identity: the "Link Social Account" action is dead on every boot — it navigates to a GET of the POST-only social sign-in route (404) and offers a fixed provider list regardless of configuration

[objectstack-fleet]

QA-source: #21845 · identity-auth.linked-accounts-social · acceptance[3]

Clause A4 (and N4) of identity-auth.linked-accounts-social (rev 2) fail in the follow-up run #21845 (subject 316be321e); an independent verifier (RUNNER rule 7) confirmed it from source and live: medium, predates 17.6.0.

Reproduction

1. Stock showcase boot; /api/v1/auth/config reports socialProviders [].
2. Sign in; Account → Linked Accounts → "Link Social Account"; choose Google; Confirm.

• Expected: on a provider-less boot the action is absent (or names the missing provider); on a configured boot it links the chosen provider to the signed-in user.
• Actual: a fixed list of 7 providers; the browser navigates to GET /api/v1/auth/sign-in/social?provider=google → 404. With a configured OIDC provider the action still cannot link (it offers only the static list, and targets the sign-in door).

Mechanism

packages/platform-objects/src/identity/sys-account.object.ts:58-84 declares link_social as a type:'url' action to the sign-in route with a static option list and no visibility gate. better-auth serves sign-in/social and link-social as POST only (route ledger auth-route-ledger.ts :159, :167); linking needs the authenticated POST /api/v1/auth/link-social, which answers a URL to navigate to.

Done when

The action POSTs the link door and then navigates to the returned URL, its options come from the configured providers, and it is hidden when none is configured; a dogfood test links through it.

---

Generated by Claude Code

[objectstack-fleet]

Path: sign-in and identity — external identity: OAuth consent and social account linking | identity-auth.linked-accounts-social | P2

Triage: first grade — bug · priority:p2 · domain:engine · area:identity · pm:queue. The action POSTs the link door and navigates to its answer; options come from configured providers, and it is hidden when there are none

Triage seat (objectstack-wide, seat post #6015) · session_01AavokzJ5DndAwitDXvKy4U · 2026-10-05T08:59Z. ⛔ Not a claim, ⛔ not a dispatch.

Triage: lands in packages/platform-objects/src/identity/sys-account.object.ts (link_social, about :58–:84) ⇒ domain:engine (the lane that owns platform-objects); rationale: the action targets the sign-in route by GET with a fixed provider list, and linking is the authenticated POST link door.

• Why p2. The action is dead on every boot. On a provider-less boot it offers 7 providers that 404, and on a configured boot it still cannot link. It predates 17.6.0.
• Direction, as the card states.
  • The action POSTs the authenticated link door and navigates to the URL it answers.
  • Its options come from the configured providers.
  • It is hidden when none is configured.
  • ⛔ No static provider list.
• Pins: the card's dogfood test (link through the action on a configured OIDC boot), and the action is absent on a provider-less boot.
• Serial: security(auth): implicit account linking on social / OIDC sign-in is broader than the platform's account-ownership rules allow — detail withheld pending maintainer #21846 (implicit-linking tightening, plugin-auth) is in the same identity area.

---

Generated by Claude Code

[objectstack-fleet]

Claim: PM loop round 32 · 2026-10-05T09:30Z
Session: session_017ErfyP2Rx7XWHJA27QjyUi
Account: os-project-manager (the seat's linked user as GET /user answers it; always the card's assignee)
Branch: claude/issue-21849-link-social-action
Worktree: objectstack-issue-21849
Domain: domain:engine
Seat: domain:engine#1
File surface (at origin/main 5b2d189e28), per triage's grade and direction 5991318271:

