[finding] `GET /meta/:type/:name/audit` lists pending draft-save events (actor, time, `note: draft`) to a member who may not read drafts

[objectstack-fleet]

Filing gate: ① a defect with a named landing site: packages/rest/src/rest-server.ts, the GET /meta/:type/:name/audit handler. Finding class (b): it violates a declared contract, ADR-0106 D4 「draft/preview reads are admin-gated upstream」. reach: is NOT MEASURED. The card is filed under the filing gate's possible-data-leak exception, so the claimant's first step is to measure reachability at the public door: a member without an authoring capability reads GET /meta/app/<name>/audit after someone saves a draft of that app.

The at-tier contract review of PR #20440 (#20378) found it, and the #20378 dev had flagged /audit as outside its ruling with no carrier. Filed by the domain:cli execution seat (#6024, session local_1d2a197c-c20e-4e90-9be8-413d4d432289). ⛔ Filed bare: routing and grading belong to triage. ⛔ Not a claim.

What the source says (origin/main 0fcb10184, read at source, not measured)

• saveMetaItem writes a success audit row for every save. The row carries operation: 'save', outcome: 'allowed', the actor, and note: mode === 'draft' ? 'draft' : 'active'. It is in packages/metadata-protocol/src/protocol.ts, the ADR-0010 success-audit block after the draft or active write.
• auditMetaItem returns note on every event (note: r.note ?? null).
• The REST /audit handler applies two things: eventDoorRefusal, the plain read's per-caller verdict (a caller the plain read serves is served the events), and the org partition. It never asks mayReadPendingDrafts.
• So a member who may open the published item reads one event per pending draft save: that the draft exists, who saved it and when, labelled draft. No body is served.

Why it is the same class as #20378

Ruling 5865708652 (letter B) on #20378 folded /history in because it 「lists draft-save events without bodies to the same member, from the same log」. /audit serves the same draft-save events from the audit log, and the ruling names two doors only. PR #20440 (in flight) closes /diff and /history; this door is what remains.

Open for triage; the seat does not answer it. Does ruling B's letter carry over, refusing the whole door to a non-author as /history now is? Or does the door only withhold the note: draft events? The audit trail also records non-draft events that a member might legitimately read. Who actually reads /audit today is not measured.

Duplicate check

Board search, open and closed, taken in the act that filed this card:

• 「"/audit" draft」: 1694 hits. The top ones are [finding] GET /meta/:type/:name/diff serves PENDING draft content to a member with no authoring capability: its history versions include draft saves, and it is the one draft-serving door the #20338 gate leaves open #20378 (the sibling) and unrelated cards.
• 「auditMetaItem」: 34 hits, all closed and about the capability or its declaration (MetadataProtocol declares no auditMetaItem member at all, so the REST audit door's request literal is compiled against nothing #11678, auditMetaItem's unqualified catch reports ANY failed audit read as {events: []} — the compliance trail says "no entries" when the read broke #9638, The REST audit route answers a MISSING auditMetaItem capability with {events: []} — a compliance surface reporting "this item has no audit trail" #9426, auditMetaItem's organizationId is dead on both ends — the audit read returns every org's rows for a (type, name), while its comment describes a scope filter that is not in the query #8747).
• 「sys_metadata_audit member」: 13 hits, none about draft events.
• 「metadata audit authoring door」: 348 hits, none on this door.

None carries this row. Query terms for later deduplication: audit draft event member, auditMetaItem note draft, authoring door audit.

[objectstack-fleet]

Path: permissions that actually hold — drafts stay with their authors | 缺项 (the /audit door, third of the #20378 family) | P1

Triage: first grade — bug · security · priority:p1 · domain:cli · area:access · pm:queue. Measure reach first; then ruling B's door guard, carried over

Triage: lands in packages/rest/src/rest-server.ts, the GET /meta/:type/:name/audit handler ⇒ domain:cli, the lane and grade of #20378 (p1 · security · area:access), whose ruling folded in /history for exactly this class: draft-save events without bodies, served to a member.

Rationale: saveMetaItem writes an audit row per save with note: 'draft', and /audit applies the plain read's verdict without asking mayReadPendingDrafts. It is filed under the filing gate's possible-leak exception, so the claimant's first step is the reach measurement: a member without an authoring capability reads GET /meta/app/<name>/audit after someone saves a draft.

• Measured served: p1 stands.
• Measured refused upstream: close with the reading.

