test(plugin-auth): import the registered object set from the manifest in five harnesses

[os-sales]

Fixes#14756

Five plugin-auth harnesses hand-wrote the set of objects a deployment mounting
plugin-auth registers, instead of importing authIdentityObjects from
src/manifest.ts. Each hand list had drifted below the manifest, so each
harness booted an engine missing tables the runtime registers. This converts
all five to the import pattern PR #14751 established on the two SCIM harnesses.

Population, re-derived on the tree

git grep -ln AUTH_OBJECTS finds six harnesses; the two SCIM ones were already
converted by #14751 (merged as d2bdab2d0) and are left untouched here. The
five this card owns, measured against authIdentityObjects (30 objects) by
resolving each hand-listed symbol through @objectstack/platform-objects and
comparing the resulting object NAMES:

harness	hand list	objects missing vs manifest
audience-bootstrap-seam.test.ts	9	21
dev-admin-seed-credential-gate.test.ts	9	21
sso-register-platform-admin-gate.test.ts	10	20
walled-owner-operator-stamp.test.ts	9	21
credential-at-rest-posture.test.ts	22	8

No hand list contained an object the manifest does not (0 extras anywhere), so
every conversion is a strict widening.

Two corrections to the triage note on the card, both measured:

1. credential-at-rest-posture.test.ts was described as "complete today". It is
   not: its list is missing 8 of the 30 objects, three of them OAuth ones —
   sys_oauth_client_assertion, sys_oauth_client_resource,
   sys_oauth_resource — plus sys_api_key, sys_device_code,
   sys_sso_provider, sys_two_factor, sys_user_preference. Converting it is
   a real widening, not just a spelling change.
2. sso-register-platform-admin-gate.test.ts had no AUTH_OBJECTS constant at
   all. Its list was a local const objects inside bootEngine(). It is now a
   module-scope AUTH_OBJECTS = authIdentityObjects, matching the other four.

Non-vacuity: the object set really grew

Booting the same engine shape bootEngine() uses (ObjectQL + driver-sql +
better-sqlite3 :memory:), once with the old 9-object hand list and once with
authIdentityObjects, then asking the driver to read four tables:

BEFORE (old hand-written list): registered 9 objects
sys_user: READABLE (table exists)
sys_oauth_access_token: REFUSED (no such table)
sys_jwks: REFUSED (no such table)
sys_sso_provider: REFUSED (no such table)
AFTER (authIdentityObjects): registered 30 objects
sys_user: READABLE (table exists)
sys_oauth_access_token: READABLE (table exists)
sys_jwks: READABLE (table exists)
sys_sso_provider: READABLE (table exists)

ERROR-line disposition

Of the five, only sso-register-platform-admin-gate.test.ts emitted driver
DATABASE_ERROR lines on a green run. Tallied by table, before and after:

table	before	after	in authIdentityObjects?
sys_jwks	1	0	yes
sys_position	4	4	no
sys_user_position	4	4	no

The only line that disappeared is the sys_jwks one, and it disappeared
because SysJwks is in authIdentityObjects and is therefore now registered
and its table created — the intended effect. The sys_position and
sys_user_position lines are unchanged in count: those objects are not in the
auth identity manifest, so this change cannot and does not touch them.

No sys_oauth_access_token ERROR line appears in any of these five harnesses,
before or after, so nothing here touches the back-channel planner question in
#14615 arm 2 — that arm stays fenced and untouched by this PR.

Tests

All five files, before and after (pnpm --filter @objectstack/plugin-auth exec vitest run --maxWorkers=2 src/NAME.test.ts):

file	before	after
audience-bootstrap-seam	Tests 6 passed (6)	Tests 6 passed (6)
dev-admin-seed-credential-gate	Tests 15 passed (15)	Tests 15 passed (15)
sso-register-platform-admin-gate	Tests 4 passed (4)	Tests 4 passed (4)
walled-owner-operator-stamp	Tests 28 passed (28)	Tests 28 passed (28)
credential-at-rest-posture	Tests 5 passed (5)	Tests 5 passed (5)

Whole package, at 0b6a065a2:

Test Files 91 passed (91)
Tests 1864 passed (1864)

pnpm --filter @objectstack/plugin-auth typecheck — exit 0. Its test layer is
compiled (verified with tsc --listFiles -p tsconfig.test.json: all five edited
files present, 1 hit each) and the shrink-only ledger is unmoved:
check:test-typecheck: OK ... 10 file(s) / 94 error(s) / 23 pinned signature(s),
none of the 94 in an edited file.

pnpm lint (eslint . --no-inline-config, whole repo) — exit 0, no output.

Gates

Derived at 0b6a065a2 with
node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack
(27 commands). 24 green. The other three exit 3, and each says in its own verdict
text that nothing was measured because the full workspace dist/ is absent
locally — check-test-completeness ("Nothing was measured"),
check:dual-build-cjs-loads ("PREREQUISITE NOT MET ... This is NOT a pass"),
check:type-check-debt ("--re-measure cannot run"). CI builds the closure and
runs them for real. check:nul-bytes green (8070 files) and a control-byte
scan over the five edited files found nothing.

check-system-context-census and check-affected-docs are both green after the
line-number shifts this diff causes in the five files.

Scope

Test-only; it imports an existing live export (manifest.ts:49). No package
publishes anything new, so this carries the skip-changeset label rather than a
changeset. The two SCIM harnesses (scim-deactivation-reconcile-user.test.ts,
scim-transaction-scope.test.ts) are not modified here and nothing was pushed
to #14751.

🤖 Generated with Claude Code

https://claude.ai/code/session_01AUF1NoViznQK32gqpK8wS8

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

Nothing in this diff resolved to a documentable surface (no symbol, route or SDK anchor derived from 0 changed package(s)), so this run has no opinion about the docs.

What this run could not see

• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 0 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json f3ae441fa2582e0b38e834b76353db0fe729fce5 → packageMentionDocs.

[os-sales]

Landing — PM seat domain:services, R21. Undrafted and auto-merge armed 05:39:10Z on head 0b6a065a27fd50ff172b5fd8cc2f3e4a7a31f8e2.

Verified before arming, at job level rather than from an aggregate:

• Every check run on this head is completed with success or skipped — 37 runs, none failed, none pending. The two that were still in flight at the previous probe finished green: Test Core (1/6) at 05:33:40Z (it ran 18 minutes against 2–4 minutes for shards 2–6 — the long shard, not a stall) and Lint & Repo Gates at 05:31:50Z.
• Clause-② carriers clear on both載体: this PR carries size/m / tests / skip-changeset, and card [finding] Four more plugin-auth AuthManager harnesses hand-write the object list without the OAuth objects — latent copies of the #14615 shape, counted (4 of 7) #14756 carries tests / pm:dispatched / domain:services / priority:p3. No needs:contract-review on either.

The auto-merge confirmation echoes method: MERGE even though SQUASH was requested. That is the known cosmetic field on a merge-queue repository (finding #14798) — the queue merges by its own configured method, and this will not be disabled and re-enabled to "fix" it.

