feat(analytics): enforce analytics_cube.public and default it to visible

[objectstack-fleet]

Part of #20282

Clause-②: yes (narrowing)

Rework round 2

The order of record is seat comment 5863061968 on #20282. It responds to the at-tier contract review 5863057917 on this PR, which recorded FAIL at f84cd184df. Claim 5859909653 is unchanged. There are new commits on top only, with no rebase, amend or force-push. The final head is 5ddea9580d.

1. The declaration. The changeset and this body now read Clause-②: yes (narrowing), and the changeset carries a **BREAKING** sentence.
   • It names the refused class: a query or SQL dry run against a cube declared public: false, and every cube in an artifact built by os compile before this release.
   • It gives the remedy: delete public: false from any cube that is meant to be queried, and recompile.
   • It carries the ADR-0087 disposition registered analytics-cube-public-default-visible-enforced. The gate printed the six categories, and registered is the true one because this PR adds the entry.
   • check-adr-0087-registration passes: 1 declared-breaking changeset with a disposition. Levels stay minor.
2. The D3 entry. packages/spec/src/migrations/entries/semantic/18.analytics-cube-public-default-visible-enforced.ts is a structured TODO with no tracker numbers in the author-shown fields.
   • It covers both holdings: an authored public: false now hides the cube and refuses its queries, and a pre-release compiled artifact must be recompiled.
   • registry.ts is regenerated, and check:migration-registry passes.
   • spec-changes.json and the upgrade guide do not project major-18 entries yet, so they did not move.
   • Probe. Base is origin/main 862b6ce869, which does not have this PR.
     • I compiled a one-object, one-cube app whose cube omits public with the base CLI's compile command. The command class was run directly, because the oclif dev dispatcher loads every command module and needs the whole CLI closure built.
     • The artifact carries "public": false on the cube.
     • I served those artifact cubes on head's built AnalyticsService: getMeta() returned [], and query() and generateSql() returned 404 CUBE_NOT_FOUND.
     • The same cube recompiled with head's schema has public: true: listed, and both doors answer.
   • Narrowing, declared. The head leg ran at the service seam that the /analytics/* routes call, not through an HTTP boot. The verify closure rebuild did not get the lock (queue timeouts).
   • Observation. The open-core os serve artifact boot never threads analyticsCubes into the analytics service (standalone-stack.ts does not return them), so on that path an artifact's cubes are absent either way. The entry is worded for a host that registers cubes from an artifact.
3. Non-disclosure. A hidden cube's refusal is now cubeNotFoundError, the same function the unknown-name path throws: the same CUBE_NOT_FOUND / 404 and the same message.
   • The one shared message names both possibilities and still contains "is not a registered object", which the dataset door's missing-source sniffer reads.
   • Pinned. For query() and generateSql(), the same name hidden in one service and absent from another gives equal status, code, message, cube and own keys.
   • Ablation at ac5260a28b, via scripts/ablation-replace.mjs. The mutation made the hidden-path message differ: anchor 1→0, blob 1a1763ac7d04→7e5bc6dd03ab. The two identity pins went red and the other 13 stayed green (Tests 2 failed | 13 passed). After restore the blob is back to HEAD's and git diff HEAD is empty.
   • Docs. The cube-visibility.ts docblock and the changeset sentence no longer claim public: false withholds the definition. They say what the key does: the cube is left out of /analytics/meta, and queries and SQL generation against it are refused. The definition stays readable on the metadata door.
   • The ledger evidence anchor was renamed to #cubeNotFoundError.
4. Stale texts. Each now says that cubes declared public: false are omitted:
   • content/docs/api/data-api.mdx (GET /analytics/meta);
   • content/docs/api/client-sdk.mdx (the analytics.meta comment);
   • the IAnalyticsService.getMeta TSDoc.
5. Merges of origin/main. Three merges went through scripts/pm/os-regen-merge.sh: 5a6267f486, then 862b6ce869, then 15bf186f50. Each regenerated artifact was regenerated with its generator (gen:schema, gen:docs, gen:liveness-counts), never hand-resolved.
   • The last merge brought in fix(service-analytics): queryDataset compiles into a request scope and never writes the shared registries #20380, which moves queryDataset into a request scope.
   • Two joint fixes followed. The visibility gate now asks the call's own cube scope. Otherwise a dataset named like a hidden cube was refused while any other name ran, which is an oracle for hidden names. This is pinned.
   • Main's query-dataset-request-scope.test.ts observer baseline, written while nothing read public, now expects discovery to omit its public: false fixture.
6. Verification. Service-analytics, spec and ledger checks, then gates:
   • The service-analytics full suite at 036af03342 passed with one exception: 130 of 131 files and 3067 of 3069 tests. The two failures were main's observer baseline, fixed in 5ddea9580d.
   • Pins at 5ddea9580d: 5 files, 108 tests passed. They are cube-public-visibility, query-dataset-request-scope, analytics-service, query-dataset and cube-inference-gate.
   • Service-analytics typecheck passes. Spec analytics, migrations and contracts/analytics-service tests: 194 of 194.
   • The spec build is green, and its ratchet still prints data/Cube:public: false → true. check:generated (15 of 15 current), check:liveness (analytics_cube live 18 / dead 9) and check:migration-registry are green.
   • dispatch-gates --commands at 5ddea9580d derived 117 commands. All ran and were reconciled with --ran: 117 run, 0 NOT MEASURED, 0 unrun.
   • check:query-options-erasure and check:type-check-debt hit the 420 s runner cap on the loaded box and were re-run with a longer cap; both exited 0.
   • CI at 5ddea9580d: 35 check runs, 33 success, 2 skipped. Mergeable: clean.

