Repository navigation
QA run · touched:8e3d4a54 (25/52) · c4196099 · 2026-11-13 · 22 PASS / 1 PARTIAL / 2 FAIL / 0 BLOCKED / 27 NOT-RUN #33093
Description
qa#3 · os-tesla · session_01L9qibw6yXcLi9aRRBpPT4W
Slice C-browser of qa#3's round 2 part C: the delta 8e3d4a5 → c419609, mixed/browser surface, 25 of 52 items; C-api is #33092.
Environment fingerprint
- Framework
objectstack-ai/objectstackmain @c4196099, the release tip, built in its own git worktree beside part A's 8e3d4a5 tree so neither run touched the other:pnpm install --frozen-lockfile,pnpm build --concurrency=2,pnpm console:build(✓ @objectstack/console dist ready (85560 KB) from ui/apps/console), showcase compiled once (10:02–10:13Z). Delta on top of 8e3d4a5: c419609 (fix(plugin-auth): a directory deactivation revokes the user's API keys, and no one restores them #33075), b232220 (fix(plugin-form): the modal and drawer record forms save a picked permission-set holder's package; pin the create form's seed rules #32931), 9df85e1 (feat(approvals): a submitter's agent can recall and resubmit its own approval request over MCP (#32993) #33076), e003ebb (fix(automation): a flow's answer also names the read-only fields its map items and resumed subflow children dropped (#33019) #33068), d60a0de (pm tooling, no product surface). - Boots
objectstack dev --ui --seed-admin --no-compile --no-watch -p PORT -d file:/tmp/qa3/C/<runner>/<db>withOS_PORT/OS_STORAGE_LOCAL_ROOTexported, stopped by process group; vite console dev servers on their own ports; installs and scratch plugins from scratch copies symlinked to the c419609 tree;examples/app-showcase/.objectstack/installed-packagesabsent andgit statusclean at the end. Ports 41300–41359. - Special boots: a SCIM-enabled boot (
OS_SCIM_ENABLED=true, credential minted throughadmin/scim/mint-credential); phone + two-factor on, andNODE_ENV=productionwith phone on (SMS_SERVICE_REQUIRED); zero-user with sign-up disabled; walledisolatedinvite-only andgroup; a scratch copy registering a local OIDC provider throughapplyConfigPatchwithOS_SSO_ENABLED=trueand its origin inOS_TRUSTED_ORIGINS, beside a local SMTP sink;OS_OIDC_PROVIDER_ENABLED=false; open audience posture withmember_default(email verification); a default boot and a scheduled-work-on boot of a scratch copy (flow-status). - Execution: Tier 1 pins run centrally at c419609 (sequential vitest
--maxWorkers=1, 6 groups): 605 tests, 0 failed, 0 skipped. Tier 2 by 3 runner subagents (effort high): approvals/automation/forms/studio (9), identity-auth (9, fix(plugin-auth): a directory deactivation revokes the user's API keys, and no one restores them #33075 first), identity-auth (7). - Container restart at ≈10:21Z (the machine was reclaimed; files restored from checkpoint). Every live boot ended; runners resumed at 10:28Z, re-booting on the same DB files where they reused one (noted per item — the dynamic-approver-routing paused run survived and was decided on the second boot). No clause is scored on a half-run leg.
- Timestamps (UTC): build 10:02–10:13; pins 10:14–10:17; runners 10:14–10:53 (setup ≈14 runner-minutes, testing ≈84 runner-minutes, ≈10 lost to the restart).
Scope
Selector touched:8e3d4a54 at c419609 → 52 items; this record is the 25 of items-C-browser.md. Revisions (all equal to the resolver's): inbox-metadata-actions 8 · dynamic-approver-routing 6 · record-page-decisions 5 · flow-node-type-matrix 14 · flow-error-handling 7 · flow-reference-package-resolution 2 · phone-signin-surfaces 3 · auth-method-matrix 10 · admin-lifecycle-operations 10 · session-list-revoke 4 · api-key-ui-lifecycle 5 · self-service-profile-password 3 · org-membership-team-management 6 · oauth-app-consent-loop 3 · linked-accounts-social 5 · identity-import-wizard 3 · first-run-owner-bootstrap 5 · self-signup-gate 8 · email-verification-loop 6 · workspace-org-switch 6 · implicit-account-linking-ownership 5 · sso-provider-groups-claim 1 · flow-connector-picker 5 · form-dirty-guard 7 · flow-status-matches-runtime 5. No P0 item in this slice.
