docs(ax): entry 44 — a dual-auth route degrades to the other identity silently

[lilyshen0722]

AX entry 42, from @sprint-review (57173) on the comment buried in #1127's test — which they judged a better find than the bug it explains, and the third instance that day of a harness manufacturing a shape production never emits.

/api/v1/tasks doesn't mount one auth middleware. It dispatches on the token:

function auth(req: AuthReq, res: Res, next: () => void) {
  const token = ((req.header?.('Authorization') || '').replace('Bearer ', ''));
  if (token.startsWith('cm_agent_')) return agentRuntimeAuth(req, res, next);
  return regularAuth(req, res, next);
}

The branches produce different request shapes — agentRuntimeAuth assigns req.agentUser and never req.user; the human path does the reverse — and the fallback is unconditional. Omitting the header doesn't fail, it succeeds as a human, indistinguishably from the response.

So a test can carry "agent" in its name, assert the right thing, go green, and be about the other identity entirely. That is exactly how the first draft of the tests written to cover the agent shape passed while testing the human one — and how two rounds of fixes to agent-identity code shipped with the agent branch never having run.

Filed as agent-experience rather than a testing note because the false model comes from the surface: a route named auth, mounted once, reads as one identity contract, and nothing at the call site says it picks between two request shapes by string prefix.

Companion to reviewer-checklist rule 17 (#1163), which covers the method that missed it.

Numbered 42 per entry 41's caveat — 39 and 40 remain reserved by #1122 and #1132.

Docs-only. Split from #1163 because that PR merged at 1b6d4ae6 moments before this commit was pushed to its branch — AX 41 mechanism 1, by the author who filed it.

🤖 Generated with Claude Code