---

Generated by Claude Code

[os-sales]

Fixes#14756

Five plugin-auth harnesses hand-wrote the set of objects a deployment mounting
plugin-auth registers, instead of importing authIdentityObjects from
src/manifest.ts. Each hand list had drifted below the manifest, so each
harness booted an engine missing tables the runtime registers. This converts
all five to the import pattern PR #14751 established on the two SCIM harnesses.

Population, re-derived on the tree

git grep -ln AUTH_OBJECTS finds six harnesses; the two SCIM ones were already
converted by #14751 (merged as d2bdab2d0) and are left untouched here. The
five this card owns, measured against authIdentityObjects (30 objects) by
resolving each hand-listed symbol through @objectstack/platform-objects and
comparing the resulting object NAMES:

harness	hand list	objects missing vs manifest
audience-bootstrap-seam.test.ts	9	21
dev-admin-seed-credential-gate.test.ts	9	21
sso-register-platform-admin-gate.test.ts	10	20
walled-owner-operator-stamp.test.ts	9	21
credential-at-rest-posture.test.ts	22	8

No hand list contained an object the manifest does not (0 extras anywhere), so
every conversion is a strict widening.

Two corrections to the triage note on the card, both measured:

1. credential-at-rest-posture.test.ts was described as "complete today". It is
   not: its list is missing 8 of the 30 objects, three of them OAuth ones —
   sys_oauth_client_assertion, sys_oauth_client_resource,
   sys_oauth_resource — plus sys_api_key, sys_device_code,
   sys_sso_provider, sys_two_factor, sys_user_preference. Converting it is
   a real widening, not just a spelling change.
2. sso-register-platform-admin-gate.test.ts had no AUTH_OBJECTS constant at
   all. Its list was a local const objects inside bootEngine(). It is now a
   module-scope AUTH_OBJECTS = authIdentityObjects, matching the other four.

Non-vacuity: the object set really grew

Booting the same engine shape bootEngine() uses (ObjectQL + driver-sql +
better-sqlite3 :memory:), once with the old 9-object hand list and once with
authIdentityObjects, then asking the driver to read four tables:

BEFORE (old hand-written list): registered 9 objects
sys_user: READABLE (table exists)
sys_oauth_access_token: REFUSED (no such table)
sys_jwks: REFUSED (no such table)
sys_sso_provider: REFUSED (no such table)
AFTER (authIdentityObjects): registered 30 objects
sys_user: READABLE (table exists)
sys_oauth_access_token: READABLE (table exists)
sys_jwks: READABLE (table exists)
sys_sso_provider: READABLE (table exists)

ERROR-line disposition

Of the five, only sso-register-platform-admin-gate.test.ts emitted driver
DATABASE_ERROR lines on a green run. Tallied by table, before and after:

table	before	after	in authIdentityObjects?
sys_jwks	1	0	yes
sys_position	4	4	no
sys_user_position	4	4	no

The only line that disappeared is the sys_jwks one, and it disappeared
because SysJwks is in authIdentityObjects and is therefore now registered
and its table created — the intended effect. The sys_position and
sys_user_position lines are unchanged in count: those objects are not in the
auth identity manifest, so this change cannot and does not touch them.

No sys_oauth_access_token ERROR line appears in any of these five harnesses,
before or after, so nothing here touches the back-channel planner question in
#14615 arm 2 — that arm stays fenced and untouched by this PR.

Tests

All five files, before and after (pnpm --filter @objectstack/plugin-auth exec vitest run --maxWorkers=2 src/NAME.test.ts):

file	before	after
audience-bootstrap-seam	Tests 6 passed (6)	Tests 6 passed (6)
dev-admin-seed-credential-gate	Tests 15 passed (15)	Tests 15 passed (15)
sso-register-platform-admin-gate	Tests 4 passed (4)	Tests 4 passed (4)
walled-owner-operator-stamp	Tests 28 passed (28)	Tests 28 passed (28)
credential-at-rest-posture	Tests 5 passed (5)	Tests 5 passed (5)

Whole package, at 0b6a065a2:

Test Files 91 passed (91)
Tests 1864 passed (1864)

pnpm --filter @objectstack/plugin-auth typecheck — exit 0. Its test layer is
compiled (verified with tsc --listFiles -p tsconfig.test.json: all five edited
files present, 1 hit each) and the shrink-only ledger is unmoved:
check:test-typecheck: OK ... 10 file(s) / 94 error(s) / 23 pinned signature(s),
none of the 94 in an edited file.

pnpm lint (eslint . --no-inline-config, whole repo) — exit 0, no output.

Gates

Derived at 0b6a065a2 with
node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack
(27 commands). 24 green. The other three exit 3, and each says in its own verdict
text that nothing was measured because the full workspace dist/ is absent
locally — check-test-completeness ("Nothing was measured"),
check:dual-build-cjs-loads ("PREREQUISITE NOT MET ... This is NOT a pass"),
check:type-check-debt ("--re-measure cannot run"). CI builds the closure and
runs them for real. check:nul-bytes green (8070 files) and a control-byte
scan over the five edited files found nothing.

check-system-context-census and check-affected-docs are both green after the
line-number shifts this diff causes in the five files.

Scope

Test-only; it imports an existing live export (manifest.ts:49). No package
publishes anything new, so this carries the skip-changeset label rather than a
changeset. The two SCIM harnesses (scim-deactivation-reconcile-user.test.ts,
scim-transaction-scope.test.ts) are not modified here and nothing was pushed
to #14751.

🤖 Generated with Claude Code

https://claude.ai/code/session_01AUF1NoViznQK32gqpK8wS8

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

Nothing in this diff resolved to a documentable surface (no symbol, route or SDK anchor derived from 0 changed package(s)), so this run has no opinion about the docs.

What this run could not see

• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 0 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json f3ae441fa2582e0b38e834b76353db0fe729fce5 → packageMentionDocs.

[os-sales]

Landing — PM seat domain:services, R21. Undrafted and auto-merge armed 05:39:10Z on head 0b6a065a27fd50ff172b5fd8cc2f3e4a7a31f8e2.

Verified before arming, at job level rather than from an aggregate:

• Every check run on this head is completed with success or skipped — 37 runs, none failed, none pending. The two that were still in flight at the previous probe finished green: Test Core (1/6) at 05:33:40Z (it ran 18 minutes against 2–4 minutes for shards 2–6 — the long shard, not a stall) and Lint & Repo Gates at 05:31:50Z.
• Clause-② carriers clear on both載体: this PR carries size/m / tests / skip-changeset, and card [finding] Four more plugin-auth AuthManager harnesses hand-write the object list without the OAuth objects — latent copies of the #14615 shape, counted (4 of 7) #14756 carries tests / pm:dispatched / domain:services / priority:p3. No needs:contract-review on either.

The auto-merge confirmation echoes method: MERGE even though SQUASH was requested. That is the known cosmetic field on a merge-queue repository (finding #14798) — the queue merges by its own configured method, and this will not be disabled and re-enabled to "fix" it.

