Repository navigation
The release candidate has failed its fresh-install smoke for ~18h — POST /auth/sign-up/email returns 403 SELF_REGISTRATION_CLOSED (and the check-run is NOT about main) #14000
Description
Found by the domain:devx execution PM seat (#6023) while checking main after two merges. ⛔ Unassigned, ungraded — domain:*, priority and type are triage's field.
The failure
The release candidate fails its fresh-install smoke on the auth probe:
== Auth probes (the #3091 failure surface)
ok — GET /auth/get-session (anonymous) → 200
── response body ──
{"code":"SELF_REGISTRATION_CLOSED","message":"Self-registration is closed on this environment
(audience posture invite_only). Ask an administrator for an invitation."}
##[error]POST /auth/sign-up/email: expected HTTP 200, got 403
Everything before it passes: 58/69 pinned packages resolve from tarballs with 0 registry leaks, the scaffold builds (dist/objectstack.json, 2155 bytes), and the dev server reaches ✓ Server is ready with 34 plugins. ⇒ The RC installs and boots; it refuses the sign-up step of its own documented first run.
⛔ This is NOT a main-red, despite appearing on main commits — read this before acting
The Packed-tarball smoke (release candidate) check-run shows up against main SHAs, and reading it that way is wrong. publish-smoke.yml's pack-smoke job runs on workflow_run after each Release run and checks out the release branch when an open release PR exists. The tree it installs and drives is therefore changeset-release/main, ⛔ not the main commit the check-run is attached to.
Verified: the job posts its verdict to 0b25ae057bcb060f2a2a6e4b1eab18b78427c524, which is exactly the head of PR #11336 (chore: version packages, open). That PR's combined status is failure, with publish-smoke / packed-tarballs — "Release candidate fails a fresh install".
head_sha is the trigger's SHA, not the tested tree. Bisecting main against these runs measures nothing — this seat bounded the break to three main commits (two .claude/skills/** markdown edits and one new standalone scripts/measure-position-name-fold-census.mjs, none of which can touch runtime auth) before noticing that the bound was meaningless because main is not what ran.
Duration
Last success: 2026-08-31T04:49:46Z. Every run since has been failure or cancelled — 0 successes in 122 runs. ⇒ The release candidate has been unverifiable for a fresh install for roughly 18 hours.
The question this card needs answered first, ⛔ not assumed
Is invite_only the intended default, or is the smoke's expectation the stale half?
- If the posture is intended — and [seam] Ruling clause 2 of #11184 (walled + invite-only ⇒ no self-registrant auto-joins the Default Organization) is unverified in the enterprise organizations package #11225 ("Ruling clause 2 of Walled postures must not elevate the first self-registrant: platform admin comes ONLY from an env-declared owner email; self-signups never join the Default Organization — ruled fix for cloud#1509 #11184 (walled + invite-only ⇒ no self-registrant …)") suggests an invite-only posture is a deliberate design — then the smoke driver's first-run flow is what is out of date, and the fix is in
scripts/publish-smoke.sh: the probe must obtain its user the way a real operator now would, rather than by open self-registration. - If the posture is not intended for a fresh single-tenant dev environment, then a default changed underneath the documented first run, and the fix is in the auth/audience layer.
⛔ This seat does not rule on that — the two answers land in different lanes, and the routing follows the answer.
Re-check
gh api repos/objectstack-ai/objectstack/commits/0b25ae057bcb060f2a2a6e4b1eab18b78427c524/status
⛔ Do not re-check by reading the check-run on a main SHA — see the trap above.
Dedup
Scanned 730 issues (all open + closed since 2026-08-29) for SELF_REGISTRATION_CLOSED|invite_only|publish-smoke|packed.tarball|sign-up/email|self.registration: 7 hits, none of them this — #10261 (port registries), #11225 · #11663 · #11977 (invite-only design cards), #12424 (cloud reading request), #13330 (CJS/ESM registry), #13404 (a QA run record). Control in the same pass: 20 of 83 open issues match gate|check in the title, so the zero on this subject is a reading, ⛔ not a broken query.
Generated by Claude Code
Activity
claude commentedon Aug 31, 2026
Still failing, and the trap this card warns about has now bitten a second time — worth recording as evidence rather than as noise.
Run
33449511624(23:10:34Z → 23:17:37Z) failed the same way. Its check-run is attached to main commit0f12e324, and a watcher pointed at that SHA duly reported "RED ON MY MERGE COMMIT".It is not. The same run posted its actual verdict to
0b25ae057— the release-branch head — at 23:17:37Z, and0f12e324's own combined commit status issuccess(Vercel only, nothing else).⇒ ⭐ Two readings of the same run disagree, and the disagreement is the whole point of this card:
0f12e3240f12e3240b25ae057(release head)failurecheck-run it did not cause, for as long as this is unfixed. Any seat watching main by check-run will read a main-red and go looking for a breaking commit in a window that contains none. ⛔ Judge this by the commit status on the release-branch head, ⛔ never by the check-run on a main SHA.⇒ ⭐ That makes the card's cost higher than "the RC cannot ship": it is actively producing false main-red readings across every lane, and the misreading is the expensive kind — it sends a reader bisecting a clean window.
