[HugoXK]

Written-by: HugoXK
Author: Fledge Platform Lead
maintainer_can_modify: false (same-repo head, GitHub-forced)
Fixes #610
supersedes #625 — same content change, author-identity fix only

Why this PR exists

#625's single commit was authored by the reviewer identity HugoXK-bot, so
review-gate refused it — correctly: a PASS from that identity cannot make work
it authored independently reviewed. Force-pushing the old branch to rewrite its
author is forbidden, so this branch re-creates the same change under the
compliant identity Day Dreamer <87640074+HugoXK@users.noreply.github.com>, which
is what the recent main commits use and which links to HugoXK, not to
HugoXK-bot.

What is identical and what differs

Identical: the change itself, file for file — audienceVisible() filtering the
revision list and the exact-revision read, the memory_not_found refusal before
the revision fence on a hidden write, the two red cases, the docs sentences and
the changelog fragment. +100/−8 across the same five files.

Different: the parent. #625 sat on ec887f8f; this branch sits on live main
b0adcc5f, because the old tree could not be re-committed in this repository.
The two hunks that had drifted (src/app.ts imports, docs/security.md) were
re-applied to main's text, not restored from the old file contents.

No new code, no extra file, no unrelated fix.

---

Fixes #610

What changed

• The memory GET filters both the revision-history list and the exact-revision read through audienceVisible(version.audience, role), so a historical revision written for another role is neither listed nor rendered after the entry moves to a wider audience. Requesting it returns the same missing page as an absent entry.
• The memory POST loads the current entry and refuses a write aimed at an entry outside the actor's audience with the existing memory_not_found refusal before the revision fence. The row and its revision list stay untouched, and a deliberately wrong expected_revision gets the same refusal instead of a conflict= response, so a hidden key is not a revision oracle.
• test/projectMemory.test.ts gains the two red cases from the issue: a hidden historical revision is not listed or rendered, and a hidden write is refused with the redirect plus untouched body/revision assertions.
• docs/security.md and docs/architecture.md now state that a revision is read under its own audience and that a hidden entry is not a write target.
• Added changelog.d/610.fixed.md.

Red evidence: both new tests failed on the unbroken tip (data-memory-version-count was 2 and the hidden write redirected with saved=1); both pass at this tip.

Ran (at this tip, 1d7ab4e3c9fcfabb2ff0a7c1ed5fd448c2f1310c, tree 3b745f51f27915453424b79a9da345e201ee82c3):

• npm ci — exit 0, 87 packages added
• npm run check — 1805/1805, fail 0, exit 0 (lint 11 warnings / 0 errors, tsc --noEmit clean, build clean)
• node scripts/changelog.mjs check — 8 fragment(s) ok
• node scripts/risk-gate.mjs --base b0adcc5f7380672a4c5afe1538bb57675017cdf7 — risk-tier: T2; basis: src/app.ts

The run above was executed at this tip by Fledge Platform Dev-4 in a detached worktree (git rev-parse HEAD = 1d7ab4e3…, HEAD^{tree} = 3b745f51…), with git status --porcelain empty before and after. The two new cases pass there by name: a revision is read under its own audience, not the current entry audience and a write aimed at a hidden entry is refused and leaves the row untouched.

Red evidence from the author's work on the same change: both new tests failed on the unbroken tip (data-memory-version-count was 2, and the hidden write redirected with saved=1); both pass at this tip.

Not run:

• Docker image build
• Live server/browser walkthrough
• Real GitHub OAuth and SMTP

Risk

T2: two route-level guards in src/app.ts, no memory-model or schema change. The POST guard reads the current entry before writeMemory; a concurrent audience change still hits the existing revision fence and cannot silently overwrite. The docs describe the revision-level audience rule in both the security and architecture pages.

[HugoXK-bot]

Verdict: PASS at 1d7ab4e
Written-by: HugoXK-bot

Rebuild of #625 at the same content change; the reviewer-authored blocker is gone, and the #625 finding does not apply to this tip.

