docs: close Phase 0 acceptance gate
This commit is contained in:
chick
@@ -9,7 +9,7 @@
|
||||
- **Sensitive fields:** every item carries snapshot-rebuildable evidence (file/range/SHA-256/symbol/model field), with explicit container model chains for array paths and exact handler slices for dynamic keys.
|
||||
- **Boundary / semanticBindingReview:** structural checks prove source/model/field relationships, not semantic payload intent. Each registry operation is marked `semanticBindingReview: 'reviewed-phase-0.2'`; manual review fixes the method/path/handler/payload-symbol tuple, especially high-value response bindings.
|
||||
- **Policy:** every R2 requires at least explicit confirmation; every R3 requires strong confirmation. Auth/session-sensitive operations use dedicated flow/replay protections.
|
||||
- **Phase 0.3 仅负责采集真实响应样本** (`responseFixtureStatus=pending-phase-0.3`); static evidence is not a runtime fixture.
|
||||
- **Phase 0.3 真实响应样本 disposition:** the per-operation `responseFixtureStatus=pending-phase-0.3` value is retained as a frozen Phase 0.2 claim and is deprecated for current coverage decisions. The authoritative current value is `runtimeFixtureStatus` in `packages/operation-registry/src/acceptance-58e2204.ts`, derived from the collector selection and real fixture manifest. Static evidence is not a runtime fixture.
|
||||
|
||||
## Whole-file snapshot SHA-256
|
||||
|
||||
|
||||
@@ -4,7 +4,7 @@
|
||||
> 产品对照基线：API-first Multi SimAdmin V1<br>
|
||||
> 上游证据基线：`3899/SimAdmin@58e220411d6599609f0eeda01eb7016e9212f970`
|
||||
|
||||
> Phase 0.1 文档导航：[返回项目章程](./project-charter.md)｜**现状审计**（本文）｜[角色与流程](./personas-and-workflows.md)｜[信息架构](./information-architecture.md)
|
||||
> Phase 0.1 文档导航：[返回项目章程](./project-charter.md)｜**现状审计**（本文）｜[角色与流程](./personas-and-workflows.md)｜[信息架构](./information-architecture.md)｜[117 项验收账本](./operation-acceptance-matrix.md)
|
||||
|
||||
## 1. 审计结论
|
||||
|
||||
|
||||
@@ -1,5 +1,7 @@
|
||||
# API-first Multi SimAdmin 信息架构
|
||||
|
||||
> Operation 的精确页面归属、surface、风险、确认、执行模式及 Fleet/资源批量语义见 [117 项验收账本](./operation-acceptance-matrix.md)；Registry 是风险事实源。
|
||||
|
||||
> 本文定义 V1 路由、导航、页面职责、上游模块映射、状态呈现与验收矩阵。路由与 OperationRegistry 是实现边界，不允许再建立“任意 endpoint 工作台”。
|
||||
|
||||
> Phase 0.1 文档导航：[返回项目章程](./project-charter.md)｜[现状审计](./current-system-audit.md)｜[角色与流程](./personas-and-workflows.md)｜**信息架构**（本文）
|
||||
@@ -33,12 +35,12 @@
|
||||
| `/instances/new` | 添加实例、连接/认证/capability 初探 | R0 health/auth-status；R1-S credential verify/login；保存 | 仅登记并校验 canonical origin；R1-S 限速、脱敏元数据审计、禁止重放；secret 不回显 |
|
||||
| `/instances/:id/overview` | 设备、SIM、网络、系统、关键异常摘要 | 刷新；服务/系统重启 | 查询 R0；重启 R3 Job |
|
||||
| `/instances/:id/cellular` | 蜂窝、信号、小区、运营商、射频、锁频/锁小区、数据/APN | register、lock、data 等 | R0/R1/R2；影响服务项 Job 化 |
|
||||
| `/instances/:id/device-network` | 接口、地址、DDNS、WLAN | DDNS sync、WLAN connect/forget | R0/R1/R2，断连影响需预检 |
|
||||
| `/instances/:id/device-network` | 接口、地址、DDNS、WLAN | DDNS sync、WLAN connect/forget | 查询 R0；WLAN connect R1，WLAN forget R2 Job；DDNS config R2 Job，断连影响需预检 |
|
||||
| `/instances/:id/messages` | 统计、列表、会话、发送、删除 | send、delete、clear | 查询 R0；发送按 registry；删除/清空 R3 |
|
||||
| `/instances/:id/calls` | 实时通话、拨号、设置、历史、IMS、voicemail | dial/answer/hangup/settings；删除通话记录 | 查询 R0；通话控制/设置按 R1/R2；通话记录删除 R3 Job |
|
||||
| `/instances/:id/esim` | work mode、config、lpac、eUICC、profiles | download/enable/rename/delete | R1/R2；profile delete R3 |
|
||||
| `/instances/:id/notifications` | config、channel test、logs、queue | test/retry/clear/delete | config R1；清理类 R3 |
|
||||
| `/instances/:id/automation` | 配置、task test、logs | save/test/clear | config R1；测试按 operation；clear R3 |
|
||||
| `/instances/:id/esim` | work mode、config、lpac、eUICC、profiles | download/enable/rename/delete | eSIM download/enable R1 direct；config/work mode R2 Job；profile delete R3 |
|
||||
| `/instances/:id/notifications` | config、channel test、logs、queue | test/retry/clear/delete | notifications config R2 Job；清理类 R3 |
|
||||
| `/instances/:id/automation` | 配置、task test、logs | save/test/clear | automation config R2 Job；task test R2 Job；clear R3 |
|
||||
| `/instances/:id/ota` | 当前/最新版本、上传、prepare、apply、cancel | upload/prepare/apply/cancel | prepare R2；apply R3 Job；专用流上传 |
|
||||
| `/jobs` | Job 表格与筛选 | 取消/重试入口 | cancel 默认 R1；retry 继承原 operation 风险且最低 R2，均由 registry 可提高 |
|
||||
| `/jobs/:jobId` | 阶段、items、attempt、事件、retry lineage 和关联 audit | cancel/retry items | cancel 默认 R1；retry 创建新 Job 且继承原风险（最低 R2）；不复制/重放成功 item，非幂等先核实 |
|
||||
@@ -95,7 +97,7 @@
|
||||
| SIM | SIM 信息、详情刷新、缓存更新 | `overview` | 与 cellular 交叉字段只引用同一 resource/query，不重复 endpoint 定义 |
|
||||
| 蜂窝网络 | network、cells、monitor、signal、location、operators、register | `cellular` | overview 仅摘要和深链 |
|
||||
| 射频与锁定 | radio mode、band lock、cell lock、unlock all | `cellular` | lock/unlock 预检并按 R2/R3 registry 执行 |
|
||||
| 数据连接 | data、roaming、airplane、APN、baseband | `cellular` | R1 开关与 R2 restart 分开呈现 |
|
||||
| 数据连接 | data、roaming、airplane、APN、baseband | `cellular` | R1 开关；baseband restart R3 Job，baseband restart status R0 read，必须分开呈现 |
|
||||
| 设备网络 | interfaces、addresses、DDNS、WLAN 全生命周期 | `device-network` | connect/disconnect 后需验证 connectivity |
|
||||
| 工作模式与 eSIM | work mode、config、lpac、eUICC、profiles | `esim` | profile delete R3；工作模式影响说明 |
|
||||
| 短信 | stats、list、conversation、send、delete、clear | `messages` | 删除/清空 R3；短信正文不进入 audit |
|
||||
@@ -188,12 +190,12 @@ R3 全部 Job 化。R2 默认 Job 化；仅单目标 operation 可在 OperationR
|
||||
| New instance | 实例与认证 | L,X,A,U/unknown capability | 配置专用保存/secret set | 连接与认证分阶段；失败可存 disabled 草稿；无 secret 回显 |
|
||||
| Overview | 设备系统、SIM、摘要 | L,E,S,X,U,A,P | restart service/system R3 | 摘要深链；重启进入 Job，不在断连时假报成功 |
|
||||
| Cellular | 蜂窝、射频、数据连接 | L,E,S,X,U,A,P | data/roaming R1；register/lock/baseband R2/3 | 当前值→目标值；断连影响；验证后状态 |
|
||||
| Device Network | interfaces/DDNS/WLAN | L,E,S,X,U,A,P | config R1；connect/forget R2 | 扫描空与 unsupported 区分；变更后 connectivity 验证 |
|
||||
| Device Network | interfaces/DDNS/WLAN | L,E,S,X,U,A,P | DDNS config R2 Job；WLAN connect R1；WLAN forget R2 Job | 扫描空与 unsupported 区分；变更后 connectivity 验证 |
|
||||
| Messages | SMS | L,E,S,X,U,A,P | send R2（默认 Job，`syncSafe` 例外）；delete/clear R3 Job | 分页/会话；号码校验；删除数量强确认 |
|
||||
| Calls | Calls/IMS/voicemail | L,E,S,X,U,A,P | dial/answer/hangup/settings R1/2；history delete R3 Job | 实时与历史分离；拨号超时不重放；记录删除复述目标/数量并落 Job、刷新历史及脱敏 audit |
|
||||
| eSIM | work mode/eSIM/lpac/eUICC/profile | L,E,S,X,U,A,P | config R1；download/enable R2；delete R3 | profile 身份可见；删除复述；完成后列表与连接核实 |
|
||||
| Notifications | config/test/logs/queue | L,E,S,X,U,A,P | config R1；test/retry R2（默认 Job，`syncSafe` 例外）；clear/delete R3 Job | channel 级反馈；队列逐项；清理确认数量 |
|
||||
| Automation | config/test/logs | L,E,S,X,U,A,P | config R1；test R2（默认 Job，`syncSafe` 例外）；clear R3 Job | schema 表单；测试与正式任务明确区分 |
|
||||
| eSIM | work mode/eSIM/lpac/eUICC/profile | L,E,S,X,U,A,P | eSIM download/enable R1 direct；config/work mode R2 Job；delete R3 | profile 身份可见；删除复述；完成后列表与连接核实 |
|
||||
| Notifications | config/test/logs/queue | L,E,S,X,U,A,P | notifications config R2 Job；test/retry R2 Job；clear/delete R3 Job | channel 级反馈；队列逐项；清理确认数量 |
|
||||
| Automation | config/test/logs | L,E,S,X,U,A,P | automation config R2 Job；test R2 Job；clear R3 Job | schema 表单；测试与正式任务明确区分 |
|
||||
| OTA | status/release/upload/prepare/apply/cancel | L,E,S,X,U,A,P | prepare R2；apply R3 | 流式进度/校验；版本重现判完成；可取消性明确 |
|
||||
| Jobs | jobs/items/attempts | L,E,S,X,P | cancel 默认 R1（可提高）；retry 继承原风险且最低 R2、创建新 Job | 重启恢复；终态不可变；失败项选择重试；新 jobId+attemptId 与 retry/root/source lineage 关联 |
|
||||
| Job Detail `/jobs/:jobId` | jobs/items/events/audit links | L,E,S,X,P | cancel 默认 R1；retry 最低 R2 | 阶段、逐项、attempt 与关联 audit；不可取消/重试原因可见 |
|
||||
@@ -225,11 +227,22 @@ R3 全部 Job 化。R2 默认 Job 化；仅单目标 operation 可在 OperationR
|
||||
|
||||
## 10. IA 阶段门禁
|
||||
|
||||
进入 Web 实现前必须满足：
|
||||
### Phase 0 → Phase 1 workspace/contract bootstrap gate
|
||||
|
||||
进入 Phase 1 workspace/contract bootstrap 前只要求规格、结构化证据与复审门禁；不以尚未进入实现阶段的 Fleet 组件或 E2E 产物阻断 workspace bootstrap：
|
||||
|
||||
- [x] 全部 117 个上游 operation 由显式 operation ID exact partition 映射到唯一主路由与可实施 section/surface；测试验证 exact cover、无重叠、无未知 ID，且 route owner 一致。
|
||||
- [x] loading/empty/stale/error/unsupported/auth/partial、policy-forbidden、unknown-result 与 owner-switch 由显式 operation ID scenario profile exact partition 决定，并保留逐 profile 不适用理由。
|
||||
- [x] policy 与 availability 均由显式 operation ID exact partition 决定；每个写动作具有 Registry 风险等级、确认形态、结构化政策和结果落点，缺失映射立即失败。
|
||||
- [x] 规格与测试不存在 iframe、任意 path、任意 JSON 或第二份 endpoint catalog 的产品入口。
|
||||
- [x] 1440–320 的导航与数据降级策略已形成可执行规格。
|
||||
- [x] 最终独立规格与质量/安全复审均已通过；防假绿 mutation、独立 Phase 0.2 Git-object 安全基线和 metadata-only fixture 扫描均获批准。
|
||||
|
||||
### Phase 5 implementation gate
|
||||
|
||||
以下实现证据不能删除或伪造为已完成，但 deferred 到 Phase 5；它们不是 Phase 1 workspace/contract bootstrap blocker：
|
||||
|
||||
- [ ] 全部上游 operation 在 OperationRegistry 中有且仅有一个主页面 owner。
|
||||
- [ ] 目标路由均有 loading/empty/stale/error/unsupported/auth/partial 设计或明确不适用理由。
|
||||
- [ ] 每个写动作有风险等级、确认形态和结果落点。
|
||||
- [ ] Fleet 默认列、排序、筛选和批量选择规则已形成组件/E2E 验收用例。
|
||||
- [ ] 不存在 iframe、任意 path、任意 JSON 或第二份 endpoint catalog 的产品入口。
|
||||
- [ ] 1440–320 的导航与数据降级策略可执行，而不是仅写“响应式”。
|
||||
- [ ] E2E 当前为 N/A；进入 Phase 5 Fleet 页面实现前，必须将上述规格落为可执行组件/E2E 验收并通过。
|
||||
|
||||
Phase 0 release gate 已通过；Phase 5 实现与 E2E 仍是各自阶段的独立门禁，不能由本次规格复审替代。
|
||||
|
||||
@@ -0,0 +1,153 @@
|
||||
# Operation acceptance matrix — upstream 58e2204
|
||||
|
||||
> Generated from the structured ledger. Registry is the sole source for risk, confirmation, capability, and dedicated-flow facts; orchestration is bound by acceptance policy. `registeredOperation` is not a synonym for preparation Job.
|
||||
|
||||
REAL_READ means captured evidence and is restricted to `captured-readonly`. REAL_READ_DEFERRED marks denied candidates without a real fixture. Fixture disposition is metadata-only: runtime status, count, safe observed status categories, and reason; it never renders fixture body/response, alias, identity, or URL.
|
||||
|
||||
## Control-plane acceptance (independent flows)
|
||||
|
||||
| flowId | route | risk / subtype | confirmation | preconditions | result | failure recovery | secret policy | evidence |
|
||||
|---|---|---|---|---|---|---|---|---|
|
||||
| `instance-create` | `/instances/new` | R1 / configuration | diff-confirm | canonical origin and unique stable ID | created instance revision and audit | retain draft on validation or reconcile failure | secret reference only; never return a value | WF-01 + product policy |
|
||||
| `instance-update` | `/settings/instances/:id` | R1 / configuration | revision-diff | current revision | updated revision and audit | 409 refreshes diff without losing edits | preserve/set/clear explicit; never return a value | WF-01 + product policy |
|
||||
| `instance-delete` | `/settings/instances/:id` | R3 / destructive | strong target restatement | fresh revision and no conflicting job | new jobId with two-phase deleting to tombstone result | before boundary restore; after boundary manual recovery | destroy reference without reading secret value | WF-13 |
|
||||
| `secret-set` | `/settings/instances/:id` | R1 / secret-reference | explicit set | authorized SecretStore write | new reference metadata and audit | atomic rollback on reference write failure | never return or log secret value | WF-01 |
|
||||
| `secret-preserve` | `/settings/instances/:id` | R1 / secret-reference | explicit preserve | existing reference metadata | unchanged reference metadata and audit | revision conflict refreshes metadata only | never read or return secret value | WF-01 |
|
||||
| `secret-clear` | `/settings/instances/:id` | R1 / secret-reference | explicit clear | fresh revision | reference removed and audit | atomic rollback or explicit recovery state | never return destroyed secret value | WF-01 |
|
||||
| `config-import-preview` | `/settings/instances` | R0 / preview | none | validated upload and canonical origins | redacted diff/conflict/count preview | fix file and regenerate preview | never include secret values in preview | IA settings import |