Rework round 1

The order of record is seat comment 5861384124 on #20282; claim 5859909653 is unchanged. The open question was ruled A in-seat: no ADR-0087 semantic entry, and Clause-②: yes and minor stay as shipped. There is one new commit on top, 2cfa134c34, with no rebase and no force-push.

1. Checklist text: docs/qa/platform-checklist/areas/dashboards.json, item dashboards.cube-query. It moves from revision 1 to 2 and gains a history entry. Three pieces of text were rewritten to what is true after this PR:
   • The meta clause's verify text: getMeta lists a cube only when its public is not false. A public: false cube is omitted and refused by query()/generateSql() with 404 CUBE_NOT_FOUND. showcase_delivery declares no public, so it is visible by default.
   • The showcase-cube source line no longer says public:false.
   • The getMeta source line no longer says it "returns all registry cubes".
   • The verdict is unchanged. Every clause, step and negative still holds, because showcase_delivery stays visible with the same four measures and four dimensions.
   • pnpm check:platform-checklist is OK (266 items; symbol anchors 624/642, 18 on the named residual).
2. Measurement only, no fix: the inline-dataset name collision, at the public door. It reaches.
   • Boot: @objectstack/verify bootStack (the real Hono app, in process), with the analytics-admission-fixture stack on sqlite-wasm.
   • Two authored cubes, parsed through CubeSchema and passed as AnalyticsServicePlugin({ cubes }): open_summary (visible) and hidden_summary (public: false), both over admission_open.
   • Callers: A and B are two separate plain-member sign-ups.
   • Before, B calls GET /api/v1/analytics/meta and gets 200 listing open_summary "Open Summary (authored)" with measure open_summary.authored_total. B's POST /api/v1/analytics/query for that measure answers 200, authored_total: 2.
   • A is refused, and the cube is replaced anyway. A sends POST /api/v1/analytics/dataset/query with an inline dataset named open_summary over admission_walled, an object A has no grant on. The answer is 403 PERMISSION_DENIED. B's meta then answers 200 listing open_summary titled "inline by A" with only open_summary.hijack_cnt. B's query of authored_total answers 400 INVALID_FIELD ("…which object 'admission_walled' does not have. Valid measures: hijack_cnt"). queryDataset registers the compiled cube before its admission gate runs.
   • A is admitted. On a second boot, the same request over admission_open answers 200 and makes the same replacement. B's open_summary.hijack_cnt answers 200, and the count is B's own RLS scope.
   • It persists. 3 s later, after unrelated traffic, B still sees A's definition.
   • The hidden cube. B's query of hidden_summary answers 404 CUBE_NOT_FOUND (this PR's gate). A's inline dataset named hidden_summary then answers 200. B's meta now lists hidden_summary, with A's definition. The authored secret_total is gone (400 INVALID_FIELD); the hidden definition was replaced, never disclosed.
   • A restart restores it. A fresh kernel from the same config serves the authored cube again.
   • The replacement is process-wide: it crossed users. No response returned rows outside the caller's own RLS scope. A multi-tenant (cross-org) boot was not measured.
   • The scratch probe was not committed, and no process is left running.
3. Gates re-derived at 2cfa134c34. dispatch-gates --commands derived the same 113-command set, and all of it was re-run on this head.
   • Reconciled with --ran: 112 run with exit 0, 1 NOT MEASURED, 0 unrun.
   • check:skill-examples and check:type-check-debt first exited 3 and passed once their build prerequisites were built. The type-check-debt re-measure is OK: 4 ledger entries, 53 raw errors, none above its record.
   • NOT MEASURED: check:dual-build-cjs-loads, reason: PREREQUISITE NOT MET (34 workspace packages have no dist/ here; a whole-tree build for CI).