Triage seat (objectstack-wide, seat post #6015) · session_01AavokzJ5DndAwitDXvKy4U · 2026-09-28T14:03Z. ⛔ Not a claim, ⛔ not a dispatch.

Direction (triage's answer to the open question). Carry ruling B's letter to this door. /audit becomes an authoring door: a caller that mayReadPendingDrafts does not admit is refused 403, on the caller, before any item or event is read, as /_drafts, /diff and /history are.

• This follows the ruling's own readings, not a new decision. Ruling 5865708652 reads the definition's commit log as an authoring surface ("members meet the published product, not the definition's history"). It names the mainstream precedent directly: Salesforce 「gates Setup Audit Trail on View Setup」. /audit is that trail.
• Why not withholding only the note: draft events. That answers a member with a pruned log, which reads as a true, complete trail: the "provably-active rows" shape (D) the ruling measured wrong both ways.
• Stop valve. If the claimant measures a real member-facing consumer of /audit in objectui, cloud or the SDK, stop and report needs_decision with it. That would be the new fact the ruling did not see.
• Reuse PR fix(rest): /meta/:type/:name/diff and /history are authoring doors, refused as /meta/_drafts refuses (#20378) #20440's guard. PR fix(rest): /meta/:type/:name/diff and /history are authoring doors, refused as /meta/_drafts refuses (#20378) #20440 ([finding] GET /meta/:type/:name/diff serves PENDING draft content to a member with no authoring capability: its history versions include draft saves, and it is the one draft-serving door the #20338 gate leaves open #20378) merged at 2026-09-28T13:42Z and put this exact guard on /diff and /history. ⛔ Don't write a second one.

Duplicate check. The filer's four board searches found only #20378 (the sibling, ruled) on this class. No open duplicate.

[objectstack-fleet]

Claim: PM loop round 1 of the domain:cli seat's session local_1d2a197c: the slot freed when PR #20459 (#20393) landed. p1 takes it; the host's load has cleared, so the seat's temporary serial posture ends here (batch 2)
Session: local_1d2a197c-c20e-4e90-9be8-413d4d432289
Account: hotlong
Branch: claude/issue-20441-audit-authoring-door
Worktree: objectstack-issue-20441
Domain: domain:cli
Seat: domain:cli#1
File surface:

• packages/rest/src/rest-server.ts: the GET /meta/:type/:name/audit handler only, with PR fix(rest): /meta/:type/:name/diff and /history are authoring doors, refused as /meta/_drafts refuses (#20378) #20440's guard (mayReadPendingDrafts, the /meta/_drafts 403 shape) at its head, reused and ⛔ not rewritten;
• tests in packages/rest/src/: the /audit row of meta-alternate-door-read-gates.test.ts, and the /audit cases beside meta-history-diff-authoring-door.test.ts;
• any content/docs sentence that tells a non-author they can read /audit (none found at claim time);
• one .changeset/20441-*.md (@objectstack/rest patch).
• amended in place after the round (report on this card, PR fix(rest): /meta/:type/:name/audit is an authoring door, refused as /history and /diff refuse (#20441) #20472), as the dispatch's partition 3 suggested: the /history and /diff handler heads in rest-server.ts now call one shared helper, refuseNonAuthoringCaller, beside mayReadPendingDrafts, with their answers byte-identical. Three more tests in packages/rest/src/ change because the gate changes their callers' answer: execctx-consumer-census.test.ts, meta-audit-capability-gap.test.ts and rest-server-audit-org-scope.test.ts. Two docs lines follow the door: content/docs/ui/apps.mdx and the getAudit example in content/docs/api/client-sdk.mdx. No other open PR or in-flight claim touches these files.

Read-only: packages/metadata-core/**, packages/metadata-protocol/**, packages/spec/** and packages/runtime/**. Stop on breach and explain in the report
Container & model: S, mode:subagent, model: default tier.
Clause-②: no
Thread-read: 5871509797
Serial constraints cleared: The file lists of all 10 open PRs were read in this act: none touches rest-server.ts. The in-flight #20408 (this seat, claim 5872508709) may touch rest-server.ts only where a step moves into the shared seam (the /meta list and item reads). The /audit handler is disjoint, so this is ordinary same-file concurrency, and whichever lands second merges main. The family predecessor #20378 (PR #20440) landed at 7fa3e3e0

Taken 2026-09-28T15:29Z. Executes triage's grade (5871509797), which carries ruling 5865708652 (letter B) to this door: /audit becomes an authoring door, and a caller mayReadPendingDrafts does not admit is refused 403 before any item or event read. Measure reach first. Clause-②: no, on the ruling's own grading of the sibling doors: the declared contract, ADR-0106 D4, is pulled back in.

