[itexpert120]

Fixes #679.

The gap

Release-scoped stamping (#656) pins every inherited app.* slot to the child's platform release — except slots the child authors. authoredSlotPaths treated any app.<key> object as authored, so a child that only configures its inherited auth (auth: { variables, secrets } — SIWN recipients, email sender, trusted origins, auth secrets) had app.auth skipped. Only app.auth.ui and app.host got stamped; the auth server kept following the parent's live config pointer.

Live today: multiagentic.near → dev.multiagency.ai is pinned to rc.27, but its published app.auth carries no production/pin, and the parent's live app.auth has already moved from rc.27's 0e7c85b2… to 61db1793… — a post-rc.27 auth server under an rc.27 host and auth UI. The composition gate only compares UI slots, so it doesn't catch this. Same story for remote-only api: { variables, secrets } entries (#566).

The fix

A slot is authored only when it names where its code comes from: production, development, pin, extends, or proxy — plus the existing ui: false opt-out and bare-string plugin ref cases. Configuration alone (variables, secrets, routes, …) no longer opts a slot out of release pinning. stampSlotRecord already merges into the existing entry, so the child's configuration survives the stamp.

Unchanged:

• Workspace slots stay authored — path: "ui" canonicalizes to development: "local:ui", and stamping reads the authored config before local: targets are stripped.
• ui: false opt-outs, and plugin slots (never stamped since fix(everything-dev): stamp app.* slots only — plugins are declaration-scoped (rc.26 child-deploy hotfix) #657).
• proxy counts as a source, so proxied slots keep today's behavior.

ADR 0034's amendment is clarified to define "authored" this way (it previously assumed children never author app.auth). Patch changeset included.

Verification

• New tests in tests/unit/composition.test.ts: configured-only app.auth is stamped with variables/secrets kept and workspace ui/api untouched; remote-only app.api is stamped, proxied app.api is not; authoredSlotPaths excludes configuration-only entries. The fixtures in the existing authoredSlotPaths test now use real source keys instead of { x: 1 } placeholders. All new tests failed before the fix.
• Replayed against real data (not committed): the dev.multiagency.ai bos.app.ts → toConfigInput + stripLocalDevelopmentTargets, stamped with the published rc.27 release manifest.
  • before: stamped app.auth.ui, app.host. That matches the live published config.
  • after: stamped app.auth, app.auth.ui, app.host. app.auth is pinned to 0e7c85b2…, all variables/secrets are kept, and ui/api aren't stamped.
• pnpm --filter everything-dev test: 1695 passed, 3 skipped. tsc --noEmit, biome check . and pnpm run lint:effect are clean.

🤖 Generated with Claude Code