Stage 1 of the analytics-cube-semantics family: analytics_cube.public and its default. Triage verdict ENFORCE (5859510828, execution note 1), claim 5859909653. #20282 remains open for the later stages (format, granularities, refreshKey, descriptions, and the objectui picker sub-issue). This PR does not touch any of them.

What changes

• Spec. CubeSchema.public defaults to true (it was false) and gains a .describe(). false hides the cube from the analytics API. It is visibility, not row security. The default change is declared in DEFAULT_CHANGES_BY_MAJOR (packages/spec/scripts/lib/default-changes.ts), which the authorable-defaults ratchet requires.
• Reader. New module packages/services/service-analytics/src/cube-visibility.ts. isCubePublic is the one reader: a cube is exposed unless it declares public: false. The registry holds the input shape, so an omitted key reads as the schema default. cubeNotFoundError is the refusal, and it is shared with the unknown-cube path (rework round 2).
• Discovery. AnalyticsService#getMeta omits a hidden cube. getMeta(name) for a hidden cube answers [], the same answer as a name no cube has.
• Query doors. AnalyticsService#assertCubePublic runs first in query() and in generateSql(). It runs before token resolution, cube inference, admission and every strategy, so the refusal leaves the registry untouched. The refusal is 404 CUBE_NOT_FOUND, byte-identical to the one an unknown cube name gets (rework round 2). Its one shared message names both possibilities. It is never an empty result.
• Internal producers. inferCubeFromQuery, compileDataset and CubeRegistry.inferFromObject each wrote a literal public: false, the old default. They now write true. Without that, the ad-hoc KPI path and the dataset door would refuse the cubes they mint themselves (see the internal-caller census below).
• Showcase. examples/app-showcase/src/data/analytics/showcase.cube.ts drops its public: false (evidence below).
• Ledger. The public row in packages/spec/liveness/analytics_cube.json flips dead to live, citing cube-visibility.ts#isCubePublic, analytics-service.ts#getMeta and analytics-service.ts#assertCubePublic, with the CLI threading as producer. The README cell and state-counts.md (regenerated) now read analytics_cube live 18 / dead 9.
• Generated projections, regenerated by their generators: authorable-defaults/data.json (by the build) and content/docs/references/data/analytics.mdx (gen:docs). state-counts.md comes from gen:liveness-counts. No file under skills/** or any other governed surface changed, so this PR is not Tier H.

Present state, measured before the change (base 4e0f72e8d2)

• Declared: packages/spec/src/data/analytics.zod.ts, public: z.boolean().default(false) under an /** Access Control */ comment, with no describe.
• Readers: none. git grep for cube.public or .public found no reader in packages/services/service-analytics/src or packages/drivers.
• Doors that list or resolve an authored cube:
  • GET /api/v1/analytics/meta goes to getMeta.
  • POST /api/v1/analytics/query goes to query().
  • POST /api/v1/analytics/sql goes to generateSql().
  • The three routes above are served by the runtime domains/analytics.ts.
  • POST /api/v1/analytics/dataset/query goes to queryDataset, which uses DatasetExecutor and then query().
  • The strategies resolve only ctx.getCube(query.cube), the root cube. Joins reach objects, not cubes, so no second cube is resolved per query.
• Authored cubes in the repo: exactly one writes public, examples/app-showcase/src/data/analytics/showcase.cube.ts:98 with public: false. No platform object or qa fixture authors a cube public value. Test fixtures restated public: false in 45 files: 44 in service-analytics, plus packages/runtime/src/cross-field-refusal-operand-withhold.test.ts.
• Lit control: the new pin file run on the unfixed code (commit 99f0e9d296, test only) gave Tests 10 failed | 3 passed (13):
  • expected [ 'hidden_cube', 'visible_cube', …(2) ] to not include 'hidden_cube' (getMeta lists the hidden cube).
  • query(): promise resolved "{ rows: [ {} ], fields: [ { …(2) } ] }" instead of rejecting.
  • generateSql(): promise resolved "{ …(2) }" instead of rejecting.
  • The 3 passes are the controls: a visible cube, an omitted-key cube and a parsed cube are all answered.