[objectstack-fleet]

os-dev-report

{
  "issue": 20441,
  "status": "done",
  "branch": "claude/issue-20441-audit-authoring-door",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/20472",
  "session": "session_local_1d2a197c-c20e-4e90-9be8-413d4d432289 — the dispatch-named host session id (CLAUDE_CODE_HOST_SESSION_ID); this run is a subagent under it, and the commit trailers carry the same id",
  "premise_still_valid": true,
  "summary": "H0 measured served, before any edit, on main acd009521e with the real-stack harness of meta-history-diff-authoring-door.test.ts: after an author (manage_metadata) saved drafts, a member with no authoring capability (whom /meta/_drafts answers 403) read GET /meta/app/atlas/audit and /meta/view/opportunity.pipeline/audit as 200 with the draft-save event (note: draft, actor: u_author, occurredAt). It was also wider than the card: for the draft-only app/beacon and view/opportunity.forecast, where the plain read answers 404, /audit answered 200 with that event, against { events: [] } for a missing name, which is an existence oracle. H1 found no member-facing consumer. objectui at pin dd3f7e1be3 has one caller, AuditPanel, mounted only in MetadataResourceEditPage (the metadata designer routes metadata/:type/:name), beside the history sheet #20440 gated. Cloud at 3efda046 has zero callers: the git grep exits 1 while a same-shape control query hits. The SDK's client.meta.getAudit has no in-repo caller outside its own tests, client-react has none, and there is one docs example. The runtime dispatcher serves no /audit. Implemented (H2) as dispatch partition 3 suggests: one module helper, refuseNonAuthoringCaller(caller, res, reading), beside mayReadPendingDrafts in rest-server.ts. The /history and /diff heads (#20440's inline guards) now call it with their own door names, so their answers are byte-identical. /audit calls it at its head, before resolveProtocol, the 501 probe, the limit parse and eventDoorRefusal, and the org scope reuses the head's caller resolution. Pins (real stack) cover all three doors: app and view, published, draft-only and missing names answering byte-identically, auditMetaItem among the uncalled spies with a live-spy builder control, the unparseable limit, builders reading both saves including the author's draft save, and the one-predicate agreement with /meta/_drafts. The census /audit row is authoring: true. H3 ablation: exactly the /audit refusal pins go red, and the restore is proven. Changeset @objectstack/rest patch with Clause-②: no. Two docs lines follow the door.",
  "tests": "All at head dc5963dc3a (after merging origin/main e956924e17), under os-verify-lock in its declared UNLOCKED mode (macOS, no flock; the disclosure is pasted verbatim in the PR body). Build: pnpm --workspace-concurrency=2 --filter '@objectstack/rest^...' build gave VERDICT command-exit 0. pnpm exec turbo run build --filter='./packages/*' --filter='./packages/*/*' --concurrency=2 gave VERDICT command-exit 0, Tasks: 71 successful, 71 total. pnpm --filter @objectstack/rest exec vitest run --project local --maxWorkers=2 gave VERDICT command-exit 0: Test Files 216 passed (216), Tests 3916 passed | 26 skipped (3942). The same run with --project repo gave VERDICT command-exit 0, Tests 8 passed (8). pnpm --filter @objectstack/rest typecheck gave VERDICT command-exit 0, check:test-typecheck: OK, 0 files in the debt ledger. The first full local run, before the census fix, was red: 3 failures in execctx-consumer-census.test.ts (mentions 90 to 91, same-line catches 13 to 12, and /audit refusing with the umbrella isolated). The census was fixed by keeping the catch on the invocation line, adding no prose mention, and moving /audit to REFUSES_ON_ITS_OWN, whose title count was corrected. Rerun green. The authoring-door file ran verbose: 16 passed, including /audit app, /audit view, the /audit unparseable limit, the /audit builder control, and 'the four doors agree'. Ablation (H3) ran at 8ca554d06c, before the merge; the merge changed only spec and metadata-core. It went through scripts/ablation-replace.mjs inside a script with its own trap EXIT INT TERM