Repository navigation
Commit 98c0257
test(dogfood): derive the authz probe reach from the route ledgers; retire the hand-written census (#26491)
<!-- claude-projects-attribution: {"github_login":"os-steve"} -->
_Requested by **Steve** · [project
thread](https://claude.ai/code/project/chan_01FdL1XeUyvVNxLreh3F4Qi9?thread=cmsg_01FdL1XeUyvVNxLreh3F4Qi99G8ApwiZzLyCouRQisBjZd)_
Fixes #26410
Clause-②: no
Metadata-protocol: none
Ruling-ref: 6433001130
## 维护者速读
- 改了什么:删掉 dogfood 里 1,691 行手写的权限普查表
`authz-probe-blind-spot.census.ts`,`authz-probe-blind-spot.test.ts`
改成直接从两张路由账本推导:只有账本里出现一行 `discover()` 读不到的路由才红,不再钉任何条数。matrix 注释里两本账的「N
rows」也去掉,只留 families / domains 数,#17111 的钉相应只钉组数。
- 为什么改:10 天里 3 次 PR 绿着合进去、main 才红,全是「加了一条路由、条数没同步」。按裁决
C:普查从账本派生,纯数字变动不再红;`discover()` 的 UNCLASSIFIED / STALE 棘轮不动,也不加任何 CI 车道。
- 风险与回滚:只动测试文件和三处注释,不动任何路由代码和发布内容;回滚即 revert。代价是不再记录 rest-server.ts
注册点的盲点读数(那份记录留在 commit 6746140 的历史里)。
-
先看:`packages/qa/dogfood/test/authz-probe-blind-spot.test.ts`(新的推导检查),其次
`authz-conformance.test.ts` 的 #17111 段,再看 `authz-conformance.matrix.ts`
第 27 行一带。
- 两分钟验证:`pnpm --filter @objectstack/dogfood exec vitest run
test/authz-probe-blind-spot.test.ts test/authz-conformance.test.ts`,预期 2
个文件、70 个测试全绿。
- 需要你做的:无,席位落地。
## What changes
**C, as ruled.** The hand-written census
`packages/qa/dogfood/test/authz-probe-blind-spot.census.ts` (1,691
lines) is deleted. It pinned per-file registration-site counts, exact
positive-control counts, the probe-table shape (25 / 20 / 33) and two
blind-spot totals (65 / 70), so every route added anywhere in
`@objectstack/rest` had to be re-measured by hand. If it was not, `main`
went red after a green merge.
`authz-probe-blind-spot.test.ts` is rewritten to derive everything and
pin no count:
- **Population and reach come from the ledgers.** For
`REST_ROUTE_LEDGER` (`family`) and `ROUTE_LEDGER` (`domain`), the
imported table is the population. The ledger probe's own scoped text
read (the same `export const NAME` … closing-bracket scope `discover()`
uses) is the reach. The test asserts the two line up row by row. It goes
red only on a ledger row whose grouping value the probe cannot read.
Such a row is a route `discover()` can never name. A row with a literal
family or domain moves nothing.
- **Kept, derived on both sides:** the matrix header's "`discover()`: N
probes over M named source files" must equal the `PROBES` table it
describes. Every `PROBES` entry must declare its `kind` before its
`file`. All three kinds must still be in use.
- **Kept, presence only:** each file a TRIPWIRE probe reads keeps one
in-file positive control, so a tripwire's zero still reads the file.
Each module on the `RestServer` registrar list must still register
routes, since the two `rest-server.ts` tripwires read them all. No exact
counts.
**The #17111 docblock pin, in place (same defect class).** The claim's
premise was "the three reds were all the blind-spot pin". That is only
partly true. #26406's before-run shows `authz-conformance.test.ts`'s
#17111 pin also red on #26361 (`docblock says 80 rows, the table holds
81`), so deleting the census alone would leave a route-only PR still
editing `authz-conformance.matrix.ts`.
The matrix docblock now states only `(18 families)` / `(23 domains)`.
The pin parses that shape, and the "stale ROW count" doctoring case is
gone. The group, deletion, second-copy and anchor cases stay. A new
family or domain still moves the figure, alongside the `discover()`
classification it needs anyway. The seat amended the claim's file
surface for this.
