gstack/test/fixtures/eng-golden-parity-an.json

{
  "sourceHead": "9d66d6ca9ecf13d8a8209283e611d0fce652b6f4",
  "reportSha256": "51f4544a93d6f2052b8baf1358dea4451513d43c39115c0d05827acd0a6fe16a",
  "provenanceSha256": "6ad734edaac3af2bd7faa479b75b27310484ba95041fabb432b0d044ccaa44d8",
  "provenance": "Exact public successful Write and ExitPlanMode plan text; selected native answered questions. Compact report joins exact blocks under original section headings. No direct-file freshness or approval claim.",
  "calls": [
    {
      "sessionId": "6bcd4c4d-8b17-44e5-807e-4adf4f7d9e31",
      "toolUseId": "toolu_015km1ErJykXyRY2NW6Jr1S4",
      "questions": [
        {
          "header": "Scope",
          "question": "D3 \u2014 Complexity check fired: 12 files, 4 new classes. Reduce to the two classes that carry the feature, or proceed as planned?\nProject/branch/task: gstack-plan-count-vtSmzJ on main, Multi-tenant Auth Refactor (PLAN.md:34-36).\nELI10: The plan adds four classes, but only AuthBroker and SessionMint do anything the plan describes. AuthCache is a wrapper over a cache adapter that already keys by tenant, evicts, and invalidates (PLAN.md:7-13). TokenStore and RequestPolicy have no stated job anywhere in the plan. Every extra class is another place a tenant-isolation bug can hide and another file to test, and this touches auth, so blast radius is every tenant.\nStakes if we pick wrong: Too big and you ship two undefined classes that overlap the adapter; too small and you cut a class that had a real reason nobody wrote down.\nRecommendation: A because the plan cannot justify TokenStore or RequestPolicy in its own text, and the existing adapter already does what they imply. Matches your engineered-enough and right-sized-diff preferences.\nNote: options differ in kind, not coverage \u2014 no completeness score.",
          "options": [
            {
              "label": "A) Reduce: 2 classes (recommended)",
              "description": "Keep AuthBroker + SessionMint; inject the existing adapter directly; RequestPolicy becomes a plain type + pure function; drop TokenStore unless a gap is named. ~7-8 files. (human: saves ~2 days / CC: saves ~20 min) \u2705 Fewer moving parts around tenant isolation, each remaining piece has a stated job. \u2705 Existing adapter tests keep covering the cache path unchanged. \u274c If TokenStore had an undocumented purpose (e.g. refresh-token persistence) it must be re-argued later."
            },
            {
              "label": "B) Proceed as-is: 4 classes",
              "description": "Keep all four; the review will demand a one-line responsibility and a test file for each. (human: ~5 days / CC: ~40 min) \u2705 No re-planning; whatever design intent existed is preserved. \u2705 AuthCache facade can hide adapter API churn from the services. \u274c Two classes with no written responsibility, plus a facade duplicating the adapter, is the classic premature-abstraction smell you asked me to flag."
            },
            {
              "label": "C) Middle: 3 classes",
              "description": "Keep AuthBroker, SessionMint, and AuthCache as an injected facade; fold TokenStore and RequestPolicy into functions. ~9 files. (human: ~3.5 days / CC: ~30 min) \u2705 Services get one narrow cache surface instead of the whole adapter API. \u2705 Still removes the two undefined classes. \u274c A facade over one backing cache with unchanged rules is mostly pass-through code to maintain."
            }
          ],
          "multiSelect": false
        }
      ],
      "answered": true,
      "failed": false,
      "answers": {
        "D3 \u2014 Complexity check fired: 12 files, 4 new classes. Reduce to the two classes that carry the feature, or proceed as planned?\nProject/branch/task: gstack-plan-count-vtSmzJ on main, Multi-tenant Auth Refactor (PLAN.md:34-36).\nELI10: The plan adds four classes, but only AuthBroker and SessionMint do anything the plan describes. AuthCache is a wrapper over a cache adapter that already keys by tenant, evicts, and invalidates (PLAN.md:7-13). TokenStore and RequestPolicy have no stated job anywhere in the plan. Every extra class is another place a tenant-isolation bug can hide and another file to test, and this touches auth, so blast radius is every tenant.\nStakes if we pick wrong: Too big and you ship two undefined classes that overlap the adapter; too small and you cut a class that had a real reason nobody wrote down.\nRecommendation: A because the plan cannot justify TokenStore or RequestPolicy in its own text, and the existing adapter already does what they imply. Matches your engineered-enough and right-sized-diff preferences.\nNote: options differ in kind, not coverage \u2014 no completeness score.": "A) Reduce: 2 classes (recommended)"
      },
      "unansweredQuestionIndices": [],
      "answeredAt": "2026-09-10T10:51:39.964Z"
    },
    {
      "sessionId": "6bcd4c4d-8b17-44e5-807e-4adf4f7d9e31",
      "toolUseId": "toolu_01YRgsQDio1oQVDds1cNWBH8",
      "questions": [
        {
          "header": "Cache owner",
          "question": "D4 \u2014 Issue 1: two services mutate one shared cache with no serialized writes. How should cache ownership work?\nProject/branch/task: gstack-plan-count-vtSmzJ on main, Multi-tenant Auth Refactor (PLAN.md:10, 19-20).\nELI10: AuthBroker and SessionMint both write into the same tenant-keyed cache, and the plan says nothing orders those writes. Realistic production failure: a tenant gets suspended, the invalidation hook clears its entries, and a SessionMint write that started a few milliseconds earlier lands after the clear. That suspended tenant now has a live cached session until the TTL expires. Nobody sees an error; the cache just quietly re-admits them. A module-level global also means every test shares state and you cannot construct a service with a fake cache.\nStakes if we pick wrong: Silent re-admission of a suspended or revoked tenant, plus test suites that pass or fail depending on run order.\nRecommendation: A because one writer plus a version check turns a silent race into an explicit, testable rule, and injection is the standard fix for module-level mutable state [Layer 1]. Maps to explicit over clever.\nCompleteness: A=10/10, B=7/10, C=3/10",
          "options": [
            {
              "label": "A) Inject + single writer + invalidation epoch (recommended)",
              "description": "Constructor-inject the existing adapter into both services. Only AuthBroker writes; SessionMint returns minted material to the broker, which stores it. Adapter set() takes the per-tenant invalidation epoch it read from, and drops the write if the epoch moved. Tests: write-after-invalidate race, cross-tenant key isolation, both services with a fake adapter. (human: ~1.5 days / CC: ~15 min) \u2705 Suspension and revocation win every race by construction, not by luck. \u2705 Every test builds its own cache; no shared global to reset. \u274c SessionMint gains a return-value contract instead of writing directly; slightly more plumbing."