Derived item verdicts
| verdict | items |
|---|---|
| FAIL (2) | approvals.record-page-decisions (A4, stale spec — existing re-point card card-p2-1.md) · studio-authoring.flow-status-matches-runtime (A1, stale spec — existing re-point card card-browser-5.md) |
| PARTIAL (1) | identity-auth.auth-method-matrix (N2 blocked(dependency): magic-link and passkeys have no UI, objectui#4179 closed not_planned; the S4 SSO half and S5 device variant blocked(environment) as knownGaps) |
| PASS (22) | every other item |
The delta, driven live
- fix(plugin-auth): a directory deactivation revokes the user's API keys, and no one restores them #33075 (c419609) — a directory deactivation revokes the user's API keys, and no one restores them: holds. SCIM credential minted (
Cache-Control: no-store); users provisioned throughPOST /api/v1/auth/scim/v2/Users(source: idp_provisioned), given a local password, each minting keys that read 200. Five deactivation spellings — SCIM PATCHactive:false,DELETE /Users/{id}, PUTactive:false, Azure-style pathless PATCH{active:false}, and the string"False"— each stamp every key rowrevoked:true, revoked_reason: scim_deactivated(an owner-revoked key is restamped) and the next request is refused 403API_KEY_REVOKED(the ruled [Decision] API key 的生命周期与存放：到期上限与不活动失效取多长，key 继续放自有 sys_api_key 还是迁到 @better-auth/api-key（#23287 裁决 C′ 的留项） #23367 shape; only an unknown key is 401) naming the new-key road; every session row is deleted, the old bearer reads 401, sign-in answers 403BANNED_USERdetails.cause: scim_deactivated. Re-activation (SCIM PATCHactive:true, a SCIM re-POST re-linking through the tombstone, andimport-usersupsert) lifts the ban only: every old key stays revoked. Every restore door refuses — owner and adminrestore_api_key403, owner and admin PATCH{revoked:false}(with or withoutrevoked_reason:null) 403,revoked_reasonnot editable 403,service-account/restore-key404. A later admin set-user-password restamps only unrevoked keys (admin_password_reset) and leavesscim_deactivatedrows as they are. A key minted after re-activation reads 200 and only the owner's rows; two other users' keys read 200 after every step. Control: an admin ban does not share the revocation (by design per the commit) — the key reads 401 while banned, its row staysrevoked:false, and it works again after unban. A wrong SCIM bearer and a member's session bearer are both 401. - feat(approvals): a submitter's agent can recall and resubmit its own approval request over MCP (#32993) #33076 (9df85e1) — MCP recall / resubmit by the submitter's agent: holds.
list_actionslists approve/reject/reassign/send_back/recall/resubmit on sys_approval_request, each aiExposed and requiresConfirmation. Recall: non-submitter unconfirmed 428 ACTION_CONFIRMATION_REQUIRED, confirmed 403 "Only the person who submitted this approval request can recall it…" (still pending, no action row); submitter unconfirmed 428 (nothing recorded), confirmed → recalled with exactly one [recall, Mei] row. Resubmit on a returned request: non-participant 404 REQUEST_NOT_FOUND; submitter unconfirmed 428, confirmed → round 2 pending, the run completes after approval; a participant on another pending request: resubmit 409 INVALID_STATE, recall 403. - fix(automation): a flow's answer also names the read-only fields its map items and resumed subflow children dropped (#33019) #33068 (e003ebb) — the flow answer names read-only fields dropped in map items and resumed subflow children: holds. On invoice
tax_rate(readonlyWhen on paid invoices): the map answer carriesdroppedFields [{object: showcase_invoice, fields: [tax_rate], reason: readonly_when}]folded once, value unchanged; a resumed subflow child carries the same entry whether the resume names the parent or the child run id, and the parent's subflow step carries it; a draft-invoice control has no droppedFields member. (A static readonly write is refused at registration, 422 flow-update-readonly-field, so the probe needs a readonlyWhen field.) - fix(plugin-form): the modal and drawer record forms save a picked permission-set holder's package; pin the create form's seed rules #32931 (b232220) is plugin-form's modal/drawer holder pick; no C-browser item drives it directly beyond form-dirty-guard (pins green, live legs pass). The C-api slice carries its items.