The showcase decision, with evidence

The cube is meant to be seen and queried, so this PR drops the false rather than keeping the cube hidden:

• examples/app-showcase/src/coverage.ts marks analyticsCubes demonstrated, "Served by the foundational analytics capability (/api/v1/analytics/*)".
• The cube's own docblock says it exists "to show BOTH analytics surfaces … cubes feed the analytics service (/api/v1/analytics/*)".
• The platform checklist item in docs/qa/platform-checklist/areas/dashboards.json runs GET /api/v1/analytics/meta?cube=showcase_delivery and POST /api/v1/analytics/query { cube: 'showcase_delivery', … }.

A hidden showcase cube would demonstrate a 404. It is pinned in examples/app-showcase/test/gap-fill.test.ts (DeliveryCube.public === true).

Internal callers of the same door

Only AnalyticsServicePlugin registers the analytics service in this repo. In-repo consumers are the runtime REST domain, the REST dataset door and service-analytics itself. packages/runtime/src/domains/mcp.ts and action-execution.ts call a different getMeta (the metadata protocol's).

Two internal paths reach query() with a cube they minted:

• The ad-hoc inference path registers what it infers, so the next request resolves it from the registry.
• queryDataset uses DatasetExecutor, then query(), on the dataset's compiled cube.

Both producers wrote the old default as a literal. Neither literal meant "hidden": if it had, enforcement would refuse the producer's own query. So they now write true. That keeps their behavior (visible and queryable, as before) and does not widen the door. No internal caller needs to reach a non-public cube, so there is no needs_decision.

Pins

packages/services/service-analytics/src/__tests__/cube-public-visibility.test.ts, 13 cases:

• getMeta omits a hidden cube; getMeta(hidden) answers [].
• query() and generateSql() refuse with { code: 'CUBE_NOT_FOUND', status: 404, cube }, and no strategy ran.
• The refusal happens before the registry is touched.
• A refusal is a rejection, not an empty result.
• Controls: a visible cube, an omitted-key cube and a CubeSchema-parsed cube are all answered.
• The three internal mints produce visible cubes: the ad-hoc path answers twice and is listed, and queryDataset answers.

packages/spec/src/data/analytics.test.ts pins the default (true) and an explicit false that parses and is kept.

Ablation

The reader was mutated at HEAD 33348d6ec3 so that it stops filtering.

• Mutation. node scripts/ablation-replace.mjs --file packages/services/service-analytics/src/cube-visibility.ts --anchor 'return cube.public !== false;' --replacement 'return true;' (WRAP mode, with the lock-held test run as its child).
• On-disk proof, from the tool. The anchor count went from 1 to 0, the replacement count from 0 to 1, and the blob from 44d9fcf712d5 to e144bb908748.
• Why no rebuild was needed. The pin file imports the service through relative src paths (../analytics-service.js, ../cube-visibility.js), so no package exports and no dist/ sit on the subject's resolution path.
• Red leg. src/__tests__/cube-public-visibility.test.ts gave Tests 6 failed | 7 passed (13). The six reds are exactly the two getMeta pins and the four door-refusal pins. The controls and the internal-producer cases stay green. The direction was red, as expected.
• Restore. The blob after restore is 44d9fcf712d5, equal to the HEAD blob, and git diff HEAD is empty. Two earlier attempts timed out in the verify-lock queue (exit 99) and never ran the test; each of their restores was proven the same way.
• Green leg, at the committed state 33348d6ec3. Tests 93 passed (93) across the pin file, analytics-service.test.ts, query-dataset.test.ts and cube-inference-gate.test.ts.

