plugin-auth: if the first request arrives before the async OIDC discovery mount, it fails ("matcher is already built") and /.well-known/openid-configuration answers 404 for the process lifetime

[objectstack-fleet]

Filing gate: ① a product defect, class a, reach: a public HTTP door measured once with a wrong result (in-process, on a real composition; production timing not measured).

• Who acts: triage routes it. The fix is in plugin-auth; the hint is domain:services.
• Dedup: search_issues on objectstack for "OIDC discovery well-known openid-configuration 404 matcher already built registerOidcDiscoveryRoutes": 4 hits, all closed and unrelated ([finding] registerDiscoveryEndpoints' auth branch strips only the retired /projects/:environmentId, so a scoped /discovery advertises routes.auth still scoped — and with an unsubstituted :environmentId #16538, runtime dispatcher's two discovery bodies (.well-known + REST-less {prefix}/discovery fallback) are the machine-read { data } class #9436 ruled on, and sit outside check-route-envelope's scan #9813, [bug] OIDC SSO registration is broken end-to-end: the bridge always sends oidcConfig.mapping.id, which @better-auth/sso@1.7.0-rc.2 rejects as an unrecognized key #8193, routes.mcp 是 REST /discovery 发出、objectui 真实消费、但 ApiRoutesSchema 从未声明的键(#4828 同族,低一层) #5679).

Filed by the repo:cloud seat (repo:cloud#1, session session_01YSygzqVmrY31BnZge8KDo6, R43), from the cloud#2526 dev's measure-first report (an out-of-scope finding, class a). The producer is framework code, so it is filed here, bare; routing and grading are triage's.

Measured

On the cloud control-plane composition (cloud main 0ae69f6d, framework pin 4b4ee88f), booted in-process on both the bare-adapter and the OS_NODE_SERVE=1 paths:

• When the first request arrives before plugin-auth has finished its async OIDC discovery mount, the mount throws Can not add a route since the matcher is already built. That is logged at ERROR and swallowed.
• GET /.well-known/openid-configuration and GET /.well-known/oauth-authorization-server then answer 404 ENDPOINT_NOT_FOUND. They still do 3 s later, and for the life of the process.
• With 5 s idle before the first request, both answer 200.

NOT MEASURED: whether a production container's first request lands inside that window.

Mechanism (read at objectstack main 2821e9f15)

packages/plugins/plugin-auth/src/auth-plugin.ts :3230 is void this.registerOidcDiscoveryRoutes(rawApp, ctx).catch(...). registerOidcDiscoveryRoutes (:3244) awaits the auth instance before calling rawApp.get(...). If Hono's router has already frozen its matcher on a first request, the late get throws.

Related: cloud#2526 (where this was measured).

---

Generated by Claude Code

[objectstack-fleet]

Triage: first grade — bug · priority:p2 · domain:services · area:identity · pm:queue. Direction: mount the discovery routes at start; resolve the auth instance per request

Triage seat (objectstack-wide, seat post #6015) · session_01AavokzJ5DndAwitDXvKy4U · 2026-10-01T06:08Z. ⛔ Not a claim, ⛔ not a dispatch.

Why p2. A public discovery door answers 404 for the life of the process, measured in-process on a real composition. Whether a production container's first request lands in that window is not measured.

• Raise rule: if the claim measures the window being hit on a production-shaped boot (a readiness probe is the likely first request), it raises the card to p1 and says so here.

Routing. plugin-auth is domain:services.

Direction.

• The OIDC discovery routes are registered synchronously during the plugin's start, before the server can build its matcher. Each handler awaits the auth instance when a request arrives.
• ⛔ No route is added after start, and ⛔ no swallowed registration error. A route that cannot mount fails start loudly.
• Census: the claim lists any other late registration in plugin-auth of the same shape and fixes it in the same PR.
• Pins: with the auth instance resolving late, a request that arrives first does not freeze the discovery routes out. Both /.well-known doors answer 200 once the instance is ready. The 5 s idle boot is the control.

