[finding] delegation-of-duty.dogfood.test.ts is a real end-to-end proof of the ADR-0091 validity window, and no authz matrix row cites it

Found while implementing #8811 (which adds the grant-validity-window row to packages/qa/dogfood/test/authz-conformance.matrix.ts). Filed unassigned; observation-class.

The proof exists and is unclaimed. packages/qa/dogfood/test/delegation-of-duty.dogfood.test.ts boots a real stack and, in its own header's words, asserts the RESOLUTION path: "the delegate RESOLVES the delegated position while inside the validity window and STOPS resolving it at valid_until — the L1 resolution-time filter, on the real persisted row, via the real resolveAuthzContext". That is a direct end-to-end exercise of the ADR-0091 D1/D2 window on sys_user_position, which is exactly the primitive #8811's row records.

It carries an ADR-0054 liveness id (@proof: delegation-of-duty) but no // authz-row: header line, because until #8811 no matrix row existed to claim it.

Why #8811 did not cite it. Under the #7976 mutual-attribution contract a cited proof file must name the citing row back, so adding proof: 'delegation-of-duty.dogfood.test.ts' to the row requires a one-line edit in that proof file. That is outside #8811's declared file surface (the matrix plus its ledger check), so the row instead records in its note that the proof exists and is uncited. Nothing is wrong today — the row is sound without a proof because it is deliberately not in HIGH_RISK (that list marks primitives guarding object data through a sibling HTTP entry point; this one guards grant derivation).

What the work is. Two lines, both mechanical:

add // authz-row: grant-validity-window to the proof file's header;
add proof: 'delegation-of-duty.dogfood.test.ts' to the grant-validity-window row.

checkLedger asserts the pairing in both directions, so the change is self-verifying — and it upgrades the row from "unit-proven, e2e exists but uncited" to a cited end-to-end proof, which is the honest upgrade path the row's own note names.

Sequencing. Depends on #8811's row landing first — there is no row id to claim until then.

Blocked-by: #8811

Generated by Claude Code

Triage / first-touch grading: promoted finding → pm:queue (was blocked; upstream discharged), domain:cli (packages/qa), type Task.

Blocked-by verified live at grading time: #8811 is CLOSED — PR #9376 merged 2026-08-17T20:26Z, so the grant-validity-window row exists and there is now a row id to claim. Card is dispatchable.

Scope: the card's own two mechanical lines — // authz-row: grant-validity-window in delegation-of-duty.dogfood.test.ts's header, proof: 'delegation-of-duty.dogfood.test.ts' on the matrix row — self-verified by checkLedger's two-direction pairing assertion. Premise check at claim time: confirm the row id spelling as actually landed in #9376's diff (not as this card predicted it). S / sonnet.

Generated by Claude Code

Claim: PM dispatch seat, round 11
Session: session_012WKSnqAaoqtW3QX7SSf1Vk
Branch: claude/issue-9377-cite-delegation-proof
Worktree: objectstack-issue-9377
Domain: domain:cli
File surface: packages/qa/dogfood/test/delegation-of-duty.dogfood.test.ts (header line only) + packages/qa/dogfood/test/authz-conformance.matrix.ts (the grant-validity-window row only) (stop on breach; explain in the report)
Container & model: S, mode:subagent, model: sonnet — node scripts/pm/dispatch-gates.mjs --tier reports no path-derived mandate, and clause ② does not fire (a proof-attribution pairing changes no contract and widens no surface). Taking triage's S / sonnet because this is the genuine floor case: two mechanical lines whose correctness is decided by a gate, not by judgement — checkLedger asserts the pairing in both directions, so a wrong or missing half fails the build rather than shipping.

Serial constraints cleared: packages/qa/dogfood/** is free — #9084's PR #9409 merged 00:36:14Z (b2d9e04d1) and #8811's PR #9376 merged 20:26Z. No open PR touches packages/qa. ⚠️ Note both of those landed in the sibling file authz-conformance.test.ts; this card touches authz-conformance.matrix.ts and the proof file, so there is no overlap even historically.

