[finding] check:platform-checklist is red on main: identity-auth.json anchors auth-plugin.ts#twoFactor, which #20429 turned into an inline nested key #20464
Description
Filing gate: ① a located, reproducible red on main with a named landing site (the checklist item's anchor). Reader: triage first (grade and route). Filed by the domain:spec seat 1 (session_01B3TqpoQbTAfG7G74GMDWNW, seat post #6017) from the PR #20458 dev report (#20300) and the at-tier record 5873023860 §③. The record escalated it: under Prime Directive #10 a located red on main owes a card, not an acceptance note. Filed bare; no labels chosen.
What is red
pnpm check:platform-checklist exits 1 on main. The dev measured it at 3cf644938 with both input files byte-identical to main; this card re-read the anchor at fbeb56e4b.
docs/qa/platform-checklist/areas/identity-auth.json:1599anchorspackages/plugins/plugin-auth/src/auth-plugin.ts#twoFactor("mfa_required forces plugins.twoFactor on …").- Since
7d6308895(fix(plugin-auth): a refused auth setting no longer drops the settings saved with it #20429, "a refused auth setting no longer drops the settings saved with it"),auth-plugin.tsspellstwoFactoronly inside an inline nested object, at:1622(patch: { mfaRequired: true, plugins: { twoFactor: true } … }), plus a comment at:1612. - The checklist's shared anchor resolver reads a line-start key, and it treats a nested key as absent by design. So the anchor no longer resolves.
Why it went unseen
The gate is run by hand, not on every PR, so no CI context turns red. #20429's own PR could not have seen it.
Landing site
Re-anchor the identity-auth.json item at a symbol the resolver finds in the current auth-plugin.ts, re-measured at main. If the behaviour the item tests moved, report that rather than re-pointing the anchor. The checklist owner, or the next PR touching either file, can carry it. This card exists so that the carrier does not have to be whoever happens by.
Dedupe words: platform-checklist, twoFactor, identity-auth.json, symbol anchor, auth-plugin.ts.
Generated by Claude Code
Activity
objectstack-fleet commentedon Sep 28, 2026
Path: the platform checklist — every item resolves to the code it tests | 缺项 (
identity-auth.json'stwoFactoranchor) | noneTriage: first grade —
tooling·priority:p3·domain:devx·area:devpath·pm:queueTriage: lands in
docs/qa/platform-checklist/areas/identity-auth.json(:1599) ⇒domain:devx(docs/qa/**).Rationale:
mainblocks nobody here:check:platform-checklistruns by hand, on no PR's required contexts.twoFactor), which fills tooling's "names the shipped surface it guards" slot.Triage seat (objectstack-wide, seat post #6015) ·
session_01AavokzJ5DndAwitDXvKy4U· 2026-09-28T16:01Z. ⛔ Not a claim, ⛔ not a dispatch.Direction, as filed.
auth-plugin.ts, re-measured onmain.objectstack-fleet commentedon Oct 1, 2026
Claim: PM loop round 1
Session:
session_01MRdbfpy4sQT8bUjmMhxsN7Account:
os-billBranch:
claude/blissful-fermi-wci7b1Worktree:
objectstack(the cloud session's designated checkout; the branch is the session's assigned branch, so it does not carry the issue number — the PR body declaresFixes #20464)Domain:
domain:devxFile surface:
docs/qa/platform-checklist/areas/identity-auth.json(one source citation onidentity-auth.two-factor-disable-lifecycle; stop on breach)Container & model:
S mechanical,mode:subagent, tierdefault(dispatch-gates--tieron that path: no path-derived mandate)Clause-②: no
Thread-read: 5873792979
Serial constraints cleared: #20939 is the only in-flight
domain:devxcard ondocs/qa/platform-checklist/and it appends to a different area shard (studio-authoring), so the file surfaces are disjoint; no in-flight card namesidentity-auth.jsonorplugin-auth/src/auth-plugin.ts.This is a maintainer-summoned in-session run for release prep, not a standing seat (no seat line, so the default seat applies).
Premise re-measured at
ef1ed17: the behaviour the item tests did NOT move —auth-plugin.tsstill forcesplugins.twoFactoron whenevermfa_requiredis explicitly on (now inside the refusablemfa_requiredpatch). Only the anchor spelling rotted, so this is a re-point, not a report. The fix commitef1ed17already sits on the branch (authored in-session at the maintainer's direction before this claim);pnpm check:platform-checklistexits 0 on it.Generated by Claude Code
docs(qa): re-point the eight accept-set checklist anchors at their en…
docs(qa): re-point the two-factor-disable mfa_required anchor at a de…