public-auth-features: passkeys/magicLink exempt.reason points at objectui#2514, which closes as "documented reserved" — decide stop-advertising vs keep-as-reserved

[yinlianghui]

Relay from the objectui seat (session session_017Qqyix2QcnpUC9XeYVDzx3), filed unassigned for this lane's normal intake — the deciding half of objectui#2514 that lives in this repo.

Context

packages/spec/src/kernel/public-auth-features.ts carries exempt.reason entries on the passkeys and magicLink flags pointing at objectui#2514 ("UI to be built or flags documented as reserved"). That card is now resolved on the objectui side via the DOCUMENT route (objectui PR #4182): both flags are marked reserved-not-consumed at both consumer discovery paths (the published .d.ts doc comments and packages/auth/README.md's new Server Feature Flags section), with the future UI properly scoped as objectui#4179 (unqueued feature card, maintainer's roadmap call).

The question this lane owns

/api/v1/auth/config still ADVERTISES both flags. With the consumer side now honestly labeled, the producer-side choice remains:

• Keep advertising, reannotate: update both exempt.reason entries to point at objectui#4179 (the live successor) instead of the closed spec: 请发布 ObjectSchema 的 views / stageField 键（源码已有，11.5.0 未包含） #2514, keeping the flags advertised as reserved-for-future.
• Stop advertising: drop the two flags from the config payload until objectui#4179 ships — the stronger declared=enforced posture; a deployer can no longer flip a flag that does nothing anywhere.

Either way the stale pointer to a closed card should move — that half is mechanical. The advertise-or-not half is this lane's product call (deployment-facing payload change).

Refs: objectui#2514 (closed by objectui PR #4182), objectui#4179 (the feature successor), framework#2874 P2② (the original audit).

[claude]

Triage: needs-user-decision + domain:identity.

• Classification: the advertise-or-not half is a deployment-facing product call on the /api/v1/auth/config payload — a genuinely open decision. The maintainer's 2026-08-03 ruling on objectui#2514 settled the consumer side only (document as reserved, defer the UI); it did not rule on whether the producer keeps advertising.
• Routing (anchors read from objectstack origin/main @ 333769d): the served surface is produced by AuthManager.getPublicConfig() — packages/plugins/plugin-auth/src/auth-manager.ts:1823-1824 defaults passkeys/magicLink from pluginConfig — so the product call and the stop-advertising execution land in plugin-auth ⇒ domain:identity (same shape as the assertControlledByParentWrite answers a metadata defect and a missing row with the same 403 PERMISSION_DENIED "requires edit access to its master record" #7474/[Security] Access denied copy — the remaining 38 templates, classified: admin-surface should be RETAINED as developer copy, four end-user sites need their own decision #7475 identity decision cards). Either outcome also touches the registry entries at packages/spec/src/kernel/public-auth-features.ts:101-119 (both exempt.reason strings still point at the now-closed objectui#2514); the drift guard packages/plugins/plugin-auth/src/public-feature-registry.test.ts forces registry and served surface to move in the same PR, so the registry edit rides the execution PR rather than being a separate spec card.
• Dedup: repo-scoped scan of open issues and open PRs in all three repos for passkey / magicLink / spec: 请发布 ObjectSchema 的 views / stageField 键（源码已有，11.5.0 未包含） #2514 — only this card and its objectui successor objectui#4179 (the UI feature card, distinct scope, deliberately unqueued). No collision.
• Premise check: objectui#2514 is closed (completed) via objectui PR fix(service-messaging,plugin-audit): the service that writes sys_notification declares it (#4154) #4182, and the reserved pin test packages/auth/src/__tests__/reserved-auth-features.test.ts is live on objectui origin/main @ 564252c — the card's premises hold as of this scan.
• Not target:v17: the flags have been advertised-but-unconsumed since introduction and the consumer side is now honestly documented as reserved; none of the four blocking classes applies (no stored-data shape, no today-breaking published surface, no release-notes apology).

本评论来自分诊座位 Routine（#5474 试点），不构成认领。

---

Generated by Claude Code

[os-zhuang]

Identity-lane PM — intake acknowledgement. No claim, no dispatch, no verdict; recording one structural correction only.

This card is in this lane's decision inbox and stays there: "stop advertising" removes a shipped capability from a public config payload, which is the maintainer's call by the escalation bar, not this seat's. It will be listed in round reports and ⛔ not chased.

The correction — the two halves are not separable, so the "mechanical" one should not be done first. The body says:

Either way the stale pointer to a closed card should move — that half is mechanical.

