|
|
|
@@ -0,0 +1,153 @@
|
|
|
|
|
# Operation acceptance matrix — upstream 58e2204
|
|
|
|
|
|
|
|
|
|
> Generated from the structured ledger. Registry is the sole source for risk, confirmation, capability, and dedicated-flow facts; orchestration is bound by acceptance policy. `registeredOperation` is not a synonym for preparation Job.
|
|
|
|
|
|
|
|
|
|
REAL_READ means captured evidence and is restricted to `captured-readonly`. REAL_READ_DEFERRED marks denied candidates without a real fixture. Fixture disposition is metadata-only: runtime status, count, safe observed status categories, and reason; it never renders fixture body/response, alias, identity, or URL.
|
|
|
|
|
|
|
|
|
|
## Control-plane acceptance (independent flows)
|
|
|
|
|
|
|
|
|
|
| flowId | route | risk / subtype | confirmation | preconditions | result | failure recovery | secret policy | evidence |
|
|
|
|
|
|---|---|---|---|---|---|---|---|---|
|
|
|
|
|
| `instance-create` | `/instances/new` | R1 / configuration | diff-confirm | canonical origin and unique stable ID | created instance revision and audit | retain draft on validation or reconcile failure | secret reference only; never return a value | WF-01 + product policy |
|
|
|
|
|
| `instance-update` | `/settings/instances/:id` | R1 / configuration | revision-diff | current revision | updated revision and audit | 409 refreshes diff without losing edits | preserve/set/clear explicit; never return a value | WF-01 + product policy |
|
|
|
|
|
| `instance-delete` | `/settings/instances/:id` | R3 / destructive | strong target restatement | fresh revision and no conflicting job | new jobId with two-phase deleting to tombstone result | before boundary restore; after boundary manual recovery | destroy reference without reading secret value | WF-13 |
|
|
|
|
|
| `secret-set` | `/settings/instances/:id` | R1 / secret-reference | explicit set | authorized SecretStore write | new reference metadata and audit | atomic rollback on reference write failure | never return or log secret value | WF-01 |
|
|
|
|
|
| `secret-preserve` | `/settings/instances/:id` | R1 / secret-reference | explicit preserve | existing reference metadata | unchanged reference metadata and audit | revision conflict refreshes metadata only | never read or return secret value | WF-01 |
|
|
|
|
|
| `secret-clear` | `/settings/instances/:id` | R1 / secret-reference | explicit clear | fresh revision | reference removed and audit | atomic rollback or explicit recovery state | never return destroyed secret value | WF-01 |
|
|
|
|
|
| `config-import-preview` | `/settings/instances` | R0 / preview | none | validated upload and canonical origins | redacted diff/conflict/count preview | fix file and regenerate preview | never include secret values in preview | IA settings import |
|
|
|
|
|
| `config-import-confirm` | `/settings/instances` | R2 / bulk-configuration | explicit preview token | fresh unexpired preview | new jobId with per-instance items | retry failed items in new lineage | references only; never import/export secret values | IA settings import |
|
|
|
|
|
| `credential-verify` | `/instances/new` | R1 / session-sensitive | actor initiated | rate limit and registered target | credential metadata-only result | no automatic replay; actor may retry after backoff | ephemeral input, never response/audit value | WF-01 |
|
|
|
|
|
| `saved-secret-login` | `/instances/new` | R1 / session-sensitive | actor initiated | saved reference and rate limit | session metadata-only result | no automatic replay; return to login flow | resolve server-side; never expose value | WF-12 |
|
|
|
|
|
| `temporary-secret-login` | `/instances/new` | R1 / session-sensitive | actor initiated | one-shot input and rate limit | session metadata-only result | no automatic replay; require new actor input | memory-only and never saved or returned | WF-12 |
|
|
|
|
|
| `logout` | `/settings/instances/:id` | R1 / session-sensitive | actor initiated | active session | session cleared and metadata audit | no replay; reconcile auth status | no credential value involved | WF-12 |
|
|
|
|
|
| `401-recovery` | `/instances/:id/overview` | R1 / session-recovery | actor chooses login | 401 evidence and retained stale data | return to owner; retry R0 only | never replay writes; preserve draft for new prepare | temporary/saved secret follows selected login policy | WF-12 |
|
|
|
|
|
| `auth-setup` | `/instances/new` | R3 / authentication-change | strong confirmation | fresh dedicated auth preflight | new jobId and metadata-only audit | new lineage after state verification | password never returned or audited | Registry postAuthSetup |
|
|
|
|
|
| `auth-password-change` | `/settings/instances/:id` | R3 / authentication-change | strong confirmation | fresh dedicated auth preflight | new jobId and metadata-only audit | new lineage after auth-status verification | old/new password never returned or audited | Registry postAuthPassword |
|
|
|
|
|
| `auth-settings-read` | `/settings/instances/:id` | R0 / authentication-read | none | registered instance and actor | structured auth settings | safe actor retry | no password/cookie/token fields | Registry getAuthSettings |
|
|
|
|
|
| `auth-settings-write` | `/settings/instances/:id` | R2 / authentication-change | explicit confirmation | fresh dedicated auth preflight | new jobId and metadata-only audit | new lineage; no replay | never return credential values | Registry postAuthSettings |
|
|
|
|
|
| `job-cancel` | `/jobs/:jobId` | R1 / job-control | explicit confirmation | cancelable current phase | immutable cancellation event | show non-cancelable boundary and reconcile | no secret data in event | IA jobs |
|
|
|
|
|
| `job-retry` | `/jobs/:jobId` | R2 / job-control | explicit failed-item selection | source terminal state and fresh preflight | new jobId with retryOf/root/source lineage | never mutate source or replay successful items | redacted parameter summary only | WF-10 |
|
|
|
|
|
| `audit-export` | `/audit` | R0 / data-export | explicit scope | authorized filters | redacted export artifact | regenerate from immutable audit | redaction applies; no sensitiveFields | WF-11 |
|
|
|
|
|
| `system-settings-update` | `/settings/system` | R1 / configuration | revision-diff | safe bounds and current revision | updated revision and audit | 409 refreshes diff; invalid bounds rejected | no secrets accepted | IA settings system |
|
|
|
|
|
|
|
|
|
|
## Upstream operation acceptance (exact 117)
|
|
|
|
|
|
|
|
|
|
| operationId | method/path | domain | route/surface | UI | availability/version evidence | scenario applicability | risk/confirmation/execution | policy IDs and resolved policies | real class | fixture disposition (metadata-only: runtime status / n / categories / reason) | evidence |
|
|
|
|
|
|---|---|---|---|---|---|---|---|---|---|---|---|
|
|
|
|
|
| `getDevice` | GET `/api/device` | device-system | `/instances/:id/overview`<br>`overview/device` | detail | planned: Frozen-scope read has two redacted captured responses; runtime support is still decided per registered instance.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Detail resource has no collection-empty rendering.)<br>partial:N (Atomic detail read has no meaningful partial rendering.)<br>policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)<br>unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)<br>owner-switch:Y (Owner switch discards responses with a mismatched instance key.) | R0; none<br>direct | query-capability/read-retain/version-probe/safe-read/route-result<br>Registered instance, authorized actor, and runtime capability decision are required.<br>Retain last success as stale and permit an explicit safe refresh.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Safe reads may retry within deadline and retain stale success.<br>Structured result returns to the owning route with a redacted audit link. | REAL_READ | captured-readonly; n=2; categories=success; collector-selected fully-bound GET R0; two redacted real captures | `registry:getDevice`<br>`upstream:backend/src/main.rs:506-506`<br>`upstream:backend/src/handlers.rs:1076-1090`<br>`upstream:bruno-api/get_device_info.bru:8`<br>`fixture:captured-readonly` |
|
|
|
|
|
| `getSim` | GET `/api/sim` | sim | `/instances/:id/overview`<br>`overview/sim` | detail | planned: Frozen-scope read has two redacted captured responses; runtime support is still decided per registered instance.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Detail resource has no collection-empty rendering.)<br>partial:N (Atomic detail read has no meaningful partial rendering.)<br>policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)<br>unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)<br>owner-switch:Y (Owner switch discards responses with a mismatched instance key.) | R0; none<br>direct | query-capability/read-retain/version-probe/safe-read/route-result<br>Registered instance, authorized actor, and runtime capability decision are required.<br>Retain last success as stale and permit an explicit safe refresh.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Safe reads may retry within deadline and retain stale success.<br>Structured result returns to the owning route with a redacted audit link. | REAL_READ | captured-readonly; n=2; categories=success; collector-selected fully-bound GET R0; two redacted real captures | `registry:getSim`<br>`upstream:backend/src/main.rs:508-508`<br>`upstream:backend/src/handlers.rs:1126-1145`<br>`upstream:bruno-api/get_sim_info.bru:8`<br>`fixture:captured-readonly` |
|
|
|
|
|
| `postSimDetailsRefresh` | POST `/api/sim/details/refresh` | sim | `/instances/:id/overview`<br>`overview/sim` | action | planned: Frozen-scope reversible command is contract-planned for a later controlled real-write acceptance phase.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)<br>partial:N (Single-target command has no meaningful partial result.)<br>policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)<br>unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)<br>owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R1; none<br>direct | command-current-state/write-revision/version-probe/verify-write/route-result<br>Refresh current state when available and bind the actor decision to its revision.<br>Refresh current state or require an explicit recorded revision-bound override.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Writes require outcome verification before actor-initiated retry.<br>Structured result returns to the owning route with a redacted audit link. | REAL_WRITE_LATER | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:postSimDetailsRefresh`<br>`upstream:backend/src/main.rs:510-511`<br>`upstream:backend/src/handlers.rs:1148-1164`<br>`fixture:not-eligible-readonly-capture` |
|
|
|
|
|
| `postSimCache` | POST `/api/sim/cache` | sim | `/instances/:id/overview`<br>`overview/sim` | form | planned: Frozen-scope reversible command is contract-planned for a later controlled real-write acceptance phase.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)<br>partial:N (Single-target command has no meaningful partial result.)<br>policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)<br>unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)<br>owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R1; none<br>direct | command-current-state/write-revision/version-probe/verify-write/route-result<br>Refresh current state when available and bind the actor decision to its revision.<br>Refresh current state or require an explicit recorded revision-bound override.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Writes require outcome verification before actor-initiated retry.<br>Structured result returns to the owning route with a redacted audit link. | REAL_WRITE_LATER | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:postSimCache`<br>`upstream:backend/src/main.rs:514-515`<br>`upstream:backend/src/handlers.rs:1167-1213`<br>`fixture:not-eligible-readonly-capture` |
|
|
|
|
|
| `getNetwork` | GET `/api/network` | cellular | `/instances/:id/cellular`<br>`cellular/serving-network` | detail | planned: Frozen-scope read has two redacted captured responses; runtime support is still decided per registered instance.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Detail resource has no collection-empty rendering.)<br>partial:N (Atomic detail read has no meaningful partial rendering.)<br>policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)<br>unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)<br>owner-switch:Y (Owner switch discards responses with a mismatched instance key.) | R0; none<br>direct | query-capability/read-retain/version-probe/safe-read/route-result<br>Registered instance, authorized actor, and runtime capability decision are required.<br>Retain last success as stale and permit an explicit safe refresh.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Safe reads may retry within deadline and retain stale success.<br>Structured result returns to the owning route with a redacted audit link. | REAL_READ | captured-readonly; n=2; categories=success; collector-selected fully-bound GET R0; two redacted real captures | `registry:getNetwork`<br>`upstream:backend/src/main.rs:519-520`<br>`upstream:backend/src/handlers.rs:1218-1232`<br>`upstream:bruno-api/get_network_info.bru:8`<br>`fixture:captured-readonly` |
|
|
|
|
|
| `getCells` | GET `/api/cells` | cellular | `/instances/:id/cellular`<br>`cellular/cells` | table | planned: Frozen-scope read has two redacted captured responses; runtime support is still decided per registered instance.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:Y (Successful collection may contain no rows.)<br>partial:Y (Independent response sections may succeed or fail.)<br>policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)<br>unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)<br>owner-switch:Y (Owner switch discards responses with a mismatched instance key.) | R0; none<br>direct | query-capability/read-retain/version-probe/safe-read/route-result<br>Registered instance, authorized actor, and runtime capability decision are required.<br>Retain last success as stale and permit an explicit safe refresh.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Safe reads may retry within deadline and retain stale success.<br>Structured result returns to the owning route with a redacted audit link. | REAL_READ | captured-readonly; n=2; categories=success; collector-selected fully-bound GET R0; two redacted real captures | `registry:getCells`<br>`upstream:backend/src/main.rs:522-522`<br>`upstream:backend/src/handlers.rs:1235-1249`<br>`upstream:bruno-api/get_cells_info.bru:8`<br>`fixture:captured-readonly` |
|
|
|
|
|
| `postCellMonitorStart` | POST `/api/cell-monitor/start` | cellular | `/instances/:id/cellular`<br>`cellular/cells` | action | planned: Frozen-scope reversible command is contract-planned for a later controlled real-write acceptance phase.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)<br>partial:N (Single-target command has no meaningful partial result.)<br>policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)<br>unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)<br>owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R1; none<br>direct | command-current-state/write-revision/version-probe/verify-write/route-result<br>Refresh current state when available and bind the actor decision to its revision.<br>Refresh current state or require an explicit recorded revision-bound override.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Writes require outcome verification before actor-initiated retry.<br>Structured result returns to the owning route with a redacted audit link. | REAL_WRITE_LATER | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:postCellMonitorStart`<br>`upstream:backend/src/main.rs:524-525`<br>`upstream:backend/src/handlers.rs:1252-1282`<br>`fixture:not-eligible-readonly-capture` |
|
|
|
|
|
| `postCellMonitorStop` | POST `/api/cell-monitor/stop` | cellular | `/instances/:id/cellular`<br>`cellular/cells` | action | planned: Frozen-scope reversible command is contract-planned for a later controlled real-write acceptance phase.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)<br>partial:N (Single-target command has no meaningful partial result.)<br>policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)<br>unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)<br>owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R1; none<br>direct | command-current-state/write-revision/version-probe/verify-write/route-result<br>Refresh current state when available and bind the actor decision to its revision.<br>Refresh current state or require an explicit recorded revision-bound override.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Writes require outcome verification before actor-initiated retry.<br>Structured result returns to the owning route with a redacted audit link. | REAL_WRITE_LATER | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:postCellMonitorStop`<br>`upstream:backend/src/main.rs:528-529`<br>`upstream:backend/src/handlers.rs:1285-1312`<br>`fixture:not-eligible-readonly-capture` |
|
|
|
|
|
| `getRadioMode` | GET `/api/radio-mode` | radio-lock | `/instances/:id/cellular`<br>`cellular/radio-locks` | read-panel | planned: Frozen-scope read has two redacted captured responses; runtime support is still decided per registered instance.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Detail resource has no collection-empty rendering.)<br>partial:N (Atomic detail read has no meaningful partial rendering.)<br>policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)<br>unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)<br>owner-switch:Y (Owner switch discards responses with a mismatched instance key.) | R0; none<br>direct | query-capability/read-retain/version-probe/safe-read/route-result<br>Registered instance, authorized actor, and runtime capability decision are required.<br>Retain last success as stale and permit an explicit safe refresh.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Safe reads may retry within deadline and retain stale success.<br>Structured result returns to the owning route with a redacted audit link. | REAL_READ | captured-readonly; n=2; categories=success; collector-selected fully-bound GET R0; two redacted real captures | `registry:getRadioMode`<br>`upstream:backend/src/main.rs:532-533`<br>`upstream:backend/src/handlers.rs:1315-1329`<br>`upstream:bruno-api/get_radio_mode.bru:8`<br>`fixture:captured-readonly` |
|
|
|
|
|
| `postRadioMode` | POST `/api/radio-mode` | radio-lock | `/instances/:id/cellular`<br>`cellular/radio-locks` | form | planned: Frozen-scope reversible command is contract-planned for a later controlled real-write acceptance phase.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)<br>partial:N (Single-target command has no meaningful partial result.)<br>policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)<br>unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)<br>owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R1; none<br>direct | command-current-state/write-revision/version-probe/verify-write/route-result<br>Refresh current state when available and bind the actor decision to its revision.<br>Refresh current state or require an explicit recorded revision-bound override.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Writes require outcome verification before actor-initiated retry.<br>Structured result returns to the owning route with a redacted audit link. | REAL_WRITE_LATER | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:postRadioMode`<br>`upstream:backend/src/main.rs:532-534`<br>`upstream:backend/src/handlers.rs:1332-1352`<br>`upstream:bruno-api/set_radio_mode_nr.bru:8`<br>`upstream:bruno-api/set_radio_mode_lte.bru:8`<br>`upstream:bruno-api/set_radio_mode_auto.bru:8`<br>`fixture:not-eligible-readonly-capture` |
|
|
|
|
|