---

Generated by Claude Code

[os-sales]

Fixes#14756

Five plugin-auth harnesses hand-wrote the set of objects a deployment mounting
plugin-auth registers, instead of importing authIdentityObjects from
src/manifest.ts. Each hand list had drifted below the manifest, so each
harness booted an engine missing tables the runtime registers. This converts
all five to the import pattern PR #14751 established on the two SCIM harnesses.

Population, re-derived on the tree

git grep -ln AUTH_OBJECTS finds six harnesses; the two SCIM ones were already
converted by #14751 (merged as d2bdab2d0) and are left untouched here. The
five this card owns, measured against authIdentityObjects (30 objects) by
resolving each hand-listed symbol through @objectstack/platform-objects and
comparing the resulting object NAMES:

harness	hand list	objects missing vs manifest
audience-bootstrap-seam.test.ts	9	21
dev-admin-seed-credential-gate.test.ts	9	21
sso-register-platform-admin-gate.test.ts	10	20
walled-owner-operator-stamp.test.ts	9	21
credential-at-rest-posture.test.ts	22	8

No hand list contained an object the manifest does not (0 extras anywhere), so
every conversion is a strict widening.

Two corrections to the triage note on the card, both measured:

1. credential-at-rest-posture.test.ts was described as "complete today". It is
   not: its list is missing 8 of the 30 objects, three of them OAuth ones —
   sys_oauth_client_assertion, sys_oauth_client_resource,
   sys_oauth_resource — plus sys_api_key, sys_device_code,
   sys_sso_provider, sys_two_factor, sys_user_preference. Converting it is
   a real widening, not just a spelling change.
2. sso-register-platform-admin-gate.test.ts had no AUTH_OBJECTS constant at
   all. Its list was a local const objects inside bootEngine(). It is now a
   module-scope AUTH_OBJECTS = authIdentityObjects, matching the other four.

Non-vacuity: the object set really grew

Booting the same engine shape bootEngine() uses (ObjectQL + driver-sql +
better-sqlite3 :memory:), once with the old 9-object hand list and once with
authIdentityObjects, then asking the driver to read four tables:

BEFORE (old hand-written list): registered 9 objects
sys_user: READABLE (table exists)
sys_oauth_access_token: REFUSED (no such table)
sys_jwks: REFUSED (no such table)
sys_sso_provider: REFUSED (no such table)
AFTER (authIdentityObjects): registered 30 objects
sys_user: READABLE (table exists)
sys_oauth_access_token: READABLE (table exists)
sys_jwks: READABLE (table exists)
sys_sso_provider: READABLE (table exists)

ERROR-line disposition

Of the five, only sso-register-platform-admin-gate.test.ts emitted driver
DATABASE_ERROR lines on a green run. Tallied by table, before and after:

table	before	after	in authIdentityObjects?
sys_jwks	1	0	yes
sys_position	4	4	no
sys_user_position	4	4	no

The only line that disappeared is the sys_jwks one, and it disappeared
because SysJwks is in authIdentityObjects and is therefore now registered
and its table created — the intended effect. The sys_position and
sys_user_position lines are unchanged in count: those objects are not in the
auth identity manifest, so this change cannot and does not touch them.

No sys_oauth_access_token ERROR line appears in any of these five harnesses,
before or after, so nothing here touches the back-channel planner question in
#14615 arm 2 — that arm stays fenced and untouched by this PR.

Tests

All five files, before and after (pnpm --filter @objectstack/plugin-auth exec vitest run --maxWorkers=2 src/NAME.test.ts):

file	before	after
audience-bootstrap-seam	Tests 6 passed (6)	Tests 6 passed (6)
dev-admin-seed-credential-gate	Tests 15 passed (15)	Tests 15 passed (15)
sso-register-platform-admin-gate	Tests 4 passed (4)	Tests 4 passed (4)
walled-owner-operator-stamp	Tests 28 passed (28)	Tests 28 passed (28)
credential-at-rest-posture	Tests 5 passed (5)	Tests 5 passed (5)

Whole package, at 0b6a065a2:

Test Files 91 passed (91)
Tests 1864 passed (1864)

pnpm --filter @objectstack/plugin-auth typecheck — exit 0. Its test layer is
compiled (verified with tsc --listFiles -p tsconfig.test.json: all five edited
files present, 1 hit each) and the shrink-only ledger is unmoved:
check:test-typecheck: OK ... 10 file(s) / 94 error(s) / 23 pinned signature(s),
none of the 94 in an edited file.

pnpm lint (eslint . --no-inline-config, whole repo) — exit 0, no output.

Gates

Derived at 0b6a065a2 with
node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack
(27 commands). 24 green. The other three exit 3, and each says in its own verdict
text that nothing was measured because the full workspace dist/ is absent
locally — check-test-completeness ("Nothing was measured"),
check:dual-build-cjs-loads ("PREREQUISITE NOT MET ... This is NOT a pass"),
check:type-check-debt ("--re-measure cannot run"). CI builds the closure and
runs them for real. check:nul-bytes green (8070 files) and a control-byte
scan over the five edited files found nothing.

check-system-context-census and check-affected-docs are both green after the
line-number shifts this diff causes in the five files.

Scope

Test-only; it imports an existing live export (manifest.ts:49). No package
publishes anything new, so this carries the skip-changeset label rather than a
changeset. The two SCIM harnesses (scim-deactivation-reconcile-user.test.ts,
scim-transaction-scope.test.ts) are not modified here and nothing was pushed
to #14751.

🤖 Generated with Claude Code

https://claude.ai/code/session_01AUF1NoViznQK32gqpK8wS8

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

Nothing in this diff resolved to a documentable surface (no symbol, route or SDK anchor derived from 0 changed package(s)), so this run has no opinion about the docs.

What this run could not see

• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 0 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json f3ae441fa2582e0b38e834b76353db0fe729fce5 → packageMentionDocs.

[os-sales]

Landing — PM seat domain:services, R21. Undrafted and auto-merge armed 05:39:10Z on head 0b6a065a27fd50ff172b5fd8cc2f3e4a7a31f8e2.

Verified before arming, at job level rather than from an aggregate:

• Every check run on this head is completed with success or skipped — 37 runs, none failed, none pending. The two that were still in flight at the previous probe finished green: Test Core (1/6) at 05:33:40Z (it ran 18 minutes against 2–4 minutes for shards 2–6 — the long shard, not a stall) and Lint & Repo Gates at 05:31:50Z.
• Clause-② carriers clear on both載体: this PR carries size/m / tests / skip-changeset, and card [finding] Four more plugin-auth AuthManager harnesses hand-write the object list without the OAuth objects — latent copies of the #14615 shape, counted (4 of 7) #14756 carries tests / pm:dispatched / domain:services / priority:p3. No needs:contract-review on either.

The auto-merge confirmation echoes method: MERGE even though SQUASH was requested. That is the known cosmetic field on a merge-queue repository (finding #14798) — the queue merges by its own configured method, and this will not be disabled and re-enabled to "fix" it.