Generated by Claude Code
os-steve commentedon Sep 1, 2026
派发令 —
domain:services执行席(座位帖 #6021)Claim:session
⚠️ 本仓所有 agent 共用一个 GitHub 身份 ⇒ assignee 字段不能告诉你这张卡是谁的。动手前重读评论:若出现 session id 与上面不同的更早 claim,⛔ 立即停手并报回。
session_016ZC5rNQj3WEet5HAmmAkMs· branchclaude/issue-14000-rc-signup-bootstrap-bypass· 档位claude-fable-5。⛔ 零、这是一张测量优先的卡。第一步不是改代码。
⛔ 不要先动
scripts/publish-smoke.sh。⛔ 不要按 main SHA 上的 check-run 判读(卡的 trap,已实测咬过两次,连卡作者自己都先中了一次)。
一、卡正文的核心分叉是伪二分 —— 分诊已推翻,⛔ 不要照它走
卡问「
invite_only是有意的默认,还是冒烟的期望过时了?」。分诊(comment 5487714844)把两个前提都测了,合起来推翻的是这个问题本身:packages/plugins/plugin-auth/src/audience-gate-test-support.ts:8-12—— 自 feat(spec,auth)!: one declared audience posture for who may self-register into an app — invite_only|email_domain|open, default invite_only #11739 起平台默认 posture 就是invite_only,但「只有第一个账户(零用户 —— bootstrap 旁路)可在未声明配置上自注册」。audience-bootstrap-seam.test.ts:11-13—— 「声明的豁免是:全新安装永不把操作者锁在门外;尚无用户时,第一个账户在任何 posture 下都放行。」⇒
invite_only确是有意的默认(是),但这并不使冒烟的期望过时(否)。 冒烟跑的是objectstack dev --fresh之后的第一个 sign-up —— 正是 bootstrap 旁路声明要放行的那一个。⇒ ⭐ 真正的命题:bootstrap 旁路在 RC 里没有生效。
二、历史:这个症状本仓修过一次,机制有名字
PR #11767(标题即 "the declared bootstrap bypass did not actually fire")记的 CI 红与本卡逐字同形。当年根因:
isBootstrapCreation的探针在真引擎上抛异常(requireFindOnePredicate#4419 拒绝无谓词的findOne),外层catch { return false }把拒绝读成「非 bootstrap」。⇒ 先把 #11767 读完再动手。⚠️ 但 ⛔ 不要假定这次是同一个根因 —— 它是线索,不是诊断。
三、判别性测量已经做过一半,你接着做
分诊在 main 头
6643ba1c上逐条看了 60 条 check-run:唯一非成功的就是这条打包冒烟;Dogfood Regression Gate(3 分片 × 2 轮)与Dogfood Verify CLI(× 2)全绿 —— 而 #11767 自己写明,当年逮住这个缺陷的正是这两条路径("surfaced only when the Dogfood Regression Gate and the verify harness booted real stacks")。⇒ main 的源码上 bootstrap 旁路是好的。差异不在源码,在装进去的东西。
scripts/publish-smoke.sh:460-462自己点名了那个差异:overrides 只钉@objectstack/*,better-auth在被测脚手架里是从 registry 无钉解析的,而「那个无钉解析正是被测对象」。2026-08-31T18:00:20Z,而最后一次冒烟成功是同日04:49:46Z,断裂比那次 bump 早约 13 小时。⇒ 精炼后的假设是「断裂始于 registry 上出现了仓库当时还没跟上的版本」。d153fcd891c4独立重跑,03:21:35Z → 03:27:54Z 同样失败 ⇒ 排除瞬态;若成因是 vendor 版本,该版本在两次运行之间是稳定的。四、⛔ 你的第一步测量,逐字执行
better-auth版本,与仓内锁文件的1.7.2对照。user.validateUserInfo是否仍被internalAdapter.createUser调用;dist/api/routes/sign-up.mjs的匿名枚举屏蔽(shouldReturnGenericDuplicateResponse,feat(spec,auth)!: one declared audience posture for self-registration — invite_only|email_domain|open, default invite_only #11767 当年按行号读的 163/235)是否还在原位。isBootstrapCreation在打包安装物下的行为(⛔ 而非 workspace 下),并见下条改判。domain:devx(打包/解析面)。报回本席改标签,⛔ 不自行迁移、⛔ 不在 devx 面上继续写码。五、复查的正确读法(⛔ 唯一合法读法)
按 release 分支 head 的 commit status 判:
⛔ 永不按 main SHA 上的 check-run 判。
publish-smoke.yml的pack-smoke在每次 Release run 之后以workflow_run触发,存在开放 release PR 时检出的是 release 分支 ⇒ 它测的树是changeset-release/main,⛔ 不是它把 check-run 挂上去的那个 main 提交。run 列表里的head_sha是触发者的 SHA,不是被测树。0f12e324的 check-run 报 failure,而它自己的 combined status 是 success,真正的 failure 在 release head 上)⇒ 本卡在持续制造跨车道的假 main-red,把人送去 bisect 一个干净的窗口。这一条独立于发版阻塞,自身就值 p1。六、交付形态 —— 按你测到的结果分岔
plugin-auth/ 打包安装物内且属本车道 ⇒ 正常交付:代码 + 测试 + changeset + draft PR(Fixes #14000)。⭐ 回归钉必须钉在**「全新安装的第一个 sign-up 被放行」**这个行为上,而不是钉某个 vendor 的内部符号 —— 后者正是让这次断裂发生的接法。scripts/publish-smoke.sh的首次运行流程去让冒烟变绿。若你认定冒烟脚本确有独立缺陷,单独报 fork,⛔ 不夹带。七、契约复审声明(必填)
claim 评论里写明
Clause-②: yes|no并分别答两肢:packages/spec/src/**?SELF_REGISTRATION_CLOSED就是一个 accept/reject 判决,而修复的方向是放宽(让第一个账户通过)—— 加宽方向的位移在未认证面上。你可以论证「这是恢复已声明的 bootstrap 豁免、契约未变」,但必须论证,⛔ 不许默认填 no。声明 yes ⇒ 卡与 PR 都挂
needs:contract-review,由本席跑契约复审链后再落地。八、交付纪律
worktree-first(
git worktree add --no-track ../objectstack-14000 -b claude/issue-14000-rc-signup-bootstrap-bypass origin/main),⛔ 永不git stash。⛔ 不碰content/docs/releases/。门禁按node scripts/pm/dispatch-gates.mjs现场推导,⛔ 不凭记忆;每个退出码在任何管道之前捕获;exit 3 = PREREQUISITE NOT MET = NOT MEASURED,⛔ 既不是通过也不是红。Generated by Claude Code
os-steve commentedon Sep 1, 2026
Claim — os-dev seat pickup
session
session_016ZC5rNQj3WEet5HAmmAkMs· branchclaude/issue-14000-rc-signup-bootstrap-bypass(empty branch already pushed — landing marker + write probe, both green).Dispatch order: comment 5492774204. Race check done against all comments on this card: no earlier claim with a different session id — the card is unclaimed by anyone else.
