test(dogfood): the census re-anchors rest-server.ts's enforceAuth control 61 -> 64 for three comment-only mentions

[objectstack-fleet]

Fixes #23563
Clause-②: no

The hourly full run's Dogfood Regression Gate (3/3) is red on main at packages/qa/dogfood/test/authz-probe-blind-spot.test.ts:88: control "enforceAuth" moved in packages/rest/src/rest-server.ts: expected 64 to be 61. This PR re-anchors that one control by the census's own rule for a moved positive control, with a provenance note. It does not drop, narrow or relax it.

What changed

One file: packages/qa/dogfood/test/authz-probe-blind-spot.census.ts, on the rest-server.ts row only.

• controls.enforceAuth: 61 -> 64. It stays an exact count, not a range or a floor.
• A provenance paragraph after the [#23050 slice 1] one, in the same voice as the earlier moves ([commit cc837dbfe] 61 -> 64, [#20102] 64 -> 56, [#23050 slice 1] 57 -> 61). It says the control was RE-ANCHORED, not relaxed, and names the three comment-only mentions by line.

Not touched: packages/rest/** (the comments #23541 added stay as written), the test runner, every other row and control, and the census's counting rule. The census states that occurrences counts the bare term, comments included. Its earlier moves were re-anchored under that rule, so this is a re-anchor, not a rule change.

Measurements (H1 to H4 from the dispatch)

Every count below comes from the census's own deriveProbeFileCensus(), imported from the checkout named and run with tsx. None is a grep of my own.

H1: only comments moved. Confirmed.

tree	enforceAuth (derived / recorded)
8226755ee9 (last green hourly run; parent of 1d79556766)	61 / 61
1d79556766 (PR #23541, #23367)	64 / 61
fa6a6085c (this branch's base)	64 / 61

git show 1d79556766 -- packages/rest/src/rest-server.ts adds exactly three lines that spell enforceAuth and removes none. data-action-routes.ts, the row's second file, is not in that commit. The three lines, at fa6a6085c:

• rest-server.ts:2395, docblock on apiKeyLifecycleRefusals: "by {@link computeExecCtx}'s catch so {@link enforceAuth} can answer it."
• rest-server.ts:2397, the same docblock: "identity fault: every door that never reaches enforceAuth keeps the"
• rest-server.ts:3471, an inline // comment in computeExecCtx's outer catch (declared at :3044): "for enforceAuth, which answers its 403 and code."

All three are comments. The same commit also changed enforceAuth's own body (the lifecycle-refusal answer) and its docblock, but none of those lines spells the term. It added no call site, forwarder or interface member. No commit between 8226755ee9 and fa6a6085c other than 1d79556766 touches either file the row reads.

H2: nothing else on the row moved. Confirmed. At fa6a6085c, population 70 / reachable 19 / blindSpot 51 match the record. So do the other six controls: private register*Endpoints( 16, this.routeManager.register( 63, data-action-routes.ts: this.routeManager.register( 9, registerPerItemRoute( 8, const registerPerItemRoute = 1, forwarder slice: this.routeManager.register( 1. Every other census row also reads as pinned (0 rows moved).

H3: red before, green after, locally. The dogfood shards skip on pull_request and merge_group (ci.yml, the dogfood job's if:), so this PR's CI will not run this test. These two local runs are the measurement of record. Both ran through scripts/pm/os-verify-lock.sh, with pnpm --filter @objectstack/dogfood exec vitest run --maxWorkers=2 test/authz-probe-blind-spot.test.ts.

Before, on fa6a6085c (clean tree):

 FAIL  |isolated| test/authz-probe-blind-spot.test.ts > authz probe blind-spot census (#13260) > packages/rest/src/rest-server.ts — every positive control is still present in THAT file
AssertionError: control "enforceAuth" moved in packages/rest/src/rest-server.ts: expected 64 to be 61 // Object.is equality
 ❯ test/authz-probe-blind-spot.test.ts:88:76
 Test Files  1 failed (1)
      Tests  1 failed | 46 passed (47)
os-verify-lock: VERDICT command-exit 1 · held the lock 3s · waited 0s

After, on 11d842198 (this PR's head):

 Test Files  1 passed (1)
      Tests  47 passed (47)
os-verify-lock: VERDICT command-exit 0 · held the lock 2s · waited 0s

H4: the next move in flight. Measured, and it does not move this control. At PR #23571's head 3dd76b2a8 (branch claude/issue-23491-patch-data-request-gate, merge base 086fa4640f, which already contains 1d79556766), the census reads enforceAuth 64, the same as the value re-anchored here. Its rest-server.ts diff (+41 / -17) adds and removes no line that spells the term. Every other control and figure on the row also reads as pinned there. That PR was not touched.

Gates

node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack at 11d842198 derives 47 commands for the one changed path. All 47 ran locally, each recorded with its exit code captured before any pipe:

• 43 exited 0.
• 4 exited 3 (PREREQUISITE NOT MET: they load built dist/ across the workspace, and this worktree has no workspace build). These are NOT MEASURED locally: check:dts-closure, check:dual-build-cjs-loads, check:lean-entry-closure and check:sourcemap-no-sources-content. CI's Lint & Repo Gates runs them.
• --ran reconciliation: ✓ dispatch-gates --ran: 47 derived famil(ies) accounted for — 43 run, 4 NOT-MEASURED (4 DERIVED from a recorded exit 3).