• packages/platform-objects/src/identity/sys-account.object.ts (link_social, about :58–:84):
  • the action POSTs the authenticated link door (POST /api/v1/auth/link-social) and navigates to the URL it answers;
  • its options come from the configured providers;
  • it is hidden when none is configured.
  • ⛔ No static provider list.
• Tests, including the card's dogfood test under packages/qa/dogfood/test/ (link through the action on a configured OIDC boot, and the action absent on a provider-less boot); .changeset/21849-*.md.
  Container & model: M, mode:subagent, model: default (dispatch-gates --tier: no path-derived mandate).
  Clause-②: no
• A declared action stops pointing at a GET of a POST-only route. No accepted input, key, export, status or error code changes. If the action schema cannot express "POST, then navigate to the answer" or config-driven options without a packages/spec/src/** edit, or without a console change in objectui, the dev stops and reports. The line and the contract-review question are then re-read.
  Thread-read: 5991318271
  Serial constraints cleared: at 2026-10-05T09:30Z:
• Of the open PRs, none touches packages/platform-objects/src/identity/ (each file list read by filename, paged).
• domain:spec's PR feat(spec): offer object.imageField in Studio's object form beside nameField #21854 (spec(liveness): object.imageField flips to live, and its describe drops "Pending renderer", at the .objectui-sha bump that carries objectui#11383 #21765) regenerates platform-objects' metadata-forms translation catalogs. If this card has to regenerate a translation catalog, it merges main after feat(spec): offer object.imageField in Studio's object form beside nameField #21854 lands.
• Triage's named sibling security(auth): implicit account linking on social / OIDC sign-in is broader than the platform's account-ownership rules allow — detail withheld pending maintainer #21846 (implicit linking, plugin-auth, in flight under its holding session) and domain:services' PR fix(plugin-auth): settle membership under the auto policy at user creation (ADR-0093 D7) #21813 (plugin-auth) hold plugin-auth. This card plans no plugin-auth edit. If it measures one is needed, it stops and reports.
• This lane's other claims, [finding] lock family, artifact layer × package axis: the _lock gate looks up the packaged artifact with no package while both reads look it up with the request's package #21803 (PR fix(metadata-protocol)!: an item's lock is the strictest among the installed packages that ship its name (#21803) #21844) and [finding] DatabaseLoader.save skips on a key-sorted checksum, so an object whose only change is a field reorder is not persisted through MetadataManager.register #21828 (PR fix(metadata): DatabaseLoader stamps and compares hashSpec(body, type), so a field-reorder-only register is persisted (#21828) #21852), are both in the merge queue, in other packages.

[objectstack-fleet]

Claim: PM loop round 1 (17.7 pre-release follow-up, dispatched on the maintainer's direct order)
Session: session_018zT8d8NpiQ1ExhuNd5TxY6
Account: hotlong (the seat's linked user as GET /user answers it; always the card's assignee)
Branch: claude/issue-21849-link-social-action
Worktree: objectstack-issue-21849
Domain: domain:engine (card label, as triage set it)
File surface: packages/platform-objects/src/identity, packages/qa/dogfood/test, .changeset/
Container & model: M, mode:subagent, model: opus (default tier; no path-derived mandate)
Clause-②: no
Thread-read: 5991785130
Serial constraints cleared: none named

Provenance: the maintainer, in Claude Code session session_018zT8d8NpiQ1ExhuNd5TxY6, 2026-10-05, verbatim: 「都开单派发」; landing per the standing order 「开发完整就进队列合并」. Dispatched one at a time within the session's load cap. Where the card withholds detail, this session holds it and the dispatch carries it privately.

---

Generated by Claude Code

[objectstack-fleet]

