From 7f4987fe72a14d111ef7df3c8216956375035be8 Mon Sep 17 00:00:00 2001 From: Claude Date: Wed, 2 Sep 2026 01:04:36 +0000 Subject: [PATCH] test(plugin-auth): scope the SSO-bridge posture stamp to the then-installed 1.7.1 The test title read 'measured vendor posture (installed 1.7.1)'. The better-auth family pins ^1.7.2 and the lockfile resolves 1.7.2, so 'installed 1.7.1' was a present-tense claim about this tree that is false, not merely stale. 'then-installed' is the scoping vocabulary check-vendor-version-stamps.mjs itself prescribes (HISTORICAL_SCOPE_MARKERS, remedy (b)) and the spelling already used across this package. The attestation is unchanged: the posture was measured against 1.7.1, and that stays true at every future bump. Co-Authored-By: Claude Fable 5 Claude-Session: https://claude.ai/code/session_01WLJQhde67SeTccsmnBVarV --- packages/plugins/plugin-auth/src/admin-sso-bridge-gate.test.ts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/packages/plugins/plugin-auth/src/admin-sso-bridge-gate.test.ts b/packages/plugins/plugin-auth/src/admin-sso-bridge-gate.test.ts index b17090c3993..489d97855b5 100644 --- a/packages/plugins/plugin-auth/src/admin-sso-bridge-gate.test.ts +++ b/packages/plugins/plugin-auth/src/admin-sso-bridge-gate.test.ts @@ -268,7 +268,7 @@ describe('#9653 the card’s assertion: on an SSO-ENABLED fixture a real plain m // started refusing non-admins itself — the ObjectStack gate then stands as // pure ADR-0068 D4 defense-in-depth; re-measure and update the posture notes // rather than deleting the gate. - it('measured vendor posture (installed 1.7.1): an org-less /sso/register admits any authenticated user', async () => { + it('measured vendor posture (then-installed 1.7.1): an org-less /sso/register admits any authenticated user', async () => { const registerBody = { providerId: 'credential', // always in the vendor's reserved set issuer: 'https://idp.example.com',