|
||||
| `config-import-confirm` | `/settings/instances` | R2 / bulk-configuration | explicit preview token | fresh unexpired preview | new jobId with per-instance items | retry failed items in new lineage | references only; never import/export secret values | IA settings import |
|
||||
| `credential-verify` | `/instances/new` | R1 / session-sensitive | actor initiated | rate limit and registered target | credential metadata-only result | no automatic replay; actor may retry after backoff | ephemeral input, never response/audit value | WF-01 |
|
||||
| `saved-secret-login` | `/instances/new` | R1 / session-sensitive | actor initiated | saved reference and rate limit | session metadata-only result | no automatic replay; return to login flow | resolve server-side; never expose value | WF-12 |
|
||||
| `temporary-secret-login` | `/instances/new` | R1 / session-sensitive | actor initiated | one-shot input and rate limit | session metadata-only result | no automatic replay; require new actor input | memory-only and never saved or returned | WF-12 |
|
||||
| `logout` | `/settings/instances/:id` | R1 / session-sensitive | actor initiated | active session | session cleared and metadata audit | no replay; reconcile auth status | no credential value involved | WF-12 |
|
||||
| `401-recovery` | `/instances/:id/overview` | R1 / session-recovery | actor chooses login | 401 evidence and retained stale data | return to owner; retry R0 only | never replay writes; preserve draft for new prepare | temporary/saved secret follows selected login policy | WF-12 |
|
||||
| `auth-setup` | `/instances/new` | R3 / authentication-change | strong confirmation | fresh dedicated auth preflight | new jobId and metadata-only audit | new lineage after state verification | password never returned or audited | Registry postAuthSetup |
|
||||
| `auth-password-change` | `/settings/instances/:id` | R3 / authentication-change | strong confirmation | fresh dedicated auth preflight | new jobId and metadata-only audit | new lineage after auth-status verification | old/new password never returned or audited | Registry postAuthPassword |
|
||||
| `auth-settings-read` | `/settings/instances/:id` | R0 / authentication-read | none | registered instance and actor | structured auth settings | safe actor retry | no password/cookie/token fields | Registry getAuthSettings |
|
||||
| `auth-settings-write` | `/settings/instances/:id` | R2 / authentication-change | explicit confirmation | fresh dedicated auth preflight | new jobId and metadata-only audit | new lineage; no replay | never return credential values | Registry postAuthSettings |
|
||||
| `job-cancel` | `/jobs/:jobId` | R1 / job-control | explicit confirmation | cancelable current phase | immutable cancellation event | show non-cancelable boundary and reconcile | no secret data in event | IA jobs |
|
||||
| `job-retry` | `/jobs/:jobId` | R2 / job-control | explicit failed-item selection | source terminal state and fresh preflight | new jobId with retryOf/root/source lineage | never mutate source or replay successful items | redacted parameter summary only | WF-10 |
|
||||
| `audit-export` | `/audit` | R0 / data-export | explicit scope | authorized filters | redacted export artifact | regenerate from immutable audit | redaction applies; no sensitiveFields | WF-11 |
|
||||
| `system-settings-update` | `/settings/system` | R1 / configuration | revision-diff | safe bounds and current revision | updated revision and audit | 409 refreshes diff; invalid bounds rejected | no secrets accepted | IA settings system |
|
||||
|
||||
## Upstream operation acceptance (exact 117)
|
||||
|
||||
| operationId | method/path | domain | route/surface | UI | availability/version evidence | scenario applicability | risk/confirmation/execution | policy IDs and resolved policies | real class | fixture disposition (metadata-only: runtime status / n / categories / reason) | evidence |
|
||||
|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||
| `getDevice` | GET `/api/device` | device-system | `/instances/:id/overview`<br>`overview/device` | detail | planned: Frozen-scope read has two redacted captured responses; runtime support is still decided per registered instance.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Detail resource has no collection-empty rendering.)<br>partial:N (Atomic detail read has no meaningful partial rendering.)<br>policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)<br>unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)<br>owner-switch:Y (Owner switch discards responses with a mismatched instance key.) | R0; none<br>direct | query-capability/read-retain/version-probe/safe-read/route-result<br>Registered instance, authorized actor, and runtime capability decision are required.<br>Retain last success as stale and permit an explicit safe refresh.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Safe reads may retry within deadline and retain stale success.<br>Structured result returns to the owning route with a redacted audit link. | REAL_READ | captured-readonly; n=2; categories=success; collector-selected fully-bound GET R0; two redacted real captures | `registry:getDevice`<br>`upstream:backend/src/main.rs:506-506`<br>`upstream:backend/src/handlers.rs:1076-1090`<br>`upstream:bruno-api/get_device_info.bru:8`<br>`fixture:captured-readonly` |
|
||||
| `getSim` | GET `/api/sim` | sim | `/instances/:id/overview`<br>`overview/sim` | detail | planned: Frozen-scope read has two redacted captured responses; runtime support is still decided per registered instance.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Detail resource has no collection-empty rendering.)<br>partial:N (Atomic detail read has no meaningful partial rendering.)<br>policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)<br>unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)<br>owner-switch:Y (Owner switch discards responses with a mismatched instance key.) | R0; none<br>direct | query-capability/read-retain/version-probe/safe-read/route-result<br>Registered instance, authorized actor, and runtime capability decision are required.<br>Retain last success as stale and permit an explicit safe refresh.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Safe reads may retry within deadline and retain stale success.<br>Structured result returns to the owning route with a redacted audit link. | REAL_READ | captured-readonly; n=2; categories=success; collector-selected fully-bound GET R0; two redacted real captures | `registry:getSim`<br>`upstream:backend/src/main.rs:508-508`<br>`upstream:backend/src/handlers.rs:1126-1145`<br>`upstream:bruno-api/get_sim_info.bru:8`<br>`fixture:captured-readonly` |
|
||||
| `postSimDetailsRefresh` | POST `/api/sim/details/refresh` | sim | `/instances/:id/overview`<br>`overview/sim` | action | planned: Frozen-scope reversible command is contract-planned for a later controlled real-write acceptance phase.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)<br>partial:N (Single-target command has no meaningful partial result.)<br>policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)<br>unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)<br>owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R1; none<br>direct | command-current-state/write-revision/version-probe/verify-write/route-result<br>Refresh current state when available and bind the actor decision to its revision.<br>Refresh current state or require an explicit recorded revision-bound override.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Writes require outcome verification before actor-initiated retry.<br>Structured result returns to the owning route with a redacted audit link. | REAL_WRITE_LATER | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:postSimDetailsRefresh`<br>`upstream:backend/src/main.rs:510-511`<br>`upstream:backend/src/handlers.rs:1148-1164`<br>`fixture:not-eligible-readonly-capture` |
|
||||
| `postSimCache` | POST `/api/sim/cache` | sim | `/instances/:id/overview`<br>`overview/sim` | form | planned: Frozen-scope reversible command is contract-planned for a later controlled real-write acceptance phase.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)<br>partial:N (Single-target command has no meaningful partial result.)<br>policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)<br>unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)<br>owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R1; none<br>direct | command-current-state/write-revision/version-probe/verify-write/route-result<br>Refresh current state when available and bind the actor decision to its revision.<br>Refresh current state or require an explicit recorded revision-bound override.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Writes require outcome verification before actor-initiated retry.<br>Structured result returns to the owning route with a redacted audit link. | REAL_WRITE_LATER | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:postSimCache`<br>`upstream:backend/src/main.rs:514-515`<br>`upstream:backend/src/handlers.rs:1167-1213`<br>`fixture:not-eligible-readonly-capture` |
|
||||
| `getNetwork` | GET `/api/network` | cellular | `/instances/:id/cellular`<br>`cellular/serving-network` | detail | planned: Frozen-scope read has two redacted captured responses; runtime support is still decided per registered instance.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Detail resource has no collection-empty rendering.)<br>partial:N (Atomic detail read has no meaningful partial rendering.)<br>policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)<br>unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)<br>owner-switch:Y (Owner switch discards responses with a mismatched instance key.) | R0; none<br>direct | query-capability/read-retain/version-probe/safe-read/route-result<br>Registered instance, authorized actor, and runtime capability decision are required.<br>Retain last success as stale and permit an explicit safe refresh.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Safe reads may retry within deadline and retain stale success.<br>Structured result returns to the owning route with a redacted audit link. | REAL_READ | captured-readonly; n=2; categories=success; collector-selected fully-bound GET R0; two redacted real captures | `registry:getNetwork`<br>`upstream:backend/src/main.rs:519-520`<br>`upstream:backend/src/handlers.rs:1218-1232`<br>`upstream:bruno-api/get_network_info.bru:8`<br>`fixture:captured-readonly` |
|
||||
| `getCells` | GET `/api/cells` | cellular | `/instances/:id/cellular`<br>`cellular/cells` | table | planned: Frozen-scope read has two redacted captured responses; runtime support is still decided per registered instance.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:Y (Successful collection may contain no rows.)<br>partial:Y (Independent response sections may succeed or fail.)<br>policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)<br>unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)<br>owner-switch:Y (Owner switch discards responses with a mismatched instance key.) | R0; none<br>direct | query-capability/read-retain/version-probe/safe-read/route-result<br>Registered instance, authorized actor, and runtime capability decision are required.<br>Retain last success as stale and permit an explicit safe refresh.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Safe reads may retry within deadline and retain stale success.<br>Structured result returns to the owning route with a redacted audit link. | REAL_READ | captured-readonly; n=2; categories=success; collector-selected fully-bound GET R0; two redacted real captures | `registry:getCells`<br>`upstream:backend/src/main.rs:522-522`<br>`upstream:backend/src/handlers.rs:1235-1249`<br>`upstream:bruno-api/get_cells_info.bru:8`<br>`fixture:captured-readonly` |
|
||||