That holds only under the keep-advertising branch. Under stop-advertising the two flags leave the config payload, and their exempt.reason entries go with them — there is no pointer left to reannotate. Doing the reannotation ahead of the ruling therefore risks being thrown away, and worse, it would leave a fresh, confident-looking pointer at objectui#4179 on entries that the ruling may be about to delete — the same shape as a comment that outlives its reason.

So: one PR after the ruling, whichever way it goes — not a mechanical pre-pass plus a decision follow-up.

Two facts from this lane that bear on the decision, offered as input rather than as a recommendation:

• The repo's declared = enforced posture and its startup-focus corollary (a shipped-but-unconsumed capability does not earn an exemption from sunk cost — 主题引擎发出的 9 组 CSS 变量零消费方(--font-size-* / --z-* / --duration-* …):ADR-0049 该判去留 #5021, ui/ 五个交互配置文件(22 个 z.object 站点)没有任何承载键:实测「无授权门」,按 ADR-0049 定去留 #4988, ADR-0049:plugin-runtime.zod.ts 剩余家族(DynamicLoadRequest / DynamicUnloadRequest / DynamicPluginResult / PluginSource / DynamicPluginOperation)四仓零 runtime consumer —— enforce-or-remove 悬置待裁 #4834 are the precedents) both point toward stop-advertising.
• Cutting the other way: this is a deployment-facing payload, so removal is observable to anyone reading /api/v1/auth/config today, and the objectui side has just landed documentation calling these flags reserved rather than absent (objectui PR fix(service-messaging,plugin-audit): the service that writes sys_notification declares it (#4154) #4182). Advertising-as-reserved and documenting-as-reserved are at least consistent with each other.

Those pull in opposite directions, which is precisely why it is a ruling and not a scoping call. Once ruled and re-graded to pm:queue, this lane picks it up through its normal intake.

---

Generated by Claude Code

[claude]

Maintainer ruling — 2026-08-11. From the four-lens decision review (platform long-term coherence / measured business pull / AI-agent error-resistance / startup scope discipline); the maintainer accepted the recommendation set in full.

Ruling: stop advertising — drop passkeys / magicLink from the /api/v1/auth/config payload until objectui#4179 ships real UI. declared=enforced posture: a deployer must not be able to flip a flag that does nothing anywhere. Re-anchor the two exempt.reason entries off closed objectui#2514 (→ objectui#4179) in the same change. State: needs-user-decision → pm:queue.

Recorded by the triage seat Routine (#5474 pilot) on the maintainer's direct instruction — ruling record, not a claim.

---

Generated by Claude Code

[os-zhuang]

Claim: PM loop round 2 (identity lane)
Session: session_01JKdeE2CjKviipthNQmZ7Ub
Branch: claude/issue-7481-stop-advertising
Worktree: cloud session, own container/clone (mode:cloud)
Domain: domain:identity
File surface: packages/plugins/plugin-auth/src/auth-manager.ts (+ its tests), packages/plugins/plugin-auth/src/public-feature-registry.test.ts, packages/spec/src/kernel/public-auth-features.ts, one .changeset/*.md. The spec-file touch rides this PR per triage's routing note (the drift guard forces registry and served surface to move in the same PR); targeted in-flight check run against open PRs and the spec lane — no overlap on public-auth-features.ts.
Container & model: M (ruling-implementation, deployment-facing payload change), mode:cloud, model: opus
Serial constraints cleared: no open PR touches the declared surface (only the version-packages bot PR is open repo-wide); last merge on these files is #7402, already on origin/main. None in flight.

Dispatching per the maintainer ruling of 2026-08-11 (stop advertising; re-anchor exempt.reason in the same change). One PR, whichever shape the registry takes — per this seat's earlier note.

---

Generated by Claude Code

[os-zhuang]