Fails — reproduction rule and disposition
approvals.record-page-decisions · A4 — stale spec, existing re-point card card-p2-1.md (unchanged since ee9ad83). A contributor-bound member who reads project tyLQ-4kFq15pIZCu but is not a participant of its pending exec_review request: POST /api/v1/approvals/requests/areq_e4d9df94…/approve {} twice → 404 {"code":"REQUEST_NOT_FOUND"}, request stays pending; the clause expects 403 FORBIDDEN. The read gate holds (the member's approvals read is empty, the page draws 0 declared actions); the override-menu half passes.
studio-authoring.flow-status-matches-runtime · A1 — stale spec, existing re-point card card-browser-5.md. A writable package's schedule flow (interval 60000) on a default boot: _status reason "disabled by deployment policy — …" with unboundCause: deployment_policy; the rail and header titles read the console's worded sentence ("This deployment keeps scheduled work that comes with a package switched off…") and the verbatim reason is the Problems note's hover title, by design in describeFlowRunStatus (flow-problems.ts). Two page loads.
Off-clause probes (rule 8)
Each runner kept a probe budget after every item (2–10 min, the #33075 and #33076 drives inside it); per-item minutes and doors are in the probe log (record-C-browser-clauses-1.md). No product defect found; no card drafted.
Observed and not carded (low, for the seat to weigh): a cross-user unlink by a caller holding a single account answers FAILED_TO_UNLINK_LAST_ACCOUNT (the last-account check runs before ownership — misleading wording, row untouched); cross-user OAuth get-consent / delete-consent answer 401 rather than 403/404; an import-users upsert overwrites a directory-managed user's name; setting a SCIM user's password moves sys_user.source from idp_provisioned to env_native; on the unbound schedule flow the header enable switch is green "Switched on" beside "Not running here"; a flow authored status:'draft' is enabled and bound (by design per the boot log — "Created Off" means obsolete); approval / wait / screen steps log success while the run reads paused; an OIDC provider's overflow menu also offers "Edit SAML Settings"; the admin revoked sessions view keeps the subtitle "Active user sessions". An operator-registered OIDC provider asserting a verified address implicitly links and signs in to that user, platform admin included — the item's A1 design (a trusted provider vouching for a verified address), recorded, not scored.
Parked-on #32908
Fixture gaps: SSO just-in-time sign-in plus SCIM deactivation (SCIM adopts an SSO account only on a verified domain, which needs a DNS TXT record — OS_SSO_DOMAIN_VERIFICATION); the auth-method-matrix S4 SSO half and S5 device variant; magic-link / passkeys UI (objectui#4179 not_planned); users from admin create-user carry PASSWORD_RESET_REQUIRED on every data read until they change their password — fixtures should say to clear it; a local OIDC provider needs its origin in OS_TRUSTED_ORIGINS (else 400 SSO_REGISTER_FAILED "not publicly routable"); the showcase self-ping connector dials :3000 on a --no-compile boot (flow-node-type-matrix connector ping).
Per-item checklist-accuracy notes follow.
approvals.inbox-metadata-actions
- A1.verify: "the dev admin on that same pending request shows 'Override Recall'" holds only once the admin's own slot on EXP-2001 is spent (the fixture routes the admin's manager group there); with the slot open the label is plain "Recall" (approvalOverride.ts isOverrideDecision, override-only viewer). Measured both states.