| `postCellMonitorStart` | POST `/api/cell-monitor/start` | cellular | `/instances/:id/cellular`<br>`cellular/cells` | action | planned: Frozen-scope reversible command is contract-planned for a later controlled real-write acceptance phase.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)<br>partial:N (Single-target command has no meaningful partial result.)<br>policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)<br>unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)<br>owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R1; none<br>direct | command-current-state/write-revision/version-probe/verify-write/route-result<br>Refresh current state when available and bind the actor decision to its revision.<br>Refresh current state or require an explicit recorded revision-bound override.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Writes require outcome verification before actor-initiated retry.<br>Structured result returns to the owning route with a redacted audit link. | REAL_WRITE_LATER | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:postCellMonitorStart`<br>`upstream:backend/src/main.rs:524-525`<br>`upstream:backend/src/handlers.rs:1252-1282`<br>`fixture:not-eligible-readonly-capture` |
|
||||
| `postCellMonitorStop` | POST `/api/cell-monitor/stop` | cellular | `/instances/:id/cellular`<br>`cellular/cells` | action | planned: Frozen-scope reversible command is contract-planned for a later controlled real-write acceptance phase.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)<br>partial:N (Single-target command has no meaningful partial result.)<br>policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)<br>unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)<br>owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R1; none<br>direct | command-current-state/write-revision/version-probe/verify-write/route-result<br>Refresh current state when available and bind the actor decision to its revision.<br>Refresh current state or require an explicit recorded revision-bound override.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Writes require outcome verification before actor-initiated retry.<br>Structured result returns to the owning route with a redacted audit link. | REAL_WRITE_LATER | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:postCellMonitorStop`<br>`upstream:backend/src/main.rs:528-529`<br>`upstream:backend/src/handlers.rs:1285-1312`<br>`fixture:not-eligible-readonly-capture` |
|
||||
| `getRadioMode` | GET `/api/radio-mode` | radio-lock | `/instances/:id/cellular`<br>`cellular/radio-locks` | read-panel | planned: Frozen-scope read has two redacted captured responses; runtime support is still decided per registered instance.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Detail resource has no collection-empty rendering.)<br>partial:N (Atomic detail read has no meaningful partial rendering.)<br>policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)<br>unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)<br>owner-switch:Y (Owner switch discards responses with a mismatched instance key.) | R0; none<br>direct | query-capability/read-retain/version-probe/safe-read/route-result<br>Registered instance, authorized actor, and runtime capability decision are required.<br>Retain last success as stale and permit an explicit safe refresh.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Safe reads may retry within deadline and retain stale success.<br>Structured result returns to the owning route with a redacted audit link. | REAL_READ | captured-readonly; n=2; categories=success; collector-selected fully-bound GET R0; two redacted real captures | `registry:getRadioMode`<br>`upstream:backend/src/main.rs:532-533`<br>`upstream:backend/src/handlers.rs:1315-1329`<br>`upstream:bruno-api/get_radio_mode.bru:8`<br>`fixture:captured-readonly` |
|
||||
| `postRadioMode` | POST `/api/radio-mode` | radio-lock | `/instances/:id/cellular`<br>`cellular/radio-locks` | form | planned: Frozen-scope reversible command is contract-planned for a later controlled real-write acceptance phase.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)<br>partial:N (Single-target command has no meaningful partial result.)<br>policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)<br>unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)<br>owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R1; none<br>direct | command-current-state/write-revision/version-probe/verify-write/route-result<br>Refresh current state when available and bind the actor decision to its revision.<br>Refresh current state or require an explicit recorded revision-bound override.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Writes require outcome verification before actor-initiated retry.<br>Structured result returns to the owning route with a redacted audit link. | REAL_WRITE_LATER | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:postRadioMode`<br>`upstream:backend/src/main.rs:532-534`<br>`upstream:backend/src/handlers.rs:1332-1352`<br>`upstream:bruno-api/set_radio_mode_nr.bru:8`<br>`upstream:bruno-api/set_radio_mode_lte.bru:8`<br>`upstream:bruno-api/set_radio_mode_auto.bru:8`<br>`fixture:not-eligible-readonly-capture` |
|
||||
| `getBandLock` | GET `/api/band-lock` | radio-lock | `/instances/:id/cellular`<br>`cellular/radio-locks` | read-panel | planned: Frozen-scope read has two redacted captured responses; runtime support is still decided per registered instance.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Detail resource has no collection-empty rendering.)<br>partial:N (Atomic detail read has no meaningful partial rendering.)<br>policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)<br>unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)<br>owner-switch:Y (Owner switch discards responses with a mismatched instance key.) | R0; none<br>direct | query-capability/read-retain/version-probe/safe-read/route-result<br>Registered instance, authorized actor, and runtime capability decision are required.<br>Retain last success as stale and permit an explicit safe refresh.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Safe reads may retry within deadline and retain stale success.<br>Structured result returns to the owning route with a redacted audit link. | REAL_READ | captured-readonly; n=2; categories=success; collector-selected fully-bound GET R0; two redacted real captures | `registry:getBandLock`<br>`upstream:backend/src/main.rs:538-539`<br>`upstream:backend/src/handlers.rs:1355-1369`<br>`upstream:bruno-api/get_band_lock.bru:8`<br>`fixture:captured-readonly` |
|
||||
| `postBandLock` | POST `/api/band-lock` | radio-lock | `/instances/:id/cellular`<br>`cellular/radio-locks` | job-action | planned: Frozen-scope high-risk operation is planned with simulation-only acceptance until controlled safety authorization exists.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)<br>partial:N (Single-target command has no meaningful partial result.)<br>policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)<br>unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)<br>owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R2; explicit<br>preparation-job | job-fresh-preflight/high-risk-block/version-probe/new-job-lineage/job-result<br>Required fresh preflight; inability to refresh blocks execution.<br>Fresh preflight is mandatory; stale, expired, or unknown state blocks execution.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Retry creates a new Job lineage (retryOfJobId/rootJobId); never replay successful items.<br>/jobs/:jobId contains per-item result, attempt lineage, and redacted audit. | SIMULATED_HIGH_RISK | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:postBandLock`<br>`upstream:backend/src/main.rs:538-540`<br>`upstream:backend/src/handlers.rs:1372-1392`<br>`upstream:bruno-api/set_band_lock_nr_n78.bru:8`<br>`upstream:bruno-api/set_band_lock_lte_b1_b3.bru:8`<br>`upstream:bruno-api/unlock_all_bands.bru:8`<br>`upstream:bruno-api/set_band_lock_lte_nr_mix.bru:8`<br>`fixture:not-eligible-readonly-capture` |
|
||||
| `getNetworkInterfaces` | GET `/api/network/interfaces` | device-network | `/instances/:id/device-network`<br>`device-network/interfaces` | table | planned: Frozen-scope read has two redacted captured responses; runtime support is still decided per registered instance.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:Y (Successful collection may contain no rows.)<br>partial:Y (Independent response sections may succeed or fail.)<br>policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)<br>unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)<br>owner-switch:Y (Owner switch discards responses with a mismatched instance key.) | R0; none<br>direct | query-capability/read-retain/version-probe/safe-read/route-result<br>Registered instance, authorized actor, and runtime capability decision are required.<br>Retain last success as stale and permit an explicit safe refresh.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Safe reads may retry within deadline and retain stale success.<br>Structured result returns to the owning route with a redacted audit link. | REAL_READ | captured-readonly; n=2; categories=success; collector-selected fully-bound GET R0; two redacted real captures | `registry:getNetworkInterfaces`<br>`upstream:backend/src/main.rs:544-545`<br>`upstream:backend/src/handlers.rs:1619-1644`<br>`upstream:bruno-api/get_network_interfaces.bru:8`<br>`fixture:captured-readonly` |
|
||||
| `getNetworkConnectionAddresses` | GET `/api/network/connection-addresses` | device-network | `/instances/:id/device-network`<br>`device-network/interfaces` | read-panel | planned: Frozen-scope read has two redacted captured responses; runtime support is still decided per registered instance.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Detail resource has no collection-empty rendering.)<br>partial:N (Atomic detail read has no meaningful partial rendering.)<br>policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)<br>unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)<br>owner-switch:Y (Owner switch discards responses with a mismatched instance key.) | R0; none<br>direct | query-capability/read-retain/version-probe/safe-read/route-result<br>Registered instance, authorized actor, and runtime capability decision are required.<br>Retain last success as stale and permit an explicit safe refresh.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Safe reads may retry within deadline and retain stale success.<br>Structured result returns to the owning route with a redacted audit link. | REAL_READ | captured-readonly; n=2; categories=success; collector-selected fully-bound GET R0; two redacted real captures | `registry:getNetworkConnectionAddresses`<br>`upstream:backend/src/main.rs:548-549`<br>`upstream:backend/src/handlers.rs:1647-1666`<br>`fixture:captured-readonly` |
|
||||
| `getDeviceNetworkDdnsConfig` | GET `/api/device-network/ddns/config` | device-network | `/instances/:id/device-network`<br>`device-network/ddns` | read-panel | planned: Frozen-scope read has two redacted captured responses; runtime support is still decided per registered instance.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Detail resource has no collection-empty rendering.)<br>partial:N (Atomic detail read has no meaningful partial rendering.)<br>policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)<br>unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)<br>owner-switch:Y (Owner switch discards responses with a mismatched instance key.) | R0; none<br>direct | query-capability/read-retain/version-probe/safe-read/route-result<br>Registered instance, authorized actor, and runtime capability decision are required.<br>Retain last success as stale and permit an explicit safe refresh.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Safe reads may retry within deadline and retain stale success.<br>Structured result returns to the owning route with a redacted audit link. | REAL_READ | captured-readonly; n=2; categories=success; collector-selected fully-bound GET R0; two redacted real captures | `registry:getDeviceNetworkDdnsConfig`<br>`upstream:backend/src/main.rs:552-553`<br>`upstream:backend/src/handlers.rs:1669-1679`<br>`upstream:bruno-api/get_device_ddns_config.bru:8`<br>`fixture:captured-readonly` |