| `getBandLock` | GET `/api/band-lock` | radio-lock | `/instances/:id/cellular`<br>`cellular/radio-locks` | read-panel | planned: Frozen-scope read has two redacted captured responses; runtime support is still decided per registered instance.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Detail resource has no collection-empty rendering.)<br>partial:N (Atomic detail read has no meaningful partial rendering.)<br>policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)<br>unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)<br>owner-switch:Y (Owner switch discards responses with a mismatched instance key.) | R0; none<br>direct | query-capability/read-retain/version-probe/safe-read/route-result<br>Registered instance, authorized actor, and runtime capability decision are required.<br>Retain last success as stale and permit an explicit safe refresh.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Safe reads may retry within deadline and retain stale success.<br>Structured result returns to the owning route with a redacted audit link. | REAL_READ | captured-readonly; n=2; categories=success; collector-selected fully-bound GET R0; two redacted real captures | `registry:getBandLock`<br>`upstream:backend/src/main.rs:538-539`<br>`upstream:backend/src/handlers.rs:1355-1369`<br>`upstream:bruno-api/get_band_lock.bru:8`<br>`fixture:captured-readonly` |
|
|
|
|
|
| `postBandLock` | POST `/api/band-lock` | radio-lock | `/instances/:id/cellular`<br>`cellular/radio-locks` | job-action | planned: Frozen-scope high-risk operation is planned with simulation-only acceptance until controlled safety authorization exists.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)<br>partial:N (Single-target command has no meaningful partial result.)<br>policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)<br>unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)<br>owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R2; explicit<br>preparation-job | job-fresh-preflight/high-risk-block/version-probe/new-job-lineage/job-result<br>Required fresh preflight; inability to refresh blocks execution.<br>Fresh preflight is mandatory; stale, expired, or unknown state blocks execution.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Retry creates a new Job lineage (retryOfJobId/rootJobId); never replay successful items.<br>/jobs/:jobId contains per-item result, attempt lineage, and redacted audit. | SIMULATED_HIGH_RISK | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:postBandLock`<br>`upstream:backend/src/main.rs:538-540`<br>`upstream:backend/src/handlers.rs:1372-1392`<br>`upstream:bruno-api/set_band_lock_nr_n78.bru:8`<br>`upstream:bruno-api/set_band_lock_lte_b1_b3.bru:8`<br>`upstream:bruno-api/unlock_all_bands.bru:8`<br>`upstream:bruno-api/set_band_lock_lte_nr_mix.bru:8`<br>`fixture:not-eligible-readonly-capture` |
|
|
|
|
|
| `getNetworkInterfaces` | GET `/api/network/interfaces` | device-network | `/instances/:id/device-network`<br>`device-network/interfaces` | table | planned: Frozen-scope read has two redacted captured responses; runtime support is still decided per registered instance.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:Y (Successful collection may contain no rows.)<br>partial:Y (Independent response sections may succeed or fail.)<br>policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)<br>unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)<br>owner-switch:Y (Owner switch discards responses with a mismatched instance key.) | R0; none<br>direct | query-capability/read-retain/version-probe/safe-read/route-result<br>Registered instance, authorized actor, and runtime capability decision are required.<br>Retain last success as stale and permit an explicit safe refresh.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Safe reads may retry within deadline and retain stale success.<br>Structured result returns to the owning route with a redacted audit link. | REAL_READ | captured-readonly; n=2; categories=success; collector-selected fully-bound GET R0; two redacted real captures | `registry:getNetworkInterfaces`<br>`upstream:backend/src/main.rs:544-545`<br>`upstream:backend/src/handlers.rs:1619-1644`<br>`upstream:bruno-api/get_network_interfaces.bru:8`<br>`fixture:captured-readonly` |
|
|
|
|
|
| `getNetworkConnectionAddresses` | GET `/api/network/connection-addresses` | device-network | `/instances/:id/device-network`<br>`device-network/interfaces` | read-panel | planned: Frozen-scope read has two redacted captured responses; runtime support is still decided per registered instance.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Detail resource has no collection-empty rendering.)<br>partial:N (Atomic detail read has no meaningful partial rendering.)<br>policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)<br>unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)<br>owner-switch:Y (Owner switch discards responses with a mismatched instance key.) | R0; none<br>direct | query-capability/read-retain/version-probe/safe-read/route-result<br>Registered instance, authorized actor, and runtime capability decision are required.<br>Retain last success as stale and permit an explicit safe refresh.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Safe reads may retry within deadline and retain stale success.<br>Structured result returns to the owning route with a redacted audit link. | REAL_READ | captured-readonly; n=2; categories=success; collector-selected fully-bound GET R0; two redacted real captures | `registry:getNetworkConnectionAddresses`<br>`upstream:backend/src/main.rs:548-549`<br>`upstream:backend/src/handlers.rs:1647-1666`<br>`fixture:captured-readonly` |
|
|
|
|
|
| `getDeviceNetworkDdnsConfig` | GET `/api/device-network/ddns/config` | device-network | `/instances/:id/device-network`<br>`device-network/ddns` | read-panel | planned: Frozen-scope read has two redacted captured responses; runtime support is still decided per registered instance.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Detail resource has no collection-empty rendering.)<br>partial:N (Atomic detail read has no meaningful partial rendering.)<br>policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)<br>unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)<br>owner-switch:Y (Owner switch discards responses with a mismatched instance key.) | R0; none<br>direct | query-capability/read-retain/version-probe/safe-read/route-result<br>Registered instance, authorized actor, and runtime capability decision are required.<br>Retain last success as stale and permit an explicit safe refresh.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Safe reads may retry within deadline and retain stale success.<br>Structured result returns to the owning route with a redacted audit link. | REAL_READ | captured-readonly; n=2; categories=success; collector-selected fully-bound GET R0; two redacted real captures | `registry:getDeviceNetworkDdnsConfig`<br>`upstream:backend/src/main.rs:552-553`<br>`upstream:backend/src/handlers.rs:1669-1679`<br>`upstream:bruno-api/get_device_ddns_config.bru:8`<br>`fixture:captured-readonly` |
|
|
|
|
|
| `postDeviceNetworkDdnsConfig` | POST `/api/device-network/ddns/config` | device-network | `/instances/:id/device-network`<br>`device-network/ddns` | job-action | planned: Frozen-scope high-risk operation is planned with simulation-only acceptance until controlled safety authorization exists.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)<br>partial:N (Single-target command has no meaningful partial result.)<br>policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)<br>unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)<br>owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R2; explicit<br>preparation-job | job-fresh-preflight/high-risk-block/version-probe/new-job-lineage/job-result<br>Required fresh preflight; inability to refresh blocks execution.<br>Fresh preflight is mandatory; stale, expired, or unknown state blocks execution.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Retry creates a new Job lineage (retryOfJobId/rootJobId); never replay successful items.<br>/jobs/:jobId contains per-item result, attempt lineage, and redacted audit. | SIMULATED_HIGH_RISK | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:postDeviceNetworkDdnsConfig`<br>`upstream:backend/src/main.rs:552-554`<br>`upstream:backend/src/handlers.rs:1682-1721`<br>`upstream:bruno-api/set_device_ddns_config.bru:8`<br>`fixture:not-eligible-readonly-capture` |
|
|
|
|
|
| `getDeviceNetworkDdnsStatus` | GET `/api/device-network/ddns/status` | device-network | `/instances/:id/device-network`<br>`device-network/ddns` | read-panel | planned: Frozen-scope read has two redacted captured responses; runtime support is still decided per registered instance.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Detail resource has no collection-empty rendering.)<br>partial:N (Atomic detail read has no meaningful partial rendering.)<br>policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)<br>unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)<br>owner-switch:Y (Owner switch discards responses with a mismatched instance key.) | R0; none<br>direct | query-capability/read-retain/version-probe/safe-read/route-result<br>Registered instance, authorized actor, and runtime capability decision are required.<br>Retain last success as stale and permit an explicit safe refresh.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Safe reads may retry within deadline and retain stale success.<br>Structured result returns to the owning route with a redacted audit link. | REAL_READ | captured-readonly; n=2; categories=success; collector-selected fully-bound GET R0; two redacted real captures | `registry:getDeviceNetworkDdnsStatus`<br>`upstream:backend/src/main.rs:558-559`<br>`upstream:backend/src/handlers.rs:1750-1757`<br>`upstream:bruno-api/get_device_ddns_status.bru:8`<br>`fixture:captured-readonly` |
|
|
|
|
|
| `postDeviceNetworkDdnsSync` | POST `/api/device-network/ddns/sync` | device-network | `/instances/:id/device-network`<br>`device-network/ddns` | action | planned: Frozen-scope reversible command is contract-planned for a later controlled real-write acceptance phase.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)<br>partial:N (Single-target command has no meaningful partial result.)<br>policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)<br>unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)<br>owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R1; none<br>direct | command-current-state/write-revision/version-probe/verify-write/route-result<br>Refresh current state when available and bind the actor decision to its revision.<br>Refresh current state or require an explicit recorded revision-bound override.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Writes require outcome verification before actor-initiated retry.<br>Structured result returns to the owning route with a redacted audit link. | REAL_WRITE_LATER | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:postDeviceNetworkDdnsSync`<br>`upstream:backend/src/main.rs:562-563`<br>`upstream:backend/src/handlers.rs:1760-1781`<br>`upstream:bruno-api/post_device_ddns_sync.bru:8`<br>`fixture:not-eligible-readonly-capture` |
|
|
|
|
|
| `getDeviceNetworkDdnsLogs` | GET `/api/device-network/ddns/logs` | device-network | `/instances/:id/device-network`<br>`device-network/ddns` | read-panel | planned: Frozen-scope read is modeled but real capture was explicitly denied; runtime support is probed per instance.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:Y (Successful collection may contain no rows.)<br>partial:Y (Independent response sections may succeed or fail.)<br>policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)<br>unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)<br>owner-switch:Y (Owner switch discards responses with a mismatched instance key.) | R0; none<br>direct | query-capability/read-retain/version-probe/safe-read/route-result<br>Registered instance, authorized actor, and runtime capability decision are required.<br>Retain last success as stale and permit an explicit safe refresh.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Safe reads may retry within deadline and retain stale success.<br>Structured result returns to the owning route with a redacted audit link. | REAL_READ_DEFERRED | denied-readonly-candidate; n=0; categories=none; no safe limit contract | `registry:getDeviceNetworkDdnsLogs`<br>`upstream:backend/src/main.rs:566-567`<br>`upstream:backend/src/handlers.rs:1784-1790`<br>`upstream:bruno-api/get_device_ddns_logs.bru:8`<br>`fixture:denied-readonly-candidate` |
|
|
|
|
|
| `postDeviceNetworkDdnsLogsClear` | POST `/api/device-network/ddns/logs/clear` | device-network | `/instances/:id/device-network`<br>`device-network/ddns` | job-action | planned: Frozen-scope high-risk operation is planned with simulation-only acceptance until controlled safety authorization exists.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)<br>partial:N (Single-target command has no meaningful partial result.)<br>policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)<br>unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)<br>owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R2; explicit<br>preparation-job | job-fresh-preflight/high-risk-block/version-probe/new-job-lineage/job-result<br>Required fresh preflight; inability to refresh blocks execution.<br>Fresh preflight is mandatory; stale, expired, or unknown state blocks execution.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Retry creates a new Job lineage (retryOfJobId/rootJobId); never replay successful items.<br>/jobs/:jobId contains per-item result, attempt lineage, and redacted audit. | SIMULATED_HIGH_RISK | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:postDeviceNetworkDdnsLogsClear`<br>`upstream:backend/src/main.rs:570-571`<br>`upstream:backend/src/handlers.rs:1793-1802`<br>`upstream:bruno-api/post_device_ddns_logs_clear.bru:8`<br>`fixture:not-eligible-readonly-capture` |
|
|
|
|
|
| `getDeviceNetworkWlanStatus` | GET `/api/device-network/wlan/status` | device-network | `/instances/:id/device-network`<br>`device-network/wlan` | read-panel | planned: Frozen-scope read has two redacted captured responses; runtime support is still decided per registered instance.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Detail resource has no collection-empty rendering.)<br>partial:N (Atomic detail read has no meaningful partial rendering.)<br>policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)<br>unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)<br>owner-switch:Y (Owner switch discards responses with a mismatched instance key.) | R0; none<br>direct | query-capability/read-retain/version-probe/safe-read/route-result<br>Registered instance, authorized actor, and runtime capability decision are required.<br>Retain last success as stale and permit an explicit safe refresh.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Safe reads may retry within deadline and retain stale success.<br>Structured result returns to the owning route with a redacted audit link. | REAL_READ | captured-readonly; n=2; categories=success; collector-selected fully-bound GET R0; two redacted real captures | `registry:getDeviceNetworkWlanStatus`<br>`upstream:backend/src/main.rs:574-575`<br>`upstream:backend/src/handlers.rs:1805-1819`<br>`upstream:bruno-api/get_device_wlan_status.bru:8`<br>`fixture:captured-readonly` |
|
|
|
|
|
| `postDeviceNetworkWlanEnabled` | POST `/api/device-network/wlan/enabled` | device-network | `/instances/:id/device-network`<br>`device-network/wlan` | form | planned: Frozen-scope reversible command is contract-planned for a later controlled real-write acceptance phase.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)<br>partial:N (Single-target command has no meaningful partial result.)<br>policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)<br>unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)<br>owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R1; none<br>direct | command-current-state/write-revision/version-probe/verify-write/route-result<br>Refresh current state when available and bind the actor decision to its revision.<br>Refresh current state or require an explicit recorded revision-bound override.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Writes require outcome verification before actor-initiated retry.<br>Structured result returns to the owning route with a redacted audit link. | REAL_WRITE_LATER | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:postDeviceNetworkWlanEnabled`<br>`upstream:backend/src/main.rs:578-579`<br>`upstream:backend/src/handlers.rs:1822-1841`<br>`upstream:bruno-api/set_device_wlan_enabled.bru:8`<br>`fixture:not-eligible-readonly-capture` |
|
|
|
|
|
| `postDeviceNetworkWlanScan` | POST `/api/device-network/wlan/scan` | device-network | `/instances/:id/device-network`<br>`device-network/wlan` | action | planned: Frozen-scope reversible command is contract-planned for a later controlled real-write acceptance phase.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)<br>partial:N (Single-target command has no meaningful partial result.)<br>policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)<br>unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)<br>owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R1; none<br>direct | command-current-state/write-revision/version-probe/verify-write/route-result<br>Refresh current state when available and bind the actor decision to its revision.<br>Refresh current state or require an explicit recorded revision-bound override.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Writes require outcome verification before actor-initiated retry.<br>Structured result returns to the owning route with a redacted audit link. | REAL_WRITE_LATER | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:postDeviceNetworkWlanScan`<br>`upstream:backend/src/main.rs:582-583`<br>`upstream:backend/src/handlers.rs:1844-1858`<br>`upstream:bruno-api/post_device_wlan_scan.bru:8`<br>`fixture:not-eligible-readonly-capture` |
|
|
|
|
|
| `getDeviceNetworkWlanProfiles` | GET `/api/device-network/wlan/profiles` | device-network | `/instances/:id/device-network`<br>`device-network/wlan` | table | planned: Frozen-scope read has two redacted captured responses; runtime support is still decided per registered instance.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:Y (Successful collection may contain no rows.)<br>partial:Y (Independent response sections may succeed or fail.)<br>policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)<br>unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)<br>owner-switch:Y (Owner switch discards responses with a mismatched instance key.) | R0; none<br>direct | query-capability/read-retain/version-probe/safe-read/route-result<br>Registered instance, authorized actor, and runtime capability decision are required.<br>Retain last success as stale and permit an explicit safe refresh.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Safe reads may retry within deadline and retain stale success.<br>Structured result returns to the owning route with a redacted audit link. | REAL_READ | captured-readonly; n=2; categories=success; collector-selected fully-bound GET R0; two redacted real captures | `registry:getDeviceNetworkWlanProfiles`<br>`upstream:backend/src/main.rs:586-587`<br>`upstream:backend/src/handlers.rs:1861-1875`<br>`upstream:bruno-api/get_device_wlan_profiles.bru:8`<br>`fixture:captured-readonly` |
|
|
|
|
|
| `postDeviceNetworkWlanForget` | POST `/api/device-network/wlan/forget` | device-network | `/instances/:id/device-network`<br>`device-network/wlan` | job-action | planned: Frozen-scope high-risk operation is planned with simulation-only acceptance until controlled safety authorization exists.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)<br>partial:N (Single-target command has no meaningful partial result.)<br>policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)<br>unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)<br>owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R2; explicit<br>preparation-job | job-fresh-preflight/high-risk-block/version-probe/new-job-lineage/job-result<br>Required fresh preflight; inability to refresh blocks execution.<br>Fresh preflight is mandatory; stale, expired, or unknown state blocks execution.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Retry creates a new Job lineage (retryOfJobId/rootJobId); never replay successful items.<br>/jobs/:jobId contains per-item result, attempt lineage, and redacted audit. | SIMULATED_HIGH_RISK | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:postDeviceNetworkWlanForget`<br>`upstream:backend/src/main.rs:590-591`<br>`upstream:backend/src/handlers.rs:1878-1897`<br>`upstream:bruno-api/post_device_wlan_forget.bru:8`<br>`fixture:not-eligible-readonly-capture` |
|
|
|
|
|