- A3.verify names /api/v1/approvals/requests/:id/approve|remind as the click's network literal; the console posts /api/v1/actions/sys_approval_request/approval_* (action door, objectstack#27611), which forwards to that route. Stale literal, not a defect.
approvals.dynamic-approver-routing
- S3 says the inbox row navigates to /apps/APP/sys_approval_request/record/ID: confirmed (APP = com.example.showcase).
- The run's step log shows co_sign [approval] with status 'success' while the run reads 'paused' (both chains). This was noted, not scored: the clause reads run status, which is correct.
approvals.record-page-decisions
- S5/S6/A1/A2 name POST /api/v1/approvals/requests/:id/reject|approve as the wire. The bar posts the action door POST /api/v1/actions/sys_approval_request/approval_reject|approval_approve, with recordId = the request id and the comment under params.comment. Stale literal; the substance holds.
- S2 "capture the read the bar ran on: GET /api/v1/approvals/requests?object=…&recordId=…": on first load the approvals arrive inside POST /api/v1/data/showcase_project/:id/page. The GET fires on the post-decision refresh. Read the viewer block directly.
- S9's example budget (200000 on a fourth project) can trip the showcase's 120%-of-spend validation rule on Data Platform (spent 420000), which answers 400. Pick a budget above spent/1.2.
- The member's page logs 404 GET /api/v1/meta/object/sys_business_unit and /sys_comment_reaction. This is not scored (same class as the A non-admin approver cannot open an approval request: GET /meta/object/sys_approval_request answers 404 since #32428, so the inbox row, ?request= links and the record panel lose Approve/Reject #32955 family, already known from earlier rounds).
automation.flow-node-type-matrix
- S8 composite run screenshot (Studio Runs tab, showcase_fan_out_notify run_8e24b4c8): 'Failed', run-level error "Node 'fan_out' failed: parallel 'fan_out': branch failed — …", 'FAILURE Notify in parallel PARALLEL', nested '↳ BRANCH 1 SUCCESS Notify Owner NOTIFY' and '↳ BRANCH 2 FAILURE Slack Notify HTTP … ENOTFOUND hooks.slack.com'.
- showcase_declarative_connector_ping (fired by every task create) fails
connector_action(showcase_status_api.request) failed: fetch failedon this --no-compile boot: its frozen base URL dials :3000, which matches the known environment note. Not scored; connector_action was proven on two other connector flows. - The bogus-node trigger answers HTTP 400 with success:false. The clause names only success:false, which holds.
- The run step log records approval/wait/screen steps with status 'success' while the run is 'paused' (e.g. dynamic approval co_sign, hold [wait]). The suspension is read from run status, as A2 does.
identity-auth.phone-signin-surfaces
- On the OFF boot the Email label carries "*" (required). On ON it does not, because a phone can stand in for it ("Required when no email is given"). This is consistent with the product.
identity-auth.auth-method-matrix
- /auth/config wraps its payload in
data({success, data:{emailPassword, features…}}). The steps readfeatures.*as top level. - Also served under the prefix: GET /api/v1/auth/.well-known/openid-configuration → 200. A8 says the documents are "mounted at app root, not the /api/v1/auth prefix". Both answer, and the root one is the RFC location. This is a note only.
- On a dev boot, phoneNumberOtp is advertised true with no SMS service (the log transport). S3 already explains this.
identity-auth.admin-lifecycle-operations
- During impersonation, the admin's ORIGINAL bearer answers 401 on get-session and on data reads. The held session is refused, so a second admin session was needed to read sys_session.impersonated_by. S9 could say so.
- S10's "a throwaway that OWNS a showcase row": showcase_task needs
project(400 VALIDATION_FAILED otherwise). - On the single posture, create-user answers membershipCreated:false even though the user lands in the Default Organization's member list. That is the bootstrap join, not create-user's.
identity-auth.session-list-revoke
- A0's "BOTH of A's sessions" assumes A holds exactly two. Here, user setup (create-user, then a forced change-password needing a sign-in) left A extra live sessions, so the count was 5, all A's own. Either start from a user with no prior sign-ins, or read the clause as "A's sessions only".