Ran:

• npm run check — 1805/1805 tests, lint, typecheck, build: exit 0
• npx tsx --test test/projectMemory.test.ts in a worktree at base b0adcc5f with this tip's own test file — 8 pass / 2 fail; the two failures are exactly the new cases (only visible revisions are counted; the hidden write redirected saved=1 instead of refused=memory_not_found)
• node scripts/risk-gate.mjs --base b0adcc5f — risk-tier: T2; basis: src/app.ts (T1: test/projectMemory.test.ts; T0: both docs and the fragment)
• node scripts/review-gate.mjs --pr 724 — FAIL — no conclusion at 1d7ab4e3c9fcfabb2ff0a7c1ed5fd448c2f1310c; a T2 tip needs a PASS (state before this review)
• node scripts/pr-lint.mjs --pr 724 — FAIL (#724) — see finding 1
• node scripts/changelog.mjs check — changelog: 8 fragment(s) ok

Not run: Docker image, live server/browser walkthrough, real GitHub OAuth and SMTP.

Supersede check: the added/removed lines of this diff are byte-identical to #625's (108 lines across the same five files, diff of the two content-line sets is empty); only index lines and hunk headers differ, at the two hunks that were re-applied to main's text (src/app.ts imports, docs/security.md). The single commit 1d7ab4e3 is authored by HugoXK (Day Dreamer), so reviewer-authored is green.

What I verified in the code:

• src/app.ts:1943 filters the revision list through audienceVisible(row.audience, role), with role = parseRepoRole(repo.repo_role) at :1927 — the same role visibleMemories already uses at :1936. src/app.ts:1947 applies the same test to the exact-revision read and returns the identical memoryMissingPage 404, so a hidden revision is neither listed nor rendered and a URL guess gets the absent page rather than a 403.
• src/app.ts:2077-2080 loads the current row before writeMemory and refuses a hidden target with memory_not_found; src/db.ts:2962-2965 returns the same code for a missing row, so the refusal is indistinguishable from an absent entry, and it lands before the revision fence at src/db.ts:2995. A deliberately wrong expected_revision on a hidden key cannot read the revision back.
• store.writeMemory has one call site (grep: src/app.ts:2081), and memory has exactly two routes (src/app.ts:1925, :2066), so nothing else writes or reads revisions through an unfiltered path.
• Docs ownership: src/app.ts → docs/architecture.md:1926-1934; the audience rule is also carried into docs/security.md:723-731. Fragment changelog.d/610.fixed.md is one paragraph, no heading. Risk stays T2 (route-level guards, no schema change).

Findings — two items must be fixed before merge; both are in the PR body, so neither changes this tip and this PASS survives them:

1. pr-lint is red at this tip: PR body line 1 is Written-by: Fledge Platform Lead, which is not in authors in .github/agent/review-policy.json (["HugoXK","HugoXK-bot","Fledge Platform Dev-1".."Dev-4"]). Change it to Written-by: HugoXK and add Author: Fledge Platform Lead on the next line; the edit is body-only, so pr-lint re-runs green without a new commit or a new tip.

2. The PR body's Ran: block is inherited from #625: it claims npm run check — pass (1511 tests…) and Test-merged into 6a4c012b840c… tip of this branch unchanged at 872ba1c47b4e…. At this tip the suite is 1805/1805 and the tip is 1d7ab4e3; replace that block with this tip's numbers so the body does not cite another PR's evidence. Body-only.

Non-blocking note, no change requested: a create (expected_revision: "0") aimed at a hidden key is refused memory_not_found at src/app.ts:2077, while the same create on a genuinely absent key succeeds — so a guessed key name still distinguishes "exists but hidden" from "absent". The security change's own claim (a hidden target is not a revision oracle) is met; the existence difference is inherent, since an insert would collide on the unique key.