| `postDeviceNetworkWlanConnect` | POST `/api/device-network/wlan/connect` | device-network | `/instances/:id/device-network`<br>`device-network/wlan` | form | planned: Frozen-scope reversible command is contract-planned for a later controlled real-write acceptance phase.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)<br>partial:N (Single-target command has no meaningful partial result.)<br>policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)<br>unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)<br>owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R1; none<br>direct | command-current-state/write-revision/version-probe/verify-write/route-result<br>Refresh current state when available and bind the actor decision to its revision.<br>Refresh current state or require an explicit recorded revision-bound override.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Writes require outcome verification before actor-initiated retry.<br>Structured result returns to the owning route with a redacted audit link. | REAL_WRITE_LATER | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:postDeviceNetworkWlanConnect`<br>`upstream:backend/src/main.rs:594-595`<br>`upstream:backend/src/handlers.rs:1900-1955`<br>`upstream:bruno-api/post_device_wlan_connect.bru:8`<br>`fixture:not-eligible-readonly-capture` |
|
|
|
|
|
| `postDeviceNetworkWlanDisconnect` | POST `/api/device-network/wlan/disconnect` | device-network | `/instances/:id/device-network`<br>`device-network/wlan` | action | planned: Frozen-scope reversible command is contract-planned for a later controlled real-write acceptance phase.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)<br>partial:N (Single-target command has no meaningful partial result.)<br>policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)<br>unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)<br>owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R1; none<br>direct | command-current-state/write-revision/version-probe/verify-write/route-result<br>Refresh current state when available and bind the actor decision to its revision.<br>Refresh current state or require an explicit recorded revision-bound override.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Writes require outcome verification before actor-initiated retry.<br>Structured result returns to the owning route with a redacted audit link. | REAL_WRITE_LATER | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:postDeviceNetworkWlanDisconnect`<br>`upstream:backend/src/main.rs:598-599`<br>`upstream:backend/src/handlers.rs:1958-1991`<br>`upstream:bruno-api/post_device_wlan_disconnect.bru:8`<br>`fixture:not-eligible-readonly-capture` |
|
|
|
|
|
| `postDeviceNetworkWlanProfile` | POST `/api/device-network/wlan/profile` | device-network | `/instances/:id/device-network`<br>`device-network/wlan` | form | planned: Frozen-scope reversible command is contract-planned for a later controlled real-write acceptance phase.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)<br>partial:N (Single-target command has no meaningful partial result.)<br>policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)<br>unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)<br>owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R1; none<br>direct | command-current-state/write-revision/version-probe/verify-write/route-result<br>Refresh current state when available and bind the actor decision to its revision.<br>Refresh current state or require an explicit recorded revision-bound override.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Writes require outcome verification before actor-initiated retry.<br>Structured result returns to the owning route with a redacted audit link. | REAL_WRITE_LATER | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:postDeviceNetworkWlanProfile`<br>`upstream:backend/src/main.rs:602-603`<br>`upstream:backend/src/handlers.rs:1994-2013`<br>`upstream:bruno-api/post_device_wlan_profile.bru:8`<br>`fixture:not-eligible-readonly-capture` |
|
|
|
|
|
| `getNetworkSignalStrength` | GET `/api/network/signal-strength` | cellular | `/instances/:id/cellular`<br>`cellular/signal` | read-panel | planned: Frozen-scope read has two redacted captured responses; runtime support is still decided per registered instance.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Detail resource has no collection-empty rendering.)<br>partial:N (Atomic detail read has no meaningful partial rendering.)<br>policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)<br>unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)<br>owner-switch:Y (Owner switch discards responses with a mismatched instance key.) | R0; none<br>direct | query-capability/read-retain/version-probe/safe-read/route-result<br>Registered instance, authorized actor, and runtime capability decision are required.<br>Retain last success as stale and permit an explicit safe refresh.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Safe reads may retry within deadline and retain stale success.<br>Structured result returns to the owning route with a redacted audit link. | REAL_READ | captured-readonly; n=2; categories=success; collector-selected fully-bound GET R0; two redacted real captures | `registry:getNetworkSignalStrength`<br>`upstream:backend/src/main.rs:606-607`<br>`upstream:backend/src/handlers.rs:2016-2030`<br>`upstream:bruno-api/get_signal_strength.bru:8`<br>`fixture:captured-readonly` |
|
|
|
|
|
| `getLocationCellInfo` | GET `/api/location/cell-info` | cellular | `/instances/:id/cellular`<br>`cellular/cells` | read-panel | planned: Frozen-scope read has two redacted captured responses; runtime support is still decided per registered instance.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Detail resource has no collection-empty rendering.)<br>partial:N (Atomic detail read has no meaningful partial rendering.)<br>policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)<br>unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)<br>owner-switch:Y (Owner switch discards responses with a mismatched instance key.) | R0; none<br>direct | query-capability/read-retain/version-probe/safe-read/route-result<br>Registered instance, authorized actor, and runtime capability decision are required.<br>Retain last success as stale and permit an explicit safe refresh.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Safe reads may retry within deadline and retain stale success.<br>Structured result returns to the owning route with a redacted audit link. | REAL_READ | captured-readonly; n=2; categories=success; collector-selected fully-bound GET R0; two redacted real captures | `registry:getLocationCellInfo`<br>`upstream:backend/src/main.rs:610-611`<br>`upstream:backend/src/handlers.rs:1395-1409`<br>`upstream:bruno-api/get_cell_location_info.bru:8`<br>`fixture:captured-readonly` |
|
|
|
|
|
| `getNetworkOperators` | GET `/api/network/operators` | cellular | `/instances/:id/cellular`<br>`cellular/operator-registration` | table | planned: Frozen-scope read has two redacted captured responses; runtime support is still decided per registered instance.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:Y (Successful collection may contain no rows.)<br>partial:Y (Independent response sections may succeed or fail.)<br>policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)<br>unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)<br>owner-switch:Y (Owner switch discards responses with a mismatched instance key.) | R0; none<br>direct | query-capability/read-retain/version-probe/safe-read/route-result<br>Registered instance, authorized actor, and runtime capability decision are required.<br>Retain last success as stale and permit an explicit safe refresh.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Safe reads may retry within deadline and retain stale success.<br>Structured result returns to the owning route with a redacted audit link. | REAL_READ | captured-readonly; n=2; categories=success; collector-selected fully-bound GET R0; two redacted real captures | `registry:getNetworkOperators`<br>`upstream:backend/src/main.rs:614-615`<br>`upstream:backend/src/handlers.rs:1412-1426`<br>`upstream:bruno-api/get_operators.bru:8`<br>`fixture:captured-readonly` |
|
|
|
|
|
| `getNetworkOperatorsScan` | GET `/api/network/operators/scan` | cellular | `/instances/:id/cellular`<br>`cellular/operator-registration` | read-panel | planned: Frozen-scope read is modeled but real capture was explicitly denied; runtime support is probed per instance.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:Y (A successful active operator scan may return no operators.)<br>partial:Y (The scan response may contain usable operators alongside per-result failures or incomplete entries.)<br>policy-forbidden:Y (Active scan may be blocked by capability, authorization, preflight, or active-scan policy.)<br>unknown-result:N (A timed-out scan result may be discarded; it is not an unknown persistent write outcome.)<br>owner-switch:Y (Owner switch discards scan responses with a mismatched instance key.) | R0; none<br>direct | command-current-state/write-revision/version-probe/verify-write/route-result<br>Refresh current state when available and bind the actor decision to its revision.<br>Refresh current state or require an explicit recorded revision-bound override.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Writes require outcome verification before actor-initiated retry.<br>Structured result returns to the owning route with a redacted audit link. | REAL_READ_DEFERRED | denied-readonly-candidate; n=0; categories=none; active radio/network scan | `registry:getNetworkOperatorsScan`<br>`upstream:backend/src/main.rs:618-619`<br>`upstream:backend/src/handlers.rs:1429-1443`<br>`upstream:bruno-api/scan_operators.bru:8`<br>`fixture:denied-readonly-candidate` |
|
|
|
|
|
| `postNetworkRegisterManual` | POST `/api/network/register-manual` | cellular | `/instances/:id/cellular`<br>`cellular/operator-registration` | job-action | planned: Frozen-scope high-risk operation is planned with simulation-only acceptance until controlled safety authorization exists.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)<br>partial:N (Single-target command has no meaningful partial result.)<br>policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)<br>unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)<br>owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R2; explicit<br>preparation-job | job-fresh-preflight/high-risk-block/version-probe/new-job-lineage/job-result<br>Required fresh preflight; inability to refresh blocks execution.<br>Fresh preflight is mandatory; stale, expired, or unknown state blocks execution.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Retry creates a new Job lineage (retryOfJobId/rootJobId); never replay successful items.<br>/jobs/:jobId contains per-item result, attempt lineage, and redacted audit. | SIMULATED_HIGH_RISK | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:postNetworkRegisterManual`<br>`upstream:backend/src/main.rs:622-623`<br>`upstream:backend/src/handlers.rs:1446-1466`<br>`upstream:bruno-api/register_operator_manual.bru:8`<br>`fixture:not-eligible-readonly-capture` |
|
|
|
|
|
| `postNetworkRegisterAuto` | POST `/api/network/register-auto` | cellular | `/instances/:id/cellular`<br>`cellular/operator-registration` | job-action | planned: Frozen-scope high-risk operation is planned with simulation-only acceptance until controlled safety authorization exists.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)<br>partial:N (Single-target command has no meaningful partial result.)<br>policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)<br>unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)<br>owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R2; explicit<br>preparation-job | job-fresh-preflight/high-risk-block/version-probe/new-job-lineage/job-result<br>Required fresh preflight; inability to refresh blocks execution.<br>Fresh preflight is mandatory; stale, expired, or unknown state blocks execution.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Retry creates a new Job lineage (retryOfJobId/rootJobId); never replay successful items.<br>/jobs/:jobId contains per-item result, attempt lineage, and redacted audit. | SIMULATED_HIGH_RISK | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:postNetworkRegisterAuto`<br>`upstream:backend/src/main.rs:626-627`<br>`upstream:backend/src/handlers.rs:1469-1486`<br>`upstream:bruno-api/register_operator_auto.bru:8`<br>`fixture:not-eligible-readonly-capture` |
|
|
|
|
|
| `getApn` | GET `/api/apn` | data-connection | `/instances/:id/cellular`<br>`cellular/data-apn` | read-panel | planned: Frozen-scope read has two redacted captured responses; runtime support is still decided per registered instance.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Detail resource has no collection-empty rendering.)<br>partial:N (Atomic detail read has no meaningful partial rendering.)<br>policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)<br>unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)<br>owner-switch:Y (Owner switch discards responses with a mismatched instance key.) | R0; none<br>direct | query-capability/read-retain/version-probe/safe-read/route-result<br>Registered instance, authorized actor, and runtime capability decision are required.<br>Retain last success as stale and permit an explicit safe refresh.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Safe reads may retry within deadline and retain stale success.<br>Structured result returns to the owning route with a redacted audit link. | REAL_READ | captured-readonly; n=2; categories=success; collector-selected fully-bound GET R0; two redacted real captures | `registry:getApn`<br>`upstream:backend/src/main.rs:630-631`<br>`upstream:backend/src/handlers.rs:1489-1504`<br>`upstream:bruno-api/get_apn_list.bru:8`<br>`fixture:captured-readonly` |
|
|
|
|
|
| `postApn` | POST `/api/apn` | data-connection | `/instances/:id/cellular`<br>`cellular/data-apn` | form | planned: Frozen-scope reversible command is contract-planned for a later controlled real-write acceptance phase.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)<br>partial:N (Single-target command has no meaningful partial result.)<br>policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)<br>unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)<br>owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R1; none<br>direct | command-current-state/write-revision/version-probe/verify-write/route-result<br>Refresh current state when available and bind the actor decision to its revision.<br>Refresh current state or require an explicit recorded revision-bound override.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Writes require outcome verification before actor-initiated retry.<br>Structured result returns to the owning route with a redacted audit link. | REAL_WRITE_LATER | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:postApn`<br>`upstream:backend/src/main.rs:630-632`<br>`upstream:backend/src/handlers.rs:1507-1571`<br>`upstream:bruno-api/set_apn.bru:8`<br>`fixture:not-eligible-readonly-capture` |
|
|
|
|
|
| `getCellLock` | GET `/api/cell-lock` | radio-lock | `/instances/:id/cellular`<br>`cellular/radio-locks` | read-panel | planned: Frozen-scope read has two redacted captured responses; runtime support is still decided per registered instance.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Detail resource has no collection-empty rendering.)<br>partial:N (Atomic detail read has no meaningful partial rendering.)<br>policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)<br>unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)<br>owner-switch:Y (Owner switch discards responses with a mismatched instance key.) | R0; none<br>direct | query-capability/read-retain/version-probe/safe-read/route-result<br>Registered instance, authorized actor, and runtime capability decision are required.<br>Retain last success as stale and permit an explicit safe refresh.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Safe reads may retry within deadline and retain stale success.<br>Structured result returns to the owning route with a redacted audit link. | REAL_READ | captured-readonly; n=2; categories=success; collector-selected fully-bound GET R0; two redacted real captures | `registry:getCellLock`<br>`upstream:backend/src/main.rs:636-637`<br>`upstream:backend/src/handlers.rs:1574-1582`<br>`upstream:bruno-api/get_cell_lock.bru:8`<br>`fixture:captured-readonly` |
|
|
|
|
|
| `postCellLock` | POST `/api/cell-lock` | radio-lock | `/instances/:id/cellular`<br>`cellular/radio-locks` | job-action | planned: Frozen-scope high-risk operation is planned with simulation-only acceptance until controlled safety authorization exists.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)<br>partial:N (Single-target command has no meaningful partial result.)<br>policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)<br>unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)<br>owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R2; explicit<br>preparation-job | job-fresh-preflight/high-risk-block/version-probe/new-job-lineage/job-result<br>Required fresh preflight; inability to refresh blocks execution.<br>Fresh preflight is mandatory; stale, expired, or unknown state blocks execution.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Retry creates a new Job lineage (retryOfJobId/rootJobId); never replay successful items.<br>/jobs/:jobId contains per-item result, attempt lineage, and redacted audit. | SIMULATED_HIGH_RISK | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:postCellLock`<br>`upstream:backend/src/main.rs:636-638`<br>`upstream:backend/src/handlers.rs:1585-1603`<br>`upstream:bruno-api/set_cell_lock_lte.bru:8`<br>`upstream:bruno-api/set_cell_lock_nr.bru:8`<br>`upstream:bruno-api/unlock_cell_nr.bru:8`<br>`fixture:not-eligible-readonly-capture` |
|
|
|
|
|
| `postCellLockUnlockAll` | POST `/api/cell-lock/unlock-all` | radio-lock | `/instances/:id/cellular`<br>`cellular/radio-locks` | job-action | planned: Frozen-scope high-risk operation is planned with simulation-only acceptance until controlled safety authorization exists.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)<br>partial:N (Single-target command has no meaningful partial result.)<br>policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)<br>unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)<br>owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R2; explicit<br>preparation-job | job-fresh-preflight/high-risk-block/version-probe/new-job-lineage/job-result<br>Required fresh preflight; inability to refresh blocks execution.<br>Fresh preflight is mandatory; stale, expired, or unknown state blocks execution.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Retry creates a new Job lineage (retryOfJobId/rootJobId); never replay successful items.<br>/jobs/:jobId contains per-item result, attempt lineage, and redacted audit. | SIMULATED_HIGH_RISK | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:postCellLockUnlockAll`<br>`upstream:backend/src/main.rs:642-643`<br>`upstream:backend/src/handlers.rs:1606-1616`<br>`upstream:bruno-api/unlock_all_cells.bru:8`<br>`fixture:not-eligible-readonly-capture` |
|
|
|
|
|
| `getData` | GET `/api/data` | data-connection | `/instances/:id/cellular`<br>`cellular/data-apn` | read-panel | planned: Frozen-scope read has two redacted captured responses; runtime support is still decided per registered instance.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Detail resource has no collection-empty rendering.)<br>partial:N (Atomic detail read has no meaningful partial rendering.)<br>policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)<br>unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)<br>owner-switch:Y (Owner switch discards responses with a mismatched instance key.) | R0; none<br>direct | query-capability/read-retain/version-probe/safe-read/route-result<br>Registered instance, authorized actor, and runtime capability decision are required.<br>Retain last success as stale and permit an explicit safe refresh.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Safe reads may retry within deadline and retain stale success.<br>Structured result returns to the owning route with a redacted audit link. | REAL_READ | captured-readonly; n=2; categories=success; collector-selected fully-bound GET R0; two redacted real captures | `registry:getData`<br>`upstream:backend/src/main.rs:647-648`<br>`upstream:backend/src/handlers.rs:2035-2062`<br>`upstream:bruno-api/get_data_status.bru:8`<br>`fixture:captured-readonly` |
|
|
|
|
|