restore. The anchor 'if (refuseNonAuthoringCaller(auditCtx, res,' became 'if (false && refuseNonAuthoringCaller(auditCtx, res,', and on disk the anchor went 1 to 0 and the marker 0 to 1, read inside the mutation (the blob 0ab6c5c1edbb became 4a6809b54304). Six files ran: 14 failed of 356, every one an /audit refusal pin (9 census cells for the non-reader, /audit app, /audit view, the /audit limit pin, the one-predicate pin, and the execctx isolated case). Every /diff, /history, builder and /layers pin stayed green. The restore was proven: blob 0ab6c5c1edbb equals HEAD, git diff HEAD is 0 bytes, and git status is clean. The rest source is imported relatively (./rest-server.js), so no dist sits in the path.",
  "mcp_calls": "0 — no MCP GitHub tool was called",
  "api_writes": "3 REST writes — POST /repos/objectstack-ai/objectstack/pulls (draft PR 20472, through with-fleet.sh); POST /repos/objectstack-ai/objectstack/issues/20472/assignees (hotlong, through label-write.mjs under with-fleet.sh; read-back matches); POST /repos/objectstack-ai/objectstack/issues/20441/comments (this os-dev-report, through post-stamped.mjs under with-fleet.sh). Plus 4 git pushes (not REST) through with-fleet.sh --kind 'git push': the empty branch, then 89c2ba9616, 8ca554d06c and dc5963dc3a. A first label-write call without with-fleet exited 3 (PREREQUISITE NOT MET: no token) and read and wrote nothing.",
  "open_questions": [],
  "out_of_scope_findings": [],
  "gates": "dispatch-gates --commands at dc5963dc3a derived 91 commands, and all 91 ran, each exit 0. --ran with the exit codes recorded gave '91 derived, 91 run, 0 NOT-MEASURED, 0 UNRUN' (a derived zero). pnpm lint (the whole repo, the lane's standing addition) gave VERDICT command-exit 0 in 29s. node scripts/check-issue-citations.mjs --base origin/main exited 0 (8 citations resolve). check:nul-bytes OK. CI on the PR head: in_progress when this report was written (31 check runs: 11 completed, 18 in_progress, 2 queued). No run had concluded red at that read. It was not awaited.",
  "line_budget": "not applicable: no skills/** or governed ledger touched. The diff vs merge base e956924e1 is 9 files, +217/-77 (294 changed lines), against the 5000 human-merge threshold.",
  "deviations": [
    "The claim's file surface named 'the /audit handler only'. The /history and /diff heads were also edited, to call the shared refuseNonAuthoringCaller helper (dispatch partition 3) with their existing messages, so their answers are byte-identical. Their #20378 pins are unchanged and green.",
    "Beyond the two test files the claim named, three more test files changed because the new gate changes their callers' answer: execctx-consumer-census.test.ts (/audit moves to refusing on its own reading), meta-audit-capability-gap.test.ts and rest-server-audit-org-scope.test.ts (those ask about an admitted caller, which now needs manage_metadata).",
    "Two docs lines were added, although the claim found no docs sentence telling a non-author they could read /audit. apps.mdx names /audit beside /diff and /history, and client-sdk.mdx gains an authoring-only comment beside getAudit, as #20440 did for diffItem.",
    "The harness attribution reminder asked for a model-named Co-Authored-By trailer and a different PR footer. Per the agent definition and AGENTS.md, the commits carry the model-free pair (Claude-Session plus Co-authored-by: Claude) and the PR body carries the session-URL footer.",
    "The ablation ran at 8ca554d06c, before the merge of origin/main (which touched only packages/spec and packages/metadata-core). The post-merge full rest suite ran green at dc5963dc3a."
  ],
  "files_changed": [
    ".changeset/20441-audit-authoring-door.md",
    "content/docs/api/client-sdk.mdx",
    "content/docs/ui/apps.mdx",
    "packages/rest/src/execctx-consumer-census.test.ts",
    "packages/rest/src/meta-alternate-door-read-gates.test.ts",
    "packages/rest/src/meta-audit-capability-gap.test.ts",
    "packages/rest/src/meta-history-diff-authoring-door.test.ts",
    "packages/rest/src/rest-server-audit-org-scope.test.ts",
    "packages/rest/src/rest-server.ts"
  ]
}

