fix(plugin-auth)!: an anonymous get-session is refused with the declared 401 envelope, not answered 200 null - #17881

…us get-session

The packed-tarball release-candidate smoke asserted that an anonymous
`GET /api/v1/auth/get-session` answers 200. Since #17881 the platform
deliberately answers 401 with the ADR-0112 envelope
(`code: UNAUTHENTICATED`), ruled by the director seat in decision batch
 #117 item 4 on card #17238: better-auth's `200` + literal JSON `null` is a
value no `SessionResponse` can express, so `auth.me()` resolved outside its
own declared type; the code moved and the published schema did not.

The smoke was therefore asserting a contract the product deliberately stopped
serving. This re-pins the probe to what the code declares — the same move
 #14000 made for `SELF_REGISTRATION_CLOSED` — and pairs the status with the
envelope `code`, so a 401 from an origin check, a rate limiter or a later
guard cannot keep the probe green while measuring nothing.

The signed-in `get-session` probe is untouched and still asserts 200: the
refusal seam converts only a 200 whose body is exactly `null`.

Claude-Session: https://claude.ai/code/session_012GKcPZbMoGq7WPzKLfRBTU
Co-authored-by: Claude <[email protected]>

…us get-session (objectstack-ai#18140)

Closes objectstack-ai#18079

`Clause-②: no` — this neither loosens an accept set nor widens a
published contract surface. It tightens one CI assertion onto the
contract the code already declares.

## The question this card asked, and the answer

objectstack-ai#18079 named two hypotheses and asserted neither: either the anonymous
`GET /auth/get-session` behaviour regressed (fix the auth surface), or
the smoke's expectation is stale (fix the probe). **The second is true,
and it is established from the tree rather than inferred.**

`packages/plugins/plugin-auth/src/anonymous-session-refusal.ts` exists
for exactly this, and its header records the ruling:

> Director seat, decision batch objectstack-ai#117 item 4 (2026-09-12), maintainer
verbatim 「17238 B」 — the server answers the platform's standard ADR-0112
failure envelope with HTTP 401 instead of `200` + `null`, and
`SessionResponseSchema` is UNTOUCHED. The charter rule quoted in that
ruling: 「spec 与代码不一致默认改代码,改协议单独立卡非选项」.

`AuthManager.handleRequest` calls it on the one seam every vendor route
passes through, and the call site says in as many words that this one
**is** the admission move:

> ⚠️ NOT the same kind of change: that one is forbidden to move
admission and this one IS the admission move (`200` -> `401`).

So the 401 is the declared contract. The smoke was asserting a shape the
platform deliberately stopped serving. ⇒ **The auth surface is not
touched by this PR.**

Three independent legs agree on the exact envelope, so the assertion is
pinned to a measurement and not to a guess:

| leg | source | reading |
|---|---|---|
| the ruling | `anonymous-session-refusal.ts` header | 401 + ADR-0112
envelope |
| the wire | run 34774426350 / 34728125950 job log |
`{"success":false,"error":{"code":"UNAUTHENTICATED","message":"Sign in
first"}}` |
| the spec | `packages/spec/src/api/errors.zod.ts:174` | `401:
'UNAUTHENTICATED'` |

## Bisect — the true first failure, not the observed window

The card cautioned that the observed window (back to `b06b2db5c4`) is
not the start, because the runs on `a83dbb6124` and `6d647858b7` read
`no-run` and `cancelled`. Correct — and the real boundary is a day
earlier and is **not a `main` commit at all**.

