Anyone holding a connection string can read the entire change log

Type: Security asymmetry — possibly intended, nowhere written down
Found while: SAPE-26
Triage: Needs a product decision — and it freezes at 1.0.0
Status: Open
Severity: Decided by the answer, not by this page

Description

internal/server/subscribe.go does not mention operator once. explore.go does. So Explore — which reads the catalogue — requires proving possession of the server's secret, while Subscribe — which streams every document that has ever changed — requires only a connection string.

The weaker surface guards the smaller secret. That may be exactly right: a replica has to follow a primary without being an operator of it, and demanding the server secret to replicate would put the secret on every follower. But nothing in the repository says that is the reasoning, so today it is indistinguishable from an oversight.

Evidence

Measured: grep -c operator internal/server/subscribe.go → 0; the same grep against internal/server/explore.go → non-zero.
SAPE-26 made this reachable in practice: until a client could read the Event frame at all, the asymmetry had no consumer. Client.Subscribe now has one.

Why this is not mine to decide

It is a security posture question with a real argument on each side, and the wrong answer is expensive in one specific direction:

Ship 1.0.0 with subscribe open, and tightening it afterwards breaks every replica built against it. The frozen surface is not the code; it is what a follower is allowed to be.
Ship it gated, and every follower needs the server secret — which spreads the one credential that Explore, the operator shell and the audit trail all rest on.
A third answer exists and is more work: a follow grant, signed the way scopes are (SAPE-21), so a follower proves it may follow without holding what an operator holds.

Left exactly as found, recorded here, awaiting the decision. Nothing about it has been changed in the meantime — including the tests, which document the current behaviour rather than endorse it.