TypeScript Type Checksuccess, Test Core (1/6)success at 11:21:56Z, aggregate Test Coresuccess; mergeable_state: clean.
• Action: draft → ready and auto-merge enabled at ~11:44Z. On MERGED: card auto-closes; strip pm:dispatched from [finding] SCIM active:false no longer disables the account — the vendor ban coupling was removed upstream in @better-auth/scim 1.7.0 and nothing in this repo replaced it #14360; the seat files one follow-up finding for the review's §5 notes 1–5 (docblock word, timed-ban face clock margin and positive control, DELETE-of-last-administrator pin, stale last-admin-guard.ts header, DELETE docblock clause). SCIM provisioning writes run outside any engine transaction on @better-auth/scim 1.7.2 — the #3653 scimRequestScope stamped in verifyBearerToken is not observed at write time (0 engine.transaction calls across POST + PATCH /Users) #14522 (SCIM writes outside an engine transaction on 1.7.2) stays with triage.

---

Generated by Claude Code

[claude]

Fixes#14360

What this does

Stable @better-auth/scim (1.7.0 and later; the repo pins and installs 1.7.2) no longer writes the admin plugin's banned column when an identity provider sends active: false — it hands the user's aggregate lifecycle state to an OPTIONAL host callback, identity.reconcileUser, and then only revokes sessions. plugin-auth passed no identity member, so a deactivation revoked sessions and wrote nothing: sys_user.banned stayed false and a user holding a local password signed straight back in, while ADR-0071, the generated docs and the #13816 construction-time refusal all asserted the ban.

Limb A of the triage ruling, and only limb A:

• auth-manager.ts — the scim({...}) options gain identity.reconcileUser, routed to a new private method reconcileScimUserLifecycle that reads the user through the vendor's transaction-bound adapter and reconciles: active: false on a row that is not banned ⇒ the platform ban write (reason Deactivated via SCIM, the exact string the vendor wrote itself through 1.6.x; no expiry), and on a row already banned WITH an expiry (an administrator's timed ban) ⇒ the ban is made permanent (banExpires cleared, banned and the administrator's reason untouched — the vendor's session hook auto-lifts an expired ban and would otherwise admit a principal the IdP still holds deactivated); active: true on a row banned WITH that reason ⇒ unban; anything else is a no-op (the callback is contractually idempotent and the vendor calls it on EVERY user mutation).
• user-ban-write.ts (new, PACKAGE-INTERNAL — not re-exported from src/index.ts) holds the existing /admin/ban-user / /admin/unban-user write as applyUserBan / applyUserUnban over a minimal UserBanWriter surface; admin-ban-endpoints.ts and the SCIM hook both call that ONE write (field for field the vendor's own banUser shape). No new HTTP endpoint, no new public symbol. The admin mount's behaviour is unchanged (its own suite: 88/88 across the six ban-adjacent files).
• New end-to-end suite scim-deactivation-reconcile-user.test.ts driving @better-auth/scim itself through a real AuthManager over better-sqlite3 (the simulated deprovision() helper in last-admin-guard.test.ts is NOT extended, per triage).
• One changeset for @objectstack/plugin-auth, level patch (see Contract review).

Admin forcing untouched (admin: pluginConfig.admin ?? scimEffective at three sites) — that is the #13816 shape-1 follow-up, not this card. The five stale assertion sites triage listed are untouched and are true again under this change.

Premise (re-verified on origin/main00ff228fe with the package installed)

1. grep -ro "ban" node_modules/@better-auth/scim/dist | wc -l = 0; positive control over node_modules/better-auth/dist/plugins/admin = 117. dist/index.d.mts:267 declares reconcileUser?(input: SCIMIdentityState, context: SCIMTransactionContext); SCIMIdentityState carries userId, the aggregate active (true while ANY participating SCIM source is active), profileSourceId and sources; SCIMTransactionContext carries only database (the DBTransactionAdapter). A throw from the hook: runSCIMApplicationCallback rethrows a better-auth APIError unchanged and wraps anything else as a SCIM 500 with detail SCIM identity reconciliation failed and the original as cause — never swallowed.
2. auth-manager.ts:3265 handed scim() exactly connections: [] and authentication.verifyBearerToken; repo-wide reconcileUser = 0 hits (control verifyBearerToken = 15).
3. admin-ban-endpoints.ts owns the platform ban write and re-runs the last-LOCAL-credential guard; the last-ADMINISTRATOR guard (ADR-0024 D5.2, plugin-auth: break-glass 守卫 —— SCIM/ban 不得停用最后一个管理员(ADR-0024 D5.2,cloud#621 转入) #5892) is an ENGINE beforeUpdate hook in last-admin-guard.ts, registered by auth-plugin.ts at kernel:ready, so it holds on every banned write regardless of caller. Both writes were endpoint-shaped (they parsed a Request); the write itself is now a plain callable.
4. The forced admin plugin supplies the banned column and the sign-in refusal: better-auth/dist/plugins/admin/admin.mjs:36-47 reads user?.banned in the session.create hook and throws FORBIDDEN / BANNED_USER.

PM hypotheses

• H1 — proven with a correction. The vendor invokes the callback inside its runIdentityMutationTransaction with enough identity (userId + aggregate active) to drive the ban write; active: false ⇒ ban with the SCIM reason, active: true ⇒ unban — but only of a ban carrying the SCIM reason. An administrator's ban (any other reason) is deliberately NOT lifted by the IdP: every SCIM PUT carries active: true, so unconditional reconciliation would re-admit a user banned for cause on the next attribute sync. Pinned in face (d). Listed as an open question below in case the maintainer wants IdP-authoritative semantics instead.
• H2 — proven, with a measured residual filed separately. The guard's refusal is LOUD through SCIM: HTTP 403 with the SCIM 2.0 error envelope (schemas contains the Error URN, status: "403", detail = the guard's own text naming last administrator, ADR-0024 D5.2 and SCIM deprovision is too broad); the ban never lands and the administrator still signs in. Residual: the vendor's OWN scimUser.active = false write, made before the callback inside what it believes is a transaction, survives the refusal — because the adapter's SCIM: 停在 @better-auth/scim rc.1,等正式版再整体迁移 —— rc.2 换掉了整套模型 #3653 SCIM transaction scoping never opens an engine transaction on 1.7.2 (measured: 0 engine.transaction and 0 driver.beginTransaction calls across a SCIM POST + PATCH; inScimRequestScope() false at every sys_user / sys_scim_user write). That is a pre-existing defect outside this card's file surface, filed as SCIM provisioning writes run outside any engine transaction on @better-auth/scim 1.7.2 — the #3653 scimRequestScope stamped in verifyBearerToken is not observed at write time (0 engine.transaction calls across POST + PATCH /Users) #14522 (out of scope here); face (c) pins the residual as observed (line 487 on this head) so SCIM provisioning writes run outside any engine transaction on @better-auth/scim 1.7.2 — the #3653 scimRequestScope stamped in verifyBearerToken is not observed at write time (0 engine.transaction calls across POST + PATCH /Users) #14522's landing flips that line deliberately. Operator-visible consequence of that residual: after a refused last-administrator deactivation, every later SCIM mutation of that user — an attribute-only PATCH included — re-attempts the ban and answers 403 until the IdP sends active: true for that user or a second administrator exists (it refuses rather than admits; stated on SCIM provisioning writes run outside any engine transaction on @better-auth/scim 1.7.2 — the #3653 scimRequestScope stamped in verifyBearerToken is not observed at write time (0 engine.transaction calls across POST + PATCH /Users) #14522 as well).
• H3 — proven. No change to the admin-forcing sites was needed; the forced plugin already supplies the column and the refusal (face (a) shows the refusal firing on a SCIM-banned row).

One consequence stated rather than left implicit: on 1.7.2 a SCIM DELETE /Users/{id} tombstones the source instead of deleting the better-auth user, so the aggregate state turns inactive and the hook disables that account (face (f)); re-provisioning through the tombstone re-links the same user and the SCIM ban is lifted.

Tests (head 21c7dbe76)

• pnpm --filter @objectstack/plugin-auth exec vitest run --maxWorkers=2 src/scim-deactivation-reconcile-user.test.ts + the five ban-adjacent siblings (admin-ban-endpoints, admin-remove-user-gate-ordering, break-glass-guard-self-service-target, break-glass-local-credential, session-tombstone) — Test Files 6 passed (6) · Tests 88 passed (88), VERDICT command-exit 0.
• The six SCIM-adjacent siblings (auth-manager, better-auth-schema-parity, credential-at-rest-posture, last-admin-guard, managed-extension-fields, scim-case-insensitive-identifier) — Test Files 6 passed (6) · Tests 469 passed (469), VERDICT command-exit 0.
• tsc --noEmit (src program) exit 0; pnpm --filter @objectstack/plugin-auth check:test-typecheck — OK — the test layer compiles under tsconfig.test.json (the new test file is in that program; the src program excludes tests by design). The tsconfig.examples.json half of the typecheck script resolves the package's own dist types, which this worktree has not built — NOT MEASURED locally; CI builds it.
• Reverse verification on the committed tree (round-1 head 51000d482; the wiring line it removes is unchanged on 21c7dbe76, so the reading was not re-run) (scratchpad/issue-14360/ablation.sh, trap-restored): removed the three-line identity member from the scim() options — proven on disk (marker count 1 → 0, git diff --stat = 3 deletions) — and ran the suite: 6 red / 3 green, exactly (a), (b), the idempotency case, (c) [the request answers 200 instead of the guard's 403], the (c) positive control and (f) red; (d) attribute-only, (d) administrator-ban and (e) green. Restore via git checkout HEAD -- path: git diff HEAD empty, disk blob = HEAD blob e9d5c5eb…, marker count back to 1. No dist rebuild is involved: the suite imports ./auth-manager.js from src, and no workspace dependency was mutated.

Gates (head 21c7dbe76)

node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands derived 36 commands from the changeset (re-derived on 21c7dbe76 after the changed-file set grew by user-ban-write.ts: identical list); each run at 21c7dbe76 with its exit captured before any pipe. 33 green, including check-system-context-census (OK — 109 elevation read sites … all anchored; 0 anchors on the two edited files, no census fix needed), check:cross-package-test-inputs, check:test-source-alias, check:engine-double-contract, check:logger-receiver-detach, check-adr-0087-registration (non-breaking changeset), check-changeset-no-major. Three answered exit 3 = PREREQUISITE NOT MET by their own verdict text, recorded as NOT MEASURED locally (CI owns them): check-test-completeness (needs a saved turbo test log), check:dual-build-cjs-loads (needs pnpm build), check:type-check-debt (needs the full built closure). Control-character self-scan over the four changed files: clean.

Contract review (Clause ②)

• Behaviour change, as accept/reject: a principal an identity provider has deactivated over SCIM (active: false, or deleted) is now REJECTED at sign-in with the vendor's 403 BANNED_USER (before: sessions revoked, sign-in ACCEPTED); an IdP active: true re-ACCEPTS a principal whose ban carries the SCIM reason (an administrator's ban stays a rejection). Deactivating the last administrator over SCIM is REJECTED with a 403 SCIM error (before: accepted, disabling nothing).
• Exported-symbol delta (git diff -U0 00ff228fe...HEAD | grep -E '^[+-].*\bexport\b'): five export lines, ALL in the new package-internal module packages/plugins/plugin-auth/src/user-ban-write.ts (UserBanWriter, UserBanFields, SCIM_DEACTIVATION_BAN_REASON, applyUserBan, applyUserUnban). NO new export is reachable through src/index.ts: the barrel is untouched (84 lines before and after, zero references to user-ban-write), and the same grep over admin-ban-endpoints.ts, auth-manager.ts and index.ts prints nothing. No removals, no signature changes to existing exports. The scim() options gain the vendor's identity member (not an ObjectStack-authored config key).
• Changeset level:patch — a bug fix restoring the declared behaviour with no new public symbol. Clause-② stays yes: sign-in accept/reject changes for a class of principals; the needs:contract-review carriers stay on the card and the PR.
• Log levels: no new log site of any level; the last-admin refusal is an error RESPONSE through the vendor's SCIM error mapping.

Out of scope, filed

• SCIM provisioning writes run outside any engine transaction on @better-auth/scim 1.7.2 — the #3653 scimRequestScope stamped in verifyBearerToken is not observed at write time (0 engine.transaction calls across POST + PATCH /Users) #14522 — SCIM provisioning writes run outside any engine transaction on 1.7.2 (the SCIM: 停在 @better-auth/scim rc.1,等正式版再整体迁移 —— rc.2 换掉了整套模型 #3653scimRequestScope stamped in verifyBearerToken is not observed at write time). Unassigned; the residual it leaves on a refused deactivation is pinned in face (c) of the new suite (line 487), and the post-refusal behaviour above is posted on that card.

Patch round 2 (head 21c7dbe76) — the in-seat contract review's round-1 verdict, item by item

• A (blocking finding 1 — implemented exactly as written).reconcileScimUserLifecycle reads banExpires too; in the !state.active branch a banned row with a non-null expiry gets { banExpires: null, updatedAt } and returns, otherwise returns — banned and the administrator's banReason untouched. Docblock first bullet and the changeset sentence say a deactivation also makes an existing expiring ban permanent. New face under (d): administrator ban with ban_expires 1.5s ahead, PATCH active: false → 200, expiry cleared and reason kept, then after the expiry has passed sign-in still answers 403 BANNED_USER (status AND code).
• B (note 1, required). Shared write moved to the non-barrelled user-ban-write.ts; admin-ban-endpoints.ts, auth-manager.ts and the suite import it. Barrel export surface unchanged; changeset patch; the "New exports" paragraph removed.
• C (notes 2, 3, 4, 6, 7). (2) changeset: the last-LOCAL-credential guard is deliberately not applied on the SCIM path — an IdP deprovision can disable the last password-holding account while non-administrator SSO users remain. (3) marker collision documented in the method docblock and the changeset (an administrator who types Deactivated via SCIM produces a ban the IdP can lift); the string is NOT reserved on the admin mount. (4) post-refusal behaviour stated above and on SCIM provisioning writes run outside any engine transaction on @better-auth/scim 1.7.2 — the #3653 scimRequestScope stamped in verifyBearerToken is not observed at write time (0 engine.transaction calls across POST + PATCH /Users) #14522. (6) new face (g): POST /Users with active: false provisions the account disabled — banned with the SCIM reason, sign-in 403 BANNED_USER. (7) SCIM provisioning writes run outside any engine transaction on @better-auth/scim 1.7.2 — the #3653 scimRequestScope stamped in verifyBearerToken is not observed at write time (0 engine.transaction calls across POST + PATCH /Users) #14522 carries the line-487 pin citation.
• D (verification at 21c7dbe76, verify-lock sessions each under the cap, exits before any pipe). New suite + five ban-adjacent siblings: Test Files 6 passed (6) · Tests 88 passed (88), VERDICT command-exit 0. Six SCIM-adjacent siblings: Test Files 6 passed (6) · Tests 469 passed (469), VERDICT command-exit 0. tsc --noEmit exit 0 (0 errors); check:test-typecheckOK — the test layer compiles under tsconfig.test.json. Gates re-derived on 21c7dbe76 (identical 36) and all run there: 33 green, the same three prerequisite-not-met (check-test-completeness, check:dual-build-cjs-loads, check:type-check-debt). git merge-tree --write-tree --name-only origin/main HEAD after git fetch origin main (origin/main = fed4fa409): clean, no conflicted paths. GitHub mergeable_state read after the push: clean.