---

Generated by Claude Code

[objectstack-fleet]

Claim: PM loop round 1 · 2026-10-01T07:46Z
Session: session_01DiCSbmJrkzNhuEAier4VoJ
Account: os-bill (the seat's linked user as GET /user answers it; the card's assignee)
Branch: claude/issue-21078-oidc-discovery-sync-mount
Worktree: objectstack-issue-21078
Domain: domain:services
Seat: domain:services#2 (seat post #21118)
File surface: packages/plugins/plugin-auth/src/auth-plugin.ts (the OIDC discovery mount, at registerOidcDiscoveryRoutes and its call site in start, plus any other late registration of the same shape that the census finds), its tests under packages/plugins/plugin-auth/src/, and a changeset. Stop on breach; explain in the report.
Container & model: M, mode:subagent, model: opus (dispatch-gates --tier: no path-derived mandate; default tier)
Clause-②: no
Thread-read: 5925765529
Serial constraints cleared: I diffed the pushed branches of every open pm:dispatched card (29 cards, 26 branches) against origin/main. None touches packages/plugins/plugin-auth/** or pnpm-workspace.yaml, which this lane serializes as one hot surface with plugin-auth. No open PR bumps the auth stack. pnpm-workspace.yaml changed today on origin/main (b10f6e46, deps); the dev works on the merged code.
Selection: the P1 cards are taken first, per the maintainer's order 「优先 p1 的卡片」 (seat post #21118). #21058 and #21057 are dispatched. #21079 is serial behind #21063 on security-plugin.ts, and #21080 is serial behind #20987 on native-sql-strategy.ts. This card is the next by label order (priority:p2, bug, oldest), and it fills the batch's third slot.

Clause-② no: the discovery doors keep their published shape. They answer on every boot instead of 404 inside a timing window, and no accept set or public surface changes.

---

Generated by Claude Code

[objectstack-fleet]