os-dev-report
{
"issue": 21849,
"status": "needs_decision",
"branch": "claude/issue-21849-link-social-action",
"pr": null,
"session": "session_017ErfyP2Rx7XWHJA27QjyUi (dispatching PM's session; subagent run, identity = the branch)",
"premise_still_valid": true,
"summary": "The card's premise holds and is measured on real showcase boots at 5b2d189: link_social is served as type url + a static 7-provider list + no visible gate, and its GET target answers 404 on a provider-less AND on a configured boot. The ruled direction cannot be expressed without a lane this order forbids, so I stopped before writing code (Partition 2 stop clauses). H2: the declared shape (type api, POST /api/v1/auth/link-social, onSuccess navigate to result.url) parses and the door answers the provider URL, but the console runtime opens every absolute onSuccess URL in a new tab (objectui useConsoleActionRuntime.tsx:342) instead of the in-place document navigation the spec declares for openIn self (action.zod.ts:1667-1668, :1735). That is an objectui change. H3 is falsified: ActionParamSchema is closed, with 18 keys and no options source; optionsSource, optionsFrom, optionsEndpoint and dataSource are each refused unrecognized_keys. That needs a spec edit. H4 is falsified: the console action-visibility scope is current_user, user, ctx.user, os.user, features and the record, and features is /auth/config's features object, which carries no provider information on either boot. PUBLIC_AUTH_FEATURES has no social entry, so a carrier needs a spec edit and a plugin-auth edit. The empty branch stays pushed as the claim marker. No commits, no PR, and the worktree is removed.",
"tests": "No code change, so there is no reverse verification and no gate run (dispatch-gates --commands --repo objectstack-ai/objectstack: 'this branch changes nothing against origin/main (merge base 5b2d189) - nothing to derive', exit 2). MEASUREMENTS. (1) Build under os-verify-lock: pnpm turbo run build --filter='@objectstack/verify...' --filter='@objectstack/example-showcase^...' --concurrency=2 -> 'Tasks: 60 successful, 60 total / Cached: 26 cached', VERDICT command-exit 0. (2) A throwaway dogfood file (created, run, deleted, never committed) via pnpm --filter @objectstack/dogfood exec vitest run --project isolated --maxWorkers=1 FILE -> 'Tests 2 passed (2)', VERDICT command-exit 0. Boot A, stock showcase: GET /auth/config -> socialProviders []; signed-in GET /auth/sign-in/social?provider=google -> 404; signed-in POST /auth/link-social {provider:google} -> 404 {code:PROVIDER_NOT_FOUND}; GET /meta/object/sys_account serves link_social as type url, target /api/v1/auth/sign-in/social?provider=${param.provider}..., options google/github/microsoft/apple/facebook/gitlab/discord, no visible. Boot B, GOOGLE_CLIENT_ID/GOOGLE_CLIENT_SECRET fake, through plugin-auth's OSS env fallback: /auth/config -> socialProviders [{id:google,name:Google,enabled:true,type:social}], with features keys identical to boot A; POST /auth/link-social without a session -> 401 UNAUTHORIZED; signed-in GET /auth/sign-in/social -> 404; signed-in POST /auth/link-social {provider:google, callbackURL:/_console/apps/account/sys_account} -> 200 {url:https://accounts.google.com/o/oauth2/v2/auth?...redirect_uri=.../api/v1/auth/callback/google..., redirect:true}, plus a Location header and Set-Cookie better-auth.state; signed-in POST {provider:github}, which is not configured -> 404 PROVIDER_NOT_FOUND. (3) A spec probe on the built dist (node, throwaway, deleted): ActionParamSchema.safeParse with optionsSource / optionsFrom / optionsEndpoint / dataSource -> unrecognized_keys each; the param key set is [name, field, objectOverride, label, type, required, options, placeholder, helpText, defaultValue, multiple, accept, maxSize, reference, defaultFromRow, carryOver, visible, requiresFeature]; ActionSchema accepts {type:api, target:/api/v1/auth/link-social, onSuccess:{navigate:'${result.url}'}} and parses onSuccess to {navigate:'${result.url}', openIn:'self'}. (4) Read at the objectui pin 0abd4f9f: the ActionRunner.ts:1662-1696 navigateOnSuccess calls navigationHandler(url,{external:true,newTab:false}); the console navigateHandler at useConsoleActionRuntime.tsx:341-347 calls window.open(url,'_blank','noopener,noreferrer') when external; ExpressionProvider.tsx:190 binds the scope roots; AppContent.tsx:156-162 sets features to cfg.features. NOT MEASURED: H2 in a browser through a console bundle. Reason: the dogfood harness boots no console bundle (in-process HTTP via @objectstack/verify, and packages/console has no dist or build script here), and building objectui was out of proportion once H3 and H4 had independently stopped the card.",
"mcp_calls": "0",
"api_writes": "1 - POST /repos//issues/21849/comments (this os-dev-report, via scripts/pm/post-stamped.mjs). git push of the empty branch is not a REST write. No pr_create and no label-write: there is no PR.",
"gates": "none run - the diff is empty (dispatch-gates exit 2: nothing to derive). The order's gate lead and the four symbol-anchor sweeps are owed by the PR that implements the decision.",
"line_budget": "n/a",
"files_changed": [],
"deviations": [
"H2 measured from objectui source at the .objectui-sha pin 0abd4f9f, not through a console bundle. The order's premise that the dogfood boots a console bundle is false: the dogfood harness is in-process HTTP only. The browser leg is NOT MEASURED, for the reason given in tests.",
"Writes used: git push (empty branch at 5b2d189, the claim marker) and this one comment. pr_create and label-write were not used because the stop clauses fired before any code.",
"Throwaway artefacts created and deleted inside the worktree, never committed: packages/qa/dogfood/test/zz-scratch-21849-measure.dogfood.test.ts and two node probe files in packages/platform-objects. git status --porcelain was empty before the worktree was removed.",
"objectui was partial-cloned read-only into the session scratchpad to read the console runtime at the pin, then deleted."
],
"open_questions": [
{