**Untouched:** `discover()` and its UNCLASSIFIED / STALE verdicts, the
baseline, the matrix rows, every CI workflow. No census step was added
to PRs or the merge queue.
**Other readers of the census path, re-read before deleting.** None
needs the table:
| Reader | What it held | Action |
|:--|:--|:--|
| `packages/rest/src/rest-route-ledger.ts`,
`packages/runtime/src/route-ledger.ts` | a comment pointer: "the full
reading lives in … census.ts" | pointer now names the census at commit
6746140 and its derived successor |
| `packages/rest/src/rest-meta-auth.test.ts` | a comment: the test
"licenses the census counting those 8 as REACHABLE" | reworded to the
ratchet's `meta:rest-server.ts:registerMetadataEndpoints` key |
| `authz-conformance.test.ts` (5 comments) | pointers to the census's
prose and per-file controls | re-pointed (the controls now live in the
new test) |
| `scripts/pm/dispatch-gates.mjs:2822` | a dated incident narrative
naming the path | unchanged; it describes a past edit |
| `scripts/pm/dispatch-gates.self-test.mjs:12013` | the path as a
change-set fixture for `jobFilteredSteps` | unchanged; pure path-pattern
matching, no file read, and the path still lies under
`packages/qa/dogfood/**` |
No `scripts/pm/**` wording moved, so this PR is not Tier H.
## Why
Three `main` reds in ten days (#24057, #25988, #26361 → #26400) came
from a PR that changed a counted file and merged green. These census
files run only on `main`'s push and scheduled batteries. Every one was a
count moving, never an unclassified route. The ruling (6433001130)
withdrew a PR-time census step (letter A) and kept C: derive the
population, so a bump-only change reds nothing, and leave `discover()`
as the only gate.
## Tests
<details><summary>Both files on <code>origin/main</code> 6746140
(before): 108 passed</summary>
```
Test Files 2 passed (2)
Tests 108 passed (108)
os-verify-lock: VERDICT command-exit 0 · held the lock 19s
```
</details>
<details><summary>Both files on bd9b1ea (after): 70 passed</summary>
```
Test Files 2 passed (2)
Tests 70 passed (70)
os-verify-lock: VERDICT command-exit 0 · held the lock 22s
```
The 38 fewer tests are the census's per-file parametrised rows and its
table and totals pins, all deleted with it.
</details>
<details><summary>Controls on bd9b1ea: one row added to
<code>REST_ROUTE_LEDGER</code> via
<code>scripts/ablation-replace.mjs</code>, restored and hash-checked
after each leg</summary>
- **Positive control: a route-only change.** Added `GET
/api/v1/approvals/zz-control-probe` with `family: 'approvals'`, an
existing family. Result: `Test Files 2 passed (2) · Tests 70 passed
(70)`, nothing to edit. The same shape of change on `main` (#26361)
needed #26406 (+37/−14 in the census and matrix) to clear 10 reds.
- **Negative control: an unclassified route.** Added a row with `family:
'zz-unclassified-probe'`. `discover()` still refuses: `UNCLASSIFIED
surface — add a ledger row (ADR-0060):
rest-family:rest-route-ledger.ts:zz-unclassified-probe`, and the #17111
families figure reds too. 11 failed / 59 passed.
- **Negative control: a row the probe cannot read.** Added a row with
`family: 'approv' + 'als'`. `authz-probe-blind-spot.test.ts` reds on
`the probe reads EVERY row`, naming the row. 12 failed / 58 passed.
- After each leg: `ablation-replace: ok restored: blob == HEAD
(b6dd227) and git diff HEAD is empty`.
</details>
## Acceptance notes
- The `rest-server.ts` registration-site blind-spot reading (70 sites,
19 reachable, 51 not) is no longer recorded anywhere live. The
route-level bound it measured is still stated in the matrix header: a
route inside an existing family mints no key. The full record stays in
history at 6746140.
- `rest-server-registrar-files.ts`'s header says each reader pins the
list's `length`. The derived check walks every module on the list
instead, so no length is pinned. That header is not edited here.
