The rdm-audit entry was an unconditional builtin: on a plain base without any rdm.inspect.* commands the workspace opened straight into a rejected receipt (400), and the page rendered the raw receipt JSON. (2026-10-12 diagnostic, increment 2.)
What
buildWorkspaceEntries(server, { rdmAudit }): the audit entry joins the list only when the command plane is ready; agents stays an unconditional builtin.
rdmAuditReady() + RDM_AUDIT_COMMANDS: gate on all seven rdm.inspect.* commands present AND enabled from GET /api/commands.
store.refreshPlugins probes commands alongside the workspace list (revocation hides the entry on next refresh).
rdmErrors.ts classifyRdmError + RdmErrorState: audit errors render as capability-missing / auth-expired / query-failed, with the raw receipt in a Collapsible.
Contract tests rewritten (audit entry hidden without capability); new plain-base e2e spec (self-skips outside E2E_PLAIN_BASE=1).
Evidence
vitest 23 files / 112 tests (incl. design-guard and the new contract matrix); tsc -b && vite build pass.
e2e (dev-repo scripts/e2e.sh): RDM combo 4 tests pass (entry visible, tabs readable) + plain-base test passes (entry hidden, zero rdm requests). Full receipts in the dev-repo task card .task/feature-rdm-audit-capability-gate.md.
Refs
2026-10-12 diagnostic report, increment 2. Dev-repo PR bumps the pin and carries the task card.
### Why
The rdm-audit entry was an unconditional builtin: on a plain base without any rdm.inspect.* commands the workspace opened straight into a rejected receipt (400), and the page rendered the raw receipt JSON. (2026-10-12 diagnostic, increment 2.)
### What
- `buildWorkspaceEntries(server, { rdmAudit })`: the audit entry joins the list only when the command plane is ready; agents stays an unconditional builtin.
- `rdmAuditReady()` + `RDM_AUDIT_COMMANDS`: gate on all seven rdm.inspect.* commands present AND enabled from `GET /api/commands`.
- `store.refreshPlugins` probes commands alongside the workspace list (revocation hides the entry on next refresh).
- `rdmErrors.ts classifyRdmError` + `RdmErrorState`: audit errors render as capability-missing / auth-expired / query-failed, with the raw receipt in a Collapsible.
- Contract tests rewritten (audit entry hidden without capability); new plain-base e2e spec (self-skips outside `E2E_PLAIN_BASE=1`).
### Evidence
- vitest 23 files / 112 tests (incl. design-guard and the new contract matrix); `tsc -b && vite build` pass.
- e2e (dev-repo scripts/e2e.sh): RDM combo 4 tests pass (entry visible, tabs readable) + plain-base test passes (entry hidden, zero rdm requests). Full receipts in the dev-repo task card `.task/feature-rdm-audit-capability-gate.md`.
### Refs
2026-10-12 diagnostic report, increment 2. Dev-repo PR bumps the pin and carries the task card.
Why: the rdm-audit entry was an unconditional builtin, so on a plain base
without any rdm.inspect.* commands the workspace opened straight into a
rejected receipt (400) - diagnosed 2026-10-12. The page also rendered raw
receipt JSON instead of a readable error.
Evidence: vitest 23 files / 112 tests pass incl. the new contract matrix
(workspaces.test.ts, rdm-errors.test.ts) and design-guard; tsc -b &&
vite build pass; e2e plain-base scenario added (driven by dev-repo
scripts/e2e.sh phase 4).
Impact: audit entry shows only when GET /api/commands lists all seven
rdm.inspect.* commands enabled (store.rdmAuditAvailable, refreshed with
the workspace list); audit errors classify into capability-missing /
auth-expired / query-failed with the raw receipt kept in a Collapsible.
Refs: 2026-10-12 diagnostic report, increment 2.
Why: the phase-3 playwright run scans the whole e2e/ directory, so the
plain-base assertions ran against the RDM combo where the audit entry is
legitimately visible and failed.
Evidence: phase-3 rerun shows 4 rdm-audit tests passing with plain-base
failing out of place; the spec now skips unless E2E_PLAIN_BASE=1, which
scripts/e2e.sh phase 4 injects.
Impact: plain-base scenario only executes against the plain base serve.
Refs: 2026-10-12 diagnostic report, increment 2.
Why: phase 4 runs after the RDM phase already forced the password change,
so the initial-password attempt 401s and the sidebar never renders.
Evidence: phase-4 failure log shows the login form still up at the
15s .tsb-tool timeout; rdm-audit spec already carries this branch.
Impact: plain-base login helper mirrors rdm-audit's gate-aware login.
Refs: 2026-10-12 diagnostic report, increment 2.
Why: BuildWorkspaceOptions / RdmErrorKind / RdmErrorView are only consumed
inside their own modules, so exporting them pushed unused exports 45 over
the knip baseline 43 and failed make test.
Evidence: npx vitest run 23 files / 112 tests pass; node scripts/check-knip.mjs
passes at 42 <= 43.
Impact: no API change - consumers pass object literals and consume the
classified error structurally.
Refs: 2026-10-12 diagnostic report, increment 2.
Why: dev-repo main advanced the frontend pin to d01a3eb (admin-zone
section hosting), diverging from the gating branch; the task-sync gitlink
conflict requires the component-level merge first.
Evidence: post-merge vitest 23 files / 112 tests, knip 42 <= 43, and
tsc -b && vite build all pass; store.ts conflict resolved by keeping both
rdmAuditAvailable and adminSections state.
Impact: gating branch now contains frontend main d01a3eb.
Refs: 2026-10-12 diagnostic report, increment 2; frontend #63/#64.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Why
The rdm-audit entry was an unconditional builtin: on a plain base without any rdm.inspect.* commands the workspace opened straight into a rejected receipt (400), and the page rendered the raw receipt JSON. (2026-10-12 diagnostic, increment 2.)
What
buildWorkspaceEntries(server, { rdmAudit }): the audit entry joins the list only when the command plane is ready; agents stays an unconditional builtin.rdmAuditReady()+RDM_AUDIT_COMMANDS: gate on all seven rdm.inspect.* commands present AND enabled fromGET /api/commands.store.refreshPluginsprobes commands alongside the workspace list (revocation hides the entry on next refresh).rdmErrors.ts classifyRdmError+RdmErrorState: audit errors render as capability-missing / auth-expired / query-failed, with the raw receipt in a Collapsible.E2E_PLAIN_BASE=1).Evidence
tsc -b && vite buildpass..task/feature-rdm-audit-capability-gate.md.Refs
2026-10-12 diagnostic report, increment 2. Dev-repo PR bumps the pin and carries the task card.