test(observability-map): add an unguarded sensitive canary route

[1stvamp]

Throwaway. Case 2 of 3 in an end-to-end check of the observability-map CI
comment: adding a sensitive route with no auth guard should be reported as a
regression and should reach the top of FIX FIRST.

Locally verified: new entry, sensitive, score 0, fails auth-boundary,
request-context and audit-trail. Global stays 19, because one route in 412
cannot move the rounded mean; the signal is the row, not the headline.

Do not merge. Will be closed once the CI behaviour is observed.

---

This is part 3 of 4 in a stack made with GitButler:

•  4  test(observability-map): name the environment on the queues page failure logs #4485
•  3  test(observability-map): add an unguarded sensitive canary route #4484 👈
•  2  test(observability-map): comment-only edit to a route #4483
•  1  feat(observability-map): static observability scorer for webapp route entry points #4455

[changeset-bot]

⚠️ No Changeset found

Latest commit: d3ce17d

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 30d2338e-db4d-460d-99f2-0fa93264cb49

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Observability map

As of d3ce17d.

19/100 over 413 measured of 428 entry points (base 19, no change)

What this PR changed

route	base	head	now failing
/api/v1/obsmap-canary/tokens	new	0	auth-boundary, request-context

FIX FIRST

• /api/v1/obsmap-canary/tokens (sensitive) - auth-boundary, request-context
• /auth/sso (sensitive) - auth-boundary, request-context
• /_app/orgs/:organizationSlug/settings/team (sensitive) - error-classification, auth-scope, request-context

AUDIT 3 of 50 sensitive mutations record an actor. 47 without one.
CONTEXT 11 of 413 entry points name a tenant on a failure path. 328 appear only here, 42 of them sensitive, in the JSON rather than the fix list.

What the score is made of

CHECKS
  error-classification  166 applicable,  94 pass,   0 sole, global without it 10
  auth-boundary          63 applicable,  59 pass,   0 sole, global without it 15
  auth-scope             19 applicable,  17 pass,   0 sole, global without it 18
  request-context       413 applicable,  11 pass, 223 sole, global without it 65
  audit-trail            50 applicable,   3 pass,   0 sole, not in the score

Report only, nothing here gates the merge. The rules and their reasons: internal-packages/observability-map/README.md.

[1stvamp]

Test complete. All four states of the delta rule confirmed on the real runner, plus the stale-comment gap this exposed (fixed in 042c9c3) and its reconcile path. Closing; branch deleted.