| `postData` | POST `/api/data` | data-connection | `/instances/:id/cellular`<br>`cellular/data-apn` | form | planned: Frozen-scope reversible command is contract-planned for a later controlled real-write acceptance phase.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)<br>partial:N (Single-target command has no meaningful partial result.)<br>policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)<br>unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)<br>owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R1; none<br>direct | command-current-state/write-revision/version-probe/verify-write/route-result<br>Refresh current state when available and bind the actor decision to its revision.<br>Refresh current state or require an explicit recorded revision-bound override.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Writes require outcome verification before actor-initiated retry.<br>Structured result returns to the owning route with a redacted audit link. | REAL_WRITE_LATER | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:postData`<br>`upstream:backend/src/main.rs:647-649`<br>`upstream:backend/src/handlers.rs:2065-2131`<br>`upstream:bruno-api/set_data_status_disable.bru:8`<br>`upstream:bruno-api/set_data_status_enable.bru:8`<br>`fixture:not-eligible-readonly-capture` |
|
|
|
|
|
| `getRoaming` | GET `/api/roaming` | data-connection | `/instances/:id/cellular`<br>`cellular/data-apn` | read-panel | planned: Frozen-scope read has two redacted captured responses; runtime support is still decided per registered instance.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Detail resource has no collection-empty rendering.)<br>partial:N (Atomic detail read has no meaningful partial rendering.)<br>policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)<br>unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)<br>owner-switch:Y (Owner switch discards responses with a mismatched instance key.) | R0; none<br>direct | query-capability/read-retain/version-probe/safe-read/route-result<br>Registered instance, authorized actor, and runtime capability decision are required.<br>Retain last success as stale and permit an explicit safe refresh.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Safe reads may retry within deadline and retain stale success.<br>Structured result returns to the owning route with a redacted audit link. | REAL_READ | captured-readonly; n=2; categories=success; collector-selected fully-bound GET R0; two redacted real captures | `registry:getRoaming`<br>`upstream:backend/src/main.rs:653-654`<br>`upstream:backend/src/handlers.rs:2172-2193`<br>`upstream:bruno-api/get_roaming_status.bru:8`<br>`fixture:captured-readonly` |
|
|
|
|
|
| `postRoaming` | POST `/api/roaming` | data-connection | `/instances/:id/cellular`<br>`cellular/data-apn` | form | planned: Frozen-scope reversible command is contract-planned for a later controlled real-write acceptance phase.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)<br>partial:N (Single-target command has no meaningful partial result.)<br>policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)<br>unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)<br>owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R1; none<br>direct | command-current-state/write-revision/version-probe/verify-write/route-result<br>Refresh current state when available and bind the actor decision to its revision.<br>Refresh current state or require an explicit recorded revision-bound override.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Writes require outcome verification before actor-initiated retry.<br>Structured result returns to the owning route with a redacted audit link. | REAL_WRITE_LATER | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:postRoaming`<br>`upstream:backend/src/main.rs:653-655`<br>`upstream:backend/src/handlers.rs:2196-2247`<br>`upstream:bruno-api/set_roaming_enable.bru:8`<br>`upstream:bruno-api/set_roaming_disable.bru:8`<br>`fixture:not-eligible-readonly-capture` |
|
|
|
|
|
| `getAirplaneMode` | GET `/api/airplane-mode` | data-connection | `/instances/:id/cellular`<br>`cellular/data-apn` | read-panel | planned: Frozen-scope read has two redacted captured responses; runtime support is still decided per registered instance.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Detail resource has no collection-empty rendering.)<br>partial:N (Atomic detail read has no meaningful partial rendering.)<br>policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)<br>unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)<br>owner-switch:Y (Owner switch discards responses with a mismatched instance key.) | R0; none<br>direct | query-capability/read-retain/version-probe/safe-read/route-result<br>Registered instance, authorized actor, and runtime capability decision are required.<br>Retain last success as stale and permit an explicit safe refresh.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Safe reads may retry within deadline and retain stale success.<br>Structured result returns to the owning route with a redacted audit link. | REAL_READ | captured-readonly; n=2; categories=success; collector-selected fully-bound GET R0; two redacted real captures | `registry:getAirplaneMode`<br>`upstream:backend/src/main.rs:659-660`<br>`upstream:backend/src/handlers.rs:2315-2329`<br>`upstream:bruno-api/get_airplane_mode.bru:8`<br>`fixture:captured-readonly` |
|
|
|
|
|
| `postAirplaneMode` | POST `/api/airplane-mode` | data-connection | `/instances/:id/cellular`<br>`cellular/data-apn` | form | planned: Frozen-scope reversible command is contract-planned for a later controlled real-write acceptance phase.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)<br>partial:N (Single-target command has no meaningful partial result.)<br>policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)<br>unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)<br>owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R1; none<br>direct | command-current-state/write-revision/version-probe/verify-write/route-result<br>Refresh current state when available and bind the actor decision to its revision.<br>Refresh current state or require an explicit recorded revision-bound override.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Writes require outcome verification before actor-initiated retry.<br>Structured result returns to the owning route with a redacted audit link. | REAL_WRITE_LATER | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:postAirplaneMode`<br>`upstream:backend/src/main.rs:659-661`<br>`upstream:backend/src/handlers.rs:2250-2312`<br>`upstream:bruno-api/set_airplane_mode_disable.bru:8`<br>`upstream:bruno-api/set_airplane_mode_enable.bru:8`<br>`fixture:not-eligible-readonly-capture` |
|
|
|
|
|
| `postBasebandRestart` | POST `/api/baseband/restart` | data-connection | `/instances/:id/cellular`<br>`cellular/data-apn` | job-action | planned: Frozen-scope high-risk operation is planned with simulation-only acceptance until controlled safety authorization exists.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)<br>partial:N (Single-target command has no meaningful partial result.)<br>policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)<br>unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)<br>owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R3; strong<br>preparation-job | job-fresh-preflight/high-risk-block/version-probe/new-job-lineage/job-result<br>Required fresh preflight; inability to refresh blocks execution.<br>Fresh preflight is mandatory; stale, expired, or unknown state blocks execution.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Retry creates a new Job lineage (retryOfJobId/rootJobId); never replay successful items.<br>/jobs/:jobId contains per-item result, attempt lineage, and redacted audit. | SIMULATED_HIGH_RISK | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:postBasebandRestart`<br>`upstream:backend/src/main.rs:665-666`<br>`upstream:backend/src/handlers.rs:2133-2159`<br>`fixture:not-eligible-readonly-capture` |
|
|
|
|
|
| `getBasebandRestartStatus` | GET `/api/baseband/restart/status` | data-connection | `/instances/:id/cellular`<br>`cellular/data-apn` | read-panel | planned: Frozen-scope read has two redacted captured responses; runtime support is still decided per registered instance.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Detail resource has no collection-empty rendering.)<br>partial:N (Atomic detail read has no meaningful partial rendering.)<br>policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)<br>unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)<br>owner-switch:Y (Owner switch discards responses with a mismatched instance key.) | R0; none<br>direct | query-capability/read-retain/version-probe/safe-read/route-result<br>Registered instance, authorized actor, and runtime capability decision are required.<br>Retain last success as stale and permit an explicit safe refresh.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Safe reads may retry within deadline and retain stale success.<br>Structured result returns to the owning route with a redacted audit link. | REAL_READ | captured-readonly; n=2; categories=success; collector-selected fully-bound GET R0; two redacted real captures | `registry:getBasebandRestartStatus`<br>`upstream:backend/src/main.rs:669-670`<br>`upstream:backend/src/handlers.rs:2161-2169`<br>`fixture:captured-readonly` |
|
|
|
|
|
| `getWorkMode` | GET `/api/work-mode` | workmode-esim | `/instances/:id/esim`<br>`esim/mode` | read-panel | planned: Frozen-scope read has two redacted captured responses; runtime support is still decided per registered instance.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Detail resource has no collection-empty rendering.)<br>partial:N (Atomic detail read has no meaningful partial rendering.)<br>policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)<br>unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)<br>owner-switch:Y (Owner switch discards responses with a mismatched instance key.) | R0; none<br>direct | query-capability/read-retain/version-probe/safe-read/route-result<br>Registered instance, authorized actor, and runtime capability decision are required.<br>Retain last success as stale and permit an explicit safe refresh.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Safe reads may retry within deadline and retain stale success.<br>Structured result returns to the owning route with a redacted audit link. | REAL_READ | captured-readonly; n=2; categories=success; collector-selected fully-bound GET R0; two redacted real captures | `registry:getWorkMode`<br>`upstream:backend/src/main.rs:674-675`<br>`upstream:backend/src/handlers.rs:352-365`<br>`fixture:captured-readonly` |
|
|
|
|
|
| `postWorkMode` | POST `/api/work-mode` | workmode-esim | `/instances/:id/esim`<br>`esim/mode` | job-action | planned: Frozen-scope high-risk operation is planned with simulation-only acceptance until controlled safety authorization exists.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)<br>partial:N (Single-target command has no meaningful partial result.)<br>policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)<br>unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)<br>owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R2; explicit<br>preparation-job | job-fresh-preflight/high-risk-block/version-probe/new-job-lineage/job-result<br>Required fresh preflight; inability to refresh blocks execution.<br>Fresh preflight is mandatory; stale, expired, or unknown state blocks execution.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Retry creates a new Job lineage (retryOfJobId/rootJobId); never replay successful items.<br>/jobs/:jobId contains per-item result, attempt lineage, and redacted audit. | SIMULATED_HIGH_RISK | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:postWorkMode`<br>`upstream:backend/src/main.rs:674-676`<br>`upstream:backend/src/handlers.rs:368-405`<br>`fixture:not-eligible-readonly-capture` |
|
|
|
|
|
| `getEsimConfig` | GET `/api/esim/config` | workmode-esim | `/instances/:id/esim`<br>`esim/config` | read-panel | planned: Frozen-scope read has two redacted captured responses; runtime support is still decided per registered instance.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Detail resource has no collection-empty rendering.)<br>partial:N (Atomic detail read has no meaningful partial rendering.)<br>policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)<br>unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)<br>owner-switch:Y (Owner switch discards responses with a mismatched instance key.) | R0; none<br>direct | query-capability/read-retain/version-probe/safe-read/route-result<br>Registered instance, authorized actor, and runtime capability decision are required.<br>Retain last success as stale and permit an explicit safe refresh.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Safe reads may retry within deadline and retain stale success.<br>Structured result returns to the owning route with a redacted audit link. | REAL_READ | captured-readonly; n=2; categories=unsupported; collector-selected fully-bound GET R0; two redacted real captures | `registry:getEsimConfig`<br>`upstream:backend/src/main.rs:680-681`<br>`upstream:backend/src/handlers.rs:456-462`<br>`fixture:captured-readonly` |
|
|
|
|
|
| `postEsimConfig` | POST `/api/esim/config` | workmode-esim | `/instances/:id/esim`<br>`esim/config` | job-action | planned: Frozen-scope high-risk operation is planned with simulation-only acceptance until controlled safety authorization exists.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)<br>partial:N (Single-target command has no meaningful partial result.)<br>policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)<br>unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)<br>owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R2; explicit<br>preparation-job | job-fresh-preflight/high-risk-block/version-probe/new-job-lineage/job-result<br>Required fresh preflight; inability to refresh blocks execution.<br>Fresh preflight is mandatory; stale, expired, or unknown state blocks execution.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Retry creates a new Job lineage (retryOfJobId/rootJobId); never replay successful items.<br>/jobs/:jobId contains per-item result, attempt lineage, and redacted audit. | SIMULATED_HIGH_RISK | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:postEsimConfig`<br>`upstream:backend/src/main.rs:680-682`<br>`upstream:backend/src/handlers.rs:465-482`<br>`fixture:not-eligible-readonly-capture` |
|
|
|
|
|
| `getEsimLpacStatus` | GET `/api/esim/lpac/status` | workmode-esim | `/instances/:id/esim`<br>`esim/lpac` | read-panel | planned: Frozen-scope read has two redacted captured responses; runtime support is still decided per registered instance.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Detail resource has no collection-empty rendering.)<br>partial:N (Atomic detail read has no meaningful partial rendering.)<br>policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)<br>unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)<br>owner-switch:Y (Owner switch discards responses with a mismatched instance key.) | R0; none<br>direct | query-capability/read-retain/version-probe/safe-read/route-result<br>Registered instance, authorized actor, and runtime capability decision are required.<br>Retain last success as stale and permit an explicit safe refresh.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Safe reads may retry within deadline and retain stale success.<br>Structured result returns to the owning route with a redacted audit link. | REAL_READ | captured-readonly; n=2; categories=auth-required; collector-selected fully-bound GET R0; two redacted real captures | `registry:getEsimLpacStatus`<br>`upstream:backend/src/main.rs:686-687`<br>`upstream:backend/src/handlers.rs:408-416`<br>`fixture:captured-readonly` |
|
|
|
|
|
| `postEsimLpacRepair` | POST `/api/esim/lpac/repair` | workmode-esim | `/instances/:id/esim`<br>`esim/lpac` | job-action | planned: Frozen-scope high-risk operation is planned with simulation-only acceptance until controlled safety authorization exists.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)<br>partial:N (Single-target command has no meaningful partial result.)<br>policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)<br>unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)<br>owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R2; explicit<br>preparation-job | job-fresh-preflight/high-risk-block/version-probe/new-job-lineage/job-result<br>Required fresh preflight; inability to refresh blocks execution.<br>Fresh preflight is mandatory; stale, expired, or unknown state blocks execution.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Retry creates a new Job lineage (retryOfJobId/rootJobId); never replay successful items.<br>/jobs/:jobId contains per-item result, attempt lineage, and redacted audit. | SIMULATED_HIGH_RISK | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:postEsimLpacRepair`<br>`upstream:backend/src/main.rs:690-691`<br>`upstream:backend/src/handlers.rs:419-453`<br>`fixture:not-eligible-readonly-capture` |
|
|
|
|
|
| `getEsimEuicc` | GET `/api/esim/euicc` | workmode-esim | `/instances/:id/esim`<br>`esim/euicc` | read-panel | planned: Frozen-scope read is modeled but real capture was explicitly denied; runtime support is probed per instance.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Detail resource has no collection-empty rendering.)<br>partial:N (Atomic detail read has no meaningful partial rendering.)<br>policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)<br>unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)<br>owner-switch:Y (Owner switch discards responses with a mismatched instance key.) | R0; none<br>direct | query-capability/read-retain/version-probe/safe-read/route-result<br>Registered instance, authorized actor, and runtime capability decision are required.<br>Retain last success as stale and permit an explicit safe refresh.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Safe reads may retry within deadline and retain stale success.<br>Structured result returns to the owning route with a redacted audit link. | REAL_READ_DEFERRED | denied-readonly-candidate; n=0; categories=none; query-bearing endpoint omitted | `registry:getEsimEuicc`<br>`upstream:backend/src/main.rs:694-695`<br>`upstream:backend/src/handlers.rs:485-521`<br>`fixture:denied-readonly-candidate` |
|
|
|
|
|
| `getEsimProfiles` | GET `/api/esim/profiles` | workmode-esim | `/instances/:id/esim`<br>`esim/profiles` | table | planned: Frozen-scope read is modeled but real capture was explicitly denied; runtime support is probed per instance.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:Y (Successful collection may contain no rows.)<br>partial:Y (Independent response sections may succeed or fail.)<br>policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)<br>unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)<br>owner-switch:Y (Owner switch discards responses with a mismatched instance key.) | R0; none<br>direct | query-capability/read-retain/version-probe/safe-read/route-result<br>Registered instance, authorized actor, and runtime capability decision are required.<br>Retain last success as stale and permit an explicit safe refresh.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Safe reads may retry within deadline and retain stale success.<br>Structured result returns to the owning route with a redacted audit link. | REAL_READ_DEFERRED | denied-readonly-candidate; n=0; categories=none; query-bearing endpoint omitted | `registry:getEsimProfiles`<br>`upstream:backend/src/main.rs:698-699`<br>`upstream:backend/src/handlers.rs:524-598`<br>`fixture:denied-readonly-candidate` |
|
|
|
|
|
| `postEsimProfiles` | POST `/api/esim/profiles` | workmode-esim | `/instances/:id/esim`<br>`esim/profiles` | form | planned: Frozen-scope reversible command is contract-planned for a later controlled real-write acceptance phase.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)<br>partial:N (Single-target command has no meaningful partial result.)<br>policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)<br>unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)<br>owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R1; none<br>direct | command-current-state/write-revision/version-probe/verify-write/route-result<br>Refresh current state when available and bind the actor decision to its revision.<br>Refresh current state or require an explicit recorded revision-bound override.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Writes require outcome verification before actor-initiated retry.<br>Structured result returns to the owning route with a redacted audit link. | REAL_WRITE_LATER | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:postEsimProfiles`<br>`upstream:backend/src/main.rs:698-700`<br>`upstream:backend/src/handlers.rs:803-1071`<br>`fixture:not-eligible-readonly-capture` |