- Causal commit on `main`: **`374d9d3afa`** — `fix(plugin-auth)!: an
anonymous get-session is refused with the declared 401 envelope, not
answered 200 null (objectstack-ai#17881)`, 2026-09-12T19:15:14Z. `git log
--diff-filter=A` names it as the commit that *adds* the refusal module;
the shallow graft boundary here is `ca0a1f83d6` (2026-07-29), far older,
so that add is genuine and not a graft artifact.
- Last green RC smoke: run `34726616436`, 2026-09-12T23:54:27Z, status
posted to RC head `a1effc8e44` (`chore: version packages`,
2026-09-12T18:12:26Z).
- First red RC smoke: run `34728125950`, 2026-09-13T00:30:11Z, job
`103645853837`, status posted to RC head `e612087feb` (`chore: version
packages`, 2026-09-13T00:29:49Z). Its log carries the same assertion and
the byte-identical body as the card's evidence run.

Those two runs carry the **same** `main` head sha (`a9c6477904`) and
opposite verdicts, which is the card's "NOT main-red" point showing up
as data: the smoke tests the release candidate, not the commit the check
attaches to. The decisive probe is therefore on content, not on timing —

```
                                anonymous-session-refusal.ts   platform-admin-gate.ts   (nonsense path)
a1effc8  LAST GREEN RC              ABSENT                        PRESENT                 ABSENT
e612087  FIRST RED RC               PRESENT                       PRESENT                 ABSENT
```

The firing control is present in both trees (the probe reaches them) and
the nonsense control is absent in both (the probe can say no).
`374d9d3afa` (19:15:14Z) falls inside the interval between those two
`chore: version packages` commits (18:12:26Z → 00:29:49Z), so the two
readings cross-validate.

## What changed

One file, `scripts/publish-smoke.sh`:

1. The anonymous probe now expects **401** and is paired with
`assert_body '.error.code == "UNAUTHENTICATED"'`. The status alone would
be satisfied by an origin check, a rate limiter or any later guard while
measuring nothing — the same reasoning the `SELF_REGISTRATION_CLOSED`
probe below it is already written under, and what this file's header
means by *"every assertion here is an HTTP status plus a `code` this
repo owns and publishes"*.
2. A comment pinning **why**, naming objectstack-ai#17881, objectstack-ai#17238 and the ruling, so
the next reader does not "fix" it back — the card asked for this
explicitly.
3. The header's declared-contract table updated to match.

The **signed-in** probe is deliberately untouched and still asserts 200:
the refusal seam converts only a 200 whose body is exactly `null`, so
that answer is byte-identical to before.

This is the objectstack-ai#14000 move repeated — that card re-pinned this same script
to the declared contract for `SELF_REGISTRATION_CLOSED` rather than
touching auth runtime code, and left a standing ⛔ against relaxing an
assertion *back toward 200*. This change runs the other way (200 → 401),
which is the direction that prohibition protects.

## Verification

- `bash -n scripts/publish-smoke.sh` → exit 0.
- The new `jq` filter, tested against the byte-exact body from job
`103645853837` and two controls: observed body → exit 0; a 401 carrying
`INVALID_ORIGIN` → exit 1; the old `null` → exit 1. So the assertion
accepts the real refusal and rejects both a foreign guard and the
retired shape.
- The full derived gate family for this diff — 26 commands from `node
scripts/pm/dispatch-gates.mjs --commands` — all exit 0, including
`check:bash32-floor` and `check:nul-bytes`.
- Control-character self-scan over the edited file: no matches.
- ⚠️ The smoke itself is **NOT MEASURED** locally. It packs ~70
tarballs, installs and builds a project outside the workspace and boots
a dev server; that is far past this container's foreground budget and
its shared-verification discipline. The real verdict is the next
`publish-smoke / packed-tarballs` status on the release-candidate head.

## Reverse-read, both directions

**Which currently-true sentence does this make false?** Inside this
file, the header's `→ 200 (anonymous)` row — updated in the same diff,
so the file does not contradict itself. Outside it, none: I grepped
`get-session` across `packages`, `scripts`, `docs`, `content` and
`.github` and no other statement depends on the smoke asserting 200.