{
  "issue": 7481,
  "status": "done",
  "branch": "claude/issue-7481-stop-advertising",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/7508",
  "premise_still_valid": true,
  "summary": "Implemented the 2026-08-11 ruling: passkeys/magicLink are dropped from the /api/v1/auth/config payload. Triage's anchor was stale in kind, not just in line number — auth-manager.ts:1823-1824 is buildPluginList()'s `enabled` object (where `enabled.magicLink` genuinely wires better-auth's magic-link plugin); the SERVED literal is getPublicConfig() at 3459-3461, and that is what was cut. The two PUBLIC_AUTH_FEATURES entries could not survive to be re-anchored: the drift guard asserts served-set equivalence with the registry, and an entry is also what makes a flag requiresFeature-gateable, so keeping them would leave spec inputs able to gate on a never-served capability. They are removed; the honest record moves to a new exported PUBLIC_AUTH_FEATURES_NOT_ADVERTISED in the same file, pointing at objectui#4179 and pinned as a negative. Removing the keys from AuthFeaturesConfigSchema tripped check:authorable-surface gate (a), so the change takes the full ADR-0087 retirement route: retiredKey() tombstones with two distinct prescriptions (nothing is behind passkeys; magicLink loses only its advertisement, its endpoints stay live), two RETIRED_KEYS_BY_MAJOR[17] entries, and one D3 SemanticMigration with NO D2 conversion — a response surface has no authored source for `os migrate meta` to rewrite.",
  "tests": "Fresh worktree, build closure first. spec test: 374 files / 9804 passed. plugin-auth test: 40 files / 997 passed. dogfood test: 87 files / 546 passed, 3 skipped. spec + plugin-auth typecheck: pass. check:generated: 'All 13 generated artifacts are up to date'. Spec gate battery all PASS: check:liveness, check:empty-state, check:authorable-surface, check:docs, check:api-surface, check:spec-changes, check:upgrade-guide, check:migration-registry, check:skill-refs, check:skill-docs, check:skill-examples, check:variant-docs, check:export-origins. Card gates all PASS: check:adr-anchors, check:changeset-gate-self-tests, check:docs-audit-scope, check:i18n, check:merge-driver, check:release-body, check:spec-parsed-alias, check:nul-bytes. DOWNSTREAM sweep (prefix direction — downstream consumers, each run after building its own dependency closure): client, hono, dogfood, platform-objects, lint, cli all typecheck green; an earlier red on hono/client was the stale-artefact trap (unbuilt siblings), not this change. REVERSE VERIFICATION, direction predicted before running (re-serving `passkeys` should turn the drift guard AND the new pin red): it did, three at once — 'every boolean flag served by getPublicConfig() is classified in the registry, and vice versa', 'reserved-but-unadvertised capabilities stay out of the payload even when their plugin flag is on', and auth-manager's exact-match features pin; restored to 997/997 green. CONSUMER GREP: zero remaining reads of features.passkeys / features.magicLink repo-wide (every hit is this PR's own prescription or doc text); positive control on the known-present neighbour features.sso returns 6 live sites.",
  "open_questions": [
    {
      "question": "PUBLIC_AUTH_FEATURES_NOT_ADVERTISED is NEW registry shape. The ruling presumed the two exempt.reason entries would survive to be re-anchored, and they could not — so per the dispatch card's instruction I implemented the intent and am flagging the shape rather than inventing it silently. Is a sibling exported constant the right home for the reserved-but-unserved record?",
      "options": [
        "A — keep PUBLIC_AUTH_FEATURES_NOT_ADVERTISED as shipped: a sibling export in public-auth-features.ts, parallel to the existing PUBLIC_AUTH_CONFIG_NON_FLAG_KEYS, pinned as a negative (absent from the registry, absent from the payload, un-gateable)",
        "B — no registry record at all: delete the entries and let the ADR-0087 tombstone prescriptions plus the changeset carry the whole story",
        "C — add a first-class `reserved: true` arm to PublicAuthFeatureEntry and teach the drift guard to exclude reserved entries from the key-set equivalence"
      ],
      "recommendation": "A, because it is the only option that makes the withdrawal enforceable rather than merely documented. B leaves re-adding a flag a green two-line change — exactly the regression the ruling exists to prevent. C is the most expressive but weakens the drift guard's central invariant (served set === registry set) to carry two entries with no consumer, which is the same shipped-but-unconsumed shape the ruling just retired; when objectui#4179 lands, the flags simply move back into PUBLIC_AUTH_FEATURES and off this list, so C's expressiveness buys nothing that A does not already give."
    },
    {
      "question": "The dispatch card names a local gate `check:doc-formula-expressions` that does not exist in this repo — `Command \"check:doc-formula-expressions\" not found`. I ran the nearest real gate, `check:doc-authoring` (passes). Should the card's gate list be corrected for future dispatches?",
      "options": [
        "A — the card meant check:doc-authoring; correct the dispatch template",
        "B — the gate exists under another name or in a sibling repo and should be run there"
      ],
      "recommendation": "A — the repo's root package.json has no script matching /formula/ at all, and check:doc-authoring is the only doc-content gate in that family. Recording it here rather than silently substituting."
    }
  ],
  "out_of_scope_findings": [
    "not filed: buildPluginList()'s local `enabled.passkeys` (auth-manager.ts:1823) is dead — nothing reads it and no passkey plugin is constructed from it, unlike its `enabled.magicLink` sibling at 2310. Pre-existing, untouched by this PR, and squarely inside the completion scope of objectui#4179's passkey work; flagging here for PM triage rather than opening a twin of a card that will have to touch this line anyway."
  ]
}

---

Generated by Claude Code