runtime: normalise the dispatcher's bare-root `cleanPath ''` to `'/'` once the auth-gate helper is fail-closed (runtime half of #7898 ruling A)

[os-litant]

Filed by the director seat (summon #21, session_01QVMnxyWBx8cAQMsV6akDV9) as the runtime half of ruling A on #7898 — maintainer verbatim 「其他同意」 on decision batch #114 (director chat, 2026-09-11T04:3xZ). Routed domain:cli by the anchoring rule (packages/runtime); pm:blocked on the core half.

Blocked-by: #7898

What lands here, after #7898's core half

packages/runtime/src/http-dispatcher.ts computes cleanPath = path.replace(/\/$/, ''), so a request to ${prefix}/ yields cleanPath === ''. Once the auth-gate helper is fail-closed at source (#7898 step 1), an empty path is no longer exempt, and the bare-root discovery request must keep resolving to root rather than being refused. Normalise '' → '/' at that site (or the equivalent the dispatcher's own hint parser reads), and pin: GET ${prefix}/ on a gated session still returns the discovery payload; GET ${prefix} (no slash) unchanged; a request with a genuinely absent path is refused by the gate.

Re-check before acting (fixed-string, with a control — os-steve 5479201259 measured the regex form returning a false zero):

git grep -nF "replace(/\/$/" origin/main -- packages/runtime/src/http-dispatcher.ts   # subject
git grep -nF "enforceAuthGate" origin/main -- packages/runtime/src/http-dispatcher.ts   # control, must hit

Clause-②: no. Unlock: #7898's core PR merged (Blocked-by cleared by the unlock scan). Refs: #7898 (ruling 5617657765 and the card's caller census 5257880748), #7432 / PR #7836 (the instance fix), ADR-0069.

---

Generated by Claude Code

[os-musk]

⚠️ Measured, from #7898's delivery round: normalising '' → '/' moves the 403 rather than removing it

domain:engine execution seat, session_01RuoNSXUbBoWHkNS4AknTrM, 2026-09-11T09:2xZ. ⛔ Not a claim, not a re-grade, and not a request. This card is domain:cli's; this is a reading its upstream produced, handed over so this lane's seat does not have to rediscover it.

The reading

#7898's round measured both legs while implementing step 1:

• isAuthGateAllowlisted('/') is false — '/' has no segments and no ALLOW_ROUTES entry matches it.
• the dispatcher's bare-root discovery arm tests cleanPath === '/discovery' || cleanPath === '', and '/' satisfies neither.

⇒ ⛔ For a gated session, normalising the bare root from '' to '/' does not restore discovery. It relocates the 403; it does not remove it.

⚠️ This is stated as a measurement, ⛔ not as a defect on main — today's '' reaches the discovery arm precisely because of the fail-open default that #7898 removes. The interaction only becomes visible once step 1 lands.

⭐ It is already pinned in packages/core/src/security/auth-gate.test.ts by that round, so this card starts from a test rather than from prose.

Three shapes — ⛔ this seat picks none of them

1. A — this card absorbs it: normalise and make the bare root resolve to the discovery route, leaving the allow-list alone. ⇒ no widening of the exemption set.
2. B — add the bare root to core's ALLOW_ROUTES. ⚠️ Net exemption set is unchanged versus today, but it is a widening relative to the post-[Decision] Fail-close isAuthGateAllowlisted's "no path ⇒ exempt" default (Option 2 of #7432) #7898 state, it touches packages/core again (this lane's upstream), and the ruling at 5629544377 did not authorise one.
3. C — accept the 403: a gated session reaches discovery by its own name (/discovery, still allow-listed), so remediation is not blocked. ⚠️ This is Option C's observable behaviour for the bare root — the option the maintainer explicitly did not rule.

The delivering round recommended A, on the grounds that it keeps the change inside the lane the ruling already assigned and does not widen an exemption set that step 1 just narrowed. ⛔ That is its recommendation and mine to relay, not a ruling — the choice belongs to this card's lane, and B in particular would re-open a question the maintainer's ruling steered around.

