# Eve SOTA — Metis pre-query guard closure (task 1.4)

**Evaluated:** 2026-09-01

**Decision:** `prequery-guards-enforced-zero-metis-query` **Record digest:**
`20cd95b6d8abac84ef5401f23f8a6090c0fae13f0771d9ae2b556e0a815cbd0b`

## Verdict

Task 1.4 is closed at the common Eve workbench-read boundary. Every registered
read is subject to authenticated subject, tenant, route scope, and an
independent route-exact data-classification admission before query execution. A
denied classification stops at `route-authorize` before body parsing, object
metadata preload, object authorization, or handler execution. Unknown views and
missing or unavailable dependencies fail loud.

This does **not** create a Metis read path. Task 1.3 still admits zero Metis
views, the canonical façade still has zero operations, G4 remains open, and no
test-only Metis route or service call was fabricated.

## Boundary summary

| Measure                                   | Observed |
| ----------------------------------------- | -------: |
| Registered workbench views                |       31 |
| Route-exact classification admissions     |       31 |
| Metis registered views                    |        0 |
| Metis classification admissions           |        0 |
| Metis façade operations (task 1.3 record) |        0 |

The session tenant now comes only from the authenticated tenant claim. A
tenantless Tara caller no longer inherits the configured store tenant.

## Guard-isolated refusal proofs

| Guard                             | Caller-visible code                  | Exact terminal boundary | Focused test                                                                                                                              | Present |
| --------------------------------- | ------------------------------------ | ----------------------- | ----------------------------------------------------------------------------------------------------------------------------------------- | ------- |
| `subject-invalid`                 | `authentication.credentials_invalid` | `authenticate`          | SUBJECT: a blank authenticated subject is refused at authenticate, before tenant, scope, classification, or store access                  | yes     |
| `tenant-missing`                  | `tenancy.tenant_missing`             | `resolve-scope`         | TENANT: a tenantless operator is refused at resolve-scope; the configured Tara store tenant is never fabricated into the session          | yes     |
| `tenant-mismatch`                 | `tenancy.tenant_mismatch`            | `authenticate`          | CROSS-TENANT: a session bound to another tenant is refused at AUTHENTICATE for a tenant view — before scope, roles, or any read           | yes     |
| `scope-missing`                   | `authorization.scope_missing`        | `route-authorize`       | SCOPE ESCALATION: a member session is refused at route-authorize; the store is never touched                                              | yes     |
| `classification-refused`          | `authorization.scope_missing`        | `route-authorize`       | CLASSIFICATION: a deployment restriction reaches the classification guard at route-authorize, before object metadata preload or query     | yes     |
| `unknown-view`                    | `unknown_view`                       | `before-kit`            | UNKNOWN SURFACE: an unregistered workbench or view is refused with the registered list — the kit is never entered                         | yes     |
| `service-not-configured`          | `dependency.not_configured`          | `handler`               | ABSENCE IS NEVER SUCCESS: with no store bound a tara view is refused at the handler as not_configured, audited                            | yes     |
| `service-persistence-unavailable` | `persistence_unavailable`            | `execution-failed`      | ABSENCE IS NEVER SUCCESS (hathor): durability required with no sink bound refuses as persistence_unavailable, audited as execution-failed | yes     |

## Classification admission totality

The descriptor and this independent admission must match exactly. New routes and
reclassifications fail closed until both boundaries are reviewed. A deployment
policy may narrow this table but cannot widen it.

| Route                                              | Admitted classification |
| -------------------------------------------------- | ----------------------- |
| `eve.workbench-read.tara-overview`                 | `confidential`          |
| `eve.workbench-read.tara-funnel`                   | `confidential`          |
| `eve.workbench-read.tara-sparks`                   | `confidential`          |
| `eve.workbench-read.tara-concepts`                 | `confidential`          |
| `eve.workbench-read.tara-concept`                  | `confidential`          |
| `eve.workbench-read.tara-programs`                 | `confidential`          |
| `eve.workbench-read.tara-sources`                  | `confidential`          |
| `eve.workbench-read.tara-bundles`                  | `confidential`          |
| `eve.workbench-read.tara-categories`               | `confidential`          |
| `eve.workbench-read.tara-catalog`                  | `internal`              |
| `eve.workbench-read.lrg-vocabulary`                | `internal`              |
| `eve.workbench-read.lrg-evaluate`                  | `internal`              |
| `eve.workbench-read.hathor-quest-authoring`        | `confidential`          |
| `eve.workbench-read.hathor-story-graph-authoring`  | `confidential`          |
| `eve.workbench-read.hathor-timeline-modeling`      | `confidential`          |
| `eve.workbench-read.hathor-world-configuration`    | `confidential`          |
| `eve.workbench-read.isis-account-protection`       | `confidential`          |
| `eve.workbench-read.isis-artifact-detection`       | `confidential`          |
| `eve.workbench-read.isis-benchmarking`             | `confidential`          |
| `eve.workbench-read.isis-chargeback-prevention`    | `confidential`          |
| `eve.workbench-read.isis-content-safety`           | `confidential`          |
| `eve.workbench-read.isis-cost-tracking`            | `confidential`          |
| `eve.workbench-read.isis-feedback-eval`            | `confidential`          |
| `eve.workbench-read.isis-intelligent-routing`      | `confidential`          |
| `eve.workbench-read.isis-model-quality`            | `confidential`          |
| `eve.workbench-read.isis-output-gallery`           | `confidential`          |
| `eve.workbench-read.isis-curated-lesson-gallery`   | `confidential`          |
| `eve.workbench-read.isis-resource-recommendations` | `confidential`          |
| `eve.workbench-read.isis-texture-quality`          | `confidential`          |
| `eve.workbench-read.isis-suspicious-activity`      | `confidential`          |
| `eve.workbench-read.isis-model-governance`         | `confidential`          |

## Service integration and failure behavior

Focused integration cases bind the common seam to the real in-process Hathor and
Isis runtime stores, prove Hathor owner isolation and Isis tenant filtering, and
exercise both an unbound dependency and a durability repository that cannot
answer. Neither failure becomes `[]`, `null`, or another empty-success shape.

The current integration proof binds the BFF common seam to real in-process
Hathor/Isis runtime stores and controlled dependency failures. It does not claim
a Metis HTTP call because task 1.3 admitted zero Metis routes.

## Verification

- BFF focused suite: 47 passed.
- Shared router focused suite: 51 passed.
- BFF typecheck backlog: 0.
- Workbench-kit library compile: passed.
- Workbench-kit package spec typecheck: pre-existing-backlog; changed-file
  diagnostics: 0.

## Limitations

- This closes task 1.4 for the common Eve workbench-read seam; it does not
  register a Metis view, implement the ADR-0075 HTTP transport, or close G4.
- No Metis subject/tenant/scope request is fabricated for testing: the zero-view
  boundary rejects it as unknown before a service call. The guards are exercised
  on real registered views and the shared router boundary.
- The service integration evidence uses real BFF runtime stores and controlled
  dependency loss, not a staging or production network probe.
- The workbench-kit library compile passes, while its package-wide spec
  typecheck retains unrelated pre-existing diagnostics; the changed router spec
  passes under Vitest and has no recorded changed-file type diagnostic.