os-dev-report
{
"issue": 21078,
"status": "done",
"branch": "claude/issue-21078-oidc-discovery-sync-mount",
"pr": "#21132",
"session": "session_01DiCSbmJrkzNhuEAier4VoJ — subagent of the PM seat session (container CLAUDE_CODE_REMOTE_SESSION_ID cse_01DiCSbmJrkzNhuEAier4VoJ)",
"premise_still_valid": true,
"summary": "Premise confirmed at 53ed3d1: auth-plugin.ts :3230 was void this.registerOidcDiscoveryRoutes(rawApp, ctx).catch(...) and :3244 awaited getAuthInstance() before any rawApp.get. The in-process repro is the new pin. With the instance on a deferred and one request served first, the pre-fix file answers 404 on both doors. registerOidcDiscoveryRoutes is now synchronous and is called from the existing synchronous registerAuthRoutes in the kernel:ready route hook, before kernel:listening opens the socket. All five discovery routes are mounted on config-level decisions: the two doors, the RFC 8414 base-path alias, and the two RFC 9728 protected-resource documents. A mount throw now propagates out of the hook and fails the boot. Each handler resolves the instance-level half per request through the memoised getAuthInstance(): a degraded oauthProvider gets next(), which is the same answer as when the path was not mounted, and the vendor document builders are bound to the live instance. One call at boot runs the same resolution and mounts nothing. It keeps three existing boot behaviours: the eager background instance build, the degraded ERROR line, and the Failed to register OIDC discovery routes anchor that publish-smoke.sh matches by name. Census: only those five routes were registered late. Every other plugin-auth route is already synchronous. Raise rule: on a production-shaped objectstack start boot the pre-fix window was NOT hit (3 of 3 runs, the async mount landed 197-292 ms before listen), so this measurement does not raise the card to p1.",
"tests": "HEAD eb85e82. (1) pnpm --filter @objectstack/plugin-auth exec vitest run --maxWorkers=2 (full package, via os-verify-lock): Test Files 116 passed (116), Tests 2480 passed (2480), VERDICT command-exit 0. (2) pnpm --filter @objectstack/plugin-auth run typecheck: exit 0, check:test-typecheck OK, 10 files / 94 errors / 23 signatures held; the new test file compiles clean. (3) New pin file src/oidc-discovery-sync-mount.test.ts: 8 tests, all pass on HEAD. ABLATION A (scripts/ablation-replace.mjs, the forbidden shape put back as void this.authManager!.getAuthInstance().then(() => this.registerOidcDiscoveryRoutes(rawApp, ctx)).catch(log)): anchor 1->0, marker 0->1, blob c11a3fa6->83ec14c2. Result 6 failed / 2 passed: control (late-but-idle) and degraded pass; the early-request pin received [openid-configuration, 404]; arrives-first received [404, 404]; sync-registration found 5 paths missing; mount-throw received undefined, not the refusal; instance-failure received 404, not 500. Restored blob == HEAD c11a3fa6 and git diff HEAD empty. ABLATION B (BASE 53ed3d1 auth-plugin.ts blob f2324f20 written over the file under an EXIT INT TERM trap): 7 failed / 1 passed. The control passed. The degraded test failed only on its report line, and its doors matched the unmounted composition on BASE as well. Restored to blob c11a3fa6 == HEAD with git diff HEAD empty. The subject is imported from src by relative path, so no dist rebuild was needed. (4) Production-shaped dist leg (ablation C): BASE auth-plugin.ts was built into dist, ablation-dist-preflight confirmed the marker void this.registerOidcDiscoveryRoutes( present (exit 0), then the real CLI booted objectstack start (NODE_ENV=production, empty kernel, local SQLite) with a GET /api/v1/health probe every 5 ms. Mount vs listen vs first-request ms: 6292/6523/6545, 5806/6098/6120, 6079/6293/6312. Doors 200/200 in all 3 runs. Idle control 5516/5713/10719, 200/200. Fixed dist: early 5444/6064/6091 200/200; idle 6173/6930/11937 200/200. No ERROR line in any boot. Restore: src blob == HEAD, rebuilt, preflight --absent exit 0, whole-tree git status --porcelain empty. (5) Lint, narrowed and proven: eslint --no-inline-config --format json over the 5 touched TS files reported 5 files, 0 errors, 0 warnings. The population is eslint.config.mjs files **/*.{ts,tsx,mts,cts,js,jsx,mjs,cjs}. Type-aware linting is never enabled (no parserOptions.project), so no untouched file's verdict can move. (6) Build: turbo run build --filter='@objectstack/cli...' gave 59/59 tasks, exit 0.",
"gates": "dispatch-gates.mjs --repo objectstack-ai/objectstack --commands (derived from merge base 53ed3d1, 6 paths): 65 commands, all run at eb85e82 with exit codes recorded; 65/65 exit 0. --ran reconciliation (exit codes recorded): 65 derived, 65 run, 0 NOT-MEASURED, 0 UNRUN. check:dual-build-cjs-loads first answered PREREQUISITE NOT MET (exit 3; nine unrelated packages had no dist/); re-run once their dist/ existed, exit 0 (105 entry points / 66 packages load). Of note: check:auth-mount-ledger OK (20 auth mounts all accounted for), check:doc-authoring OK, check:nul-bytes OK (9733 files). NOT MEASURED, as the tool declares outside its runnable total: the 6 workflow-valued families, the 5 path-scheduled CI jobs (Test Core, Temporal Conformance, Dogfood x2, Build Core) and the 4 type-check lanes. Those are CI's.",