            },
            {
              "label": "B) Inject only, keep two writers",
              "description": "Replace the module-level export with constructor injection but let both services keep writing. Tests: isolation and fake-adapter construction; no race test. (human: ~0.5 day / CC: ~5 min) \u2705 Removes the global and makes both services unit-testable in isolation. \u2705 Smallest diff from the current plan wording. \u274c The write-after-invalidate race stays open; suspension can still be undone by a late mint write."
            },
            {
              "label": "C) Keep module-level global as planned",
              "description": "Do nothing here; both services import and mutate the singleton. (human: 0 / CC: 0) \u2705 No plan change and no new contract between the two services. \u2705 Module cache already guarantees one instance, so no double-init bug. \u274c Race stays open and tests share mutable state across the whole suite."
            }
          ],
          "multiSelect": false
        }
      ],
      "answered": true,
      "failed": false,
      "answers": {
        "D4 \u2014 Issue 1: two services mutate one shared cache with no serialized writes. How should cache ownership work?\nProject/branch/task: gstack-plan-count-vtSmzJ on main, Multi-tenant Auth Refactor (PLAN.md:10, 19-20).\nELI10: AuthBroker and SessionMint both write into the same tenant-keyed cache, and the plan says nothing orders those writes. Realistic production failure: a tenant gets suspended, the invalidation hook clears its entries, and a SessionMint write that started a few milliseconds earlier lands after the clear. That suspended tenant now has a live cached session until the TTL expires. Nobody sees an error; the cache just quietly re-admits them. A module-level global also means every test shares state and you cannot construct a service with a fake cache.\nStakes if we pick wrong: Silent re-admission of a suspended or revoked tenant, plus test suites that pass or fail depending on run order.\nRecommendation: A because one writer plus a version check turns a silent race into an explicit, testable rule, and injection is the standard fix for module-level mutable state [Layer 1]. Maps to explicit over clever.\nCompleteness: A=10/10, B=7/10, C=3/10": "A) Inject + single writer + invalidation epoch (recommended)"
      },
      "unansweredQuestionIndices": [],
      "answeredAt": "2026-09-10T10:52:40.165Z"
    },
    {
      "sessionId": "6bcd4c4d-8b17-44e5-807e-4adf4f7d9e31",
      "toolUseId": "toolu_019Kj471tp4y9YEJs9Lj89gg",
      "questions": [
        {
          "header": "Error flow",
          "question": "D6 \u2014 Issue 3: validateAndDispatch() nests three try/catch blocks that each swallow an error class. Restructure, or leave it?\nProject/branch/task: gstack-plan-count-vtSmzJ on main, Multi-tenant Auth Refactor (PLAN.md:23-24).\nELI10: In an auth path, a swallowed error is a fail-open bug waiting to happen: if token validation throws and the catch eats it, the code after the try still runs and may dispatch the request as if validation passed. Three nested catches also mean a reader cannot tell which failure ends up where. The fix is a flat pipeline of small steps (parse, validate, resolve policy, dispatch) where each step returns a typed result, and one boundary at the top maps each error class to an explicit outcome: reject, retry, or rethrow. Nothing is silently dropped.\nStakes if we pick wrong: A validation error that is caught and ignored lets a bad token through with no log line to show it happened.\nRecommendation: A because explicit over clever, and each mapped error class becomes one test case instead of one hidden branch.\nCompleteness: A=10/10, B=6/10, C=2/10",
          "options": [
            {
              "label": "A) Flat pipeline + one typed error boundary (recommended)",
              "description": "Split into 4 pure-ish steps returning a discriminated Result; one top-level boundary maps each error class to reject/retry/rethrow and logs with tenant + error class; unknown errors rethrow (fail closed). Tests: one per error class per step, unknown-error-rethrows, and success. Add an ASCII pipeline diagram in the service file header. (human: ~1 day / CC: ~10 min) \u2705 No path where a validation failure reaches dispatch. \u2705 Each catch becomes a named, individually tested branch. \u274c Larger diff than a patch; touches every caller expecting thrown errors."
            },
            {
              "label": "B) Keep structure, stop swallowing",
              "description": "Leave the 60-line shape; make each catch log and rethrow or return an explicit failure. Tests: each catch path. (human: ~2 h / CC: ~3 min) \u2705 Small, mechanical change with immediate safety gain. \u2705 No caller contract change. \u274c Three nested catches remain unreadable; the next edit re-introduces a swallow."
            },
            {
              "label": "C) Leave as-is",
              "description": "No change; accept the current function. (human: 0 / CC: 0) \u2705 Zero risk of churn in code that currently works in production. \u2705 Nothing to re-test now. \u274c Fail-open on swallowed validation errors stays possible and untested."
