[os-zhuang]

Fixes #9377

What

Two mechanical lines, both required by the #7976 mutual-attribution contract:

1. packages/qa/dogfood/test/delegation-of-duty.dogfood.test.ts header gains // authz-row: grant-validity-window — the proof file now claims the row it proves.
2. packages/qa/dogfood/test/authz-conformance.matrix.ts's grant-validity-window row gains proof: 'delegation-of-duty.dogfood.test.ts' — the row now cites the file back.

No test content changed, no risk classification changed, and state: 'enforced' is untouched — this is purely an attribution upgrade from "unit-proven, e2e exists but uncited" to a cited end-to-end proof, exactly as #9377 frames it.

Follow-up (PM review): the row's own note still ended with a clause saying the proof was "not cited here ... filed as a follow-up" — stale the moment the citation above landed. Corrected that trailing clause only (now: "exists and is now cited (#9377) ... the #7976 mutual-attribution contract is satisfied"); the rest of the note (HIGH_RISK reasoning, unit pins, the #8802 note) is untouched.

Why this is safe to do mechanically

checkLedger's attribution option (packages/verify/src/conformance.ts) asserts the row <-> proof pairing in both directions: the cited proof file must claim the row, and every claim must be reciprocated by a real row that cites that file back. A wrong or missing half fails the build rather than shipping silently.

Verification

• pnpm --filter @objectstack/dogfood exec vitest run test/delegation-of-duty.dogfood.test.ts test/authz-conformance.test.ts — 2 files, 32/32 passed, including authz-conformance.test.ts's #7976 — row ↔ proof attribution is mutual > every row that cites a proof is CLAIMED by it (baseline lock), which is the real checkLedger call running against this PR's own matrix + proof file. Re-ran after the note-wording follow-up commit — still 32/32 (prose-only change, checkLedger unaffected as expected).
• Reverse-verification (predicted before running): removed the authz-row: grant-validity-window header line only, re-ran authz-conformance.test.ts -t 'is a sound conformance ledger' — failed exactly as predicted, naming the row:

  AssertionError: grant-validity-window: proof does not claim this row — add `authz-row: grant-validity-window` to delegation-of-duty.dogfood.test.ts, or stop citing it
  

  Restored from the committed state (git checkout HEAD -- <path>), re-ran the same test — green again.
• pnpm --filter @objectstack/dogfood typecheck — clean.
• Full workspace build (pnpm exec turbo run build --filter='./packages/*' --filter='./packages/*/*') — 70/70 tasks successful, then re-measured on the built closure:
  • pnpm check:type-check-coverage / pnpm check:type-check-debt --re-measure — OK, 1926 raw tsc errors total, none above the recorded ledger numbers.
• pnpm --filter @objectstack/spec run check:empty-state, check:liveness, check:strictness-ledger, check:variant-docs — all green (dogfood liveness family).
• pnpm check:test-source-alias, check:type-source-resolution — green.
• node scripts/docs-audit/check-affected-docs.mjs — green.
• pnpm check:query-options-erasure, check:engine-double-contract, check:where-matcher — green (test-file-edit convention family; no new doubles/matchers introduced by this change); re-confirmed after the follow-up commit.
• pnpm exec eslint on all changed files — clean (re-run after the follow-up commit too).
• node scripts/check-nul-bytes.mjs — clean.

Head commit: 2e13bcd1f.

Changeset

skip-changeset — this is a tests-only attribution change inside @objectstack/dogfood, which is "private": true and never published; nothing here ships or releases. Per .github/workflows/pr-automation.yml's own guidance (.changeset/-gate comment), tests-only changes take the skip-changeset label rather than an empty-frontmatter changeset. Label applied on PR creation.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

Nothing in this diff resolved to a documentable surface (no symbol, route or SDK anchor derived from 1 changed package(s)), so this run has no opinion about the docs.

What this run could not see

• 2 name(s) were too generic to anchor anything (single lowercase words)

Coarse fallback — 2 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json origin/main → packageMentionDocs.