fix(guide): gate Architect + Claude tabs to BCOS_ADMIN only (#16) #17

2026-07-14T17:55:27-04:00

hiveiq commented

2026-07-14 17:55:27 -04:00

Closes #16.

What

Retag the 162 Architect + Claude docs from audience: dev to audience: bcos, and add a new platform.guide-access page documenting the access model.

Why

audience: dev resolves through isInternal() = ROLE_MSP_ADMIN || ROLE_BCOS_ADMIN, so every MSP_ADMIN could read the full body of all Architect and Claude tabs: internal architecture, source file paths, DB table names, service ports, NGINX routes.

Reproduced live on bcos.dev as msp_a@msp1.bcos.dev (role MSP_ADMIN): 81 Architect + 81 Claude tabs returned in /nav, and analytics.adoons served a 4,672-char Architect body and a 3,918-char Claude body. Bodies, not just nav entries.

Why content-only, not a code fix

Remapping the dev tier in MarkdownGuideService.visible() would also strip the 15 Internal, 35 Overview and 66 Testing docs from MSP_ADMIN, and agent.* modules would lose every tab and vanish from MSP's nav. Retagging only the two affected tab types has no such blast radius.

Testing tabs stay MSP-visible, per Johannes.

Verification

	CUSTOMER	MSP_ADMIN	BCOS_ADMIN
modules visible (before)	66	116	124
modules visible (after)	66	116	124
Architect tabs	0	81 → 0	81
Claude tabs	0	81 → 0	81
Testing tabs	0	66 (unchanged)	66

No module loses all its tabs. The 8 modules MSP cannot see (processes.*, devops.dev, devops.prod, milestone.2026-07) were already bcos-tier and are unaffected. New doc validated against the loader's own frontmatter parser.

Scope / risk

Guide is bcos.dev only; it is not routed in production. No production change, no deploy in this PR.

Follow-up (not in this PR)

The dev tier is a footgun: named for developers, gates at MSP_ADMIN. Any future doc tagged audience: dev is silently MSP-visible. Worth a rename or a startup assertion.

Closes #16. ## What Retag the **162** `Architect` + `Claude` docs from `audience: dev` to `audience: bcos`, and add a new `platform.guide-access` page documenting the access model. ## Why `audience: dev` resolves through `isInternal()` = `ROLE_MSP_ADMIN || ROLE_BCOS_ADMIN`, so **every MSP_ADMIN could read the full body** of all Architect and Claude tabs: internal architecture, source file paths, DB table names, service ports, NGINX routes. Reproduced live on bcos.dev as `msp_a@msp1.bcos.dev` (role `MSP_ADMIN`): 81 Architect + 81 Claude tabs returned in `/nav`, and `analytics.adoons` served a 4,672-char Architect body and a 3,918-char Claude body. Bodies, not just nav entries. ## Why content-only, not a code fix Remapping the `dev` tier in `MarkdownGuideService.visible()` would also strip the 15 `Internal`, 35 `Overview` and 66 `Testing` docs from MSP_ADMIN, and `agent.*` modules would lose every tab and vanish from MSP's nav. Retagging only the two affected tab types has no such blast radius. **Testing tabs stay MSP-visible**, per Johannes. ## Verification | | CUSTOMER | MSP_ADMIN | BCOS_ADMIN | |---|---|---|---| | modules visible (before) | 66 | 116 | 124 | | modules visible (after) | 66 | **116** | 124 | | Architect tabs | 0 | **81 → 0** | 81 | | Claude tabs | 0 | **81 → 0** | 81 | | Testing tabs | 0 | 66 (unchanged) | 66 | No module loses all its tabs. The 8 modules MSP cannot see (`processes.*`, `devops.dev`, `devops.prod`, `milestone.2026-07`) were already `bcos`-tier and are unaffected. New doc validated against the loader's own frontmatter parser. ## Scope / risk Guide is **bcos.dev only**; it is not routed in production. No production change, no deploy in this PR. ## Follow-up (not in this PR) The `dev` tier is a footgun: named for developers, gates at MSP_ADMIN. Any future doc tagged `audience: dev` is silently MSP-visible. Worth a rename or a startup assertion.

johannes approved these changes 2026-07-14 17:57:56 -04:00

hiveiq closed this pull request

2026-07-14 18:01:38 -04:00

hiveiq reopened this pull request

2026-07-14 18:01:38 -04:00

hiveiq added 1 commit 2026-07-14 18:25:49 -04:00

fix(guide): gate Architect + Claude tabs to BCOS_ADMIN only (#16 ) f21c783d8c

The 162 Architect/Claude docs were tagged 'audience: dev'. The 'dev' tier
resolves to isInternal() = ROLE_MSP_ADMIN || ROLE_BCOS_ADMIN, so every
MSP_ADMIN could read full internal architecture: source paths, DB tables,
service ports, NGINX routes. Verified live on bcos.dev as msp_a@msp1.bcos.dev.

Retag them to 'audience: bcos' (isBcos, BCOS_ADMIN only). Content-only change;
the 'dev' tier mapping is deliberately left alone so the 15 Internal, 35
Overview and 66 Testing docs stay MSP-visible.

Also add platform.guide-access documenting the audience tiers and the
per-role visibility matrix, so the access model is queryable from the Guide
instead of re-derived from source each time.

Verified: MSP module count unchanged (116 across 17 apps); no module loses
all its tabs. Guide is bcos.dev only, not deployed to production.

Closes #16

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

hiveiq merged commit a54c9f7885 into develop

2026-07-14 18:26:23 -04:00

Sign in to join this conversation.

2 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: hiveiq-src/hiveops-guide#17