Session: https://claude.ai/code/session_01AUF1NoViznQK32gqpK8wS8

Generated by Claude Code

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/plugin-auth, touching 15 documentable anchor(s).

3 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/kernel/contracts/auth-service.mdx(via AuthManager (symbol, a top-level class))
• content/docs/kernel/services-checklist.mdx(via AuthManager (symbol, a top-level class))
• content/docs/permissions/authentication.mdx(via AuthManager (symbol, a top-level class))

What this run could not see

• the SDK route bridge reached 47 of 219 client-bound route-ledger rows — the other 172 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 172: 14 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 56 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 102 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 11 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json fed4fa40924bd1366354ac9b8a55db9d94a7e404 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 32800235fc78c29dffbfc4bdfd601e0028eb72ca — the merge of head 21c7dbe76b7d44df32fbd9f6497db6372b9f2d0f into base fed4fa40924bd1366354ac9b8a55db9d94a7e404, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 32800235fc78c29dffbfc4bdfd601e0028eb72ca && git checkout 32800235fc78c29dffbfc4bdfd601e0028eb72ca
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin fed4fa40924bd1366354ac9b8a55db9d94a7e404 21c7dbe76b7d44df32fbd9f6497db6372b9f2d0f && git checkout -B drift-repro fed4fa40924bd1366354ac9b8a55db9d94a7e404 && git merge --no-ff 21c7dbe76b7d44df32fbd9f6497db6372b9f2d0f
node scripts/docs-audit/affected-docs.mjs --json fed4fa40924bd1366354ac9b8a55db9d94a7e404

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs fed4fa40924bd1366354ac9b8a55db9d94a7e404 → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[os-sales]

Contract review round 1 at 51000d482: FAIL — patch round 2 in flight

The in-seat isolated Clause-② review (fable tier, transcript-verified 78/78) is posted verbatim on #14360. One blocking finding: a SCIM active: false over a row that already carries an expiring administrator ban leaves the expiry in place, so the vendor's session.create hook auto-unbans and admits the principal once the expiry passes while the identity provider still holds them deactivated. Fix (a pure tightening): on deactivation, make an existing expiring ban permanent (banExpires: null) without touching banned or the administrator's reason; one new suite face pins it.

Also taken up in the same round: the five new symbols move into a non-barrelled module so the package surface does not grow (changeset → patch; Clause-② stays yes for the sign-in accept-set change), plus one-sentence documentation of the last-LOCAL-credential guard exemption on the SCIM path, the marker-collision case, the post-refusal 403 behaviour (also noted on #14522), and a POST /Usersactive: false pin.

needs:contract-review stays on the PR and the card until a delta review passes on the patched head; the PR stays draft.

---

Generated by Claude Code

[os-sales]

Landing provenance — ready + auto-merge at head 21c7dbe76

• Card: [finding] SCIM active:false no longer disables the account — the vendor ban coupling was removed upstream in @better-auth/scim 1.7.0 and nothing in this repo replaced it #14360 (Fixes, closes on merge).
• Contract review (Clause-② yes, accept-set change for SCIM-deactivated principals): in-seat isolated fable review — round 1 FAIL at 51000d482 (14360#issuecomment-5508485458, one blocking finding), patch round 2, round 2 (delta) PASS at 21c7dbe76 (14360#issuecomment-5508938514); transcript verified 105/105 claude-fable-5-1; verdicts adopted verbatim. Provenance for clearing the carriers: the 2026-08-31 maintainer ruling that the dispatching seat completes the contract review in-seat, plus that PASS.
• Carriers: needs:contract-review removed from [finding] SCIM active:false no longer disables the account — the vendor ban coupling was removed upstream in @better-auth/scim 1.7.0 and nothing in this repo replaced it #14360 and from this PR in the same stroke, read back; node scripts/pm/check-clause2-carriers.mjs --pair 14540 → "the clause-② declaration is readable in the fixed spelling and both carriers agree", exit 0.
• Surface: 5 files, all inside the fence (auth-manager.ts, admin-ban-endpoints.ts, new package-internal user-ban-write.ts, the new suite, the changeset patch); src/index.ts byte-identical to origin/main; no packages/spec, no content/docs/releases/; admin-forcing sites untouched.
• CI on 21c7dbe76: every check green — Lint & Repo Gatessuccess at 11:26:32Z, TypeScript Type Checksuccess, Test Core (1/6)success at 11:21:56Z, aggregate Test Coresuccess; mergeable_state: clean.
• Action: draft → ready and auto-merge enabled at ~11:44Z. On MERGED: card auto-closes; strip pm:dispatched from [finding] SCIM active:false no longer disables the account — the vendor ban coupling was removed upstream in @better-auth/scim 1.7.0 and nothing in this repo replaced it #14360; the seat files one follow-up finding for the review's §5 notes 1–5 (docblock word, timed-ban face clock margin and positive control, DELETE-of-last-administrator pin, stale last-admin-guard.ts header, DELETE docblock clause). SCIM provisioning writes run outside any engine transaction on @better-auth/scim 1.7.2 — the #3653 scimRequestScope stamped in verifyBearerToken is not observed at write time (0 engine.transaction calls across POST + PATCH /Users) #14522 (SCIM writes outside an engine transaction on 1.7.2) stays with triage.

---

Generated by Claude Code

[claude]

Fixes#14360

What this does

Stable @better-auth/scim (1.7.0 and later; the repo pins and installs 1.7.2) no longer writes the admin plugin's banned column when an identity provider sends active: false — it hands the user's aggregate lifecycle state to an OPTIONAL host callback, identity.reconcileUser, and then only revokes sessions. plugin-auth passed no identity member, so a deactivation revoked sessions and wrote nothing: sys_user.banned stayed false and a user holding a local password signed straight back in, while ADR-0071, the generated docs and the #13816 construction-time refusal all asserted the ban.

Limb A of the triage ruling, and only limb A:

• auth-manager.ts — the scim({...}) options gain identity.reconcileUser, routed to a new private method reconcileScimUserLifecycle that reads the user through the vendor's transaction-bound adapter and reconciles: active: false on a row that is not banned ⇒ the platform ban write (reason Deactivated via SCIM, the exact string the vendor wrote itself through 1.6.x; no expiry), and on a row already banned WITH an expiry (an administrator's timed ban) ⇒ the ban is made permanent (banExpires cleared, banned and the administrator's reason untouched — the vendor's session hook auto-lifts an expired ban and would otherwise admit a principal the IdP still holds deactivated); active: true on a row banned WITH that reason ⇒ unban; anything else is a no-op (the callback is contractually idempotent and the vendor calls it on EVERY user mutation).
• user-ban-write.ts (new, PACKAGE-INTERNAL — not re-exported from src/index.ts) holds the existing /admin/ban-user / /admin/unban-user write as applyUserBan / applyUserUnban over a minimal UserBanWriter surface; admin-ban-endpoints.ts and the SCIM hook both call that ONE write (field for field the vendor's own banUser shape). No new HTTP endpoint, no new public symbol. The admin mount's behaviour is unchanged (its own suite: 88/88 across the six ban-adjacent files).
• New end-to-end suite scim-deactivation-reconcile-user.test.ts driving @better-auth/scim itself through a real AuthManager over better-sqlite3 (the simulated deprovision() helper in last-admin-guard.test.ts is NOT extended, per triage).
• One changeset for @objectstack/plugin-auth, level patch (see Contract review).

Admin forcing untouched (admin: pluginConfig.admin ?? scimEffective at three sites) — that is the #13816 shape-1 follow-up, not this card. The five stale assertion sites triage listed are untouched and are true again under this change.

Premise (re-verified on origin/main00ff228fe with the package installed)

1. grep -ro "ban" node_modules/@better-auth/scim/dist | wc -l = 0; positive control over node_modules/better-auth/dist/plugins/admin = 117. dist/index.d.mts:267 declares reconcileUser?(input: SCIMIdentityState, context: SCIMTransactionContext); SCIMIdentityState carries userId, the aggregate active (true while ANY participating SCIM source is active), profileSourceId and sources; SCIMTransactionContext carries only database (the DBTransactionAdapter). A throw from the hook: runSCIMApplicationCallback rethrows a better-auth APIError unchanged and wraps anything else as a SCIM 500 with detail SCIM identity reconciliation failed and the original as cause — never swallowed.
2. auth-manager.ts:3265 handed scim() exactly connections: [] and authentication.verifyBearerToken; repo-wide reconcileUser = 0 hits (control verifyBearerToken = 15).
3. admin-ban-endpoints.ts owns the platform ban write and re-runs the last-LOCAL-credential guard; the last-ADMINISTRATOR guard (ADR-0024 D5.2, plugin-auth: break-glass 守卫 —— SCIM/ban 不得停用最后一个管理员(ADR-0024 D5.2,cloud#621 转入) #5892) is an ENGINE beforeUpdate hook in last-admin-guard.ts, registered by auth-plugin.ts at kernel:ready, so it holds on every banned write regardless of caller. Both writes were endpoint-shaped (they parsed a Request); the write itself is now a plain callable.
4. The forced admin plugin supplies the banned column and the sign-in refusal: better-auth/dist/plugins/admin/admin.mjs:36-47 reads user?.banned in the session.create hook and throws FORBIDDEN / BANNED_USER.

PM hypotheses

• H1 — proven with a correction. The vendor invokes the callback inside its runIdentityMutationTransaction with enough identity (userId + aggregate active) to drive the ban write; active: false ⇒ ban with the SCIM reason, active: true ⇒ unban — but only of a ban carrying the SCIM reason. An administrator's ban (any other reason) is deliberately NOT lifted by the IdP: every SCIM PUT carries active: true, so unconditional reconciliation would re-admit a user banned for cause on the next attribute sync. Pinned in face (d). Listed as an open question below in case the maintainer wants IdP-authoritative semantics instead.
• H2 — proven, with a measured residual filed separately. The guard's refusal is LOUD through SCIM: HTTP 403 with the SCIM 2.0 error envelope (schemas contains the Error URN, status: "403", detail = the guard's own text naming last administrator, ADR-0024 D5.2 and SCIM deprovision is too broad); the ban never lands and the administrator still signs in. Residual: the vendor's OWN scimUser.active = false write, made before the callback inside what it believes is a transaction, survives the refusal — because the adapter's SCIM: 停在 @better-auth/scim rc.1,等正式版再整体迁移 —— rc.2 换掉了整套模型 #3653 SCIM transaction scoping never opens an engine transaction on 1.7.2 (measured: 0 engine.transaction and 0 driver.beginTransaction calls across a SCIM POST + PATCH; inScimRequestScope() false at every sys_user / sys_scim_user write). That is a pre-existing defect outside this card's file surface, filed as SCIM provisioning writes run outside any engine transaction on @better-auth/scim 1.7.2 — the #3653 scimRequestScope stamped in verifyBearerToken is not observed at write time (0 engine.transaction calls across POST + PATCH /Users) #14522 (out of scope here); face (c) pins the residual as observed (line 487 on this head) so SCIM provisioning writes run outside any engine transaction on @better-auth/scim 1.7.2 — the #3653 scimRequestScope stamped in verifyBearerToken is not observed at write time (0 engine.transaction calls across POST + PATCH /Users) #14522's landing flips that line deliberately. Operator-visible consequence of that residual: after a refused last-administrator deactivation, every later SCIM mutation of that user — an attribute-only PATCH included — re-attempts the ban and answers 403 until the IdP sends active: true for that user or a second administrator exists (it refuses rather than admits; stated on SCIM provisioning writes run outside any engine transaction on @better-auth/scim 1.7.2 — the #3653 scimRequestScope stamped in verifyBearerToken is not observed at write time (0 engine.transaction calls across POST + PATCH /Users) #14522 as well).
• H3 — proven. No change to the admin-forcing sites was needed; the forced plugin already supplies the column and the refusal (face (a) shows the refusal firing on a SCIM-banned row).

One consequence stated rather than left implicit: on 1.7.2 a SCIM DELETE /Users/{id} tombstones the source instead of deleting the better-auth user, so the aggregate state turns inactive and the hook disables that account (face (f)); re-provisioning through the tombstone re-links the same user and the SCIM ban is lifted.

Tests (head 21c7dbe76)

• pnpm --filter @objectstack/plugin-auth exec vitest run --maxWorkers=2 src/scim-deactivation-reconcile-user.test.ts + the five ban-adjacent siblings (admin-ban-endpoints, admin-remove-user-gate-ordering, break-glass-guard-self-service-target, break-glass-local-credential, session-tombstone) — Test Files 6 passed (6) · Tests 88 passed (88), VERDICT command-exit 0.
• The six SCIM-adjacent siblings (auth-manager, better-auth-schema-parity, credential-at-rest-posture, last-admin-guard, managed-extension-fields, scim-case-insensitive-identifier) — Test Files 6 passed (6) · Tests 469 passed (469), VERDICT command-exit 0.
• tsc --noEmit (src program) exit 0; pnpm --filter @objectstack/plugin-auth check:test-typecheck — OK — the test layer compiles under tsconfig.test.json (the new test file is in that program; the src program excludes tests by design). The tsconfig.examples.json half of the typecheck script resolves the package's own dist types, which this worktree has not built — NOT MEASURED locally; CI builds it.
• Reverse verification on the committed tree (round-1 head 51000d482; the wiring line it removes is unchanged on 21c7dbe76, so the reading was not re-run) (scratchpad/issue-14360/ablation.sh, trap-restored): removed the three-line identity member from the scim() options — proven on disk (marker count 1 → 0, git diff --stat = 3 deletions) — and ran the suite: 6 red / 3 green, exactly (a), (b), the idempotency case, (c) [the request answers 200 instead of the guard's 403], the (c) positive control and (f) red; (d) attribute-only, (d) administrator-ban and (e) green. Restore via git checkout HEAD -- path: git diff HEAD empty, disk blob = HEAD blob e9d5c5eb…, marker count back to 1. No dist rebuild is involved: the suite imports ./auth-manager.js from src, and no workspace dependency was mutated.