|
||||
| `postDeviceNetworkDdnsConfig` | POST `/api/device-network/ddns/config` | device-network | `/instances/:id/device-network`<br>`device-network/ddns` | job-action | planned: Frozen-scope high-risk operation is planned with simulation-only acceptance until controlled safety authorization exists.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)<br>partial:N (Single-target command has no meaningful partial result.)<br>policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)<br>unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)<br>owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R2; explicit<br>preparation-job | job-fresh-preflight/high-risk-block/version-probe/new-job-lineage/job-result<br>Required fresh preflight; inability to refresh blocks execution.<br>Fresh preflight is mandatory; stale, expired, or unknown state blocks execution.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Retry creates a new Job lineage (retryOfJobId/rootJobId); never replay successful items.<br>/jobs/:jobId contains per-item result, attempt lineage, and redacted audit. | SIMULATED_HIGH_RISK | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:postDeviceNetworkDdnsConfig`<br>`upstream:backend/src/main.rs:552-554`<br>`upstream:backend/src/handlers.rs:1682-1721`<br>`upstream:bruno-api/set_device_ddns_config.bru:8`<br>`fixture:not-eligible-readonly-capture` |
|
||||
| `getDeviceNetworkDdnsStatus` | GET `/api/device-network/ddns/status` | device-network | `/instances/:id/device-network`<br>`device-network/ddns` | read-panel | planned: Frozen-scope read has two redacted captured responses; runtime support is still decided per registered instance.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Detail resource has no collection-empty rendering.)<br>partial:N (Atomic detail read has no meaningful partial rendering.)<br>policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)<br>unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)<br>owner-switch:Y (Owner switch discards responses with a mismatched instance key.) | R0; none<br>direct | query-capability/read-retain/version-probe/safe-read/route-result<br>Registered instance, authorized actor, and runtime capability decision are required.<br>Retain last success as stale and permit an explicit safe refresh.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Safe reads may retry within deadline and retain stale success.<br>Structured result returns to the owning route with a redacted audit link. | REAL_READ | captured-readonly; n=2; categories=success; collector-selected fully-bound GET R0; two redacted real captures | `registry:getDeviceNetworkDdnsStatus`<br>`upstream:backend/src/main.rs:558-559`<br>`upstream:backend/src/handlers.rs:1750-1757`<br>`upstream:bruno-api/get_device_ddns_status.bru:8`<br>`fixture:captured-readonly` |
|
||||
| `postDeviceNetworkDdnsSync` | POST `/api/device-network/ddns/sync` | device-network | `/instances/:id/device-network`<br>`device-network/ddns` | action | planned: Frozen-scope reversible command is contract-planned for a later controlled real-write acceptance phase.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)<br>partial:N (Single-target command has no meaningful partial result.)<br>policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)<br>unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)<br>owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R1; none<br>direct | command-current-state/write-revision/version-probe/verify-write/route-result<br>Refresh current state when available and bind the actor decision to its revision.<br>Refresh current state or require an explicit recorded revision-bound override.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Writes require outcome verification before actor-initiated retry.<br>Structured result returns to the owning route with a redacted audit link. | REAL_WRITE_LATER | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:postDeviceNetworkDdnsSync`<br>`upstream:backend/src/main.rs:562-563`<br>`upstream:backend/src/handlers.rs:1760-1781`<br>`upstream:bruno-api/post_device_ddns_sync.bru:8`<br>`fixture:not-eligible-readonly-capture` |
|
||||
| `getDeviceNetworkDdnsLogs` | GET `/api/device-network/ddns/logs` | device-network | `/instances/:id/device-network`<br>`device-network/ddns` | read-panel | planned: Frozen-scope read is modeled but real capture was explicitly denied; runtime support is probed per instance.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:Y (Successful collection may contain no rows.)<br>partial:Y (Independent response sections may succeed or fail.)<br>policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)<br>unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)<br>owner-switch:Y (Owner switch discards responses with a mismatched instance key.) | R0; none<br>direct | query-capability/read-retain/version-probe/safe-read/route-result<br>Registered instance, authorized actor, and runtime capability decision are required.<br>Retain last success as stale and permit an explicit safe refresh.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Safe reads may retry within deadline and retain stale success.<br>Structured result returns to the owning route with a redacted audit link. | REAL_READ_DEFERRED | denied-readonly-candidate; n=0; categories=none; no safe limit contract | `registry:getDeviceNetworkDdnsLogs`<br>`upstream:backend/src/main.rs:566-567`<br>`upstream:backend/src/handlers.rs:1784-1790`<br>`upstream:bruno-api/get_device_ddns_logs.bru:8`<br>`fixture:denied-readonly-candidate` |
|
||||
| `postDeviceNetworkDdnsLogsClear` | POST `/api/device-network/ddns/logs/clear` | device-network | `/instances/:id/device-network`<br>`device-network/ddns` | job-action | planned: Frozen-scope high-risk operation is planned with simulation-only acceptance until controlled safety authorization exists.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)<br>partial:N (Single-target command has no meaningful partial result.)<br>policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)<br>unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)<br>owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R2; explicit<br>preparation-job | job-fresh-preflight/high-risk-block/version-probe/new-job-lineage/job-result<br>Required fresh preflight; inability to refresh blocks execution.<br>Fresh preflight is mandatory; stale, expired, or unknown state blocks execution.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Retry creates a new Job lineage (retryOfJobId/rootJobId); never replay successful items.<br>/jobs/:jobId contains per-item result, attempt lineage, and redacted audit. | SIMULATED_HIGH_RISK | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:postDeviceNetworkDdnsLogsClear`<br>`upstream:backend/src/main.rs:570-571`<br>`upstream:backend/src/handlers.rs:1793-1802`<br>`upstream:bruno-api/post_device_ddns_logs_clear.bru:8`<br>`fixture:not-eligible-readonly-capture` |
|
||||
| `getDeviceNetworkWlanStatus` | GET `/api/device-network/wlan/status` | device-network | `/instances/:id/device-network`<br>`device-network/wlan` | read-panel | planned: Frozen-scope read has two redacted captured responses; runtime support is still decided per registered instance.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Detail resource has no collection-empty rendering.)<br>partial:N (Atomic detail read has no meaningful partial rendering.)<br>policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)<br>unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)<br>owner-switch:Y (Owner switch discards responses with a mismatched instance key.) | R0; none<br>direct | query-capability/read-retain/version-probe/safe-read/route-result<br>Registered instance, authorized actor, and runtime capability decision are required.<br>Retain last success as stale and permit an explicit safe refresh.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Safe reads may retry within deadline and retain stale success.<br>Structured result returns to the owning route with a redacted audit link. | REAL_READ | captured-readonly; n=2; categories=success; collector-selected fully-bound GET R0; two redacted real captures | `registry:getDeviceNetworkWlanStatus`<br>`upstream:backend/src/main.rs:574-575`<br>`upstream:backend/src/handlers.rs:1805-1819`<br>`upstream:bruno-api/get_device_wlan_status.bru:8`<br>`fixture:captured-readonly` |
|
||||
| `postDeviceNetworkWlanEnabled` | POST `/api/device-network/wlan/enabled` | device-network | `/instances/:id/device-network`<br>`device-network/wlan` | form | planned: Frozen-scope reversible command is contract-planned for a later controlled real-write acceptance phase.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)<br>partial:N (Single-target command has no meaningful partial result.)<br>policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)<br>unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)<br>owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R1; none<br>direct | command-current-state/write-revision/version-probe/verify-write/route-result<br>Refresh current state when available and bind the actor decision to its revision.<br>Refresh current state or require an explicit recorded revision-bound override.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Writes require outcome verification before actor-initiated retry.<br>Structured result returns to the owning route with a redacted audit link. | REAL_WRITE_LATER | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:postDeviceNetworkWlanEnabled`<br>`upstream:backend/src/main.rs:578-579`<br>`upstream:backend/src/handlers.rs:1822-1841`<br>`upstream:bruno-api/set_device_wlan_enabled.bru:8`<br>`fixture:not-eligible-readonly-capture` |
|
||||
| `postDeviceNetworkWlanScan` | POST `/api/device-network/wlan/scan` | device-network | `/instances/:id/device-network`<br>`device-network/wlan` | action | planned: Frozen-scope reversible command is contract-planned for a later controlled real-write acceptance phase.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)<br>partial:N (Single-target command has no meaningful partial result.)<br>policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)<br>unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)<br>owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R1; none<br>direct | command-current-state/write-revision/version-probe/verify-write/route-result<br>Refresh current state when available and bind the actor decision to its revision.<br>Refresh current state or require an explicit recorded revision-bound override.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Writes require outcome verification before actor-initiated retry.<br>Structured result returns to the owning route with a redacted audit link. | REAL_WRITE_LATER | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:postDeviceNetworkWlanScan`<br>`upstream:backend/src/main.rs:582-583`<br>`upstream:backend/src/handlers.rs:1844-1858`<br>`upstream:bruno-api/post_device_wlan_scan.bru:8`<br>`fixture:not-eligible-readonly-capture` |
|
||||
