authz matrix: `dispatcher-plugin.ts` mounts routes AND already writes SSE, but no transport tripwire watches it — a realtime transport landing there mints no key

[os-zhuang]

Filed unassigned and unlabelled for triage routing by the dev seat on #9084 (session session_012WKSnqAaoqtW3QX7SSf1Vk), branch claude/issue-9084-realtime-tripwire-mechanics. Not a claim — measured while widening the fifth #2992 transport tripwire. Out of scope there: the #9084 declared file surface is the conformance test, and this needs a decision the evidence does not settle (below).

The gap

The #2992 transport tripwires in packages/qa/dogfood/test/authz-conformance.test.ts watch a curated list of five files. packages/runtime/src/dispatcher-plugin.ts is not one of them, and it has both properties that make a file a plausible landing site for a realtime transport:

1. It mounts routes. It is the registration path for /actions, /automation and /packages — a path separate from the @objectstack/rest one. The conformance test's own comment already names this: "/actions and /automation are mounted by dispatcher-plugin.ts, a separate registration path from the @objectstack/rest one that gates /data and /meta, which is exactly why they diverged unnoticed."
2. It already writes SSE server-push responses. Two sites, packages/runtime/src/dispatcher-plugin.ts:248 and :356:

res.header('Content-Type', 'text/event-stream');
res.header('Cache-Control', 'no-cache');
res.header('Connection', 'keep-alive');

So the SSE machinery — content type, no-cache, keep-alive — is already present and working in an unwatched route-mounting file. A realtime subscribe/fan-out transport wired there produces no key, no UNCLASSIFIED surface and no CI failure. The protocol page's callout states the limitation in general terms ("A transport wired outside the watched files produces no key and no failure"); this issue is that the limitation has a specific, already-SSE-capable file sitting inside it.

This is the same class as #9084 (a tripwire aimed somewhere other than where the transport would land), one file over.

Measured on origin/main e1bb0cad6

• dispatcher-plugin.ts appears in authz-conformance.test.ts: only in a prose comment, never as a probe file.
• Probe file values naming a runtime dispatcher: packages/runtime/src/http-dispatcher.ts only (three probes). http-dispatcher.ts and dispatcher-plugin.ts are different files.
• text/event-stream in dispatcher-plugin.ts: 2 occurrences (lines 248, 356).

Control query, so the zero above is not a broken search: grepping authz-conformance.test.ts for http-dispatcher.ts returns 4 hits in the same read that returns 0 for dispatcher-plugin.ts as a probe file. The search works.

Why this is filed rather than patched

The obvious repair — add dispatcher-plugin.ts to the tripwire population with the mechanics pattern #9084 just introduced — cannot be applied mechanically, which is why it is a decision rather than a bounded fix. Those two existing text/event-stream sites are AI/agent response streaming, not realtime subscription fan-out. A mechanics probe on that file would mint a key for them on day one: an immediate UNCLASSIFIED surface on main for a surface that is not the hazard #2992 is about, and the only exits are to classify two non-realtime sites in the authz matrix or to weaken the pattern. Neither should be chosen by a dev seat mid-card.

Options for the matrix owner:

• A. Watch the file with a marker that separates subscription fan-out from per-request response streaming (e.g. an upgrade handler, a subscribe registration, or a realtime-service call) rather than the bare SSE content type.
• B. Watch it with the full mechanics pattern and classify the two existing AI-streaming sites with an enforced row naming their authorization site — honest, but it puts two non-realtime surfaces into the realtime tripwire vocabulary.
• C. Record deliberately that dispatcher-plugin.ts is out of the watched set, with the reason, so the next reader is not left to infer coverage that is not there.

No recommendation from this seat — under #9083's rule the choice changes what a TRANSPORT-WIRED key means, which is the matrix owner's call.

Related: #9084 (the same class in rest-server.ts, PR #9409) · #9083 (TRANSPORT-WIRED admission rule) · #8347 (WS/SSE transport, v18) · ADR-0096 D4 · framework#2992.

[os-zhuang]

Triage: routed domain:cli (fix face is packages/qa/dogfood/test/authz-conformance.test.ts), type Task, needs-user-decision — the A/B/C choice changes what a TRANSPORT-WIRED key means (#9083 admission rule) and sits on the security/authz-matrix floor, so it is not adjudicable by a seat.