Gates (head 21c7dbe76)

node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands derived 36 commands from the changeset (re-derived on 21c7dbe76 after the changed-file set grew by user-ban-write.ts: identical list); each run at 21c7dbe76 with its exit captured before any pipe. 33 green, including check-system-context-census (OK — 109 elevation read sites … all anchored; 0 anchors on the two edited files, no census fix needed), check:cross-package-test-inputs, check:test-source-alias, check:engine-double-contract, check:logger-receiver-detach, check-adr-0087-registration (non-breaking changeset), check-changeset-no-major. Three answered exit 3 = PREREQUISITE NOT MET by their own verdict text, recorded as NOT MEASURED locally (CI owns them): check-test-completeness (needs a saved turbo test log), check:dual-build-cjs-loads (needs pnpm build), check:type-check-debt (needs the full built closure). Control-character self-scan over the four changed files: clean.

Contract review (Clause ②)

• Behaviour change, as accept/reject: a principal an identity provider has deactivated over SCIM (active: false, or deleted) is now REJECTED at sign-in with the vendor's 403 BANNED_USER (before: sessions revoked, sign-in ACCEPTED); an IdP active: true re-ACCEPTS a principal whose ban carries the SCIM reason (an administrator's ban stays a rejection). Deactivating the last administrator over SCIM is REJECTED with a 403 SCIM error (before: accepted, disabling nothing).
• Exported-symbol delta (git diff -U0 00ff228fe...HEAD | grep -E '^[+-].*\bexport\b'): five export lines, ALL in the new package-internal module packages/plugins/plugin-auth/src/user-ban-write.ts (UserBanWriter, UserBanFields, SCIM_DEACTIVATION_BAN_REASON, applyUserBan, applyUserUnban). NO new export is reachable through src/index.ts: the barrel is untouched (84 lines before and after, zero references to user-ban-write), and the same grep over admin-ban-endpoints.ts, auth-manager.ts and index.ts prints nothing. No removals, no signature changes to existing exports. The scim() options gain the vendor's identity member (not an ObjectStack-authored config key).
• Changeset level:patch — a bug fix restoring the declared behaviour with no new public symbol. Clause-② stays yes: sign-in accept/reject changes for a class of principals; the needs:contract-review carriers stay on the card and the PR.
• Log levels: no new log site of any level; the last-admin refusal is an error RESPONSE through the vendor's SCIM error mapping.

Out of scope, filed

• SCIM provisioning writes run outside any engine transaction on @better-auth/scim 1.7.2 — the #3653 scimRequestScope stamped in verifyBearerToken is not observed at write time (0 engine.transaction calls across POST + PATCH /Users) #14522 — SCIM provisioning writes run outside any engine transaction on 1.7.2 (the SCIM: 停在 @better-auth/scim rc.1,等正式版再整体迁移 —— rc.2 换掉了整套模型 #3653scimRequestScope stamped in verifyBearerToken is not observed at write time). Unassigned; the residual it leaves on a refused deactivation is pinned in face (c) of the new suite (line 487), and the post-refusal behaviour above is posted on that card.

Patch round 2 (head 21c7dbe76) — the in-seat contract review's round-1 verdict, item by item

• A (blocking finding 1 — implemented exactly as written).reconcileScimUserLifecycle reads banExpires too; in the !state.active branch a banned row with a non-null expiry gets { banExpires: null, updatedAt } and returns, otherwise returns — banned and the administrator's banReason untouched. Docblock first bullet and the changeset sentence say a deactivation also makes an existing expiring ban permanent. New face under (d): administrator ban with ban_expires 1.5s ahead, PATCH active: false → 200, expiry cleared and reason kept, then after the expiry has passed sign-in still answers 403 BANNED_USER (status AND code).
• B (note 1, required). Shared write moved to the non-barrelled user-ban-write.ts; admin-ban-endpoints.ts, auth-manager.ts and the suite import it. Barrel export surface unchanged; changeset patch; the "New exports" paragraph removed.
• C (notes 2, 3, 4, 6, 7). (2) changeset: the last-LOCAL-credential guard is deliberately not applied on the SCIM path — an IdP deprovision can disable the last password-holding account while non-administrator SSO users remain. (3) marker collision documented in the method docblock and the changeset (an administrator who types Deactivated via SCIM produces a ban the IdP can lift); the string is NOT reserved on the admin mount. (4) post-refusal behaviour stated above and on SCIM provisioning writes run outside any engine transaction on @better-auth/scim 1.7.2 — the #3653 scimRequestScope stamped in verifyBearerToken is not observed at write time (0 engine.transaction calls across POST + PATCH /Users) #14522. (6) new face (g): POST /Users with active: false provisions the account disabled — banned with the SCIM reason, sign-in 403 BANNED_USER. (7) SCIM provisioning writes run outside any engine transaction on @better-auth/scim 1.7.2 — the #3653 scimRequestScope stamped in verifyBearerToken is not observed at write time (0 engine.transaction calls across POST + PATCH /Users) #14522 carries the line-487 pin citation.
• D (verification at 21c7dbe76, verify-lock sessions each under the cap, exits before any pipe). New suite + five ban-adjacent siblings: Test Files 6 passed (6) · Tests 88 passed (88), VERDICT command-exit 0. Six SCIM-adjacent siblings: Test Files 6 passed (6) · Tests 469 passed (469), VERDICT command-exit 0. tsc --noEmit exit 0 (0 errors); check:test-typecheckOK — the test layer compiles under tsconfig.test.json. Gates re-derived on 21c7dbe76 (identical 36) and all run there: 33 green, the same three prerequisite-not-met (check-test-completeness, check:dual-build-cjs-loads, check:type-check-debt). git merge-tree --write-tree --name-only origin/main HEAD after git fetch origin main (origin/main = fed4fa409): clean, no conflicted paths. GitHub mergeable_state read after the push: clean.

Session: https://claude.ai/code/session_01AUF1NoViznQK32gqpK8wS8

Generated by Claude Code

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/plugin-auth, touching 15 documentable anchor(s).

3 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/kernel/contracts/auth-service.mdx(via AuthManager (symbol, a top-level class))
• content/docs/kernel/services-checklist.mdx(via AuthManager (symbol, a top-level class))
• content/docs/permissions/authentication.mdx(via AuthManager (symbol, a top-level class))

What this run could not see

• the SDK route bridge reached 47 of 219 client-bound route-ledger rows — the other 172 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 172: 14 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 56 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 102 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 11 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json fed4fa40924bd1366354ac9b8a55db9d94a7e404 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 32800235fc78c29dffbfc4bdfd601e0028eb72ca — the merge of head 21c7dbe76b7d44df32fbd9f6497db6372b9f2d0f into base fed4fa40924bd1366354ac9b8a55db9d94a7e404, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 32800235fc78c29dffbfc4bdfd601e0028eb72ca && git checkout 32800235fc78c29dffbfc4bdfd601e0028eb72ca
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin fed4fa40924bd1366354ac9b8a55db9d94a7e404 21c7dbe76b7d44df32fbd9f6497db6372b9f2d0f && git checkout -B drift-repro fed4fa40924bd1366354ac9b8a55db9d94a7e404 && git merge --no-ff 21c7dbe76b7d44df32fbd9f6497db6372b9f2d0f
node scripts/docs-audit/affected-docs.mjs --json fed4fa40924bd1366354ac9b8a55db9d94a7e404

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs fed4fa40924bd1366354ac9b8a55db9d94a7e404 → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[os-sales]

Contract review round 1 at 51000d482: FAIL — patch round 2 in flight

The in-seat isolated Clause-② review (fable tier, transcript-verified 78/78) is posted verbatim on #14360. One blocking finding: a SCIM active: false over a row that already carries an expiring administrator ban leaves the expiry in place, so the vendor's session.create hook auto-unbans and admits the principal once the expiry passes while the identity provider still holds them deactivated. Fix (a pure tightening): on deactivation, make an existing expiring ban permanent (banExpires: null) without touching banned or the administrator's reason; one new suite face pins it.

Also taken up in the same round: the five new symbols move into a non-barrelled module so the package surface does not grow (changeset → patch; Clause-② stays yes for the sign-in accept-set change), plus one-sentence documentation of the last-LOCAL-credential guard exemption on the SCIM path, the marker-collision case, the post-refusal 403 behaviour (also noted on #14522), and a POST /Usersactive: false pin.

needs:contract-review stays on the PR and the card until a delta review passes on the patched head; the PR stays draft.

---

Generated by Claude Code

[os-sales]

Landing provenance — ready + auto-merge at head 21c7dbe76

• Card: [finding] SCIM active:false no longer disables the account — the vendor ban coupling was removed upstream in @better-auth/scim 1.7.0 and nothing in this repo replaced it #14360 (Fixes, closes on merge).
• Contract review (Clause-② yes, accept-set change for SCIM-deactivated principals): in-seat isolated fable review — round 1 FAIL at 51000d482 (14360#issuecomment-5508485458, one blocking finding), patch round 2, round 2 (delta) PASS at 21c7dbe76 (14360#issuecomment-5508938514); transcript verified 105/105 claude-fable-5-1; verdicts adopted verbatim. Provenance for clearing the carriers: the 2026-08-31 maintainer ruling that the dispatching seat completes the contract review in-seat, plus that PASS.
• Carriers: needs:contract-review removed from [finding] SCIM active:false no longer disables the account — the vendor ban coupling was removed upstream in @better-auth/scim 1.7.0 and nothing in this repo replaced it #14360 and from this PR in the same stroke, read back; node scripts/pm/check-clause2-carriers.mjs --pair 14540 → "the clause-② declaration is readable in the fixed spelling and both carriers agree", exit 0.
• Surface: 5 files, all inside the fence (auth-manager.ts, admin-ban-endpoints.ts, new package-internal user-ban-write.ts, the new suite, the changeset patch); src/index.ts byte-identical to origin/main; no packages/spec, no content/docs/releases/; admin-forcing sites untouched.
• CI on 21c7dbe76: every check green — Lint & Repo Gatessuccess at 11:26:32Z, TypeScript Type Checksuccess, Test Core (1/6)success at 11:21:56Z, aggregate Test Coresuccess; mergeable_state: clean.
• Action: draft → ready and auto-merge enabled at ~11:44Z. On MERGED: card auto-closes; strip pm:dispatched from [finding] SCIM active:false no longer disables the account — the vendor ban coupling was removed upstream in @better-auth/scim 1.7.0 and nothing in this repo replaced it #14360; the seat files one follow-up finding for the review's §5 notes 1–5 (docblock word, timed-ban face clock margin and positive control, DELETE-of-last-administrator pin, stale last-admin-guard.ts header, DELETE docblock clause). SCIM provisioning writes run outside any engine transaction on @better-auth/scim 1.7.2 — the #3653 scimRequestScope stamped in verifyBearerToken is not observed at write time (0 engine.transaction calls across POST + PATCH /Users) #14522 (SCIM writes outside an engine transaction on 1.7.2) stays with triage.

---

Generated by Claude Code

[claude]

Fixes#14360

What this does

Stable @better-auth/scim (1.7.0 and later; the repo pins and installs 1.7.2) no longer writes the admin plugin's banned column when an identity provider sends active: false — it hands the user's aggregate lifecycle state to an OPTIONAL host callback, identity.reconcileUser, and then only revokes sessions. plugin-auth passed no identity member, so a deactivation revoked sessions and wrote nothing: sys_user.banned stayed false and a user holding a local password signed straight back in, while ADR-0071, the generated docs and the #13816 construction-time refusal all asserted the ban.

Limb A of the triage ruling, and only limb A:

• auth-manager.ts — the scim({...}) options gain identity.reconcileUser, routed to a new private method reconcileScimUserLifecycle that reads the user through the vendor's transaction-bound adapter and reconciles: active: false on a row that is not banned ⇒ the platform ban write (reason Deactivated via SCIM, the exact string the vendor wrote itself through 1.6.x; no expiry), and on a row already banned WITH an expiry (an administrator's timed ban) ⇒ the ban is made permanent (banExpires cleared, banned and the administrator's reason untouched — the vendor's session hook auto-lifts an expired ban and would otherwise admit a principal the IdP still holds deactivated); active: true on a row banned WITH that reason ⇒ unban; anything else is a no-op (the callback is contractually idempotent and the vendor calls it on EVERY user mutation).
• user-ban-write.ts (new, PACKAGE-INTERNAL — not re-exported from src/index.ts) holds the existing /admin/ban-user / /admin/unban-user write as applyUserBan / applyUserUnban over a minimal UserBanWriter surface; admin-ban-endpoints.ts and the SCIM hook both call that ONE write (field for field the vendor's own banUser shape). No new HTTP endpoint, no new public symbol. The admin mount's behaviour is unchanged (its own suite: 88/88 across the six ban-adjacent files).
• New end-to-end suite scim-deactivation-reconcile-user.test.ts driving @better-auth/scim itself through a real AuthManager over better-sqlite3 (the simulated deprovision() helper in last-admin-guard.test.ts is NOT extended, per triage).
• One changeset for @objectstack/plugin-auth, level patch (see Contract review).

Admin forcing untouched (admin: pluginConfig.admin ?? scimEffective at three sites) — that is the #13816 shape-1 follow-up, not this card. The five stale assertion sites triage listed are untouched and are true again under this change.

Premise (re-verified on origin/main00ff228fe with the package installed)

1. grep -ro "ban" node_modules/@better-auth/scim/dist | wc -l = 0; positive control over node_modules/better-auth/dist/plugins/admin = 117. dist/index.d.mts:267 declares reconcileUser?(input: SCIMIdentityState, context: SCIMTransactionContext); SCIMIdentityState carries userId, the aggregate active (true while ANY participating SCIM source is active), profileSourceId and sources; SCIMTransactionContext carries only database (the DBTransactionAdapter). A throw from the hook: runSCIMApplicationCallback rethrows a better-auth APIError unchanged and wraps anything else as a SCIM 500 with detail SCIM identity reconciliation failed and the original as cause — never swallowed.
2. auth-manager.ts:3265 handed scim() exactly connections: [] and authentication.verifyBearerToken; repo-wide reconcileUser = 0 hits (control verifyBearerToken = 15).
3. admin-ban-endpoints.ts owns the platform ban write and re-runs the last-LOCAL-credential guard; the last-ADMINISTRATOR guard (ADR-0024 D5.2, plugin-auth: break-glass 守卫 —— SCIM/ban 不得停用最后一个管理员(ADR-0024 D5.2,cloud#621 转入) #5892) is an ENGINE beforeUpdate hook in last-admin-guard.ts, registered by auth-plugin.ts at kernel:ready, so it holds on every banned write regardless of caller. Both writes were endpoint-shaped (they parsed a Request); the write itself is now a plain callable.
4. The forced admin plugin supplies the banned column and the sign-in refusal: better-auth/dist/plugins/admin/admin.mjs:36-47 reads user?.banned in the session.create hook and throws FORBIDDEN / BANNED_USER.

