Document stats
The vault portal shows how many documents it holds, in two views — by
document, each with its compartment set, and by compartment, each with
its document count and, on demand, the document list itself. The
surface is metadata only: document names, compartment names, and
counts, never content. An administrator sees the whole vault, even
though the truth table gives them no compartment grants of their own;
anyone else sees only what their own compartments cover, and asking
about a compartment outside that reach looks exactly like asking about
one that was never created — the vault gives no hint either way. Every
stats request leaves its own entry in the audit trail.
A compartment outside a member's reach reveals nothingstack
- Given a running vault with a member and a compartment they cannot reach
- When the member asks for that compartment's documents
- Then the vault refuses with no hint whether the compartment exists
Asking about a compartment that was never created looks the samestack
- Given a running vault with a signed-in member
- When the member asks for a compartment id that was never created
- Then the vault refuses with no hint whether the compartment exists
A member's document count is bounded to their own reachstack
- Given a running vault with a member holding one compartment and a document outside it
- When the member asks the vault how many documents exist
- Then the vault lists only the documents within the member's reach
The administrator sees the whole vault despite holding no compartment of their ownstack
- Given a running vault with an administrator and documents in two different compartments
- When the administrator asks the vault how many documents exist
- Then the vault reports every document in the vault
Every stats request leaves an audit trailstack
- Given a running vault with a signed-in administrator
- When the administrator asks the vault how many documents exist
- Then the stats access is recorded in the vault's audit trail