[waleedlatif1]

Summary

• Remove POST /api/workflows/[id]/log. It let whoever started a run re-complete that run with a client-supplied result: overwrite the status, output, and trace spans of an already finished log, and record client-controlled cost into the payer's usage ledger. The ledger only adds increments, so this could inflate charges and burn through the workspace's usage limit
• The route was gated by validateWorkflowAccess(..., false), which only checks read. Read-only members can run deployed workflows, so they could reach it too. Bumping it to write would still leave the cost and log forgery open to every write member, so the route goes
• Its only caller was debug mode's persistLogs, which has no UI entry point. It also sent a freshly generated execution ID, so the route answered 404 and the client swallowed the error. Nothing has been persisted through this route, so removing it changes no behaviour
• Drop the contract and schemas, the client persistLogs path (the debug handlers are now synchronous), and the deleted route's entries from the explicit-any, source-conventions, and unused-exports baselines
• No other callers in this repo (SDKs, CLI, docs, realtime, desktop) or in the copilot repo. No other route feeds request-supplied trace spans or cost into run completion. The remaining validateWorkflowAccess(..., false) callers are all read-only GETs

Type of Change

• Bug fix

Testing

• use-workflow-execution.test.tsx, middleware.test.ts (15 passing)
• bun run lint, block-registry check, generators (no drift), check:api-validation:strict, check:unused-exports, check:explicit-any, check:source-conventions, check:test-patterns, check:boundaries
• Full check:audits, type-check, and suite left to CI

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing (new tests pass the test-audit authoring gate)
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)