PM hypotheses

• H1 — proven with a correction. The vendor invokes the callback inside its runIdentityMutationTransaction with enough identity (userId + aggregate active) to drive the ban write; active: false ⇒ ban with the SCIM reason, active: true ⇒ unban — but only of a ban carrying the SCIM reason. An administrator's ban (any other reason) is deliberately NOT lifted by the IdP: every SCIM PUT carries active: true, so unconditional reconciliation would re-admit a user banned for cause on the next attribute sync. Pinned in face (d). Listed as an open question below in case the maintainer wants IdP-authoritative semantics instead.
• H2 — proven, with a measured residual filed separately. The guard's refusal is LOUD through SCIM: HTTP 403 with the SCIM 2.0 error envelope (schemas contains the Error URN, status: "403", detail = the guard's own text naming last administrator, ADR-0024 D5.2 and SCIM deprovision is too broad); the ban never lands and the administrator still signs in. Residual: the vendor's OWN scimUser.active = false write, made before the callback inside what it believes is a transaction, survives the refusal — because the adapter's SCIM: 停在 @better-auth/scim rc.1,等正式版再整体迁移 —— rc.2 换掉了整套模型 #3653 SCIM transaction scoping never opens an engine transaction on 1.7.2 (measured: 0 engine.transaction and 0 driver.beginTransaction calls across a SCIM POST + PATCH; inScimRequestScope() false at every sys_user / sys_scim_user write). That is a pre-existing defect outside this card's file surface, filed as SCIM provisioning writes run outside any engine transaction on @better-auth/scim 1.7.2 — the #3653 scimRequestScope stamped in verifyBearerToken is not observed at write time (0 engine.transaction calls across POST + PATCH /Users) #14522 (out of scope here); face (c) pins the residual as observed (line 487 on this head) so SCIM provisioning writes run outside any engine transaction on @better-auth/scim 1.7.2 — the #3653 scimRequestScope stamped in verifyBearerToken is not observed at write time (0 engine.transaction calls across POST + PATCH /Users) #14522's landing flips that line deliberately. Operator-visible consequence of that residual: after a refused last-administrator deactivation, every later SCIM mutation of that user — an attribute-only PATCH included — re-attempts the ban and answers 403 until the IdP sends active: true for that user or a second administrator exists (it refuses rather than admits; stated on SCIM provisioning writes run outside any engine transaction on @better-auth/scim 1.7.2 — the #3653 scimRequestScope stamped in verifyBearerToken is not observed at write time (0 engine.transaction calls across POST + PATCH /Users) #14522 as well).
• H3 — proven. No change to the admin-forcing sites was needed; the forced plugin already supplies the column and the refusal (face (a) shows the refusal firing on a SCIM-banned row).

One consequence stated rather than left implicit: on 1.7.2 a SCIM DELETE /Users/{id} tombstones the source instead of deleting the better-auth user, so the aggregate state turns inactive and the hook disables that account (face (f)); re-provisioning through the tombstone re-links the same user and the SCIM ban is lifted.

Tests (head 21c7dbe76)

• pnpm --filter @objectstack/plugin-auth exec vitest run --maxWorkers=2 src/scim-deactivation-reconcile-user.test.ts + the five ban-adjacent siblings (admin-ban-endpoints, admin-remove-user-gate-ordering, break-glass-guard-self-service-target, break-glass-local-credential, session-tombstone) — Test Files 6 passed (6) · Tests 88 passed (88), VERDICT command-exit 0.
• The six SCIM-adjacent siblings (auth-manager, better-auth-schema-parity, credential-at-rest-posture, last-admin-guard, managed-extension-fields, scim-case-insensitive-identifier) — Test Files 6 passed (6) · Tests 469 passed (469), VERDICT command-exit 0.
• tsc --noEmit (src program) exit 0; pnpm --filter @objectstack/plugin-auth check:test-typecheck — OK — the test layer compiles under tsconfig.test.json (the new test file is in that program; the src program excludes tests by design). The tsconfig.examples.json half of the typecheck script resolves the package's own dist types, which this worktree has not built — NOT MEASURED locally; CI builds it.
• Reverse verification on the committed tree (round-1 head 51000d482; the wiring line it removes is unchanged on 21c7dbe76, so the reading was not re-run) (scratchpad/issue-14360/ablation.sh, trap-restored): removed the three-line identity member from the scim() options — proven on disk (marker count 1 → 0, git diff --stat = 3 deletions) — and ran the suite: 6 red / 3 green, exactly (a), (b), the idempotency case, (c) [the request answers 200 instead of the guard's 403], the (c) positive control and (f) red; (d) attribute-only, (d) administrator-ban and (e) green. Restore via git checkout HEAD -- path: git diff HEAD empty, disk blob = HEAD blob e9d5c5eb…, marker count back to 1. No dist rebuild is involved: the suite imports ./auth-manager.js from src, and no workspace dependency was mutated.

Gates (head 21c7dbe76)

node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands derived 36 commands from the changeset (re-derived on 21c7dbe76 after the changed-file set grew by user-ban-write.ts: identical list); each run at 21c7dbe76 with its exit captured before any pipe. 33 green, including check-system-context-census (OK — 109 elevation read sites … all anchored; 0 anchors on the two edited files, no census fix needed), check:cross-package-test-inputs, check:test-source-alias, check:engine-double-contract, check:logger-receiver-detach, check-adr-0087-registration (non-breaking changeset), check-changeset-no-major. Three answered exit 3 = PREREQUISITE NOT MET by their own verdict text, recorded as NOT MEASURED locally (CI owns them): check-test-completeness (needs a saved turbo test log), check:dual-build-cjs-loads (needs pnpm build), check:type-check-debt (needs the full built closure). Control-character self-scan over the four changed files: clean.

Contract review (Clause ②)

• Behaviour change, as accept/reject: a principal an identity provider has deactivated over SCIM (active: false, or deleted) is now REJECTED at sign-in with the vendor's 403 BANNED_USER (before: sessions revoked, sign-in ACCEPTED); an IdP active: true re-ACCEPTS a principal whose ban carries the SCIM reason (an administrator's ban stays a rejection). Deactivating the last administrator over SCIM is REJECTED with a 403 SCIM error (before: accepted, disabling nothing).
• Exported-symbol delta (git diff -U0 00ff228fe...HEAD | grep -E '^[+-].*\bexport\b'): five export lines, ALL in the new package-internal module packages/plugins/plugin-auth/src/user-ban-write.ts (UserBanWriter, UserBanFields, SCIM_DEACTIVATION_BAN_REASON, applyUserBan, applyUserUnban). NO new export is reachable through src/index.ts: the barrel is untouched (84 lines before and after, zero references to user-ban-write), and the same grep over admin-ban-endpoints.ts, auth-manager.ts and index.ts prints nothing. No removals, no signature changes to existing exports. The scim() options gain the vendor's identity member (not an ObjectStack-authored config key).
• Changeset level:patch — a bug fix restoring the declared behaviour with no new public symbol. Clause-② stays yes: sign-in accept/reject changes for a class of principals; the needs:contract-review carriers stay on the card and the PR.
• Log levels: no new log site of any level; the last-admin refusal is an error RESPONSE through the vendor's SCIM error mapping.

Out of scope, filed

• SCIM provisioning writes run outside any engine transaction on @better-auth/scim 1.7.2 — the #3653 scimRequestScope stamped in verifyBearerToken is not observed at write time (0 engine.transaction calls across POST + PATCH /Users) #14522 — SCIM provisioning writes run outside any engine transaction on 1.7.2 (the SCIM: 停在 @better-auth/scim rc.1,等正式版再整体迁移 —— rc.2 换掉了整套模型 #3653scimRequestScope stamped in verifyBearerToken is not observed at write time). Unassigned; the residual it leaves on a refused deactivation is pinned in face (c) of the new suite (line 487), and the post-refusal behaviour above is posted on that card.

Patch round 2 (head 21c7dbe76) — the in-seat contract review's round-1 verdict, item by item

• A (blocking finding 1 — implemented exactly as written).reconcileScimUserLifecycle reads banExpires too; in the !state.active branch a banned row with a non-null expiry gets { banExpires: null, updatedAt } and returns, otherwise returns — banned and the administrator's banReason untouched. Docblock first bullet and the changeset sentence say a deactivation also makes an existing expiring ban permanent. New face under (d): administrator ban with ban_expires 1.5s ahead, PATCH active: false → 200, expiry cleared and reason kept, then after the expiry has passed sign-in still answers 403 BANNED_USER (status AND code).
• B (note 1, required). Shared write moved to the non-barrelled user-ban-write.ts; admin-ban-endpoints.ts, auth-manager.ts and the suite import it. Barrel export surface unchanged; changeset patch; the "New exports" paragraph removed.
• C (notes 2, 3, 4, 6, 7). (2) changeset: the last-LOCAL-credential guard is deliberately not applied on the SCIM path — an IdP deprovision can disable the last password-holding account while non-administrator SSO users remain. (3) marker collision documented in the method docblock and the changeset (an administrator who types Deactivated via SCIM produces a ban the IdP can lift); the string is NOT reserved on the admin mount. (4) post-refusal behaviour stated above and on SCIM provisioning writes run outside any engine transaction on @better-auth/scim 1.7.2 — the #3653 scimRequestScope stamped in verifyBearerToken is not observed at write time (0 engine.transaction calls across POST + PATCH /Users) #14522. (6) new face (g): POST /Users with active: false provisions the account disabled — banned with the SCIM reason, sign-in 403 BANNED_USER. (7) SCIM provisioning writes run outside any engine transaction on @better-auth/scim 1.7.2 — the #3653 scimRequestScope stamped in verifyBearerToken is not observed at write time (0 engine.transaction calls across POST + PATCH /Users) #14522 carries the line-487 pin citation.
• D (verification at 21c7dbe76, verify-lock sessions each under the cap, exits before any pipe). New suite + five ban-adjacent siblings: Test Files 6 passed (6) · Tests 88 passed (88), VERDICT command-exit 0. Six SCIM-adjacent siblings: Test Files 6 passed (6) · Tests 469 passed (469), VERDICT command-exit 0. tsc --noEmit exit 0 (0 errors); check:test-typecheckOK — the test layer compiles under tsconfig.test.json. Gates re-derived on 21c7dbe76 (identical 36) and all run there: 33 green, the same three prerequisite-not-met (check-test-completeness, check:dual-build-cjs-loads, check:type-check-debt). git merge-tree --write-tree --name-only origin/main HEAD after git fetch origin main (origin/main = fed4fa409): clean, no conflicted paths. GitHub mergeable_state read after the push: clean.

Session: https://claude.ai/code/session_01AUF1NoViznQK32gqpK8wS8

Generated by Claude Code

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/plugin-auth, touching 15 documentable anchor(s).

3 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/kernel/contracts/auth-service.mdx(via AuthManager (symbol, a top-level class))
• content/docs/kernel/services-checklist.mdx(via AuthManager (symbol, a top-level class))
• content/docs/permissions/authentication.mdx(via AuthManager (symbol, a top-level class))

What this run could not see

• the SDK route bridge reached 47 of 219 client-bound route-ledger rows — the other 172 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 172: 14 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 56 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 102 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 11 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json fed4fa40924bd1366354ac9b8a55db9d94a7e404 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 32800235fc78c29dffbfc4bdfd601e0028eb72ca — the merge of head 21c7dbe76b7d44df32fbd9f6497db6372b9f2d0f into base fed4fa40924bd1366354ac9b8a55db9d94a7e404, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 32800235fc78c29dffbfc4bdfd601e0028eb72ca && git checkout 32800235fc78c29dffbfc4bdfd601e0028eb72ca
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin fed4fa40924bd1366354ac9b8a55db9d94a7e404 21c7dbe76b7d44df32fbd9f6497db6372b9f2d0f && git checkout -B drift-repro fed4fa40924bd1366354ac9b8a55db9d94a7e404 && git merge --no-ff 21c7dbe76b7d44df32fbd9f6497db6372b9f2d0f
node scripts/docs-audit/affected-docs.mjs --json fed4fa40924bd1366354ac9b8a55db9d94a7e404

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs fed4fa40924bd1366354ac9b8a55db9d94a7e404 → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[os-sales]

Contract review round 1 at 51000d482: FAIL — patch round 2 in flight

The in-seat isolated Clause-② review (fable tier, transcript-verified 78/78) is posted verbatim on #14360. One blocking finding: a SCIM active: false over a row that already carries an expiring administrator ban leaves the expiry in place, so the vendor's session.create hook auto-unbans and admits the principal once the expiry passes while the identity provider still holds them deactivated. Fix (a pure tightening): on deactivation, make an existing expiring ban permanent (banExpires: null) without touching banned or the administrator's reason; one new suite face pins it.

Also taken up in the same round: the five new symbols move into a non-barrelled module so the package surface does not grow (changeset → patch; Clause-② stays yes for the sign-in accept-set change), plus one-sentence documentation of the last-LOCAL-credential guard exemption on the SCIM path, the marker-collision case, the post-refusal 403 behaviour (also noted on #14522), and a POST /Usersactive: false pin.

needs:contract-review stays on the PR and the card until a delta review passes on the patched head; the PR stays draft.

---

Generated by Claude Code

[os-sales]

Landing provenance — ready + auto-merge at head 21c7dbe76

• Card: [finding] SCIM active:false no longer disables the account — the vendor ban coupling was removed upstream in @better-auth/scim 1.7.0 and nothing in this repo replaced it #14360 (Fixes, closes on merge).
• Contract review (Clause-② yes, accept-set change for SCIM-deactivated principals): in-seat isolated fable review — round 1 FAIL at 51000d482 (14360#issuecomment-5508485458, one blocking finding), patch round 2, round 2 (delta) PASS at 21c7dbe76 (14360#issuecomment-5508938514); transcript verified 105/105 claude-fable-5-1; verdicts adopted verbatim. Provenance for clearing the carriers: the 2026-08-31 maintainer ruling that the dispatching seat completes the contract review in-seat, plus that PASS.
• Carriers: needs:contract-review removed from [finding] SCIM active:false no longer disables the account — the vendor ban coupling was removed upstream in @better-auth/scim 1.7.0 and nothing in this repo replaced it #14360 and from this PR in the same stroke, read back; node scripts/pm/check-clause2-carriers.mjs --pair 14540 → "the clause-② declaration is readable in the fixed spelling and both carriers agree", exit 0.
• Surface: 5 files, all inside the fence (auth-manager.ts, admin-ban-endpoints.ts, new package-internal user-ban-write.ts, the new suite, the changeset patch); src/index.ts byte-identical to origin/main; no packages/spec, no content/docs/releases/; admin-forcing sites untouched.
• CI on 21c7dbe76: every check green — Lint & Repo Gatessuccess at 11:26:32Z, TypeScript Type Checksuccess, Test Core (1/6)success at 11:21:56Z, aggregate Test Coresuccess; mergeable_state: clean.
• Action: draft → ready and auto-merge enabled at ~11:44Z. On MERGED: card auto-closes; strip pm:dispatched from [finding] SCIM active:false no longer disables the account — the vendor ban coupling was removed upstream in @better-auth/scim 1.7.0 and nothing in this repo replaced it #14360; the seat files one follow-up finding for the review's §5 notes 1–5 (docblock word, timed-ban face clock margin and positive control, DELETE-of-last-administrator pin, stale last-admin-guard.ts header, DELETE docblock clause). SCIM provisioning writes run outside any engine transaction on @better-auth/scim 1.7.2 — the #3653 scimRequestScope stamped in verifyBearerToken is not observed at write time (0 engine.transaction calls across POST + PATCH /Users) #14522 (SCIM writes outside an engine transaction on 1.7.2) stays with triage.

