quest(auth): path patterns join the line so AUTH ships with pattern grants

[kixelated]

Problem

lite-06 AUTH_OK encodes grants as prefixes only. A literal grant such as b1.hang can't be encoded, so the relay leaves it out and the client sees no grant at all. The relay's origin still enforces it correctly. Found by #4181, where interop had to mint name/** tokens to work around it. The fix is for AUTH_OK to carry wildcards, and AUTH hasn't shipped in a release yet.

Approach

• Move quest/m1/path-patterns.md into this line as quest/m1/auth/patterns.md, ranked before Relay tokens, which already requires it.
• Update its wire plan: AUTH_OK carries pattern grants from AUTH's first release. There is no prefix-only encoding and no covering-prefix workaround.
• Update every reference to the old path in this line's tree.

Impact

• None (quest docs only). The quest itself changes the not-yet-released lite-06 AUTH wire.

Alternatives

• Advertising the smallest covering prefix on lite-06 and moving to patterns in lite-07: rejected, because it means maintaining two encodings for an unshipped feature.

Follow-ups

• Other lines that still link /quest/m1/path-patterns.md (e.g. wildcard) pick up the new path when they merge main after this line lands.

(Written by Claude Opus 5.5)

🤖 Generated with Claude Code

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	⚠️ Failed 2026-09-25T22:43:55.217912Z	53c9973	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[kixelated]

ITERATE

Positive improvement? Yes. lite-06 AUTH_OK encoding only subtree prefixes, so a literal grant like b1.hang is dropped from AUTH_OK while the relay origin still enforces it, is a real client-visible gap (surfaced by #4181). AUTH has not shipped, so folding path patterns into this line and making AUTH_OK carry pattern grants from the first release is the right timing: it avoids a covering-prefix workaround and a second encoding later.

Worth the complexity? Yes. This is a small quest-doc move plus a plan update (7 files, net +5). Nesting patterns.md under auth/ and ranking it before relay tokens matches the dependency. Updating in-line references is the right scope; other lines picking up the path after they merge main is a reasonable follow-up.

Different approach? The rejected alternative (advertise a covering prefix on lite-06, patterns in lite-07) would maintain two encodings for an unshipped feature. Prefer shipping patterns once. Keeping announce/SUBSCRIBE_NAMESPACE on prefixes while AUTH grants use patterns also stays consistent with the existing "one prefix on the wire, one pattern in the token" split in the wildcard quest.

What to change before merge

1. Sync the Decisions bullet in quest/m1/auth/README.md. It still says legacy AUTH wire codecs refuse unrepresentable patterns and that Pattern interest "upgrades AUTH and ANNOUNCE_REQUEST wire fields together." That framing conflicts with the new patterns.md plan (AUTH_OK ships patterns from day one; announce stays prefix-only). Rewrite that decision so implementers do not reintroduce a prefix-only AUTH_OK or assume ANNOUNCE_REQUEST gains patterns in the same change.

2. Optional: in top-level quest/m1/README.md, the Path patterns top-level entry was removed and is now only under In-band auth. That is fine; just confirm no other in-line docs still describe path-patterns as a sibling quest rather than an auth prerequisite.

Once the Decisions bullet matches the shipping plan, this is merge-ready.

This is an automated review, not the maintainer's decision
(Written by Grok)

[kixelated]

Landing on quest/m1/auth/README. Path patterns join this line so AUTH_OK carries pattern grants, literals and wildcards, from AUTH's first release, with no prefix-only encoding. The grant decision now matches that plan: announce stays a prefix, so ANNOUNCE_REQUEST and SUBSCRIBE_NAMESPACE do not gain patterns in the same change.

(Written by Grok 4.7)