| `getDeviceNetworkWlanProfiles` | GET `/api/device-network/wlan/profiles` | device-network | `/instances/:id/device-network`<br>`device-network/wlan` | table | planned: Frozen-scope read has two redacted captured responses; runtime support is still decided per registered instance.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:Y (Successful collection may contain no rows.)<br>partial:Y (Independent response sections may succeed or fail.)<br>policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)<br>unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)<br>owner-switch:Y (Owner switch discards responses with a mismatched instance key.) | R0; none<br>direct | query-capability/read-retain/version-probe/safe-read/route-result<br>Registered instance, authorized actor, and runtime capability decision are required.<br>Retain last success as stale and permit an explicit safe refresh.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Safe reads may retry within deadline and retain stale success.<br>Structured result returns to the owning route with a redacted audit link. | REAL_READ | captured-readonly; n=2; categories=success; collector-selected fully-bound GET R0; two redacted real captures | `registry:getDeviceNetworkWlanProfiles`<br>`upstream:backend/src/main.rs:586-587`<br>`upstream:backend/src/handlers.rs:1861-1875`<br>`upstream:bruno-api/get_device_wlan_profiles.bru:8`<br>`fixture:captured-readonly` |
|
||||
| `postDeviceNetworkWlanForget` | POST `/api/device-network/wlan/forget` | device-network | `/instances/:id/device-network`<br>`device-network/wlan` | job-action | planned: Frozen-scope high-risk operation is planned with simulation-only acceptance until controlled safety authorization exists.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)<br>partial:N (Single-target command has no meaningful partial result.)<br>policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)<br>unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)<br>owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R2; explicit<br>preparation-job | job-fresh-preflight/high-risk-block/version-probe/new-job-lineage/job-result<br>Required fresh preflight; inability to refresh blocks execution.<br>Fresh preflight is mandatory; stale, expired, or unknown state blocks execution.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Retry creates a new Job lineage (retryOfJobId/rootJobId); never replay successful items.<br>/jobs/:jobId contains per-item result, attempt lineage, and redacted audit. | SIMULATED_HIGH_RISK | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:postDeviceNetworkWlanForget`<br>`upstream:backend/src/main.rs:590-591`<br>`upstream:backend/src/handlers.rs:1878-1897`<br>`upstream:bruno-api/post_device_wlan_forget.bru:8`<br>`fixture:not-eligible-readonly-capture` |
|
||||
| `postDeviceNetworkWlanConnect` | POST `/api/device-network/wlan/connect` | device-network | `/instances/:id/device-network`<br>`device-network/wlan` | form | planned: Frozen-scope reversible command is contract-planned for a later controlled real-write acceptance phase.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)<br>partial:N (Single-target command has no meaningful partial result.)<br>policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)<br>unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)<br>owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R1; none<br>direct | command-current-state/write-revision/version-probe/verify-write/route-result<br>Refresh current state when available and bind the actor decision to its revision.<br>Refresh current state or require an explicit recorded revision-bound override.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Writes require outcome verification before actor-initiated retry.<br>Structured result returns to the owning route with a redacted audit link. | REAL_WRITE_LATER | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:postDeviceNetworkWlanConnect`<br>`upstream:backend/src/main.rs:594-595`<br>`upstream:backend/src/handlers.rs:1900-1955`<br>`upstream:bruno-api/post_device_wlan_connect.bru:8`<br>`fixture:not-eligible-readonly-capture` |
|
||||
| `postDeviceNetworkWlanDisconnect` | POST `/api/device-network/wlan/disconnect` | device-network | `/instances/:id/device-network`<br>`device-network/wlan` | action | planned: Frozen-scope reversible command is contract-planned for a later controlled real-write acceptance phase.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)<br>partial:N (Single-target command has no meaningful partial result.)<br>policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)<br>unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)<br>owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R1; none<br>direct | command-current-state/write-revision/version-probe/verify-write/route-result<br>Refresh current state when available and bind the actor decision to its revision.<br>Refresh current state or require an explicit recorded revision-bound override.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Writes require outcome verification before actor-initiated retry.<br>Structured result returns to the owning route with a redacted audit link. | REAL_WRITE_LATER | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:postDeviceNetworkWlanDisconnect`<br>`upstream:backend/src/main.rs:598-599`<br>`upstream:backend/src/handlers.rs:1958-1991`<br>`upstream:bruno-api/post_device_wlan_disconnect.bru:8`<br>`fixture:not-eligible-readonly-capture` |
|
||||
| `postDeviceNetworkWlanProfile` | POST `/api/device-network/wlan/profile` | device-network | `/instances/:id/device-network`<br>`device-network/wlan` | form | planned: Frozen-scope reversible command is contract-planned for a later controlled real-write acceptance phase.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)<br>partial:N (Single-target command has no meaningful partial result.)<br>policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)<br>unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)<br>owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R1; none<br>direct | command-current-state/write-revision/version-probe/verify-write/route-result<br>Refresh current state when available and bind the actor decision to its revision.<br>Refresh current state or require an explicit recorded revision-bound override.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Writes require outcome verification before actor-initiated retry.<br>Structured result returns to the owning route with a redacted audit link. | REAL_WRITE_LATER | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:postDeviceNetworkWlanProfile`<br>`upstream:backend/src/main.rs:602-603`<br>`upstream:backend/src/handlers.rs:1994-2013`<br>`upstream:bruno-api/post_device_wlan_profile.bru:8`<br>`fixture:not-eligible-readonly-capture` |
|
||||
| `getNetworkSignalStrength` | GET `/api/network/signal-strength` | cellular | `/instances/:id/cellular`<br>`cellular/signal` | read-panel | planned: Frozen-scope read has two redacted captured responses; runtime support is still decided per registered instance.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Detail resource has no collection-empty rendering.)<br>partial:N (Atomic detail read has no meaningful partial rendering.)<br>policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)<br>unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)<br>owner-switch:Y (Owner switch discards responses with a mismatched instance key.) | R0; none<br>direct | query-capability/read-retain/version-probe/safe-read/route-result<br>Registered instance, authorized actor, and runtime capability decision are required.<br>Retain last success as stale and permit an explicit safe refresh.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Safe reads may retry within deadline and retain stale success.<br>Structured result returns to the owning route with a redacted audit link. | REAL_READ | captured-readonly; n=2; categories=success; collector-selected fully-bound GET R0; two redacted real captures | `registry:getNetworkSignalStrength`<br>`upstream:backend/src/main.rs:606-607`<br>`upstream:backend/src/handlers.rs:2016-2030`<br>`upstream:bruno-api/get_signal_strength.bru:8`<br>`fixture:captured-readonly` |
|
||||
| `getLocationCellInfo` | GET `/api/location/cell-info` | cellular | `/instances/:id/cellular`<br>`cellular/cells` | read-panel | planned: Frozen-scope read has two redacted captured responses; runtime support is still decided per registered instance.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Detail resource has no collection-empty rendering.)<br>partial:N (Atomic detail read has no meaningful partial rendering.)<br>policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)<br>unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)<br>owner-switch:Y (Owner switch discards responses with a mismatched instance key.) | R0; none<br>direct | query-capability/read-retain/version-probe/safe-read/route-result<br>Registered instance, authorized actor, and runtime capability decision are required.<br>Retain last success as stale and permit an explicit safe refresh.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Safe reads may retry within deadline and retain stale success.<br>Structured result returns to the owning route with a redacted audit link. | REAL_READ | captured-readonly; n=2; categories=success; collector-selected fully-bound GET R0; two redacted real captures | `registry:getLocationCellInfo`<br>`upstream:backend/src/main.rs:610-611`<br>`upstream:backend/src/handlers.rs:1395-1409`<br>`upstream:bruno-api/get_cell_location_info.bru:8`<br>`fixture:captured-readonly` |
|
||||
| `getNetworkOperators` | GET `/api/network/operators` | cellular | `/instances/:id/cellular`<br>`cellular/operator-registration` | table | planned: Frozen-scope read has two redacted captured responses; runtime support is still decided per registered instance.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:Y (Successful collection may contain no rows.)<br>partial:Y (Independent response sections may succeed or fail.)<br>policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)<br>unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)<br>owner-switch:Y (Owner switch discards responses with a mismatched instance key.) | R0; none<br>direct | query-capability/read-retain/version-probe/safe-read/route-result<br>Registered instance, authorized actor, and runtime capability decision are required.<br>Retain last success as stale and permit an explicit safe refresh.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Safe reads may retry within deadline and retain stale success.<br>Structured result returns to the owning route with a redacted audit link. | REAL_READ | captured-readonly; n=2; categories=success; collector-selected fully-bound GET R0; two redacted real captures | `registry:getNetworkOperators`<br>`upstream:backend/src/main.rs:614-615`<br>`upstream:backend/src/handlers.rs:1412-1426`<br>`upstream:bruno-api/get_operators.bru:8`<br>`fixture:captured-readonly` |
|
||||
| `getNetworkOperatorsScan` | GET `/api/network/operators/scan` | cellular | `/instances/:id/cellular`<br>`cellular/operator-registration` | read-panel | planned: Frozen-scope read is modeled but real capture was explicitly denied; runtime support is probed per instance.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:Y (A successful active operator scan may return no operators.)<br>partial:Y (The scan response may contain usable operators alongside per-result failures or incomplete entries.)<br>policy-forbidden:Y (Active scan may be blocked by capability, authorization, preflight, or active-scan policy.)<br>unknown-result:N (A timed-out scan result may be discarded; it is not an unknown persistent write outcome.)<br>owner-switch:Y (Owner switch discards scan responses with a mismatched instance key.) | R0; none<br>direct | command-current-state/write-revision/version-probe/verify-write/route-result<br>Refresh current state when available and bind the actor decision to its revision.<br>Refresh current state or require an explicit recorded revision-bound override.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Writes require outcome verification before actor-initiated retry.<br>Structured result returns to the owning route with a redacted audit link. | REAL_READ_DEFERRED | denied-readonly-candidate; n=0; categories=none; active radio/network scan | `registry:getNetworkOperatorsScan`<br>`upstream:backend/src/main.rs:618-619`<br>`upstream:backend/src/handlers.rs:1429-1443`<br>`upstream:bruno-api/scan_operators.bru:8`<br>`fixture:denied-readonly-candidate` |