---

Generated by Claude Code

[claude]

Fixes#14360

What this does

Stable @better-auth/scim (1.7.0 and later; the repo pins and installs 1.7.2) no longer writes the admin plugin's banned column when an identity provider sends active: false — it hands the user's aggregate lifecycle state to an OPTIONAL host callback, identity.reconcileUser, and then only revokes sessions. plugin-auth passed no identity member, so a deactivation revoked sessions and wrote nothing: sys_user.banned stayed false and a user holding a local password signed straight back in, while ADR-0071, the generated docs and the #13816 construction-time refusal all asserted the ban.

Limb A of the triage ruling, and only limb A:

• auth-manager.ts — the scim({...}) options gain identity.reconcileUser, routed to a new private method reconcileScimUserLifecycle that reads the user through the vendor's transaction-bound adapter and reconciles: active: false on a row that is not banned ⇒ the platform ban write (reason Deactivated via SCIM, the exact string the vendor wrote itself through 1.6.x; no expiry), and on a row already banned WITH an expiry (an administrator's timed ban) ⇒ the ban is made permanent (banExpires cleared, banned and the administrator's reason untouched — the vendor's session hook auto-lifts an expired ban and would otherwise admit a principal the IdP still holds deactivated); active: true on a row banned WITH that reason ⇒ unban; anything else is a no-op (the callback is contractually idempotent and the vendor calls it on EVERY user mutation).
• user-ban-write.ts (new, PACKAGE-INTERNAL — not re-exported from src/index.ts) holds the existing /admin/ban-user / /admin/unban-user write as applyUserBan / applyUserUnban over a minimal UserBanWriter surface; admin-ban-endpoints.ts and the SCIM hook both call that ONE write (field for field the vendor's own banUser shape). No new HTTP endpoint, no new public symbol. The admin mount's behaviour is unchanged (its own suite: 88/88 across the six ban-adjacent files).
• New end-to-end suite scim-deactivation-reconcile-user.test.ts driving @better-auth/scim itself through a real AuthManager over better-sqlite3 (the simulated deprovision() helper in last-admin-guard.test.ts is NOT extended, per triage).
• One changeset for @objectstack/plugin-auth, level patch (see Contract review).

Admin forcing untouched (admin: pluginConfig.admin ?? scimEffective at three sites) — that is the #13816 shape-1 follow-up, not this card. The five stale assertion sites triage listed are untouched and are true again under this change.

Premise (re-verified on origin/main00ff228fe with the package installed)

1. grep -ro "ban" node_modules/@better-auth/scim/dist | wc -l = 0; positive control over node_modules/better-auth/dist/plugins/admin = 117. dist/index.d.mts:267 declares reconcileUser?(input: SCIMIdentityState, context: SCIMTransactionContext); SCIMIdentityState carries userId, the aggregate active (true while ANY participating SCIM source is active), profileSourceId and sources; SCIMTransactionContext carries only database (the DBTransactionAdapter). A throw from the hook: runSCIMApplicationCallback rethrows a better-auth APIError unchanged and wraps anything else as a SCIM 500 with detail SCIM identity reconciliation failed and the original as cause — never swallowed.
2. auth-manager.ts:3265 handed scim() exactly connections: [] and authentication.verifyBearerToken; repo-wide reconcileUser = 0 hits (control verifyBearerToken = 15).
3. admin-ban-endpoints.ts owns the platform ban write and re-runs the last-LOCAL-credential guard; the last-ADMINISTRATOR guard (ADR-0024 D5.2, plugin-auth: break-glass 守卫 —— SCIM/ban 不得停用最后一个管理员(ADR-0024 D5.2,cloud#621 转入) #5892) is an ENGINE beforeUpdate hook in last-admin-guard.ts, registered by auth-plugin.ts at kernel:ready, so it holds on every banned write regardless of caller. Both writes were endpoint-shaped (they parsed a Request); the write itself is now a plain callable.
4. The forced admin plugin supplies the banned column and the sign-in refusal: better-auth/dist/plugins/admin/admin.mjs:36-47 reads user?.banned in the session.create hook and throws FORBIDDEN / BANNED_USER.

PM hypotheses

• H1 — proven with a correction. The vendor invokes the callback inside its runIdentityMutationTransaction with enough identity (userId + aggregate active) to drive the ban write; active: false ⇒ ban with the SCIM reason, active: true ⇒ unban — but only of a ban carrying the SCIM reason. An administrator's ban (any other reason) is deliberately NOT lifted by the IdP: every SCIM PUT carries active: true, so unconditional reconciliation would re-admit a user banned for cause on the next attribute sync. Pinned in face (d). Listed as an open question below in case the maintainer wants IdP-authoritative semantics instead.
• H2 — proven, with a measured residual filed separately. The guard's refusal is LOUD through SCIM: HTTP 403 with the SCIM 2.0 error envelope (schemas contains the Error URN, status: "403", detail = the guard's own text naming last administrator, ADR-0024 D5.2 and SCIM deprovision is too broad); the ban never lands and the administrator still signs in. Residual: the vendor's OWN scimUser.active = false write, made before the callback inside what it believes is a transaction, survives the refusal — because the adapter's SCIM: 停在 @better-auth/scim rc.1,等正式版再整体迁移 —— rc.2 换掉了整套模型 #3653 SCIM transaction scoping never opens an engine transaction on 1.7.2 (measured: 0 engine.transaction and 0 driver.beginTransaction calls across a SCIM POST + PATCH; inScimRequestScope() false at every sys_user / sys_scim_user write). That is a pre-existing defect outside this card's file surface, filed as SCIM provisioning writes run outside any engine transaction on @better-auth/scim 1.7.2 — the #3653 scimRequestScope stamped in verifyBearerToken is not observed at write time (0 engine.transaction calls across POST + PATCH /Users) #14522 (out of scope here); face (c) pins the residual as observed (line 487 on this head) so SCIM provisioning writes run outside any engine transaction on @better-auth/scim 1.7.2 — the #3653 scimRequestScope stamped in verifyBearerToken is not observed at write time (0 engine.transaction calls across POST + PATCH /Users) #14522's landing flips that line deliberately. Operator-visible consequence of that residual: after a refused last-administrator deactivation, every later SCIM mutation of that user — an attribute-only PATCH included — re-attempts the ban and answers 403 until the IdP sends active: true for that user or a second administrator exists (it refuses rather than admits; stated on SCIM provisioning writes run outside any engine transaction on @better-auth/scim 1.7.2 — the #3653 scimRequestScope stamped in verifyBearerToken is not observed at write time (0 engine.transaction calls across POST + PATCH /Users) #14522 as well).
• H3 — proven. No change to the admin-forcing sites was needed; the forced plugin already supplies the column and the refusal (face (a) shows the refusal firing on a SCIM-banned row).

One consequence stated rather than left implicit: on 1.7.2 a SCIM DELETE /Users/{id} tombstones the source instead of deleting the better-auth user, so the aggregate state turns inactive and the hook disables that account (face (f)); re-provisioning through the tombstone re-links the same user and the SCIM ban is lifted.

Tests (head 21c7dbe76)

• pnpm --filter @objectstack/plugin-auth exec vitest run --maxWorkers=2 src/scim-deactivation-reconcile-user.test.ts + the five ban-adjacent siblings (admin-ban-endpoints, admin-remove-user-gate-ordering, break-glass-guard-self-service-target, break-glass-local-credential, session-tombstone) — Test Files 6 passed (6) · Tests 88 passed (88), VERDICT command-exit 0.
• The six SCIM-adjacent siblings (auth-manager, better-auth-schema-parity, credential-at-rest-posture, last-admin-guard, managed-extension-fields, scim-case-insensitive-identifier) — Test Files 6 passed (6) · Tests 469 passed (469), VERDICT command-exit 0.
• tsc --noEmit (src program) exit 0; pnpm --filter @objectstack/plugin-auth check:test-typecheck — OK — the test layer compiles under tsconfig.test.json (the new test file is in that program; the src program excludes tests by design). The tsconfig.examples.json half of the typecheck script resolves the package's own dist types, which this worktree has not built — NOT MEASURED locally; CI builds it.
• Reverse verification on the committed tree (round-1 head 51000d482; the wiring line it removes is unchanged on 21c7dbe76, so the reading was not re-run) (scratchpad/issue-14360/ablation.sh, trap-restored): removed the three-line identity member from the scim() options — proven on disk (marker count 1 → 0, git diff --stat = 3 deletions) — and ran the suite: 6 red / 3 green, exactly (a), (b), the idempotency case, (c) [the request answers 200 instead of the guard's 403], the (c) positive control and (f) red; (d) attribute-only, (d) administrator-ban and (e) green. Restore via git checkout HEAD -- path: git diff HEAD empty, disk blob = HEAD blob e9d5c5eb…, marker count back to 1. No dist rebuild is involved: the suite imports ./auth-manager.js from src, and no workspace dependency was mutated.

Gates (head 21c7dbe76)

node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands derived 36 commands from the changeset (re-derived on 21c7dbe76 after the changed-file set grew by user-ban-write.ts: identical list); each run at 21c7dbe76 with its exit captured before any pipe. 33 green, including check-system-context-census (OK — 109 elevation read sites … all anchored; 0 anchors on the two edited files, no census fix needed), check:cross-package-test-inputs, check:test-source-alias, check:engine-double-contract, check:logger-receiver-detach, check-adr-0087-registration (non-breaking changeset), check-changeset-no-major. Three answered exit 3 = PREREQUISITE NOT MET by their own verdict text, recorded as NOT MEASURED locally (CI owns them): check-test-completeness (needs a saved turbo test log), check:dual-build-cjs-loads (needs pnpm build), check:type-check-debt (needs the full built closure). Control-character self-scan over the four changed files: clean.

Contract review (Clause ②)

• Behaviour change, as accept/reject: a principal an identity provider has deactivated over SCIM (active: false, or deleted) is now REJECTED at sign-in with the vendor's 403 BANNED_USER (before: sessions revoked, sign-in ACCEPTED); an IdP active: true re-ACCEPTS a principal whose ban carries the SCIM reason (an administrator's ban stays a rejection). Deactivating the last administrator over SCIM is REJECTED with a 403 SCIM error (before: accepted, disabling nothing).
• Exported-symbol delta (git diff -U0 00ff228fe...HEAD | grep -E '^[+-].*\bexport\b'): five export lines, ALL in the new package-internal module packages/plugins/plugin-auth/src/user-ban-write.ts (UserBanWriter, UserBanFields, SCIM_DEACTIVATION_BAN_REASON, applyUserBan, applyUserUnban). NO new export is reachable through src/index.ts: the barrel is untouched (84 lines before and after, zero references to user-ban-write), and the same grep over admin-ban-endpoints.ts, auth-manager.ts and index.ts prints nothing. No removals, no signature changes to existing exports. The scim() options gain the vendor's identity member (not an ObjectStack-authored config key).
• Changeset level:patch — a bug fix restoring the declared behaviour with no new public symbol. Clause-② stays yes: sign-in accept/reject changes for a class of principals; the needs:contract-review carriers stay on the card and the PR.
• Log levels: no new log site of any level; the last-admin refusal is an error RESPONSE through the vendor's SCIM error mapping.

Out of scope, filed

• SCIM provisioning writes run outside any engine transaction on @better-auth/scim 1.7.2 — the #3653 scimRequestScope stamped in verifyBearerToken is not observed at write time (0 engine.transaction calls across POST + PATCH /Users) #14522 — SCIM provisioning writes run outside any engine transaction on 1.7.2 (the SCIM: 停在 @better-auth/scim rc.1,等正式版再整体迁移 —— rc.2 换掉了整套模型 #3653scimRequestScope stamped in verifyBearerToken is not observed at write time). Unassigned; the residual it leaves on a refused deactivation is pinned in face (c) of the new suite (line 487), and the post-refusal behaviour above is posted on that card.

Patch round 2 (head 21c7dbe76) — the in-seat contract review's round-1 verdict, item by item

• A (blocking finding 1 — implemented exactly as written).reconcileScimUserLifecycle reads banExpires too; in the !state.active branch a banned row with a non-null expiry gets { banExpires: null, updatedAt } and returns, otherwise returns — banned and the administrator's banReason untouched. Docblock first bullet and the changeset sentence say a deactivation also makes an existing expiring ban permanent. New face under (d): administrator ban with ban_expires 1.5s ahead, PATCH active: false → 200, expiry cleared and reason kept, then after the expiry has passed sign-in still answers 403 BANNED_USER (status AND code).
• B (note 1, required). Shared write moved to the non-barrelled user-ban-write.ts; admin-ban-endpoints.ts, auth-manager.ts and the suite import it. Barrel export surface unchanged; changeset patch; the "New exports" paragraph removed.
• C (notes 2, 3, 4, 6, 7). (2) changeset: the last-LOCAL-credential guard is deliberately not applied on the SCIM path — an IdP deprovision can disable the last password-holding account while non-administrator SSO users remain. (3) marker collision documented in the method docblock and the changeset (an administrator who types Deactivated via SCIM produces a ban the IdP can lift); the string is NOT reserved on the admin mount. (4) post-refusal behaviour stated above and on SCIM provisioning writes run outside any engine transaction on @better-auth/scim 1.7.2 — the #3653 scimRequestScope stamped in verifyBearerToken is not observed at write time (0 engine.transaction calls across POST + PATCH /Users) #14522. (6) new face (g): POST /Users with active: false provisions the account disabled — banned with the SCIM reason, sign-in 403 BANNED_USER. (7) SCIM provisioning writes run outside any engine transaction on @better-auth/scim 1.7.2 — the #3653 scimRequestScope stamped in verifyBearerToken is not observed at write time (0 engine.transaction calls across POST + PATCH /Users) #14522 carries the line-487 pin citation.
• D (verification at 21c7dbe76, verify-lock sessions each under the cap, exits before any pipe). New suite + five ban-adjacent siblings: Test Files 6 passed (6) · Tests 88 passed (88), VERDICT command-exit 0. Six SCIM-adjacent siblings: Test Files 6 passed (6) · Tests 469 passed (469), VERDICT command-exit 0. tsc --noEmit exit 0 (0 errors); check:test-typecheckOK — the test layer compiles under tsconfig.test.json. Gates re-derived on 21c7dbe76 (identical 36) and all run there: 33 green, the same three prerequisite-not-met (check-test-completeness, check:dual-build-cjs-loads, check:type-check-debt). git merge-tree --write-tree --name-only origin/main HEAD after git fetch origin main (origin/main = fed4fa409): clean, no conflicted paths. GitHub mergeable_state read after the push: clean.

