Release-scoped stamping skips app.auth when a child only configures it (variables/secrets) — auth server floats with parent's live pointer #679

Summary

Release-scoped slot stamping (#656, ADR 0034 amendment) skips any app.* slot the child configures, not just slots it sources. A child that sets auth: { variables, secrets } in bos.app.ts gets app.auth.ui and app.host pinned to its platform release, but app.auth is left unpinned — so the auth server keeps following the parent's live config pointer. That is the exact skew #656 set out to remove, just one slot over.

Where

packages/everything-dev/src/services/deploy/composition.ts

• authoredSlotPaths() adds every plain-object app.<key> that walkConfigSlots visits, regardless of contents.
• stampInheritedSlotsFromRelease() then does if (authored.has(slotPath)) continue;, so app.auth is never stamped.

The ADR amendment assumes "children never author app.auth; bos init deletes the whole app slot", but a child that needs its own SIWN recipients, email sender, trusted origins, or auth secrets has to set auth.variables / auth.secrets. The same applies to remote-only api: { variables, secrets } entries, which toConfigInput deliberately round-trips (#566).

Evidence (live, mainnet FastKV)

Child multiagentic.near → dev.multiagency.ai, platform: "2.0.0-rc.27", authored auth: { variables, secrets }:

The parent's live pointer has already moved past rc.27, so this child currently composes a post-rc.27 auth server with an rc.27 host and rc.27 auth UI, without having deployed anything. citynode.app appears to be affected the same way (app.auth without a pin).

The composition gate doesn't catch this: compositionSkewViolations only cross-checks UI slots, so an auth-server/host mismatch passes preflight.

Expected

A slot counts as authored only when the leaf says where its code comes from. Configuration (variables, secrets, routes, …) of an inherited slot should not opt it out of release pinning.

Proposed fix

In authoredSlotPaths, add a slot only when its entry declares a code source: production, development, pin, extends, or proxy — plus the existing cases (ui: false opt-outs and bare-string plugin refs). stampSlotRecord already merges into the existing entry ({ ...existing }), so the child's variables / secrets survive the stamp.

Unaffected by the change:

• Workspace slots: path: "ui" canonicalizes to development: "local:ui" and the authored config is read before local: targets are stripped, so the child's own ui / api stay authored.
• ui: false opt-outs and plugin slots (plugins are never stamped since fix(everything-dev): stamp app.* slots only — plugins are declaration-scoped (rc.26 child-deploy hotfix) #657).

Regression tests needed: a configuration-only app.auth gets stamped with its configuration kept; a remote-only app.api gets stamped; proxy / development: "local:…" slots do not.

Affected children recover on their next deploy after upgrading to a framework version with the fix.