#222: read-access trail for classified pages #278

fable-5 · 2026-07-31T12:25:50+02:00

fable-5 commented

2026-07-31 12:25:50 +02:00

Instruments every full-content read channel for vs_nfd pages (ADR 0023 variant A): SPA state fetch and read rendering, public JSON, no-JS shell, expanded embeds, public API GET (incl. MCP read_page), attachment download (#212 effective classification), all export shapes, and collab-token issuance as the api-side proxy for the WS join. Events land in the new read_events table (no FKs - evidence survives purges and account deletion). Failure is hard by decision: a failed trail write aborts the read (documented in ADR 0023 + security.md, incl. recorded residuals: fragments and feeds). One e2e test per channel proves event and absence for unclassified; plus the hard-failure test. Part of M29; closes after CI+merge verification. Refs #222

fable-5 added 1 commit 2026-07-31 12:25:51 +02:00

#222 : read-access trail for classified pages

CI / Lint, typecheck, test (pull_request) Successful in 6m25s

Details

CI / Build container images (pull_request) Successful in 2m58s

Details

CI / Auth e2e pack (pull_request) Successful in 8m35s

Details

CI / Import/export fidelity gate (pull_request) Successful in 1m7s

Details

CD / Deploy to Test (push) Blocked by required conditions

Details

CD / Smoke tests against Test (push) Blocked by required conditions

Details

CD / Promote to Int (push) Blocked by required conditions

Details

CI / Auth e2e pack (push) Blocked by required conditions

Details

CI / Import/export fidelity gate (push) Blocked by required conditions

Details

CI / Build container images (push) Blocked by required conditions

Details

CI / Lint, typecheck, test (push) Has been cancelled

Details

CD / Build and push images (push) Has been cancelled

Details

05a979bac3

Instrument every full-content read channel for pages with
classification = vs_nfd (ADR 0023, variant A): SPA state fetch and read
rendering, public JSON content, no-JS shell, expanded embeds, public API
GET (incl. the MCP read_page path and write echoes), attachment download
under the #212 effective classification, all export shapes (markdown,
pond ZIP, account data export, queued docx/odt/pdf at enqueue), and
collab-token issuance as the api-side proxy for the WS join.

Events land in the new read_events table (no FKs — evidence survives
page purges and hard user deletions) with actor, session key
(session:/token:/job:/anon), page, pond, channel and the classification
at read time. Recording failures are NOT swallowed: a failed write
aborts the read (hard failure, the deliberate contrast to AuditService —
decision recorded in ADR 0023 and security.md §Logging, together with
the recorded residuals: content fragments and feeds).

One e2e test per channel proves both the event and its absence for
unclassified pages, plus the hard-failure semantics.

Refs #222.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AUtYMxwTCMHG9mVHnwbFg8

fable-5 merged commit 05a979bac3 into main

2026-07-31 12:53:24 +02:00

fable-5 referenced this pull request

2026-07-31 12:59:06 +02:00

[VS-NfD] Instrument read paths for classified content #222

Sign in to join this conversation.

No reviewers