            }
          ],
          "multiSelect": false
        }
      ],
      "answered": true,
      "failed": false,
      "answers": {
        "D6 \u2014 Issue 3: validateAndDispatch() nests three try/catch blocks that each swallow an error class. Restructure, or leave it?\nProject/branch/task: gstack-plan-count-vtSmzJ on main, Multi-tenant Auth Refactor (PLAN.md:23-24).\nELI10: In an auth path, a swallowed error is a fail-open bug waiting to happen: if token validation throws and the catch eats it, the code after the try still runs and may dispatch the request as if validation passed. Three nested catches also mean a reader cannot tell which failure ends up where. The fix is a flat pipeline of small steps (parse, validate, resolve policy, dispatch) where each step returns a typed result, and one boundary at the top maps each error class to an explicit outcome: reject, retry, or rethrow. Nothing is silently dropped.\nStakes if we pick wrong: A validation error that is caught and ignored lets a bad token through with no log line to show it happened.\nRecommendation: A because explicit over clever, and each mapped error class becomes one test case instead of one hidden branch.\nCompleteness: A=10/10, B=6/10, C=2/10": "A) Flat pipeline + one typed error boundary (recommended)"
      },
      "unansweredQuestionIndices": [],
      "answeredAt": "2026-09-10T10:53:18.285Z"
    },
    {
      "sessionId": "6bcd4c4d-8b17-44e5-807e-4adf4f7d9e31",
      "toolUseId": "toolu_01WPFDUDUejnksq6iFYYvYQt",
      "questions": [
        {
          "header": "IDP calls",
          "question": "D8 \u2014 Issue 5: five sequential IDP calls become Promise.all. Which failure semantics ship with it?\nProject/branch/task: gstack-plan-count-vtSmzJ on main, Multi-tenant Auth Refactor (PLAN.md:31-32).\nELI10: Running the five independent IDP calls at once cuts login latency to roughly the slowest single call instead of the sum. But Promise.all alone has two sharp edges in an auth path: if one call hangs, the whole login hangs forever with no timeout, and when one call rejects the other four keep running against the IDP with nobody listening. The complete version adds a shared timeout and abort signal so a hung call fails closed quickly and the others are cancelled, and it explicitly rejects Promise.allSettled because partial validation data must never count as validated.\nStakes if we pick wrong: Either logins hang until the load balancer gives up, or a partial-result branch quietly treats four out of five checks as good enough.\nRecommendation: A because fail-fast and fail-closed is the only correct posture for token validation [Layer 1], and a timeout is what makes it safe at 3am.\nCompleteness: A=10/10, B=6/10",
          "options": [
            {
              "label": "A) Promise.all + shared AbortSignal timeout, fail closed (recommended)",
              "description": "One AbortController per validation; timeout from config; any reject or abort -> typed validation failure through the D6 boundary; no Promise.allSettled. Tests: all resolve, one rejects, one hangs past timeout, abort propagates to remaining calls. (human: ~0.5 day / CC: ~5 min) \u2705 Latency drops to max(call) with a hard upper bound. \u2705 A hung IDP endpoint fails the login in seconds, not minutes, and the D6 boundary logs which call died. \u274c Abort plumbing must be threaded into the IDP client."
            },
            {
              "label": "B) Bare Promise.all as written",
              "description": "Wrap the five calls in Promise.all, no timeout, no abort. Tests: all resolve, one rejects. (human: ~1 h / CC: ~2 min) \u2705 Same latency win on the happy path. \u2705 Smallest possible change. \u274c A single hung call hangs every login; sibling calls keep hitting the IDP after the first failure."
            }
          ],
          "multiSelect": false
        }
      ],
      "answered": true,
      "failed": false,
      "answers": {
        "D8 \u2014 Issue 5: five sequential IDP calls become Promise.all. Which failure semantics ship with it?\nProject/branch/task: gstack-plan-count-vtSmzJ on main, Multi-tenant Auth Refactor (PLAN.md:31-32).\nELI10: Running the five independent IDP calls at once cuts login latency to roughly the slowest single call instead of the sum. But Promise.all alone has two sharp edges in an auth path: if one call hangs, the whole login hangs forever with no timeout, and when one call rejects the other four keep running against the IDP with nobody listening. The complete version adds a shared timeout and abort signal so a hung call fails closed quickly and the others are cancelled, and it explicitly rejects Promise.allSettled because partial validation data must never count as validated.\nStakes if we pick wrong: Either logins hang until the load balancer gives up, or a partial-result branch quietly treats four out of five checks as good enough.\nRecommendation: A because fail-fast and fail-closed is the only correct posture for token validation [Layer 1], and a timeout is what makes it safe at 3am.\nCompleteness: A=10/10, B=6/10": "A) Promise.all + shared AbortSignal timeout, fail closed (recommended)"
      },
      "unansweredQuestionIndices": [],
      "answeredAt": "2026-09-10T10:54:16.506Z"
    }
  ],
  "ordering": "2. **Golden regression tests for legacyAuthFlow (T3)** \u2014 pin current outputs\n   per input class before any other code moves. CRITICAL, lands first.\n",