|
|
|
|
|
| `postEsimProfilesIccidEnable` | POST `/api/esim/profiles/{iccid}/enable` | workmode-esim | `/instances/:id/esim`<br>`esim/profiles` | action | planned: Frozen-scope reversible command is contract-planned for a later controlled real-write acceptance phase.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)<br>partial:N (Single-target command has no meaningful partial result.)<br>policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)<br>unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)<br>owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R1; none<br>direct | command-current-state/write-revision/version-probe/verify-write/route-result<br>Refresh current state when available and bind the actor decision to its revision.<br>Refresh current state or require an explicit recorded revision-bound override.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Writes require outcome verification before actor-initiated retry.<br>Structured result returns to the owning route with a redacted audit link. | REAL_WRITE_LATER | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:postEsimProfilesIccidEnable`<br>`upstream:backend/src/main.rs:704-705`<br>`upstream:backend/src/handlers.rs:601-726`<br>`fixture:not-eligible-readonly-capture` |
|
|
|
|
|
| `postEsimProfilesIccidRename` | POST `/api/esim/profiles/{iccid}/rename` | workmode-esim | `/instances/:id/esim`<br>`esim/profiles` | form | planned: Frozen-scope reversible command is contract-planned for a later controlled real-write acceptance phase.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)<br>partial:N (Single-target command has no meaningful partial result.)<br>policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)<br>unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)<br>owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R1; none<br>direct | command-current-state/write-revision/version-probe/verify-write/route-result<br>Refresh current state when available and bind the actor decision to its revision.<br>Refresh current state or require an explicit recorded revision-bound override.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Writes require outcome verification before actor-initiated retry.<br>Structured result returns to the owning route with a redacted audit link. | REAL_WRITE_LATER | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:postEsimProfilesIccidRename`<br>`upstream:backend/src/main.rs:708-709`<br>`upstream:backend/src/handlers.rs:729-750`<br>`fixture:not-eligible-readonly-capture` |
|
|
|
|
|
| `deleteEsimProfilesIccid` | DELETE `/api/esim/profiles/{iccid}` | workmode-esim | `/instances/:id/esim`<br>`esim/profiles` | job-action | planned: Frozen-scope high-risk operation is planned with simulation-only acceptance until controlled safety authorization exists.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)<br>partial:N (Single-target command has no meaningful partial result.)<br>policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)<br>unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)<br>owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R3; strong<br>preparation-job | job-fresh-preflight/high-risk-block/version-probe/new-job-lineage/job-result<br>Required fresh preflight; inability to refresh blocks execution.<br>Fresh preflight is mandatory; stale, expired, or unknown state blocks execution.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Retry creates a new Job lineage (retryOfJobId/rootJobId); never replay successful items.<br>/jobs/:jobId contains per-item result, attempt lineage, and redacted audit. | SIMULATED_HIGH_RISK | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:deleteEsimProfilesIccid`<br>`upstream:backend/src/main.rs:712-713`<br>`upstream:backend/src/handlers.rs:753-780`<br>`fixture:not-eligible-readonly-capture` |
|
|
|
|
|
| `getCalls` | GET `/api/calls` | calls | `/instances/:id/calls`<br>`calls/live` | table | planned: Frozen-scope read has two redacted captured responses; runtime support is still decided per registered instance.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:Y (Successful collection may contain no rows.)<br>partial:Y (Independent response sections may succeed or fail.)<br>policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)<br>unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)<br>owner-switch:Y (Owner switch discards responses with a mismatched instance key.) | R0; none<br>direct | query-capability/read-retain/version-probe/safe-read/route-result<br>Registered instance, authorized actor, and runtime capability decision are required.<br>Retain last success as stale and permit an explicit safe refresh.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Safe reads may retry within deadline and retain stale success.<br>Structured result returns to the owning route with a redacted audit link. | REAL_READ | captured-readonly; n=2; categories=success; collector-selected fully-bound GET R0; two redacted real captures | `registry:getCalls`<br>`upstream:backend/src/main.rs:717-718`<br>`upstream:backend/src/handlers.rs:2634-2655`<br>`upstream:bruno-api/get_calls.bru:8`<br>`fixture:captured-readonly` |
|
|
|
|
|
| `postCallDial` | POST `/api/call/dial` | calls | `/instances/:id/calls`<br>`calls/live` | form | planned: Frozen-scope reversible command is contract-planned for a later controlled real-write acceptance phase.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)<br>partial:N (Single-target command has no meaningful partial result.)<br>policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)<br>unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)<br>owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R1; none<br>direct | command-current-state/write-revision/version-probe/verify-write/route-result<br>Refresh current state when available and bind the actor decision to its revision.<br>Refresh current state or require an explicit recorded revision-bound override.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Writes require outcome verification before actor-initiated retry.<br>Structured result returns to the owning route with a redacted audit link. | REAL_WRITE_LATER | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:postCallDial`<br>`upstream:backend/src/main.rs:721-722`<br>`upstream:backend/src/handlers.rs:2657-2689`<br>`upstream:bruno-api/post_call_dial.bru:8`<br>`fixture:not-eligible-readonly-capture` |
|
|
|
|
|
| `postCallHangup` | POST `/api/call/hangup` | calls | `/instances/:id/calls`<br>`calls/live` | form | planned: Frozen-scope reversible command is contract-planned for a later controlled real-write acceptance phase.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)<br>partial:N (Single-target command has no meaningful partial result.)<br>policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)<br>unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)<br>owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R1; none<br>direct | command-current-state/write-revision/version-probe/verify-write/route-result<br>Refresh current state when available and bind the actor decision to its revision.<br>Refresh current state or require an explicit recorded revision-bound override.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Writes require outcome verification before actor-initiated retry.<br>Structured result returns to the owning route with a redacted audit link. | REAL_WRITE_LATER | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:postCallHangup`<br>`upstream:backend/src/main.rs:725-726`<br>`upstream:backend/src/handlers.rs:2691-2725`<br>`upstream:bruno-api/post_call_hangup.bru:8`<br>`fixture:not-eligible-readonly-capture` |
|
|
|
|
|
| `postCallHangupAll` | POST `/api/call/hangup-all` | calls | `/instances/:id/calls`<br>`calls/live` | action | planned: Frozen-scope reversible command is contract-planned for a later controlled real-write acceptance phase.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)<br>partial:N (Single-target command has no meaningful partial result.)<br>policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)<br>unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)<br>owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R1; none<br>direct | command-current-state/write-revision/version-probe/verify-write/route-result<br>Refresh current state when available and bind the actor decision to its revision.<br>Refresh current state or require an explicit recorded revision-bound override.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Writes require outcome verification before actor-initiated retry.<br>Structured result returns to the owning route with a redacted audit link. | REAL_WRITE_LATER | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:postCallHangupAll`<br>`upstream:backend/src/main.rs:729-730`<br>`upstream:backend/src/handlers.rs:2727-2760`<br>`upstream:bruno-api/post_call_hangup_all.bru:8`<br>`fixture:not-eligible-readonly-capture` |
|
|
|
|
|
| `postCallAnswer` | POST `/api/call/answer` | calls | `/instances/:id/calls`<br>`calls/live` | form | planned: Frozen-scope reversible command is contract-planned for a later controlled real-write acceptance phase.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)<br>partial:N (Single-target command has no meaningful partial result.)<br>policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)<br>unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)<br>owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R1; none<br>direct | command-current-state/write-revision/version-probe/verify-write/route-result<br>Refresh current state when available and bind the actor decision to its revision.<br>Refresh current state or require an explicit recorded revision-bound override.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Writes require outcome verification before actor-initiated retry.<br>Structured result returns to the owning route with a redacted audit link. | REAL_WRITE_LATER | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:postCallAnswer`<br>`upstream:backend/src/main.rs:733-734`<br>`upstream:backend/src/handlers.rs:2762-2789`<br>`upstream:bruno-api/post_call_answer.bru:8`<br>`fixture:not-eligible-readonly-capture` |
|
|
|
|
|
| `getCallVolume` | GET `/api/call/volume` | calls | `/instances/:id/calls`<br>`calls/volume` | read-panel | planned: Frozen-scope read has two redacted captured responses; runtime support is still decided per registered instance.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Detail resource has no collection-empty rendering.)<br>partial:N (Atomic detail read has no meaningful partial rendering.)<br>policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)<br>unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)<br>owner-switch:Y (Owner switch discards responses with a mismatched instance key.) | R0; none<br>direct | query-capability/read-retain/version-probe/safe-read/route-result<br>Registered instance, authorized actor, and runtime capability decision are required.<br>Retain last success as stale and permit an explicit safe refresh.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Safe reads may retry within deadline and retain stale success.<br>Structured result returns to the owning route with a redacted audit link. | REAL_READ | captured-readonly; n=2; categories=success; collector-selected fully-bound GET R0; two redacted real captures | `registry:getCallVolume`<br>`upstream:backend/src/main.rs:737-738`<br>`upstream:backend/src/handlers.rs:2899-2906`<br>`upstream:bruno-api/get_call_volume.bru:8`<br>`fixture:captured-readonly` |
|
|
|
|
|
| `postCallVolume` | POST `/api/call/volume` | calls | `/instances/:id/calls`<br>`calls/volume` | form | planned: Frozen-scope reversible command is contract-planned for a later controlled real-write acceptance phase.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)<br>partial:N (Single-target command has no meaningful partial result.)<br>policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)<br>unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)<br>owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R1; none<br>direct | command-current-state/write-revision/version-probe/verify-write/route-result<br>Refresh current state when available and bind the actor decision to its revision.<br>Refresh current state or require an explicit recorded revision-bound override.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Writes require outcome verification before actor-initiated retry.<br>Structured result returns to the owning route with a redacted audit link. | REAL_WRITE_LATER | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:postCallVolume`<br>`upstream:backend/src/main.rs:737-739`<br>`upstream:backend/src/handlers.rs:2908-2922`<br>`upstream:bruno-api/set_call_volume.bru:8`<br>`fixture:not-eligible-readonly-capture` |
|
|
|
|
|
| `getCallForwarding` | GET `/api/call/forwarding` | calls | `/instances/:id/calls`<br>`calls/forwarding` | read-panel | planned: Frozen-scope read has two redacted captured responses; runtime support is still decided per registered instance.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Detail resource has no collection-empty rendering.)<br>partial:N (Atomic detail read has no meaningful partial rendering.)<br>policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)<br>unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)<br>owner-switch:Y (Owner switch discards responses with a mismatched instance key.) | R0; none<br>direct | query-capability/read-retain/version-probe/safe-read/route-result<br>Registered instance, authorized actor, and runtime capability decision are required.<br>Retain last success as stale and permit an explicit safe refresh.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Safe reads may retry within deadline and retain stale success.<br>Structured result returns to the owning route with a redacted audit link. | REAL_READ | captured-readonly; n=2; categories=success; collector-selected fully-bound GET R0; two redacted real captures | `registry:getCallForwarding`<br>`upstream:backend/src/main.rs:743-744`<br>`upstream:backend/src/handlers.rs:2924-2931`<br>`upstream:bruno-api/get_call_forwarding.bru:8`<br>`fixture:captured-readonly` |
|
|
|
|
|
| `postCallForwarding` | POST `/api/call/forwarding` | calls | `/instances/:id/calls`<br>`calls/forwarding` | form | planned: Frozen-scope reversible command is contract-planned for a later controlled real-write acceptance phase.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)<br>partial:N (Single-target command has no meaningful partial result.)<br>policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)<br>unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)<br>owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R1; none<br>direct | command-current-state/write-revision/version-probe/verify-write/route-result<br>Refresh current state when available and bind the actor decision to its revision.<br>Refresh current state or require an explicit recorded revision-bound override.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Writes require outcome verification before actor-initiated retry.<br>Structured result returns to the owning route with a redacted audit link. | REAL_WRITE_LATER | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:postCallForwarding`<br>`upstream:backend/src/main.rs:743-745`<br>`upstream:backend/src/handlers.rs:2933-2943`<br>`upstream:bruno-api/set_call_forwarding.bru:8`<br>`fixture:not-eligible-readonly-capture` |
|
|
|
|
|
| `getCallSettings` | GET `/api/call/settings` | calls | `/instances/:id/calls`<br>`calls/settings` | read-panel | planned: Frozen-scope read has two redacted captured responses; runtime support is still decided per registered instance.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Detail resource has no collection-empty rendering.)<br>partial:N (Atomic detail read has no meaningful partial rendering.)<br>policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)<br>unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)<br>owner-switch:Y (Owner switch discards responses with a mismatched instance key.) | R0; none<br>direct | query-capability/read-retain/version-probe/safe-read/route-result<br>Registered instance, authorized actor, and runtime capability decision are required.<br>Retain last success as stale and permit an explicit safe refresh.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Safe reads may retry within deadline and retain stale success.<br>Structured result returns to the owning route with a redacted audit link. | REAL_READ | captured-readonly; n=2; categories=success; collector-selected fully-bound GET R0; two redacted real captures | `registry:getCallSettings`<br>`upstream:backend/src/main.rs:749-750`<br>`upstream:backend/src/handlers.rs:2852-2866`<br>`upstream:bruno-api/get_call_settings.bru:8`<br>`fixture:captured-readonly` |
|
|
|
|
|
| `postCallSettings` | POST `/api/call/settings` | calls | `/instances/:id/calls`<br>`calls/settings` | job-action | planned: Frozen-scope high-risk operation is planned with simulation-only acceptance until controlled safety authorization exists.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)<br>partial:N (Single-target command has no meaningful partial result.)<br>policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)<br>unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)<br>owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R2; explicit<br>preparation-job | job-fresh-preflight/high-risk-block/version-probe/new-job-lineage/job-result<br>Required fresh preflight; inability to refresh blocks execution.<br>Fresh preflight is mandatory; stale, expired, or unknown state blocks execution.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Retry creates a new Job lineage (retryOfJobId/rootJobId); never replay successful items.<br>/jobs/:jobId contains per-item result, attempt lineage, and redacted audit. | SIMULATED_HIGH_RISK | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:postCallSettings`<br>`upstream:backend/src/main.rs:749-751`<br>`upstream:backend/src/handlers.rs:2868-2897`<br>`upstream:bruno-api/set_call_settings.bru:8`<br>`fixture:not-eligible-readonly-capture` |
|
|
|
|
|
| `getCallHistory` | GET `/api/call/history` | calls | `/instances/:id/calls`<br>`calls/history` | table | planned: Frozen-scope read is modeled but real capture was explicitly denied; runtime support is probed per instance.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:Y (Successful collection may contain no rows.)<br>partial:Y (Independent response sections may succeed or fail.)<br>policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)<br>unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)<br>owner-switch:Y (Owner switch discards responses with a mismatched instance key.) | R0; none<br>direct | query-capability/read-retain/version-probe/safe-read/route-result<br>Registered instance, authorized actor, and runtime capability decision are required.<br>Retain last success as stale and permit an explicit safe refresh.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Safe reads may retry within deadline and retain stale success.<br>Structured result returns to the owning route with a redacted audit link. | REAL_READ_DEFERRED | denied-readonly-candidate; n=0; categories=none; query limit is not encoded in Registry path contract | `registry:getCallHistory`<br>`upstream:backend/src/main.rs:755-756`<br>`upstream:backend/src/handlers.rs:2791-2813`<br>`fixture:denied-readonly-candidate` |
|
|
|
|
|
| `deleteCallHistoryId` | DELETE `/api/call/history/{id}` | calls | `/instances/:id/calls`<br>`calls/history` | job-action | planned: Frozen-scope high-risk operation is planned with simulation-only acceptance until controlled safety authorization exists.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)<br>partial:N (Single-target command has no meaningful partial result.)<br>policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)<br>unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)<br>owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R3; strong<br>preparation-job | job-fresh-preflight/high-risk-block/version-probe/new-job-lineage/job-result<br>Required fresh preflight; inability to refresh blocks execution.<br>Fresh preflight is mandatory; stale, expired, or unknown state blocks execution.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Retry creates a new Job lineage (retryOfJobId/rootJobId); never replay successful items.<br>/jobs/:jobId contains per-item result, attempt lineage, and redacted audit. | SIMULATED_HIGH_RISK | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:deleteCallHistoryId`<br>`upstream:backend/src/main.rs:759-760`<br>`upstream:backend/src/handlers.rs:2815-2832`<br>`upstream:bruno-api/delete_call_history.bru:8`<br>`fixture:not-eligible-readonly-capture` |