---

Generated by Claude Code

[os-sales]

Fixes#14756

Five plugin-auth harnesses hand-wrote the set of objects a deployment mounting
plugin-auth registers, instead of importing authIdentityObjects from
src/manifest.ts. Each hand list had drifted below the manifest, so each
harness booted an engine missing tables the runtime registers. This converts
all five to the import pattern PR #14751 established on the two SCIM harnesses.

Population, re-derived on the tree

git grep -ln AUTH_OBJECTS finds six harnesses; the two SCIM ones were already
converted by #14751 (merged as d2bdab2d0) and are left untouched here. The
five this card owns, measured against authIdentityObjects (30 objects) by
resolving each hand-listed symbol through @objectstack/platform-objects and
comparing the resulting object NAMES:

harness	hand list	objects missing vs manifest
audience-bootstrap-seam.test.ts	9	21
dev-admin-seed-credential-gate.test.ts	9	21
sso-register-platform-admin-gate.test.ts	10	20
walled-owner-operator-stamp.test.ts	9	21
credential-at-rest-posture.test.ts	22	8

No hand list contained an object the manifest does not (0 extras anywhere), so
every conversion is a strict widening.

Two corrections to the triage note on the card, both measured:

1. credential-at-rest-posture.test.ts was described as "complete today". It is
   not: its list is missing 8 of the 30 objects, three of them OAuth ones —
   sys_oauth_client_assertion, sys_oauth_client_resource,
   sys_oauth_resource — plus sys_api_key, sys_device_code,
   sys_sso_provider, sys_two_factor, sys_user_preference. Converting it is
   a real widening, not just a spelling change.
2. sso-register-platform-admin-gate.test.ts had no AUTH_OBJECTS constant at
   all. Its list was a local const objects inside bootEngine(). It is now a
   module-scope AUTH_OBJECTS = authIdentityObjects, matching the other four.

Non-vacuity: the object set really grew

Booting the same engine shape bootEngine() uses (ObjectQL + driver-sql +
better-sqlite3 :memory:), once with the old 9-object hand list and once with
authIdentityObjects, then asking the driver to read four tables:

BEFORE (old hand-written list): registered 9 objects
sys_user: READABLE (table exists)
sys_oauth_access_token: REFUSED (no such table)
sys_jwks: REFUSED (no such table)
sys_sso_provider: REFUSED (no such table)
AFTER (authIdentityObjects): registered 30 objects
sys_user: READABLE (table exists)
sys_oauth_access_token: READABLE (table exists)
sys_jwks: READABLE (table exists)
sys_sso_provider: READABLE (table exists)

ERROR-line disposition

Of the five, only sso-register-platform-admin-gate.test.ts emitted driver
DATABASE_ERROR lines on a green run. Tallied by table, before and after:

table	before	after	in authIdentityObjects?
sys_jwks	1	0	yes
sys_position	4	4	no
sys_user_position	4	4	no

The only line that disappeared is the sys_jwks one, and it disappeared
because SysJwks is in authIdentityObjects and is therefore now registered
and its table created — the intended effect. The sys_position and
sys_user_position lines are unchanged in count: those objects are not in the
auth identity manifest, so this change cannot and does not touch them.

No sys_oauth_access_token ERROR line appears in any of these five harnesses,
before or after, so nothing here touches the back-channel planner question in
#14615 arm 2 — that arm stays fenced and untouched by this PR.

Tests

All five files, before and after (pnpm --filter @objectstack/plugin-auth exec vitest run --maxWorkers=2 src/NAME.test.ts):

file	before	after
audience-bootstrap-seam	Tests 6 passed (6)	Tests 6 passed (6)
dev-admin-seed-credential-gate	Tests 15 passed (15)	Tests 15 passed (15)
sso-register-platform-admin-gate	Tests 4 passed (4)	Tests 4 passed (4)
walled-owner-operator-stamp	Tests 28 passed (28)	Tests 28 passed (28)
credential-at-rest-posture	Tests 5 passed (5)	Tests 5 passed (5)

Whole package, at 0b6a065a2:

Test Files 91 passed (91)
Tests 1864 passed (1864)

pnpm --filter @objectstack/plugin-auth typecheck — exit 0. Its test layer is
compiled (verified with tsc --listFiles -p tsconfig.test.json: all five edited
files present, 1 hit each) and the shrink-only ledger is unmoved:
check:test-typecheck: OK ... 10 file(s) / 94 error(s) / 23 pinned signature(s),
none of the 94 in an edited file.

pnpm lint (eslint . --no-inline-config, whole repo) — exit 0, no output.

Gates

Derived at 0b6a065a2 with
node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack
(27 commands). 24 green. The other three exit 3, and each says in its own verdict
text that nothing was measured because the full workspace dist/ is absent
locally — check-test-completeness ("Nothing was measured"),
check:dual-build-cjs-loads ("PREREQUISITE NOT MET ... This is NOT a pass"),
check:type-check-debt ("--re-measure cannot run"). CI builds the closure and
runs them for real. check:nul-bytes green (8070 files) and a control-byte
scan over the five edited files found nothing.

check-system-context-census and check-affected-docs are both green after the
line-number shifts this diff causes in the five files.

Scope

Test-only; it imports an existing live export (manifest.ts:49). No package
publishes anything new, so this carries the skip-changeset label rather than a
changeset. The two SCIM harnesses (scim-deactivation-reconcile-user.test.ts,
scim-transaction-scope.test.ts) are not modified here and nothing was pushed
to #14751.

🤖 Generated with Claude Code

https://claude.ai/code/session_01AUF1NoViznQK32gqpK8wS8

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

Nothing in this diff resolved to a documentable surface (no symbol, route or SDK anchor derived from 0 changed package(s)), so this run has no opinion about the docs.

What this run could not see

• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 0 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json f3ae441fa2582e0b38e834b76353db0fe729fce5 → packageMentionDocs.

[os-sales]

Landing — PM seat domain:services, R21. Undrafted and auto-merge armed 05:39:10Z on head 0b6a065a27fd50ff172b5fd8cc2f3e4a7a31f8e2.

Verified before arming, at job level rather than from an aggregate:

• Every check run on this head is completed with success or skipped — 37 runs, none failed, none pending. The two that were still in flight at the previous probe finished green: Test Core (1/6) at 05:33:40Z (it ran 18 minutes against 2–4 minutes for shards 2–6 — the long shard, not a stall) and Lint & Repo Gates at 05:31:50Z.
• Clause-② carriers clear on both載体: this PR carries size/m / tests / skip-changeset, and card [finding] Four more plugin-auth AuthManager harnesses hand-write the object list without the OAuth objects — latent copies of the #14615 shape, counted (4 of 7) #14756 carries tests / pm:dispatched / domain:services / priority:p3. No needs:contract-review on either.

The auto-merge confirmation echoes method: MERGE even though SQUASH was requested. That is the known cosmetic field on a merge-queue repository (finding #14798) — the queue merges by its own configured method, and this will not be disabled and re-enabled to "fix" it.

