GOV-ONT-002 — Retire deprecated direct-main mutation routes
| Field | Value |
|---|---|
| Status | Open deprecated-path finding; source-verified |
| Severity | High |
| Components | sparqd/ontology, sparqd/bff-api |
| Associated issues | sparqd/ontology-backend#14 |
Concrete observed case
Oqullus treats main as read-only and writes only to a working branch. BFF still
proxies POST /ontology/v1/objects and DELETE /ontology/v1/objects/{id},
while ontology-backend accepts those operations for any authenticated caller.
Backend integration tests use the route to seed and modify main directly.
The direct write commits ontology_objects first and snapshots main revision
history in a second transaction. A failure between those commits leaves current
main state ahead of the main revision and object-version history.
Expected condition
All user-authored main changes come from an approved proposal and one atomic merge transaction. Bootstrap or import uses a separately named, privileged, audited operation with the same validation and version guarantees.
Why it matters
An API caller can bypass review even though the UI communicates that main is protected. Split commits can also make history and conflict bases disagree with the published projection.
Existing controls and workarounds
The normal Oqullus path does not call direct-main mutations. Authentication is required. Neither is an authorization or atomicity control for API callers.
Alternatives considered
- Recommended: remove the BFF and backend mutation routes after replacing test and bootstrap seeding.
- Retain a privileged import endpoint with explicit scope, audit, validation, idempotency, and one projection-plus-revision transaction.
- Rely on the UI hiding the path — rejected because the API remains callable.
Component involvement
- Ontology backend removes or restricts the mutation contract and preserves an atomic publication boundary.
- BFF removes the public proxy at the same compatibility milestone.
- Test fixtures stop depending on a production governance bypass.
Reproduction and verification
Follow ONT-S004.
Resolution conditions
Close when ordinary identities cannot mutate main except through approved merge, no public BFF route exposes the deprecated contract, bootstrap has an explicit replacement, and all successful publication updates projection and version history atomically.
Validation and blockers
Source and test dependence are confirmed. Consumers outside Oqullus must be inventoried before route removal.