QA run · identity-auth (20/28) · 5b14b7f3 · 2026-10-19 · 18 PASS / 2 PARTIAL / 0 FAIL / 0 BLOCKED / 8 NOT-RUN #24538

Environment fingerprint

• framework: 5b14b7f3ad8e2e0786d228772f473d07b36b2477 (objectstack-ai/objectstack main, detached, not pulled)
• console: .objectui-sha = 4016370af3c9c9dafec2bc5299afd8e8079701b8, built with pnpm objectui:build; dist stamp matched the pin
• app: examples/app-showcase, OS_PORT=P objectstack dev --ui --seed-admin -p P -d file:/tmp/qa18/RUN/data.db — every runner its own port (472xx) and file DB; per-item extra env recorded in the run scratch
• seed: --seed-admin (admin@objectos.ai) + showcase demo personas; members minted via admin create-user / invite-then-signup
• date: 2026-10-19 (UTC); runner: checklist-test card of the 18.0 release QA wave (dispatch session session_01CfRDy7SuTfUqaTu2AEH2Hi); items driven by parallel runner sub-agents, each on its own port + DB + browser context (Playwright, chromium via /opt/pw-browsers/chromium)
• plan: maintainer-approved option B — Tier 1 (pinned, vitest batch) + Tier 2 (unpinned P0/P1, driven live); Tier 3 (unpinned P2) deferred

Scope

Selector area:identity-auth → 28 runnable items (node scripts/checklist-select.mjs area:identity-auth --json); planned items: none; blocked items excluded by default.

Per-clause verdicts

Tier 1 clauses carry [pin] when the pinned test asserts them (evidence = the vitest batch below), [live] when driven against the boot.

Failures and reproduction rules

None — 0 FAIL.

Checklist-accuracy findings / fixture gaps

For the wave anchor card (not extracted, not edited here).

Checklist accuracy

• identity-auth.auth-method-matrix: discovery documents are ALSO answered under the /api/v1/auth prefix (GET /api/v1/auth/.well-known/openid-configuration 200) — harmless, item only requires the root mount
• identity-auth.invitation-scope-gates: fixtures.requires says 'a multi-org boot'; the stock single-tenancy showcase (multiOrgEnabled:false, features.organization:true) is sufficient — the pin itself boots single
• identity-auth.invitation-scope-gates: pin's first case asserts row count + role, not status pending; status pending was proven live
• identity-auth.admin-lifecycle-operations: UX note (not scored): the impersonation banner names the starting administrator by raw user id ('Started by administrator c9g6…'), not by name/email
• identity-auth.api-key-ui-lifecycle: source[2] says sys_api_key apiMethods ['get','list']; live declaration is ['get','list','update'] (sys-api-key.object.ts:469, userActions.edit + D2 column whitelist) — which is what makes the revoke/restore PATCH answer 200. Citation stale, behavior consistent.
• identity-auth.org-membership-team-management: step 'nav label follows' the rename: nav_organization's label is the static string 'Organization'; what follows the rename is the record page header (and get-full-organization). Suggest rewording to 'the org record page title follows'
• identity-auth.self-service-password-reset: acceptance[0].oracle is "log" but the verify/evidence now read the sys_email row (an api read) — oracle label could be "api".
• identity-auth.two-factor-enrollment-reveal: Clause 0/steps[1] expect the anonymous empty-body probe to answer 400/401; live answers 400 VALIDATION_ERROR (body validation precedes the auth check) — consistent with the clause, just noting the anon probe never reaches 401.
• identity-auth.two-factor-verify-to-activate: fixtures.requires names an in-process ObjectQL system read; an HTTP-booted run can read the same rows from the -d SQLite file directly — worth naming as an accepted alternative rig.
• identity-auth.two-factor-backup-codes: fixtures.requires names an in-process ObjectQL system read; an HTTP-booted run can read the same rows from the -d SQLite file directly — worth naming as an accepted alternative rig.
• identity-auth.two-factor-disable-lifecycle: fixtures.requires names an in-process ObjectQL system read; an HTTP-booted run can read the same rows from the -d SQLite file directly — worth naming as an accepted alternative rig.
• identity-auth.self-signup-gate: step 1 quotes the by-invitation notice as 'Self-registration is not open on this environment…'; the pinned console renders 'Self-registration is not open on this system. Ask an administrator for an invitation.' (data-testid register-by-invitation present, no form) — wording drift only
• identity-auth.auth-gate-held-session-raw-host-families: fixtures say pnpm dev -- --fresh; canonical os dev boot with a fresh -d DB used
• identity-auth.auth-gate-held-session-raw-host-families: MFA hold took ~70s to appear after require_mfa flipped (org-MFA cache TTL) — a runner probing immediately sees 200; poll
• identity-auth.default-organization-boot-invariant: the default-level boot log prints no Default-Organization line, so step 1's 'read the boot log ordering' has nothing to read on os dev; ordering taken from created_at timestamps

