epic #470 C12: delete the two dev-platform publicPaths exemptions

[Weegy]

Epic #470 C12. Stacked on feat/470-c10-delete-dev-platform (C11 has no branch yet). Single revertible commit.

What

Deletes the two STATIC_PUBLIC_PATHS entries core held on the Dev Platform's behalf: the runner phone-home prefix (which also carries the LLM proxy under /llm/) and the GitHub-App callback/setup redirect targets.

Why this is a handover, not tidy-up

Since C4 the plugin declares its own public prefixes in permissions.public_paths, claimed exclusively at activation and consented per prefix by the operator (platform/publicPathGrants.ts).

The C4 validator rejects a declaration colliding with a live static exemption:

is already a static core public path (…) — remove the core exemption first, or drop the declaration

Two mechanisms claiming one URL is ambiguous and only one of them terminates, so the validator refuses rather than letting the static entry silently win. While these two entries existed, the plugin's own grant could never validate. Verified against this branch:

/api/v1/dev-runner                 => ACCEPTED
/api/v1/dev-platform/github-app    => ACCEPTED
CONTROL (exemption restored)       => REJECTED: is already a static core public path (…)

Nothing goes dark: the grant path is what serves these now, and it fails closed — empty grant table, store down, plugin not activated, registry unwired all degrade to requireAuth 401, never to "less authentication".

The guard

middleware/test/auth/staticPublicPathsClosedSet.test.ts pins STATIC_PUBLIC_PATHS as a closed set: every entry must be accounted for by a named, justified core-owned exemption, and every documented exemption must still have an entry. Mutation-checked — restoring either deleted entry fails the suite and prints the restored entry:

not ok 1 - holds exactly one entry per core-owned exemption, and no others
    + '/^\\/api\\/v1\\/dev-runner(?:\\/|$|\\?)/'
    + '/^\\/api\\/v1\\/dev-platform\\/github-app\\/(?:callback|setup)(?:\\/|$|\\?)/'

That is what makes this cleanly revertible: the revert flips one test, not a suite.

Why the suite does not name the two deleted paths

Deliberate, and worth arguing with if you disagree. Hardcoding a plugin's wire paths into a core test is a reference to that plugin whichever direction it asserts in — the exact coupling this epic removes, the thing scripts/check-core-decoupling.mjs counts on its way to a permanent zero (C13), and a guard that goes stale-but-green the day the plugin renames a path.

Stated as a closed set it is also strictly stronger: enumerating two paths catches those two coming back, pinning the whole array catches any unauthenticated surface being added — including the next one nobody has thought of yet.

The 401 then follows as a corollary rather than an enumeration, since requireAuth runs on the /api mount before routing. Asserted end-to-end against the same chain src/index.ts assembles (express.json + cookieParser + the OB-106 app.use('/api', requireAuth, …) line, nothing mounted underneath), including 401 rather than 404 for an unmounted path — because a guard that decided after routing would leave the path open the moment anything mounts under it.

Verification

Check	Result
staticPublicPathsClosedSet + 8 related auth/grant/MCP suites	210 pass, 0 fail
Mutation check (restore each entry)	red, and names the entry
C4 handover (validator accepts, control rejects)	confirmed
eslint, tsc --noEmit	clean
typecheck:test ratchet	371, no regressions
check-core-decoupling.mjs	214 → 209, no zone raised

Baseline intentionally left at 214 — C13 drives it to 0 and pins it there.

Do not merge yet; stacked.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

---

Cross-family review (Forge)

Reviewed against code, not against the description. GPT-5.4 (reasoning=high) via codex exec — a different model family from the author, deliberately.

Verdict: MERGE. Every claim in this PR held up under mutation.

What was verified against the tree

Claim	How it was checked	Result
Exactly the two exemptions removed, nothing else	Full git diff of publicPaths.ts	8 deleted lines: 6 comment + the 2 regexes. No other file touched besides the new suite. Confirmed
The closed-set guard is load-bearing	Re-added /^\/api\/v1\/dev-runner(?:\/|$|\?)/ to the array and ran the suite	Red, 7/8, and the failure message names the missing owner row. Not a decorative assertion
Formerly-exempt paths now 401	The suite's 5 off-list probes ran for real (# skipped 0), and requireAuth is mounted on /api at index.ts:1610 ahead of routing	Confirmed, and the probes are generic (/api/v1/plugin-owned/…) so no plugin path is written back into core
C4 validator now accepts the plugin's declaration	platform/publicPathGrants.ts:181-191 — the collision branch returns ok: false only while a static entry matches; the comment states the handover explicitly	Confirmed in code. Removing the exemption is what makes the declaration validate

Deriving the removed paths from git rather than naming them was the right call, and stating the guard as a closed set is strictly stronger than enumerating two paths — it also catches the next unauthenticated surface nobody has thought of yet.

One defect fixed — f7acf93f

The suite computed sandboxDeniedListen and t.skip()d the five 401 tests when a loopback listener could not bind. Locally that is correct. In CI it is not: a runner that denied bind(127.0.0.1:0) would have deleted the entire 401 half of the guard while the job stayed green — the same permanently-green failure family the decoupling job's own timeout comment warns about.

The local skip stays; when CI is set the same bind failure now throws with a named reason. # tests 8 / pass 8 / skipped 0 before and after.

Gates

staticPublicPathsClosedSet 8/8 · middleware suite 6,948 tests, 6,936 pass, 0 fail, 12 skipped · typecheck:test ratchet 371, no regressions · middleware eslint clean.