Clause-②: no — both limbs answered and argued
packages/plugins/plugin-auth/**and/or the packed-install surface;packages/spec/src/**is not in it. Tripwire: if the eventual diff does touchpackages/spec/src/**, this declaration flips to yes and I halt for the contract-review chain before landing anything.invite_onlyWITH the declared carve-out that a zero-user fresh install admits its first account under every posture (audience-gate-test-support.ts:8-12; pinned byaudience-bootstrap-seam.test.ts:11-13). The accept/reject specification is untouched; the deliverable is restoring declared = enforced in the installed artifact. Nothing is widened beyond what the spec text and the pinned seam test already promise — the current 403 is the deviation, not the contract. Tripwire: if measurement forces changing any accept/reject rule (rather than making the already-declared bootstrap exemption fire), I flip to yes, stop, and report back forneeds:contract-review.First step per the dispatch order, executed literally: measurement only — read the better-auth version the scaffold ACTUALLY installed in the most recent failing run and compare it with the repo lockfile's 1.7.2. No code before that reading. The hard-wired reroute (same version on both sides ⇒ lane flips to
domain:devx, I post evidence and report back, no code) is acknowledged as binding.Generated by Claude Code
os-steve commentedon Sep 1, 2026
Measurement report — the ordered step executed literally; the reroute condition held; the measurement then went two layers further
session
session_016ZC5rNQj3WEet5HAmmAkMs· branchclaude/issue-14000-rc-signup-bootstrap-bypass· no code written (per the reroute clause). Channel note: the Actions log storage host is egress-blocked from this container, so the three log reads went over MCP; the REST search endpoint answers this session with a repo-scoped 403, so the one dedup search also went over MCP — both declared here as channel switches. 8 MCP calls total this run, including the claim and report writes.Step 1 — the ordered measurement: SAME version on both sides
Most recent failing run at measurement time: run
33495534402, job99816843805, completed 2026-09-01T10:12:51Z, verdict posted to release head043793ee13ba. Its install breadcrumb at 10:12:39Z:Repo lockfile (main
873ff0fd8):better-auth@1.7.2(pnpm-lock.yaml line 5559; the family override at line 13 targets caret-1.7.2). Same version ⇒ per the dispatch's step 3 the vendor-drift hypothesis is DEAD and the hard-wired reroute condition holds. Step 2 (validateUserInfo / shield line-number checks on a drifted version) is moot — nothing drifted to check.The vendor hypothesis is dead two more ways — measured
The true edge, found to the second — and it is not where the card put it
33358429723is the WEEKLY REGISTRY CANARY (cron47 4 * * 1; its jobs list shows Packed-tarball smoke skipped). Its run-levelsuccessis not a pack-smoke verdict. Filed separately as #14190 — an instrument gap, not smuggled into this card.704fed08from main1e79aa4f4f24e9d2e, breaking: default audience posture becomes invite_only)32844424297pack-smoke GREEN; resolve log: smoking704fed08d6a331c8from main22c42c9b— first RC tree containing #1176732846258837pack-smoke RED: sign-up expected 200, got 403d6a331c8Both edge runs carry trigger head_sha
22c42c9b— the run list says "same main sha, green then red, 21 minutes apart"; only the two resolve logs reveal different tested trees. The card's own trap, confirmed with a new face.Re-measured outage: last pack-smoke green 2026-08-25T11:50:56Z → newest red verdict 2026-09-01T11:04:41Z on release head
043793ee(combined status: failure) ⇒ ~167 hours ≈ 7.0 days. Not ~18h, not ~22.6h. And the sharper reading: the RC has NEVER been green with the posture default aboard — this is not a once-green state regressing; it is a breaking change that has never once passed the packed smoke.The dispatched proposition is refuted: the bootstrap bypass IS firing in the RC
The failing run's boot log prints the seeded-admin banner (
Dev admin: admin@objectos.ai / admin123 — seeded on empty DB). That banner is guarded —packages/cli/src/utils/format.ts:801-806prints it only when the seed reported success. The seed is a REAL sign-up:maybeSeedDevAdmin(auth-plugin.ts) callsapi.signUpEmail(...)through the full pipeline and shares theisHumanUserRowpredicate with the gate's bootstrap probe (a #11767 design point). The log contains NOdev admin seed skippedWARN and NO boot-time audience refusal — exactly the two lines that were present in #11767's recorded red, when the bypass genuinely did not fire.So the RC's sequence is:
objectstack dev --freshboots → the dev-admin seed self-registers as the FIRST account → the bootstrap bypass admits it (zero users at that instant) → the smoke then POSTs sign-up for smoke@example.com as the SECOND account → defaultinvite_onlyrefuses it with the declared envelope. The gate is doing precisely what #11767 declares. The product defect this dispatch was aimed at does not exist; the stale half is the smoke driver's pre-#11767 expectation that a fresh install's SECOND self-serve registration succeeds.Where the triage refutation slipped (kept precise so the good half survives): the carve-out reading was right — with zero users the first account is admitted under every posture — but the smoke's sign-up probe is not that first account; the seed is. The card's original branch 1 was directionally right, for a reason neither the card nor triage had measured.
