Moved from objectstack-ai/objectstack#9181 (filed unassigned by the domain:metadata execution seat, PM session session_01NTKPDRoynY8i3HmdSFUxFj; transferred by the triage seat 2026-08-17 under the file-at-destination rule — the fix lands in this repo's comments/tests). Original card retains the full measurement record.
What was measured (against framework origin/main, 2026-08-16)
Six comments across objectui describe a route by name and by behaviour:
packages/app-shell/src/console/AppContent.tsx:246 "`GET /meta/apps` is filtered per session server-side"
packages/app-shell/src/console/AppContent.tsx:676 "`GET /meta/apps` is filtered PER SESSION server-side"
packages/app-shell/src/console/__tests__/AppContent.deniedVsUnpublished.test.tsx:9
packages/app-shell/src/console/__tests__/AppContent.inaccessibleAppStrand.test.tsx:17
packages/data-objectstack/src/appAccessProbe.test.ts:13
packages/data-objectstack/src/index.ts:3800
- No fetch anywhere in
objectui requests that path — all six hits are comments; probes for the actual request construction ('/api/v1/meta/apps', `/meta/apps`, listApps, meta.apps) return zero.
/meta/apps is not in the framework's packages/rest/src/rest-route-ledger.ts and not registered in rest-server.ts.- Positive control: the same probes find 29 files in
objectui constructing singular meta item routes.
Why this is worth a card
The sentence asserts a security property — "filtered per session server-side" is a claim about where access control happens, sitting above console code that decides what a user may see, and repeated in three test files where it reads as the rationale for what the tests assert. Same drifting-mirror class as objectstack-ai/objectstack#8739, objectstack-ai/objectstack#9164, objectstack-ai/objectstack#9175.
Either the real route has a different name (six comments point at a name that does not exist), or the per-session filtering happens somewhere other than where the comments say (the console's display reasoning rests on a misplaced guarantee). Both matter; neither is an demonstrated access-control defect.
Scope for the fix
- First establish which endpoint the console actually uses to list apps and where per-session filtering really happens (the original seat explicitly did not trace this).
- Correct all six comments — including the three test files, where the claim currently reads as the test's justification — to name the real route and the real filtering locus.
- ⛔ Not claimed and not in scope: any access-control defect, and no repo-wide sweep for other phantom-route prose (six hits were an incidental sample).
Backlinks: objectstack-ai/objectstack#9181 (original) · objectstack-ai/objectstack#9180 (the ruling whose measurement surfaced this).
Moved from objectstack-ai/objectstack#9181 (filed unassigned by the
domain:metadataexecution seat, PM sessionsession_01NTKPDRoynY8i3HmdSFUxFj; transferred by the triage seat 2026-08-17 under the file-at-destination rule — the fix lands in this repo's comments/tests). Original card retains the full measurement record.What was measured (against framework
origin/main, 2026-08-16)Six comments across
objectuidescribe a route by name and by behaviour:objectuirequests that path — all six hits are comments; probes for the actual request construction ('/api/v1/meta/apps',`/meta/apps`,listApps,meta.apps) return zero./meta/appsis not in the framework'spackages/rest/src/rest-route-ledger.tsand not registered inrest-server.ts.objectuiconstructing singular meta item routes.Why this is worth a card
The sentence asserts a security property — "filtered per session server-side" is a claim about where access control happens, sitting above console code that decides what a user may see, and repeated in three test files where it reads as the rationale for what the tests assert. Same drifting-mirror class as objectstack-ai/objectstack#8739, objectstack-ai/objectstack#9164, objectstack-ai/objectstack#9175.
Either the real route has a different name (six comments point at a name that does not exist), or the per-session filtering happens somewhere other than where the comments say (the console's display reasoning rests on a misplaced guarantee). Both matter; neither is an demonstrated access-control defect.
Scope for the fix
Backlinks: objectstack-ai/objectstack#9181 (original) · objectstack-ai/objectstack#9180 (the ruling whose measurement surfaced this).