Changeset

.changeset/20282-analytics-cube-public-enforced.md bumps @objectstack/spec and @objectstack/service-analytics at minor. The reasons:

• Clause-②: yes (narrowing) is BREAKING, and ships as minor under the launch-window convention.
• Both packages are in the same fixed group.
• The service change is a new enforcement, not a fix to an existing behavior.

Since rework round 2, the changeset carries a **BREAKING** sentence and the ADR-0087 disposition registered analytics-cube-public-default-visible-enforced. It also records the upgrade notes: omitted key (no change), explicit false (now hidden), os compile artifacts that carry a materialized false (recompile), and the platform-minted cubes.

Local verification

Every reading below was taken at HEAD 33348d6ec3, a clean tree that includes a merge of origin/main at eea8787aa7, unless a line says otherwise.

• @objectstack/service-analytics, full vitest run, at c9382ff256. Test Files 1 failed | 129 passed (130), Tests 1 failed | 3053 passed (3054).
  • The one failure was this PR's own new case, a dataset fixture with no dimensions. It is fixed in 33348d6ec3, which changes only that test file.
  • The 44 re-spelled fixture files are among the 129 that passed.
  • At 33348d6ec3 the pin run is 93 passed (93).
• @objectstack/service-analytics typecheck (tsc --noEmit, which reaches the tests): exit 0 at c9382ff256.
• @objectstack/spec, targeted.
  • src/data/analytics.test.ts, analytics-strictness-batchd.test.ts, src/api/analytics.test.ts, src/contracts/analytics-service.test.ts and src/kernel/metadata-type-schemas.test.ts gave Tests 227 passed (227).
  • The spec build is green, including the authorable-defaults ratchet, which now prints the declared data/Cube:public: false → true.
  • check:generated reports all 15 artifacts up to date.
  • check:liveness is green: analytics_cube 27 classified (live 18, dead 9).
• packages/runtime/src/cross-field-refusal-operand-withhold.test.ts, against a rebuilt service-analytics dist: Tests 11 passed (11).
• Lit control, on the unfixed code at 99f0e9d296. Tests 10 failed | 3 passed (13) (the readings are quoted above).
• Gates. node scripts/pm/dispatch-gates.mjs --repo objectstack-ai/objectstack --commands derived 113 commands. All were run and recorded, then reconciled with --ran: 111 exited 0, 2 are NOT MEASURED, 0 are unrun.
  • NOT MEASURED: check:dual-build-cjs-loads, reason: PREREQUISITE NOT MET, 64 workspace packages have no dist/ in this worktree, so this is a whole-tree build for CI.
  • NOT MEASURED: check:type-check-debt, reason: PREREQUISITE NOT MET, @objectstack/driver-turso has no built types.
  • check:skill-examples first exited 3, because the client packages were not built. It was re-run after building them and exited 0.
• NOT MEASURED: examples/app-showcase/test/gap-fill.test.ts, reason: the showcase's dependency closure is not built here (Failed to resolve entry for package "@objectstack/connector-mcp", so the run never reached a test). The pinned fact itself was measured lock-free: evaluating src/data/analytics/showcase.cube.ts with tsx prints DeliveryCube.public = true. The file runs in CI.
• NOT MEASURED locally, declared to CI: @objectstack/spec's full pnpm test and typecheck.
• Unit-level only: no dev server was booted. The door behaviour is pinned at the service seam that the runtime /analytics/* routes call.

Acceptance notes

Observations, not filed:

• MemoryAnalyticsService does not read public. @objectstack/driver-memory's standalone MemoryAnalyticsService#getMeta and #query ignore the key.
  • It is not a door in any in-repo composition: only AnalyticsServicePlugin registers the analytics service.
  • Behind AnalyticsService it is reached only through the gated query() and generateSql(), and AnalyticsService#getMeta never consults it.
  • Carrier: the analytics: an authored cube's public, refreshKey, format, granularities and descriptions take effect (8 keys) #20282 descriptions stage, whose reader list already names both getMeta implementations.
• Stale checklist wording in docs/qa/platform-checklist/areas/dashboards.json: fixed in rework round 1 (item 1 above).
• An inline dataset can replace an authored cube. This was measured at the public door in rework round 1 and filed as analytics: any member's inline dataset query replaces an authored cube for every user until restart, even when the query itself is refused 403 #20356. Main has since fixed it (fix(service-analytics): queryDataset compiles into a request scope and never writes the shared registries #20380), and that fix is merged into this branch in round 2, where the visibility gate was adapted to its request scope.