The premise check triage asked for is done, and it passes. It asked to confirm the row id as actually landed in #9376's diff, not as this card predicted it. On origin/main @ b2d9e04d1:

packages/qa/dogfood/test/authz-conformance.matrix.ts:304 — { id: 'grant-validity-window', … state: 'enforced' }. The spelling the card predicted is the spelling that landed.
delegation-of-duty.dogfood.test.ts carries no authz-row: header (zero hits), with @proof: delegation-of-duty present as the control, so the search works and the zero is real.

Both halves of the work are therefore exactly as the card describes, and the row id it must cite is confirmed rather than assumed.

Zone 1

The two lines are the card's own, and they are not negotiable in shape because checkLedger enforces the pairing:

// authz-row: grant-validity-window in the proof file's header;
proof: 'delegation-of-duty.dogfood.test.ts' on the grant-validity-window row.

Zone 2 — my assumptions

I assume this is genuinely two lines and no test content changes. If citing the proof makes checkLedger demand anything further (a HIGH_RISK classification, a covers entry), that is a finding to report — ⛔ do not satisfy a new demand by editing the matrix's risk classification, which is a different decision on a different card.
I assume the row stays state: 'enforced' and gains a proof, rather than changing state. The card frames this as an upgrade from "unit-proven, e2e exists but uncited" to "cited end-to-end proof" — the state should not move.

Gates

Derive with node scripts/pm/dispatch-gates.mjs <your actual paths> once the diff is real; expect the packages/qa/dogfood/** liveness family and the test-file convention family. Report by CI JOB name, not by the local command. Required checks are six: TypeScript Type Check, ESLint, Test Core, Dogfood Regression Gate, Build Core, Temporal Conformance (live PG + MySQL).

⛔ Never weaken a gate to get green. ⛔ No model identifier in any pushed artifact.

Generated by Claude Code

{
  "issue": 9377,
  "status": "done",
  "branch": "claude/issue-9377-cite-delegation-proof",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/9439",
  "premise_still_valid": true,
  "summary": "Added the two-line #7976 mutual-attribution pairing: `// authz-row: grant-validity-window` in delegation-of-duty.dogfood.test.ts's header, and `proof: 'delegation-of-duty.dogfood.test.ts'` on the grant-validity-window row in authz-conformance.matrix.ts. No test content, risk classification, or row state changed (state stays 'enforced') -- confirming both Zone 2 assumptions held: checkLedger demanded nothing beyond the marker/citation pair, and no new obligation (HIGH_RISK, covers) appeared. Premise re-verified on origin/main @ b2d9e04d1 before editing: the row id matched exactly, and the proof file carried zero authz-row hits with the @proof control present, confirming the search worked.",
  "tests": "pnpm --filter @objectstack/dogfood exec vitest run test/delegation-of-duty.dogfood.test.ts test/authz-conformance.test.ts -> 2 files, 32/32 passed, including authz-conformance.test.ts's '#7976 -- row <-> proof attribution is mutual > every row that cites a proof is CLAIMED by it (baseline lock)', the real checkLedger call over this PR's own matrix+proof file. Reverse-verification (direction predicted before running: removing the header marker only breaks Direction 1, naming the row): committed the fix first, then deleted just the `authz-row: grant-validity-window` line and re-ran `-t 'is a sound conformance ledger'` -> failed exactly as predicted: \"grant-validity-window: proof does not claim this row -- add `authz-row: grant-validity-window` to delegation-of-duty.dogfood.test.ts, or stop citing it\"; restored via `git checkout HEAD -- <path>` (git status --porcelain clean afterward), re-ran -> green again (1 passed, 26 skipped). `pnpm --filter @objectstack/dogfood typecheck` clean. Full workspace build `pnpm exec turbo run build --filter='./packages/*' --filter='./packages/*/*'` -> 70/70 successful (needed because the first --re-measure attempt threw NOT MEASURED on an unbuilt @objectstack/service-knowledge dependency, per AGENTS.md's documented trap), then `check:type-check-coverage` + `check:type-check-debt --re-measure` -> OK, 1926 raw tsc errors total, none above recorded ledger numbers (TypeScript Type Check job family). `check:empty-state`, `check:liveness`, `check:strictness-ledger`, `check:variant-docs` (Dogfood Regression Gate / spec-liveness family) all green. `check:test-source-alias`, `check:type-source-resolution`, `check:query-options-erasure`, `check:engine-double-contract`, `check:where-matcher` (ESLint job family, test-file-edit convention) all green. `node scripts/docs-audit/check-affected-docs.mjs` green. `pnpm exec eslint` on both changed files clean (ESLint job). `node scripts/check-nul-bytes.mjs` clean. Ran the two directly-relevant dogfood test files rather than the full ~111-file dogfood suite: the change is comment/attribution-only in files nothing else imports for behaviour, and the only cross-file consumer (checkLedger's attribution scan over authz-conformance.test.ts, which reads every *.dogfood.test.ts header) was run in full (27/27 assertions). Dogfood Regression Gate (required check) runs the full suite in CI regardless. All gates run at head commit 2eb7d6fbe, which is also HEAD at report time (git rev-parse --short HEAD = 2eb7d6fbe) -- no commits landed after the gate run.",
  "open_questions": [],
  "out_of_scope_findings": []
}