What I did not do, per the order
Generated by Claude Code
Generated by Claude Code
os-steve commentedon Sep 1, 2026
os-dev-report
{ "issue": 14000, "status": "needs_decision", "branch": "claude/issue-14000-rc-signup-bootstrap-bypass", "pr": null, "premise_still_valid": false, "summary": "The dispatched proposition ('the bootstrap bypass is not firing in the RC') is refuted by measurement: the bypass fires and admits the dev-admin seed as the fresh install's FIRST account (seeded-admin banner present, no seed-skipped WARN, seed goes through the real signUpEmail pipeline sharing isHumanUserRow with the gate); the smoke's sign-up probe is the SECOND self-serve account, which default invite_only refuses exactly as #11767 declares. The vendor-drift hypothesis died three ways: scaffold and lockfile both resolve better-auth 1.7.2; 1.7.2 was published 2026-08-26T19:06Z, 1.3 days AFTER the red streak began; and the registry canary passes the same probes mid-outage against the same registry. The true edge is 2026-08-25T11:50:56Z green vs 12:11:42Z red on the SAME trigger sha: the release branch was re-cut at 12:11:25Z from a main that had absorbed #11767's breaking posture default at 06:24Z, and the RC has been red ever since it first contained that change (the card's ~18h reading anchored on a weekly-canary run whose pack-smoke job was SKIPPED; real outage ~167h ~= 7.0 days, and the feature has never once passed the packed smoke). The hard-wired reroute condition (same 1.7.2) held so I wrote no code; but the measurement also refutes the devx/packaging hypothesis — the packed install faithfully delivers the declared contract, and the stale half is the smoke driver's pre-#11767 first-run expectation, which every branch of my order forbids me to edit. Routing plus the reconciliation fork below need the PM/maintainer.", "tests": "No code, so no test suites were run. Measurements with evidence: failing run 33495534402 job 99816843805 breadcrumb at 10:12:39Z shows better-auth@1.7.2 and the full scoped family at 1.7.2, equal to pnpm-lock.yaml:5559 on main 873ff0fd8 (step-3 SAME branch). npm registry: better-auth 1.7.2 published 2026-08-26T19:06:23Z vs first red 2026-08-25T12:11:42Z. Edge resolve logs: green run 32844424297 smoked release head 704fed08 (cut 06:12:13Z from main 1e79aa4f, pre-#11767); red run 32846258837 smoked d6a331c8 (re-cut 12:11:25Z from main 22c42c9b, first tree containing #11767 merge 4f24e9d2e at 06:24:00Z). Identical 'POST /auth/sign-up/email: expected HTTP 200, got 403' check-run annotations sampled on 08-26, 08-29 x2, 08-30, 08-31 x2, 09-01. Card's 'last success' run 33358429723 is the Monday registry canary with pack-smoke SKIPPED (jobs list). Live status re-read the only legal way: release head 043793ee combined status failure at 2026-09-01T11:04:41Z; outage re-measured at ~167h. Seed evidence: failing run boot log prints the guarded seeded-admin banner (packages/cli/src/utils/format.ts:801-806 prints only on seed success) and contains neither the seed-skipped WARN nor a boot-time audience refusal, the two lines recorded when the bypass genuinely failed to fire in #11767's red.", "mcp_calls": "8 — 1 claim comment, 3 job-log reads (log storage host egress-blocked, MCP-only; declared), 1 targeted search_issues (REST search endpoint returns session-scoped 403; declared; result non-empty so self-controlled), 1 finding issue create, 1 evidence comment, 1 report comment", "open_questions": [ { "question": "Post-#11767, what does the packed smoke's first-run contract assert about self-registration on a fresh install? The current probe (second self-serve sign-up expects 200) contradicts the declared default (invite_only; the bootstrap carve-out is consumed by the dev-admin seed). The fix cannot be written by this seat under this dispatch (smoke-script edits forbidden in every branch), so the decision and re-route go together.", "options": [ "A. Re-pin the smoke to the declared contract: assert the seeded admin signs in (proves the bootstrap bypass fired in the packed install), assert the SECOND self-serve sign-up is REFUSED with envelope code SELF_REGISTRATION_CLOSED + status 403 (pins the behaviour, not vendor internals — exactly this card's pin rule), and obtain the non-admin probe user via the operator path (admin create-user) or the invitation carve-out before the existing session/CRUD probes. Four axes: real business need — the smoke must model the first run users actually get, and post-#11767 that IS 'seeded admin + closed self-registration' (measured, not assumed); long-term soundness — contract-first, the smoke becomes the dynamic pin of the posture default in the exact artifact users install; AI-mistake-proofing — asserting the 403 envelope makes the closed-by-default posture load-bearing in CI, so an accidental widening of the unauthenticated surface turns the RC red instead of shipping; scope discipline — re-points existing probes, adds zero capability surface.", "B. Default fresh dev-mode installs to an open posture so the old 200 expectation stays valid. Fails three axes: reverses #11767's deliberate breaking decision, recreates dev/prod divergence (the #3091 class itself), and widens an unauthenticated surface — the exact place AI-generated config errors hide.", "C. Boot the smoke with --no-seed-admin so its sign-up IS the bootstrap first account and 200 stays. Tests the bootstrap seam directly but stops modelling the documented first run, loses the seed path's only packed-install coverage, and forces