|
||||
| `postNetworkRegisterManual` | POST `/api/network/register-manual` | cellular | `/instances/:id/cellular`<br>`cellular/operator-registration` | job-action | planned: Frozen-scope high-risk operation is planned with simulation-only acceptance until controlled safety authorization exists.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)<br>partial:N (Single-target command has no meaningful partial result.)<br>policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)<br>unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)<br>owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R2; explicit<br>preparation-job | job-fresh-preflight/high-risk-block/version-probe/new-job-lineage/job-result<br>Required fresh preflight; inability to refresh blocks execution.<br>Fresh preflight is mandatory; stale, expired, or unknown state blocks execution.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Retry creates a new Job lineage (retryOfJobId/rootJobId); never replay successful items.<br>/jobs/:jobId contains per-item result, attempt lineage, and redacted audit. | SIMULATED_HIGH_RISK | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:postNetworkRegisterManual`<br>`upstream:backend/src/main.rs:622-623`<br>`upstream:backend/src/handlers.rs:1446-1466`<br>`upstream:bruno-api/register_operator_manual.bru:8`<br>`fixture:not-eligible-readonly-capture` |
|
||||
| `postNetworkRegisterAuto` | POST `/api/network/register-auto` | cellular | `/instances/:id/cellular`<br>`cellular/operator-registration` | job-action | planned: Frozen-scope high-risk operation is planned with simulation-only acceptance until controlled safety authorization exists.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)<br>partial:N (Single-target command has no meaningful partial result.)<br>policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)<br>unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)<br>owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R2; explicit<br>preparation-job | job-fresh-preflight/high-risk-block/version-probe/new-job-lineage/job-result<br>Required fresh preflight; inability to refresh blocks execution.<br>Fresh preflight is mandatory; stale, expired, or unknown state blocks execution.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Retry creates a new Job lineage (retryOfJobId/rootJobId); never replay successful items.<br>/jobs/:jobId contains per-item result, attempt lineage, and redacted audit. | SIMULATED_HIGH_RISK | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:postNetworkRegisterAuto`<br>`upstream:backend/src/main.rs:626-627`<br>`upstream:backend/src/handlers.rs:1469-1486`<br>`upstream:bruno-api/register_operator_auto.bru:8`<br>`fixture:not-eligible-readonly-capture` |
|
||||
| `getApn` | GET `/api/apn` | data-connection | `/instances/:id/cellular`<br>`cellular/data-apn` | read-panel | planned: Frozen-scope read has two redacted captured responses; runtime support is still decided per registered instance.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Detail resource has no collection-empty rendering.)<br>partial:N (Atomic detail read has no meaningful partial rendering.)<br>policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)<br>unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)<br>owner-switch:Y (Owner switch discards responses with a mismatched instance key.) | R0; none<br>direct | query-capability/read-retain/version-probe/safe-read/route-result<br>Registered instance, authorized actor, and runtime capability decision are required.<br>Retain last success as stale and permit an explicit safe refresh.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Safe reads may retry within deadline and retain stale success.<br>Structured result returns to the owning route with a redacted audit link. | REAL_READ | captured-readonly; n=2; categories=success; collector-selected fully-bound GET R0; two redacted real captures | `registry:getApn`<br>`upstream:backend/src/main.rs:630-631`<br>`upstream:backend/src/handlers.rs:1489-1504`<br>`upstream:bruno-api/get_apn_list.bru:8`<br>`fixture:captured-readonly` |
|
||||
| `postApn` | POST `/api/apn` | data-connection | `/instances/:id/cellular`<br>`cellular/data-apn` | form | planned: Frozen-scope reversible command is contract-planned for a later controlled real-write acceptance phase.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)<br>partial:N (Single-target command has no meaningful partial result.)<br>policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)<br>unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)<br>owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R1; none<br>direct | command-current-state/write-revision/version-probe/verify-write/route-result<br>Refresh current state when available and bind the actor decision to its revision.<br>Refresh current state or require an explicit recorded revision-bound override.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Writes require outcome verification before actor-initiated retry.<br>Structured result returns to the owning route with a redacted audit link. | REAL_WRITE_LATER | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:postApn`<br>`upstream:backend/src/main.rs:630-632`<br>`upstream:backend/src/handlers.rs:1507-1571`<br>`upstream:bruno-api/set_apn.bru:8`<br>`fixture:not-eligible-readonly-capture` |
|
||||
| `getCellLock` | GET `/api/cell-lock` | radio-lock | `/instances/:id/cellular`<br>`cellular/radio-locks` | read-panel | planned: Frozen-scope read has two redacted captured responses; runtime support is still decided per registered instance.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Detail resource has no collection-empty rendering.)<br>partial:N (Atomic detail read has no meaningful partial rendering.)<br>policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)<br>unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)<br>owner-switch:Y (Owner switch discards responses with a mismatched instance key.) | R0; none<br>direct | query-capability/read-retain/version-probe/safe-read/route-result<br>Registered instance, authorized actor, and runtime capability decision are required.<br>Retain last success as stale and permit an explicit safe refresh.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Safe reads may retry within deadline and retain stale success.<br>Structured result returns to the owning route with a redacted audit link. | REAL_READ | captured-readonly; n=2; categories=success; collector-selected fully-bound GET R0; two redacted real captures | `registry:getCellLock`<br>`upstream:backend/src/main.rs:636-637`<br>`upstream:backend/src/handlers.rs:1574-1582`<br>`upstream:bruno-api/get_cell_lock.bru:8`<br>`fixture:captured-readonly` |
|
||||
| `postCellLock` | POST `/api/cell-lock` | radio-lock | `/instances/:id/cellular`<br>`cellular/radio-locks` | job-action | planned: Frozen-scope high-risk operation is planned with simulation-only acceptance until controlled safety authorization exists.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)<br>partial:N (Single-target command has no meaningful partial result.)<br>policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)<br>unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)<br>owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R2; explicit<br>preparation-job | job-fresh-preflight/high-risk-block/version-probe/new-job-lineage/job-result<br>Required fresh preflight; inability to refresh blocks execution.<br>Fresh preflight is mandatory; stale, expired, or unknown state blocks execution.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Retry creates a new Job lineage (retryOfJobId/rootJobId); never replay successful items.<br>/jobs/:jobId contains per-item result, attempt lineage, and redacted audit. | SIMULATED_HIGH_RISK | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:postCellLock`<br>`upstream:backend/src/main.rs:636-638`<br>`upstream:backend/src/handlers.rs:1585-1603`<br>`upstream:bruno-api/set_cell_lock_lte.bru:8`<br>`upstream:bruno-api/set_cell_lock_nr.bru:8`<br>`upstream:bruno-api/unlock_cell_nr.bru:8`<br>`fixture:not-eligible-readonly-capture` |
|
||||
| `postCellLockUnlockAll` | POST `/api/cell-lock/unlock-all` | radio-lock | `/instances/:id/cellular`<br>`cellular/radio-locks` | job-action | planned: Frozen-scope high-risk operation is planned with simulation-only acceptance until controlled safety authorization exists.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)<br>partial:N (Single-target command has no meaningful partial result.)<br>policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)<br>unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)<br>owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R2; explicit<br>preparation-job | job-fresh-preflight/high-risk-block/version-probe/new-job-lineage/job-result<br>Required fresh preflight; inability to refresh blocks execution.<br>Fresh preflight is mandatory; stale, expired, or unknown state blocks execution.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Retry creates a new Job lineage (retryOfJobId/rootJobId); never replay successful items.<br>/jobs/:jobId contains per-item result, attempt lineage, and redacted audit. | SIMULATED_HIGH_RISK | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:postCellLockUnlockAll`<br>`upstream:backend/src/main.rs:642-643`<br>`upstream:backend/src/handlers.rs:1606-1616`<br>`upstream:bruno-api/unlock_all_cells.bru:8`<br>`fixture:not-eligible-readonly-capture` |
|
||||
| `getData` | GET `/api/data` | data-connection | `/instances/:id/cellular`<br>`cellular/data-apn` | read-panel | planned: Frozen-scope read has two redacted captured responses; runtime support is still decided per registered instance.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Detail resource has no collection-empty rendering.)<br>partial:N (Atomic detail read has no meaningful partial rendering.)<br>policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)<br>unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)<br>owner-switch:Y (Owner switch discards responses with a mismatched instance key.) | R0; none<br>direct | query-capability/read-retain/version-probe/safe-read/route-result<br>Registered instance, authorized actor, and runtime capability decision are required.<br>Retain last success as stale and permit an explicit safe refresh.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Safe reads may retry within deadline and retain stale success.<br>Structured result returns to the owning route with a redacted audit link. | REAL_READ | captured-readonly; n=2; categories=success; collector-selected fully-bound GET R0; two redacted real captures | `registry:getData`<br>`upstream:backend/src/main.rs:647-648`<br>`upstream:backend/src/handlers.rs:2035-2062`<br>`upstream:bruno-api/get_data_status.bru:8`<br>`fixture:captured-readonly` |
|
||||
| `postData` | POST `/api/data` | data-connection | `/instances/:id/cellular`<br>`cellular/data-apn` | form | planned: Frozen-scope reversible command is contract-planned for a later controlled real-write acceptance phase.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)<br>partial:N (Single-target command has no meaningful partial result.)<br>policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)<br>unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)<br>owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R1; none<br>direct | command-current-state/write-revision/version-probe/verify-write/route-result<br>Refresh current state when available and bind the actor decision to its revision.<br>Refresh current state or require an explicit recorded revision-bound override.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Writes require outcome verification before actor-initiated retry.<br>Structured result returns to the owning route with a redacted audit link. | REAL_WRITE_LATER | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:postData`<br>`upstream:backend/src/main.rs:647-649`<br>`upstream:backend/src/handlers.rs:2065-2131`<br>`upstream:bruno-api/set_data_status_disable.bru:8`<br>`upstream:bruno-api/set_data_status_enable.bru:8`<br>`fixture:not-eligible-readonly-capture` |