Session: https://claude.ai/code/session_01AUF1NoViznQK32gqpK8wS8

Generated by Claude Code

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/plugin-auth, touching 15 documentable anchor(s).

3 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/kernel/contracts/auth-service.mdx(via AuthManager (symbol, a top-level class))
• content/docs/kernel/services-checklist.mdx(via AuthManager (symbol, a top-level class))
• content/docs/permissions/authentication.mdx(via AuthManager (symbol, a top-level class))

What this run could not see

• the SDK route bridge reached 47 of 219 client-bound route-ledger rows — the other 172 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 172: 14 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 56 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 102 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 11 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json fed4fa40924bd1366354ac9b8a55db9d94a7e404 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 32800235fc78c29dffbfc4bdfd601e0028eb72ca — the merge of head 21c7dbe76b7d44df32fbd9f6497db6372b9f2d0f into base fed4fa40924bd1366354ac9b8a55db9d94a7e404, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 32800235fc78c29dffbfc4bdfd601e0028eb72ca && git checkout 32800235fc78c29dffbfc4bdfd601e0028eb72ca
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin fed4fa40924bd1366354ac9b8a55db9d94a7e404 21c7dbe76b7d44df32fbd9f6497db6372b9f2d0f && git checkout -B drift-repro fed4fa40924bd1366354ac9b8a55db9d94a7e404 && git merge --no-ff 21c7dbe76b7d44df32fbd9f6497db6372b9f2d0f
node scripts/docs-audit/affected-docs.mjs --json fed4fa40924bd1366354ac9b8a55db9d94a7e404

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs fed4fa40924bd1366354ac9b8a55db9d94a7e404 → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[os-sales]

Contract review round 1 at 51000d482: FAIL — patch round 2 in flight

The in-seat isolated Clause-② review (fable tier, transcript-verified 78/78) is posted verbatim on #14360. One blocking finding: a SCIM active: false over a row that already carries an expiring administrator ban leaves the expiry in place, so the vendor's session.create hook auto-unbans and admits the principal once the expiry passes while the identity provider still holds them deactivated. Fix (a pure tightening): on deactivation, make an existing expiring ban permanent (banExpires: null) without touching banned or the administrator's reason; one new suite face pins it.

Also taken up in the same round: the five new symbols move into a non-barrelled module so the package surface does not grow (changeset → patch; Clause-② stays yes for the sign-in accept-set change), plus one-sentence documentation of the last-LOCAL-credential guard exemption on the SCIM path, the marker-collision case, the post-refusal 403 behaviour (also noted on #14522), and a POST /Usersactive: false pin.

needs:contract-review stays on the PR and the card until a delta review passes on the patched head; the PR stays draft.

---

Generated by Claude Code

[os-sales]

Landing provenance — ready + auto-merge at head 21c7dbe76

• Card: [finding] SCIM active:false no longer disables the account — the vendor ban coupling was removed upstream in @better-auth/scim 1.7.0 and nothing in this repo replaced it #14360 (Fixes, closes on merge).
• Contract review (Clause-② yes, accept-set change for SCIM-deactivated principals): in-seat isolated fable review — round 1 FAIL at 51000d482 (14360#issuecomment-5508485458, one blocking finding), patch round 2, round 2 (delta) PASS at 21c7dbe76 (14360#issuecomment-5508938514); transcript verified 105/105 claude-fable-5-1; verdicts adopted verbatim. Provenance for clearing the carriers: the 2026-08-31 maintainer ruling that the dispatching seat completes the contract review in-seat, plus that PASS.
• Carriers: needs:contract-review removed from [finding] SCIM active:false no longer disables the account — the vendor ban coupling was removed upstream in @better-auth/scim 1.7.0 and nothing in this repo replaced it #14360 and from this PR in the same stroke, read back; node scripts/pm/check-clause2-carriers.mjs --pair 14540 → "the clause-② declaration is readable in the fixed spelling and both carriers agree", exit 0.
• Surface: 5 files, all inside the fence (auth-manager.ts, admin-ban-endpoints.ts, new package-internal user-ban-write.ts, the new suite, the changeset patch); src/index.ts byte-identical to origin/main; no packages/spec, no content/docs/releases/; admin-forcing sites untouched.
• CI on 21c7dbe76: every check green — Lint & Repo Gatessuccess at 11:26:32Z, TypeScript Type Checksuccess, Test Core (1/6)success at 11:21:56Z, aggregate Test Coresuccess; mergeable_state: clean.
• Action: draft → ready and auto-merge enabled at ~11:44Z. On MERGED: card auto-closes; strip pm:dispatched from [finding] SCIM active:false no longer disables the account — the vendor ban coupling was removed upstream in @better-auth/scim 1.7.0 and nothing in this repo replaced it #14360; the seat files one follow-up finding for the review's §5 notes 1–5 (docblock word, timed-ban face clock margin and positive control, DELETE-of-last-administrator pin, stale last-admin-guard.ts header, DELETE docblock clause). SCIM provisioning writes run outside any engine transaction on @better-auth/scim 1.7.2 — the #3653 scimRequestScope stamped in verifyBearerToken is not observed at write time (0 engine.transaction calls across POST + PATCH /Users) #14522 (SCIM writes outside an engine transaction on 1.7.2) stays with triage.

---

Generated by Claude Code

[claude]

Fixes#14360

What this does

Stable @better-auth/scim (1.7.0 and later; the repo pins and installs 1.7.2) no longer writes the admin plugin's banned column when an identity provider sends active: false — it hands the user's aggregate lifecycle state to an OPTIONAL host callback, identity.reconcileUser, and then only revokes sessions. plugin-auth passed no identity member, so a deactivation revoked sessions and wrote nothing: sys_user.banned stayed false and a user holding a local password signed straight back in, while ADR-0071, the generated docs and the #13816 construction-time refusal all asserted the ban.

Limb A of the triage ruling, and only limb A:

• auth-manager.ts — the scim({...}) options gain identity.reconcileUser, routed to a new private method reconcileScimUserLifecycle that reads the user through the vendor's transaction-bound adapter and reconciles: active: false on a row that is not banned ⇒ the platform ban write (reason Deactivated via SCIM, the exact string the vendor wrote itself through 1.6.x; no expiry), and on a row already banned WITH an expiry (an administrator's timed ban) ⇒ the ban is made permanent (banExpires cleared, banned and the administrator's reason untouched — the vendor's session hook auto-lifts an expired ban and would otherwise admit a principal the IdP still holds deactivated); active: true on a row banned WITH that reason ⇒ unban; anything else is a no-op (the callback is contractually idempotent and the vendor calls it on EVERY user mutation).
• user-ban-write.ts (new, PACKAGE-INTERNAL — not re-exported from src/index.ts) holds the existing /admin/ban-user / /admin/unban-user write as applyUserBan / applyUserUnban over a minimal UserBanWriter surface; admin-ban-endpoints.ts and the SCIM hook both call that ONE write (field for field the vendor's own banUser shape). No new HTTP endpoint, no new public symbol. The admin mount's behaviour is unchanged (its own suite: 88/88 across the six ban-adjacent files).
• New end-to-end suite scim-deactivation-reconcile-user.test.ts driving @better-auth/scim itself through a real AuthManager over better-sqlite3 (the simulated deprovision() helper in last-admin-guard.test.ts is NOT extended, per triage).
• One changeset for @objectstack/plugin-auth, level patch (see Contract review).

Admin forcing untouched (admin: pluginConfig.admin ?? scimEffective at three sites) — that is the #13816 shape-1 follow-up, not this card. The five stale assertion sites triage listed are untouched and are true again under this change.

Premise (re-verified on origin/main00ff228fe with the package installed)

1. grep -ro "ban" node_modules/@better-auth/scim/dist | wc -l = 0; positive control over node_modules/better-auth/dist/plugins/admin = 117. dist/index.d.mts:267 declares reconcileUser?(input: SCIMIdentityState, context: SCIMTransactionContext); SCIMIdentityState carries userId, the aggregate active (true while ANY participating SCIM source is active), profileSourceId and sources; SCIMTransactionContext carries only database (the DBTransactionAdapter). A throw from the hook: runSCIMApplicationCallback rethrows a better-auth APIError unchanged and wraps anything else as a SCIM 500 with detail SCIM identity reconciliation failed and the original as cause — never swallowed.
2. auth-manager.ts:3265 handed scim() exactly connections: [] and authentication.verifyBearerToken; repo-wide reconcileUser = 0 hits (control verifyBearerToken = 15).
3. admin-ban-endpoints.ts owns the platform ban write and re-runs the last-LOCAL-credential guard; the last-ADMINISTRATOR guard (ADR-0024 D5.2, plugin-auth: break-glass 守卫 —— SCIM/ban 不得停用最后一个管理员(ADR-0024 D5.2,cloud#621 转入) #5892) is an ENGINE beforeUpdate hook in last-admin-guard.ts, registered by auth-plugin.ts at kernel:ready, so it holds on every banned write regardless of caller. Both writes were endpoint-shaped (they parsed a Request); the write itself is now a plain callable.
4. The forced admin plugin supplies the banned column and the sign-in refusal: better-auth/dist/plugins/admin/admin.mjs:36-47 reads user?.banned in the session.create hook and throws FORBIDDEN / BANNED_USER.

PM hypotheses

• H1 — proven with a correction. The vendor invokes the callback inside its runIdentityMutationTransaction with enough identity (userId + aggregate active) to drive the ban write; active: false ⇒ ban with the SCIM reason, active: true ⇒ unban — but only of a ban carrying the SCIM reason. An administrator's ban (any other reason) is deliberately NOT lifted by the IdP: every SCIM PUT carries active: true, so unconditional reconciliation would re-admit a user banned for cause on the next attribute sync. Pinned in face (d). Listed as an open question below in case the maintainer wants IdP-authoritative semantics instead.
• H2 — proven, with a measured residual filed separately. The guard's refusal is LOUD through SCIM: HTTP 403 with the SCIM 2.0 error envelope (schemas contains the Error URN, status: "403", detail = the guard's own text naming last administrator, ADR-0024 D5.2 and SCIM deprovision is too broad); the ban never lands and the administrator still signs in. Residual: the vendor's OWN scimUser.active = false write, made before the callback inside what it believes is a transaction, survives the refusal — because the adapter's SCIM: 停在 @better-auth/scim rc.1,等正式版再整体迁移 —— rc.2 换掉了整套模型 #3653 SCIM transaction scoping never opens an engine transaction on 1.7.2 (measured: 0 engine.transaction and 0 driver.beginTransaction calls across a SCIM POST + PATCH; inScimRequestScope() false at every sys_user / sys_scim_user write). That is a pre-existing defect outside this card's file surface, filed as SCIM provisioning writes run outside any engine transaction on @better-auth/scim 1.7.2 — the #3653 scimRequestScope stamped in verifyBearerToken is not observed at write time (0 engine.transaction calls across POST + PATCH /Users) #14522 (out of scope here); face (c) pins the residual as observed (line 487 on this head) so SCIM provisioning writes run outside any engine transaction on @better-auth/scim 1.7.2 — the #3653 scimRequestScope stamped in verifyBearerToken is not observed at write time (0 engine.transaction calls across POST + PATCH /Users) #14522's landing flips that line deliberately. Operator-visible consequence of that residual: after a refused last-administrator deactivation, every later SCIM mutation of that user — an attribute-only PATCH included — re-attempts the ban and answers 403 until the IdP sends active: true for that user or a second administrator exists (it refuses rather than admits; stated on SCIM provisioning writes run outside any engine transaction on @better-auth/scim 1.7.2 — the #3653 scimRequestScope stamped in verifyBearerToken is not observed at write time (0 engine.transaction calls across POST + PATCH /Users) #14522 as well).
• H3 — proven. No change to the admin-forcing sites was needed; the forced plugin already supplies the column and the refusal (face (a) shows the refusal firing on a SCIM-banned row).

One consequence stated rather than left implicit: on 1.7.2 a SCIM DELETE /Users/{id} tombstones the source instead of deleting the better-auth user, so the aggregate state turns inactive and the hook disables that account (face (f)); re-provisioning through the tombstone re-links the same user and the SCIM ban is lifted.

Tests (head 21c7dbe76)

• pnpm --filter @objectstack/plugin-auth exec vitest run --maxWorkers=2 src/scim-deactivation-reconcile-user.test.ts + the five ban-adjacent siblings (admin-ban-endpoints, admin-remove-user-gate-ordering, break-glass-guard-self-service-target, break-glass-local-credential, session-tombstone) — Test Files 6 passed (6) · Tests 88 passed (88), VERDICT command-exit 0.
• The six SCIM-adjacent siblings (auth-manager, better-auth-schema-parity, credential-at-rest-posture, last-admin-guard, managed-extension-fields, scim-case-insensitive-identifier) — Test Files 6 passed (6) · Tests 469 passed (469), VERDICT command-exit 0.
• tsc --noEmit (src program) exit 0; pnpm --filter @objectstack/plugin-auth check:test-typecheck — OK — the test layer compiles under tsconfig.test.json (the new test file is in that program; the src program excludes tests by design). The tsconfig.examples.json half of the typecheck script resolves the package's own dist types, which this worktree has not built — NOT MEASURED locally; CI builds it.
• Reverse verification on the committed tree (round-1 head 51000d482; the wiring line it removes is unchanged on 21c7dbe76, so the reading was not re-run) (scratchpad/issue-14360/ablation.sh, trap-restored): removed the three-line identity member from the scim() options — proven on disk (marker count 1 → 0, git diff --stat = 3 deletions) — and ran the suite: 6 red / 3 green, exactly (a), (b), the idempotency case, (c) [the request answers 200 instead of the guard's 403], the (c) positive control and (f) red; (d) attribute-only, (d) administrator-ban and (e) green. Restore via git checkout HEAD -- path: git diff HEAD empty, disk blob = HEAD blob e9d5c5eb…, marker count back to 1. No dist rebuild is involved: the suite imports ./auth-manager.js from src, and no workspace dependency was mutated.

Gates (head 21c7dbe76)

node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands derived 36 commands from the changeset (re-derived on 21c7dbe76 after the changed-file set grew by user-ban-write.ts: identical list); each run at 21c7dbe76 with its exit captured before any pipe. 33 green, including check-system-context-census (OK — 109 elevation read sites … all anchored; 0 anchors on the two edited files, no census fix needed), check:cross-package-test-inputs, check:test-source-alias, check:engine-double-contract, check:logger-receiver-detach, check-adr-0087-registration (non-breaking changeset), check-changeset-no-major. Three answered exit 3 = PREREQUISITE NOT MET by their own verdict text, recorded as NOT MEASURED locally (CI owns them): check-test-completeness (needs a saved turbo test log), check:dual-build-cjs-loads (needs pnpm build), check:type-check-debt (needs the full built closure). Control-character self-scan over the four changed files: clean.