- The admin
revokedview keeps the object's subtitle "Active user sessions" and the "Sign out other devices" toolbar button. This is cosmetic.
identity-auth.api-key-ui-lifecycle
- S4/S5 call the row action a
PATCH … bodyExtra {revoked:true}. The console's row action actually posts to POST /api/v1/actions/sys_api_key/revoke_api_key (and restore_api_key) with {recordId, params:{}}. The PATCH door also works, and both were driven. Re-spell the step, or name both doors. - A user made by admin/create-user is mustChangePassword:true, so every data read answers 403 PASSWORD_RESET_REQUIRED until change-password. The fixture should say to clear that first.
- Off-clause: the row menu offers "Edit" on sys_api_key, yet a PATCH of
nameis refused 403 "None of the submitted fields (name) are editable … Editable fields: revoked". This was not opened in the UI form, so it is a note only.
identity-auth.org-membership-team-management
- S6 says remove-member revokes the live sessions. Measured: the old session answers 401 at once, with reason organization_membership_ended. The step is correct.
- A1's "the gated operation" is not named. invite-member worked as a discriminator for member ↔ admin. Suggest naming it.
identity-auth.oauth-app-consent-loop
- create-client's default grant_types is [authorization_code] only; A3's "access/refresh tokens" needs grant_types including refresh_token AND the offline_access scope at authorize. Without them the token answer has no refresh_token. The step could say so.
- Cross-user get-consent / delete-consent answer 401 (not 403/404); a refusal either way, noted only.
identity-auth.linked-accounts-social
- The UI unlink goes through the action door POST /api/v1/actions/sys_account/unlink_account (which reaches the auth unlink), not a direct POST /auth/unlink-account from the browser; the step text names the latter. The direct door also works (implicit-linking run: 200 {status:true}).
- Fixture: a real social provider still needs real client credentials; the local OIDC provider stood in (as rev 5 records).
identity-auth.identity-import-wizard
- The wizard's default match mode is "Always create new"; S4's upsert needs the operator to pick "Update if matched, else create" and tick Match on: Email (the Import button stays disabled until a match field is chosen). The step could say so.
- An insert-mode import of an existing email answers row error "User already exists. Use another email." (IMPORT_ROW_FAILED) inside a 200. That is correct, recorded for the item's negatives.
identity-auth.first-run-owner-bootstrap
- Same as the earlier run: S5 says "two document loads, to /_console/ and then /_console/home", but both document requests were /_console/, and /home is a client route after the reload. The contract (a full-document exit) holds.
identity-auth.self-signup-gate
- As before, the invitation card heading is "Dev Admin invited you to join Default Organization", not "Accept your invitation". The link is as described.
identity-auth.workspace-org-switch
- A5's "the UI surfaces an error" has no UI path: the forged call is API-only, and after it the console shows the organization picker (no active org), not an error. Scored on "never the foreign org".
- The admin persona note says the walled admin "starts with none"; at c419609 the seeded admin already holds a "Default Organization" on a walled boot. create-user still needs the admin's active org set to the intended one.
- A3's group write needs a project in the new org (showcase_task.project is required); the member's own org is seeded, so a Beta project exists.
identity-auth.sso-provider-groups-claim
- fixtures.knownGaps is right that the issuer must be reachable; a local IdP additionally needs its origin in OS_TRUSTED_ORIGINS (the register door refuses a loopback discovery URL otherwise). Worth adding to the item's requires.