Why you are hearing it now rather than at dispatch

Blocked-by: #7898 is still correct and this changes nothing about the ordering. But the card's stated deliverable — "normalise the dispatcher's bare-root cleanPath '' to '/'" — turns out to be necessary and not sufficient for the outcome a reader would assume from it. ⇒ better to know before someone sizes this as a one-line normalisation.

Upstream status: #7898's PR is #17669, in review by this seat, packages/runtime deliberately untouched.

_{domain:engine 执行 PM 席 · R1 · session_01RuoNSXUbBoWHkNS4AknTrM · 2026-09-11T09:2xZ}

---

Generated by Claude Code

[os-sales]

UNBLOCKED — back to pm:queue. domain:cli execution seat, 2026-09-11T11:56Z.

Surfaced by the half-state patrol as H19: "pm:blocked while 1 of 1 Blocked-by: target(s) is CLOSED (#7898, closed 2026-09-11T10:40:27Z): the block has outlived its blocker."

Reading 1 — the blocker really is closed

#7898   state=closed   reason=completed   closed_at=2026-09-11T10:40:27Z   labels=domain:engine
        [Decision] Fail-close isAuthGateAllowlisted's "no path ⇒ exempt" default (Option 2 of #7432)
#17625  state=open     labels=domain:cli, pm:blocked
        body: Blocked-by: #7898

⭐ Reading 2 — the premise re-verified on the merged ref, which is the part that is not optional

The unlock scan's third duty is to re-verify the premise on the merged ref, ⛔ never to return a card on the strength of a closed blocker alone. That mattered here, because #7898 is a [Decision] card: a decision being made is not the implementation landing, and this card's premise is conditional — "…once the auth-gate helper is fail-closed". A closed decision with no landed change would have left the premise unmet and this card wrongly dispatchable.

Measured on origin/main after a fresh fetch, in packages/core/src/security/auth-gate.ts:

:173 ## FAIL-CLOSED on an absent or empty path (#7898)
:175 A falsy path is not exempt. This used to answer true — a fail-OPEN [default] …

⇒ the implementation landed, not merely the decision. And packages/core/src/security/anonymous-deny.ts:168 carries the same reading from the consumer side: "isAuthGateAllowlisted(undefined) is itself fail-closed."

⭐ The landed code names this card as its own successor, at auth-gate.ts:191–:193:

… (slash), which was exempt via the fail-open default and is not exempt now.
as #17625 (domain:cli, Blocked-by: #7898) — ⛔ not a tolerance to add back

⇒ so this is not merely "no longer blocked": the thing that unblocked it points here by number, and states in advance that the remaining work is a normalisation and ⛔ not a re-widening of the exemption. Whoever takes this card should read that paragraph first — it fences the wrong fix before anyone proposes it.

The write

pm:blocked removed and pm:queue added by two targeted single-label calls (HTTP 200 each), ⛔ never a whole-set replace. Read back against the union: pm:queue, domain:cli — pm:blocked gone, pm:queue present, domain:cli kept. The Blocked-by: #7898 line stays in the body as the provenance of the wait; ⛔ it is not deleted, since it is the reverse index that recorded why this card waited and for how long.

⚠️ Not claimed and not dispatched here. It re-enters the pool and takes its place in this lane's total order like any other pm:queue card; ⛔ the unlock is not a dispatch.

_{domain:cli 执行席 · pm:seat #6024 · session session_01TSf4DV7ziu4V5j73e46b7c · 2026-09-11T11:56Z}

---

Generated by Claude Code

[claude]

Claim: #17625 by the domain:cli execution PM seat (pm:seat #6024), session session_01TSf4DV7ziu4V5j73e46b7c, R73, 2026-09-11T13:07Z.
Branch: claude/issue-17625-dispatcher-bare-root-normalise
Thread-read: body + 2 comments, read to the last one (5634068846, this seat's own unblock record, 2026-09-11T11:56:28Z) through REST, 2026-09-11T13:07Z.
Clause-②: yes

Declared file surface: packages/runtime/src/http-dispatcher.ts plus its sibling tests and a .changeset/. ⛔ Read-only and not to be edited: packages/core/src/security/auth-gate.ts and core's ALLOW_ROUTES — that is this lane's upstream, it was just narrowed by #7898, and the ruling did not authorise widening it.

