Upstream Mike PR #271 review

[github-actions]

Automated-Upstream-Mike-Sync: true
Upstream-Risk: high

Workspace action history is promising but requires explicit governance and security architecture decisions before implementation.

Mike PR Open-Legal-Products#271

• Outcome: needs-decision
• Capability: Workspace-wide metadata-only action history with filtering, pagination, and CSV export
• Series: workspace-audit-history
• Dependencies: ROSS security_audit_events subsystem, ROSS project ownership and shared_with access model, ROSS account export and deletion flows, ROSS authenticated backend and frontend API seams
• Prerequisites: Approve retention, deletion, privacy, and export policy, Define event taxonomy and strictly allowlisted metadata, Approve owner/shared-member visibility and tenant-boundary rules, Specify RLS, service-role access, and audit-access auditing, Provide authorization, redaction, deletion, pagination, and CSV-injection test evidence
• Reason: ROSS has suitable seams in backend/src/index.ts, authenticated route modules, securityAudit.ts, mikeApi.ts, and AppSidebar.tsx, but this capability changes schemas, RLS/access boundaries, retention, privacy, and exports. The existing security audit is metadata-only and browser-inaccessible, while ADR-009 remains Proposed; adopting upstream visibility semantics without review could expose activity across shared projects.

Architecture brief

Extend ROSS’s metadata-only audit design rather than copying Mike’s broad audit_events implementation. Use a constrained event store with validated event types, allowlisted scalar metadata, explicit retention/deletion behavior, and centralized authorization reusing project-access checks. Expose a rate-limited authenticated history API and CSV export only after visibility policy is approved; audit access to the history itself. Add the History page through the existing mikeApi.ts and AppSidebar.tsx seams.

Implementation plan

• Approve a threat model and data inventory covering titles, emails, model identifiers, shared-project events, exports, retention, deletion, and legal holds.
• Design the ROSS-native schema, constraints, indexes, RLS/service-role policy, event taxonomy, and migration/rollback plan.
• Centralize event recording and project visibility checks; instrument only approved chat, document, project, tabular, workflow, and export actions.
• Implement bounded pagination/filtering and spreadsheet-safe CSV export with rate limiting and access auditing.
• Add negative cross-user/shared-project tests, metadata redaction tests, deletion/retention tests, migration tests, and frontend API/page tests before rollout.

Required human action

This is a draft state-only architecture record. Review the brief and implementation plan before any code is attempted.