---

Generated by Claude Code

[os-sales]

Fixes#14756

Five plugin-auth harnesses hand-wrote the set of objects a deployment mounting
plugin-auth registers, instead of importing authIdentityObjects from
src/manifest.ts. Each hand list had drifted below the manifest, so each
harness booted an engine missing tables the runtime registers. This converts
all five to the import pattern PR #14751 established on the two SCIM harnesses.

Population, re-derived on the tree

git grep -ln AUTH_OBJECTS finds six harnesses; the two SCIM ones were already
converted by #14751 (merged as d2bdab2d0) and are left untouched here. The
five this card owns, measured against authIdentityObjects (30 objects) by
resolving each hand-listed symbol through @objectstack/platform-objects and
comparing the resulting object NAMES:

harness	hand list	objects missing vs manifest
audience-bootstrap-seam.test.ts	9	21
dev-admin-seed-credential-gate.test.ts	9	21
sso-register-platform-admin-gate.test.ts	10	20
walled-owner-operator-stamp.test.ts	9	21
credential-at-rest-posture.test.ts	22	8

No hand list contained an object the manifest does not (0 extras anywhere), so
every conversion is a strict widening.

Two corrections to the triage note on the card, both measured:

1. credential-at-rest-posture.test.ts was described as "complete today". It is
   not: its list is missing 8 of the 30 objects, three of them OAuth ones —
   sys_oauth_client_assertion, sys_oauth_client_resource,
   sys_oauth_resource — plus sys_api_key, sys_device_code,
   sys_sso_provider, sys_two_factor, sys_user_preference. Converting it is
   a real widening, not just a spelling change.
2. sso-register-platform-admin-gate.test.ts had no AUTH_OBJECTS constant at
   all. Its list was a local const objects inside bootEngine(). It is now a
   module-scope AUTH_OBJECTS = authIdentityObjects, matching the other four.

Non-vacuity: the object set really grew

Booting the same engine shape bootEngine() uses (ObjectQL + driver-sql +
better-sqlite3 :memory:), once with the old 9-object hand list and once with
authIdentityObjects, then asking the driver to read four tables:

BEFORE (old hand-written list): registered 9 objects
sys_user: READABLE (table exists)
sys_oauth_access_token: REFUSED (no such table)
sys_jwks: REFUSED (no such table)
sys_sso_provider: REFUSED (no such table)
AFTER (authIdentityObjects): registered 30 objects
sys_user: READABLE (table exists)
sys_oauth_access_token: READABLE (table exists)
sys_jwks: READABLE (table exists)
sys_sso_provider: READABLE (table exists)

ERROR-line disposition

Of the five, only sso-register-platform-admin-gate.test.ts emitted driver
DATABASE_ERROR lines on a green run. Tallied by table, before and after:

table	before	after	in authIdentityObjects?
sys_jwks	1	0	yes
sys_position	4	4	no
sys_user_position	4	4	no

The only line that disappeared is the sys_jwks one, and it disappeared
because SysJwks is in authIdentityObjects and is therefore now registered
and its table created — the intended effect. The sys_position and
sys_user_position lines are unchanged in count: those objects are not in the
auth identity manifest, so this change cannot and does not touch them.

No sys_oauth_access_token ERROR line appears in any of these five harnesses,
before or after, so nothing here touches the back-channel planner question in
#14615 arm 2 — that arm stays fenced and untouched by this PR.

Tests

All five files, before and after (pnpm --filter @objectstack/plugin-auth exec vitest run --maxWorkers=2 src/NAME.test.ts):

file	before	after
audience-bootstrap-seam	Tests 6 passed (6)	Tests 6 passed (6)
dev-admin-seed-credential-gate	Tests 15 passed (15)	Tests 15 passed (15)
sso-register-platform-admin-gate	Tests 4 passed (4)	Tests 4 passed (4)
walled-owner-operator-stamp	Tests 28 passed (28)	Tests 28 passed (28)
credential-at-rest-posture	Tests 5 passed (5)	Tests 5 passed (5)

Whole package, at 0b6a065a2:

Test Files 91 passed (91)
Tests 1864 passed (1864)

pnpm --filter @objectstack/plugin-auth typecheck — exit 0. Its test layer is
compiled (verified with tsc --listFiles -p tsconfig.test.json: all five edited
files present, 1 hit each) and the shrink-only ledger is unmoved:
check:test-typecheck: OK ... 10 file(s) / 94 error(s) / 23 pinned signature(s),
none of the 94 in an edited file.

pnpm lint (eslint . --no-inline-config, whole repo) — exit 0, no output.

Gates

Derived at 0b6a065a2 with
node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack
(27 commands). 24 green. The other three exit 3, and each says in its own verdict
text that nothing was measured because the full workspace dist/ is absent
locally — check-test-completeness ("Nothing was measured"),
check:dual-build-cjs-loads ("PREREQUISITE NOT MET ... This is NOT a pass"),
check:type-check-debt ("--re-measure cannot run"). CI builds the closure and
runs them for real. check:nul-bytes green (8070 files) and a control-byte
scan over the five edited files found nothing.

check-system-context-census and check-affected-docs are both green after the
line-number shifts this diff causes in the five files.

Scope

Test-only; it imports an existing live export (manifest.ts:49). No package
publishes anything new, so this carries the skip-changeset label rather than a
changeset. The two SCIM harnesses (scim-deactivation-reconcile-user.test.ts,
scim-transaction-scope.test.ts) are not modified here and nothing was pushed
to #14751.

🤖 Generated with Claude Code

https://claude.ai/code/session_01AUF1NoViznQK32gqpK8wS8

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

Nothing in this diff resolved to a documentable surface (no symbol, route or SDK anchor derived from 0 changed package(s)), so this run has no opinion about the docs.

What this run could not see

• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 0 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json f3ae441fa2582e0b38e834b76353db0fe729fce5 → packageMentionDocs.

[os-sales]

Landing — PM seat domain:services, R21. Undrafted and auto-merge armed 05:39:10Z on head 0b6a065a27fd50ff172b5fd8cc2f3e4a7a31f8e2.

Verified before arming, at job level rather than from an aggregate:

• Every check run on this head is completed with success or skipped — 37 runs, none failed, none pending. The two that were still in flight at the previous probe finished green: Test Core (1/6) at 05:33:40Z (it ran 18 minutes against 2–4 minutes for shards 2–6 — the long shard, not a stall) and Lint & Repo Gates at 05:31:50Z.
• Clause-② carriers clear on both載体: this PR carries size/m / tests / skip-changeset, and card [finding] Four more plugin-auth AuthManager harnesses hand-write the object list without the OAuth objects — latent copies of the #14615 shape, counted (4 of 7) #14756 carries tests / pm:dispatched / domain:services / priority:p3. No needs:contract-review on either.

The auto-merge confirmation echoes method: MERGE even though SQUASH was requested. That is the known cosmetic field on a merge-queue repository (finding #14798) — the queue merges by its own configured method, and this will not be disabled and re-enabled to "fix" it.