  "declaration": "- **CRITICAL \u2014 `auth/legacyAuthFlow.regression.test.ts` (T3, REGRESSION RULE, no approval needed):**\n  golden tests for valid token, expired, wrong tenant, wrong audience,\n  revoked, malformed. What broke: PLAN.md:27-28 rewrites the live auth path\n  with no regression test; PLAN.md:15-16 says new coverage does not assert\n  compatibility. These tests are the parity oracle for the D5 flag-off path.\n",
  "task": "- [ ] **T3 (P1, human: ~1 day / CC: ~10 min)** \u2014 auth/legacyAuthFlow tests \u2014 CRITICAL golden regression tests, land first\n  - Surfaced by: Test review REGRESSION RULE \u2014 PLAN.md:27-28, PLAN.md:15-16\n  - Files: auth/legacyAuthFlow.regression.test.ts\n  - Verify: six input classes pinned; suite green against unmodified legacy code before any refactor commit\n",
  "reviewReport": "## GSTACK REVIEW REPORT\n\n| Review | Trigger | Why | Runs | Status | Findings |\n|--------|---------|-----|------|--------|----------|\n| CEO Review | `/plan-ceo-review` | Scope & strategy | 0 | \u2014 | \u2014 |\n| Outside Review | codex via `/plan-eng-review` (plan-review phase) | Independent 2nd opinion | 1 | disabled | none (skipped by config, no outside coverage) |\n| Eng Review | `/plan-eng-review` | Architecture & tests (required) | 1 | clean (SCOPE_REDUCED) | 31 issues (5 findings + 27 test gaps, all folded), 0 critical gaps |\n| Design Review | `/plan-design-review` | UI/UX gaps | 0 | \u2014 | \u2014 |\n| DX Review | `/plan-devex-review` | Developer experience gaps | 0 | \u2014 | \u2014 |\n\n- **OUTSIDE COVERAGE:** provider codex, phase plan-review, host claude, outside_status disabled (codex_reviews=disabled). No outside findings; no native fallback dispatched because disabled is an intentional opt-out. Re-enable with `gstack-config set codex_reviews enabled`.\n- **VERDICT:** ENG CLEARED \u2014 ready to implement.\n\nNO UNRESOLVED DECISIONS\n",
  "compact": "## Implementation steps\n\n2. **Golden regression tests for legacyAuthFlow (T3)** \u2014 pin current outputs\n   per input class before any other code moves. CRITICAL, lands first.\n\n### Test requirements\n\n- **CRITICAL \u2014 `auth/legacyAuthFlow.regression.test.ts` (T3, REGRESSION RULE, no approval needed):**\n  golden tests for valid token, expired, wrong tenant, wrong audience,\n  revoked, malformed. What broke: PLAN.md:27-28 rewrites the live auth path\n  with no regression test; PLAN.md:15-16 says new coverage does not assert\n  compatibility. These tests are the parity oracle for the D5 flag-off path.\n\n## Implementation Tasks\n\n- [ ] **T3 (P1, human: ~1 day / CC: ~10 min)** \u2014 auth/legacyAuthFlow tests \u2014 CRITICAL golden regression tests, land first\n  - Surfaced by: Test review REGRESSION RULE \u2014 PLAN.md:27-28, PLAN.md:15-16\n  - Files: auth/legacyAuthFlow.regression.test.ts\n  - Verify: six input classes pinned; suite green against unmodified legacy code before any refactor commit\n\n## GSTACK REVIEW REPORT\n\n| Review | Trigger | Why | Runs | Status | Findings |\n|--------|---------|-----|------|--------|----------|\n| CEO Review | `/plan-ceo-review` | Scope & strategy | 0 | \u2014 | \u2014 |\n| Outside Review | codex via `/plan-eng-review` (plan-review phase) | Independent 2nd opinion | 1 | disabled | none (skipped by config, no outside coverage) |\n| Eng Review | `/plan-eng-review` | Architecture & tests (required) | 1 | clean (SCOPE_REDUCED) | 31 issues (5 findings + 27 test gaps, all folded), 0 critical gaps |\n| Design Review | `/plan-design-review` | UI/UX gaps | 0 | \u2014 | \u2014 |\n| DX Review | `/plan-devex-review` | Developer experience gaps | 0 | \u2014 | \u2014 |\n\n- **OUTSIDE COVERAGE:** provider codex, phase plan-review, host claude, outside_status disabled (codex_reviews=disabled). No outside findings; no native fallback dispatched because disabled is an intentional opt-out. Re-enable with `gstack-config set codex_reviews enabled`.\n- **VERDICT:** ENG CLEARED \u2014 ready to implement.\n\nNO UNRESOLVED DECISIONS\n",
  "ledgerParityCab3": {
    "source": "cab3edc8b24f873b55f6edc6d98b60981eda52cb",
    "reportSha256": "ad044adff3258fd190536a08d9c8d2645772d5f4a234d4342ac917874901ecba",
    "originalOutcome": "timeout; mandatory legacy regression coverage absent",
    "plan": "# Current reviewed plan\n\n## Tests (revised)\n\nFramework: unknown in this fixture repo (no `package.json`, no test files). Names below assume a TypeScript runner (`*.test.ts`); match the real repo's convention.\n\nApproved test work:\n\n| Decision | Test file | Asserts |\n|---|---|---|\n| D9 | `auth/router.test.ts` | 4 branches: kill off \u2192 legacy; tenant unlisted \u2192 legacy; tenant missing \u2192 legacy + log; tenant listed \u2192 AuthBroker |\n| D7 | `auth/AuthCache.test.ts` | fresh instance per test; key = tenant+issuer+aud+policyVer; tenant A never returns tenant B entry; `set` only via `Writer` |\n| D8 | `auth/SessionMint.test.ts` | type-level: injected cache has no `set`; mint completing after `invalidate(tenant)` does not repopulate the entry |\n| D10 | `auth/validateAndDispatch.test.ts` | one test per `AuthResult` variant; unknown error propagates; `dispatch` not called on non-ok |\n| D13 | `auth/AuthBroker.test.ts` | cache hit \u2192 0 IDP calls; all-succeed \u2192 ok; one rejects \u2192 