feat/one-api

'service' RouteAuthKind is unresolvable — silent W2 trap

apps/platform/src/api/utils/public-v1-meta-gate.ts:104

Gate maps actorType to kind as machine|session only. RouteMetaSchema accepts auth:['service'], so when W2 service keys land and a route stamps auth:['service'], the gate silently returns FORBIDDEN_ACTOR for all callers. Fix before W2: add 'service' to the actorType discriminator, or document that service routes must also include 'machine' until the gate is extended.

OPTIONS handler bypasses rate limiting

apps/platform/src/app/api/v1/[...ts-rest]/route.ts

All HTTP methods pass through withRateLimit before dispatch; OPTIONS calls baseHandler directly. Real impact minimal (CORS preflight is method-matched against POST so gate returns UNAUTHORIZED on OPTIONS) but inconsistent surface.

Org-claim GUC gap correctly documented; no W3 merge gate exists yet

.claude/rules/one-api.md

Convergence hazard #3 accurately identifies stale JWT membership claims as an auth gap on converged public routes. No blocker for this PR (no converged routes yet), but W3 capability PRs should each require a stale-membership test before deleting the internal twin.

Scope grammar conflates grant vocabulary with required-scope vocabulary

.claude/rules/api-patterns.md

The new bullet lists 5 grant forms including {cap}:* but RouteMetaSchema.scopes restricts required scopes to {cap}:{read|write} only. Add one sentence distinguishing grant forms from route requirement forms to prevent future implementers from stamping {cap}:* as a required scope.

withPublicApiAuth attribution inverts causal direction

.claude/rules/api-patterns.md

Docs frame withPublicApiAuth as the enforcement mechanism; in reality withMetaGate enforces scopes, withPublicApiAuth is a handler wrapper that short-circuits. Risk: future implementers may believe adding withPublicApiAuth alone is sufficient for scope enforcement.

Pricing zone row not cleaned up in afterAll

apps/platform/src/__tests__/integration/public-v1-idor.test.ts

Pre-existing gap (not introduced by this diff). Repeated runs accumulate stale rows in shared integration DB.

No explicit 'fails-closed' test for withMetaGate unknown route key

apps/platform/src/__tests__/integration/public-v1-idor.test.ts

Docs claim withMetaGate fails closed on unknown keys. IDOR harness fires all known routes but not a fabricated unknown key. A one-line synthetic test would pin this behavioral claim.

Route-metadata-gate bullet is a 230-word paragraph — hard to scan

.claude/rules/api-patterns.md

Encodes a 4-step decision tree, stash/reuse optimization, AuthContext shape, and CI hook all in one dense run-on. Sub-list would aid future readers scanning for specific facts.

Missing convergence hazard — error surface divergence

.claude/rules/one-api.md

3 documented hazards (casing, pagination, auth mechanism) miss a fourth: internal routes emit raw ZodError trees and undeclared 5xx bodies; when converged those become public leaks or contract violations.

Realtime table Gate column is heterogeneous

.claude/rules/one-api.md

Gate column mixes a system name, a design property, and a technical detail across rows — not a consistent column. Consider 3-column table (Plane/Transport/Audience) with gate info in the bullet rules below.

Test comment could be more specific

apps/platform/src/__tests__/integration/public-v1-idor.test.ts:149

'referential completeness of the CFE graph' is opaque. 'Required by the CFE schema FK chain but not used as a probe target' is more concrete.