- Observed: the OIDC provider's overflow menu also offers "Edit SAML Settings". Not scored; cosmetic.
integration-system.flow-connector-picker
- A fixture flow for POST /api/v1/automation must declare a
connectorConfigblock on the node (connectorId/actionId/input). Aconfig:{connectorId…}form is refused 422 INVALID_METADATA "aconnector_actionnode requires aconnectorConfigblock". The item's fixture text does not say this. - By design (connector-input-fields.ts), the typed form shows no required asterisk for echo_upper's
text, though the JSON-Schemarequiredlists it. Noted so A2's "input fields match inputSchema" is not read as a gap.
records-forms.form-dirty-guard
- The tab-reload beforeunload leg (S1's aside) was not driven (it is a native prompt; the pin's describe.each covers it at the component layer).
studio-authoring.flow-status-matches-runtime
- A flow authored over the API with
status:'draft'is enabled and bound (_status {enabled:true,bound:true,status:'draft'}) and fires on a create (run_fcc42d7c). That is by design: the boot logs "draft flows still fire their triggers; set status: 'active' … or 'obsolete' to disable". "Created Off" therefore meansstatus:'obsolete'; that is what the Studio switch writes (StudioDesignSurface toggleEnabled: active ↔ obsolete). The fixture text should say so for API authoring. - On the default boot, the schedule flow's header shows the enable switch green, labelled "Switched on", beside "Status: Not running here". The switch reflects
enabled(true, which _status agrees with); the status word and the dot carry the binding. I do not read it as N0's "green On", but a reader of N0 could, so the clause could name the status pill and dot as the surfaces it means. - The launch entry showcase-scheduled-work-3778 has its own fixed port; this run used the same environment on runner port 41303.
Activity
objectstack-fleet commentedon Nov 13, 2026
qa#3 · os-tesla · session_01L9qibw6yXcLi9aRRBpPT4W
Probe log (rule 8)
list_actionslists approval_approve/reject/reassign/send_back/recall/resubmit on sys_approval_request, each aiExposed:true requiresConfirmation:true. On EXP-2001 (submitter Mei): Ada (non-submitter approver) run_action approval_recall unconfirmed → ACTION_CONFIRMATION_REQUIRED 428 "nothing was run"; confirmed → FORBIDDEN…multiple: true)"; ['usr_nope'] → 400 "'usr_nope' names no user. Nothing was recorded…"; an undeclared extra key in outputs → 400 "decision output key(s)bogusare not declared on this node"; re-approving a finalized request → 409 INVALID_STATE …error=account_not_linked, no session (provider-side gate). (2) IdP asserting email_verified:true for admin@objectos.ai (verified) → implicitly links and signs in as the admin. That is A1's designed behaviour (an operator-configured provider vouching for a verified address), recorded, not a finding. Note: probe (2) …status:"draft", and Studio's header still reads "Switched on" with the toggle on. _status agrees ({enabled:true, bound:false, status:"draft"}), so Studio and runtime say the same thing. I did not pursue it further (enabl…Per-clause tables
approvals.inbox-metadata-actions · rev 8 · PASS
approvals.dynamic-approver-routing · rev 6 · PASS
{}→ 400 VALIDATION_FAILED "decision output(s)next_reviewersare required to approve this request…";{"outputs":{"next_reviewers":[]}}→ same 400; action doo…approvals.record-page-decisions · rev 5 · FAIL
automation.flow-node-type-matrix · rev 14 · PASS
end:skippednot used). create_record: showcase_inbound_task_webhook run_289512f1 create_task success (signed t=,v1= hook → 202). update_record + screen: showcase_reassign_wizard run_429c96cf collect / …automation.flow-error-handling · rev 7 · PASS
automation.flow-reference-package-resolution · rev 2 · PASS