idp_unreachable; elapsed \u2248 max(call) not sum |\n| D14 | `auth/AuthBroker.test.ts` | deadline exceeded \u2192 idp_unreachable within ~3 s; first rejection aborts siblings (fake IDP asserts signal aborted) |\n| D11 CRITICAL | `auth/authBehavior.contract.test.ts` | parity suite: valid, expired, revoked, tenant suspended, IDP unreachable, missing tenant; asserts outcome + cache key written; parameterized over `legacyAuthFlow()` and `AuthBroker`; both green before any tenant is allowlisted |\n| D12 | `auth/auth.e2e.test.ts` | legacy login (tenant unlisted); v2 login (tenant listed); admin suspends tenant \u2192 next request denied; kill switch flipped mid-session \u2192 legacy serves |\n\nCoverage diagram (target state after this work):\n\n```\nCODE PATHS                                                    USER FLOWS\n[+] auth/router.ts                                            [+] Login (tenant off list)\n  \u2514\u2500\u2500 routeAuth: kill off | no tenant | unlisted | listed        \u2514\u2500\u2500 [\u2192E2E] identical to today (parity D11 + E2E D12)\n[+] auth/AuthBroker.ts                                        [+] Login (tenant on list)\n  \u251c\u2500\u2500 validate: hit | miss\u2192x5 | one rejects | deadline | unknown    \u251c\u2500\u2500 [\u2192E2E] success via AuthBroker\n  \u2514\u2500\u2500 dispatch: ok | expired | revoked | idp_unreachable          \u251c\u2500\u2500 expired \u2192 specific error\n[+] auth/SessionMint.ts                                           \u251c\u2500\u2500 revoked \u2192 specific error\n  \u251c\u2500\u2500 mint \u2192 session returned to AuthBroker                       \u2514\u2500\u2500 IDP down \u2192 idp_unreachable \u2264 3 s\n  \u2514\u2500\u2500 type: no set() on injected cache                          [+] Admin suspends tenant\n[+] auth/AuthCache.ts                                             \u251c\u2500\u2500 [\u2192E2E] next request denied\n  \u251c\u2500\u2500 get/invalidate keyed by tenant|issuer|aud|policyVer         \u2514\u2500\u2500 late mint does not repopulate (D8)\n  \u251c\u2500\u2500 set() via Writer only                                     [+] Rollback\n  \u2514\u2500\u2500 tenant isolation                                            \u251c\u2500\u2500 [\u2192E2E] kill switch \u2192 legacy, no forced logout\n[~] legacyAuthFlow() (unchanged)                                  \u2514\u2500\u2500 remove tenant from list \u2192 that tenant on legacy\n  \u2514\u2500\u2500 parity suite pins current behavior (D11)                  [+] Interaction edge cases\n[~] adapter + hooks: existing tests retained (\u2605\u2605\u2605)                \u251c\u2500\u2500 double-submit: one mint, one set\n                                                                  \u251c\u2500\u2500 session expires mid-request \u2192 expired\n                                                                  \u2514\u2500\u2500 two tabs same tenant \u2192 cache hit\n\nCOVERAGE (pre-review): 1/29 paths tested (3%)  |  GAPS: 28 (4 E2E, 0 eval)\nCOVERAGE (planned):    29/29 paths (100%) once T1-T7 land  |  E2E: 4  |  eval: none\n```\n\nRegression contract (D11): behavior to preserve = every `legacyAuthFlow()` outcome and its cache write for the six scenarios. Intentional differences in this PR: none.\n\n## Worktree parallelization strategy\n\n| Step | Modules touched | Depends on |\n|---|---|---|\n| T5 `AuthResult` type + `validate/dispatch` split | auth/ (validateAndDispatch) | \u2014 |\n| T2 `AuthCache` facade | auth/ (AuthCache) | \u2014 |\n| T3 `AuthBroker` + composition root | auth/ | T2, T5 |\n| T4 `SessionMint` | auth/ | T2 |\n| T1 router + flags | auth/ (router) | T3 |\n| T6 parity suite | auth/__tests__ or tests/ | legacy only at first; T3 to parameterize |\n| T7 E2E | tests/e2e | T1, T3, T4 |\n| T8 diagrams | auth/ headers | T1, T3, T5 |\n| T9 TODOS.md | repo root | after plan mode exits |\n\nLanes:\n- Lane A: T5 \u2192 T2 \u2192 T3 + T4 \u2192 T1 \u2192 T8 (sequential, shared `auth/`)\n- Lane B: T6 parity suite written against `legacyAuthFlow()` (independent: tests/ only), then parameterized over `AuthBroker` after Lane A's T3 merges\n- Lane C: T7 E2E (after A and B merge)\n- T9 anywhere (root only)\n\nExecution: launch A and B in parallel worktrees. Merge both. Then C.\nConflict flag: if the parity suite is placed under `auth/` instead of `tests/`, Lanes A and B both touch `auth/`; keep it under `tests/` or `auth/__tests__/` to avoid the merge conflict.\n\n## Implementation Tasks\nSynthesized from this review's findings. Each task derives from a specific\nfinding above. Run with Claude Code or Codex; checkbox as you ship.