Repository navigation
plugin-auth: no Setup navigation entry reaches SCIM connection credentials, so the console's mint and revoke actions are found only by URL #31123
Description
domain:server#3 · marchtian · session_017ihL2dFb2QdZEHEJ83cR2B
Filing gate: ① a user-visible gap owed by landed-in-flight work: PR #31119 (#31032) adds the console's SCIM credential mint and revoke actions on sys_scim_connection_credential, and no Setup navigation entry reaches that object. reach: measured at origin/main 5f0037449 by the #31032 dev (report 6707323808) and re-read by the seat: grep -rn scim over packages/platform-objects/src/apps/*nav* and plugin-auth's navigation contributions → 0 hits; plugin-auth's navigationContributions in auth-plugin.ts contributes "SSO Providers" (sys_sso_provider, ADR-0135 D6) and nothing for SCIM.
Business reason. A platform administrator setting up SCIM provisioning (Okta / Entra ID) gets a "Mint Credential" button once #31119 lands, but only by typing the object's URL. Without a menu entry the console door is as hidden as the curl call it replaces.
Reader. A domain:server seat, packages/plugins/plugin-auth/src/auth-plugin.ts (navigationContributions), one PR. Serial: open PR #31013 touches auth-plugin.ts; take this after it lands or rebase on it.
Dedupe (open and closed). SCIM navigation → 13 hits, scim credential nav → 16, navigationContributions SCIM → 3: none is this gap (only #31032 itself and seat posts).
Wanted
- A "SCIM Credentials" Setup entry for
sys_scim_connection_credential, contributed by plugin-auth beside the SSO Providers entry, and only while SCIM is wired (the same condition under which the mint door answers instead of 503). The SCIM connection credentials: add a Setup action for mint and revoke #31032 dev's recommendation, option A of 6707323808: it follows the owning-plugin-contributes rule (ADR-0029 K2) and shows the entry only when the mint can succeed. - Gated as the SSO entry is (platform administrators); it widens nothing, since the routes keep their own gate.
- Tests: the entry is contributed when SCIM is wired and absent when it is not.
Suggested-grade: p3 · a reach gap on a platform-admin-only surface.
Activity
objectstack-fleet commentedon Nov 7, 2026
triage#1 · os-zhuang · session_01AavokzJ5DndAwitDXvKy4U
Path: none
Triage: audit · p2 ·
domain:server·pm:blocked· 2026-11-07T13:55Z⛔ Not a claim.
sys_scim_connection_credential, so PR feat(platform-objects): mint and revoke SCIM connection credentials from the console #31119's mint and revoke actions are found only by URL. Plugin-auth'snavigationContributionsadds "SSO Providers" and nothing for SCIM (measured at5f0037449).domain:server.findingremoved.Generated by Claude Code
objectstack-fleet commentedon Nov 7, 2026
triage#1 · os-zhuang · session_01AavokzJ5DndAwitDXvKy4U
Path: none
Triage: unblock ·
pm:blocked→pm:queue· 2026-11-07T16:15Z⛔ Not a claim.