"line_budget": "+492 / -35 over 6 files (527 changed lines, under the 5000 human-merge threshold): auth-plugin.ts +140/-32, new pin test +316, three fixtures +8/-1 each, changeset +12.",
"files_changed": [
".changeset/21078-oidc-discovery-sync-mount.md",
"packages/plugins/plugin-auth/src/auth-plugin.ts",
"packages/plugins/plugin-auth/src/oidc-discovery-sync-mount.test.ts",
"packages/plugins/plugin-auth/src/auth-catchall-fallthrough.test.ts",
"packages/plugins/plugin-auth/src/auth-catchall-yield.test.ts",
"packages/plugins/plugin-auth/src/admin-sso-bridge-gate.test.ts"
],
"deviations": [
"Base: origin/main had moved from the dispatch's 9c8b65a to 53ed3d1 when the worktree was created. Work is on 53ed3d1, and plugin-auth is identical between the two. main has moved again since then (to 7a606a9), but no plugin-auth, plugin-hono-server or core lifecycle file changed.",
"Registration point: the triage text says 'during the plugin's start'. The routes are registered where every other plugin-auth route already is, in the synchronous registerAuthRoutes inside the existing kernel:ready route hook, which runs before kernel:listening opens the socket. That hook already exists to wait for http-server, and moving into start() itself would change that. The spec contract (plugin-lifecycle-events.ts) defines kernel:ready as the route-registration phase.",
"One void remains in registerOidcDiscoveryRoutes: the boot-time preparation call. It mounts NOTHING and logs both outcomes at ERROR. It is kept so this PR changes only route-registration timing: the better-auth instance is still built eagerly at boot, the degraded oauthProvider ERROR line still appears at boot, and the publish-smoke boot anchor Failed to register OIDC discovery routes still fires on the class it was written for. A reviewer grepping for the old shape will find it, and the PR body explains why it is there.",
"Three existing fixtures (auth-catchall-fallthrough, auth-catchall-yield, admin-sso-bridge-gate) now construct AuthPlugin with plugins: { oidcProvider: false }. Their manager stubs lack getAuthIssuer, and the formerly-async discovery mount used to fail into their logger mock on every run. This is within the claimed surface (tests under plugin-auth/src).",
"Transport notices (plain-HTTP accepted/public) now emit at mount (config-level) instead of after the degraded-oauthProvider early return. In the degraded case on a public plain-HTTP origin, the notice's 'reachable now' clause is contradicted by the degraded ERROR line that follows. This is recorded in the PR Acceptance notes."
],
"raise_rule_measurement": "NOT RAISED by this measurement. Boot shape: objectstack start from this worktree's CLI dist, NODE_ENV=production, empty kernel, default composition (OIDC on by default through the MCP surface), local SQLite, fresh home, on a shared container. Readiness probe: GET /api/v1/health every 5 ms from spawn until answered; the first answer came 19-27 ms after 'HTTP server started'. With the pre-fix dist, the async mount line came 197-292 ms BEFORE listen in 3 of 3 runs, so the matcher was built after the mount and both doors answered 200. NOT MEASURED: the cloud control-plane composition where the card measured 404, and boots against a remote database, where the instance build is longer. The window opens whenever the better-auth build outlasts the remaining kernel:ready plus kernel:bootstrapped hooks. The p1 write belongs to the PM.",
"mcp_calls": "0",
"api_writes": "3 relay strokes through scripts/pm/fleet-write (each is one POST /repos/objectstack-ai/objectstack/dispatches, executed by fleet-write.yml as objectstack-fleet[bot]): (1) pr_create, POST /repos/objectstack-ai/objectstack/pulls, draft #21132, body read back byte-identical (10784 bytes); (2) label-write --assign os-bill, POST /repos//issues/21132/assignees, read back MATCHES (assignee os-bill; no label written); (3) this os-dev-report, POST /repos//issues/21078/comments. Plus git push of the branch (not REST). No other writes.",
"open_questions": [],
"out_of_scope_findings": [
"carrier: none (承接者:无) · noted in PR Acceptance notes, not filed · scripts/publish-smoke.sh comments say plugin-auth emits Failed to register OIDC discovery routes 'when OIDC discovery route registration throws'. After this PR, a registration throw fails the boot instead, and the anchor line means the documents could not be prepared from the auth instance. The pattern still matches; only the comment text is stale. Dedupe words: publish-smoke SMOKE_BOOT_ERROR_PATTERN OIDC discovery anchor comment",
"carrier: none (承接者:无) · noted in PR Acceptance notes, not filed · auth-manager.ts authBuild docblock (~:1283) and the auth-manager-instance-single-flight.test.ts header still name 'registerOidcDiscoveryRoutes() with void' as the boot caller of getAuthInstance(). The caller is now the boot-time preparation call, and the single-flight reasoning is unchanged. These files are outside this card's file surface. Dedupe words: single-flight getOrCreateAuth boot caller registerOidcDiscoveryRoutes void comment"
]
}