|
||||
| `getRoaming` | GET `/api/roaming` | data-connection | `/instances/:id/cellular`<br>`cellular/data-apn` | read-panel | planned: Frozen-scope read has two redacted captured responses; runtime support is still decided per registered instance.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Detail resource has no collection-empty rendering.)<br>partial:N (Atomic detail read has no meaningful partial rendering.)<br>policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)<br>unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)<br>owner-switch:Y (Owner switch discards responses with a mismatched instance key.) | R0; none<br>direct | query-capability/read-retain/version-probe/safe-read/route-result<br>Registered instance, authorized actor, and runtime capability decision are required.<br>Retain last success as stale and permit an explicit safe refresh.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Safe reads may retry within deadline and retain stale success.<br>Structured result returns to the owning route with a redacted audit link. | REAL_READ | captured-readonly; n=2; categories=success; collector-selected fully-bound GET R0; two redacted real captures | `registry:getRoaming`<br>`upstream:backend/src/main.rs:653-654`<br>`upstream:backend/src/handlers.rs:2172-2193`<br>`upstream:bruno-api/get_roaming_status.bru:8`<br>`fixture:captured-readonly` |
|
||||
| `postRoaming` | POST `/api/roaming` | data-connection | `/instances/:id/cellular`<br>`cellular/data-apn` | form | planned: Frozen-scope reversible command is contract-planned for a later controlled real-write acceptance phase.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)<br>partial:N (Single-target command has no meaningful partial result.)<br>policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)<br>unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)<br>owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R1; none<br>direct | command-current-state/write-revision/version-probe/verify-write/route-result<br>Refresh current state when available and bind the actor decision to its revision.<br>Refresh current state or require an explicit recorded revision-bound override.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Writes require outcome verification before actor-initiated retry.<br>Structured result returns to the owning route with a redacted audit link. | REAL_WRITE_LATER | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:postRoaming`<br>`upstream:backend/src/main.rs:653-655`<br>`upstream:backend/src/handlers.rs:2196-2247`<br>`upstream:bruno-api/set_roaming_enable.bru:8`<br>`upstream:bruno-api/set_roaming_disable.bru:8`<br>`fixture:not-eligible-readonly-capture` |
|
||||
| `getAirplaneMode` | GET `/api/airplane-mode` | data-connection | `/instances/:id/cellular`<br>`cellular/data-apn` | read-panel | planned: Frozen-scope read has two redacted captured responses; runtime support is still decided per registered instance.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Detail resource has no collection-empty rendering.)<br>partial:N (Atomic detail read has no meaningful partial rendering.)<br>policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)<br>unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)<br>owner-switch:Y (Owner switch discards responses with a mismatched instance key.) | R0; none<br>direct | query-capability/read-retain/version-probe/safe-read/route-result<br>Registered instance, authorized actor, and runtime capability decision are required.<br>Retain last success as stale and permit an explicit safe refresh.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Safe reads may retry within deadline and retain stale success.<br>Structured result returns to the owning route with a redacted audit link. | REAL_READ | captured-readonly; n=2; categories=success; collector-selected fully-bound GET R0; two redacted real captures | `registry:getAirplaneMode`<br>`upstream:backend/src/main.rs:659-660`<br>`upstream:backend/src/handlers.rs:2315-2329`<br>`upstream:bruno-api/get_airplane_mode.bru:8`<br>`fixture:captured-readonly` |
|
||||
| `postAirplaneMode` | POST `/api/airplane-mode` | data-connection | `/instances/:id/cellular`<br>`cellular/data-apn` | form | planned: Frozen-scope reversible command is contract-planned for a later controlled real-write acceptance phase.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)<br>partial:N (Single-target command has no meaningful partial result.)<br>policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)<br>unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)<br>owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R1; none<br>direct | command-current-state/write-revision/version-probe/verify-write/route-result<br>Refresh current state when available and bind the actor decision to its revision.<br>Refresh current state or require an explicit recorded revision-bound override.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Writes require outcome verification before actor-initiated retry.<br>Structured result returns to the owning route with a redacted audit link. | REAL_WRITE_LATER | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:postAirplaneMode`<br>`upstream:backend/src/main.rs:659-661`<br>`upstream:backend/src/handlers.rs:2250-2312`<br>`upstream:bruno-api/set_airplane_mode_disable.bru:8`<br>`upstream:bruno-api/set_airplane_mode_enable.bru:8`<br>`fixture:not-eligible-readonly-capture` |
|
||||
| `postBasebandRestart` | POST `/api/baseband/restart` | data-connection | `/instances/:id/cellular`<br>`cellular/data-apn` | job-action | planned: Frozen-scope high-risk operation is planned with simulation-only acceptance until controlled safety authorization exists.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)<br>partial:N (Single-target command has no meaningful partial result.)<br>policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)<br>unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)<br>owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R3; strong<br>preparation-job | job-fresh-preflight/high-risk-block/version-probe/new-job-lineage/job-result<br>Required fresh preflight; inability to refresh blocks execution.<br>Fresh preflight is mandatory; stale, expired, or unknown state blocks execution.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Retry creates a new Job lineage (retryOfJobId/rootJobId); never replay successful items.<br>/jobs/:jobId contains per-item result, attempt lineage, and redacted audit. | SIMULATED_HIGH_RISK | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:postBasebandRestart`<br>`upstream:backend/src/main.rs:665-666`<br>`upstream:backend/src/handlers.rs:2133-2159`<br>`fixture:not-eligible-readonly-capture` |
|
||||
| `getBasebandRestartStatus` | GET `/api/baseband/restart/status` | data-connection | `/instances/:id/cellular`<br>`cellular/data-apn` | read-panel | planned: Frozen-scope read has two redacted captured responses; runtime support is still decided per registered instance.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Detail resource has no collection-empty rendering.)<br>partial:N (Atomic detail read has no meaningful partial rendering.)<br>policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)<br>unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)<br>owner-switch:Y (Owner switch discards responses with a mismatched instance key.) | R0; none<br>direct | query-capability/read-retain/version-probe/safe-read/route-result<br>Registered instance, authorized actor, and runtime capability decision are required.<br>Retain last success as stale and permit an explicit safe refresh.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Safe reads may retry within deadline and retain stale success.<br>Structured result returns to the owning route with a redacted audit link. | REAL_READ | captured-readonly; n=2; categories=success; collector-selected fully-bound GET R0; two redacted real captures | `registry:getBasebandRestartStatus`<br>`upstream:backend/src/main.rs:669-670`<br>`upstream:backend/src/handlers.rs:2161-2169`<br>`fixture:captured-readonly` |
|
||||
| `getWorkMode` | GET `/api/work-mode` | workmode-esim | `/instances/:id/esim`<br>`esim/mode` | read-panel | planned: Frozen-scope read has two redacted captured responses; runtime support is still decided per registered instance.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Detail resource has no collection-empty rendering.)<br>partial:N (Atomic detail read has no meaningful partial rendering.)<br>policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)<br>unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)<br>owner-switch:Y (Owner switch discards responses with a mismatched instance key.) | R0; none<br>direct | query-capability/read-retain/version-probe/safe-read/route-result<br>Registered instance, authorized actor, and runtime capability decision are required.<br>Retain last success as stale and permit an explicit safe refresh.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Safe reads may retry within deadline and retain stale success.<br>Structured result returns to the owning route with a redacted audit link. | REAL_READ | captured-readonly; n=2; categories=success; collector-selected fully-bound GET R0; two redacted real captures | `registry:getWorkMode`<br>`upstream:backend/src/main.rs:674-675`<br>`upstream:backend/src/handlers.rs:352-365`<br>`fixture:captured-readonly` |
|
||||
| `postWorkMode` | POST `/api/work-mode` | workmode-esim | `/instances/:id/esim`<br>`esim/mode` | job-action | planned: Frozen-scope high-risk operation is planned with simulation-only acceptance until controlled safety authorization exists.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)<br>partial:N (Single-target command has no meaningful partial result.)<br>policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)<br>unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)<br>owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R2; explicit<br>preparation-job | job-fresh-preflight/high-risk-block/version-probe/new-job-lineage/job-result<br>Required fresh preflight; inability to refresh blocks execution.<br>Fresh preflight is mandatory; stale, expired, or unknown state blocks execution.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Retry creates a new Job lineage (retryOfJobId/rootJobId); never replay successful items.<br>/jobs/:jobId contains per-item result, attempt lineage, and redacted audit. | SIMULATED_HIGH_RISK | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:postWorkMode`<br>`upstream:backend/src/main.rs:674-676`<br>`upstream:backend/src/handlers.rs:368-405`<br>`fixture:not-eligible-readonly-capture` |
|
||||
| `getEsimConfig` | GET `/api/esim/config` | workmode-esim | `/instances/:id/esim`<br>`esim/config` | read-panel | planned: Frozen-scope read has two redacted captured responses; runtime support is still decided per registered instance.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Detail resource has no collection-empty rendering.)<br>partial:N (Atomic detail read has no meaningful partial rendering.)<br>policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)<br>unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)<br>owner-switch:Y (Owner switch discards responses with a mismatched instance key.) | R0; none<br>direct | query-capability/read-retain/version-probe/safe-read/route-result<br>Registered instance, authorized actor, and runtime capability decision are required.<br>Retain last success as stale and permit an explicit safe refresh.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Safe reads may retry within deadline and retain stale success.<br>Structured result returns to the owning route with a redacted audit link. | REAL_READ | captured-readonly; n=2; categories=unsupported; collector-selected fully-bound GET R0; two redacted real captures | `registry:getEsimConfig`<br>`upstream:backend/src/main.rs:680-681`<br>`upstream:backend/src/handlers.rs:456-462`<br>`fixture:captured-readonly` |