---

Generated by Claude Code

[os-sales]

Fixes#14756

Five plugin-auth harnesses hand-wrote the set of objects a deployment mounting
plugin-auth registers, instead of importing authIdentityObjects from
src/manifest.ts. Each hand list had drifted below the manifest, so each
harness booted an engine missing tables the runtime registers. This converts
all five to the import pattern PR #14751 established on the two SCIM harnesses.

Population, re-derived on the tree

git grep -ln AUTH_OBJECTS finds six harnesses; the two SCIM ones were already
converted by #14751 (merged as d2bdab2d0) and are left untouched here. The
five this card owns, measured against authIdentityObjects (30 objects) by
resolving each hand-listed symbol through @objectstack/platform-objects and
comparing the resulting object NAMES:

harness	hand list	objects missing vs manifest
audience-bootstrap-seam.test.ts	9	21
dev-admin-seed-credential-gate.test.ts	9	21
sso-register-platform-admin-gate.test.ts	10	20
walled-owner-operator-stamp.test.ts	9	21
credential-at-rest-posture.test.ts	22	8

No hand list contained an object the manifest does not (0 extras anywhere), so
every conversion is a strict widening.

Two corrections to the triage note on the card, both measured:

1. credential-at-rest-posture.test.ts was described as "complete today". It is
   not: its list is missing 8 of the 30 objects, three of them OAuth ones —
   sys_oauth_client_assertion, sys_oauth_client_resource,
   sys_oauth_resource — plus sys_api_key, sys_device_code,
   sys_sso_provider, sys_two_factor, sys_user_preference. Converting it is
   a real widening, not just a spelling change.
2. sso-register-platform-admin-gate.test.ts had no AUTH_OBJECTS constant at
   all. Its list was a local const objects inside bootEngine(). It is now a
   module-scope AUTH_OBJECTS = authIdentityObjects, matching the other four.

Non-vacuity: the object set really grew

Booting the same engine shape bootEngine() uses (ObjectQL + driver-sql +
better-sqlite3 :memory:), once with the old 9-object hand list and once with
authIdentityObjects, then asking the driver to read four tables:

BEFORE (old hand-written list): registered 9 objects
sys_user: READABLE (table exists)
sys_oauth_access_token: REFUSED (no such table)
sys_jwks: REFUSED (no such table)
sys_sso_provider: REFUSED (no such table)
AFTER (authIdentityObjects): registered 30 objects
sys_user: READABLE (table exists)
sys_oauth_access_token: READABLE (table exists)
sys_jwks: READABLE (table exists)
sys_sso_provider: READABLE (table exists)

ERROR-line disposition

Of the five, only sso-register-platform-admin-gate.test.ts emitted driver
DATABASE_ERROR lines on a green run. Tallied by table, before and after:

table	before	after	in authIdentityObjects?
sys_jwks	1	0	yes
sys_position	4	4	no
sys_user_position	4	4	no

The only line that disappeared is the sys_jwks one, and it disappeared
because SysJwks is in authIdentityObjects and is therefore now registered
and its table created — the intended effect. The sys_position and
sys_user_position lines are unchanged in count: those objects are not in the
auth identity manifest, so this change cannot and does not touch them.

No sys_oauth_access_token ERROR line appears in any of these five harnesses,
before or after, so nothing here touches the back-channel planner question in
#14615 arm 2 — that arm stays fenced and untouched by this PR.

Tests

All five files, before and after (pnpm --filter @objectstack/plugin-auth exec vitest run --maxWorkers=2 src/NAME.test.ts):

file	before	after
audience-bootstrap-seam	Tests 6 passed (6)	Tests 6 passed (6)
dev-admin-seed-credential-gate	Tests 15 passed (15)	Tests 15 passed (15)
sso-register-platform-admin-gate	Tests 4 passed (4)	Tests 4 passed (4)
walled-owner-operator-stamp	Tests 28 passed (28)	Tests 28 passed (28)
credential-at-rest-posture	Tests 5 passed (5)	Tests 5 passed (5)

Whole package, at 0b6a065a2:

Test Files 91 passed (91)
Tests 1864 passed (1864)

pnpm --filter @objectstack/plugin-auth typecheck — exit 0. Its test layer is
compiled (verified with tsc --listFiles -p tsconfig.test.json: all five edited
files present, 1 hit each) and the shrink-only ledger is unmoved:
check:test-typecheck: OK ... 10 file(s) / 94 error(s) / 23 pinned signature(s),
none of the 94 in an edited file.

pnpm lint (eslint . --no-inline-config, whole repo) — exit 0, no output.

Gates

Derived at 0b6a065a2 with
node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack
(27 commands). 24 green. The other three exit 3, and each says in its own verdict
text that nothing was measured because the full workspace dist/ is absent
locally — check-test-completeness ("Nothing was measured"),
check:dual-build-cjs-loads ("PREREQUISITE NOT MET ... This is NOT a pass"),
check:type-check-debt ("--re-measure cannot run"). CI builds the closure and
runs them for real. check:nul-bytes green (8070 files) and a control-byte
scan over the five edited files found nothing.

check-system-context-census and check-affected-docs are both green after the
line-number shifts this diff causes in the five files.

Scope

Test-only; it imports an existing live export (manifest.ts:49). No package
publishes anything new, so this carries the skip-changeset label rather than a
changeset. The two SCIM harnesses (scim-deactivation-reconcile-user.test.ts,
scim-transaction-scope.test.ts) are not modified here and nothing was pushed
to #14751.

🤖 Generated with Claude Code

https://claude.ai/code/session_01AUF1NoViznQK32gqpK8wS8

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

Nothing in this diff resolved to a documentable surface (no symbol, route or SDK anchor derived from 0 changed package(s)), so this run has no opinion about the docs.

What this run could not see

• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 0 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json f3ae441fa2582e0b38e834b76353db0fe729fce5 → packageMentionDocs.

[os-sales]

Landing — PM seat domain:services, R21. Undrafted and auto-merge armed 05:39:10Z on head 0b6a065a27fd50ff172b5fd8cc2f3e4a7a31f8e2.

Verified before arming, at job level rather than from an aggregate:

• Every check run on this head is completed with success or skipped — 37 runs, none failed, none pending. The two that were still in flight at the previous probe finished green: Test Core (1/6) at 05:33:40Z (it ran 18 minutes against 2–4 minutes for shards 2–6 — the long shard, not a stall) and Lint & Repo Gates at 05:31:50Z.
• Clause-② carriers clear on both載体: this PR carries size/m / tests / skip-changeset, and card [finding] Four more plugin-auth AuthManager harnesses hand-write the object list without the OAuth objects — latent copies of the #14615 shape, counted (4 of 7) #14756 carries tests / pm:dispatched / domain:services / priority:p3. No needs:contract-review on either.

The auto-merge confirmation echoes method: MERGE even though SQUASH was requested. That is the known cosmetic field on a merge-queue repository (finding #14798) — the queue merges by its own configured method, and this will not be disabled and re-enabled to "fix" it.