|
|
|
|
|
| `postCallHistoryClear` | POST `/api/call/history/clear` | calls | `/instances/:id/calls`<br>`calls/history` | job-action | planned: Frozen-scope high-risk operation is planned with simulation-only acceptance until controlled safety authorization exists.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)<br>partial:N (Single-target command has no meaningful partial result.)<br>policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)<br>unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)<br>owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R3; strong<br>preparation-job | job-fresh-preflight/high-risk-block/version-probe/new-job-lineage/job-result<br>Required fresh preflight; inability to refresh blocks execution.<br>Fresh preflight is mandatory; stale, expired, or unknown state blocks execution.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Retry creates a new Job lineage (retryOfJobId/rootJobId); never replay successful items.<br>/jobs/:jobId contains per-item result, attempt lineage, and redacted audit. | SIMULATED_HIGH_RISK | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:postCallHistoryClear`<br>`upstream:backend/src/main.rs:763-764`<br>`upstream:backend/src/handlers.rs:2834-2850`<br>`upstream:bruno-api/clear_call_history.bru:8`<br>`fixture:not-eligible-readonly-capture` |
|
|
|
|
|
| `getImsStatus` | GET `/api/ims/status` | calls | `/instances/:id/calls`<br>`calls/ims-voicemail` | read-panel | planned: Frozen-scope read has two redacted captured responses; runtime support is still decided per registered instance.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Detail resource has no collection-empty rendering.)<br>partial:N (Atomic detail read has no meaningful partial rendering.)<br>policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)<br>unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)<br>owner-switch:Y (Owner switch discards responses with a mismatched instance key.) | R0; none<br>direct | query-capability/read-retain/version-probe/safe-read/route-result<br>Registered instance, authorized actor, and runtime capability decision are required.<br>Retain last success as stale and permit an explicit safe refresh.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Safe reads may retry within deadline and retain stale success.<br>Structured result returns to the owning route with a redacted audit link. | REAL_READ | captured-readonly; n=2; categories=success; collector-selected fully-bound GET R0; two redacted real captures | `registry:getImsStatus`<br>`upstream:backend/src/main.rs:767-768`<br>`upstream:backend/src/handlers.rs:2945-2952`<br>`upstream:bruno-api/get_ims_status.bru:8`<br>`fixture:captured-readonly` |
|
|
|
|
|
| `getVoicemailStatus` | GET `/api/voicemail/status` | calls | `/instances/:id/calls`<br>`calls/ims-voicemail` | read-panel | planned: Frozen-scope read has two redacted captured responses; runtime support is still decided per registered instance.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Detail resource has no collection-empty rendering.)<br>partial:N (Atomic detail read has no meaningful partial rendering.)<br>policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)<br>unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)<br>owner-switch:Y (Owner switch discards responses with a mismatched instance key.) | R0; none<br>direct | query-capability/read-retain/version-probe/safe-read/route-result<br>Registered instance, authorized actor, and runtime capability decision are required.<br>Retain last success as stale and permit an explicit safe refresh.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Safe reads may retry within deadline and retain stale success.<br>Structured result returns to the owning route with a redacted audit link. | REAL_READ | captured-readonly; n=2; categories=success; collector-selected fully-bound GET R0; two redacted real captures | `registry:getVoicemailStatus`<br>`upstream:backend/src/main.rs:771-772`<br>`upstream:backend/src/handlers.rs:2954-2961`<br>`upstream:bruno-api/get_voicemail_status.bru:8`<br>`fixture:captured-readonly` |
|
|
|
|
|
| `postSmsSend` | POST `/api/sms/send` | messages | `/instances/:id/messages`<br>`messages/compose` | job-action | planned: Frozen-scope high-risk operation is planned with simulation-only acceptance until controlled safety authorization exists.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)<br>partial:N (Single-target command has no meaningful partial result.)<br>policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)<br>unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)<br>owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R2; explicit<br>preparation-job | job-fresh-preflight/high-risk-block/version-probe/new-job-lineage/job-result<br>Required fresh preflight; inability to refresh blocks execution.<br>Fresh preflight is mandatory; stale, expired, or unknown state blocks execution.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Retry creates a new Job lineage (retryOfJobId/rootJobId); never replay successful items.<br>/jobs/:jobId contains per-item result, attempt lineage, and redacted audit. | SIMULATED_HIGH_RISK | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:postSmsSend`<br>`upstream:backend/src/main.rs:776-777`<br>`upstream:backend/src/handlers.rs:2373-2404`<br>`upstream:bruno-api/post_sms_send.bru:8`<br>`fixture:not-eligible-readonly-capture` |
|
|
|
|
|
| `getSmsList` | GET `/api/sms/list` | messages | `/instances/:id/messages`<br>`messages/list` | table | planned: Frozen-scope read is modeled but real capture was explicitly denied; runtime support is probed per instance.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:Y (Successful collection may contain no rows.)<br>partial:Y (Independent response sections may succeed or fail.)<br>policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)<br>unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)<br>owner-switch:Y (Owner switch discards responses with a mismatched instance key.) | R0; none<br>direct | query-capability/read-retain/version-probe/safe-read/route-result<br>Registered instance, authorized actor, and runtime capability decision are required.<br>Retain last success as stale and permit an explicit safe refresh.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Safe reads may retry within deadline and retain stale success.<br>Structured result returns to the owning route with a redacted audit link. | REAL_READ_DEFERRED | denied-readonly-candidate; n=0; categories=none; message list can expose body; intentionally not collected | `registry:getSmsList`<br>`upstream:backend/src/main.rs:780-781`<br>`upstream:backend/src/handlers.rs:2407-2434`<br>`fixture:denied-readonly-candidate` |
|
|
|
|
|
| `getSmsConversation` | GET `/api/sms/conversation` | messages | `/instances/:id/messages`<br>`messages/conversation` | table | planned: Frozen-scope read is modeled but real capture was explicitly denied; runtime support is probed per instance.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:Y (Successful collection may contain no rows.)<br>partial:Y (Independent response sections may succeed or fail.)<br>policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)<br>unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)<br>owner-switch:Y (Owner switch discards responses with a mismatched instance key.) | R0; none<br>direct | query-capability/read-retain/version-probe/safe-read/route-result<br>Registered instance, authorized actor, and runtime capability decision are required.<br>Retain last success as stale and permit an explicit safe refresh.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Safe reads may retry within deadline and retain stale success.<br>Structured result returns to the owning route with a redacted audit link. | REAL_READ_DEFERRED | denied-readonly-candidate; n=0; categories=none; requires correspondent query and exposes message bodies | `registry:getSmsConversation`<br>`upstream:backend/src/main.rs:784-785`<br>`upstream:backend/src/handlers.rs:2437-2458`<br>`fixture:denied-readonly-candidate` |
|
|
|
|
|
| `getSmsStats` | GET `/api/sms/stats` | messages | `/instances/:id/messages`<br>`messages/stats` | read-panel | planned: Frozen-scope read has two redacted captured responses; runtime support is still decided per registered instance.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Detail resource has no collection-empty rendering.)<br>partial:N (Atomic detail read has no meaningful partial rendering.)<br>policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)<br>unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)<br>owner-switch:Y (Owner switch discards responses with a mismatched instance key.) | R0; none<br>direct | query-capability/read-retain/version-probe/safe-read/route-result<br>Registered instance, authorized actor, and runtime capability decision are required.<br>Retain last success as stale and permit an explicit safe refresh.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Safe reads may retry within deadline and retain stale success.<br>Structured result returns to the owning route with a redacted audit link. | REAL_READ | captured-readonly; n=2; categories=success; collector-selected fully-bound GET R0; two redacted real captures | `registry:getSmsStats`<br>`upstream:backend/src/main.rs:788-789`<br>`upstream:backend/src/handlers.rs:2461-2477`<br>`upstream:bruno-api/get_sms_stats.bru:8`<br>`fixture:captured-readonly` |
|
|
|
|
|
| `postSmsBatchDelete` | POST `/api/sms/batch-delete` | messages | `/instances/:id/messages`<br>`messages/destructive` | job-action | planned: Frozen-scope high-risk operation is planned with simulation-only acceptance until controlled safety authorization exists.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)<br>partial:Y (Job items may independently succeed, fail, or be skipped.)<br>policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)<br>unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)<br>owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R3; strong<br>preparation-job | job-fresh-preflight/high-risk-block/version-probe/new-job-lineage/job-result<br>Required fresh preflight; inability to refresh blocks execution.<br>Fresh preflight is mandatory; stale, expired, or unknown state blocks execution.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Retry creates a new Job lineage (retryOfJobId/rootJobId); never replay successful items.<br>/jobs/:jobId contains per-item result, attempt lineage, and redacted audit. | SIMULATED_HIGH_RISK | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:postSmsBatchDelete`<br>`upstream:backend/src/main.rs:792-793`<br>`upstream:backend/src/handlers.rs:2551-2578`<br>`fixture:not-eligible-readonly-capture` |
|
|
|
|
|
| `deleteSmsConversationPhoneNumber` | DELETE `/api/sms/conversation/{phone_number}` | messages | `/instances/:id/messages`<br>`messages/destructive` | job-action | planned: Frozen-scope high-risk operation is planned with simulation-only acceptance until controlled safety authorization exists.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)<br>partial:N (Single-target command has no meaningful partial result.)<br>policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)<br>unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)<br>owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R3; strong<br>preparation-job | job-fresh-preflight/high-risk-block/version-probe/new-job-lineage/job-result<br>Required fresh preflight; inability to refresh blocks execution.<br>Fresh preflight is mandatory; stale, expired, or unknown state blocks execution.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Retry creates a new Job lineage (retryOfJobId/rootJobId); never replay successful items.<br>/jobs/:jobId contains per-item result, attempt lineage, and redacted audit. | SIMULATED_HIGH_RISK | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:deleteSmsConversationPhoneNumber`<br>`upstream:backend/src/main.rs:796-797`<br>`upstream:backend/src/handlers.rs:2528-2548`<br>`fixture:not-eligible-readonly-capture` |
|
|
|
|
|
| `deleteSmsMessageId` | DELETE `/api/sms/message/{id}` | messages | `/instances/:id/messages`<br>`messages/destructive` | job-action | planned: Frozen-scope high-risk operation is planned with simulation-only acceptance until controlled safety authorization exists.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)<br>partial:N (Single-target command has no meaningful partial result.)<br>policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)<br>unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)<br>owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R3; strong<br>preparation-job | job-fresh-preflight/high-risk-block/version-probe/new-job-lineage/job-result<br>Required fresh preflight; inability to refresh blocks execution.<br>Fresh preflight is mandatory; stale, expired, or unknown state blocks execution.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Retry creates a new Job lineage (retryOfJobId/rootJobId); never replay successful items.<br>/jobs/:jobId contains per-item result, attempt lineage, and redacted audit. | SIMULATED_HIGH_RISK | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:deleteSmsMessageId`<br>`upstream:backend/src/main.rs:800-801`<br>`upstream:backend/src/handlers.rs:2508-2525`<br>`fixture:not-eligible-readonly-capture` |
|
|
|
|
|
| `postSmsClear` | POST `/api/sms/clear` | messages | `/instances/:id/messages`<br>`messages/destructive` | job-action | planned: Frozen-scope high-risk operation is planned with simulation-only acceptance until controlled safety authorization exists.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)<br>partial:N (Single-target command has no meaningful partial result.)<br>policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)<br>unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)<br>owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R3; strong<br>preparation-job | job-fresh-preflight/high-risk-block/version-probe/new-job-lineage/job-result<br>Required fresh preflight; inability to refresh blocks execution.<br>Fresh preflight is mandatory; stale, expired, or unknown state blocks execution.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Retry creates a new Job lineage (retryOfJobId/rootJobId); never replay successful items.<br>/jobs/:jobId contains per-item result, attempt lineage, and redacted audit. | SIMULATED_HIGH_RISK | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:postSmsClear`<br>`upstream:backend/src/main.rs:804-805`<br>`upstream:backend/src/handlers.rs:2480-2505`<br>`upstream:bruno-api/post_sms_clear.bru:8`<br>`fixture:not-eligible-readonly-capture` |
|
|
|
|
|
| `getStats` | GET `/api/stats` | device-system | `/instances/:id/overview`<br>`overview/stats` | read-panel | planned: Frozen-scope read has two redacted captured responses; runtime support is still decided per registered instance.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Detail resource has no collection-empty rendering.)<br>partial:Y (Independent response sections may succeed or fail.)<br>policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)<br>unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)<br>owner-switch:Y (Owner switch discards responses with a mismatched instance key.) | R0; none<br>direct | command-current-state/read-retain/version-probe/safe-read/route-result<br>Refresh current state when available and bind the actor decision to its revision.<br>Retain last success as stale and permit an explicit safe refresh.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Safe reads may retry within deadline and retain stale success.<br>Structured result returns to the owning route with a redacted audit link. | REAL_READ | captured-readonly; n=2; categories=success; collector-selected fully-bound GET R0; two redacted real captures | `registry:getStats`<br>`upstream:backend/src/main.rs:808-808`<br>`upstream:backend/src/handlers.rs:3272-3288`<br>`upstream:bruno-api/get_stats.bru:8`<br>`fixture:captured-readonly` |
|
|
|
|
|
| `getStatsCpu` | GET `/api/stats/cpu` | device-system | `/instances/:id/overview`<br>`overview/stats` | read-panel | planned: Frozen-scope read has two redacted captured responses; runtime support is still decided per registered instance.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Detail resource has no collection-empty rendering.)<br>partial:Y (Independent response sections may succeed or fail.)<br>policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)<br>unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)<br>owner-switch:Y (Owner switch discards responses with a mismatched instance key.) | R0; none<br>direct | command-current-state/read-retain/version-probe/safe-read/route-result<br>Refresh current state when available and bind the actor decision to its revision.<br>Retain last success as stale and permit an explicit safe refresh.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Safe reads may retry within deadline and retain stale success.<br>Structured result returns to the owning route with a redacted audit link. | REAL_READ | captured-readonly; n=2; categories=success; collector-selected fully-bound GET R0; two redacted real captures | `registry:getStatsCpu`<br>`upstream:backend/src/main.rs:809-809`<br>`upstream:backend/src/handlers.rs:3291-3302`<br>`upstream:bruno-api/get_cpu_info.bru:8`<br>`fixture:captured-readonly` |
|
|
|
|
|
| `getConnectivity` | GET `/api/connectivity` | device-system | `/instances/:id/overview`<br>`overview/auth-health` | read-panel | planned: Frozen-scope read is modeled but real capture was explicitly denied; runtime support is probed per instance.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Detail resource has no collection-empty rendering.)<br>partial:Y (Independent response sections may succeed or fail.)<br>policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)<br>unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)<br>owner-switch:Y (Owner switch discards responses with a mismatched instance key.) | R0; none<br>direct | command-current-state/read-retain/version-probe/safe-read/route-result<br>Refresh current state when available and bind the actor decision to its revision.<br>Retain last success as stale and permit an explicit safe refresh.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Safe reads may retry within deadline and retain stale success.<br>Structured result returns to the owning route with a redacted audit link. | REAL_READ_DEFERRED | denied-readonly-candidate; n=0; categories=none; handler performs active connectivity ping | `registry:getConnectivity`<br>`upstream:backend/src/main.rs:811-812`<br>`upstream:backend/src/handlers.rs:3305-3322`<br>`fixture:denied-readonly-candidate` |
|
|
|
|
|
| `postSystemReboot` | POST `/api/system/reboot` | device-system | `/instances/:id/overview`<br>`overview/system-actions` | job-action | planned: Frozen-scope high-risk operation is planned with simulation-only acceptance until controlled safety authorization exists.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)<br>partial:N (Single-target command has no meaningful partial result.)<br>policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)<br>unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)<br>owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R3; strong<br>preparation-job | job-fresh-preflight/high-risk-block/version-probe/new-job-lineage/job-result<br>Required fresh preflight; inability to refresh blocks execution.<br>Fresh preflight is mandatory; stale, expired, or unknown state blocks execution.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Retry creates a new Job lineage (retryOfJobId/rootJobId); never replay successful items.<br>/jobs/:jobId contains per-item result, attempt lineage, and redacted audit. | SIMULATED_HIGH_RISK | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:postSystemReboot`<br>`upstream:backend/src/main.rs:815-816`<br>`upstream:backend/src/handlers.rs:3381-3406`<br>`upstream:bruno-api/post_system_reboot.bru:8`<br>`fixture:not-eligible-readonly-capture` |
|
|
|
|
|
