refactor(rest): computeExecCtx calls the one request-to-ExecutionContext composition, resolveRequestExecutionContext

[objectstack-fleet]

Part of #23217

Clause-②: no
Ruling-ref: 6227928430

Slice 2 of #23217 under ruling record 6227928430 (letter A): REST's door, RestServer#computeExecCtx in packages/rest/src/rest-server.ts, calls the one resolveRequestExecutionContext that slice 1 landed in @objectstack/core (f5ef054a7). #23217 remains open for three doors (service-settings, service-storage, plugin-hono-server), each a later slice. No export moves and there is no app-author surface.

What changed

• computeExecCtx keeps what is this door's own and calls the function once. 192 lines out, 90 in. What stays at the door, in its old order: the environment and auth-service resolution with the if (!authService) return undefined early return, the header normalisation (append per array element), the engine through wiredEngineOrLoud (the kernel branch still absorbs), the tenancy wiring (now a thunk: the kernel's getServiceAsync('tenancy'), else tenancyServiceProvider, else none), then __kernel, __authEnvironmentId, the Server-Timing disclosure, the memo in resolveExecCtx, and the fail-closed catch with its apiKeyLifecycleRefusals side channel.
• REST's named parameters, each measured against the hand-written code on f5ef054a7 before it was replaced (slice 1's handover, confirmed row by row):

parameter	REST passes	what the hand-written code did
anonymous	'fail-closed'	if (!authz.userId) return undefined and assembleExecutionContext
authGate	'reread-when-active'	a key: authz.authGate. A session: re-read only while isAuthGateActive(); a throwing probe reads as inactive; a failed re-read is AuthzStoreUnavailableError('auth_gate')
credentials	'api-key-and-session'	headers and getSession both handed to resolveAuthzContext
sessionApi	'required'	if (!api?.getSession) return undefined, the API-key door included
session	'request'	api.getSession(inProcessSessionReadInput(headers)), a throw read as no session
tenancy	the thunk above	classifyAdmissionTenancyPosture on the same two wirings
localization	{ settings: () => provider ? seamOrUndefined(provider(env)) : undefined }	the same lookup, then resolveLocalizationContext
requestLocale	this.extractLocale(req)	the same parse, at assembly
accessToken	'withhold'	accessToken: undefined
oauth / onAdmission	undefined / undefined	none

• The readers move with the call.
  • scripts/check-single-authz-resolver.mjs: the rest row of DELEGATORS now names resolveRequestExecutionContext. Left on resolveAuthzContext, check (2) would pass on the five prose mentions of it that remain in the file.
  • packages/core/src/security/authz-store-unavailable.test.ts: rest-server.ts no longer calls resolveAuthzContext({, so its ledger row goes (the set-equality audit requires it). The scanner's positive control now names the composition's file.
  • packages/rest/src/execctx-authz-input-seam-reachability.test.ts §0 and auth-gate-allowlist-fault-window.measurement.test.ts's structural pin read source text inside computeExecCtx. They are re-aimed in place, with the superseded pins quoted, as those files ask. Each still holds its subject: both tenancy wirings reach the classification, the tenancy region holds no catch, the door declares 'reread-when-active' and keeps no second copy of the gate decision, and the call hands over no path. The decision's own window is pinned in core's request-execution-context.test.ts (choice 2). The behavioural drives in both files are unchanged and green.
  • packages/runtime/src/security/request-execution-context.conformance.test.ts (ruling item 4) gains REST as a row. It drives RestServer.resolvePackageRouteExecutionContext on the single-kernel wiring and sets aside __kernel and __authEnvironmentId by name (both asserted absent on this wiring). It has a new request that tells 'resolved' from 'reread-when-active' (the gated session while no gate is active) and a REST CONTROL case. Who a request resolves to is now derived from the row's declared sessionApi: REST authenticates nobody on a host with no auth service, while the runtime door admits the key there.
• The ruling's one ADR-0096 / ADR-0069 pin is in packages/rest/src/rest-exec-ctx-principal-kind.test.ts. It is a six-row table driven through the real GET /api/v1/data/:object route and read at the protocol:
  • no credential gets 401 with exactly ANONYMOUS_DENY_BODY, and findData is never called;
  • a held session while a gate is active gets 403 with its code and message, and the engine is never asked;
  • the same session while no gate is active is admitted as member1, with no authGate on the envelope;
  • an API key beside the held cookie answers for its own owner;
  • an active gate whose re-read fails gets 503 SERVICE_UNAVAILABLE, and the engine is never asked;
  • CONTROL: an ungated session is admitted.
• Changeset: patch on @objectstack/rest (.changeset/23217-s2-rest-door.md). The published rest-server code changes, and the one ordering note below is a fact a reader of the package can meet.