Declared narrowings:

• The dogfood package's full pnpm test (the three dogfood shards) was not run locally. The census module is imported by exactly one file, test/authz-probe-blind-spot.test.ts (git grep). That file was run in full, so the single-file run covers the whole reach of this diff.
• pnpm --filter @objectstack/dogfood typecheck is left to CI's TypeScript Type Check, whose PR selection includes the changed package. The edit is a numeric literal in the row's controls record (typed as a read-only record of string to number), plus comments. Building the dependency closure would mean 67 packages, 65 of them a turbo cache MISS on a dry run.

Changeset

None. @objectstack/dogfood is private: true, so this diff publishes nothing from any released package. Under the repo's convention the PR carries the skip-changeset label.

Acceptance notes

• Observation, not a defect: the census counts enforceAuth textually, comments included, by its own stated rule. Any prose mention added to rest-server.ts or data-action-routes.ts therefore moves the control. Because the dogfood shards skip on PRs and in the merge queue, only the hourly full run on main sees such a move. That is the two-speed design working as declared. Changing the counting rule is a census redesign, out of this card's scope. Carrier: none.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

Nothing in this diff resolved to a documentable surface (no symbol, route or SDK anchor derived from 0 changed package(s)), so this run has no opinion about the docs.

What this run could not see

• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 0 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json fa6a6085c07df22274fa56bfc93141f75f50d25b → packageMentionDocs.

[objectstack-fleet]

席位核对

ACCEPT · domain:spec seat 1 (#6017) · huangyiirene · session session_01YRp5z4kK6vgYkrdH97ztsy · head 11d842198 · 2026-10-15T01:50Z

No contract face, so no review is owed beyond this one: a private test-census pin (@objectstack/dogfood is private: true), no published schema, no governed text, Clause-②: no. CI and this seat's own read clear it. Card #23563 (main red, p1), claim 6182281865, dev report on #23563.

1. Shape

• Draft, base main. Line 1 Fixes #23563; Clause-②: no. No other closing keyword.
• 1 file, +15 / -1: packages/qa/dogfood/test/authz-probe-blind-spot.census.ts, the rest-server.ts row only. controls.enforceAuth moves 61 → 64, with a provenance paragraph in the voice of the row's earlier moves ("RE-ANCHORED, not relaxed").
• The counting rule, every other control and every other row are untouched. packages/rest/** is untouched.
• skip-changeset is applied (a private package); Check Changeset is green.

2. Premises measured

• H1 held, by the census's own deriveProbeFileCensus(): 61 at 8226755ee (the last green hourly run), 64 at 1d79556766, 64 at fa6a6085c.
  • The +3 are the three comment lines PR feat(spec,core,runtime,plugin-auth)!: API keys get a lifecycle: 90-day default expiry, one-year ceiling, 90-day inactivity expiry, one-year grace, distinct refusal codes #23541 added: rest-server.ts:2395 and :2397 (the apiKeyLifecycleRefusals docblock) and :3471 (the inline comment in computeExecCtx's outer catch). No call site, forwarder or interface member was added.
  • The seat counted independently with a plain textual count over the two files the row reads: 50+11 = 61 → 53+11 = 64. Same reading.
• H2 held: 70 / 19 / 51 and the six other controls read as pinned, and no other census row moved.
• H3, the measurement of record (the dogfood shards skip on PRs and in the merge queue, so this PR's CI does not run the test): the failing file run alone through the verify lock.
  • Before, on fa6a6085c: expected 64 to be 61, 1 failed / 46 passed.
  • After, on 11d842198: 47 passed.
• H4: PR fix(rest,runtime)!: both /data write doors validate the request as the caller sent it; a number expectedVersion is refused 400 #23571's head (3dd76b2a8, runtime: the dispatcher's PATCH /data/:object/:id has no request-schema gate, so a non-record body answers 500 with the engine's own error, where REST answers 400 VALIDATION_FAILED #23491) also reads 64, so it does not move this control further.

3. Gates

• Local: --ran 47 derived / 43 run / 4 NOT-MEASURED. The four are exit 3, needing a workspace dist build: check:dts-closure, check:dual-build-cjs-loads, check:lean-entry-closure, check:sourcemap-no-sources-content. CI runs them.
• CI on the head at this act: in progress, no failures. The flip waits for green.
• The next hourly run on main after landing is what closes the card.

4. Deviations accepted

• Declared narrowings: the dogfood full suite, the dogfood typecheck and the dependency-closure build are left to CI. The census module's one importer, test/authz-probe-blind-spot.test.ts, was run in full; the edit is a numeric literal plus comments.
• No ablation: a re-anchored pin's proof is the before-red / after-green run, as the order said.
• Measurement scaffolding (a detached comparison worktree in the scratchpad, a fetched ref) was removed.

5. Out of scope

• Acceptance note, 承接者:无: the census counts enforceAuth textually, comments included (its stated rule), and the dogfood shards skip on PRs and in the merge queue. So any prose mention added to rest-server.ts or data-action-routes.ts will turn the hourly run red again, and only the hourly run will see it. Changing that rule, or running the shard on PRs that touch those two files, is a census or CI redesign. It is not this card's fix, and no reader is named for it.

6. Landing: Tier S, ordinary queue, once the head is all green. main is red until it lands.

---

Generated by Claude Code