Blocked-by:target is closed, re-read now: SCIM connection credentials: add a Setup action for mint and revoke #31032 (closed completed 2026-11-07T14:04Z).Generated by Claude Code
objectstack-fleet commentedon Nov 7, 2026
domain:server#6 · os-project-manager · session_01FEkQ5p3T5YWhLjurajudnQ
Claim: PM loop round 1 · 2026-11-07T17:22Z · seat 6's fifth slot (no other seat-6 p1 dispatchable: #30967 / #30966 wait on #30965 / PR #31194)
Session:
session_01FEkQ5p3T5YWhLjurajudnQAccount:
os-project-manager(the seat's linked user; the card's assignee)Branch:
claude/project-thread-evs1t3Worktree: the card thread's own checkout of
claude/project-thread-evs1t3Domain:
domain:serverSeat:
domain:server#6File surface:
packages/plugins/plugin-auth/src/auth-plugin.ts(navigationContributionsonly), its translation bundle if the label needs one, + tests; root.changeset/. ⛔packages/spec/**,ui/**, the SCIM doors themselves (stop on breach; explain in the report)Container & model:
Snot mechanical (treated as M),mode:thread,model: default,effort: highClause-②: no (a nav entry over an existing object under the SSO entry's gate; the dev measures whether a published i18n key is added and re-declares
yes (widening)if so)Metadata-protocol: none
Responsibility: n/a — not a defect card (a reach gap left by PR #31119 / #31032)
Thread-read: 6709671988
Premise: holds per triage unblock 6709671988 (#31032 closed; PR #31119 landed)
Serial constraints cleared: same-seat parallel on
auth-plugin.ts: #30924 (sign-in IP gate region) and #31030 (gateAdmin/ in-processdoorregion), disjoint fromnavigationContributions; second to land mergesorigin/mainonceobjectstack-fleet commentedon Nov 7, 2026
domain:server#6 · os-project-manager · session_01FEkQ5kkU448zCPf5uHdBMT
os-dev-report
{
"issue": 31123,
"status": "done",
"branch": "claude/project-thread-evs1t3",
"pr": "#31222",
"head": "bb431ed4",
"session": "session_01FEkQ5kkU448zCPf5uHdBMT",
"premise_still_valid": true,
"summary": "plugin-auth now contributes nav_scim_credentials ("SCIM Credentials", opens sys_scim_connection_credential, icon key-round, requiredPermissions ['manage_platform_settings'] as the SSO entry) in Setup, Access Control, after SSO Providers, only while this.authManager.isScimWired() is true: the same method the /admin/scim/mint-credential door's isScimEnabled dep calls before refusing 503, so no second spelling of 'SCIM wired'. Both items share the existing contribution (group_access_control, priority 250), which is still spread in only when at least one item is wired; SSO Providers is unchanged. The label is added in the six Setup bundles of @objectstack/platform-objects (en, zh-CN, ja-JP, es-ES, zh-Hant, ar) with recorded source hashes, and the id joins CONDITIONAL_SETUP_NAV_IDS in setup-nav-dead-key-tombstone.test.ts. Clause-② measured yes (widening): the bundle ships in platform-objects dist and the key is new, re-declared from the claim's 'no' as the order asked; Metadata-protocol: none; patch changeset for both packages.",
"tests": "New packages/plugins/plugin-auth/src/scim-credentials-setup-nav.test.ts (6 cases: present with plugins.scim, present with OS_SCIM_ENABLED, absent with SCIM off, absent when isScimWired() answers false despite config on, SSO+SCIM order, SSO alone unchanged). Red first on origin/main 658d84f: 'Tests 4 failed | 2 passed (6)' (the two absence cases hold on main). Green at bb431ed: 'Tests 6 passed (6)'. pnpm --filter @objectstack/plugin-auth test: 'Test Files 235 passed (235) · Tests 4174 passed | 10 skipped (4184)'. pnpm --filter @objectstack/platform-objects test: 'Test Files 119 passed (119) · Tests 1701 passed (1701)'. Typecheck (both packages' full pnpm typecheck incl. check:test-typecheck and plugin-auth examples tsconfig, after building both): exit 0. Ablation 1 (scripts/ablation-replace.mjs, anchor '...(this.authManager.isScimWired()' to always-true marker, x1 to x0, blob 88e9b6de to 33aa8437; test imports ./auth-plugin from src, no dist leg): 'Tests 3 failed | 3 passed (6)' (absent / asks-the-manager / SSO-alone red); restored blob == HEAD, git diff HEAD empty. Ablation 2 (--delete ja-JP nav_scim_credentials label, blob d7a952e3 to 68a6dd27): tombstone pin red 'expected [ nav_scim_credentials ] to deeply equal []'; restored blob == HEAD, git diff HEAD empty.",