| `postServiceRestart` | POST `/api/service/restart` | device-system | `/instances/:id/overview`<br>`overview/system-actions` | job-action | planned: Frozen-scope high-risk operation is planned with simulation-only acceptance until controlled safety authorization exists.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)<br>partial:N (Single-target command has no meaningful partial result.)<br>policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)<br>unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)<br>owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R3; strong<br>preparation-job | job-fresh-preflight/high-risk-block/version-probe/new-job-lineage/job-result<br>Required fresh preflight; inability to refresh blocks execution.<br>Fresh preflight is mandatory; stale, expired, or unknown state blocks execution.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Retry creates a new Job lineage (retryOfJobId/rootJobId); never replay successful items.<br>/jobs/:jobId contains per-item result, attempt lineage, and redacted audit. | SIMULATED_HIGH_RISK | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:postServiceRestart`<br>`upstream:backend/src/main.rs:819-820`<br>`upstream:backend/src/handlers.rs:3578-3601`<br>`fixture:not-eligible-readonly-capture` |
|
|
|
|
|
| `getNotificationsConfig` | GET `/api/notifications/config` | notifications | `/instances/:id/notifications`<br>`notifications/config` | read-panel | planned: Frozen-scope read has two redacted captured responses; runtime support is still decided per registered instance.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Detail resource has no collection-empty rendering.)<br>partial:N (Atomic detail read has no meaningful partial rendering.)<br>policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)<br>unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)<br>owner-switch:Y (Owner switch discards responses with a mismatched instance key.) | R0; none<br>direct | query-capability/read-retain/version-probe/safe-read/route-result<br>Registered instance, authorized actor, and runtime capability decision are required.<br>Retain last success as stale and permit an explicit safe refresh.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Safe reads may retry within deadline and retain stale success.<br>Structured result returns to the owning route with a redacted audit link. | REAL_READ | captured-readonly; n=2; categories=success; collector-selected fully-bound GET R0; two redacted real captures | `registry:getNotificationsConfig`<br>`upstream:backend/src/main.rs:824-825`<br>`upstream:backend/src/handlers.rs:3641-3652`<br>`upstream:bruno-api/get_notification_config.bru:8`<br>`fixture:captured-readonly` |
|
|
|
|
|
| `postNotificationsConfig` | POST `/api/notifications/config` | notifications | `/instances/:id/notifications`<br>`notifications/config` | job-action | planned: Frozen-scope high-risk operation is planned with simulation-only acceptance until controlled safety authorization exists.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)<br>partial:N (Single-target command has no meaningful partial result.)<br>policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)<br>unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)<br>owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R2; explicit<br>preparation-job | job-fresh-preflight/high-risk-block/version-probe/new-job-lineage/job-result<br>Required fresh preflight; inability to refresh blocks execution.<br>Fresh preflight is mandatory; stale, expired, or unknown state blocks execution.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Retry creates a new Job lineage (retryOfJobId/rootJobId); never replay successful items.<br>/jobs/:jobId contains per-item result, attempt lineage, and redacted audit. | SIMULATED_HIGH_RISK | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:postNotificationsConfig`<br>`upstream:backend/src/main.rs:824-826`<br>`upstream:backend/src/handlers.rs:3655-3672`<br>`upstream:bruno-api/set_notification_config.bru:8`<br>`fixture:not-eligible-readonly-capture` |
|
|
|
|
|
| `postNotificationsTestChannel` | POST `/api/notifications/test/{channel}` | notifications | `/instances/:id/notifications`<br>`notifications/config` | job-action | planned: Frozen-scope high-risk operation is planned with simulation-only acceptance until controlled safety authorization exists.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)<br>partial:N (Single-target command has no meaningful partial result.)<br>policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)<br>unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)<br>owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R2; explicit<br>preparation-job | job-fresh-preflight/high-risk-block/version-probe/new-job-lineage/job-result<br>Required fresh preflight; inability to refresh blocks execution.<br>Fresh preflight is mandatory; stale, expired, or unknown state blocks execution.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Retry creates a new Job lineage (retryOfJobId/rootJobId); never replay successful items.<br>/jobs/:jobId contains per-item result, attempt lineage, and redacted audit. | SIMULATED_HIGH_RISK | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:postNotificationsTestChannel`<br>`upstream:backend/src/main.rs:830-831`<br>`upstream:backend/src/handlers.rs:3675-3704`<br>`fixture:not-eligible-readonly-capture` |
|
|
|
|
|
| `getNotificationsLogs` | GET `/api/notifications/logs` | notifications | `/instances/:id/notifications`<br>`notifications/logs` | table | planned: Frozen-scope read is modeled but real capture was explicitly denied; runtime support is probed per instance.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:Y (Successful collection may contain no rows.)<br>partial:Y (Independent response sections may succeed or fail.)<br>policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)<br>unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)<br>owner-switch:Y (Owner switch discards responses with a mismatched instance key.) | R0; none<br>direct | query-capability/read-retain/version-probe/safe-read/route-result<br>Registered instance, authorized actor, and runtime capability decision are required.<br>Retain last success as stale and permit an explicit safe refresh.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Safe reads may retry within deadline and retain stale success.<br>Structured result returns to the owning route with a redacted audit link. | REAL_READ_DEFERRED | denied-readonly-candidate; n=0; categories=none; query limit is not encoded in Registry path contract | `registry:getNotificationsLogs`<br>`upstream:backend/src/main.rs:835-836`<br>`upstream:backend/src/handlers.rs:3709-3734`<br>`fixture:denied-readonly-candidate` |
|
|
|
|
|
| `postNotificationsLogsClear` | POST `/api/notifications/logs/clear` | notifications | `/instances/:id/notifications`<br>`notifications/logs` | job-action | planned: Frozen-scope high-risk operation is planned with simulation-only acceptance until controlled safety authorization exists.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)<br>partial:N (Single-target command has no meaningful partial result.)<br>policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)<br>unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)<br>owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R3; strong<br>preparation-job | job-fresh-preflight/high-risk-block/version-probe/new-job-lineage/job-result<br>Required fresh preflight; inability to refresh blocks execution.<br>Fresh preflight is mandatory; stale, expired, or unknown state blocks execution.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Retry creates a new Job lineage (retryOfJobId/rootJobId); never replay successful items.<br>/jobs/:jobId contains per-item result, attempt lineage, and redacted audit. | SIMULATED_HIGH_RISK | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:postNotificationsLogsClear`<br>`upstream:backend/src/main.rs:839-840`<br>`upstream:backend/src/handlers.rs:3737-3760`<br>`fixture:not-eligible-readonly-capture` |
|
|
|
|
|
| `getNotificationsQueue` | GET `/api/notifications/queue` | notifications | `/instances/:id/notifications`<br>`notifications/queue` | table | planned: Frozen-scope read is modeled but real capture was explicitly denied; runtime support is probed per instance.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:Y (Successful collection may contain no rows.)<br>partial:Y (Independent response sections may succeed or fail.)<br>policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)<br>unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)<br>owner-switch:Y (Owner switch discards responses with a mismatched instance key.) | R0; none<br>direct | query-capability/read-retain/version-probe/safe-read/route-result<br>Registered instance, authorized actor, and runtime capability decision are required.<br>Retain last success as stale and permit an explicit safe refresh.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Safe reads may retry within deadline and retain stale success.<br>Structured result returns to the owning route with a redacted audit link. | REAL_READ_DEFERRED | denied-readonly-candidate; n=0; categories=none; query limit is not encoded in Registry path contract | `registry:getNotificationsQueue`<br>`upstream:backend/src/main.rs:843-844`<br>`upstream:backend/src/notification_queue.rs:24-41`<br>`fixture:denied-readonly-candidate` |
|
|
|
|
|
| `postNotificationsQueueRetryAll` | POST `/api/notifications/queue/retry-all` | notifications | `/instances/:id/notifications`<br>`notifications/queue` | job-action | planned: Frozen-scope high-risk operation is planned with simulation-only acceptance until controlled safety authorization exists.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)<br>partial:Y (Job items may independently succeed, fail, or be skipped.)<br>policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)<br>unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)<br>owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R2; explicit<br>preparation-job | job-fresh-preflight/high-risk-block/version-probe/new-job-lineage/job-result<br>Required fresh preflight; inability to refresh blocks execution.<br>Fresh preflight is mandatory; stale, expired, or unknown state blocks execution.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Retry creates a new Job lineage (retryOfJobId/rootJobId); never replay successful items.<br>/jobs/:jobId contains per-item result, attempt lineage, and redacted audit. | SIMULATED_HIGH_RISK | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:postNotificationsQueueRetryAll`<br>`upstream:backend/src/main.rs:847-848`<br>`upstream:backend/src/notification_queue.rs:84-100`<br>`fixture:not-eligible-readonly-capture` |
|
|
|
|
|
| `postNotificationsQueueClear` | POST `/api/notifications/queue/clear` | notifications | `/instances/:id/notifications`<br>`notifications/queue` | job-action | planned: Frozen-scope high-risk operation is planned with simulation-only acceptance until controlled safety authorization exists.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)<br>partial:Y (Job items may independently succeed, fail, or be skipped.)<br>policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)<br>unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)<br>owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R3; strong<br>preparation-job | job-fresh-preflight/high-risk-block/version-probe/new-job-lineage/job-result<br>Required fresh preflight; inability to refresh blocks execution.<br>Fresh preflight is mandatory; stale, expired, or unknown state blocks execution.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Retry creates a new Job lineage (retryOfJobId/rootJobId); never replay successful items.<br>/jobs/:jobId contains per-item result, attempt lineage, and redacted audit. | SIMULATED_HIGH_RISK | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:postNotificationsQueueClear`<br>`upstream:backend/src/main.rs:851-852`<br>`upstream:backend/src/notification_queue.rs:103-119`<br>`fixture:not-eligible-readonly-capture` |
|
|
|
|
|
| `deleteNotificationsQueueId` | DELETE `/api/notifications/queue/{id}` | notifications | `/instances/:id/notifications`<br>`notifications/queue` | job-action | planned: Frozen-scope high-risk operation is planned with simulation-only acceptance until controlled safety authorization exists.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)<br>partial:N (Single-target command has no meaningful partial result.)<br>policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)<br>unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)<br>owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R3; strong<br>preparation-job | job-fresh-preflight/high-risk-block/version-probe/new-job-lineage/job-result<br>Required fresh preflight; inability to refresh blocks execution.<br>Fresh preflight is mandatory; stale, expired, or unknown state blocks execution.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Retry creates a new Job lineage (retryOfJobId/rootJobId); never replay successful items.<br>/jobs/:jobId contains per-item result, attempt lineage, and redacted audit. | SIMULATED_HIGH_RISK | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:deleteNotificationsQueueId`<br>`upstream:backend/src/main.rs:855-856`<br>`upstream:backend/src/notification_queue.rs:64-81`<br>`fixture:not-eligible-readonly-capture` |
|
|
|
|
|
| `postNotificationsQueueIdRetry` | POST `/api/notifications/queue/{id}/retry` | notifications | `/instances/:id/notifications`<br>`notifications/queue` | job-action | planned: Frozen-scope high-risk operation is planned with simulation-only acceptance until controlled safety authorization exists.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)<br>partial:N (Single-target command has no meaningful partial result.)<br>policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)<br>unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)<br>owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R2; explicit<br>preparation-job | job-fresh-preflight/high-risk-block/version-probe/new-job-lineage/job-result<br>Required fresh preflight; inability to refresh blocks execution.<br>Fresh preflight is mandatory; stale, expired, or unknown state blocks execution.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Retry creates a new Job lineage (retryOfJobId/rootJobId); never replay successful items.<br>/jobs/:jobId contains per-item result, attempt lineage, and redacted audit. | SIMULATED_HIGH_RISK | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:postNotificationsQueueIdRetry`<br>`upstream:backend/src/main.rs:859-860`<br>`upstream:backend/src/notification_queue.rs:44-61`<br>`fixture:not-eligible-readonly-capture` |
|
|
|
|
|
| `getAutomationConfig` | GET `/api/automation/config` | automation | `/instances/:id/automation`<br>`automation/config` | read-panel | planned: Frozen-scope read has two redacted captured responses; runtime support is still decided per registered instance.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Detail resource has no collection-empty rendering.)<br>partial:N (Atomic detail read has no meaningful partial rendering.)<br>policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)<br>unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)<br>owner-switch:Y (Owner switch discards responses with a mismatched instance key.) | R0; none<br>direct | query-capability/read-retain/version-probe/safe-read/route-result<br>Registered instance, authorized actor, and runtime capability decision are required.<br>Retain last success as stale and permit an explicit safe refresh.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Safe reads may retry within deadline and retain stale success.<br>Structured result returns to the owning route with a redacted audit link. | REAL_READ | captured-readonly; n=2; categories=unsupported; collector-selected fully-bound GET R0; two redacted real captures | `registry:getAutomationConfig`<br>`upstream:backend/src/main.rs:864-865`<br>`upstream:backend/src/handlers.rs:3968-3979`<br>`fixture:captured-readonly` |
|
|
|
|
|
| `postAutomationConfig` | POST `/api/automation/config` | automation | `/instances/:id/automation`<br>`automation/config` | job-action | planned: Frozen-scope high-risk operation is planned with simulation-only acceptance until controlled safety authorization exists.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)<br>partial:N (Single-target command has no meaningful partial result.)<br>policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)<br>unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)<br>owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R2; explicit<br>preparation-job | job-fresh-preflight/high-risk-block/version-probe/new-job-lineage/job-result<br>Required fresh preflight; inability to refresh blocks execution.<br>Fresh preflight is mandatory; stale, expired, or unknown state blocks execution.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Retry creates a new Job lineage (retryOfJobId/rootJobId); never replay successful items.<br>/jobs/:jobId contains per-item result, attempt lineage, and redacted audit. | SIMULATED_HIGH_RISK | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:postAutomationConfig`<br>`upstream:backend/src/main.rs:864-866`<br>`upstream:backend/src/handlers.rs:3982-3999`<br>`fixture:not-eligible-readonly-capture` |
|
|
|
|
|
| `getAutomationLogs` | GET `/api/automation/logs` | automation | `/instances/:id/automation`<br>`automation/logs` | table | planned: Frozen-scope read is modeled but real capture was explicitly denied; runtime support is probed per instance.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:Y (Successful collection may contain no rows.)<br>partial:Y (Independent response sections may succeed or fail.)<br>policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)<br>unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)<br>owner-switch:Y (Owner switch discards responses with a mismatched instance key.) | R0; none<br>direct | query-capability/read-retain/version-probe/safe-read/route-result<br>Registered instance, authorized actor, and runtime capability decision are required.<br>Retain last success as stale and permit an explicit safe refresh.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Safe reads may retry within deadline and retain stale success.<br>Structured result returns to the owning route with a redacted audit link. | REAL_READ_DEFERRED | denied-readonly-candidate; n=0; categories=none; query limit is not encoded in Registry path contract | `registry:getAutomationLogs`<br>`upstream:backend/src/main.rs:870-871`<br>`upstream:backend/src/handlers.rs:4002-4027`<br>`fixture:denied-readonly-candidate` |
|
|
|
|
|
| `postAutomationLogsClear` | POST `/api/automation/logs/clear` | automation | `/instances/:id/automation`<br>`automation/logs` | job-action | planned: Frozen-scope high-risk operation is planned with simulation-only acceptance until controlled safety authorization exists.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)<br>partial:N (Single-target command has no meaningful partial result.)<br>policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)<br>unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)<br>owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R3; strong<br>preparation-job | job-fresh-preflight/high-risk-block/version-probe/new-job-lineage/job-result<br>Required fresh preflight; inability to refresh blocks execution.<br>Fresh preflight is mandatory; stale, expired, or unknown state blocks execution.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Retry creates a new Job lineage (retryOfJobId/rootJobId); never replay successful items.<br>/jobs/:jobId contains per-item result, attempt lineage, and redacted audit. | SIMULATED_HIGH_RISK | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:postAutomationLogsClear`<br>`upstream:backend/src/main.rs:874-875`<br>`upstream:backend/src/handlers.rs:4030-4053`<br>`fixture:not-eligible-readonly-capture` |
|
|
|
|
|