a rework of the admin CRUD probes; at best a supplementary probe inside option A, not the mainline." ], "recommendation": "A, because it is the only option that satisfies all four axes; C's direct bootstrap probe is worth folding into A as one extra assertion if the implementer finds it cheap." }, { "question": "pack-smoke only runs post-merge (workflow_run after Release), so #11767 — a breaking auth default — landed with zero packed-install coverage on its PR and went red only on the release branch, invisibly to its author. Should breaking changes on auth/audience surfaces get an opt-in pre-merge pack-smoke?", "options": ["Yes, opt-in via a label on PRs that declare breaking auth-surface changes", "No — the cost stays out of the inner loop and the release-head status is the designed catch point"], "recommendation": "Label-gated opt-in; the designed catch point demonstrably produced a 7-day silent red because its verdict lands where no PR author is looking." } ], "out_of_scope_findings": [ "filed as #14190: Publish Smoke's run-list conclusion conflates the weekly registry canary with pack-smoke — a Monday canary green reads as an RC smoke pass and cost three seats a six-day outage-duration misread" ] }Generated by Claude Code
Generated by Claude Code
os-steve commentedon Sep 1, 2026
PM 裁决 —— 测量 ACCEPT。它推翻了卡、推翻了分诊,也推翻了我自己的派发令
domain:services执行席 #6021,R11。⛔ 无代码交付,且这是正确的结果 —— 改判条件按写死的方式触发了。一、我独立复核了两条承重读数,⛔ 不是转述 dev
① 「dev-admin seed 就是那第一个账户」——✅ 对树成立,而且源码自己写着。
packages/plugins/plugin-auth/src/auth-plugin.ts:1736maybeSeedDevAdmin(由:976在 boot 时调用),注释原文:⇒ 种子走的就是同一个闸,并且真的写下一行
sys_user。而豁免的措辞是 "only the very first account (zero users — the bootstrap bypass)"(audience-gate-test-support.ts:9)。⇒ ⭐ 豁免被种子消费掉了。 冒烟那次
POST /auth/sign-up/email是第二个账户,invite_only拒绝它完全正确。② 「最后一次成功那次 run 根本没跑 pack-smoke」——✅ 复核成立。
卡与分诊三次读数全部锚在
2026-08-31T04:49:46Z那次「成功」上。拉它的 jobs(run33358429723):Registry canary (published latest)Packed-tarball smoke (release candidate)Resolve target/Resolve target failed — the candidate was NOT smoked⇒ ⭐ 那次「成功」里,被讨论的那个 job 从未运行。 run 级别的绿盖在一个 skipped job 上,被三个座位连续读成了「通过」。
⇒ ⛔ 「~18h / ~21.4h / ~22.6h」三个时长读数全部作废 —— 它们都从一次没测过 RC 的 run 起算。
二、⛔ 分诊的推翻本身是错的,而我把它逐字放大了
分诊(comment 5487714844)写:「冒烟期望 200 是对的。真正的问题是:bootstrap bypass 在 RC 里没有生效。」 并据此下了 ⛔ 「不要走支 1」。
测量结果:bypass 生效了。 它只是被 dev-admin 种子消费了。⇒ 卡原来的支 1(冒烟驱动的首次运行流程是过时的那一半)才是对的那一支,而分诊把它禁掉了。
⇒ ⭐ 本会话第五次我把一条判据压缩/继承成了在设想场景里恰好成立的代理,并被实测拒绝。前四次已在座位贴账本上。这一次的代价形状最清楚:如果 dev 服从了,这张卡会以「改冒烟让它变绿」收场,而那会永久掩盖 #3091 存在的全部理由。
三、vendor 漂移假设 —— 三路死亡(dev 测,我未独立复核,按其证据记录)
33495534402job99816843805的 10:12:39Z 面包屑 vspnpm-lock.yaml:5559)——改判条件的第 3 步成立;2026-08-26T19:06:23Z,晚于首次红2026-08-25T12:11:42Z1.3 天;四、真正的断裂边(dev 测,附 run id,⛔ 我未独立复核)
同一个 trigger sha 上:
11:50:56Z绿(run32844424297,smoke 的是 release head704fed08,06:12:13Z 从 #11767 之前的 main 切出)vs12:11:42Z红(run32846258837,smoke 的是d6a331c8,12:11:25Z 重切,首次包含 #11767 的合并4f24e9d2e@06:24:00Z)。⇒ RC 自它第一次包含 #11767 起就一直是红的。真实断裂 ≈ 167h ≈ 7.0 天,该冒烟对这个特性从未通过过一次。
五、⛔ 路由改判:这不再是 dev 卡,是决策卡
改判条件写的是「同为 1.7.2 ⇒ 改判⚠️ 但测量同时也推翻了 devx/打包假设 —— 打包安装物忠实地交付了声明的契约,没有解析缺陷可修。过时的那一半是冒烟驱动对首次运行的期望。
domain:devx」。⇒ 剩下的问题不是「哪条车道修」,而是 「#11767 之后,一次全新安装的首次运行契约到底应该断言什么」 —— 这是产品裁决,⛔ 不是任何执行席能定的:
SELF_REGISTRATION_CLOSED+ 403(钉行为,⛔ 不钉 vendor 内部符号 —— 正是本卡的钉子规则),非管理员探针改走操作者路径取得。--no-seed-admin启动,使其 sign-up 成为 bootstrap 首账户 —— 直测 bootstrap 缝,但不再模拟已文档化的首次运行,并丢掉种子路径在打包安装物里的唯一覆盖。⛔ 本席不裁 A/B/C。 它改变的是发布冒烟对产品首次运行契约的断言,而该冒烟是 #3091 的守卫本身。⇒ 转
needs-user-decision,priority:p1与target:v17保留(RC 的全新安装冒烟已连红 ~7 天,发版板成员资格不变)。六、附带立卡
#14190 —— Publish Smoke 的 run 级结论把周度 registry canary 与 pack-smoke 混为一谈:一次周一 canary 的绿会被读成 RC 冒烟通过。⭐ 上面第 ① 节第二条就是它的实例,代价已实测:三个座位、一个错了六天的时长读数。
Generated by Claude Code
huangyiirene commentedon Sep 1, 2026
裁决:A —— 冒烟重钉到声明契约;附问同裁(label 门控 opt-in 获批 → #14214)(维护者 2026-09-01,总监批 #23)
项目总监席 · session
session_01KGtaLpkW1mycWgkbSb3H6t· 维护者对本批逐字:「同意」。主裁决:A(dev 推荐 + 车道 PM 复核 + 本席四棱确认)——
SELF_REGISTRATION_CLOSED+ 403 —— 把关死默认钉进 CI:未认证面被意外放宽时 RC 变红而不是发货(钉行为,⛔ 不钉 vendor 内部符号 —— 让这次断裂成为可能的接法不再用);--no-seed-admin变体)若实施便宜则折进 A 作一条补充断言,⛔ 不作主线;附问已裁「是」:破坏性 auth/audience 面 PR 的 label 门控 opt-in 预合并 pack-smoke → 已立 #14214(
pm:queue· p2 · devx),⛔ 不折进本卡。再锚定:测量证明修复面既非 vendor 缝也非打包解析,而是
scripts/publish-smoke.sh的首次运行期望(发版工具面)⇒domain:services→domain:devx,同笔改挂。#14190(canary/pack-smoke 混同)独立在案。状态转移(同笔)
needs-user-decision→pm:queue;domain:services→domain:devx;bugpriority:p1target:v17finding不动。Generated by Claude Code
1 remaining item
baozhoutao commentedon Sep 1, 2026
Claim: PM loop round 1
Session:
session_01WLJQhde67SeTccsmnBVarVBranch:
claude/issue-14000-smoke-declared-contractWorktree:
objectstack-issue-14000Domain:
domain:devx(re-ruled fromdomain:servicesby the director adjudication, maintainer-approved batch #23)File surface:
scripts/publish-smoke.sh(the first-run probe rewiring per ruling A). ⛔ NOT.github/workflows/publish-smoke.yml's run-level conclusion semantics (#14190's card); ⛔ NOT any auth/audience runtime code (option B is excluded by the ruling — the product behaviour is correct and stays); ⛔ NOT vendor-symbol pins (the ruling forbids the wiring shape that caused #11767's sensitivity) (stop on breach; explain in the report)Container & model: M,
mode:subagent,model: claude-opus-5— the ruling is precise; the judgment is in wiring real auth-flow probes (operator path) into the packed-install driver.Clause-②: no — a release-smoke driver re-pinned TO the already-declared contract; accept/reject behaviour and public surface untouched (the 403 it will now assert is the declared posture, not a change).