---

Generated by Claude Code

[github-actions]

📓 Docs Drift Check

This PR changes 2 package(s): @objectstack/service-analytics, @objectstack/spec, touching 15 documentable anchor(s). ⚠️ 4 changed file(s) yielded no anchor (packages/spec/authorable-defaults/data.json, packages/spec/liveness/README.md, packages/spec/liveness/analytics_cube.json, …), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files.

2 hand-written doc(s) NAME something this change touched and may need an implementation-accuracy re-verification:

• content/docs/api/data-api.mdx (via IAnalyticsService (symbol, a top-level interface), CUBE_NOT_FOUND (literal, a string literal in assertInferableCube; a string literal in cubeNotFoundError))
• content/docs/data-modeling/analytics.mdx (via IAnalyticsService (symbol, a top-level interface))

⛔ 1 release-owned page(s) also name something this change touched. These are read-only:

• content/docs/releases/v14.mdx (via generateSql (symbol, a method of class AnalyticsService))

content/docs/releases/ is RELEASE-OWNED (AGENTS.md "Documentation Guardrails"): release
notes are written centrally at release time, and a code PR that edits them is the exact PR
that guardrail exists to stop. They are still audited — read-only. If one of them is actually
wrong, file an issue or open a dedicated docs-only PR; do not edit it here.

What this run could not see

• 4 changed file(s) yielded no anchor (packages/spec/authorable-defaults/data.json, packages/spec/liveness/README.md, packages/spec/liveness/analytics_cube.json, …) — pages documenting those are invisible to this run
• 4 name(s) were too generic to anchor anything (single lowercase words)
• the SDK route bridge reached 54 of 206 client-bound route-ledger rows — the other 152 have no registrar path: tail to select them, so pages documenting THEIR client methods cannot appear above, on this or any run. Of those 152: 0 are remediable by widening that discovery convention (an in-repo file declares the path; the convention did not scan it); 55 are structural — on a ledger where NOT ONE row is declared in-repo, so no discovery change reaches them at any price; 97 are undecided (no in-repo declaration, on a ledger that has other in-repo registrars — absence and an unreadable spelling are not distinguishable here). The rows themselves: node scripts/docs-audit/affected-docs.mjs --bridge-coverage
• a page that states a rule by its inputs shares no identifier with the emitter that implements the rule, so an emitter-only diff cannot list it — not on this run and not on any run. Measured on fix(driver-sql): emit varchar(maxLength) for a text field a declared index keys on #11430: content/docs/protocol/objectql/types.mdx documents the text-family column mapping by the ObjectQL type names it maps FROM (text / textarea / html) while the diff changed createColumn; it went unlisted, and it was the page that diff falsified, in four places. No shared token exists to detect this on, so a rule your change carries has to be re-read by hand in the pages that restate it.
• a key NAME is not a key, so the hand re-read the line above prescribes can land on the wrong schema. The same spelling is authorable on one governed type and a [REMOVED] tombstone on another for each of active, aria, joins, objects, template, tools and version (censused on [finding] tools is a key on BOTH AgentSchema (tombstoned, dead) and SkillSchema (live, cloud-attested), so a name-based search attributes skill examples to the agent key — it produced a false stop-the-line alarm on PR #19059 #19093 over the liveness ledger's governed types, top-level keys); nothing in a search result distinguishes the two, so a grep hit on a LIVE example reads as evidence about the DEAD key. Measured on fix(spec): the agent.tools liveness row says dead — it claimed live on a key the schema tombstoned #19059: content/docs/ai/agents.mdx was reported as contradicting the agent.tools tombstone over its tools: example at :161, which is inside the defineSkill({ block opened at :155 — the page was already correct. Settle ownership by PARSING the value against both schemas, never by the name: that literal PASSES SkillSchema, and as an AgentSchema it FAILS at tools with the tombstone prescription. ⛔ These names are not the whole class — a key retired through a .strict() guidance map leaves no tombstone in the walked shape and none of them here (tool.category, live as AIToolDefinition.category).