\n\n- [ ] **T1 (P1, human: ~3h / CC: ~10min)** \u2014 auth/router \u2014 Add `routeAuth()` with `AUTH_V2_ENABLED` kill switch and `AUTH_V2_TENANTS` allowlist; `legacyAuthFlow()` unchanged\n  - Surfaced by: Scope Challenge S4 / Architecture A3 (D4, D9)\n  - Files: `auth/router.ts`, `auth/router.test.ts`\n  - Verify: 4 routing branch tests green\n- [ ] **T2 (P1, human: ~4h / CC: ~15min)** \u2014 auth/AuthCache \u2014 Create facade over the existing adapter with `Reader` (`get`, `invalidate`) and `Writer` (`set`) interfaces; no module-level export\n  - Surfaced by: Architecture A1, A2 (D6, D7, D8)\n  - Files: `auth/AuthCache.ts`, `auth/AuthCache.test.ts`\n  - Verify: isolation + key + writer-only tests green; adapter tests untouched and green\n- [ ] **T3 (P1, human: ~1d / CC: ~30min)** \u2014 auth/AuthBroker \u2014 Implement with injected `Writer`; `validate()` returns `AuthResult`; `Promise.all` over 5 IDP calls with shared `AbortController` and 3 s deadline; composition root wires one cache\n  - Surfaced by: Architecture A1/A4, Code quality C1, Performance P1/P2 (D7, D10, D13, D14)\n  - Files: `auth/AuthBroker.ts`, `auth/AuthBroker.test.ts`, `auth/composition.ts`\n  - Verify: hit=0 calls; one-rejects; deadline; sibling-abort; elapsed\u2248max tests green\n- [ ] **T4 (P1, human: ~4h / CC: ~15min)** \u2014 auth/SessionMint \u2014 Implement with injected `Reader` only; return minted session to `AuthBroker` for storage\n  - Surfaced by: Architecture A2 (D8)\n  - Files: `auth/SessionMint.ts`, `auth/SessionMint.test.ts`\n  - Verify: type test (no `set`); late-mint-does-not-repopulate test green\n- [ ] **T5 (P1, human: ~1d / CC: ~20min)** \u2014 auth/validateAndDispatch \u2014 Split into `validate()` + `dispatch()`; map known errors to `AuthResult`; rethrow unknown; header diagram\n  - Surfaced by: Code quality C1 (D10)\n  - Files: `auth/validateAndDispatch.ts`, `auth/validateAndDispatch.test.ts`\n  - Verify: one test per variant + unknown-propagates + no-dispatch-on-non-ok green\n- [ ] **T6 (P1, human: ~1.5d / CC: ~30min)** \u2014 tests/parity \u2014 Write `authBehavior.contract.test.ts` parameterized over `legacyAuthFlow()` and `AuthBroker`\n  - Surfaced by: Test review T1 CRITICAL (D11)\n  - Files: `auth/authBehavior.contract.test.ts` (or `tests/`)\n  - Verify: six scenarios green for both implementations before any tenant is allowlisted\n- [ ] **T7 (P2, human: ~1d / CC: ~30min)** \u2014 tests/e2e \u2014 Write `auth.e2e.test.ts`: legacy login, v2 login, tenant suspension denial, kill-switch rollback mid-session\n  - Surfaced by: Test review T2 (D12)\n  - Files: `auth/auth.e2e.test.ts`\n  - Verify: 4 flows green against IDP stub in CI\n- [ ] **T8 (P2, human: ~1h / CC: ~5min)** \u2014 docs \u2014 Header ASCII diagrams in `AuthBroker.ts`, `validateAndDispatch.ts`, `router.ts`\n  - Surfaced by: Architecture A5, Code quality C4\n  - Files: `auth/AuthBroker.ts`, `auth/validateAndDispatch.ts`, `auth/router.ts`\n  - Verify: diagrams match the routing table and variant map\n- [ ] **T9 (P3, human: ~30min / CC: ~5min)** \u2014 TODOS.md \u2014 Create with the four approved entries below\n  - Surfaced by: Final planning decisions D15-D18\n  - Files: `TODOS.md`\n  - Verify: file matches TODOS-format (What/Why/Context/Effort/Priority)\n\nEffort assumption: tests ~50x, features ~30x, architecture ~5x human\u00f7CC ratios, adjusted down for a 3-component auth change.\n\nJSONL artifact: `~/.gstack/projects/gstack-plan-count-Sr94jU/tasks-eng-review-20260915-192142.jsonl` (9 tasks).\n\n### R5: legacyAuthFlow() regression contract\nFinding: T1, P1 CRITICAL, 9/10, PLAN.md:14-16 (\"does not exercise legacyAuthFlow() or assert compatibility\") + PLAN.md:27-28, native reviewer\nPlan baseline: no regression coverage for legacyAuthFlow(); after D4 it is unchanged code called through a new router\nRuntime evidence: unknown; no source or tests in this repo\nState: approved\n\nComparison grid:\n\n| Choice | Current | A | B | C |\n|---|---|---|---|---|\n| R5 behavior to preserve | unstated | legacy success, expired, revoked, tenant-suspended, IDP-failure outcomes and side effects (cache writes, emitted events) | same | router passes args/result through unchanged |\n| R5 test shape | none | shared parity fixture `authBehavior.contract.test.ts` run against legacyAuthFlow() now and AuthBroker (both must pass) | characterization suite `legacyAuthFlow.test.ts` pinning current outputs only | one routing pass-through test |\n| Intentional differences | none in this PR (legacy unchanged, D4) | none | none | none |\n| Acceptance assertions | none | identical outcome + identical cache key written for each scenario, both impls | identical outcome + cache key for legacy | router calls legacy with same args, returns same result |\n| Router branch tests (D9) | approved work | carried | carried | carried |\n| R6 IDP parallelization tests | pending (Section 4) | pending | pending | pending |\n\nQuestion D11: Shared parity suite (recommended) / Characterization suite / Router pass-through only\nActual answer: Shared parity suite run against legacy AND AuthBroker (D11)\nAccepted scope: `authBehavior.contract.test.ts` with implementation-agnostic scenarios (valid, expired, revoked, tenant suspended, IDP unreachable, missing tenant ID) asserting outcome + cache key written; parameterized over `legacyAuthFlow()` and `AuthBroker`. Both must pass before any tenant enters `AUTH_V2_TENANTS`. Intentional differences: none in this PR.\nHistory: none\n",
    "parts": [