call, and qa_env_child had 0 runs a…callboth before AND after qa_b's dependency change (still 400 naming the environment after the 1.0.1 reinstall); qa_env_child's only run is the direct door triggeridentity-auth.phone-signin-surfaces · rev 3 · PASS
identity-auth.auth-method-matrix · rev 10 · PARTIAL
identity-auth.admin-lifecycle-operations · rev 10 · PASS
identity-auth.session-list-revoke · rev 4 · PASS
tokenfrom list-sessions → 200 {status:true}. device-2's protected GET /data/showcase_task → 401, …all_sessions(screenshot): User column present, 8 live rows. The read is filtered revoked_at is_null, and the users cover A, B and the admin.revokedview (screenshot): User / IP Address / Revoked At / Revoke Reason / Created At, 5 rows for "sa", each revoke_reason user_revoked and revoked_a…identity-auth.api-key-ui-lifecycle · rev 5 · PASS
{data:{id:IVROUu0C-palhqEX,name,prefix:"osk_z9Xt8oaJ",key:"osk_z9Xt8oaJ…(full)",expires_at…}}. GET /data/sys_api_key/{…{"error":{"code":"API_KEY_REVOKED",…}}, no records key. Also driven by the item's literal door: PATCH…all_keys(no filter) lists the key with Owner "kowner". Also server-side: kother's unfiltered GET /data/sys_api_key lists only its…identity-auth.self-service-profile-password · rev 3 · PASS
identity-auth.org-membership-team-management · rev 6 · PASS
identity-auth.oauth-app-consent-loop · rev 3 · PASS
error=access_denied&error_description=User denied access, no code; get-consents unchanged (same id, scopes without the added one)identity-auth.linked-accounts-social · rev 5 · PASS
identity-auth.identity-import-wizard · rev 3 · PASS
identity-auth.first-run-owner-bootstrap · rev 5 · PASS
objectstack-fleet commentedon Nov 13, 2026
qa#3 · os-tesla · session_01L9qibw6yXcLi9aRRBpPT4W
Per-clause tables (2)
identity-auth.self-signup-gate · rev 8 · PASS
identity-auth.email-verification-loop · rev 6 · PASS
identity-auth.workspace-org-switch · rev 6 · PASS
identity-auth.implicit-account-linking-ownership · rev 5 · PASS
/_console/login?qa=err&error=account_not_linked&error_description=An account with this email already exists and its email address is not verified…; get-sessi…error=account_not_linked&error_description=This sign-in method was unlinked from the account. Sign in another way and link it again…; get-session 401; sys_account(U) still credenti…?qa=ok, get-session U. W (unverified, invited sign-up) explicit link-social → W's own row…identity-auth.sso-provider-groups-claim · rev 1 · PASS
{"providerId":"qa-sso","groupsClaim":null}(exactly two keys); {providerId:nope} → 404 RESOURCE_NOT_FOUNDSSO provider "nope" was not found.mapping.extraFields.groupsadded; set {groupsClaim:""} → 200 groupsClaim null; get → null; stored oidc_config before vs after-clear: 0 differing members (issuer, cl…{"code":"PERMISSION_DENIED","message":"Admin role required"}; set-groups-claim {groupsClaim:"pwned"} → 403 same body; admin read-back unchanged (null)Edit Sign-In Options · Edit SAML Settings · Edit OIDC Settings · Show Groups Claim · Edit Groups Claim · Show Attribute Mapping · Edit Attribute Mapping; Show Groups Claim (Provider ID prefilled qa-sso) → POST /api/v1/actions/sys_sso_provider/show…mapping:{email:"x"}on set was ignored (email mapping still "email")integration-system.flow-connector-picker · rev 5 · PASS
records-forms.form-dirty-guard · rev 7 · PASS
studio-authoring.flow-status-matches-runtime · rev 5 · FAIL
objectstack-fleet commentedon Nov 13, 2026
qa#3 · os-tesla · session_01L9qibw6yXcLi9aRRBpPT4W
Close-out 2026-11-13T10:59Z.
Extracted: #33060 · approvals.record-page-decisions · acceptance[4]
Extracted: #33054 · studio-authoring.flow-status-matches-runtime · acceptance[1]
Parked-on: #32908 · checklist-accuracy notes and fixture gaps of this slice
objectstack-fleet commentedon Nov 13, 2026
qa#3 · os-tesla · session_01L9qibw6yXcLi9aRRBpPT4W
Closed 2026-11-13T11:00Z: the c419609 browser delta is judged, two stale specs on existing cards; close-out above.