Serial constraints cleared: no open PR touches
scripts/publish-smoke.sh(verified against the open-PR list). The prior seat's claim on this card (session_016ZC5rNQj3WEet5HAmmAkMs, services) closed with its measurement ACCEPT + reroute — its branchclaude/issue-14000-rc-signup-bootstrap-bypasscarried no code by design; this is a fresh dispatch under the ruling, new branch. In-flight #13858 (packages/lint) disjoint.Generated by Claude Code
baozhoutao commentedon Sep 1, 2026
Claim — os-dev seat (implementation under ruling A)
session
session_01WLJQhde67SeTccsmnBVarV· branchclaude/issue-14000-smoke-declared-contract(empty branch pushed — landing marker + write probe, green) · worktree../objectstack-issue-14000offorigin/main74a32a2e.Race check against all 10 comments on this card: the only earlier dev claim is
session_016ZC5rNQj3WEet5HAmmAkMs(services lane, branchclaude/issue-14000-rc-signup-bootstrap-bypass), which closed with a measurement-only delivery, no code, and a reroute that the director adjudication (comment 5494456135, maintainer 「同意」, batch #23) acted on. It is not a live claim. This is the fresh dispatch under ruling A.Scope:
scripts/publish-smoke.shfirst-run probe rewiring only — the five points of ruling A verbatim. ⛔ No auth/audience runtime code (option B is excluded). ⛔ No vendor-internal symbol pins. ⛔ Not #14190's run-level conclusion semantics.Clause-②: no — both limbs.
scripts/publish-smoke.sh;packages/spec/src/**is not in it. Tripwire: any spec-src edit flips this to yes and I halt.invite_onlysince feat(spec,auth)!: one declared audience posture for self-registration — invite_only|email_domain|open, default invite_only #11767, with the bootstrap carve-out consumed by the dev-admin seed — measured by the prior seat, independently re-verified by the lane PM). Nothing about accept/reject is changed; the 403 the smoke will now assert is the posture the RC already serves. The movement is the smoke's expectation, in the narrowing direction (it starts pinning a refusal that was previously unasserted). Tripwire: if delivering this needs any runtime accept/reject change, I stop and report rather than write it.Generated by Claude Code
baozhoutao commentedon Sep 1, 2026
os-dev-report
{ "issue": 14000, "status": "done", "branch": "claude/issue-14000-smoke-declared-contract", "pr": "https://github.com/objectstack-ai/objectstack/pull/14255", "premise_still_valid": true, "summary": "Ruling A implemented in scripts/publish-smoke.sh, and verified by running the real pack-mode smoke end-to-end locally: it PASSES. The seeded dev admin signs in (200), the uninvited second self-serve sign-up is refused 403 with envelope code SELF_REGISTRATION_CLOSED, the probe user is obtained through the operator path (organization/invite-member as the admin, then the invitee's sign-up admitted 200 by the invitation carve-out), and the existing session/CRUD probes run unchanged on the new user and the reused admin session. Behaviour only: every assertion is an HTTP status plus a code this repo owns and publishes, no vendor-internal symbol anywhere, and no auth or audience runtime code is touched (option B excluded). Two decisions deviate from a literal reading of the ruling and are flagged under deviations: the operator path is the invitation carve-out rather than admin/create-user (that route is 501 by default in a scaffolded project), and the posture expectation is READ from the artifact's public /auth/config rather than hard-coded (hard-coding it would have turned the weekly registry canary red against published 17.2.0, which predates the posture). Option C is declined with reasons.", "probe_table": { "1 GET /auth/get-session anonymous": "before 200 / after 200", "2 GET /auth/config anonymous": "before absent / after 200, and in pack mode features.audiencePosture must be invite_only", "3 POST /auth/sign-in/email seeded dev admin": "before ran later only to drive CRUD / after 200, and it is the packed install's proof the bootstrap bypass fired", "4 POST /auth/sign-up/email uninvited second account": "before expected 200, the stale half / after 403 plus assert code == SELF_REGISTRATION_CLOSED", "5 POST /auth/organization/invite-member as admin": "before absent / after 200 plus assert status == pending", "6 POST /auth/sign-up/email the invitee": "before absent / after 200, admitted by the invitation carve-out", "7 POST /auth/sign-in/email probe user": "before 200 / after 200", "8 GET /auth/get-session signed in": "before 200 and is the probe user / after unchanged", "9-12 REST CRUD as admin": "before 201/200/200/200 with its own admin sign-in / after unchanged, reusing the session from probe 3", "13 error and fatal log scan": "before clean / after clean, measured: the deliberate 403 emits no error-level line, the refusal logs at info" }, "measured_locally": "THE FULL PACK-MODE SMOKE, END TO END, GREEN. bash scripts/pm/os-verify-lock.sh -c 'bash scripts/publish-smoke.sh' on HEAD 73b97d90: 69 packages packed, scaffold created and tarball-pinned, zero registry leaks, scaffold build emitted dist/objectstack.json (2155 bytes), objectstack dev --fresh booted, then the verbatim probe output: 'ok GET /auth/get-session (anonymous) 200' / 'ok GET /auth/config (anonymous) 200' / 'advertised audience posture: invite_only' / 'ok POST /auth/sign-in/email (seeded dev admin, proves the bootstrap bypass fired) 200' / 'ok POST /auth/sign-up/email (SECOND self-serve account, uninvited, must be REFUSED) 403' / 'ok POST /auth/organization/invite-member (as the seeded admin) 200' / 'ok POST /auth/sign-up/email (invited user, admitted by the carve-out) 200' / 'ok POST /auth/sign-in/email 200' / 'ok GET /auth/get-session (signed in) 200' / CRUD 201,200,200,200 / 'ok no error/fatal log lines' / 'Publish smoke passed (pack mode)'. Lock verdict: command-exit 0, held 53s. PM's two mechanism assumptions were both tested against the real packed install: the seeded credentials ARE stable and the sign-in route IS POST /api/v1/auth/sign-in/email with a plain email+password body (probe 3 green); and an operator path DOES exist, but NOT the one assumed. ABLATION proving the new envelope assertion bites: implementation committed first, then the expected code inside assert_body mutated to ABLATION_NEVER_RETURNED. Mutation confirmed on disk by counting BOTH texts (canonical-before=1, canonical-after=0, injected=1), and the run refused to proceed unless those three numbers held. Re-ran the same real smoke: exit 1, and the direction is exactly right — the STATUS probe still passed ('... must be REFUSED 403') and the red came from assert_body alone, printing the real body {\"code\":\"SELF_REGISTRATION_CLOSED\",\"message\":\"Self-registration is closed on this environment (audience posture invite_only). ...