Four-facet card face:

• Platform long-term coherence: A keeps the tripwire vocabulary meaning exactly "realtime transport"; B dilutes it with two AI-streaming rows; C leaves the known gap but records it where the next reader looks. A > C > B.
• Measured business pull: zero today — realtime transport is realtime: no WS/SSE transport — service-realtime is in-process only and clients long-poll; big-screen/command-center scenarios need real push #8347, scheduled v18; the two existing SSE sites are per-request AI response streaming, not fan-out. Nothing lands in this file before v18 by plan.
• AI-agent error-resistance: the hazard is an agent wiring a transport into an unwatched route-mounting file with working SSE plumbing and minting no key. A closes that structurally; C only documents it.
• Startup scope discipline: A requires designing a fan-out marker now, for a v18 surface; C is one honest paragraph.

Recommendation: C now, A as a named precondition of #8347. Record dispatcher-plugin.ts as deliberately out of the watched set with the reason, and write into #8347's card that its acceptance includes promoting this file into the tripwire population with a fan-out-specific marker (option A). That spends the design effort when the hazard becomes real, and no reader is left inferring coverage that is not there in the meantime.

Triage seat routine — session session_pm_triage_20260818T0104Z.

---

Generated by Claude Code

[os-zhuang]

Maintainer ruling recorded — maintainer, 2026-08-18, batch acceptance of the triage seat's decision-inbox recommendations, verbatim: 「同意」. Provenance: triage session session_pm_triage_20260818T0104Z.

Ruled: C now, A as a named precondition of #8347. Concretely:

• C (this card's work): record dispatcher-plugin.ts as deliberately outside the watched tripwire set, with the reason (its two text/event-stream sites are per-request AI response streaming, not realtime subscription fan-out), where the next reader looks — the conformance test's watched-list comment and the protocol page's callout. No probe added, no key minted, no matrix rows for the two non-realtime sites.
• A: promoting this file into the tripwire population with a fan-out-specific marker (upgrade handler / subscribe registration / realtime-service call, not the bare SSE content type) is written into realtime: no WS/SSE transport — service-realtime is in-process only and clients long-poll; big-screen/command-center scenarios need real push #8347's acceptance as a precondition — a companion comment lands on realtime: no WS/SSE transport — service-realtime is in-process only and clients long-poll; big-screen/command-center scenarios need real push #8347 in this same stroke. B is rejected: it would put two non-realtime surfaces into the TRANSPORT-WIRED vocabulary.

Label needs-user-decision → pm:queue (the C recording work) in the same stroke.

---

Generated by Claude Code

[os-zhuang]

Claim: PM loop round 14
Session: session_012WKSnqAaoqtW3QX7SSf1Vk
Branch: claude/issue-9410-dispatcher-plugin-out-of-watched-set
Worktree: objectstack-issue-9410
Domain: domain:cli
File surface: packages/qa/dogfood/test/authz-conformance.test.ts (the PROBES watched-list comment) and content/docs/protocol/** (the callout) + a companion comment on #8347 (stop on breach; explain in the report)
Container & model: S, mode:subagent, model: opus
Clause-②: no — Option C changes no behaviour at all. It mints no key, adds no probe, and adds no matrix row; it records a boundary that already exists.
Serial constraints cleared: packages/qa/dogfood/** — free (#9084 landed b2d9e04d1, #9364 landed 88e1bac58). packages/runtime/src/dispatcher-plugin.ts is read-only for this card and is not the write face of round 14's other dispatch (#9446 writes packages/runtime/src/action-execution.ts), so the two do not intersect.

Tier derivation (node scripts/pm/dispatch-gates.mjs --tier packages/qa/dogfood/test/authz-conformance.test.ts content/docs/protocol/kernel/http-protocol.mdx, run now, not recalled): no path-derived mandate. Taken to opus rather than the sonnet floor deliberately: the deliverable is a reason, and a comment that records the wrong reason is worse than no comment — this is authorship, not a mechanical edit.

Stale-premise check on origin/main (8a56ad5a1): the two SSE sites the ruling turns on are still there — dispatcher-plugin.ts:248 and :356, both text/event-stream. dispatcher-plugin.ts is mentioned once in authz-conformance.test.ts (:96) but in the #5519 gate-pin comment, about route mounting, ⛔ not as a recorded exclusion from the watched set — so the card's gap is real and the existing mention is a neighbour to write beside, not the thing already done. Control: TRANSPORT-WIRED appears 9× in that file.

⚠️ Read the maintainer's ruling comment on this card before writing anything — it is narrower than the recommendation it accepted. B is rejected by name, A is deferred into #8347's acceptance, and C's content is specified down to the reason to give (the two sites are per-request AI response streaming, not realtime subscription fan-out). ⛔ No probe, no key, no matrix rows.

---

Generated by Claude Code