Fixture gaps

• identity-auth.auth-method-matrix: clause 0/4: generic-OIDC variant needs the scratch-plugin localhost IdP fixture (not provisioned this run); device authorization needs a custom host; @better-auth/sso half needs a registered provider
• identity-auth.self-service-profile-password: knownGaps says set-initial branch needs an IdP; a passwordless user is provisionable on stock showcase: POST /api/v1/auth/admin/import-users {format:'json',rows:[{email,name}],passwordPolicy:'none'} then POST /api/v1/auth/admin/impersonate-user {userId} for a session (inject session_token cookie + localStorage auth-session-token). Recipe could replace the knownGap.
• identity-auth.self-service-password-reset: Natural expiry (1h window) not waited out; expiry was forced by back-dating sys_verification.expires_at.
• identity-auth.two-factor-disable-lifecycle: The elapsed-stamp branch of clause 5 needs an aged sys_user.mfa_required_at; there is no API to set it, so this run back-dated it in SQLite. mfa_grace_period_days=0 would also do it but gates the (unenrolled) admin too.
• identity-auth.implicit-account-linking-ownership: the live lane needs the local OIDC IdP runtime fixture (QA run · follow-up: 6 previously unrun or published-only items (6/6) · 316be321 + 53021e3a · 2026-10-05 · 4 PASS / 0 PARTIAL / 2 FAIL / 0 BLOCKED / 0 NOT-RUN #21845 recipe: scratch app plugin calling applyConfigPatch({oidcProviders:[…]}) before the first auth request, from a scratch copy of the app); not provisioned in this Tier-1 run — clauses 0/2/3 rest on the pin's end-to-end cases, clause 1's session-identity half is unproven

Handover — items without a verdict

• identity-auth.sso-enforced-first-paint (P2) — Tier 3 deferred by the 18.0 release-sweep plan
• identity-auth.phone-signin-surfaces (P2) — Tier 3 deferred by the 18.0 release-sweep plan
• identity-auth.teams-bu-membership (P2) — Tier 3 deferred by the 18.0 release-sweep plan
• identity-auth.oauth-app-consent-loop (P2) — Tier 3 deferred by the 18.0 release-sweep plan
• identity-auth.linked-accounts-social (P2) — Tier 3 deferred by the 18.0 release-sweep plan
• identity-auth.identity-import-wizard (P2) — Tier 3 deferred by the 18.0 release-sweep plan
• identity-auth.email-verification-loop (P2) — Tier 3 deferred by the 18.0 release-sweep plan
• identity-auth.workspace-org-switch (P2) — Tier 3 deferred by the 18.0 release-sweep plan

Tier 1 evidence — vitest batch (RUNNER rule 6, one command per package, run once for the area)

All files: 0 failed, 0 skipped, 0 todo (grep of each log).

Also run live by the Tier 1 runner (not in the area map): packages/plugins/plugin-security [#3023] exemption test — 1 passed (supports admin-lifecycle-operations clause 5).

Observations (not scored, no card)

• invite-member answers ROLE_NOT_FOUND with a message only and no code field, while update-member-role carries the code (org-membership-team-management clause 2 passes on status + no-row read-back). Relevant to ADR-0112's assert-the-code rule; left for the anchor card.
• After an invited address signs up it is joined to the org, but its sys_invitation row stays pending (no item in this area asserts the accept transition on that path).
• Impersonation banner names the target by raw user id, not display name (UX note).
• An authorization-adjacent observation on an admin-only path was recorded in the runner session and reported to the maintainer channel; it grants no capability an admin lacks and is not scored. Detail withheld pending maintainer.

Run notes

• Authentication / authorization findings: none (0 FAIL in this area).
• Execution: parallel runner sub-agents (5 for this area), each with its own port, file DB and browser context; browser concurrency kept at 3 or fewer.
• Env time for the whole card (install 48 s, framework build ~13 min incl. one self-inflicted concurrent-build race, console build ~16 min) is reported in the wave hand-back.