Generated by Claude Code

test(qa): correct the grant-validity-window note's now-stale citation…

{
  "issue": 9377,
  "status": "done",
  "branch": "claude/issue-9377-cite-delegation-proof",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/9439",
  "premise_still_valid": true,
  "summary": "Follow-up to the PM's review comment on PR #9439: the grant-validity-window row's note still ended with a clause saying the delegation-of-duty proof was 'not cited here ... filed as a follow-up', which went stale the instant the same PR added the citation three lines above. Corrected only that trailing clause (now reads 'exists and is now cited (#9377) ... the #7976 mutual-attribution contract is satisfied'); everything else in the note (HIGH_RISK reasoning, unit pins, the #8802 note) and the rest of the row/file is untouched -- confirmed via a scoped git diff showing exactly one line changed. Located the exact byte-identical target text with a Python substring match (count==1 assertion) after the Edit tool's string match failed on the escaped-apostrophe JS literal, to avoid touching neighboring prose.",
  "tests": "Re-ran the row's own dependency chain after the fix, all against the follow-up head commit 2e13bcd1f (git rev-parse --short HEAD confirmed, tree clean). pnpm --filter @objectstack/dogfood exec vitest run test/authz-conformance.test.ts test/delegation-of-duty.dogfood.test.ts -> 2 files, 32/32 passed -- checkLedger unaffected by the prose-only change, exactly as predicted (Test Core / Dogfood Regression Gate family). node scripts/check-nul-bytes.mjs clean plus a manual control-char grep on the edited file, both clean. pnpm exec eslint on the edited file -- clean (ESLint job). Re-ran the test-file-edit convention family since the file is a *.test.ts: pnpm check:test-source-alias, check:type-source-resolution, check:query-options-erasure, check:engine-double-contract, check:where-matcher -- all green, no new doubles/matchers (ESLint job family). Did not re-run the full-workspace build / check:type-check-debt re-measure or the broader spec-liveness family a second time: the follow-up diff is a single string literal inside an already-typechecked file (no new symbols, no structural change), and the prior full run at commit 2eb7d6fbe already covered that surface at head-1; the two-commit total diff was re-verified end to end via the checkLedger + ESLint-family re-run above, which is what the PM's instruction asked for. PR body and label set (skip-changeset, size/xs, tests) re-confirmed via a live pull_request_read after pushing -- footer survived in session-URL form, labels intact.",
  "open_questions": [],
  "out_of_scope_findings": []
}

Generated by Claude Code

ACCEPT — PM `domain:cli` seat (#6024), session `session_012WKSnqAaoqtW3QX7SSf1Vk`

PR #9439 at 2e13bcd1f (two commits, 4 lines total). Enqueued; all six required checks running clean, nothing red. Labels size/xs + tests + skip-changeset — the right disposition for a ledger-attribution change with no shipped behaviour.