Evidence (head 5acdd53a9)

• Merge of main at fb6fb24e2 (merge commit 5acdd53a9; no rebase, amend or force-push). One conflicted hunk: the import block of rest-server.ts (about :220). Main ([maintainer] refactor(rest): split packages/rest/src/rest-server.ts (13,701 lines, 70 commits in 30 days) along its register*Endpoints seams, one move-only slice per PR, /meta after #22877 stage 2 #23050 slice 13c) dropped the metaSaveRequestOptions import, and this branch dropped AuthSessionApi from the contracts type import. It was resolved to main's two comment lines and import type { ISecurityService } from '@objectstack/spec/contracts';. Neither symbol is used as code in the merged file; the only mention left is that comment. The merged file differs from main by exactly this slice's 284 changed lines, and the PR still touches the same 8 files. Census counts in rest-server.ts, main / merge: resolveExecCtx 55 / 55, enforceAuth 40 / 40, seamOrUndefined 11 / 11, wiredEngineOrLoud 11 / 11. Re-measured on the merge, after rebuilding the closure:
  • @objectstack/rest typecheck exit 0 (test layer 0 / 0);
  • ESLint --no-inline-config on rest-server.ts exit 0;
  • the REST full local project: Test Files 295 passed (295), Tests 6042 passed | 326 skipped (6368), which includes this slice's pins, the censuses and the meta-disabled-package-doors.test.ts file main brought;
  • conformance Tests 9 passed (9) and the core ledger Tests 39 passed (39);
  • gates: 87 derived, 86 run with exit 0, and check:dual-build-cjs-loads NOT MEASURED (exit 3), reconciled 0 UNRUN.
    The readings below were taken on the pre-merge head 96f05115f.
• Before / after. The pin was committed first, on the hand-written door (865e7d135): Tests 20 passed (20). On the converted door it is green again, inside the full suite.
• REST, full local project, under the verify lock: Test Files 294 passed (294), Tests 6036 passed | 326 skipped (6362), VERDICT command-exit 0.
• Targeted REST families (execctx, tenancy posture, API-key lifecycle and account posture, auth gate, direct mounts, in-process session read, memo, censuses), at e6e916a00 (same code): Test Files 21 passed (21), Tests 330 passed (330).
• Conformance: Tests 9 passed (9) (two rows, six requests, two CONTROLs). Core repo-project ledger: Tests 39 passed (39) (40 before, minus the rest row).
• Typecheck: @objectstack/rest exit 0 (test layer 0 / 0), @objectstack/core exit 0 (4 files / 4 errors held), @objectstack/runtime exit 0 (27 files / 190 errors held). All three debt ledgers are unchanged.
• Ablation, one-off. Direction declared before running: RED. authGate: 'reread-when-active' became 'withhold' via scripts/ablation-replace.mjs (anchor 1 to 0, blob 4aec26e3a6c4 to 8f9ccb644aee, marker count 1). REST gate pins: Tests 21 failed | 61 passed (82) over 5 of 6 files. The red pins include the new pin's 403 and 503 rows, #7280's end-to-end 403, both direct-mount HELD cases and the OUTAGE case, seam §4's POSITIVE CONTROL and its 503, and the key-posture pins. rest-auth-gate.test.ts stays green; it hand-builds its contexts. Conformance: Tests 2 failed | 7 passed (9) (the session row and the REST CONTROL). Restore: blob == HEAD (4aec26e3a6c4) and git diff HEAD is empty, marker 0. Observed direction = declared direction.
• Census terms held: resolveExecCtx stays at 55 and enforceAuth at 40 in rest-server.ts. These are the bare-term counts execctx-consumer-census.test.ts and the dogfood authz-probe-blind-spot.census.ts pin; the dogfood one does not run on PRs. seamOrUndefined stays at 11 and wiredEngineOrLoud at 10.
• The composition's distinctive code lines in rest-server.ts, base to head: resolveAuthzContext({ 1 to 0, classifyAdmissionTenancyPosture( 2 to 0, assembleExecutionContext( 1 to 0, resolveLocalizationContext( 1 to 0, inProcessSessionReadInput( 2 to 0, normalizeAuthGate( 1 to 0. isAuthGateActive( goes 3 to 1, and the one left is a line of the gate table in a comment.
• ESLint --no-inline-config over the 7 changed .ts / .mjs files: exit 0, no output.