Coarse fallback — 136 page(s) merely mention a changed package (the pre-#9192 predicate, kept for the deliberately-wide backstop): node scripts/docs-audit/affected-docs.mjs --json 40b315b03345e334069dd454aecaf7016adbea4f → packageMentionDocs.

Which tree this was computed on

This run read content/docs from d1ac2513985ce7435c9a875702a3ed658611fdda — the merge of head 93376b42076d6f4708fd00ba7725434c4deb109f into base 40b315b03345e334069dd454aecaf7016adbea4f, which is what actions/checkout gives a pull_request run. Not the PR head.

A worktree cut from an older main holds a different content/docs, so re-deriving there can legitimately return a different list — that is a different tree, not a wrong row. To answer on the same tree:

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin d1ac2513985ce7435c9a875702a3ed658611fdda && git checkout d1ac2513985ce7435c9a875702a3ed658611fdda
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 40b315b03345e334069dd454aecaf7016adbea4f 93376b42076d6f4708fd00ba7725434c4deb109f && git checkout -B drift-repro 40b315b03345e334069dd454aecaf7016adbea4f && git merge --no-ff 93376b42076d6f4708fd00ba7725434c4deb109f

node scripts/docs-audit/affected-docs.mjs --json 40b315b03345e334069dd454aecaf7016adbea4f

⚠️ That checkout carried uncommitted changes, so the commit above does not fully identify what was read.

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 40b315b03345e334069dd454aecaf7016adbea4f → pass the list as
args.docs, on the commit named under Which tree this was computed on.

[objectstack-fleet]

Contract review

Served-tier: 105/105 CONTRACT_REVIEW_TIER
Head-sha: f84cd184dff0644cc2aca0e631a7309370b85db1