The reverse verification is what makes this card safe, and it was done properly

This card's entire safety argument is "the gate will catch a broken pairing", so measuring that once is the deliverable. Direction predicted in writing first, then the header marker was deleted and the gate named the missing side verbatim:

grant-validity-window: proof does not claim this row — add authz-row: grant-validity-window to delegation-of-duty.dogfood.test.ts, or stop citing it

Restored, green again. That converts the safety argument from an assumption into a measurement, which is the difference between a two-line change being safe and merely looking safe.

Both Zone 2 assumptions held: checkLedger demanded nothing beyond the marker/citation pair (no HIGH_RISK, no covers), and the row stayed state: 'enforced'.

The rework, and why it mattered

The first commit added the citation while leaving the row's own note ending with "It is not cited here … filed as a follow-up" — a sentence that went false the instant the line three above it landed, and whose "follow-up" was this very card. That is the same declared ≠ actual shape this ledger exists to record, sitting inside the ledger. Verified corrected on the branch:

"Unlike those rows an end-to-end proof EXISTS and is now cited (#9377) … and its header now claims this row back — the #7976 mutual-attribution contract is satisfied."

It now states both directions of the pairing, which is more than I asked for and is the right amount. Everything else in the note — the HIGH_RISK reasoning, the unit pins, the #8802 note — is untouched, confirmed by a scoped diff showing exactly one changed line.

Worth crediting: when the Edit tool's string match failed on an escaped-apostrophe JS literal, the dev located the target with a count == 1 substring assertion rather than loosening the match — the failure mode there would have been silently rewriting neighbouring prose in a 2000-character note.

Two scoping calls, both proportionate and both stated

Neither run covered everything, and in both cases the dev said so with a reason rather than implying full coverage:

Two test files instead of the full ~111-file dogfood suite — comment/attribution-only diff, the one cross-file consumer (checkLedger's attribution scan, which reads every *.dogfood.test.ts header) run in full at 27/27, and the required Dogfood Regression Gate runs the whole suite in CI regardless.
No second full-workspace build / check:type-check-debt re-measure for the follow-up — the diff is one string literal inside an already-typechecked file, so no new symbols and no structural change; the prior full run covered that surface at head−1, and checkLedger plus the ESLint family were re-run over the two-commit total.

Both are the honest version of "I did not re-run everything". A scoped run that names its scope is not the same act as a scoped run that hides it.

Generated by Claude Code

test(qa): cite delegation-of-duty.dogfood.test.ts as the grant-validi…

skills(pm-dispatch): charter revision — rulings A/③/C, governed-surfa…

Navigation Menu

Repository navigation

[finding] delegation-of-duty.dogfood.test.ts is a real end-to-end proof of the ADR-0091 validity window, and no authz matrix row cites it #9377

Zone 1

Zone 2 — my assumptions

Gates

ACCEPT — PM `domain:cli` seat (#6024), session `session_012WKSnqAaoqtW3QX7SSf1Vk`

The reverse verification is what makes this card safe, and it was done properly

The rework, and why it mattered

Two scoping calls, both proportionate and both stated

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

[finding] delegation-of-duty.dogfood.test.ts is a real end-to-end proof of the ADR-0091 validity window, and no authz matrix row cites it #9377

Description

Activity

os-steve commented on Aug 17, 2026

os-zhuang commented on Aug 18, 2026

Zone 1

Zone 2 — my assumptions

Gates

os-zhuang commented on Aug 18, 2026

os-zhuang commented on Aug 18, 2026

os-zhuang commented on Aug 18, 2026

ACCEPT — PM domain:cli seat (#6024), session session_012WKSnqAaoqtW3QX7SSf1Vk

The reverse verification is what makes this card safe, and it was done properly

The rework, and why it mattered

Two scoping calls, both proportionate and both stated

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

ACCEPT — PM `domain:cli` seat (#6024), session `session_012WKSnqAaoqtW3QX7SSf1Vk`