- Leg 3 also shows a pre-existing probe weakness: `family: 'approv' +
'als'` makes the ledger probe mint a phantom key `approv`, because its
pattern stops at the first quote. It is caught twice (UNCLASSIFIED, and
the new row-by-row check), so this is noted only.
- Dogfood shards run only on `main` push and schedule runs (#24073
stands), so the first CI reading of these two files is after merge.
## Verification
All readings on head `bd9b1ea5b0`, clone unshallowed, every package
under `packages/**` built (`turbo run build --concurrency=2
--filter='./packages/**'`, 75 tasks, under the verify lock).
- `node scripts/pm/dispatch-gates.mjs --commands --repo
objectstack-ai/objectstack`: **56** derived commands, every exit
captured before any pipe, **56 exit 0**. The first pass had 2 exit-3
prerequisite refusals (`check-plugin-teardown-shape --self-test` on the
shallow clone, `check:dual-build-cjs-loads` without `dist/`). Both exit
0 after unshallowing and building.
- `--ran`: `56 derived famil(ies) accounted for — 56 run, 0 NOT-MEASURED
(a DERIVED zero)`.
- The three artifact-roster families whose roster sits under `packages/`
were run too: `check:authz-resolver`, `check:error-code-casing` and
`check:filter-alias-parity`, all exit 0.
- `pnpm --filter @objectstack/dogfood typecheck`: exit 0, 0 errors.
- Not run locally: `@objectstack/rest` and `@objectstack/runtime` tests
and typecheck. Their diff is comment-only (three comment blocks). `Test
Core` runs them on this PR.
- Dogfood shards: not run whole. The title has no `!` and no
`(narrowing)` arm. The two affected files are the ones run above.
Changeset: `skip-changeset`. `@objectstack/dogfood` is private, and the
two `src/` edits in `@objectstack/rest` / `@objectstack/runtime` are
comments only.
## Human Minimum
- [x] 1. Schemas start as Zod; `packages/spec` holds no runtime logic.
(not touched)
- [x] 2. Every name I added uses the casing for its kind.
- [x] 3. No formatter ran; `pnpm lint` passes. (CI-owned)
- [x] 4. One issue, one branch off an up-to-date `main`, one pull
request.
- [x] 5. A change that publishes carries a changeset. (nothing
publishes: `skip-changeset`)
- [x] 6. `packages/spec` touched: n/a.
- [x] 7. No hand edits to `content/docs/references/`,
`packages/*/CHANGELOG.md` or `content/docs/releases/`.
- [x] 8. Title, body and comments are in English, except the 维护者速读
block.
- [x] The *Before Submitting* list in CONTRIBUTING.md is done.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
https://claude.ai/code/session_01ADHkmPfdxeQ7cdMHou5dY1
---
_Generated by [Claude
Code](https://claude.ai/code/session_01ADHkmPfdxeQ7cdMHou5dY1)_
Co-authored-by: Claude <noreply@anthropic.com>1 parent 45de8c6 commit 98c0257
7 files changed
Lines changed: 227 additions & 1870 deletions
File tree
- packages
- qa/dogfood/test
- rest/src
- runtime/src
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
24 | 24 | | |
25 | 25 | | |
26 | 26 | | |
27 | | - | |
28 | | - | |
| 27 | + | |
| 28 | + | |
29 | 29 | | |
30 | 30 | | |
31 | 31 | | |
32 | 32 | | |
33 | 33 | | |
34 | | - | |
| 34 | + | |