---

Generated by Claude Code

[objectstack-fleet]

PM review — PR #21132: ACCEPT. Landing: ordinary queue, once every check on head eb85e827 is green

domain:services seat 2 (#21118) · session_01DiCSbmJrkzNhuEAier4VoJ · 2026-10-01T08:36Z. Reviewed-by: this seat. Implemented-by: os-dev subagent, same session (report 5927774690).

Checklist, read on GitHub rather than from the report:

• Shape: draft, base main, first line Fixes #21078, Clause-②: no (matches the claim). The body names no other open card next to a closing keyword (scanned).
• Path surface (PR file list): plugin-auth/src/auth-plugin.ts, one new pin file, three fixtures under plugin-auth/src/, and a patch changeset for @objectstack/plugin-auth (published: no private). check-governed-merges.mjs --pr 21132: not governed, 527 changed lines (≤ 5000). All of it sits inside the claimed surface.
• Diff, read in full (auth-plugin.ts):
  • registerOidcDiscoveryRoutes is synchronous and called in place of the void …catch(log).
  • All five routes are mounted on config-level decisions before the hook returns.
  • The instance-level half resolves per request through getAuthInstance().
  • A degraded oauthProvider answers next(), which is the unmounted answer. The RFC 9728 document keeps the same gate it had.
  • A mount throw now leaves the hook, and no route is added after an await.
  • The one remaining void is the boot-time preparation call. It mounts nothing and logs both outcomes. It keeps the Failed to register OIDC discovery routes anchor that publish-smoke.sh greps.
  • Triage's direction 5925765529 is met. Registering in the kernel:ready route hook rather than literally in start() is the plugin's existing route phase. It precedes kernel:listening, and the PR body states it.
• Evidence accepted:
  • the new pin (8 tests) is green on head eb85e827;
  • ablation A (the async mount put back) turns 6 of 8 red: the early-request doors answer 404 and five paths go missing. The controls stay green, and the restore is byte-identical;
  • ablation B (the base file written back) turns 7 of 8 red;
  • the full plugin-auth suite (2480 tests), typecheck and build are green;
  • 65 of 65 derived gates pass, reconciled with --ran.
• Census: only the five discovery routes were registered late. Every other plugin-auth route was already synchronous.
• Raise rule (triage 5925765529): not raised. On a production-shaped objectstack start boot with a 5 ms readiness probe, the pre-fix mount landed 197–292 ms before listen in 3 of 3 runs. The card stays priority:p2. The cloud composition where the card measured 404 was not re-run, and neither was a remote-database boot. Both are NOT MEASURED.
• CI on head eb85e827 at this write: 12 success, 3 skipped, 18 in progress, 0 failed. Landing waits for every check, not the required subset.

Out-of-scope findings (carrier: none):

1. Acceptance notes — the stale comment in scripts/publish-smoke.sh about when the anchor line fires. The pattern still matches; only the prose moved.
2. Acceptance notes — the auth-manager.ts authBuild docblock and the single-flight test header still name the old void caller. The single-flight reasoning is unchanged.

Neither is a defect class under the filing gate.

---

Generated by Claude Code