---

Generated by Claude Code

[os-sales]

Fixes#14756

Five plugin-auth harnesses hand-wrote the set of objects a deployment mounting
plugin-auth registers, instead of importing authIdentityObjects from
src/manifest.ts. Each hand list had drifted below the manifest, so each
harness booted an engine missing tables the runtime registers. This converts
all five to the import pattern PR #14751 established on the two SCIM harnesses.

Population, re-derived on the tree

git grep -ln AUTH_OBJECTS finds six harnesses; the two SCIM ones were already
converted by #14751 (merged as d2bdab2d0) and are left untouched here. The
five this card owns, measured against authIdentityObjects (30 objects) by
resolving each hand-listed symbol through @objectstack/platform-objects and
comparing the resulting object NAMES:

harness	hand list	objects missing vs manifest
audience-bootstrap-seam.test.ts	9	21
dev-admin-seed-credential-gate.test.ts	9	21
sso-register-platform-admin-gate.test.ts	10	20
walled-owner-operator-stamp.test.ts	9	21
credential-at-rest-posture.test.ts	22	8

No hand list contained an object the manifest does not (0 extras anywhere), so
every conversion is a strict widening.

Two corrections to the triage note on the card, both measured:

1. credential-at-rest-posture.test.ts was described as "complete today". It is
   not: its list is missing 8 of the 30 objects, three of them OAuth ones —
   sys_oauth_client_assertion, sys_oauth_client_resource,
   sys_oauth_resource — plus sys_api_key, sys_device_code,
   sys_sso_provider, sys_two_factor, sys_user_preference. Converting it is
   a real widening, not just a spelling change.
2. sso-register-platform-admin-gate.test.ts had no AUTH_OBJECTS constant at
   all. Its list was a local const objects inside bootEngine(). It is now a
   module-scope AUTH_OBJECTS = authIdentityObjects, matching the other four.

Non-vacuity: the object set really grew

Booting the same engine shape bootEngine() uses (ObjectQL + driver-sql +
better-sqlite3 :memory:), once with the old 9-object hand list and once with
authIdentityObjects, then asking the driver to read four tables:

BEFORE (old hand-written list): registered 9 objects
sys_user: READABLE (table exists)
sys_oauth_access_token: REFUSED (no such table)
sys_jwks: REFUSED (no such table)
sys_sso_provider: REFUSED (no such table)
AFTER (authIdentityObjects): registered 30 objects
sys_user: READABLE (table exists)
sys_oauth_access_token: READABLE (table exists)
sys_jwks: READABLE (table exists)
sys_sso_provider: READABLE (table exists)

ERROR-line disposition

Of the five, only sso-register-platform-admin-gate.test.ts emitted driver
DATABASE_ERROR lines on a green run. Tallied by table, before and after:

table	before	after	in authIdentityObjects?
sys_jwks	1	0	yes
sys_position	4	4	no
sys_user_position	4	4	no

The only line that disappeared is the sys_jwks one, and it disappeared
because SysJwks is in authIdentityObjects and is therefore now registered
and its table created — the intended effect. The sys_position and
sys_user_position lines are unchanged in count: those objects are not in the
auth identity manifest, so this change cannot and does not touch them.

No sys_oauth_access_token ERROR line appears in any of these five harnesses,
before or after, so nothing here touches the back-channel planner question in
#14615 arm 2 — that arm stays fenced and untouched by this PR.

Tests

All five files, before and after (pnpm --filter @objectstack/plugin-auth exec vitest run --maxWorkers=2 src/NAME.test.ts):

file	before	after
audience-bootstrap-seam	Tests 6 passed (6)	Tests 6 passed (6)
dev-admin-seed-credential-gate	Tests 15 passed (15)	Tests 15 passed (15)
sso-register-platform-admin-gate	Tests 4 passed (4)	Tests 4 passed (4)
walled-owner-operator-stamp	Tests 28 passed (28)	Tests 28 passed (28)
credential-at-rest-posture	Tests 5 passed (5)	Tests 5 passed (5)

Whole package, at 0b6a065a2:

Test Files 91 passed (91)
Tests 1864 passed (1864)

pnpm --filter @objectstack/plugin-auth typecheck — exit 0. Its test layer is
compiled (verified with tsc --listFiles -p tsconfig.test.json: all five edited
files present, 1 hit each) and the shrink-only ledger is unmoved:
check:test-typecheck: OK ... 10 file(s) / 94 error(s) / 23 pinned signature(s),
none of the 94 in an edited file.

pnpm lint (eslint . --no-inline-config, whole repo) — exit 0, no output.

Gates

Derived at 0b6a065a2 with
node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack
(27 commands). 24 green. The other three exit 3, and each says in its own verdict
text that nothing was measured because the full workspace dist/ is absent
locally — check-test-completeness ("Nothing was measured"),
check:dual-build-cjs-loads ("PREREQUISITE NOT MET ... This is NOT a pass"),
check:type-check-debt ("--re-measure cannot run"). CI builds the closure and
runs them for real. check:nul-bytes green (8070 files) and a control-byte
scan over the five edited files found nothing.

check-system-context-census and check-affected-docs are both green after the
line-number shifts this diff causes in the five files.

Scope

Test-only; it imports an existing live export (manifest.ts:49). No package
publishes anything new, so this carries the skip-changeset label rather than a
changeset. The two SCIM harnesses (scim-deactivation-reconcile-user.test.ts,
scim-transaction-scope.test.ts) are not modified here and nothing was pushed
to #14751.

🤖 Generated with Claude Code

https://claude.ai/code/session_01AUF1NoViznQK32gqpK8wS8

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

Nothing in this diff resolved to a documentable surface (no symbol, route or SDK anchor derived from 0 changed package(s)), so this run has no opinion about the docs.

What this run could not see

• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 0 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json f3ae441fa2582e0b38e834b76353db0fe729fce5 → packageMentionDocs.

[os-sales]

Landing — PM seat domain:services, R21. Undrafted and auto-merge armed 05:39:10Z on head 0b6a065a27fd50ff172b5fd8cc2f3e4a7a31f8e2.

Verified before arming, at job level rather than from an aggregate:

• Every check run on this head is completed with success or skipped — 37 runs, none failed, none pending. The two that were still in flight at the previous probe finished green: Test Core (1/6) at 05:33:40Z (it ran 18 minutes against 2–4 minutes for shards 2–6 — the long shard, not a stall) and Lint & Repo Gates at 05:31:50Z.
• Clause-② carriers clear on both載体: this PR carries size/m / tests / skip-changeset, and card [finding] Four more plugin-auth AuthManager harnesses hand-write the object list without the OAuth objects — latent copies of the #14615 shape, counted (4 of 7) #14756 carries tests / pm:dispatched / domain:services / priority:p3. No needs:contract-review on either.

The auto-merge confirmation echoes method: MERGE even though SQUASH was requested. That is the known cosmetic field on a merge-queue repository (finding #14798) — the queue merges by its own configured method, and this will not be disabled and re-enabled to "fix" it.

