[Epic 953][Stage I][chat-api] Retain owner-only views and block stateful writes

[think-in-universe]

Parent epic: nearai/cloud-api#953
Parent stage: nearai/cloud-api#954
Target date: Sep 1

Goal

Make the chat-api boundary read-only for the temporary Private Chat migration/export window. No normal request may create or mutate confidential Conversation, File, sharing, or response-history state through chat-api.

This boundary excludes the existing account-deletion flow in #380: DELETE /v1/users/me and its established asynchronous worker remain operational. That worker uses Cloud #943's retained Conversation/File resource DELETE compatibility exception; ordinary browser-facing Conversation/File proxy DELETE routes remain disabled below.

Stage I retained views

Only the following existing, owner-scoped views remain available temporarily. Every one is session-authenticated and sends Cache-Control: no-store:

• GET /v1/conversations
• GET /v1/conversations/{conversation_id}
• GET /v1/conversations/{conversation_id}/items
• GET /v1/files
• GET /v1/files/{file_id}
• GET /v1/files/{file_id}/content

These are the existing owner views used by the Private Chat migration/export workflow. They are not a new chat-api export API. In particular, chat-api does not add a public POST /v1/conversations/batch or a new Cloud Conversation-list API; its existing owner-scoped Conversation list may use Cloud's retained batch view internally.

Closed sharing surface

Sharing is not needed for export. The whole sharing surface is session-authenticated 410 Gone with Cache-Control: no-store, including reads:

• GET and all other methods on /v1/conversations/{conversation_id}/shares and its descendants;
• GET and all other methods on /v1/share-groups and its descendants; and
• GET and all other methods on /v1/shared-with-me and its descendants.

The former optional-auth/public shared-Conversation reads are also outside the Stage I contract.

Write contract

Known Conversation, File, copy/clone, pin, archive, item-creation, and other legacy mutation paths return the authenticated migration response: 410 Gone with Cache-Control: no-store. They must not forward a mutation to Cloud or write local Private Chat state.

The only exception is the existing DELETE /v1/users/me account-deletion workflow in #380. It is not a retained Conversation/File proxy route: it enqueues the existing worker, which uses Cloud #943's two retained workspace-scoped resource DELETE calls before local finalization.

The component action issues split the work:

• [Epic 953][Stage I][chat-api] Make the Responses proxy stateless #386: stateless Responses proxy.
• [Epic 953][Stage I][chat-api] Retain owner-only Conversation views and block writes #387: owner-only Conversation views and Conversation write blocking.
• [Epic 953][Stage I][chat-api] Retain File views and block writes #388: owner-only File views and File write blocking.
• [Epic 953][Stage I][chat-api] Close sharing routes and other Conversation mutations #389: all sharing routes plus other conversation-related write blocking.
• [Epic 953][Stage I][chat-api] Preserve account deletion across Cloud migration #380: account-deletion compatibility with Cloud's retained resource DELETE endpoints.

Responses

POST /v1/responses remains a stateless/no-store proxy. It does not create response history, inject author metadata, force store: true, or track a Conversation locally. For client-managed custom function calls and matching function_call_output replay, Chat does not create a replacement transcript shape, reorder the supplied tool/input items, or execute tools; it forwards the normalized request to Cloud.

Cloud owns public Responses tool-schema validation. Unsupported Responses built-in or remote-MCP tool/input shapes receive Cloud's normal 400; this is distinct from the separate root POST /mcp proxy, which remains outside the Responses path.

Out of scope

• A new export endpoint, Cloud Conversation-list endpoint, schema/table migration, retention purge, or historical-data cleanup.
• Removing the temporary owner views, their service/repository wiring, or the Private Chat frontend. Those are Stage III work under [Epic 953][Stage III][chat-api] Remove stateful proxy surfaces and runtime wiring #377 after the export window.
• Changing or retiring the established account-deletion lifecycle. Any such change requires separate approval.

Acceptance criteria

• Every retained view above remains owner-scoped, session-authenticated, and no-store.
• Sharing endpoints, including their GET methods, and all ordinary legacy write paths are 410/no-store.
• DELETE /v1/users/me and its established worker remain functional through Cloud's retained resource DELETE routes.
• OpenAPI/docs advertise only the temporary owner views and omit disabled paths.
• Stateless Responses behavior and existing proxy concerns such as usage, subscription, rate limits, model settings, and attestation passthrough remain covered.

[hanakannzashi]

@ironloopai help

[ironloopai]

⌨️ IronLoop command · Help

Available in this issue.

Command	Result
@ironloopai help	Show this command guide.
@ironloopai implement	Implement the issue and open a draft pull request.
@ironloopai list	Show recent Runs for this issue.

Example with instructions

@ironloopai implement

Keep the public API unchanged.

[hanakannzashi]

Stage I clarification — owner-only views

The retained export surface is now deliberately narrower: only the authenticated owner Conversation and File views listed in this issue remain temporarily available with Cache-Control: no-store.

Sharing is not needed for export. Every sharing namespace route, including GET /v1/conversations/{conversation_id}/shares, GET /v1/share-groups, and GET /v1/shared-with-me, is session-authenticated 410 Gone/no-store; optional-auth/public shared Conversation reads are closed as well.

Responses remains a stateless proxy with unchanged client-managed function replay, while Cloud owns built-in/MCP tool validation. Final removal of the retained owner views and their wiring remains Stage III work under #377.