Contract review (Clause ②)

• Behaviour change, as accept/reject: a principal an identity provider has deactivated over SCIM (active: false, or deleted) is now REJECTED at sign-in with the vendor's 403 BANNED_USER (before: sessions revoked, sign-in ACCEPTED); an IdP active: true re-ACCEPTS a principal whose ban carries the SCIM reason (an administrator's ban stays a rejection). Deactivating the last administrator over SCIM is REJECTED with a 403 SCIM error (before: accepted, disabling nothing).
• Exported-symbol delta (git diff -U0 00ff228fe...HEAD | grep -E '^[+-].*\bexport\b'): five export lines, ALL in the new package-internal module packages/plugins/plugin-auth/src/user-ban-write.ts (UserBanWriter, UserBanFields, SCIM_DEACTIVATION_BAN_REASON, applyUserBan, applyUserUnban). NO new export is reachable through src/index.ts: the barrel is untouched (84 lines before and after, zero references to user-ban-write), and the same grep over admin-ban-endpoints.ts, auth-manager.ts and index.ts prints nothing. No removals, no signature changes to existing exports. The scim() options gain the vendor's identity member (not an ObjectStack-authored config key).
• Changeset level:patch — a bug fix restoring the declared behaviour with no new public symbol. Clause-② stays yes: sign-in accept/reject changes for a class of principals; the needs:contract-review carriers stay on the card and the PR.
• Log levels: no new log site of any level; the last-admin refusal is an error RESPONSE through the vendor's SCIM error mapping.

Out of scope, filed

• SCIM provisioning writes run outside any engine transaction on @better-auth/scim 1.7.2 — the #3653 scimRequestScope stamped in verifyBearerToken is not observed at write time (0 engine.transaction calls across POST + PATCH /Users) #14522 — SCIM provisioning writes run outside any engine transaction on 1.7.2 (the SCIM: 停在 @better-auth/scim rc.1,等正式版再整体迁移 —— rc.2 换掉了整套模型 #3653scimRequestScope stamped in verifyBearerToken is not observed at write time). Unassigned; the residual it leaves on a refused deactivation is pinned in face (c) of the new suite (line 487), and the post-refusal behaviour above is posted on that card.

Patch round 2 (head 21c7dbe76) — the in-seat contract review's round-1 verdict, item by item

• A (blocking finding 1 — implemented exactly as written).reconcileScimUserLifecycle reads banExpires too; in the !state.active branch a banned row with a non-null expiry gets { banExpires: null, updatedAt } and returns, otherwise returns — banned and the administrator's banReason untouched. Docblock first bullet and the changeset sentence say a deactivation also makes an existing expiring ban permanent. New face under (d): administrator ban with ban_expires 1.5s ahead, PATCH active: false → 200, expiry cleared and reason kept, then after the expiry has passed sign-in still answers 403 BANNED_USER (status AND code).
• B (note 1, required). Shared write moved to the non-barrelled user-ban-write.ts; admin-ban-endpoints.ts, auth-manager.ts and the suite import it. Barrel export surface unchanged; changeset patch; the "New exports" paragraph removed.
• C (notes 2, 3, 4, 6, 7). (2) changeset: the last-LOCAL-credential guard is deliberately not applied on the SCIM path — an IdP deprovision can disable the last password-holding account while non-administrator SSO users remain. (3) marker collision documented in the method docblock and the changeset (an administrator who types Deactivated via SCIM produces a ban the IdP can lift); the string is NOT reserved on the admin mount. (4) post-refusal behaviour stated above and on SCIM provisioning writes run outside any engine transaction on @better-auth/scim 1.7.2 — the #3653 scimRequestScope stamped in verifyBearerToken is not observed at write time (0 engine.transaction calls across POST + PATCH /Users) #14522. (6) new face (g): POST /Users with active: false provisions the account disabled — banned with the SCIM reason, sign-in 403 BANNED_USER. (7) SCIM provisioning writes run outside any engine transaction on @better-auth/scim 1.7.2 — the #3653 scimRequestScope stamped in verifyBearerToken is not observed at write time (0 engine.transaction calls across POST + PATCH /Users) #14522 carries the line-487 pin citation.
• D (verification at 21c7dbe76, verify-lock sessions each under the cap, exits before any pipe). New suite + five ban-adjacent siblings: Test Files 6 passed (6) · Tests 88 passed (88), VERDICT command-exit 0. Six SCIM-adjacent siblings: Test Files 6 passed (6) · Tests 469 passed (469), VERDICT command-exit 0. tsc --noEmit exit 0 (0 errors); check:test-typecheckOK — the test layer compiles under tsconfig.test.json. Gates re-derived on 21c7dbe76 (identical 36) and all run there: 33 green, the same three prerequisite-not-met (check-test-completeness, check:dual-build-cjs-loads, check:type-check-debt). git merge-tree --write-tree --name-only origin/main HEAD after git fetch origin main (origin/main = fed4fa409): clean, no conflicted paths. GitHub mergeable_state read after the push: clean.

Session: https://claude.ai/code/session_01AUF1NoViznQK32gqpK8wS8

Generated by Claude Code

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/plugin-auth, touching 15 documentable anchor(s).

3 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/kernel/contracts/auth-service.mdx(via AuthManager (symbol, a top-level class))
• content/docs/kernel/services-checklist.mdx(via AuthManager (symbol, a top-level class))
• content/docs/permissions/authentication.mdx(via AuthManager (symbol, a top-level class))

What this run could not see

• the SDK route bridge reached 47 of 219 client-bound route-ledger rows — the other 172 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 172: 14 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 56 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 102 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 11 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json fed4fa40924bd1366354ac9b8a55db9d94a7e404 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 32800235fc78c29dffbfc4bdfd601e0028eb72ca — the merge of head 21c7dbe76b7d44df32fbd9f6497db6372b9f2d0f into base fed4fa40924bd1366354ac9b8a55db9d94a7e404, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 32800235fc78c29dffbfc4bdfd601e0028eb72ca && git checkout 32800235fc78c29dffbfc4bdfd601e0028eb72ca
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin fed4fa40924bd1366354ac9b8a55db9d94a7e404 21c7dbe76b7d44df32fbd9f6497db6372b9f2d0f && git checkout -B drift-repro fed4fa40924bd1366354ac9b8a55db9d94a7e404 && git merge --no-ff 21c7dbe76b7d44df32fbd9f6497db6372b9f2d0f
node scripts/docs-audit/affected-docs.mjs --json fed4fa40924bd1366354ac9b8a55db9d94a7e404

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs fed4fa40924bd1366354ac9b8a55db9d94a7e404 → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[os-sales]

Contract review round 1 at 51000d482: FAIL — patch round 2 in flight

The in-seat isolated Clause-② review (fable tier, transcript-verified 78/78) is posted verbatim on #14360. One blocking finding: a SCIM active: false over a row that already carries an expiring administrator ban leaves the expiry in place, so the vendor's session.create hook auto-unbans and admits the principal once the expiry passes while the identity provider still holds them deactivated. Fix (a pure tightening): on deactivation, make an existing expiring ban permanent (banExpires: null) without touching banned or the administrator's reason; one new suite face pins it.

Also taken up in the same round: the five new symbols move into a non-barrelled module so the package surface does not grow (changeset → patch; Clause-② stays yes for the sign-in accept-set change), plus one-sentence documentation of the last-LOCAL-credential guard exemption on the SCIM path, the marker-collision case, the post-refusal 403 behaviour (also noted on #14522), and a POST /Usersactive: false pin.

needs:contract-review stays on the PR and the card until a delta review passes on the patched head; the PR stays draft.

---

Generated by Claude Code

[os-sales]

Landing provenance — ready + auto-merge at head 21c7dbe76

• Card: [finding] SCIM active:false no longer disables the account — the vendor ban coupling was removed upstream in @better-auth/scim 1.7.0 and nothing in this repo replaced it #14360 (Fixes, closes on merge).
• Contract review (Clause-② yes, accept-set change for SCIM-deactivated principals): in-seat isolated fable review — round 1 FAIL at 51000d482 (14360#issuecomment-5508485458, one blocking finding), patch round 2, round 2 (delta) PASS at 21c7dbe76 (14360#issuecomment-5508938514); transcript verified 105/105 claude-fable-5-1; verdicts adopted verbatim. Provenance for clearing the carriers: the 2026-08-31 maintainer ruling that the dispatching seat completes the contract review in-seat, plus that PASS.
• Carriers: needs:contract-review removed from [finding] SCIM active:false no longer disables the account — the vendor ban coupling was removed upstream in @better-auth/scim 1.7.0 and nothing in this repo replaced it #14360 and from this PR in the same stroke, read back; node scripts/pm/check-clause2-carriers.mjs --pair 14540 → "the clause-② declaration is readable in the fixed spelling and both carriers agree", exit 0.
• Surface: 5 files, all inside the fence (auth-manager.ts, admin-ban-endpoints.ts, new package-internal user-ban-write.ts, the new suite, the changeset patch); src/index.ts byte-identical to origin/main; no packages/spec, no content/docs/releases/; admin-forcing sites untouched.
• CI on 21c7dbe76: every check green — Lint & Repo Gatessuccess at 11:26:32Z, TypeScript Type Checksuccess, Test Core (1/6)success at 11:21:56Z, aggregate Test Coresuccess; mergeable_state: clean.
• Action: draft → ready and auto-merge enabled at ~11:44Z. On MERGED: card auto-closes; strip pm:dispatched from [finding] SCIM active:false no longer disables the account — the vendor ban coupling was removed upstream in @better-auth/scim 1.7.0 and nothing in this repo replaced it #14360; the seat files one follow-up finding for the review's §5 notes 1–5 (docblock word, timed-ban face clock margin and positive control, DELETE-of-last-administrator pin, stale last-admin-guard.ts header, DELETE docblock clause). SCIM provisioning writes run outside any engine transaction on @better-auth/scim 1.7.2 — the #3653 scimRequestScope stamped in verifyBearerToken is not observed at write time (0 engine.transaction calls across POST + PATCH /Users) #14522 (SCIM writes outside an engine transaction on 1.7.2) stays with triage.

---

Generated by Claude Code

[claude]

Fixes#14360

What this does

Stable @better-auth/scim (1.7.0 and later; the repo pins and installs 1.7.2) no longer writes the admin plugin's banned column when an identity provider sends active: false — it hands the user's aggregate lifecycle state to an OPTIONAL host callback, identity.reconcileUser, and then only revokes sessions. plugin-auth passed no identity member, so a deactivation revoked sessions and wrote nothing: sys_user.banned stayed false and a user holding a local password signed straight back in, while ADR-0071, the generated docs and the #13816 construction-time refusal all asserted the ban.

Limb A of the triage ruling, and only limb A:

• auth-manager.ts — the scim({...}) options gain identity.reconcileUser, routed to a new private method reconcileScimUserLifecycle that reads the user through the vendor's transaction-bound adapter and reconciles: active: false on a row that is not banned ⇒ the platform ban write (reason Deactivated via SCIM, the exact string the vendor wrote itself through 1.6.x; no expiry), and on a row already banned WITH an expiry (an administrator's timed ban) ⇒ the ban is made permanent (banExpires cleared, banned and the administrator's reason untouched — the vendor's session hook auto-lifts an expired ban and would otherwise admit a principal the IdP still holds deactivated); active: true on a row banned WITH that reason ⇒ unban; anything else is a no-op (the callback is contractually idempotent and the vendor calls it on EVERY user mutation).
• user-ban-write.ts (new, PACKAGE-INTERNAL — not re-exported from src/index.ts) holds the existing /admin/ban-user / /admin/unban-user write as applyUserBan / applyUserUnban over a minimal UserBanWriter surface; admin-ban-endpoints.ts and the SCIM hook both call that ONE write (field for field the vendor's own banUser shape). No new HTTP endpoint, no new public symbol. The admin mount's behaviour is unchanged (its own suite: 88/88 across the six ban-adjacent files).
• New end-to-end suite scim-deactivation-reconcile-user.test.ts driving @better-auth/scim itself through a real AuthManager over better-sqlite3 (the simulated deprovision() helper in last-admin-guard.test.ts is NOT extended, per triage).
• One changeset for @objectstack/plugin-auth, level patch (see Contract review).

Admin forcing untouched (admin: pluginConfig.admin ?? scimEffective at three sites) — that is the #13816 shape-1 follow-up, not this card. The five stale assertion sites triage listed are untouched and are true again under this change.

Premise (re-verified on origin/main00ff228fe with the package installed)

1. grep -ro "ban" node_modules/@better-auth/scim/dist | wc -l = 0; positive control over node_modules/better-auth/dist/plugins/admin = 117. dist/index.d.mts:267 declares reconcileUser?(input: SCIMIdentityState, context: SCIMTransactionContext); SCIMIdentityState carries userId, the aggregate active (true while ANY participating SCIM source is active), profileSourceId and sources; SCIMTransactionContext carries only database (the DBTransactionAdapter). A throw from the hook: runSCIMApplicationCallback rethrows a better-auth APIError unchanged and wraps anything else as a SCIM 500 with detail SCIM identity reconciliation failed and the original as cause — never swallowed.
2. auth-manager.ts:3265 handed scim() exactly connections: [] and authentication.verifyBearerToken; repo-wide reconcileUser = 0 hits (control verifyBearerToken = 15).
3. admin-ban-endpoints.ts owns the platform ban write and re-runs the last-LOCAL-credential guard; the last-ADMINISTRATOR guard (ADR-0024 D5.2, plugin-auth: break-glass 守卫 —— SCIM/ban 不得停用最后一个管理员(ADR-0024 D5.2,cloud#621 转入) #5892) is an ENGINE beforeUpdate hook in last-admin-guard.ts, registered by auth-plugin.ts at kernel:ready, so it holds on every banned write regardless of caller. Both writes were endpoint-shaped (they parsed a Request); the write itself is now a plain callable.
4. The forced admin plugin supplies the banned column and the sign-in refusal: better-auth/dist/plugins/admin/admin.mjs:36-47 reads user?.banned in the session.create hook and throws FORBIDDEN / BANNED_USER.

