[finding] content/docs/permissions/authentication.mdx describes bootstrap-status as "any user yet" — imprecise once PR #14352 makes the route answer from the admission gate's predicate #14374

Activity

1. os-sales

   added

   findingRecorded observation — held, not dispatchable until the findings triage round grades itRecorded observation — held, not dispatchable until the findings triage round grades it

   on Sep 2, 2026
2. huangyiirene commented on Sep 2, 2026

   

   huangyiirene

   on Sep 2, 2026 – with Claude

   Collaborator

   More actions

   Triage: duplicate of #14357 — converging there, closing this one. Same file, same two sites, same trigger; #14357 was filed at 03:04:58Z, this at 03:22:42Z, and #14357 was already graded and blocked on #14157 when this arrived. ⛔ Nothing is lost: both of this card's additions are folded into #14357 rather than summarised away.

   What #14357 gained from this card:

   1. PR fix(plugin-auth): gate the dev-admin seed on a LOGIN, not on user rows, and admit its own provisioning call #14352 as the concrete landing, which Published auth docs define bootstrap-status as "does this environment have any user yet" in two places — #14157 changes it to the bootstrap-window question #14357 only knew as "maybeSeedDevAdmin gates on "any sys_user row", but runs at kernel:ready — so any app that seeds people permanently loses the objectstack dev login #14157".
   2. The wording the reviewing seat asked for, adopted verbatim as the fix instruction: state that bootstrap-status reports whether the admission gate's bootstrap window is open — no human user yet; service rows do not count.

   And one correction to this card's ask, checked rather than carried over. This card also asks the fix to state "that in a no-engine composition it reads as bootstrapped". The page already says that and it is still true after the change, so it needs no edit: hasBootstrapWindow() delegates to isBootstrapCreation() (auth-manager.ts:4148), which returns false when no engine is wired, so hasOwner is !false = true — the documented fails-open behaviour survives PR #14352 intact. Adding it would be re-stating a correct sentence.

   The fence you drew is right and is preserved. #14357 keeps domain:devx for content/docs/** and stays a separate card from #14350 (docs/qa/platform-checklist/areas/cli.json), for exactly the reason you gave: different surface, different authoring playbook. ⛔ They are not bundled.

   Both are now pm:queue — #14157 landed, so the drift on both is real rather than projected, and both faces were re-verified on 5c9e40a before release.

   For the future, and offered as a note rather than a complaint: a dedup pass over open cards would have found #14357 here, but search_issues is returning false zeros in this repo right now (recorded as #13326, reproduced again this session against a positive control), so a search-based dedup would have passed vacuously. list_issues with a label filter is the channel that answers.

   ---

   Generated by Claude Code
3. huangyiirene

   closed this as a duplicateof Published auth docs define bootstrap-status as "does this environment have any user yet" in two places — #14157 changes it to the bootstrap-window question #14357 on Sep 2, 2026