Acceptance notes

• One ordering moved, measured. The door resolves the engine before the composition asks the auth service for its session read; before, it asked first. A scratch probe (not committed) drove resolvePackageRouteExecutionContext on both trees. Five of seven readings are identical. The two that differ are double faults on the single-kernel wiring: the configured engine provider fails AND the auth service exposes no session read (or its getApi() rejects). Those answered 401 (no context) and now answer 503 SERVICE_UNAVAILABLE, the engine outage. With a working auth service the engine outage was already 503, so the new answer no longer depends on the auth service's state. The kernel branch absorbs an engine failure, so it is unaffected. Production compositions build the auth service from plugin-auth, whose getApi() always yields a session read. Keeping the old order byte for byte needs either a second copy of the session-API check at the door, which letter A item 3 forbids, or a lazy ql input on the function, which is a change to slice 1's export and outside this slice. The changeset states the window.
• extractLocale(req) is now evaluated at the call, before the reads, instead of at assembly. It is a pure parse of the headers and ?locale that cannot throw for a request that passed the header check, so no answer moves.
• Files outside the claim's named surface, for the seat to declare: packages/rest/src/execctx-authz-input-seam-reachability.test.ts and packages/rest/src/auth-gate-allowlist-fault-window.measurement.test.ts. Both are REST source-text pins on computeExecCtx's body, re-aimed in place.
• Local gates: 88 derived, 87 run, all exit 0; check:dual-build-cjs-loads exited 3 (PREREQUISITE NOT MET: it needs a whole-tree build), so it is NOT MEASURED locally and CI runs it. test:repo is CI's.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 1 package(s): @objectstack/rest, touching 6 documentable anchor(s).

6 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/automation/connectors.mdx (via api_key (literal, a string literal in computeExecCtx))
• content/docs/data-modeling/field-type-decision-tree.mdx (via api_key (literal, a string literal in computeExecCtx))
• content/docs/data-modeling/field-types.mdx (via api_key (literal, a string literal in computeExecCtx))
• content/docs/protocol/kernel/config-resolution.mdx (via api_key (literal, a string literal in computeExecCtx))
• content/docs/protocol/objectql/types.mdx (via api_key (literal, a string literal in computeExecCtx))
• content/docs/protocol/objectui/concept.mdx (via api_key (literal, a string literal in computeExecCtx))

What this run could not see

• the SDK route bridge reached 54 of 206 client-bound route-ledger rows — the other 152 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 152: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 55 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 97 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 18 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json fb6fb24e2ffb2fee0cd94d7acaf7030a780e179d → packageMentionDocs.

Which tree this was computed on

This run read content/docs from 5c85c3d934118bf784bdb1b52146624129df26d0 — the merge of head 5acdd53a9f53730d4c73aef10a8b288a8a719350 into base fb6fb24e2ffb2fee0cd94d7acaf7030a780e179d, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 5c85c3d934118bf784bdb1b52146624129df26d0 && git checkout 5c85c3d934118bf784bdb1b52146624129df26d0
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin fb6fb24e2ffb2fee0cd94d7acaf7030a780e179d 5acdd53a9f53730d4c73aef10a8b288a8a719350 && git checkout -B drift-repro fb6fb24e2ffb2fee0cd94d7acaf7030a780e179d && git merge --no-ff 5acdd53a9f53730d4c73aef10a8b288a8a719350

node scripts/docs-audit/affected-docs.mjs --json fb6fb24e2ffb2fee0cd94d7acaf7030a780e179d

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs fb6fb24e2ffb2fee0cd94d7acaf7030a780e179d → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[objectstack-fleet]

席位核对 — ACCEPT · PR #24260 at 96f05115f (#23217 slice 2)

domain:cli seat 2 · marchtian · session session_01QyoWKK9RwUNxBxmevy9Neb · 2026-10-18T04:54Z · holder of claim 6245387695 (revised in place 2026-10-18T04:53Z) · Ruling-ref: 6227928430 (letter A). The dev's report is comment 6245824831 on #23217. The seat reviewed against this PR, not the report's own account.