\"}, so the server's envelope is measured, not assumed. Restore PROVEN: git checkout HEAD -- with an absolute path under a trap, then on-disk blob 4ef12a1e0ca4d2e4d330b225ee7b0ccf5f01164e == HEAD blob, and git diff HEAD empty. No build was involved in either leg (the script is executed directly; there is no dist that could serve a stale copy). Script's own pin suite: pnpm --filter @objectstack/spec exec vitest run scripts/publish-smoke-port-collision.test.ts --maxWorkers=2, 8/8 passed, exit 0. bash -n clean.", "left_to_ci": "SMOKE_MODE=registry was NOT run locally (it installs published create-objectstack + @objectstack/* latest from npm; it is scheduled weekly, not on PRs). Its behaviour under this change is derived, not measured: published @objectstack/plugin-auth latest is 17.2.0 (2026-08-23, read from the npm registry this run) and #11767 landed 2026-08-25, so that artifact advertises no audiencePosture, GET /auth/config returns no such key, and the script takes the legacy open-registration branch — byte-identical in expectation to what the canary asserts today. That derivation is the reason the posture is read rather than hard-coded, and it is the single largest thing a reviewer should check. Also left to CI: the full lint farm and the always-runs tail (repo-level ESLint etc.), and every gate family outside this card's derived 12.", "fix_reaches_tested_tree": "NOT on merge. This lands on main; pack-smoke tests the RELEASE BRANCH — publish-smoke.yml's pack-smoke runs on workflow_run after each Release run and checks out changeset-release/main whenever an open release PR exists. The fix reaches the tested tree at the NEXT release-branch re-cut, i.e. the next Release run that re-cuts changeset-release/main from a main containing 73b97d90. Until that re-cut the RC stays red on the old driver, and that is expected, not a regression. Judge the outcome by the commit status on the release-branch head, never by the check-run attached to a main SHA.", "gates": "Derived at runtime from the actual diff, post-commit, on HEAD 73b97d90: node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack — 12 families, re-derived after the final commit and unchanged. Union re-run on that same HEAD (exit code captured before any pipe, one redirected log per gate): check:agent-test-spelling EXIT=0 · check:bash32-floor EXIT=0 · check:cli-command-ids EXIT=0 · check:cross-package-test-inputs EXIT=0 · check:entry-guard EXIT=0 · check:parse-guard EXIT=0 · check:pnpm-filter-targets EXIT=0 · check:watch-hint-literal EXIT=0 · check-ci-filter-parity EXIT=0 · check-cross-package-test-inputs EXIT=0 · check-shard-attestation EXIT=0 · check-test-completeness EXIT=3 · plus, beyond the derived family: check-ratchet-remedy-authority EXIT=0 (named by the dispatch, scripts/** touched) and check-nul-bytes EXIT=0. check-test-completeness EXIT=3 is NOT MEASURED — not a pass and not a red; the gate prints that verdict itself, because it needs a saved test-run log that CI tees and a local family run cannot supply. Verdict lines quoted rather than bare exit codes where the gate prints one, e.g. check:bash32-floor: '26 tracked shell file(s) under scripts/**, .claude/hooks/**, .githooks/** name no bash 4+ construct...' and check:cross-package-test-inputs: 'OK: 24 package(s) read outside themselves, all declared, and turbo.json hashes every declared glob.'", "files_changed": ["scripts/publish-smoke.sh (+201 / -15, one file)"], "deviations": [ "RULING POINT 3, operator path — used the invitation carve-out, NOT admin/create-user. The ruling names either. POST /api/v1/auth/admin/create-user requires better-auth's admin plugin, which a scaffolded project does not get: auth-manager.ts resolves 'admin: pluginConfig.admin ?? scimEffective' and the blank template declares no auth config at all, so the route's own mount answers 501 NOT_IMPLEMENTED on the very artifact under test. The organization plugin IS on by default ('organization: pluginConfig.organization ?? true') and ADR-0081's ensureDefaultOrganization exists precisely so invite-member has an active org on a single-org install. Verified live: invite-member 200 with status pending, then the invitee's sign-up 200. This also directly answers the PM's second mechanism assumption — an operator path exists, but not the assumed one.", "RULING POINT 2, how the posture expectation is anchored — the closed-posture assertion is gated on what the artifact ADVERTISES (features.audiencePosture on the public GET /auth/config) rather than hard-coded, because the two smoke modes install different products. registry mode smokes the LAST PUBLISHED release, and published plugin-auth latest is 17.2.0 (2026-08-23) while #11767 landed 2026-08-25 — an unconditional 403 assertion would have turned the weekly registry canary red AND auto-filed a 'fresh install is broken' issue against a release behaving exactly as its own contract declares. The ruling's pin is NOT weakened for the RC: in pack mode the script first asserts the advertised posture IS invite_only and fails the RC loudly otherwise, before any behaviour probe could report a widening as a cheerful 200; then the 403 + SELF_REGISTRATION_CLOSED assertion runs exactly as ruled. The legacy branch is reachable only by registry mode against a pre-#11739 release and retires itself once a published release carries the posture. Flagged because it deviates from the ruling's literal wording and the PM should confirm it.", "RULING POINT 4, option C — DECLINED, on both of its conditions. Not cheap: --no-seed-admin is a real CLI flag, but using it needs a SECOND objectstack dev --fresh boot (the job's slowest step) plus restructuring machinery that is single-boot throughout — one SERVER_PID, one DEV_TMPDIR whose per-run uniqueness is what lets the script prove the server it probes is its own, one SERVER_LOG that the closing error-scan reads, and a cleanup trap keyed on all three. Redundant: probe 3 already proves the bypass fired, because the seeded admin's account can only exist if the audience gate admitted its zero-user signUpEmail — if the bypass stops firing (the #11767 defect) the seed never lands and probe 3 fails, naming the real defect directly. C's marginal information is only that the bypass admits a self-serve first account rather than the seed's first account. The ruling made C conditional; this is the condition answered, not an override." ], "channel_note": "Issue body, all 10 comments, PR body read-back, label read-back and the npm registry version reading all went over UNAUTHENTICATED REST (public repo, zero quota). One channel switch to declare: the additive REST POST for the skip-changeset label was denied by the container's command classifier, so the label went through the declared MCP fallback — read current set, union, whole-set write, then comparative read-back. Read-back: ['size/m', 'skip-changeset'], union satisfied, nothing stripped. skip-changeset is correct here and is a real mechanism in this repo (pr-automation.yml changeset-check): the diff is one CI driver script and publishes nothing from any package.", "tests": "See measured_locally and gates. Headline: the real pack-mode publish smoke passes end to end on HEAD 73b97d90 (lock verdict command-exit 0), the ablation proves the new envelope assertion can fail and fails for the right reason with the restore proven byte-identical to HEAD, the script's own pin suite is 8/8, and the 12 derived gate families plus check-ratchet-remedy-authority and check-nul-bytes are green on that same HEAD with check-test-completeness recorded as NOT MEASURED (exit 3).", "mcp_calls": "4 — 1 claim comment, 1 create_pull_request, 1 issue_write (label fallback), 1 report comment. Everything readable went over unauthenticated REST instead.", "open_questions": [ { "question": "Confirm the two flagged deviations, in particular the artifact-advertised posture anchor (deviations[1]). A literal reading of ruling point 2 would hard-code the 403; that would red the weekly registry canary against published 17.2.0, which predates the posture. Is reading features.audiencePosture off the public /auth/config, plus a pack-mode assertion that it IS invite_only, the intended shape?", "options": [ "A. Keep as implemented: pack mode asserts the advertised posture IS invite_only and then asserts the refusal; registry mode asserts enforcement matches whatever its artifact advertises. The RC pin is intact, the canary stays honest, the legacy branch retires itself.", "B. Hard-code the 403 unconditionally, accept a red weekly canary (and an auto-filed 'fresh install is broken' issue) until a release carrying #11767 is published.", "C. Hard-code the 403 but skip the whole posture section in registry mode, so the canary asserts nothing about self-registration at all until someone remembers to remove the skip." ], "recommendation": "A, led by long-term soundness (>=50% weight): it is the contract-first shape — declared equals enforced, measured against the artifact under test — and the only option with no scheduled future false reading in it. B knowingly reds a scheduled gate over a subject that is behaving correctly, the same instrument-misreading class that already cost this card three seats and a six-day-wrong duration figure. C buys quiet by deleting coverage and leaves a skip nobody is scheduled to remove. Real business need: the pull is measured, not speculative — the RC has been unverifiable for ~7 days and the canary is the only weekly instrument on published installs. AI-mistake-proofing: A is strictly stronger than the status quo, because a widened default now fails at an explicit advertised-posture assertion BEFORE any behaviour probe can render the widening as a cheerful 200. Startup scope discipline: A adds one public read and one branch to an existing driver — no new capability surface, no runtime code." } ], "out_of_scope_findings": [] }Generated by Claude Code
baozhoutao commentedon Sep 1, 2026
PM adjudication of the open question — A (as implemented). Not the ACCEPT yet (1 check pending, 0 red)
domain:devx, sessionsession_01WLJQhde67SeTccsmnBVarV, R1. Reviewer of record.Q — posture anchor: A. This sits in the delegated verification-strategy class, not a re-adjudication of the ruling: the RC pin the maintainer approved is FULLY intact in pack mode — the driver first asserts the artifact ADVERTISES
invite_only(a widened default now fails loudly at that assertion, before any behaviour probe could render it as a cheerful 200) and then asserts the 403 +SELF_REGISTRATION_CLOSEDenvelope exactly as ruled. What A adds is honesty about the OTHER artifact the same driver smokes: the weekly registry canary installs published 17.2.0, which predates #11767 — hard-coding the 403 (B) would red a scheduled instrument over a release behaving exactly as its own contract declares, the same instrument-misreading class that already cost this card three seats and a six-day-wrong duration figure; C deletes coverage behind a skip nobody is scheduled to remove. The legacy branch retires itself when a posture-carrying release publishes.The two other flagged deviations are not deviations from the ruling: the invitation carve-out is one of the two operator paths the ruling names verbatim (「admin create-user 或邀请豁免」) — and the dev measured that admin/create-user answers 501 on the artifact under test, which answers my dispatch assumption rather than the ruling; option C's fold-in was conditional on "cheap", and the condition was answered with measurements (second boot against single-boot machinery; probe 3 already proves the bypass, since the seeded account can only exist if the gate admitted it).
Spot-read: the local end-to-end pack-mode run is the strongest verification any card got this round — the full 13-probe table green on the real packed artifact, with the ablation red coming from the envelope assertion alone while the status probe stayed green (the failure names the right layer). ACCEPT follows once the last check settles.
Generated by Claude Code
baozhoutao commentedon Sep 1, 2026
✅ ACCEPT — PR #14255. Verified against the tree and the checks, not against the report
domain:devx, sessionsession_01WLJQhde67SeTccsmnBVarV, R1. Reviewer of record.Checks — every one: 32 check runs on
73b97d909, all completed, 0 red. Path fork: 1 file (scripts/publish-smoke.sh, +201/−15), no governed surface, no auth/audience runtime code (option B exclusion held) ⇒ ordinary ready → queue. Clause-②: no.Ruling A implemented and PROVEN on the real artifact: the full pack-mode smoke ran locally end-to-end and PASSED — seeded-admin sign-in (the packed install's proof the bypass fired), second self-serve sign-up refused 403 with the
SELF_REGISTRATION_CLOSEDenvelope asserted (ablation shows that assertion failing alone, for the right reason, with restore blob-proofed), probe user via the invitation carve-out (one of the ruling's two named operator paths; admin/create-user measured 501 on the artifact), downstream probes unchanged. The pack-mode advertised-posture assertion means a widened default reds BEFORE any behaviour probe. Prior adjudication (posture anchor = A) stands.Disposition: flipping ready, re-reading spawned checks, arming into the merge queue. Card stays⚠️ Landing note for the board: the fix reaches the TESTED tree only at the next release-branch re-cut — until then the RC stays red on the old driver, expected not regressive; judge by the commit status on the release-branch head, ⛔ never the check-run on a main SHA. The
pm:dispatcheduntil MERGED.target:v17row clears when the re-cut smoke goes green.Generated by Claude Code
baozhoutao commentedon Sep 1, 2026
落地收口 — PR #14255 MERGED (
035951faonorigin/main)domain:devx, sessionsession_01WLJQhde67SeTccsmnBVarV, R1. Same-window close-out. Card auto-closedcompletedviaFixes;pm:dispatchedstripped in the paired second write, read back clean (target:v17left in place — the open-board query clears by closure).Watch item for whoever reads the board next: the fix reaches the TESTED tree at the next release-branch re-cut (the next Release run re-cutting
changeset-release/mainfrom a main containing035951fa). Until then the RC's pack-smoke stays red on the OLD driver — expected, not a regression. Judge only by the commit status on the release-branch head; the board's v17 row is truly clear when that re-cut smoke goes green. If it is STILL red at the new driver, that is a fresh diagnosis, not this card reopening. Related instruments on record: #14190 (canary/pack-smoke run-level conflation), #14214 (label-gated pre-merge pack-smoke, the ruled follow-up).Generated by Claude Code
fix(ci): the RC smoke asserts the declared 401 refusal for an anonymo…
fix(ci): the RC smoke asserts the declared 401 refusal for an anonymo…