      "## Tests (revised)\n\nFramework: unknown in this fixture repo (no `package.json`, no test files). Names below assume a TypeScript runner (`*.test.ts`); match the real repo's convention.\n\nApproved test work:\n\n| Decision | Test file | Asserts |\n|---|---|---|\n| D9 | `auth/router.test.ts` | 4 branches: kill off \u2192 legacy; tenant unlisted \u2192 legacy; tenant missing \u2192 legacy + log; tenant listed \u2192 AuthBroker |\n| D7 | `auth/AuthCache.test.ts` | fresh instance per test; key = tenant+issuer+aud+policyVer; tenant A never returns tenant B entry; `set` only via `Writer` |\n| D8 | `auth/SessionMint.test.ts` | type-level: injected cache has no `set`; mint completing after `invalidate(tenant)` does not repopulate the entry |\n| D10 | `auth/validateAndDispatch.test.ts` | one test per `AuthResult` variant; unknown error propagates; `dispatch` not called on non-ok |\n| D13 | `auth/AuthBroker.test.ts` | cache hit \u2192 0 IDP calls; all-succeed \u2192 ok; one rejects \u2192 idp_unreachable; elapsed \u2248 max(call) not sum |\n| D14 | `auth/AuthBroker.test.ts` | deadline exceeded \u2192 idp_unreachable within ~3 s; first rejection aborts siblings (fake IDP asserts signal aborted) |\n| D11 CRITICAL | `auth/authBehavior.contract.test.ts` | parity suite: valid, expired, revoked, tenant suspended, IDP unreachable, missing tenant; asserts outcome + cache key written; parameterized over `legacyAuthFlow()` and `AuthBroker`; both green before any tenant is allowlisted |\n| D12 | `auth/auth.e2e.test.ts` | legacy login (tenant unlisted); v2 login (tenant listed); admin suspends tenant \u2192 next request denied; kill switch flipped mid-session \u2192 legacy serves |\n\nCoverage diagram (target state after this work):\n\n```\nCODE PATHS                                                    USER FLOWS\n[+] auth/router.ts                                            [+] Login (tenant off list)\n  \u2514\u2500\u2500 routeAuth: kill off | no tenant | unlisted | listed        \u2514\u2500\u2500 [\u2192E2E] identical to today (parity D11 + E2E D12)\n[+] auth/AuthBroker.ts                                        [+] Login (tenant on list)\n  \u251c\u2500\u2500 validate: hit | miss\u2192x5 | one rejects | deadline | unknown    \u251c\u2500\u2500 [\u2192E2E] success via AuthBroker\n  \u2514\u2500\u2500 dispatch: ok | expired | revoked | idp_unreachable          \u251c\u2500\u2500 expired \u2192 specific error\n[+] auth/SessionMint.ts                                           \u251c\u2500\u2500 revoked \u2192 specific error\n  \u251c\u2500\u2500 mint \u2192 session returned to AuthBroker                       \u2514\u2500\u2500 IDP down \u2192 idp_unreachable \u2264 3 s\n  \u2514\u2500\u2500 type: no set() on injected cache                          [+] Admin suspends tenant\n[+] auth/AuthCache.ts                                             \u251c\u2500\u2500 [\u2192E2E] next request denied\n  \u251c\u2500\u2500 get/invalidate keyed by tenant|issuer|aud|policyVer         \u2514\u2500\u2500 late mint does not repopulate (D8)\n  \u251c\u2500\u2500 set() via Writer only                                     [+] Rollback\n  \u2514\u2500\u2500 tenant isolation                                            \u251c\u2500\u2500 [\u2192E2E] kill switch \u2192 legacy, no forced logout\n[~] legacyAuthFlow() (unchanged)                                  \u2514\u2500\u2500 remove tenant from list \u2192 that tenant on legacy\n  \u2514\u2500\u2500 parity suite pins current behavior (D11)                  [+] Interaction edge cases\n[~] adapter + hooks: existing tests retained (\u2605\u2605\u2605)                \u251c\u2500\u2500 double-submit: one mint, one set\n                                                                  \u251c\u2500\u2500 session expires mid-request \u2192 expired\n                                                                  \u2514\u2500\u2500 two tabs same tenant \u2192 cache hit\n\nCOVERAGE (pre-review): 1/29 paths tested (3%)  |  GAPS: 28 (4 E2E, 0 eval)\nCOVERAGE (planned):    29/29 paths (100%) once T1-T7 land  |  E2E: 4  |  eval: none\n```\n\nRegression contract (D11): behavior to preserve = every `legacyAuthFlow()` outcome and its cache write for the six scenarios. Intentional differences in this PR: none.\n",
      "## Worktree parallelization strategy\n\n| Step | Modules touched | Depends on |\n|---|---|---|\n| T5 `AuthResult` type + `validate/dispatch` split | auth/ (validateAndDispatch) | \u2014 |\n| T2 `AuthCache` facade | auth/ (AuthCache) | \u2014 |\n| T3 `AuthBroker` + composition root | auth/ | T2, T5 |\n| T4 `SessionMint` | auth/ | T2 |\n| T1 router + flags | auth/ (router) | T3 |\n| T6 parity suite | auth/__tests__ or tests/ | legacy only at first; T3 to parameterize |\n| T7 E2E | tests/e2e | T1, T3, T4 |\n| T8 diagrams | auth/ headers | T1, T3, T5 |\n| T9 TODOS.md | repo root | after plan mode exits |\n\nLanes:\n- Lane A: T5 \u2192 T2 \u2192 T3 + T4 \u2192 T1 \u2192 T8 (sequential, shared `auth/`)\n- Lane B: T6 parity suite written against `legacyAuthFlow()` (independent: tests/ only), then parameterized over `AuthBroker` after Lane A's T3 merges\n- Lane C: T7 E2E (after A and B merge)\n- T9 anywhere (root only)\n\nExecution: launch A and B in parallel worktrees. Merge both. Then C.\nConflict flag: if the parity suite is placed under `auth/` instead of `tests/`, Lanes A and B both touch `auth/`; keep it under `tests/` or `auth/__tests__/` to avoid the merge conflict.\n",
