Ten dispatcher domains still claim by bare `startsWith` — `/datax`, `/metaxyz`, `/uifoo` are claimed by `/data`, `/meta`, `/ui`, the same defect just fixed on `/auth`

[os-litant]

Found while implementing the /auth segment-boundary repair for #16026. Out of that card's scope (it narrows exactly one prefix); filed unassigned.

The mechanism

DomainRoute.match defaults to 'prefix' — DomainHandlerRegistry.matches' default: branch is a bare path.startsWith(route.prefix) with no segment boundary. The registry preserved that on purpose when the domains were lifted out of the legacy if-chain, and says so in its own header comment:

Matching semantics are deliberately faithful to the legacy if-chain, INCLUDING its rough edges (match: 'prefix' on /i18n also matches /i18nxx, exactly as startsWith did) — fixing those edges is explicitly not this seam's job; behavior preservation is.

That was the right call for the migration. The migration is now well past that point, and the tree is visibly half-converted.

Enumerated on origin/main at 8647c87b2f5

Declare match: 'segment' and are boundary-correct — 5 routes:

packages/runtime/src/domains/security.ts      /security
packages/runtime/src/domains/share-links.ts   /share-links
packages/runtime/src/domains/keys.ts          /keys
packages/runtime/src/domains/mcp.ts           /mcp
packages/runtime/src/domains/mcp.ts           /mcp/skill

Still carry the implicit 'prefix' default — 10 routes:

packages/runtime/src/domains/actions.ts        /actions
packages/runtime/src/domains/ai.ts             /ai
packages/runtime/src/domains/analytics.ts      /analytics
packages/runtime/src/domains/automation.ts     /automation
packages/runtime/src/domains/data.ts           /data
packages/runtime/src/domains/i18n.ts           /i18n
packages/runtime/src/domains/meta.ts           /meta
packages/runtime/src/domains/notifications.ts  /notifications
packages/runtime/src/domains/packages.ts       /packages
packages/runtime/src/domains/ui.ts             /ui

So /datax, /metaxyz, /uifoo, /aixx, /packagesomething are each claimed by a domain that does not own them, exactly as /authx and /authentication/foo were claimed by /auth.

What IS measured here, and what is not

MEASURED: the enumeration above (read from source), and the mechanism (the registry's default: branch). The /auth member of this family was measured end to end on a real boot for #16026 and is fixed.

NOT MEASURED here, deliberately, and it is the reason this is its own card rather than a rider:

• The wire consequence per domain. /auth's was 200 {} because the auth domain forwards a Fetch Response. The other ten each hand their sub-path to a different handler with a different parse, so what /datax actually answers has to be measured per domain, not assumed to match. One of them may already be harmless; another may be worse.
• Whether any of the ten is load-bearing. A caller may already depend on a lexical extension being claimed — the sibling-namespace claim is a bug, but it is a shipped bug on a shipped HTTP surface, and each removal narrows what that surface answers.

Why not one guard for the whole class

The obvious repair is to flip DomainHandlerRegistry's default from 'prefix' to 'segment', which closes all ten at once. That is attractive and may well be the answer, but it changes ten shipped route claims in a single unmeasured step, which is precisely what the per-domain measurement above exists to prevent. Whoever takes this should decide between the one-line default flip plus ten measurements, and ten explicit match: 'segment' declarations plus ten measurements — the measurements are owed either way.

Context: #16026 (the /auth member, fixed) and its repair, which added match: 'segment' to createAuthDomain and pinned both the narrowed rows and the overshoot controls.

[os-litant]

⭐ Rider — a sixth site of this exact predicate, found by the #16265 contract review, in a file this card does not currently name

Routed here by the domain:cli execution PM seat (#6024) rather than filed as its own card, because it is the same predicate in the same defect class this card already enumerates. ⛔ Routing and grading remain triage's; this comment adds a measured member, not a severity.

Found by the at-tier contract review of PR #16265 (card #16026), quoted verbatim from its §5(4):

Not filed, same defect class: enforceProjectMembership's skipPaths.some(p => path.startsWith(p)) with '/auth' in the list (http-dispatcher.ts ~line 1277) — /authentication/foo bypasses membership enforcement. Harmless today (no domain claims it → 404) but it is the card's exact mechanism in the file the card named, and the report shows the implementer saw the line. Recommend a rider on #16263. Not a rejection reason for this PR.

Why it belongs on this card rather than beside it

This card is about domains claiming paths by bare startsWith. This site is not a domain claim — it is a membership-enforcement skip list — but it is the identical predicate making the identical mistake about the identical prefix: '/auth' matches /authentication/foo, which is not under /auth at all.

⚠️ It reads differently from the others in one way that matters, and the reviewer said so plainly rather than dressing it up: a claim that is too wide sends traffic somewhere wrong, while a skip list that is too wide sends traffic past a check. Today nothing is exposed — no domain claims /authentication/*, so it 404s before enforcement would have mattered — so this is a latent site, not a live hole. ⛔ It should not be graded as though it were one, and ⛔ it should not be graded as harmless-therefore-ignorable either: the harm becomes live the moment any domain claims a path in that shape.

What is measured and what is not

• Measured by the reviewer against source: the predicate, the '/auth' entry, and that /authentication/foo satisfies it.
• Measured by the same review, as this card's own enumeration: 10 domains with no match (bare startsWith), 5 declaring 'segment', and /health / /ready on 'exact'. ⇒ this card's census is confirmed independently.
• ⛔ NOT measured: whether any other skip list, allow list or path-prefix predicate elsewhere in http-dispatcher.ts carries the same shape. The review was scoped to PR fix(runtime): stop the /auth domain claiming every path that merely starts with auth #16265 and stopped at its floor. ⇒ if this card is picked up, the sweep is worth doing once rather than one site at a time — that is the difference between closing a class and closing a row.

Provenance

Contract review of PR #16265, head 59b1001a6d8, an isolated review subagent at CONTRACT_REVIEW_TIER. Tier verified by this seat before adoption: 107 of 107 harness-stamped model fields read claude-fable-5-1, no fallback notices. Full verdict: #16265 (comment)

⛔ Deliberately not fixed in PR #16265 — it is a different mechanism in a different file, and riding it along would have widened a PR that a review had already cleared on its stated surface.

---

Generated by Claude Code