**Which currently-false sentence does it make true?** Two. The file's
own claim that it asserts *"the DECLARED first-run contract"* was false
for this row and is now true. And the status text `Fresh install of the
release candidate: auth + CRUD green`, which this gate has been unable
to post since 2026-09-13T00:30Z, becomes reachable again — that is the
release-blocking half.

**Zero results reported as such:** no other consumer of the smoke's
expectation exists; no docs page restates it.

## Noted separately

The same grep found that objectstack-ai#17881 moved the wire answer but left the
**client SDK** still documenting `-> 200 null`
(`packages/client/src/index.ts:1474`) and a test double still modelling
it. That is `domain:services`, not this lane, and it is filed on its own
card — see objectstack-ai#18139. It is not addressed here.

## Merge channel

⚠️ The dispatch brief expected this fix to land in
`.github/workflows/publish-smoke.yml` and warned that such a PR cannot
be armed by the PM seat (HTTP 422, token lacks `workflows`). **That
premise does not hold** — the probe lives in `scripts/publish-smoke.sh`,
the workflow's driver script, and the workflow YAML contains no
assertion at all. This diff touches no path under `.github/workflows/`,
so that caveat does not apply to it. It also touches no governed surface
under Prime Directive objectstack-ai#14.

No changeset: the changed file is a CI driver shipped by nothing.
Measured rather than assumed — the root package is `private: true`, and
of the 70 package manifests declaring `files[]`, zero name this path.
The `skip-changeset` label carries that, not this sentence.

---
_Generated by [Claude
Code](https://claude.ai/code/session_012GKcPZbMoGq7WPzKLfRBTU)_

Co-authored-by: Claude <[email protected]>

… the shipped 401

#17881 (374d9d3) moved the anonymous `GET /api/v1/auth/get-session` wire
answer from `200` + the literal `null` to the declared ADR-0112 refusal
envelope (401, `UNAUTHENTICATED`). Three present-tense statements in the SDK
and one test double still described the retired shape.

- `normalizeSessionResponse`'s `/auth/*` wire table no longer lists the
  anonymous `200 null` row among the bodies the helper is handed; the current
  answer is stated separately, with the reason it never reaches the lift.
- The closing `!body`-guard paragraph no longer claims that guard carries the
  anonymous answer.
- `auth.me()`'s docblock says the anonymous call REJECTS rather than resolving
  outside the declared type.
- `organization-get-active-member-addressing.test.ts`: the `signedIn: false`
  leg modelled an answer the runtime stopped producing, so it could not fail
  for the reason it existed. The double now serves the refusal envelope and
  case ⑥ pins that the refusal arrives on request ONE, discriminating on the
  code (`UNAUTHENTICATED` vs `list-members`' `UNAUTHORIZED`).

Claude-Session: https://claude.ai/code/session_01DvvamiacK328idtBYJBxV3
Co-authored-by: Claude <[email protected]>

…usal envelope

The five sites in `docs/qa/platform-checklist/areas/identity-auth.json` that
taught better-auth's retired no-session convention (HTTP 200 + a JSON `null`
body) were inverted by #17238/#17881: `refuseAnonymousSession` now converts
that answer into `401` + `UNAUTHENTICATED` in the ADR-0112 refusal envelope.
A runner following the file scored the correct implementation as defective,
and the remedy the negative pointed at was undoing an auth tightening.

Four instructional sites re-pointed (the step, clause 5's verify, the third
negative, the evidence row). `revision 3` is left standing and unedited --
it records what the August judgement rested on -- and a new `revision 6`
states that its cited authority was inverted afterwards.

Measured on this checkout rather than relayed: live session 200 with
{ user, session }; after revoke-sessions, 401 UNAUTHENTICATED; fresh-manager
control still 200. The refusal covers the REVOKED path, not only the
never-signed-in one, because the seam keys on the answer shape.

Claude-Session: https://claude.ai/code/session_01DvvamiacK328idtBYJBxV3
Co-authored-by: Claude <[email protected]>