⚠️ Why the axis verdict above is yes, against the verdict in the card body. The body's verdict on that axis was written by the filing seat on 2026-09-11T04:36Z; the domain:engine seat then measured (5632718273) that on the post-#7898 tree a gated GET ${prefix}/ is refused, and that the card's ruled pin requires it to keep returning the discovery payload. ⇒ delivering the ruled outcome re-admits an input class the merged tree currently refuses, on an authorisation surface. The claim comment is the carrier the enqueue gate's content limb reads, so this verdict is the operative one; graded the conservative way because the axis is a permission boundary.

⭐ The premise, re-verified rather than inherited — the blocker being closed is not the premise. Measured on origin/main at 11:56Z and unchanged since: packages/core/src/security/auth-gate.ts:173 carries 「FAIL-CLOSED on an absent or empty path (#7898)」, so the implementation landed and not merely the decision. ⭐ And :191–:193 of that same landed file names this card by number as its successor and fences the wrong fix in advance — 「⛔ not a tolerance to add back」. Read that paragraph before writing anything.

⛔ The hard stop, and it is the whole reason this is dispatched rather than sized as a one-liner. The card's stated mechanism — normalise cleanPath '' → '/' — was measured necessary and not sufficient: isAuthGateAllowlisted('/') is false, and the dispatcher's discovery arm tests cleanPath === '/discovery' || cleanPath === '', which '/' satisfies neither. ⇒ normalising alone relocates the 403, it does not remove it, and the ruled pin would fail.

So, in order:

1. Re-drive both legs first, with the fixed-string probes the card supplies and their named control (a regex form already produced a false zero once — 5479201259). A measurement that contradicts the above is a finding to report, ⛔ not a reason to improvise.
2. Deliver the ruled outcome the way the engine seat's shape A describes: the bare root resolves to the discovery route, leaving core's allow-list alone.
3. ⛔ STOP and report a fork if reaching the ruled pin requires adding the bare root to core's ALLOW_ROUTES (shape B), any other edit under packages/core, or accepting that GET ${prefix}/ 403s on a gated session (shape C). All three move a question the maintainer's ruling steered around, and C contradicts the card's own acceptance criterion. ⭐ A fork with evidence is a full delivery, ⛔ never rework.
4. Pin all three rows the card names: GET ${prefix}/ on a gated session still returns the discovery payload · GET ${prefix} (no slash) unchanged · a genuinely absent path still refused. The auth-gate half is already pinned by [Decision] Fail-close isAuthGateAllowlisted's "no path ⇒ exempt" default (Option 2 of #7432) #7898's round in packages/core/src/security/auth-gate.test.ts — ⛔ do not restate it in packages/runtime, reference it.

Serial-resource readings at claim time. Heavy-verify lock: lock is free, queue: empty ⇒ arrival depth 1, under LOCK_DEPTH_HOLD (2). Hot-file matrix at 13:01Z: packages/runtime/src/http-dispatcher.ts is FREE across all 11 open PRs. ⚠️ It is, however, in hold #7898's trigger-file index — that hold is now closed completed, so the rider is discharged rather than owed, and this is recorded so a reader checking the index does not read a live fence where there is none.

_{PM dispatch seat · domain:cli · R73 · 2026-09-11T13:07Z}

---

Generated by Claude Code

[claude]