"question": "The ruled direction for link_social (POST the authenticated link door, then navigate to the URL it answers; options from the configured providers; hidden when none is configured; no static list) cannot be expressed in today's action contract and console runtime. It needs a spec edit (a dynamic param-options source and a visibility carrier), an objectui change (in-place navigation to an absolute onSuccess URL) and, for the carrier, a plugin-auth edit, and this order forbids all three. Which route?",
"options": [
"A - Widen the contract across four lanes. spec: a declared options source on ActionParamSchema (mirroring app.zod.ts's optionsSource) plus a crud-surface PUBLIC_AUTH_FEATURES flag, e.g. socialLinking. plugin-auth: serve that flag from getPublicConfig. objectui: ActionParamDialog fetches the declared options, and navigateHandler honours onSuccess openIn self for absolute URLs with a document navigation. platform-objects: type api, target /api/v1/auth/link-social, bodyExtra callbackURL, onSuccess navigate ${result.url}, requiresFeature. COST: domain:spec, plugin-auth (held by #21846 / PR #21813, so it waits behind them), an objectui pin bump, and translation churn (the seven option leaves in four objects catalogs, three source-hash files and three echo-decision tests). Axes - business need: delivers the ruled capability, but measured pull is zero, because the action has never worked on any boot and nothing else declares dynamic action-param options. Long-term: a generic vocabulary for one consumer, and a second carrier of provider lists beside /auth/config. AI-proof: declared and enforced, but a larger surface to author. Startup focus: the widest expansion.",
"B - Producer-side derivation in plugin-auth with no spec edit. plugin-auth registers sys_account (authIdentityObjects, plugin-auth/src/manifest.ts:52), so it would stamp link_social's options and visible:false from its resolved provider set, and re-stamp when the runtime-mutable Google settings change (auth-plugin.ts:1746-1773). It still needs the objectui navigation fix from A. COST: the held plugin-auth lane; option labels move out of the translation catalogs. Axes - business need: as A. Long-term: metadata rewritten from runtime config at registration is the default magic that Route-and-surface rule 2 warns against. AI-proof: the object file shows a static action that the runtime silently replaces. Startup focus: medium.",
"C - Retire link_social from sys_account now (ADR-0049 enforce-or-remove; Prime Directive #10, trim what is not enforced), keep unlink_account, and leave self-service linking to a native console surface. That surface would be objectui Account, Linked Accounts: read /auth/config socialProviders as the login form already does for sign-in, call the SDK's auth.accounts.linkSocial and then window.location.assign(url). File it as an objectui card only when a real linking need is named. COST: a one-file deletion plus regenerating the four objects catalogs, the source hashes and the echo-decision lines, a comment in account.app.ts, and the H6 doc and QA rows. No spec or plugin-auth edit. It reverses triage's direction, so it needs the maintainer's word. Axes - business need: withdraws an affordance that is dead on every boot, with the same zero pull. Long-term: one carrier of provider lists, the /auth/config read by the auth UI, and no new vocabulary. AI-proof: removes the copyable dead GET shape at its source. Startup focus: the tightest, and the retirement is immediate.",
"D - Do C now in this card, and open the A vocabulary question (dynamic action-param options) only when a second consumer is measured."
],
"recommendation": "C, D as the same thing sequenced. Business need: measured pull is zero. Long-term: provider lists already have one consumer path, the native auth UI reading /auth/config, and a metadata path would be a second carrier. AI-proof: deleting the action removes the dead shape that docs and the spec docblock copy from it. Startup focus: A spreads one bug fix across four lanes and a pin bump for one consumer. If the maintainer keeps the ruled capability, A beats B: it is declared and enforced, while B is undeclared runtime rewriting. Under either A or B the objectui in-place navigation fix is a prerequisite."
}
],
"out_of_scope_findings": [
"carrier: the PR that implements #21849's decision (same family; H6) - content/docs/protocol/objectui/actions.mdx:96-100 teaches link_social as type url GET /api/v1/auth/sign-in/social. The route is POST-only (auth-route-ledger.ts:167), and GET was measured at 404 on both boots. Noted, not filed.",
"carrier: domain:spec, inside the PR that implements #21849's decision (same family; H6) - the TSDoc on ActionSchema.target (packages/spec/src/ui/action.zod.ts:1035-1036) cites the same dead GET target as the canonical redirect-style example. The incidental fixture at packages/spec/src/ui/inline-action.test.ts:307 uses that target string only as a parse-acceptance input. Noted, not filed.",
"carrier: the PR that implements #21849's decision - docs/qa/platform-checklist/areas/identity-auth.json:1119 and :1165 encode the dead GET shape as the expected step of identity-auth.linked-accounts-social. Noted, not filed.",
"carrier: objectui, in whichever change adopts route A or B - the console navigateHandler (useConsoleActionRuntime.tsx:342 at the pin) opens every absolute URL in a new tab, ignoring a declared onSuccess openIn self, against the spec docblock (action.zod.ts:1667-1668). There are zero producers today: no onSuccess.navigate with an absolute URL in this repo at 5b2d189. Separately, ActionRunner.ts comments at about :1964-1980 and :2354 name GET /sign-in/social as the canonical full-page redirect dance, but better-auth 1.7.3 serves it POST-only. Noted, not filed.",
"carrier: the PR that implements #21849's decision - H5 fixture note. A configured boot needs only GOOGLE_CLIENT_ID and GOOGLE_CLIENT_SECRET (fake values) through plugin-auth's OSS env fallback (auth-plugin.ts:368-387). That is enough to pin the POST door answering on a configured boot. No RP-side mock IdP exists for a full link round-trip: dogfood's only OIDC fixture, oidc-authorization-code-flow.dogfood.test.ts, is the showcase acting as IdP. A minimal round-trip fixture needs an oidcProviders entry whose discovery, token and userinfo endpoints answer in-process, followed by the callback carrying the better-auth.state cookie. Noted, not filed."
]
}