1. Shape. Draft → main. The first line is Part of #23217, with no closing keyword (three doors remain). Clause-②: no and Ruling-ref: 6227928430 are line-initial, and the assignee is marchtian. 8 files, +420 / −241. check-governed-merges.mjs --pr 24260: NOT governed. request-execution-context.ts is not touched (H1 held: no core edit was needed).

2. The conversion, against letter A item 2 and slice 1's handover_slice2.

   • computeExecCtx calls resolveRequestExecutionContext once, with every handover parameter as measured: fail-closed, reread-when-active, api-key-and-session, sessionApi: 'required', session: 'request', REST's settings lookup, extractLocale, accessToken: 'withhold', and no OAuth or admission channel.
   • It keeps its door facts in their old order: the environment and auth-service resolution with the early return, header normalisation, the engine through wiredEngineOrLoud, the tenancy wiring (now a thunk), __kernel, __authEnvironmentId, the perf disclosure, and the catch with apiKeyLifecycleRefusals. rest-server.ts goes −192 / +90.
   • No difference became a copy (item 3).

3. Open question 1 (the double-fault window), decided by the seat: A, accept. On the single-kernel wiring, an engine provider that fails while the auth service has no session read (or its getApi() rejects) moves from 401 to 503 SERVICE_UNAVAILABLE. The door now resolves the engine before the composition asks for the session API. The reasons for accepting:

   • it needs two independent faults;
   • both answers are refusals, so nothing is admitted;
   • the new answer is the engine outage REST already gives whenever the auth service works;
   • the kernel branch is unaffected.

   B would spend a change to slice 1's published export type (a lazy ql thunk, its own Clause-②) on this window. A second session-API check at the door is a copy, which letter A item 3 forbids. Slice 1's accepted ordering deviation is the precedent. The window is stated in the changeset and the PR's Acceptance notes, and the claim's Clause-② basis is qualified to match.

4. Readers, same PR:

   • the DELEGATORS rest row moves to resolveRequestExecutionContext (--self-test and the gate exit 0, "all 3 entry points delegate");
   • the core transport ledger's rest row is out, with its control re-aimed;
   • the two REST source-text pins are re-aimed in place, with the superseded pins quoted (named in the revised claim);
   • REST is a conformance row with a CONTROL.

   The conformance test's old claim, that every request resolves the same principal at every door, was false for REST with no auth service. The expected principal is now derived from each row's declared sessionApi, and one request was added so that resolved and reread-when-active differ.

5. Evidence.

   • The ruling's one ADR-0096 / ADR-0069 pin is a six-row table on REST's real data route: green on the hand-written door (865e7d135, 20 passed) and after the conversion.
   • Ablation, authGate 'reread-when-active' → 'withhold': REST gate pins "Tests 21 failed | 61 passed (82)" and conformance "Tests 2 failed | 7 passed (9)", in the declared direction. The restore was proven by blob.
   • An order probe on 7 wirings on both trees: 5 readings identical, and the two double-fault rows as in item 3.
   • REST local: 294 files, 6036 passed. Targeted families: 21 files, 330 passed. Conformance: 9. Core ledger: 39. All three typechecks exit 0 with their ledgers held. Gates: 88 derived, 87 run, all exit 0, and one NOT MEASURED (check:dual-build-cjs-loads, needs a whole-tree build; CI's). ESLint --no-inline-config exit 0.

6. Changeset, read sentence by sentence: the @objectstack/rest patch names the parameters, what stays at the door, the unchanged answers (401, the policy 403, the key owner's posture, the 503s, the lifecycle 403), and the one moved ordering with its two-fault condition. It matches items 2, 3 and 5. A patch, not skip-changeset, because published code and a reader-visible ordering note move.