      "## Implementation Tasks\nSynthesized from this review's findings. Each task derives from a specific\nfinding above. Run with Claude Code or Codex; checkbox as you ship.\n\n- [ ] **T1 (P1, human: ~3h / CC: ~10min)** \u2014 auth/router \u2014 Add `routeAuth()` with `AUTH_V2_ENABLED` kill switch and `AUTH_V2_TENANTS` allowlist; `legacyAuthFlow()` unchanged\n  - Surfaced by: Scope Challenge S4 / Architecture A3 (D4, D9)\n  - Files: `auth/router.ts`, `auth/router.test.ts`\n  - Verify: 4 routing branch tests green\n- [ ] **T2 (P1, human: ~4h / CC: ~15min)** \u2014 auth/AuthCache \u2014 Create facade over the existing adapter with `Reader` (`get`, `invalidate`) and `Writer` (`set`) interfaces; no module-level export\n  - Surfaced by: Architecture A1, A2 (D6, D7, D8)\n  - Files: `auth/AuthCache.ts`, `auth/AuthCache.test.ts`\n  - Verify: isolation + key + writer-only tests green; adapter tests untouched and green\n- [ ] **T3 (P1, human: ~1d / CC: ~30min)** \u2014 auth/AuthBroker \u2014 Implement with injected `Writer`; `validate()` returns `AuthResult`; `Promise.all` over 5 IDP calls with shared `AbortController` and 3 s deadline; composition root wires one cache\n  - Surfaced by: Architecture A1/A4, Code quality C1, Performance P1/P2 (D7, D10, D13, D14)\n  - Files: `auth/AuthBroker.ts`, `auth/AuthBroker.test.ts`, `auth/composition.ts`\n  - Verify: hit=0 calls; one-rejects; deadline; sibling-abort; elapsed\u2248max tests green\n- [ ] **T4 (P1, human: ~4h / CC: ~15min)** \u2014 auth/SessionMint \u2014 Implement with injected `Reader` only; return minted session to `AuthBroker` for storage\n  - Surfaced by: Architecture A2 (D8)\n  - Files: `auth/SessionMint.ts`, `auth/SessionMint.test.ts`\n  - Verify: type test (no `set`); late-mint-does-not-repopulate test green\n- [ ] **T5 (P1, human: ~1d / CC: ~20min)** \u2014 auth/validateAndDispatch \u2014 Split into `validate()` + `dispatch()`; map known errors to `AuthResult`; rethrow unknown; header diagram\n  - Surfaced by: Code quality C1 (D10)\n  - Files: `auth/validateAndDispatch.ts`, `auth/validateAndDispatch.test.ts`\n  - Verify: one test per variant + unknown-propagates + no-dispatch-on-non-ok green\n- [ ] **T6 (P1, human: ~1.5d / CC: ~30min)** \u2014 tests/parity \u2014 Write `authBehavior.contract.test.ts` parameterized over `legacyAuthFlow()` and `AuthBroker`\n  - Surfaced by: Test review T1 CRITICAL (D11)\n  - Files: `auth/authBehavior.contract.test.ts` (or `tests/`)\n  - Verify: six scenarios green for both implementations before any tenant is allowlisted\n- [ ] **T7 (P2, human: ~1d / CC: ~30min)** \u2014 tests/e2e \u2014 Write `auth.e2e.test.ts`: legacy login, v2 login, tenant suspension denial, kill-switch rollback mid-session\n  - Surfaced by: Test review T2 (D12)\n  - Files: `auth/auth.e2e.test.ts`\n  - Verify: 4 flows green against IDP stub in CI\n- [ ] **T8 (P2, human: ~1h / CC: ~5min)** \u2014 docs \u2014 Header ASCII diagrams in `AuthBroker.ts`, `validateAndDispatch.ts`, `router.ts`\n  - Surfaced by: Architecture A5, Code quality C4\n  - Files: `auth/AuthBroker.ts`, `auth/validateAndDispatch.ts`, `auth/router.ts`\n  - Verify: diagrams match the routing table and variant map\n- [ ] **T9 (P3, human: ~30min / CC: ~5min)** \u2014 TODOS.md \u2014 Create with the four approved entries below\n  - Surfaced by: Final planning decisions D15-D18\n  - Files: `TODOS.md`\n  - Verify: file matches TODOS-format (What/Why/Context/Effort/Priority)\n\nEffort assumption: tests ~50x, features ~30x, architecture ~5x human\u00f7CC ratios, adjusted down for a 3-component auth change.\n\nJSONL artifact: `~/.gstack/projects/gstack-plan-count-Sr94jU/tasks-eng-review-20260915-192142.jsonl` (9 tasks).\n",
      "### R5: legacyAuthFlow() regression contract\nFinding: T1, P1 CRITICAL, 9/10, PLAN.md:14-16 (\"does not exercise legacyAuthFlow() or assert compatibility\") + PLAN.md:27-28, native reviewer\nPlan baseline: no regression coverage for legacyAuthFlow(); after D4 it is unchanged code called through a new router\nRuntime evidence: unknown; no source or tests in this repo\nState: approved\n\nComparison grid:\n\n| Choice | Current | A | B | C |\n|---|---|---|---|---|\n| R5 behavior to preserve | unstated | legacy success, expired, revoked, tenant-suspended, IDP-failure outcomes and side effects (cache writes, emitted events) | same | router passes args/result through unchanged |\n| R5 test shape | none | shared parity fixture `authBehavior.contract.test.ts` run against legacyAuthFlow() now and AuthBroker (both must pass) | characterization suite `legacyAuthFlow.test.ts` pinning current outputs only | one routing pass-through test |\n| Intentional differences | none in this PR (legacy unchanged, D4) | none | none | none |\n| Acceptance assertions | none | identical outcome + identical cache key written for each scenario, both impls | identical outcome + cache key for legacy | router calls legacy with same args, returns same result |\n| Router branch tests (D9) | approved work | carried | carried | carried |\n| R6 IDP parallelization tests | pending (Section 4) | pending | pending | pending |\n\nQuestion D11: Shared parity suite (recommended) / Characterization suite / Router pass-through only\nActual answer: Shared parity suite run against legacy AND AuthBroker (D11)\nAccepted scope: `authBehavior.contract.test.ts` with implementation-agnostic scenarios (valid, expired, revoked, tenant suspended, IDP unreachable, missing tenant ID) asserting outcome + cache key written; parameterized over `legacyAuthFlow()` and `AuthBroker`. Both must pass before any tenant enters `AUTH_V2_TENANTS`. Intentional differences: none in this PR.\nHistory: none\n"
    ],
    "provenance": "Exact ordered current test declaration, execution lanes, complete task section and owned approved R5 ledger from the captured report. Full original report hash retained; this excerpt is not the full report."
  }
}