From 11d842198fce024d2e79779b8d7bee9d6afda264 Mon Sep 17 00:00:00 2001 From: Claude Date: Thu, 15 Oct 2026 01:34:29 +0000 Subject: [PATCH] test(dogfood): the census re-anchors rest-server.ts's enforceAuth control 61 -> 64 for three comment-only mentions Commit 1d79556766 (the API-key lifecycle) added three prose mentions of `enforceAuth` to packages/rest/src/rest-server.ts: two in the docblock on `apiKeyLifecycleRefusals` and one in `computeExecCtx`'s outer catch. It added and removed no call site. The census counts the bare term, comments included, so the control moved 61 -> 64 while population, reach, blind spot and every other control on the row stayed as pinned. Re-anchored with a provenance note, as the row's earlier moves were; the control stays an exact count. Claude-Session: https://claude.ai/code/session_01YRp5z4kK6vgYkrdH97ztsy Co-authored-by: Claude --- .../test/authz-probe-blind-spot.census.ts | 16 +++++++++++++++- 1 file changed, 15 insertions(+), 1 deletion(-) diff --git a/packages/qa/dogfood/test/authz-probe-blind-spot.census.ts b/packages/qa/dogfood/test/authz-probe-blind-spot.census.ts index ea70ff2232a..e28fa932312 100644 --- a/packages/qa/dogfood/test/authz-probe-blind-spot.census.ts +++ b/packages/qa/dogfood/test/authz-probe-blind-spot.census.ts @@ -631,6 +631,20 @@ export const PROBE_FILE_CENSUS: readonly ProbeFileReading[] = [ // carries the move — the host literal's forwarder (`enforceAuth: (...a) => // this.enforceAuth(...a)`, two) and the host interface's member // (`enforceAuth: RestServer['enforceAuth']`, two). No call site was added. + // [commit 1d79556766] `enforceAuth` 61 -> 64, and nothing else on this row + // moved: 70 / 19 / 51 and every other control re-derived unchanged. + // ⛔ RE-ANCHORED, not relaxed: PR #23541 (#23367, the API-key lifecycle) + // added three PROSE mentions and no call site, and `occurrences` counts the + // bare term, comments included. At `fa6a6085c` they are + // `rest-server.ts:2395` and `:2397`, the docblock on + // `apiKeyLifecycleRefusals` ("so {@link enforceAuth} can answer it", + // "every door that never reaches `enforceAuth`"), and `:3471`, the inline + // comment in `computeExecCtx`'s outer `catch` ("for `enforceAuth`, which + // answers its `403` and code"). The same commit edited `enforceAuth`'s own + // body and docblock in lines that do not spell the term, removed no + // mention, and left `data-action-routes.ts` untouched. No call site was + // added. ⚠️ The dogfood shards skip on PRs and in the merge queue, so this + // move was seen only by the hourly full run on `main`. controls: { 'private register*Endpoints(': 16, 'this.routeManager.register(': 63, @@ -642,7 +656,7 @@ export const PROBE_FILE_CENSUS: readonly ProbeFileReading[] = [ 'registerPerItemRoute(': 8, 'const registerPerItemRoute =': 1, 'forwarder slice: this.routeManager.register(': 1, - enforceAuth: 61, + enforceAuth: 64, }, note: 'The single non-tripwire probe names ONE registrar of 16. The other 15 can never mint a key: ' +