← all branches

feat/one-api

safeviewing older commit
42c7358 · incrementalPR #326reviewed 2026-07-22 20:46 UTC0H · 0M · 0L · 1I
The branch
Purpose
Establish the One-API program: one canonical contract tree where audience (public / platform-admin / browser-session / service) is metadata on a route, not a separate mount point.
Goal
W1 groundwork — rule SSOT, 250-route inventory, unified id-prefix registry, RouteMeta machinery, and three P0 security gates (meta-gate, catalog-admin-gate, IDOR harness).
Sub-goals
  • SG-1: one-api.md SSOT rule (decision + wire grammar + wave plan)
  • SG-2: classify-routes.ts → route-inventory.json (250 routes, dual-auth surfaced)
  • SG-3: shared-kernel sole 55-entity PublicIdPrefix registry; cjb→cfj; publicIdRegex
  • SG-4: ADRs 016/018/020 distilled into .claude/rules; docs/ADRs/ retired
  • SG-5: RouteMeta type/builder/schema — all 48 public-v1 routes stamped; guard test
  • SG-6 (BAT-274): withMetaGate enforcement point — credential class + machine scopes; fail-closed
  • SG-7 (BAT-273): 12 catalog write exports gated isPlatformAdmin; regression suite
  • SG-8 (BAT-275): two-org IDOR harness over all 48 routes; local ES256 token mint; green on preview DB
The changes (whole branch)
What
Registered Finding ('fnd') in PublicIdPrefix after the utility-contract-findings entity merged to main (#328) without folding its FINDING_PREFIX into the shared-kernel registry. Also brought in two main-merge files (db schema index + api package.json exports) that now appear in the diff window.
Why
The integrity test (public-id-prefix-registry.test.ts) caught the drift on merge — exactly its purpose. The fix closes the gap so the registry stays authoritative and the 'every db *_PREFIX is registered' assertion passes.
Areas
.claude/rules+675−13apps/platform+1343−116docs (ADRs retired)+1−12201packages/api+266−46packages/shared-kernel+85−22packages/database+5−3scripts/one-api+6036−0
Blast
~86 files changed across platform, rules, api, and shared-kernel; +8413/-12431 (bulk of dels = retired ADR files). Incremental this run: 3 files, +17/-0.
IDOR harness not wired into CI yet (noted in PR out-of-scope) Structural org-claim GUC audit (P2.4) deferred to own branch
➖ci· check-runs not accessible via this token (403)➖coderabbit· no .coderabbit.yaml in repo

Findings · 1

conventions1

info

Multi-line comment block on db/schema/index.ts export (came via main merge)

packages/database/src/schema/index.ts:95

The 3-line comment explaining the JS-vs-table name divergence (JS `findings` / table `utility_contract_findings`) shipped in PR #328. CLAUDE.md says one short line max for comments; the WHY (naming ergonomics diverges from the table) is non-obvious so a comment is warranted, but it could be condensed to a single line. Not blocking — landed in main already.

History · 47 commits

  1. 82bb5b9blockedincremental5H · 5M · 4L2026-08-12 01:48
  2. 90aa3d5needs attentionincremental1H · 5M · 3L2026-08-11 19:37
  3. 29d19a0needs attentionincremental1H · 5M · 9L2026-08-11 17:41
  4. 9bd8a0cneeds attentionfull0H · 5M · 9L2026-08-11 02:14
  5. 62ec3f7needs attentionincremental2H · 5M · 6L2026-08-10 22:51
  6. f93bca9needs attentionincremental2H · 5M · 8L2026-08-10 17:51
  7. 052db6fneeds attentionincremental1H · 3M · 4L2026-08-09 21:13
  8. 45699caneeds attentionincremental0H · 7M · 11L2026-08-09 17:44
  9. b843d8aneeds attentionincremental1H · 7M · 9L2026-08-09 04:05
  10. e1757b8needs attentionincremental0H · 3M · 6L2026-08-05 02:11
  11. 7a762faneeds attentionincremental2H · 5M · 5L2026-08-05 01:25
  12. 3300a60needs attentionincremental2H · 4M · 7L2026-08-04 19:06
  13. 0c8a7f5needs attentionincremental0H · 4M · 9L2026-08-04 18:15
  14. 345f42eneeds attentionincremental2H · 6M · 9L2026-08-04 17:28
  15. 8338a9aneeds attentionincremental5H · 14M · 14L2026-08-04 00:33
  16. 41be4c3needs attentionincremental0H · 5M · 7L2026-08-03 23:49
  17. 5ed593dneeds attentionincremental1H · 6M · 6L2026-08-03 21:32
  18. b333e25needs attentionincremental4H · 9M · 8L2026-08-03 21:00
  19. 5642cccneeds attentionincremental2H · 3M · 2L2026-08-03 20:17
  20. 73b0b39needs attentionincremental3H · 10M · 13L2026-07-31 18:29
  21. b19852eneeds attentionincremental0H · 1M · 5L2026-07-29 05:04
  22. 3845205needs attentionincremental3H · 6M · 4L2026-07-29 04:47
  23. eb8eb50needs attentionincremental0H · 1M · 2L2026-07-29 03:03
  24. f4720a3needs attentionincremental6H · 8M · 7L2026-07-29 02:54
  25. f8d341ablockedincremental2H · 2M · 5L2026-07-29 00:00
  26. a7f1a64needs attentionincremental2H · 8M · 8L2026-07-28 18:41
  27. 738b60bblockedincremental3H · 6M · 5L2026-07-28 00:46
  28. 2c248b6needs attentionincremental8H · 12M · 8L2026-07-27 23:23
  29. 1346cc0needs attentionincremental2H · 8M · 6L2026-07-27 20:15
  30. 0716018needs attentionincremental2H · 11M · 12L2026-07-27 19:22
  31. 215cd2dneeds attentionincremental3H · 6M · 5L2026-07-27 17:04
  32. ec46958needs attentionincremental0H · 3M · 5L2026-07-27 16:51
  33. de7b337blockedincremental4H · 9M · 14L2026-07-27 06:36
  34. b1bb9c0needs attentionincremental1H · 2M · 4L2026-07-27 05:09
  35. 4701d11needs attentionincremental0H · 4M · 3L2026-07-27 04:44
  36. e1626c4needs attentionincremental3H · 9M · 10L2026-07-27 03:21
  37. 195f198needs attentionincremental3H · 3M · 3L2026-07-25 01:22
  38. 42c7358safeincremental0H · 0M · 0L2026-07-22 20:46current
  39. 85b9018needs attentionincremental0H · 1M · 6L2026-07-21 23:51
  40. a7b2a9aneeds attentionincremental0H · 9M · 12L2026-07-21 18:49
  41. c2ee0daneeds attentionincremental4H · 7M · 7L2026-07-21 02:17
  42. e8ffa5eneeds attentionincremental4H · 7M · 5L2026-07-21 01:33
  43. a2d2a54needs attentionincremental2H · 7M · 3L2026-07-21 00:51
  44. 576fbd6needs attentionfull1H · 6M · 7L2026-07-21 00:35
  45. d3465e8needs attentionincremental1H · 7M · 10L2026-07-21 00:23
  46. dc794a7needs attentionincremental0H · 5M · 5L2026-07-20 23:46
  47. 9082773needs attentionfull1H · 3M · 3L2026-07-20 23:13