① Derived judgments

1. Blocking: the enforcement half is an accept-set narrowing declared as a plain widening. A query naming a cube that declares public: false is answered on base and refused 404 at head (assertCubePublic, analytics-service.ts:1356/2015). The repo's precedent for an enforcement-only narrowing, .changeset/rls-check-defaults-to-using.md (security: RowLevelSecurityPolicySchema.check is published as "defaults to USING clause if not specified", but the write check runs only policies that declare check, so a USING-only policy never gates an INSERT #19942), declares no (narrowing), carries a **BREAKING** sentence and one adr-0087: marker, and ships minor. This changeset carries the migration prescriptions (delete the line; recompile) but no arm, no banner, no marker, so check-adr-0087-registration never judged it and compiled release notes will not flag it. The showcase taught public: false (showcase.cube.ts:98 on base), so consumers who copied it break on upgrade. Smallest fix: in the changeset and PR body re-spell the line Clause-②: yes (narrowing), add a **BREAKING** sentence naming the refused class and remedy, add one adr-0087: marker (the gate prints the categories); levels stay minor.
2. Blocking: a changeset sentence is not true. "What public: false withholds is the cube's own definition: its name, …" — cubeNotPublicError tells a caller who names the cube that it exists and "declares public: false" (cube-visibility.ts:53), while the same docblock says the shared code was chosen so as not to "tell a caller which names exist". Smallest fix: re-spell the sentence and docblock (name confirmed only to a caller who names it; measures, raw SQL and dimensions withheld), or make the message generic.
3. Blocking: stale hand-written doc. content/docs/api/data-api.mdx:482 says GET /analytics/meta returns "metadata for all registered cubes" — false after this PR, the class the checklist rewrite already fixed. Smallest fix: "all registered cubes not declared public: false" (also IAnalyticsService.getMeta TSDoc "returns all if omitted", client-sdk.mdx:321).
4. Doors. getMeta filters (:1985-1988); query()/generateSql() gate first, before token resolution, ensureCube, assertReadAdmitted, strategies. Dispatcher /analytics/query|meta|sql → those three (domains/analytics.ts:126,136,158); errorFromThrown keeps .status/.code, so 404 CUBE_NOT_FOUND reaches the wire. Dataset door (rest-server.ts:11319 → queryDataset → DatasetExecutor → service.query :1245/:1261) and the draft-preview branch evaluate only the compiled dataset cube (public: true). Explain = /analytics/sql = generateSql; NativeSQL and ObjectQL strategies resolve only ctx.getCube(query.cube); no result cache. MCP/AI tools: none name analytics. MemoryAnalyticsService: not constructed outside tests, only a fallbackService inside strategies after the gate; AnalyticsService#getMeta never consults it. Observation, not blocking: the metadata door lists cube definitions ungated — packages/metadata/src/plugin.ts:140 maps analyticsCubes to analytics_cube items (loop :1094) and domains/meta.ts serves getMetaItems to any authenticated caller. That is the schema surface, as Cube.dev's schema files are; a prune follow-up is the seat's call.
5. Refusal. Same CUBE_NOT_FOUND/404 as the unknown-name refusal (:2544-2552); only the message differs. Leak: existence of a hidden cube under a guessed name, which /meta would not reveal; nothing of the definition. Minor; item 2 fixes the text.
6. Default flip. Declared in DEFAULT_CHANGES_BY_MAJOR[17] (default-changes.ts:557), current major 17.4.0; authorable-defaults/data.json regenerated. Hidden after upgrade without an author-written false: YES, one class — a dist/objectstack.json built by a pre-flip os compile (serializes ObjectStackDefinitionSchema.safeParse output, compile.ts:357, so public: false is materialized) and served by os serve's artifact boot (serve.ts:1184). The changeset's "recompile" note is the only carrier; the seat's premise "unset cubes stay visible" does not cover it (supports item 1; a semantic registry entry stays the seat's ruling). Internal mints: all three write true; no other cube writer of public: outside tests.
7. Showcase. coverage.ts:192 marks analyticsCubes demonstrated; the checklist item queries it; no test or doc relied on it hidden (no reader existed on base); gap-fill.test.ts pins public === true.
8. Fixtures. 67 lines in 44 service-analytics files + 1 runtime file; every changed line is public: false → public: true (diff uniq), no other edits; no base test asserted hidden behaviour. Meaning unchanged.
9. Ledger/docs/checklist. analytics_cube.json public row live, evidence cites cube-visibility.ts#isCubePublic, analytics-service.ts#getMeta, #assertCubePublic, #cubeNotPublicError, producer serve.ts#CAPABILITY_PROVIDERS + analytics-service.ts#registerAll (:922); Spec property liveness green. dashboards.cube-query rev 2 text is true. analytics.mdx row equals the .describe() text with default true. state-counts.md 18/9/27 and 937/165/1117 is current: main's only ledger move since the merge-base (view.json) is note-only.
10. Changeset. Every other sentence checked true. Both packages minor (same fixed group). Clause-②: yes stands alone on its own line in the changeset and the PR body. CI at head: 35 runs, 33 success, 2 skipped, 0 failed.

② Semver level

minor on @objectstack/spec and @objectstack/service-analytics is right; the declaration is not. Per clause2-line.mjs: yes with no arm reads as a widening and takes at least minor (satisfied); yes (narrowing) is the reading for a diff that widens one surface and narrows another, is BREAKING, and still ships minor under the launch window (check-changeset-no-major.mjs), with the banner and ADR-0087 marker as the carriers. Widening: default false → true, .describe(), JSON-schema default. Narrowing: queries against a public: false cube go from answered to 404; pre-flip compiled artifacts go dark. Verdict: Clause-②: yes (narrowing), minor, banner, marker (item 1).

③ Boundary flags

• analytics: any member's inline dataset query replaces an authored cube for every user until restart, even when the query itself is refused 403 #20356: not worse for the authored definition — the overwrite still replaces and never discloses, and query() gates the caller's own public: true compiled cube; one new consequence: an inline dataset named like a hidden cube un-hides that name in /meta with the caller's definition (registerDataset :1448 runs before admission). The fix belongs to analytics: any member's inline dataset query replaces an authored cube for every user until restart, even when the query itself is refused 403 #20356.
• git merge-tree --write-tree of f84cd184df against current origin/main a88a1bb399: clean (tree 9148b0165b, exit 0); state-counts.md needs no regeneration.

Implemented-by: claude/issue-20282-analytics-cube-public-enforced
Reviewed-by: session_01QcAS3qiYYZNezaxZxaUdMV

VERDICT: FAIL