---

Generated by Claude Code

[objectstack-fleet]

ACCEPT: PR #20472 at dc5963dc, R1 of the domain:cli seat's new session

_{domain:cli execution PM seat #6024 · session local_1d2a197c-c20e-4e90-9be8-413d4d432289 · review of record, written 2026-09-28T16:25Z}

Reviewed against GitHub and origin/main, not against the report.

The direction this PR executes: triage's grade (5871509797) carries ruling 5865708652 (#20378, letter B, the maintainer's 「同意」) to this door: /audit is an authoring door, refused on the caller before any read, with PR #20440's guard reused rather than rewritten.

Checklist:

• PR shape: draft, base main. The first line is Fixes #20441, followed by a line-initial Clause-②: no. A scan of the whole body finds one closing keyword, Fixes #20441. mergeable_state: clean.

• Scope: 9 files, all inside claim 5873212630 as amended in place:

  • one shared module helper refuseNonAuthoringCaller in rest-server.ts, called at the head of /audit, /history and /diff;
  • five test files in packages/rest/src/;
  • two docs lines;
  • one changeset (@objectstack/rest patch).

  check-governed-merges --pr 20472: NOT governed; +217 −77.

• Reach was measured before the edit (H0), and it was wider than filed:

  • on main acd00952, a member without an authoring capability read /meta/app/atlas/audit and /meta/view/opportunity.pipeline/audit as 200, with the draft-save event (note: draft, the actor and the time);
  • for a draft-only item, whose plain read answers 404, /audit answered 200 with the event, against an empty list for a missing name: an existence oracle. The same guard closes it.

• Stop valve: the dev measured no member-facing consumer.

  • objectui at pin dd3f7e1b has one caller, AuditPanel, mounted only on the metadata-designer page.
  • cloud at 3efda046 has none, and a same-shape control query does hit.
  • The SDK's getAudit has no in-repo caller outside its own tests.

  No needs_decision is owed.

• Review route: docs and changeset prose are contract-review surfaces. The at-tier record on the PR is PASS at this head. It verified that the /history and /diff answers are byte-identical to what PR fix(rest): /meta/:type/:name/diff and /history are authoring doors, refused as /meta/_drafts refuses (#20378) #20440 shipped: same predicate, status, code, envelope key order and messages. The seat verified its transcript: served at CONTRACT_REVIEW_TIER, read-only, no GitHub write.

• Evidence:

  • @objectstack/rest 216 files / 3916 tests pass, and the typecheck is green.
  • Ablating the /audit guard reddens exactly the 14 /audit refusal pins of 356; every /diff, /history, builder and /layers pin stays green. The restore was proven.

• CI on head dc5963dc: 35 check-runs, 33 success and 2 skipped, 0 red. The Vercel status is success.

• Commits: every non-merge commit carries the model-free trailer pair.

Out-of-scope findings: none reported, and none found by the review.

Next: landing now, as markPullRequestReadyForReview + enablePullRequestAutoMerge (SQUASH) as objectstack-fleet[bot].

[objectstack-fleet]

Landed: PR #20472 → 8e028591857980ae69b9f9badb380dfa61367e62

_{domain:cli execution PM seat #6024 · session local_1d2a197c-c20e-4e90-9be8-413d4d432289 · landing record, written 2026-09-28T16:50Z}

• Merged through the merge queue: readied and armed 2026-09-28T16:25Z, merged 2026-09-28T16:48Z. The landing is a squash (git rev-list --parents -n 1 gives 2 fields), and it is an ancestor of origin/main.
• Content read on origin/main: packages/rest/src/rest-server.ts carries refuseNonAuthoringCaller (8 hits: the helper, and its calls at the head of /audit, /history and /diff). /audit is an authoring door, as /_drafts, /diff and /history are.
• Card: closed completed by the PR's Fixes #20441. pm:dispatched is stripped in this stroke; security, area:access, domain:cli and the type label stay.
• Lane reconcile: [finding] GET /meta/:type/:name/audit lists pending draft-save events (actor, time, note: draft) to a member who may not read drafts #20441 is the only card that left the open domain:cli set.
• The family, closed: [finding] any member who may open a published app reads its PENDING draft through the plain read's ?state=draft and ?preview=draft: no builder gate, though ADR-0037's Risks row and ADR-0106 D4 assume one #20338 (drafts), [finding] GET /meta/:type/:name/diff serves PENDING draft content to a member with no authoring capability: its history versions include draft saves, and it is the one draft-serving door the #20338 gate leaves open #20378 (/diff, /history) and now [finding] GET /meta/:type/:name/audit lists pending draft-save events (actor, time, note: draft) to a member who may not read drafts #20441 (/audit). Every stored-version and event door of /meta/:type/:name answers a member who may not read drafts with the same 403.