Claude Fable 5
05a979bac3
Some checks failed
CI / Lint, typecheck, test (pull_request) Successful in 6m25s
CI / Build container images (pull_request) Successful in 2m58s
CI / Auth e2e pack (pull_request) Successful in 8m35s
CI / Import/export fidelity gate (pull_request) Successful in 1m7s
CD / Deploy to Test (push) Blocked by required conditions
CD / Smoke tests against Test (push) Blocked by required conditions
CD / Promote to Int (push) Blocked by required conditions
CI / Auth e2e pack (push) Blocked by required conditions
CI / Import/export fidelity gate (push) Blocked by required conditions
CI / Build container images (push) Blocked by required conditions
CI / Lint, typecheck, test (push) Has been cancelled
CD / Build and push images (push) Has been cancelled
Instrument every full-content read channel for pages with classification = vs_nfd (ADR 0023, variant A): SPA state fetch and read rendering, public JSON content, no-JS shell, expanded embeds, public API GET (incl. the MCP read_page path and write echoes), attachment download under the #212 effective classification, all export shapes (markdown, pond ZIP, account data export, queued docx/odt/pdf at enqueue), and collab-token issuance as the api-side proxy for the WS join. Events land in the new read_events table (no FKs — evidence survives page purges and hard user deletions) with actor, session key (session:/token:/job:/anon), page, pond, channel and the classification at read time. Recording failures are NOT swallowed: a failed write aborts the read (hard failure, the deliberate contrast to AuditService — decision recorded in ADR 0023 and security.md §Logging, together with the recorded residuals: content fragments and feeds). One e2e test per channel proves both the event and its absence for unclassified pages, plus the hard-failure semantics. Refs #222. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01AUtYMxwTCMHG9mVHnwbFg8
24 lines
908 B
SQL
24 lines
908 B
SQL
-- #222 (ADR 0023): read-access trail for classified pages. Its own table —
|
|
-- volume, purpose and legal basis differ from audit_log. No foreign keys:
|
|
-- evidence must survive page purges and hard user deletions unchanged.
|
|
-- Partitioning and retention follow in #224.
|
|
CREATE TABLE "read_events" (
|
|
"id" TEXT NOT NULL,
|
|
"occurred_at" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
|
|
"actor_id" TEXT,
|
|
"session_key" TEXT NOT NULL,
|
|
"page_id" TEXT,
|
|
"pond_id" TEXT NOT NULL,
|
|
"channel" TEXT NOT NULL,
|
|
"classification" TEXT NOT NULL,
|
|
"details" JSONB,
|
|
|
|
CONSTRAINT "read_events_pkey" PRIMARY KEY ("id")
|
|
);
|
|
|
|
CREATE INDEX "read_events_page_id_occurred_at_idx" ON "read_events"("page_id", "occurred_at");
|
|
|
|
CREATE INDEX "read_events_actor_id_occurred_at_idx" ON "read_events"("actor_id", "occurred_at");
|
|
|
|
CREATE INDEX "read_events_occurred_at_idx" ON "read_events"("occurred_at");
|