From 1cc4fa2059269ec9804c072a6370f878003dc6ee Mon Sep 17 00:00:00 2001 From: Claude Date: Tue, 27 Oct 2026 02:17:53 +0000 Subject: [PATCH] test(dogfood): re-measure the authz census for the approval record-lock read The record-lock route added one ledger row (80 -> 81, family `approvals`, blind spot 0) and one direct registration site in approvals-routes.ts outside registerMetadataEndpoints (rest-server.ts row 69/19/50 -> 70/19/51, register 62 -> 63, enforceAuth 115 -> 116; totals 64/69 -> 65/70). The matrix docblock's REST ledger figure moves to 81 rows / 18 families. Claude-Session: https://claude.ai/code/session_01WGufzfNhdx3xRKeaa8e7JB Co-authored-by: Claude --- .../dogfood/test/authz-conformance.matrix.ts | 6 ++- .../test/authz-probe-blind-spot.census.ts | 45 ++++++++++++++----- 2 files changed, 37 insertions(+), 14 deletions(-) diff --git a/packages/qa/dogfood/test/authz-conformance.matrix.ts b/packages/qa/dogfood/test/authz-conformance.matrix.ts index b5a52edd331..f362b782aa9 100644 --- a/packages/qa/dogfood/test/authz-conformance.matrix.ts +++ b/packages/qa/dogfood/test/authz-conformance.matrix.ts @@ -24,7 +24,7 @@ // hand-curated regex table reaching 1 of 17 REST registrars and 4 of 17 // dispatcher domain files. // -// The population comes from `packages/rest/src/rest-route-ledger.ts` (80 rows +// The population comes from `packages/rest/src/rest-route-ledger.ts` (81 rows // / 18 families) and `packages/runtime/src/route-ledger.ts` (105 rows / 23 // domains) because those two are enumerated from a RUNNING server and guarded // in both directions by their own conformance tests — so a new family or @@ -58,7 +58,9 @@ // `family: packages`, which survives on the publish row. (91 → 83 rows and // 19 → 18 families later, when #20102 retired the whole `reports` family; // 81 → 80 rows, families unmoved, when #25104 retired the `/docs` viewer -// page, whose `openapi` family survives on the document row.) +// page, whose `openapi` family survives on the document row; 80 → 81 rows, +// families unmoved, when #26361 added the approval record-lock read, whose +// `approvals` family the other approval rows already carry.) // Two stale figures in // one docblock with two entirely different causes is the failure mode the pin // above ends. Widening a regex instead was refused: it rots on the next diff --git a/packages/qa/dogfood/test/authz-probe-blind-spot.census.ts b/packages/qa/dogfood/test/authz-probe-blind-spot.census.ts index 95a908c8d85..34ee08db90f 100644 --- a/packages/qa/dogfood/test/authz-probe-blind-spot.census.ts +++ b/packages/qa/dogfood/test/authz-probe-blind-spot.census.ts @@ -386,11 +386,17 @@ export const PROBE_FILE_CENSUS: readonly ProbeFileReading[] = [ // viewer page row (`GET /api/v1/docs`) left the ledger with its route. It // carried `family: 'openapi'`, which the surviving document row still // carries, so `reachable` moves with `population` and `keys` stays 18. - population: 80, - reachable: 80, + // [#26400] 80 / 80 / 0 -> 81 / 81 / 0: the approval record-lock read + // (`GET /api/v1/approvals/records/:object/:recordId/lock`, landed in + // #26361) joined the ledger with its route. It carries `family: + // 'approvals'`, a family the other approval rows already carry, so + // `reachable` moves with `population`, the blind spot stays 0 and `keys` + // stays 18 (18 distinct families before and after, re-derived). + population: 81, + reachable: 81, blindSpot: 0, populationRule: 'ledger rows inside REST_ROUTE_LEDGER; reachable = rows carrying a `family` (each distinct value mints a key)', - controls: { "route: '": 80, "family: '": 80, RestRouteLedgerEntry: 2 }, + controls: { "route: '": 81, "family: '": 81, RestRouteLedgerEntry: 2 }, // [#22430] The `openapi` family is the second classified one, by the // `anonymous-deny-api-description` row; the note's 2 / 16 counts it. // [ADR-0138 E2] The `forms` family is the third, by the D2 class 1 row @@ -401,7 +407,9 @@ export const PROBE_FILE_CENSUS: readonly ProbeFileReading[] = [ 'That guard is why this file can be a population source and a regex table cannot: a mounted route with no ' + 'row here is already RED in another package, so a new family cannot be silently absent from this file, ' + 'and therefore cannot be silently absent from the authz ratchet either. 