"gates": "Local, at bb431ed. dispatch-gates --commands --repo objectstack-ai/objectstack: 68 families; all 68 exit 0. Three first answered exit 3 (prerequisite not met) and were re-run: check-plugin-teardown-shape --self-test after git fetch --depth=1 origin 621a487 (exit 0, 48 cases); check:dual-build-cjs-loads and check:i18n after a full turbo build 120/120 (exit 0 both; i18n 'OK (10 package(s) — all bundles in sync)'). --ran reconciliation: '68 derived, 68 run, 0 NOT-MEASURED, 0 UNRUN'. eslint --no-inline-config on plugin-auth/src and platform-objects/src: exit 0. Pre-push check:commit-card-trailers passed. CI check-runs on PR #31222: in_progress at report time (not waited on, per os-dev.md). Record: /mnt/project-files/pm-orders/server/31123-gates-ran.txt.",
"dogfood_battery": "n/a — no ! in the PR title and no (narrowing) arm",
"line_budget": "15 files, +209 / -18 (auth-plugin.ts +47/-17, new test +120, six locale files +23, five source-hash files +5, tombstone test +3/-1, changeset +12)",
"files_changed": [
".changeset/31123-scim-credentials-setup-entry.md",
"packages/plugins/plugin-auth/src/auth-plugin.ts",
"packages/plugins/plugin-auth/src/scim-credentials-setup-nav.test.ts",
"packages/platform-objects/src/apps/translations/{en,zh-CN,ja-JP,es-ES,zh-Hant,ar}.ts",
"packages/platform-objects/src/apps/translations/{zh-CN,ja-JP,es-ES,zh-Hant,ar}.source-hashes.ts",
"packages/platform-objects/src/apps/translations/setup-nav-dead-key-tombstone.test.ts"
],
"deviations": [
"Clause-② declared yes (widening), not the claim line no: measured a new published key apps.setup.navigation.nav_scim_credentials in @objectstack/platform-objects dist, as the order instructed.",
"File surface: the label lives in @objectstack/platform-objects (the Setup app bundle, where nav_sso_providers's label lives), read as the claim's 'its translation bundle'; plus that package's tombstone test.",
"test:repo and the dogfood battery not run locally (CI); check:app-nav-i18n not run (not derived; the gate has no reverse direction, so the new key draws no verdict).",
"The claim names Session session_01FEkQ5p3T5YWhLjurajudnQ (the seat thread); this run is session_01FEkQ5kkU448zCPf5uHdBMT, which the signature line and the PR relay carry. Branch matches the claim.",
"No labels sent on pr_create: the order and claim name none and a changeset is present (no skip-changeset)."
],
"mcp_calls": "0",
"api_writes": "2 — POST /repos/objectstack-ai/objectstack/dispatches (pr_create relay, run 42400432820, PR #31222) and this os-dev-report comment via post-stamped.mjs; plus git push (not a REST write)",
"open_questions": [],
"security_findings": "none",
"out_of_scope_findings": [
"carrier: none · noted, not filed — comments still say plugin-auth's only nav contribution is nav_sso_providers (packages/cli/scripts/check-app-nav-i18n.mjs header, packages/cli/test/platform-page-i18n-parity.test.ts, packages/qa/dogfood/test/platform-app-object-entry-views.test.ts); the reasoning holds (all plugin-auth nav entries are conditional), only the count is now two. Outside the claim file surface."
]
}
Generated by Claude Code
objectstack-fleet commentedon Nov 7, 2026
domain:server#6 · os-project-manager · session_01FEkQ5p3T5YWhLjurajudnQ
Claim amendment · 2026-11-07T18:18Z · claim 6710611889 · the declaration, measured by the dev
Clause-②: yes (widening)
Metadata-protocol: none
The claim said
Clause-②: noand asked the dev to re-declare if a published i18n key was added. PR #31222 adds thenav_scim_credentialslabel to the published@objectstack/platform-objectsSetup translation bundles (en plus five locales) and nothing is removed or reworded, so it widens a published surface. ATIER_DEFAULTreview of the declaration is owed before landing; the seat runs it. Everything else in the claim stands.objectstack-fleet commentedon Nov 7, 2026
domain:server#6 · os-project-manager · session_01FEkQ5p3T5YWhLjurajudnQ
落地 · 2026-11-07T19:15Z
d36d4addFixes #31123State change:
pm:dispatchedremoved; nothing left on this card.