PM hypotheses

• H1 — proven with a correction. The vendor invokes the callback inside its runIdentityMutationTransaction with enough identity (userId + aggregate active) to drive the ban write; active: false ⇒ ban with the SCIM reason, active: true ⇒ unban — but only of a ban carrying the SCIM reason. An administrator's ban (any other reason) is deliberately NOT lifted by the IdP: every SCIM PUT carries active: true, so unconditional reconciliation would re-admit a user banned for cause on the next attribute sync. Pinned in face (d). Listed as an open question below in case the maintainer wants IdP-authoritative semantics instead.
• H2 — proven, with a measured residual filed separately. The guard's refusal is LOUD through SCIM: HTTP 403 with the SCIM 2.0 error envelope (schemas contains the Error URN, status: "403", detail = the guard's own text naming last administrator, ADR-0024 D5.2 and SCIM deprovision is too broad); the ban never lands and the administrator still signs in. Residual: the vendor's OWN scimUser.active = false write, made before the callback inside what it believes is a transaction, survives the refusal — because the adapter's SCIM: 停在 @better-auth/scim rc.1,等正式版再整体迁移 —— rc.2 换掉了整套模型 #3653 SCIM transaction scoping never opens an engine transaction on 1.7.2 (measured: 0 engine.transaction and 0 driver.beginTransaction calls across a SCIM POST + PATCH; inScimRequestScope() false at every sys_user / sys_scim_user write). That is a pre-existing defect outside this card's file surface, filed as SCIM provisioning writes run outside any engine transaction on @better-auth/scim 1.7.2 — the #3653 scimRequestScope stamped in verifyBearerToken is not observed at write time (0 engine.transaction calls across POST + PATCH /Users) #14522 (out of scope here); face (c) pins the residual as observed (line 487 on this head) so SCIM provisioning writes run outside any engine transaction on @better-auth/scim 1.7.2 — the #3653 scimRequestScope stamped in verifyBearerToken is not observed at write time (0 engine.transaction calls across POST + PATCH /Users) #14522's landing flips that line deliberately. Operator-visible consequence of that residual: after a refused last-administrator deactivation, every later SCIM mutation of that user — an attribute-only PATCH included — re-attempts the ban and answers 403 until the IdP sends active: true for that user or a second administrator exists (it refuses rather than admits; stated on SCIM provisioning writes run outside any engine transaction on @better-auth/scim 1.7.2 — the #3653 scimRequestScope stamped in verifyBearerToken is not observed at write time (0 engine.transaction calls across POST + PATCH /Users) #14522 as well).
• H3 — proven. No change to the admin-forcing sites was needed; the forced plugin already supplies the column and the refusal (face (a) shows the refusal firing on a SCIM-banned row).

One consequence stated rather than left implicit: on 1.7.2 a SCIM DELETE /Users/{id} tombstones the source instead of deleting the better-auth user, so the aggregate state turns inactive and the hook disables that account (face (f)); re-provisioning through the tombstone re-links the same user and the SCIM ban is lifted.

Tests (head 21c7dbe76)

• pnpm --filter @objectstack/plugin-auth exec vitest run --maxWorkers=2 src/scim-deactivation-reconcile-user.test.ts + the five ban-adjacent siblings (admin-ban-endpoints, admin-remove-user-gate-ordering, break-glass-guard-self-service-target, break-glass-local-credential, session-tombstone) — Test Files 6 passed (6) · Tests 88 passed (88), VERDICT command-exit 0.
• The six SCIM-adjacent siblings (auth-manager, better-auth-schema-parity, credential-at-rest-posture, last-admin-guard, managed-extension-fields, scim-case-insensitive-identifier) — Test Files 6 passed (6) · Tests 469 passed (469), VERDICT command-exit 0.
• tsc --noEmit (src program) exit 0; pnpm --filter @objectstack/plugin-auth check:test-typecheck — OK — the test layer compiles under tsconfig.test.json (the new test file is in that program; the src program excludes tests by design). The tsconfig.examples.json half of the typecheck script resolves the package's own dist types, which this worktree has not built — NOT MEASURED locally; CI builds it.
• Reverse verification on the committed tree (round-1 head 51000d482; the wiring line it removes is unchanged on 21c7dbe76, so the reading was not re-run) (scratchpad/issue-14360/ablation.sh, trap-restored): removed the three-line identity member from the scim() options — proven on disk (marker count 1 → 0, git diff --stat = 3 deletions) — and ran the suite: 6 red / 3 green, exactly (a), (b), the idempotency case, (c) [the request answers 200 instead of the guard's 403], the (c) positive control and (f) red; (d) attribute-only, (d) administrator-ban and (e) green. Restore via git checkout HEAD -- path: git diff HEAD empty, disk blob = HEAD blob e9d5c5eb…, marker count back to 1. No dist rebuild is involved: the suite imports ./auth-manager.js from src, and no workspace dependency was mutated.

Gates (head 21c7dbe76)

node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands derived 36 commands from the changeset (re-derived on 21c7dbe76 after the changed-file set grew by user-ban-write.ts: identical list); each run at 21c7dbe76 with its exit captured before any pipe. 33 green, including check-system-context-census (OK — 109 elevation read sites … all anchored; 0 anchors on the two edited files, no census fix needed), check:cross-package-test-inputs, check:test-source-alias, check:engine-double-contract, check:logger-receiver-detach, check-adr-0087-registration (non-breaking changeset), check-changeset-no-major. Three answered exit 3 = PREREQUISITE NOT MET by their own verdict text, recorded as NOT MEASURED locally (CI owns them): check-test-completeness (needs a saved turbo test log), check:dual-build-cjs-loads (needs pnpm build), check:type-check-debt (needs the full built closure). Control-character self-scan over the four changed files: clean.

Contract review (Clause ②)

• Behaviour change, as accept/reject: a principal an identity provider has deactivated over SCIM (active: false, or deleted) is now REJECTED at sign-in with the vendor's 403 BANNED_USER (before: sessions revoked, sign-in ACCEPTED); an IdP active: true re-ACCEPTS a principal whose ban carries the SCIM reason (an administrator's ban stays a rejection). Deactivating the last administrator over SCIM is REJECTED with a 403 SCIM error (before: accepted, disabling nothing).
• Exported-symbol delta (git diff -U0 00ff228fe...HEAD | grep -E '^[+-].*\bexport\b'): five export lines, ALL in the new package-internal module packages/plugins/plugin-auth/src/user-ban-write.ts (UserBanWriter, UserBanFields, SCIM_DEACTIVATION_BAN_REASON, applyUserBan, applyUserUnban). NO new export is reachable through src/index.ts: the barrel is untouched (84 lines before and after, zero references to user-ban-write), and the same grep over admin-ban-endpoints.ts, auth-manager.ts and index.ts prints nothing. No removals, no signature changes to existing exports. The scim() options gain the vendor's identity member (not an ObjectStack-authored config key).
• Changeset level:patch — a bug fix restoring the declared behaviour with no new public symbol. Clause-② stays yes: sign-in accept/reject changes for a class of principals; the needs:contract-review carriers stay on the card and the PR.
• Log levels: no new log site of any level; the last-admin refusal is an error RESPONSE through the vendor's SCIM error mapping.

Out of scope, filed

• SCIM provisioning writes run outside any engine transaction on @better-auth/scim 1.7.2 — the #3653 scimRequestScope stamped in verifyBearerToken is not observed at write time (0 engine.transaction calls across POST + PATCH /Users) #14522 — SCIM provisioning writes run outside any engine transaction on 1.7.2 (the SCIM: 停在 @better-auth/scim rc.1,等正式版再整体迁移 —— rc.2 换掉了整套模型 #3653scimRequestScope stamped in verifyBearerToken is not observed at write time). Unassigned; the residual it leaves on a refused deactivation is pinned in face (c) of the new suite (line 487), and the post-refusal behaviour above is posted on that card.

Patch round 2 (head 21c7dbe76) — the in-seat contract review's round-1 verdict, item by item

• A (blocking finding 1 — implemented exactly as written).reconcileScimUserLifecycle reads banExpires too; in the !state.active branch a banned row with a non-null expiry gets { banExpires: null, updatedAt } and returns, otherwise returns — banned and the administrator's banReason untouched. Docblock first bullet and the changeset sentence say a deactivation also makes an existing expiring ban permanent. New face under (d): administrator ban with ban_expires 1.5s ahead, PATCH active: false → 200, expiry cleared and reason kept, then after the expiry has passed sign-in still answers 403 BANNED_USER (status AND code).
• B (note 1, required). Shared write moved to the non-barrelled user-ban-write.ts; admin-ban-endpoints.ts, auth-manager.ts and the suite import it. Barrel export surface unchanged; changeset patch; the "New exports" paragraph removed.
• C (notes 2, 3, 4, 6, 7). (2) changeset: the last-LOCAL-credential guard is deliberately not applied on the SCIM path — an IdP deprovision can disable the last password-holding account while non-administrator SSO users remain. (3) marker collision documented in the method docblock and the changeset (an administrator who types Deactivated via SCIM produces a ban the IdP can lift); the string is NOT reserved on the admin mount. (4) post-refusal behaviour stated above and on SCIM provisioning writes run outside any engine transaction on @better-auth/scim 1.7.2 — the #3653 scimRequestScope stamped in verifyBearerToken is not observed at write time (0 engine.transaction calls across POST + PATCH /Users) #14522. (6) new face (g): POST /Users with active: false provisions the account disabled — banned with the SCIM reason, sign-in 403 BANNED_USER. (7) SCIM provisioning writes run outside any engine transaction on @better-auth/scim 1.7.2 — the #3653 scimRequestScope stamped in verifyBearerToken is not observed at write time (0 engine.transaction calls across POST + PATCH /Users) #14522 carries the line-487 pin citation.
• D (verification at 21c7dbe76, verify-lock sessions each under the cap, exits before any pipe). New suite + five ban-adjacent siblings: Test Files 6 passed (6) · Tests 88 passed (88), VERDICT command-exit 0. Six SCIM-adjacent siblings: Test Files 6 passed (6) · Tests 469 passed (469), VERDICT command-exit 0. tsc --noEmit exit 0 (0 errors); check:test-typecheckOK — the test layer compiles under tsconfig.test.json. Gates re-derived on 21c7dbe76 (identical 36) and all run there: 33 green, the same three prerequisite-not-met (check-test-completeness, check:dual-build-cjs-loads, check:type-check-debt). git merge-tree --write-tree --name-only origin/main HEAD after git fetch origin main (origin/main = fed4fa409): clean, no conflicted paths. GitHub mergeable_state read after the push: clean.

Session: https://claude.ai/code/session_01AUF1NoViznQK32gqpK8wS8

Generated by Claude Code

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/plugin-auth, touching 15 documentable anchor(s).

3 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/kernel/contracts/auth-service.mdx(via AuthManager (symbol, a top-level class))
• content/docs/kernel/services-checklist.mdx(via AuthManager (symbol, a top-level class))
• content/docs/permissions/authentication.mdx(via AuthManager (symbol, a top-level class))

What this run could not see

• the SDK route bridge reached 47 of 219 client-bound route-ledger rows — the other 172 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 172: 14 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 56 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 102 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 11 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json fed4fa40924bd1366354ac9b8a55db9d94a7e404 → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 32800235fc78c29dffbfc4bdfd601e0028eb72ca — the merge of head 21c7dbe76b7d44df32fbd9f6497db6372b9f2d0f into base fed4fa40924bd1366354ac9b8a55db9d94a7e404, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 32800235fc78c29dffbfc4bdfd601e0028eb72ca && git checkout 32800235fc78c29dffbfc4bdfd601e0028eb72ca
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin fed4fa40924bd1366354ac9b8a55db9d94a7e404 21c7dbe76b7d44df32fbd9f6497db6372b9f2d0f && git checkout -B drift-repro fed4fa40924bd1366354ac9b8a55db9d94a7e404 && git merge --no-ff 21c7dbe76b7d44df32fbd9f6497db6372b9f2d0f
node scripts/docs-audit/affected-docs.mjs --json fed4fa40924bd1366354ac9b8a55db9d94a7e404

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs fed4fa40924bd1366354ac9b8a55db9d94a7e404 → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[os-sales]

Contract review round 1 at 51000d482: FAIL — patch round 2 in flight

The in-seat isolated Clause-② review (fable tier, transcript-verified 78/78) is posted verbatim on #14360. One blocking finding: a SCIM active: false over a row that already carries an expiring administrator ban leaves the expiry in place, so the vendor's session.create hook auto-unbans and admits the principal once the expiry passes while the identity provider still holds them deactivated. Fix (a pure tightening): on deactivation, make an existing expiring ban permanent (banExpires: null) without touching banned or the administrator's reason; one new suite face pins it.

Also taken up in the same round: the five new symbols move into a non-barrelled module so the package surface does not grow (changeset → patch; Clause-② stays yes for the sign-in accept-set change), plus one-sentence documentation of the last-LOCAL-credential guard exemption on the SCIM path, the marker-collision case, the post-refusal 403 behaviour (also noted on #14522), and a POST /Usersactive: false pin.

needs:contract-review stays on the PR and the card until a delta review passes on the patched head; the PR stays draft.

---

Generated by Claude Code

[os-sales]

Landing provenance — ready + auto-merge at head 21c7dbe76

• Card: [finding] SCIM active:false no longer disables the account — the vendor ban coupling was removed upstream in @better-auth/scim 1.7.0 and nothing in this repo replaced it #14360 (Fixes, closes on merge).
• Contract review (Clause-② yes, accept-set change for SCIM-deactivated principals): in-seat isolated fable review — round 1 FAIL at 51000d482 (14360#issuecomment-5508485458, one blocking finding), patch round 2, round 2 (delta) PASS at 21c7dbe76 (14360#issuecomment-5508938514); transcript verified 105/105 claude-fable-5-1; verdicts adopted verbatim. Provenance for clearing the carriers: the 2026-08-31 maintainer ruling that the dispatching seat completes the contract review in-seat, plus that PASS.
• Carriers: needs:contract-review removed from [finding] SCIM active:false no longer disables the account — the vendor ban coupling was removed upstream in @better-auth/scim 1.7.0 and nothing in this repo replaced it #14360 and from this PR in the same stroke, read back; node scripts/pm/check-clause2-carriers.mjs --pair 14540 → "the clause-② declaration is readable in the fixed spelling and both carriers agree", exit 0.
• Surface: 5 files, all inside the fence (auth-manager.ts, admin-ban-endpoints.ts, new package-internal user-ban-write.ts, the new suite, the changeset patch); src/index.ts byte-identical to origin/main; no packages/spec, no content/docs/releases/; admin-forcing sites untouched.
• CI on 21c7dbe76: every check green — Lint & Repo Gatessuccess at 11:26:32Z, TypeScript Type Checksuccess, Test Core (1/6)success at 11:21:56Z, aggregate Test Coresuccess; mergeable_state: clean.
• Action: draft → ready and auto-merge enabled at ~11:44Z. On MERGED: card auto-closes; strip pm:dispatched from [finding] SCIM active:false no longer disables the account — the vendor ban coupling was removed upstream in @better-auth/scim 1.7.0 and nothing in this repo replaced it #14360; the seat files one follow-up finding for the review's §5 notes 1–5 (docblock word, timed-ban face clock margin and positive control, DELETE-of-last-administrator pin, stale last-admin-guard.ts header, DELETE docblock clause). SCIM provisioning writes run outside any engine transaction on @better-auth/scim 1.7.2 — the #3653 scimRequestScope stamped in verifyBearerToken is not observed at write time (0 engine.transaction calls across POST + PATCH /Users) #14522 (SCIM writes outside an engine transaction on 1.7.2) stays with triage.

---

Generated by Claude Code