18 families; 3 classified by ' + - 'matrix rows (metadata, openapi and forms), 15 enumerated in the shrink-only baseline. Re-measured 81 -> 80 when the ' + + 'matrix rows (metadata, openapi and forms), 15 enumerated in the shrink-only baseline. Re-measured 80 -> 81 when the ' + + 'approval record-lock read joined with its route; it carries `family: approvals`, which the other approval rows ' + + 'already carry. Earlier re-measured 81 -> 80 when the ' + 'OpenAPI document viewer page row left with its route; it carried `family: openapi`, which the surviving document row ' + 'still carries. Earlier re-measured 82 -> 81 when the permission-set ' + 'overlay-discard row left with its route; it carried `family: security`, which the surviving security rows still carry. ' + @@ -535,9 +543,9 @@ export const PROBE_FILE_CENSUS: readonly ProbeFileReading[] = [ kinds: ['ROUTE_ENUMERATION', 'TRIPWIRE'], probes: 3, keys: 1, - population: 69, + population: 70, reachable: 19, - blindSpot: 50, + blindSpot: 51, populationRule: 'route registration sites — `this.routeManager.register(` call sites, LESS the one inside ' + '`registerPerItemRoute` (the shared forwarder, not a route; its extent is bounded by the declaration\'s own ' + @@ -952,13 +960,22 @@ export const PROBE_FILE_CENSUS: readonly ProbeFileReading[] = [ // (`:2545`) and the two inline comments on the internal context keys in // `computeExecCtx` (`:3444`, `:3454`). `enforceAuth`'s own body gained a // comparison in lines that do not spell the term. + // [#26400] 69 / 19 / 50 -> 70 / 19 / 51, and `enforceAuth` 115 -> 116: the + // approval record-lock read (`GET {basePath}/approvals/records/:object/ + // :recordId/lock`, landed in #26361) is one new direct + // `this.routeManager.register(` site (62 -> 63; 7 -> 8 in + // `approvals-routes.ts`) inside `registerApprovalsEndpoints`, NOT inside + // `registerMetadataEndpoints`, so it is a NEW BLIND SPOT, the same as its + // seven siblings; its handler opens with `enforceAuth`, so that control + // gains one. No registrar was added, so `private register*Endpoints(` + // stays 16 and the registrar list stays 18. controls: { 'private register*Endpoints(': 16, - 'this.routeManager.register(': 62, + 'this.routeManager.register(': 63, 'registrar list length': 18, 'data-action-routes.ts: this.routeManager.register(': 9, 'batch-routes.ts: this.routeManager.register(': 5, - 'approvals-routes.ts: this.routeManager.register(': 7, + 'approvals-routes.ts: this.routeManager.register(': 8, 'sharing-routes.ts: this.routeManager.register(': 8, 'analytics-routes.ts: this.routeManager.register(': 1, 'security-routes.ts: this.routeManager.register(': 6, @@ -991,7 +1008,7 @@ export const PROBE_FILE_CENSUS: readonly ProbeFileReading[] = [ 'registerPerItemRoute(': 8, 'const registerPerItemRoute =': 1, 'forwarder slice: this.routeManager.register(': 1, - enforceAuth: 115, + enforceAuth: 116, }, note: 'The single non-tripwire probe names ONE registrar of 16. The other 15 can never mint a key: ' + @@ -1276,7 +1293,7 @@ export const PROBE_FILE_CENSUS: readonly ProbeFileReading[] = [ /** * Entry points inside the probe table's OWN files that no mintable key can * reach, counting only the route/handler surfaces the ratchet's completeness - * claim is about: rest-server.ts (50 static / 55 runtime), http-dispatcher.ts + * claim is about: rest-server.ts (51 static / 56 runtime), http-dispatcher.ts * (13) and domains/mcp.ts (1). * * hono-plugin.ts's 6 mounts are deliberately EXCLUDED from this total and @@ -1294,8 +1311,12 @@ export const PROBE_FILE_CENSUS: readonly ProbeFileReading[] = [ // [#25104] 65 / 70 -> 64 / 69: the retired `/docs` viewer page left // `discovery-routes.ts` (on rest-server.ts's registrar list) as one blind-spot // call site and one runtime mount. -export const BLIND_SPOT_TOTAL_STATIC = 64; -export const BLIND_SPOT_TOTAL_RUNTIME = 69; +// [#26400] 64 / 69 -> 65 / 70: the approval record-lock read joined +// `approvals-routes.ts` (on rest-server.ts's registrar list) as one blind-spot +// call site and one runtime mount (one ledger row, 80 -> 81: a direct +// registration, not a route factory, so static and runtime move together). +export const BLIND_SPOT_TOTAL_STATIC = 65; +export const BLIND_SPOT_TOTAL_RUNTIME = 70; /** * Re-measure every row above from the same sources the probes read.