35 | 35 | | |
36 | | - | |
37 | | - | |
| 36 | + | |
| 37 | + | |
| 38 | + | |
| 39 | + | |
| 40 | + | |
38 | 41 | | |
39 | 42 | | |
40 | 43 | | |
| |||
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
98 | 98 | | |
99 | 99 | | |
100 | 100 | | |
101 | | - | |
| 101 | + | |
| 102 | + | |
102 | 103 | | |
103 | 104 | | |
104 | 105 | | |
| |||
144 | 145 | | |
145 | 146 | | |
146 | 147 | | |
147 | | - | |
| 148 | + | |
148 | 149 | | |
149 | 150 | | |
150 | 151 | | |
| |||
200 | 201 | | |
201 | 202 | | |
202 | 203 | | |
203 | | - | |
204 | | - | |
| 204 | + | |
| 205 | + | |
| 206 | + | |
205 | 207 | | |
206 | 208 | | |
207 | 209 | | |
| |||
337 | 339 | | |
338 | 340 | | |
339 | 341 | | |
340 | | - | |
341 | | - | |
| 342 | + | |
| 343 | + | |
342 | 344 | | |
343 | 345 | | |
344 | 346 | | |
| |||
352 | 354 | | |
353 | 355 | | |
354 | 356 | | |
355 | | - | |
| 357 | + | |
| 358 | + | |
356 | 359 | | |
357 | 360 | | |
358 | 361 | | |
| |||
715 | 718 | | |
716 | 719 | | |
717 | 720 | | |
718 | | - | |
| 721 | + | |
| 722 | + | |
719 | 723 | | |
720 | 724 | | |
721 | 725 | | |
| |||
1813 | 1817 | | |
1814 | 1818 | | |
1815 | 1819 | | |
| 1820 | + | |
| 1821 | + | |
| 1822 | + | |
| 1823 | + | |
| 1824 | + | |
| 1825 | + | |
| 1826 | + | |
| 1827 | + | |
1816 | 1828 | | |
1817 | 1829 | | |
1818 | 1830 | | |
1819 | | - | |
| 1831 | + | |
1820 | 1832 | | |
1821 | 1833 | | |
1822 | 1834 | | |
| |||
1886 | 1898 | | |
1887 | 1899 | | |
1888 | 1900 | | |
1889 | | - | |
| 1901 | + | |
1890 | 1902 | | |
1891 | 1903 | | |
1892 | 1904 | | |
1893 | 1905 | | |
1894 | | - | |
| 1906 | + | |
1895 | 1907 | | |
1896 | | - | |
1897 | | - | |
1898 | | - | |
1899 | | - | |
1900 | | - | |
1901 | | - | |
1902 | | - | |
1903 | | - | |
1904 | | - | |
| 1908 | + | |
| 1909 | + | |
1905 | 1910 | | |
1906 | 1911 | | |
1907 | 1912 | | |
| |||
1911 | 1916 | | |
1912 | 1917 | | |
1913 | 1918 | | |
1914 | | - | |
| 1919 | + | |
1915 | 1920 | | |
1916 | 1921 | | |
1917 | 1922 | | |
| |||
1928 | 1933 | | |
1929 | 1934 | | |
1930 | 1935 | | |
1931 | | - | |
1932 | | - | |
1933 | | - | |
1934 | 1936 | | |
1935 | 1937 | | |
1936 | 1938 | | |
| |||
1983 | 1985 | | |
1984 | 1986 | | |
1985 | 1987 | | |
1986 | | - | |
| 1988 | + | |
1987 | 1989 | | |
1988 | 1990 | | |
1989 | | - | |
| 1991 | + | |
1990 | 1992 | | |
1991 | | - | |
1992 | | - | |
1993 | | - | |
1994 | | - | |
| 1993 | + | |
1995 | 1994 | | |
1996 | | - | |
1997 | | - | |
1998 | | - | |
1999 | | - | |
2000 | | - | |
2001 | | - | |
2002 | | - | |
2003 | | - | |
2004 | | - | |
2005 | | - | |
2006 | | - | |
2007 | | - | |
2008 | | - | |
2009 | | - | |
2010 | | - | |
2011 | 1995 | | |
2012 | 1996 | | |
2013 | 1997 | | |
| |||
2018 | 2002 | | |
2019 | 2003 | | |
2020 | 2004 | | |
2021 | | - | |
| 2005 | + | |
2022 | 2006 | | |
2023 | | - | |
| 2007 | + | |
2024 | 2008 | | |
2025 | 2009 | | |
2026 | 2010 | | |
2027 | 2011 | | |
2028 | 2012 | | |
2029 | 2013 | | |
2030 | 2014 | | |
2031 | | - | |
2032 | | - | |
| 2015 | + | |
| 2016 | + | |
2033 | 2017 | | |
2034 | 2018 | | |
2035 | 2019 | | |
| |||
0 commit comments