| `postAutomationTestTaskId` | POST `/api/automation/test/{task_id}` | automation | `/instances/:id/automation`<br>`automation/task-test` | job-action | planned: Frozen-scope high-risk operation is planned with simulation-only acceptance until controlled safety authorization exists.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)<br>partial:N (Single-target command has no meaningful partial result.)<br>policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)<br>unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)<br>owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R2; explicit<br>preparation-job | job-fresh-preflight/high-risk-block/version-probe/new-job-lineage/job-result<br>Required fresh preflight; inability to refresh blocks execution.<br>Fresh preflight is mandatory; stale, expired, or unknown state blocks execution.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Retry creates a new Job lineage (retryOfJobId/rootJobId); never replay successful items.<br>/jobs/:jobId contains per-item result, attempt lineage, and redacted audit. | SIMULATED_HIGH_RISK | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:postAutomationTestTaskId`<br>`upstream:backend/src/main.rs:878-879`<br>`upstream:backend/src/handlers.rs:4056-4146`<br>`fixture:not-eligible-readonly-capture` |
|
|
|
|
|
| `getOtaStatus` | GET `/api/ota/status` | ota | `/instances/:id/ota`<br>`ota/status` | read-panel | planned: Frozen-scope read has two redacted captured responses; runtime support is still decided per registered instance.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Detail resource has no collection-empty rendering.)<br>partial:N (Atomic detail read has no meaningful partial rendering.)<br>policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)<br>unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)<br>owner-switch:Y (Owner switch discards responses with a mismatched instance key.) | R0; none<br>direct | query-capability/read-retain/version-probe/safe-read/route-result<br>Registered instance, authorized actor, and runtime capability decision are required.<br>Retain last success as stale and permit an explicit safe refresh.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Safe reads may retry within deadline and retain stale success.<br>Structured result returns to the owning route with a redacted audit link. | REAL_READ | captured-readonly; n=2; categories=success; collector-selected fully-bound GET R0; two redacted real captures | `registry:getOtaStatus`<br>`upstream:backend/src/main.rs:882-883`<br>`upstream:backend/src/handlers.rs:3763-3769`<br>`upstream:bruno-api/get_ota_status.bru:8`<br>`fixture:captured-readonly` |
|
|
|
|
|
| `postOtaUpload` | POST `/api/ota/upload` | ota | `/instances/:id/ota`<br>`ota/upload` | dedicated-upload-flow | planned: Frozen-scope high-risk operation is planned with simulation-only acceptance until controlled safety authorization exists.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)<br>partial:N (Single-target command has no meaningful partial result.)<br>policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)<br>unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)<br>owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R3; strong<br>preparation-job | job-fresh-preflight/high-risk-block/ota-version-probe/new-job-lineage/job-result<br>Required fresh preflight; inability to refresh blocks execution.<br>Fresh preflight is mandatory; stale, expired, or unknown state blocks execution.<br>OTA 404/405/501 is frozen-version evidence; preserve release/status probe context and never infer global support.<br>Retry creates a new Job lineage (retryOfJobId/rootJobId); never replay successful items.<br>/jobs/:jobId contains per-item result, attempt lineage, and redacted audit. | SIMULATED_HIGH_RISK | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:postOtaUpload`<br>`upstream:backend/src/main.rs:886-887`<br>`upstream:backend/src/handlers.rs:3772-3792`<br>`fixture:not-eligible-readonly-capture` |
|
|
|
|
|
| `postOtaLatestRelease` | POST `/api/ota/latest-release` | ota | `/instances/:id/ota`<br>`ota/release` | form | planned: Frozen-scope reversible command is contract-planned for a later controlled real-write acceptance phase.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)<br>partial:N (Single-target command has no meaningful partial result.)<br>policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)<br>unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)<br>owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R1; none<br>direct | command-current-state/write-revision/version-probe/verify-write/route-result<br>Refresh current state when available and bind the actor decision to its revision.<br>Refresh current state or require an explicit recorded revision-bound override.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Writes require outcome verification before actor-initiated retry.<br>Structured result returns to the owning route with a redacted audit link. | REAL_WRITE_LATER | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:postOtaLatestRelease`<br>`upstream:backend/src/main.rs:892-893`<br>`upstream:backend/src/handlers.rs:3795-3825`<br>`fixture:not-eligible-readonly-capture` |
|
|
|
|
|
| `postOtaOnlinePrepare` | POST `/api/ota/online-prepare` | ota | `/instances/:id/ota`<br>`ota/release` | job-action | planned: Frozen-scope high-risk operation is planned with simulation-only acceptance until controlled safety authorization exists.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)<br>partial:N (Single-target command has no meaningful partial result.)<br>policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)<br>unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)<br>owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R2; explicit<br>preparation-job | job-fresh-preflight/high-risk-block/ota-version-probe/new-job-lineage/job-result<br>Required fresh preflight; inability to refresh blocks execution.<br>Fresh preflight is mandatory; stale, expired, or unknown state blocks execution.<br>OTA 404/405/501 is frozen-version evidence; preserve release/status probe context and never infer global support.<br>Retry creates a new Job lineage (retryOfJobId/rootJobId); never replay successful items.<br>/jobs/:jobId contains per-item result, attempt lineage, and redacted audit. | SIMULATED_HIGH_RISK | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:postOtaOnlinePrepare`<br>`upstream:backend/src/main.rs:896-897`<br>`upstream:backend/src/handlers.rs:3828-3889`<br>`fixture:not-eligible-readonly-capture` |
|
|
|
|
|
| `postOtaApply` | POST `/api/ota/apply` | ota | `/instances/:id/ota`<br>`ota/apply` | job-action | planned: Frozen-scope high-risk operation is planned with simulation-only acceptance until controlled safety authorization exists.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)<br>partial:N (Single-target command has no meaningful partial result.)<br>policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)<br>unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)<br>owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R3; strong<br>preparation-job | job-fresh-preflight/high-risk-block/ota-version-probe/new-job-lineage/job-result<br>Required fresh preflight; inability to refresh blocks execution.<br>Fresh preflight is mandatory; stale, expired, or unknown state blocks execution.<br>OTA 404/405/501 is frozen-version evidence; preserve release/status probe context and never infer global support.<br>Retry creates a new Job lineage (retryOfJobId/rootJobId); never replay successful items.<br>/jobs/:jobId contains per-item result, attempt lineage, and redacted audit. | SIMULATED_HIGH_RISK | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:postOtaApply`<br>`upstream:backend/src/main.rs:900-901`<br>`upstream:backend/src/handlers.rs:3892-3911`<br>`upstream:bruno-api/post_ota_apply_restart.bru:8`<br>`upstream:bruno-api/post_ota_apply.bru:8`<br>`fixture:not-eligible-readonly-capture` |
|
|
|
|
|
| `postOtaCancel` | POST `/api/ota/cancel` | ota | `/instances/:id/ota`<br>`ota/status` | action | planned: Frozen-scope reversible command is contract-planned for a later controlled real-write acceptance phase.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)<br>partial:N (Single-target command has no meaningful partial result.)<br>policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)<br>unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)<br>owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R1; none<br>direct | command-current-state/write-revision/version-probe/verify-write/route-result<br>Refresh current state when available and bind the actor decision to its revision.<br>Refresh current state or require an explicit recorded revision-bound override.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Writes require outcome verification before actor-initiated retry.<br>Structured result returns to the owning route with a redacted audit link. | REAL_WRITE_LATER | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:postOtaCancel`<br>`upstream:backend/src/main.rs:904-905`<br>`upstream:backend/src/handlers.rs:3914-3931`<br>`upstream:bruno-api/post_ota_cancel.bru:8`<br>`fixture:not-eligible-readonly-capture` |
|
|
|
|
|
| `postAuthPassword` | POST `/api/auth/password` | instances-auth | `/settings/instances/:id`<br>`settings/auth-settings` | dedicated-auth-flow | planned: Frozen-scope high-risk operation is planned with simulation-only acceptance until controlled safety authorization exists.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)<br>partial:N (Single-target command has no meaningful partial result.)<br>policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)<br>unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)<br>owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R3; strong<br>dedicated-flow | auth-dedicated/auth-no-replay/auth-version-probe/new-job-lineage/auth-result<br>Dedicated auth endpoint, actor/session/instance rate limits, and fresh preflight of authentication state are required.<br>Credential state is never inferred from stale data; require actor-initiated auth flow and no replay.<br>Auth 404/405/501 is version evidence; do not downgrade to a generic proxy or expose credentials.<br>Retry creates a new Job lineage (retryOfJobId/rootJobId); never replay successful items.<br>Dedicated auth jobs return through /jobs/:jobId; session flows return a credential metadata-only audit result and link. | SIMULATED_HIGH_RISK | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:postAuthPassword`<br>`upstream:backend/src/main.rs:908-909`<br>`upstream:backend/src/auth.rs:491-553`<br>`upstream:backend/src/auth.rs:43-43`<br>`fixture:not-eligible-readonly-capture` |
|
|
|
|
|
| `getAuthSettings` | GET `/api/auth/settings` | instances-auth | `/settings/instances/:id`<br>`settings/auth-settings` | detail | planned: Frozen-scope read has two redacted captured responses; runtime support is still decided per registered instance.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Detail resource has no collection-empty rendering.)<br>partial:N (Atomic detail read has no meaningful partial rendering.)<br>policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)<br>unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)<br>owner-switch:Y (Owner switch discards responses with a mismatched instance key.) | R0; none<br>direct | query-capability/auth-no-replay/auth-version-probe/auth-actor-only/auth-result<br>Registered instance, authorized actor, and runtime capability decision are required.<br>Credential state is never inferred from stale data; require actor-initiated auth flow and no replay.<br>Auth 404/405/501 is version evidence; do not downgrade to a generic proxy or expose credentials.<br>No automatic replay; require an actor-initiated dedicated flow.<br>Dedicated auth jobs return through /jobs/:jobId; session flows return a credential metadata-only audit result and link. | REAL_READ | captured-readonly; n=2; categories=success,unsupported; collector-selected fully-bound GET R0; two redacted real captures | `registry:getAuthSettings`<br>`upstream:backend/src/main.rs:912-913`<br>`upstream:backend/src/auth.rs:555-570`<br>`upstream:backend/src/auth.rs:43-43`<br>`fixture:captured-readonly` |
|
|
|
|
|
| `postAuthSettings` | POST `/api/auth/settings` | instances-auth | `/settings/instances/:id`<br>`settings/auth-settings` | dedicated-auth-flow | planned: Frozen-scope high-risk operation is planned with simulation-only acceptance until controlled safety authorization exists.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)<br>partial:N (Single-target command has no meaningful partial result.)<br>policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)<br>unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)<br>owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R2; explicit<br>dedicated-flow | auth-dedicated/auth-no-replay/auth-version-probe/new-job-lineage/auth-result<br>Dedicated auth endpoint, actor/session/instance rate limits, and fresh preflight of authentication state are required.<br>Credential state is never inferred from stale data; require actor-initiated auth flow and no replay.<br>Auth 404/405/501 is version evidence; do not downgrade to a generic proxy or expose credentials.<br>Retry creates a new Job lineage (retryOfJobId/rootJobId); never replay successful items.<br>Dedicated auth jobs return through /jobs/:jobId; session flows return a credential metadata-only audit result and link. | SIMULATED_HIGH_RISK | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:postAuthSettings`<br>`upstream:backend/src/main.rs:912-914`<br>`upstream:backend/src/auth.rs:572-640`<br>`upstream:backend/src/auth.rs:43-43`<br>`fixture:not-eligible-readonly-capture` |
|
|
|
|
|
| `getHealth` | GET `/api/health` | instances-auth | `/instances/new`<br>`settings/auth-entry` | detail | planned: Frozen-scope read has two redacted captured responses; runtime support is still decided per registered instance.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Detail resource has no collection-empty rendering.)<br>partial:N (Atomic detail read has no meaningful partial rendering.)<br>policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)<br>unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)<br>owner-switch:Y (Owner switch discards responses with a mismatched instance key.) | R0; none<br>direct | query-capability/auth-no-replay/auth-version-probe/auth-actor-only/auth-result<br>Registered instance, authorized actor, and runtime capability decision are required.<br>Credential state is never inferred from stale data; require actor-initiated auth flow and no replay.<br>Auth 404/405/501 is version evidence; do not downgrade to a generic proxy or expose credentials.<br>No automatic replay; require an actor-initiated dedicated flow.<br>Dedicated auth jobs return through /jobs/:jobId; session flows return a credential metadata-only audit result and link. | REAL_READ | captured-readonly; n=2; categories=success; collector-selected fully-bound GET R0; two redacted real captures | `registry:getHealth`<br>`upstream:backend/src/main.rs:923-923`<br>`upstream:backend/src/handlers.rs:65-75`<br>`upstream:bruno-api/get_health.bru:8`<br>`upstream:backend/src/auth.rs:43-43`<br>`fixture:captured-readonly` |
|
|
|
|
|
| `getAuthStatus` | GET `/api/auth/status` | instances-auth | `/instances/new`<br>`settings/auth-entry` | detail | planned: Frozen-scope read has two redacted captured responses; runtime support is still decided per registered instance.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Detail resource has no collection-empty rendering.)<br>partial:N (Atomic detail read has no meaningful partial rendering.)<br>policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)<br>unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)<br>owner-switch:Y (Owner switch discards responses with a mismatched instance key.) | R0; none<br>direct | query-capability/auth-no-replay/auth-version-probe/auth-actor-only/auth-result<br>Registered instance, authorized actor, and runtime capability decision are required.<br>Credential state is never inferred from stale data; require actor-initiated auth flow and no replay.<br>Auth 404/405/501 is version evidence; do not downgrade to a generic proxy or expose credentials.<br>No automatic replay; require an actor-initiated dedicated flow.<br>Dedicated auth jobs return through /jobs/:jobId; session flows return a credential metadata-only audit result and link. | REAL_READ | captured-readonly; n=2; categories=success,unsupported; collector-selected fully-bound GET R0; two redacted real captures | `registry:getAuthStatus`<br>`upstream:backend/src/main.rs:925-926`<br>`upstream:backend/src/auth.rs:345-364`<br>`upstream:backend/src/auth.rs:43-43`<br>`fixture:captured-readonly` |
|
|
|
|
|
| `postAuthSetup` | POST `/api/auth/setup` | instances-auth | `/instances/new`<br>`settings/auth-entry` | dedicated-auth-flow | planned: Frozen-scope high-risk operation is planned with simulation-only acceptance until controlled safety authorization exists.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)<br>partial:N (Single-target command has no meaningful partial result.)<br>policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)<br>unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)<br>owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R3; strong<br>dedicated-flow | auth-dedicated/auth-no-replay/auth-version-probe/new-job-lineage/auth-result<br>Dedicated auth endpoint, actor/session/instance rate limits, and fresh preflight of authentication state are required.<br>Credential state is never inferred from stale data; require actor-initiated auth flow and no replay.<br>Auth 404/405/501 is version evidence; do not downgrade to a generic proxy or expose credentials.<br>Retry creates a new Job lineage (retryOfJobId/rootJobId); never replay successful items.<br>Dedicated auth jobs return through /jobs/:jobId; session flows return a credential metadata-only audit result and link. | SIMULATED_HIGH_RISK | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:postAuthSetup`<br>`upstream:backend/src/main.rs:929-930`<br>`upstream:backend/src/auth.rs:366-427`<br>`upstream:backend/src/auth.rs:43-43`<br>`fixture:not-eligible-readonly-capture` |
|
|
|
|
|
| `postAuthLogin` | POST `/api/auth/login` | instances-auth | `/instances/new`<br>`settings/auth-entry` | dedicated-auth-flow | planned: Frozen-scope reversible command is contract-planned for a later controlled real-write acceptance phase.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)<br>partial:N (Single-target command has no meaningful partial result.)<br>policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)<br>unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)<br>owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R1; none<br>dedicated-flow | auth-dedicated/auth-no-replay/auth-version-probe/auth-actor-only/auth-result<br>Dedicated auth endpoint, actor/session/instance rate limits, and fresh preflight of authentication state are required.<br>Credential state is never inferred from stale data; require actor-initiated auth flow and no replay.<br>Auth 404/405/501 is version evidence; do not downgrade to a generic proxy or expose credentials.<br>No automatic replay; require an actor-initiated dedicated flow.<br>Dedicated auth jobs return through /jobs/:jobId; session flows return a credential metadata-only audit result and link. | REAL_WRITE_LATER | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:postAuthLogin`<br>`upstream:backend/src/main.rs:933-934`<br>`upstream:backend/src/auth.rs:429-489`<br>`upstream:backend/src/auth.rs:43-43`<br>`fixture:not-eligible-readonly-capture` |
|
|
|
|
|
| `postAuthLogout` | POST `/api/auth/logout` | instances-auth | `/settings/instances/:id`<br>`settings/auth-settings` | dedicated-auth-flow | planned: Frozen-scope reversible command is contract-planned for a later controlled real-write acceptance phase.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)<br>partial:N (Single-target command has no meaningful partial result.)<br>policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)<br>unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)<br>owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R1; none<br>dedicated-flow | auth-dedicated/auth-no-replay/auth-version-probe/auth-actor-only/auth-result<br>Dedicated auth endpoint, actor/session/instance rate limits, and fresh preflight of authentication state are required.<br>Credential state is never inferred from stale data; require actor-initiated auth flow and no replay.<br>Auth 404/405/501 is version evidence; do not downgrade to a generic proxy or expose credentials.<br>No automatic replay; require an actor-initiated dedicated flow.<br>Dedicated auth jobs return through /jobs/:jobId; session flows return a credential metadata-only audit result and link. | REAL_WRITE_LATER | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:postAuthLogout`<br>`upstream:backend/src/main.rs:937-938`<br>`upstream:backend/src/auth.rs:642-655`<br>`upstream:backend/src/auth.rs:43-43`<br>`fixture:not-eligible-readonly-capture` |
|
chick