---

Generated by Claude Code

[os-sales]

Fixes#14756

Five plugin-auth harnesses hand-wrote the set of objects a deployment mounting
plugin-auth registers, instead of importing authIdentityObjects from
src/manifest.ts. Each hand list had drifted below the manifest, so each
harness booted an engine missing tables the runtime registers. This converts
all five to the import pattern PR #14751 established on the two SCIM harnesses.

Population, re-derived on the tree

git grep -ln AUTH_OBJECTS finds six harnesses; the two SCIM ones were already
converted by #14751 (merged as d2bdab2d0) and are left untouched here. The
five this card owns, measured against authIdentityObjects (30 objects) by
resolving each hand-listed symbol through @objectstack/platform-objects and
comparing the resulting object NAMES:

harness	hand list	objects missing vs manifest
audience-bootstrap-seam.test.ts	9	21
dev-admin-seed-credential-gate.test.ts	9	21
sso-register-platform-admin-gate.test.ts	10	20
walled-owner-operator-stamp.test.ts	9	21
credential-at-rest-posture.test.ts	22	8

No hand list contained an object the manifest does not (0 extras anywhere), so
every conversion is a strict widening.

Two corrections to the triage note on the card, both measured:

1. credential-at-rest-posture.test.ts was described as "complete today". It is
   not: its list is missing 8 of the 30 objects, three of them OAuth ones —
   sys_oauth_client_assertion, sys_oauth_client_resource,
   sys_oauth_resource — plus sys_api_key, sys_device_code,
   sys_sso_provider, sys_two_factor, sys_user_preference. Converting it is
   a real widening, not just a spelling change.
2. sso-register-platform-admin-gate.test.ts had no AUTH_OBJECTS constant at
   all. Its list was a local const objects inside bootEngine(). It is now a
   module-scope AUTH_OBJECTS = authIdentityObjects, matching the other four.

Non-vacuity: the object set really grew

Booting the same engine shape bootEngine() uses (ObjectQL + driver-sql +
better-sqlite3 :memory:), once with the old 9-object hand list and once with
authIdentityObjects, then asking the driver to read four tables:

BEFORE (old hand-written list): registered 9 objects
sys_user: READABLE (table exists)
sys_oauth_access_token: REFUSED (no such table)
sys_jwks: REFUSED (no such table)
sys_sso_provider: REFUSED (no such table)
AFTER (authIdentityObjects): registered 30 objects
sys_user: READABLE (table exists)
sys_oauth_access_token: READABLE (table exists)
sys_jwks: READABLE (table exists)
sys_sso_provider: READABLE (table exists)

ERROR-line disposition

Of the five, only sso-register-platform-admin-gate.test.ts emitted driver
DATABASE_ERROR lines on a green run. Tallied by table, before and after:

table	before	after	in authIdentityObjects?
sys_jwks	1	0	yes
sys_position	4	4	no
sys_user_position	4	4	no

The only line that disappeared is the sys_jwks one, and it disappeared
because SysJwks is in authIdentityObjects and is therefore now registered
and its table created — the intended effect. The sys_position and
sys_user_position lines are unchanged in count: those objects are not in the
auth identity manifest, so this change cannot and does not touch them.

No sys_oauth_access_token ERROR line appears in any of these five harnesses,
before or after, so nothing here touches the back-channel planner question in
#14615 arm 2 — that arm stays fenced and untouched by this PR.

Tests

All five files, before and after (pnpm --filter @objectstack/plugin-auth exec vitest run --maxWorkers=2 src/NAME.test.ts):

file	before	after
audience-bootstrap-seam	Tests 6 passed (6)	Tests 6 passed (6)
dev-admin-seed-credential-gate	Tests 15 passed (15)	Tests 15 passed (15)
sso-register-platform-admin-gate	Tests 4 passed (4)	Tests 4 passed (4)
walled-owner-operator-stamp	Tests 28 passed (28)	Tests 28 passed (28)
credential-at-rest-posture	Tests 5 passed (5)	Tests 5 passed (5)

Whole package, at 0b6a065a2:

Test Files 91 passed (91)
Tests 1864 passed (1864)

pnpm --filter @objectstack/plugin-auth typecheck — exit 0. Its test layer is
compiled (verified with tsc --listFiles -p tsconfig.test.json: all five edited
files present, 1 hit each) and the shrink-only ledger is unmoved:
check:test-typecheck: OK ... 10 file(s) / 94 error(s) / 23 pinned signature(s),
none of the 94 in an edited file.

pnpm lint (eslint . --no-inline-config, whole repo) — exit 0, no output.

Gates

Derived at 0b6a065a2 with
node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack
(27 commands). 24 green. The other three exit 3, and each says in its own verdict
text that nothing was measured because the full workspace dist/ is absent
locally — check-test-completeness ("Nothing was measured"),
check:dual-build-cjs-loads ("PREREQUISITE NOT MET ... This is NOT a pass"),
check:type-check-debt ("--re-measure cannot run"). CI builds the closure and
runs them for real. check:nul-bytes green (8070 files) and a control-byte
scan over the five edited files found nothing.

check-system-context-census and check-affected-docs are both green after the
line-number shifts this diff causes in the five files.

Scope

Test-only; it imports an existing live export (manifest.ts:49). No package
publishes anything new, so this carries the skip-changeset label rather than a
changeset. The two SCIM harnesses (scim-deactivation-reconcile-user.test.ts,
scim-transaction-scope.test.ts) are not modified here and nothing was pushed
to #14751.

🤖 Generated with Claude Code

https://claude.ai/code/session_01AUF1NoViznQK32gqpK8wS8

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

Nothing in this diff resolved to a documentable surface (no symbol, route or SDK anchor derived from 0 changed package(s)), so this run has no opinion about the docs.

What this run could not see

• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.

Coarse fallback — 0 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json f3ae441fa2582e0b38e834b76353db0fe729fce5 → packageMentionDocs.

[os-sales]

Landing — PM seat domain:services, R21. Undrafted and auto-merge armed 05:39:10Z on head 0b6a065a27fd50ff172b5fd8cc2f3e4a7a31f8e2.

Verified before arming, at job level rather than from an aggregate:

• Every check run on this head is completed with success or skipped — 37 runs, none failed, none pending. The two that were still in flight at the previous probe finished green: Test Core (1/6) at 05:33:40Z (it ran 18 minutes against 2–4 minutes for shards 2–6 — the long shard, not a stall) and Lint & Repo Gates at 05:31:50Z.
• Clause-② carriers clear on both載体: this PR carries size/m / tests / skip-changeset, and card [finding] Four more plugin-auth AuthManager harnesses hand-write the object list without the OAuth objects — latent copies of the #14615 shape, counted (4 of 7) #14756 carries tests / pm:dispatched / domain:services / priority:p3. No needs:contract-review on either.

The auto-merge confirmation echoes method: MERGE even though SQUASH was requested. That is the known cosmetic field on a merge-queue repository (finding #14798) — the queue merges by its own configured method, and this will not be disabled and re-enabled to "fix" it.

---

Generated by Claude Code