Evaluated: 2026-09-01
Decision: prequery-guards-enforced-zero-metis-query Record digest:
20cd95b6d8abac84ef5401f23f8a6090c0fae13f0771d9ae2b556e0a815cbd0b
Verdict#
Task 1.4 is closed at the common Eve workbench-read boundary. Every registered
read is subject to authenticated subject, tenant, route scope, and an
independent route-exact data-classification admission before query execution. A
denied classification stops at route-authorize before body parsing, object
metadata preload, object authorization, or handler execution. Unknown views and
missing or unavailable dependencies fail loud.
This does not create a Metis read path. Task 1.3 still admits zero Metis views, the canonical façade still has zero operations, G4 remains open, and no test-only Metis route or service call was fabricated.
Boundary summary#
| Measure | Observed |
|---|---|
| Registered workbench views | 31 |
| Route-exact classification admissions | 31 |
| Metis registered views | 0 |
| Metis classification admissions | 0 |
| Metis façade operations (task 1.3 record) | 0 |
The session tenant now comes only from the authenticated tenant claim. A tenantless Tara caller no longer inherits the configured store tenant.
Guard-isolated refusal proofs#
| Guard | Caller-visible code | Exact terminal boundary | Focused test | Present |
|---|---|---|---|---|
subject-invalid |
authentication.credentials_invalid |
authenticate |
SUBJECT: a blank authenticated subject is refused at authenticate, before tenant, scope, classification, or store access | yes |
tenant-missing |
tenancy.tenant_missing |
resolve-scope |
TENANT: a tenantless operator is refused at resolve-scope; the configured Tara store tenant is never fabricated into the session | yes |
tenant-mismatch |
tenancy.tenant_mismatch |
authenticate |
CROSS-TENANT: a session bound to another tenant is refused at AUTHENTICATE for a tenant view — before scope, roles, or any read | yes |
scope-missing |
authorization.scope_missing |
route-authorize |
SCOPE ESCALATION: a member session is refused at route-authorize; the store is never touched | yes |
classification-refused |
authorization.scope_missing |
route-authorize |
CLASSIFICATION: a deployment restriction reaches the classification guard at route-authorize, before object metadata preload or query | yes |
unknown-view |
unknown_view |
before-kit |
UNKNOWN SURFACE: an unregistered workbench or view is refused with the registered list — the kit is never entered | yes |
service-not-configured |
dependency.not_configured |
handler |
ABSENCE IS NEVER SUCCESS: with no store bound a tara view is refused at the handler as not_configured, audited | yes |
service-persistence-unavailable |
persistence_unavailable |
execution-failed |
ABSENCE IS NEVER SUCCESS (hathor): durability required with no sink bound refuses as persistence_unavailable, audited as execution-failed | yes |
Classification admission totality#
The descriptor and this independent admission must match exactly. New routes and reclassifications fail closed until both boundaries are reviewed. A deployment policy may narrow this table but cannot widen it.
| Route | Admitted classification |
|---|---|
eve.workbench-read.tara-overview |
confidential |
eve.workbench-read.tara-funnel |
confidential |
eve.workbench-read.tara-sparks |
confidential |
eve.workbench-read.tara-concepts |
confidential |
eve.workbench-read.tara-concept |
confidential |
eve.workbench-read.tara-programs |
confidential |
eve.workbench-read.tara-sources |
confidential |
eve.workbench-read.tara-bundles |
confidential |
eve.workbench-read.tara-categories |
confidential |
eve.workbench-read.tara-catalog |
internal |
eve.workbench-read.lrg-vocabulary |
internal |
eve.workbench-read.lrg-evaluate |
internal |
eve.workbench-read.hathor-quest-authoring |
confidential |
eve.workbench-read.hathor-story-graph-authoring |
confidential |
eve.workbench-read.hathor-timeline-modeling |
confidential |
eve.workbench-read.hathor-world-configuration |
confidential |
eve.workbench-read.isis-account-protection |
confidential |
eve.workbench-read.isis-artifact-detection |
confidential |
eve.workbench-read.isis-benchmarking |
confidential |
eve.workbench-read.isis-chargeback-prevention |
confidential |
eve.workbench-read.isis-content-safety |
confidential |
eve.workbench-read.isis-cost-tracking |
confidential |
eve.workbench-read.isis-feedback-eval |
confidential |
eve.workbench-read.isis-intelligent-routing |
confidential |
eve.workbench-read.isis-model-quality |
confidential |
eve.workbench-read.isis-output-gallery |
confidential |
eve.workbench-read.isis-curated-lesson-gallery |
confidential |
eve.workbench-read.isis-resource-recommendations |
confidential |
eve.workbench-read.isis-texture-quality |
confidential |
eve.workbench-read.isis-suspicious-activity |
confidential |
eve.workbench-read.isis-model-governance |
confidential |
Service integration and failure behavior#
Focused integration cases bind the common seam to the real in-process Hathor and
Isis runtime stores, prove Hathor owner isolation and Isis tenant filtering, and
exercise both an unbound dependency and a durability repository that cannot
answer. Neither failure becomes [], null, or another empty-success shape.
The current integration proof binds the BFF common seam to real in-process Hathor/Isis runtime stores and controlled dependency failures. It does not claim a Metis HTTP call because task 1.3 admitted zero Metis routes.
Verification#
- BFF focused suite: 47 passed.
- Shared router focused suite: 51 passed.
- BFF typecheck backlog: 0.
- Workbench-kit library compile: passed.
- Workbench-kit package spec typecheck: pre-existing-backlog; changed-file diagnostics: 0.
Limitations#
- This closes task 1.4 for the common Eve workbench-read seam; it does not register a Metis view, implement the ADR-0075 HTTP transport, or close G4.
- No Metis subject/tenant/scope request is fabricated for testing: the zero-view boundary rejects it as unknown before a service call. The guards are exercised on real registered views and the shared router boundary.
- The service integration evidence uses real BFF runtime stores and controlled dependency loss, not a staging or production network probe.
- The workbench-kit library compile passes, while its package-wide spec typecheck retains unrelated pre-existing diagnostics; the changed router spec passes under Vitest and has no recorded changed-file type diagnostic.