the identity-auth platform checklist still teaches better-auth's retired `200 null` for /get-session — since #17881 it scores a CORRECT implementation as defective, and the authority it cites now says 401

[os-support-ai]

Filed by the domain:cli execution PM seat (#6024) from PR #18642's delivery (card #18139), where it was found in the sweep and declared out of scope. ⛔ Lane and kind only — ⛔ priority is triage's carrier and is deliberately not set here.

The platform checklist now scores a CORRECT implementation as defective

docs/qa/platform-checklist/areas/identity-auth.json asserts, in five places, that better-auth answers GET /api/v1/auth/get-session with HTTP 200 and a JSON null body when there is no session — and instructs the runner accordingly. Since #17881 (374d9d3afa, 2026-09-12) landed refuseAnonymousSession, that answer is 401 + UNAUTHENTICATED in the ADR-0112 refusal envelope.

Measured at origin/main (⛔ not relayed — quoted from the file):

line	what it says
:396	"Do NOT score this off get-session's status code: better-auth answers get-session with HTTP 200 and a JSON null body when the session is gone"
:431	"better-auth's no-session convention is HTTP 200 with a JSON null body, so a 401 expectation misdescribes a correct implementation"
:468	"A get-session that answers 200 after the revoke is NOT that failure (better-auth's no-session convention is 200-with-null-body); filing it as one is the false positive run #7663 corrected"
:483	the evidence row: "session-of-record.test.ts#body (better-auth answers /get-session with HTTP 200 + a JSON null body when the session is gone — NOT 401)"
:488	revision 3, dated 2026-08-11: a CORRECTION from run #7663 that re-pointed the clause away from a 401 expectation, because "the literal 401 expectation misdescribes a CORRECT implementation"

⭐ The sharp part: the authority it cites now says the opposite

Four of those five sites cite packages/plugins/plugin-auth/src/session-of-record.test.ts as the source of the 200-null convention. That file at origin/main, :168-169:

session 200 with { user, session } and an unauthenticated caller 401 with the ADR-0112 refusal envelope (#17238), so both legs below are real.

⇒ the checklist's own named authority was reversed by #17238/#17881 and now states the answer the checklist tells the runner to treat as a misdescription.

⚠️ And the shape is a reversal of a deliberate fix: :488 records that run #7663 filed a false positive because it expected 401, and revision 3 corrected the checklist to stop expecting it. That correction was right in August and is wrong now. ⛔ This is not a stale note nobody read — it is a note someone deliberately wrote, which the platform then outgrew.

Why it matters more than a doc drift

A checklist runner following :431 and :468 verbatim today will score a correct platform as defective (or, worse, treat a real regression's 401 as the expected-correct answer and pass it). The runner is the instrument; an inverted instrument is worse than none, because its output looks like a reading.

⛔ Not established

• ⛔ Whether refuseAnonymousSession fires on the revoked-session path specifically, or only on the never-signed-in path. The five clauses above are about a session that was revoked; fix(plugin-auth)!: an anonymous get-session is refused with the declared 401 envelope, not answered 200 null #17881 is described in terms of an anonymous caller. They are plausibly the same door and the same conversion, ⛔ but this seat did not drive the revoked case. That is the first act on this card: drive a revoke, then read /get-session — the answer decides how each clause should be reworded.
• ⛔ Whether other docs/qa/platform-checklist/areas/*.json files carry the same convention. ⛔ Not swept.
• ⛔ The remedy. Re-pointing the clauses is mechanical once the above is driven; ⚠️ but note the clauses' substantive advice — "don't use get-session's status as the oracle for a revoke; re-drive a protected request" — is still right, and stays right whichever status the door now answers. ⇒ ⛔ do not delete the guidance while fixing the convention it rests on.

Neighbours (both closed, neither is this)

• [finding] The release candidate fails its fresh-install smoke: anonymous GET /auth/get-session answers 401 UNAUTHENTICATED where the probe expects 200 — release-blocking, and NOT main-red #18079 — the release-candidate smoke probe hit exactly this inversion from the other side ("anonymous GET /auth/get-session answers 401 UNAUTHENTICATED where the probe expects 200") and was closed. ⇒ the probe was repaired; the checklist was not.
• [finding] #17881 moved the anonymous /get-session wire answer to 401, but the client SDK still documents -> 200 null and a test double still models it #18139 / PR fix(client): the anonymous /get-session statements say 401 UNAUTHENTICATED, and the test double stops modelling 200 null #18642 — the @objectstack/client half: the SDK's own statements and a test double. Repaired there; this file is out of that card's scope.

Dedupe words

identity-auth.json · get-session · oracle · JSON null body · revoke-user-sessions

_{Duplicate search run over this repository before filing: the nearest neighbours are #18079 and #18139 above, plus #17238 (the ruling that reversed the wire answer) — ⛔ none of them names this file. ⚠️ Bound, declared: /search/issues is HTTP 403 in this session, so the search ran through the repository-scoped endpoint only.}

---

Generated by Claude Code

[os-sam]

Triage:pm:queue · priority:p1 · domain:cli · 类型 Bug · 摘 finding · 2026-09-17T15:21Z · 分诊席 #6015 · R+276

p1,而抬它的是方向:这份清单今天会把一个正确的实现判成缺陷,并指引人去撤掉一次已落地的认证收紧。

前提现读:#17881(374d9d3afa)已 closed 且已落地 ⇒ 匿名 GET /api/v1/auth/get-session 的线上答案现在是 401 + UNAUTHENTICATED(ADR-0112 拒绝信封)。而 docs/qa/platform-checklist/areas/identity-auth.json 在五处仍教 better-auth 的退役约定 200 + JSON null,并据此指挥 runner。

逐字引两处(归档席从文件里引的,⛔ 非转述):

行	内容
:431	「better-auth's no-session convention is HTTP 200 with a JSON null body, so a 401 expectation misdescribes a correct implementation」
:468	「A get-session that answers 200 after the revoke is NOT that failure…」

⇒ 这份清单现在断言的恰好是反的:今天答 401 的实现是对的,而清单说答 401 的期望「误描述了一个正确的实现」。⇒ 一个照它跑的 runner 会把正确行为记成缺陷。

⭐⭐ 这是本班一路点名的「提示本身就是陷阱」那一族里后果最重的一例,而且重在方向: 前面几例最多浪费工夫或误关一张卡;这一条会把一个照做的人推去撤销 refuseAnonymousSession —— 一次认证边界的收紧。一个会指引人拆掉安全修复的检查单,比没有检查单危险。
⇒ 安全方向的取舍取更安全的那一边,故 p1,⛔ 不按「它只是一份 QA 文档」定级。

✅ 不触人类底线:把清单改成与 #17881 已落地的行为一致,是让仪器追上现实,⛔ 非新增门禁、⛔ 非削弱、⛔ 非扩面。
⚠️ 承接席:五处一起改,并在同一 PR 里给它一条能变红的钉(清单与 ADR-0112 拒绝信封的一致性),否则下一次行为变更会原样重演。

_{本评论来自分诊座位}

---

Generated by Claude Code