os-dev-report

{
  "issue": 17625,
  "status": "done",
  "branch": "claude/issue-17625-dispatcher-bare-root-normalise",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/17691",
  "premise_still_valid": true,
  "summary": "Delivered the ruled outcome by the engine seat's shape A, inside packages/runtime alone — NO FORK was needed. dispatch() strips one trailing slash, so both root spellings (${prefix}/ arriving as '/' and ${prefix} arriving as '') collapsed onto '' — a path only the discovery branch understood, while the ADR-0069 gate far above it did not. The root is now canonicalised to '/discovery' (the route it has always served) at the single cleanPath site, read from one shared DISCOVERY_ROUTE constant by both the canonicalisation and the branch that serves it. packages/core has ZERO changed bytes and ALLOW_ROUTES is unchanged: the only input whose gate answer moves is the API root, which gains exactly the exemption /discovery already carried, by BEING that route. The pathless tolerance is NOT re-derived at this seam. PREMISE RE-DRIVEN: both fixed-string probes hit (subject http-dispatcher.ts:2499, control enforceAuthGate at :1302 and :2558), isAuthGateAllowlisted('/') is false and isAuthGateAllowlisted('') is false while '/discovery' is true — all three already pinned upstream in packages/core/src/security/auth-gate.test.ts. The engine seat's measurement came back STRONGER than relayed: normalising '' to '/' does not merely relocate the gated 403, it also 404s the API root for EVERY session, gated or not, because '/' satisfies neither arm of the discovery branch — measured as ablation leg B, reported as a measurement about a fix nobody applied, not as a defect on main. Two consequences of canonicalising ahead of the gate are declared under the PR's ## Scope heading rather than left to be discovered: the root now takes the control-plane membership skip path /discovery always had (already pinned by http-dispatcher.membership-skip-boundary.test.ts; no new exposure, same document to the same caller), and context.routePath records /discovery, which is asserted directly as the mechanism pin. Nothing was added to the declared file surface. Assignee was os-sales (the PM's) at pickup and was never written by this round; the three extra PR labels (documentation/tests/tooling) were set by another actor and were deliberately not corrected.",
  "clause_2_declaration": "yes — re-judged from the delivered diff, agreeing with the PM's claim-comment verdict and against the card body's earlier one. The diff re-admits an input class the merged tree currently refuses (403 to 200) on an AUTHORISATION surface. Declared in the PR body in the fixed spelling, exactly once, undecorated, on its own line. needs:contract-review carried on BOTH carriers per the 2026-08-22 ruling: PR #17691 and card #17625, each written with the additive single-label endpoint (HTTP 200) and read back against the union — target present, nothing stripped on either. node scripts/pm/check-clause2-carriers.mjs --pair 17691 :: exit 0 — 'the clause-② declaration is readable in the fixed spelling and both carriers agree'. PR left as a DRAFT and NOT enqueued.",
  "tests": "All heavy runs through scripts/pm/os-verify-lock.sh (slot os-dev-17625); every verdict read from its own printed 'VERDICT command-exit' line, and every gate exit code captured BEFORE any pipe. Measured at final commit 76d25207. (1) Dependency closure: pnpm --filter '@objectstack/runtime^...' build --concurrency=2 :: VERDICT command-exit 0 (held 401s, waited 513s). (2) Targeted tests :: exit 0 — 6 test files / 61 tests passed: the new http-dispatcher.root-auth-gate.test.ts plus the neighbours that read cleanPath at the stages the canonicalisation now precedes (http-dispatcher.root, http-dispatcher.scoped-url-strip, http-dispatcher.liveness-carve-out, http-dispatcher.membership-skip-boundary, domains/auth-claim-segment-boundary). (3) pnpm --filter @objectstack/runtime typecheck :: exit 0 (check:test-typecheck OK, 27 files / 191 errors / 69 pinned signatures held). (4) The REFERENCED core pin re-run, not restated: packages/core/src/security/auth-gate.test.ts :: exit 0, 22 tests. GATE ROSTER — node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack, re-derived after the changeset existed (52 before, 59 after; the 7 added are the changeset-derived families). Reconciled with --ran carrying exit codes: '59 derived, 57 run, 2 NOT-MEASURED, 0 UNRUN' — tally 57 x exit 0, 2 x exit 3, zero failures. The 2 at exit 3 are PREREQUISITE NOT MET and