---

Generated by Claude Code

[objectstack-fleet]

Retriage requested: pm:retriage · the ruled direction cannot be expressed in today's contract

domain:engine#1 · session_017ErfyP2Rx7XWHJA27QjyUi · 2026-10-05T09:52Z. The dev's report is 5992085207 (needs_decision, no PR, no code). ⛔ The claim (5991785130) stands. The card keeps pm:dispatched, and the dev's empty branch stays as the claim marker.

What the dev measured, on real showcase boots at 5b2d189e28. The premise holds.

• The door answers. On a configured boot (fake GOOGLE_CLIENT_ID / GOOGLE_CLIENT_SECRET), a signed-in POST /api/v1/auth/link-social returns 200 {url, redirect:true}. The GET the action uses returns 404 on both boots.
• H2, navigation (an objectui change). The declared shape parses: type: 'api', onSuccess.navigate: '${result.url}', defaulting to openIn: 'self'. But the console runtime opens every absolute onSuccess URL in a new tab (objectui useConsoleActionRuntime.tsx:342 at the pin). That ignores the declared openIn: 'self' (action.zod.ts:1667–:1668).
• H3, options (a spec change). Falsified. ActionParamSchema is closed: 18 keys, and no options source. optionsSource, optionsFrom, optionsEndpoint and dataSource are each refused as unrecognized_keys.
• H4, visibility (a spec and plugin-auth change). Falsified. An action's visibility scope reaches features, which is /auth/config's features. It carries no provider information on either boot, so a carrier needs a spec edit and a plugin-auth edit.

The order forbade all three edits, so the dev stopped before writing code.

The fork (the dev's options; its four-axis analysis is in 5992085207):

• A. Widen the contract across four lanes. The spec gets an action-param options source and an auth-feature flag. plugin-auth serves the flag. objectui fetches the options and navigates in place. platform-objects declares the action. This is plugin-auth-serial behind security(auth): implicit account linking on social / OIDC sign-in is broader than the platform's account-ownership rules allow — detail withheld pending maintainer #21846 and PR fix(plugin-auth): settle membership under the auto policy at user creation (ADR-0093 D7) #21813, and it needs an objectui pin bump.
• B. plugin-auth (which registers sys_account) stamps the options and the visibility from its provider set at registration. It still needs the objectui fix, and the action is rewritten at runtime without being declared.
• C. Retire link_social from sys_account (ADR-0049 enforce-or-remove), and keep unlink_account. Self-service linking moves to a native console surface reading /auth/config, filed as an objectui card when a linking need is named. This reverses the ruled direction.
• D. C now; A's vocabulary only when a second consumer is measured.

Seat's read:

• The measurements hold.
• A is four lanes plus a pin bump for one consumer. It also builds a second carrier of provider lists beside /auth/config.
• B is undeclared runtime rewriting.
• C or D is the tightest, but it withdraws the capability triage ruled in. That is triage's call, or the maintainer's: the seat does not take it.
• Whichever route keeps the capability (A or B) needs the objectui in-place navigation fix first.

Asked of triage:

1. Pick the route.
2. If the route keeps the capability, say which lane carries each part and whether the card splits.
3. If it is C, say whether the maintainer's word is needed.

Out-of-scope, carried by whichever PR implements the ruling (the dev's H6), not filed:

• content/docs/protocol/objectui/actions.mdx:96–:100 and action.zod.ts:1035–:1036's TSDoc teach the dead GET target.
• docs/qa/platform-checklist/areas/identity-auth.json:1119 and :1165 encode it as the expected step.

---

Generated by Claude Code