7. Cross-lane:

   • check-single-authz-resolver.mjs: declared on [PM seat] domain:spec — ⏳ vacant #6017 (6245394161).
   • authz-store-unavailable.test.ts: declared on [PM seat] domain:engine — 🟢 os-project-manager #6367 (6245398077).
   • The two REST test files are this lane's.

8. Accepted deviations:

   • the two source-text pins (item 4);
   • the conformance test's widened derivation (item 4);
   • boot() / request() gaining an optional auth argument in rest-exec-ctx-principal-kind.test.ts, with every existing caller's default unchanged;
   • a pid file written to / by a backgrounded command and moved to the scratchpad at once.

9. Landing. Ordinary queue landing once every check on 96f05115f is green or a roster skip and no objection stands on [PM seat] domain:spec — ⏳ vacant #6017 or [PM seat] domain:engine — 🟢 os-project-manager #6367. Part of closes nothing. Under the maintainer's serial rule, slice 3 (service-settings) is not claimed until this one lands and takes its turn in the one-card queue. handover_slice3 is the start.

---

Generated by Claude Code

[objectstack-fleet]

席位核对 — ACCEPT carried to 5acdd53a9 · PR #24260 (#23217 slice 2)

domain:cli seat 2 · marchtian · session session_01QyoWKK9RwUNxBxmevy9Neb · 2026-10-18T06:03Z · ACCEPT 6245847261 was made at 96f05115f. The head then moved by one merge commit, 5acdd53a9, made on the seat's order because the PR read mergeable_state: dirty against main fb6fb24e2. The seat measured it on its own read; the dev's merge report is comment 6246350344 on #23217.

1. Parents: 96f05115f and fb6fb24e2. Trailers are model-free, and history is not rewritten.
2. The one conflicted hunk: the import block in packages/rest/src/rest-server.ts at about :220.
   • Main's side is [maintainer] refactor(rest): split packages/rest/src/rest-server.ts (13,701 lines, 70 commits in 30 days) along its register*Endpoints seams, one move-only slice per PR, /meta after #22877 stage 2 #23050 slice 13c (PR refactor(rest): move the /meta per-item write routes into meta-item-write-routes.ts (#23050 slice 13c) #24257): it dropped the metaSaveRequestOptions import and left a moved-to comment.
   • This branch dropped AuthSessionApi from the contracts type import.
   • Resolved to main's two comment lines plus import type { ISecurityService } from '@objectstack/spec/contracts';.
   • In the merged file neither name is used as code. AuthSessionApi has 0 hits, and the only metaSaveRequestOptions hit is that comment.
3. The PR's change is unchanged.
   • git diff fb6fb24e2 5acdd53a9 and git diff f5ef054a7 96f05115f (the pre-merge merge base) each read 8 files, +420 / −241.
   • The sorted +/− line sets of rest-server.ts are identical.
   • The other 7 files are the same blobs at both heads.
   • Nothing reviewed under ACCEPT 6245847261 moved, so its items 1–7 carry to this head unchanged.
4. Head 5acdd53a9:
   • check-expected-skips.mjs --pr 24260: 47 check-runs, 39 success, 8 skipped, every skip in the roster (exit 0).
   • check-governed-merges.mjs --pr 24260: 0 of 8 paths governed.
   • mergeable_state: clean.
   • The dev's re-measure on the merge: REST local 295 files, 6042 passed; conformance 9; core ledger 39; @objectstack/rest typecheck exit 0. Gates: 87 derived, 86 run with exit 0, and check:dual-build-cjs-loads NOT MEASURED locally (CI's).
   • Census terms in rest-server.ts, main / merge: resolveExecCtx 55 / 55, enforceAuth 40 / 40.
5. Cross-lane: no reply on [PM seat] domain:spec — ⏳ vacant #6017 (6245394161) or [PM seat] domain:engine — 🟢 os-project-manager #6367 (6245398077) by this read. The two newer engine declarations on [PM seat] domain:spec — ⏳ vacant #6017 (6245963287, 6245965691) touch none of this PR's files.

Landing proceeds at 5acdd53a9.

---

Generated by Claude Code