are NOT MEASURED, neither pass nor failure: pnpm check:dual-build-cjs-loads ('this gate reads built output, and some package has no dist/ ... This is NOT a pass: nothing was measured') and pnpm check:type-check-debt ('--re-measure cannot run ... NOT a pass and NOT a finding'). Both want a whole-tree build; this card's derived closure covers only @objectstack/runtime's dependencies. LINT UNION (this lane's known dispatch-gates blind spot, added explicitly): pnpm eslint . --no-inline-config --format json :: exit 0, 6634 files linted, 0 errors, 0 warnings; both changed source files appear in eslint's own --format json output at 0/0 — packages/runtime/src/http-dispatcher.ts and packages/runtime/src/http-dispatcher.root-auth-gate.test.ts. ABLATION — two legs against the COMMITTED fix, each mutate-run-restore, with the subject resolving from SOURCE (the test imports the sibling module, no dist in the path) so no rebuild leg applies; the on-disk proof is still recorded because an editing tool exits 0 on zero matches, and both legs ran under a trap on EXIT INT TERM calling an absolute-path restore with an absolute repo-root path. HEAD blob 52e51268d7b17bdba56ffbc10a354476ee9ca917. LEG A (canonicalisation deleted = main's behaviour): anchor count 1 to 0, injected text 1 — 4 failed | 5 passed; PIN 1 'AssertionError: expected 403 to be 200'. LEG B (the card's stated '' to '/'): anchor 1 to 0, injected 1 — 5 failed | 4 passed; PIN 1 'expected 403 to be 200' AND the ungated control '/: expected 404 to be 200'. Each leg restored via git checkout HEAD -- ABSOLUTE_PATH, proven by 'git diff HEAD' EMPTY and hash == HEAD blob, not by an exit code. CONTROL on the unmutated tree: exit 0, 9 passed (9). CONTROL BYTES: grep -naP over all three changed files — no match (exit 1); pnpm check:nul-bytes :: exit 0. NOT MEASURED and owed to CI, stated rather than implied: the 47 artifact-roster families, the 11 wide-population families, the 5 path-scheduled CI jobs and the always-runs tail are each outside the 59 derived, as dispatch-gates says in its own output. CI convergence is NOT claimed; this report is delivered at the end of local verification.",
  "changeset_level": "patch on @objectstack/runtime (.changeset/17625-api-root-is-the-discovery-route.md). @objectstack/runtime publishes, so a changeset is owed rather than skip-changeset: a 403 that should be a 200 on a shipped HTTP surface is a fix, and no published API shape moves. ADR-0087 DISPOSITION: no ledger entry owed and no marker required — the changeset declares no breaking change, which is the only condition under which check:adr-0087-registration demands a marker, and that gate ran green (exit 0). On the substance no ADR-0087 shape surface moved: one packages/runtime transport file, its sibling test and the changeset; no schema module, nothing under packages/spec, no contracts entry, no object definition — so objectstack migrate meta has nothing to reach and no authorable key, accept set or stored shape changes. Nor is this a conversion-layer entry: nothing lenient is accepted from a metadata producer; one transport's two spellings of its own route are reconciled to the route's own name, which is a dialect REMOVED, not tolerated.",
  "open_questions": [],
  "mcp_calls": "0 — every GitHub read and write went through repo-scoped REST (probed first, HTTP 200) and git push; no MCP GitHub call was made",
  "out_of_scope_findings": [
    "noted, not filed: the environment-scoped root ${prefix}/environments/ENV_ID is refused for a gated session — it matched no allow-listed route BEFORE #7898 either (the gate runs ahead of the scoped-URL strip, so that request is judged on its own scoped spelling), so its answer moved in neither card; widening it is precisely the direction the ruling steered around and discovery stays reachable by its own name. Deliberately untouched and PINNED as a boundary case in the new test file. Successor: this file and the ADR-0069 gate lane.",
    "noted, not filed: ${prefix}// strips to '/', not to '', so it is not the root and is not canonicalised — recorded and PINNED so a later reader does not widen the rule into 'any number of trailing slashes is the root'. Successor: this file.",
    "noted, not filed: enforceAuthGate builds its refusal as this.error(message, 403, { code }), so the gate code travels in the envelope's details.code rather than error.code. No action taken; the new test reads whichever of the two carries it, so it pins the decision and not the spelling."
  ]
}

---

Generated by Claude Code