|
||||
| `postEsimConfig` | POST `/api/esim/config` | workmode-esim | `/instances/:id/esim`<br>`esim/config` | job-action | planned: Frozen-scope high-risk operation is planned with simulation-only acceptance until controlled safety authorization exists.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)<br>partial:N (Single-target command has no meaningful partial result.)<br>policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)<br>unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)<br>owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R2; explicit<br>preparation-job | job-fresh-preflight/high-risk-block/version-probe/new-job-lineage/job-result<br>Required fresh preflight; inability to refresh blocks execution.<br>Fresh preflight is mandatory; stale, expired, or unknown state blocks execution.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Retry creates a new Job lineage (retryOfJobId/rootJobId); never replay successful items.<br>/jobs/:jobId contains per-item result, attempt lineage, and redacted audit. | SIMULATED_HIGH_RISK | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:postEsimConfig`<br>`upstream:backend/src/main.rs:680-682`<br>`upstream:backend/src/handlers.rs:465-482`<br>`fixture:not-eligible-readonly-capture` |
|
||||
| `getEsimLpacStatus` | GET `/api/esim/lpac/status` | workmode-esim | `/instances/:id/esim`<br>`esim/lpac` | read-panel | planned: Frozen-scope read has two redacted captured responses; runtime support is still decided per registered instance.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Detail resource has no collection-empty rendering.)<br>partial:N (Atomic detail read has no meaningful partial rendering.)<br>policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)<br>unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)<br>owner-switch:Y (Owner switch discards responses with a mismatched instance key.) | R0; none<br>direct | query-capability/read-retain/version-probe/safe-read/route-result<br>Registered instance, authorized actor, and runtime capability decision are required.<br>Retain last success as stale and permit an explicit safe refresh.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Safe reads may retry within deadline and retain stale success.<br>Structured result returns to the owning route with a redacted audit link. | REAL_READ | captured-readonly; n=2; categories=auth-required; collector-selected fully-bound GET R0; two redacted real captures | `registry:getEsimLpacStatus`<br>`upstream:backend/src/main.rs:686-687`<br>`upstream:backend/src/handlers.rs:408-416`<br>`fixture:captured-readonly` |
|
||||
| `postEsimLpacRepair` | POST `/api/esim/lpac/repair` | workmode-esim | `/instances/:id/esim`<br>`esim/lpac` | job-action | planned: Frozen-scope high-risk operation is planned with simulation-only acceptance until controlled safety authorization exists.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)<br>partial:N (Single-target command has no meaningful partial result.)<br>policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)<br>unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)<br>owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R2; explicit<br>preparation-job | job-fresh-preflight/high-risk-block/version-probe/new-job-lineage/job-result<br>Required fresh preflight; inability to refresh blocks execution.<br>Fresh preflight is mandatory; stale, expired, or unknown state blocks execution.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Retry creates a new Job lineage (retryOfJobId/rootJobId); never replay successful items.<br>/jobs/:jobId contains per-item result, attempt lineage, and redacted audit. | SIMULATED_HIGH_RISK | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:postEsimLpacRepair`<br>`upstream:backend/src/main.rs:690-691`<br>`upstream:backend/src/handlers.rs:419-453`<br>`fixture:not-eligible-readonly-capture` |
|
||||
| `getEsimEuicc` | GET `/api/esim/euicc` | workmode-esim | `/instances/:id/esim`<br>`esim/euicc` | read-panel | planned: Frozen-scope read is modeled but real capture was explicitly denied; runtime support is probed per instance.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Detail resource has no collection-empty rendering.)<br>partial:N (Atomic detail read has no meaningful partial rendering.)<br>policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)<br>unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)<br>owner-switch:Y (Owner switch discards responses with a mismatched instance key.) | R0; none<br>direct | query-capability/read-retain/version-probe/safe-read/route-result<br>Registered instance, authorized actor, and runtime capability decision are required.<br>Retain last success as stale and permit an explicit safe refresh.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Safe reads may retry within deadline and retain stale success.<br>Structured result returns to the owning route with a redacted audit link. | REAL_READ_DEFERRED | denied-readonly-candidate; n=0; categories=none; query-bearing endpoint omitted | `registry:getEsimEuicc`<br>`upstream:backend/src/main.rs:694-695`<br>`upstream:backend/src/handlers.rs:485-521`<br>`fixture:denied-readonly-candidate` |
|
||||
| `getEsimProfiles` | GET `/api/esim/profiles` | workmode-esim | `/instances/:id/esim`<br>`esim/profiles` | table | planned: Frozen-scope read is modeled but real capture was explicitly denied; runtime support is probed per instance.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:Y (Successful collection may contain no rows.)<br>partial:Y (Independent response sections may succeed or fail.)<br>policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)<br>unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)<br>owner-switch:Y (Owner switch discards responses with a mismatched instance key.) | R0; none<br>direct | query-capability/read-retain/version-probe/safe-read/route-result<br>Registered instance, authorized actor, and runtime capability decision are required.<br>Retain last success as stale and permit an explicit safe refresh.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Safe reads may retry within deadline and retain stale success.<br>Structured result returns to the owning route with a redacted audit link. | REAL_READ_DEFERRED | denied-readonly-candidate; n=0; categories=none; query-bearing endpoint omitted | `registry:getEsimProfiles`<br>`upstream:backend/src/main.rs:698-699`<br>`upstream:backend/src/handlers.rs:524-598`<br>`fixture:denied-readonly-candidate` |
|
||||
| `postEsimProfiles` | POST `/api/esim/profiles` | workmode-esim | `/instances/:id/esim`<br>`esim/profiles` | form | planned: Frozen-scope reversible command is contract-planned for a later controlled real-write acceptance phase.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)<br>partial:N (Single-target command has no meaningful partial result.)<br>policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)<br>unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)<br>owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R1; none<br>direct | command-current-state/write-revision/version-probe/verify-write/route-result<br>Refresh current state when available and bind the actor decision to its revision.<br>Refresh current state or require an explicit recorded revision-bound override.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Writes require outcome verification before actor-initiated retry.<br>Structured result returns to the owning route with a redacted audit link. | REAL_WRITE_LATER | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:postEsimProfiles`<br>`upstream:backend/src/main.rs:698-700`<br>`upstream:backend/src/handlers.rs:803-1071`<br>`fixture:not-eligible-readonly-capture` |
|
||||
| `postEsimProfilesIccidEnable` | POST `/api/esim/profiles/{iccid}/enable` | workmode-esim | `/instances/:id/esim`<br>`esim/profiles` | action | planned: Frozen-scope reversible command is contract-planned for a later controlled real-write acceptance phase.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)<br>partial:N (Single-target command has no meaningful partial result.)<br>policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)<br>unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)<br>owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R1; none<br>direct | command-current-state/write-revision/version-probe/verify-write/route-result<br>Refresh current state when available and bind the actor decision to its revision.<br>Refresh current state or require an explicit recorded revision-bound override.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Writes require outcome verification before actor-initiated retry.<br>Structured result returns to the owning route with a redacted audit link. | REAL_WRITE_LATER | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:postEsimProfilesIccidEnable`<br>`upstream:backend/src/main.rs:704-705`<br>`upstream:backend/src/handlers.rs:601-726`<br>`fixture:not-eligible-readonly-capture` |
|
||||
| `postEsimProfilesIccidRename` | POST `/api/esim/profiles/{iccid}/rename` | workmode-esim | `/instances/:id/esim`<br>`esim/profiles` | form | planned: Frozen-scope reversible command is contract-planned for a later controlled real-write acceptance phase.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)<br>partial:N (Single-target command has no meaningful partial result.)<br>policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)<br>unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)<br>owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R1; none<br>direct | command-current-state/write-revision/version-probe/verify-write/route-result<br>Refresh current state when available and bind the actor decision to its revision.<br>Refresh current state or require an explicit recorded revision-bound override.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Writes require outcome verification before actor-initiated retry.<br>Structured result returns to the owning route with a redacted audit link. | REAL_WRITE_LATER | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:postEsimProfilesIccidRename`<br>`upstream:backend/src/main.rs:708-709`<br>`upstream:backend/src/handlers.rs:729-750`<br>`fixture:not-eligible-readonly-capture` |
|
||||
| `deleteEsimProfilesIccid` | DELETE `/api/esim/profiles/{iccid}` | workmode-esim | `/instances/:id/esim`<br>`esim/profiles` | job-action | planned: Frozen-scope high-risk operation is planned with simulation-only acceptance until controlled safety authorization exists.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)<br>partial:N (Single-target command has no meaningful partial result.)<br>policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)<br>unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)<br>owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R3; strong<br>preparation-job | job-fresh-preflight/high-risk-block/version-probe/new-job-lineage/job-result<br>Required fresh preflight; inability to refresh blocks execution.<br>Fresh preflight is mandatory; stale, expired, or unknown state blocks execution.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Retry creates a new Job lineage (retryOfJobId/rootJobId); never replay successful items.<br>/jobs/:jobId contains per-item result, attempt lineage, and redacted audit. | SIMULATED_HIGH_RISK | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:deleteEsimProfilesIccid`<br>`upstream:backend/src/main.rs:712-713`<br>`upstream:backend/src/handlers.rs:753-780`<br>`fixture:not-eligible-readonly-capture` |
|
||||
| `getCalls` | GET `/api/calls` | calls | `/instances/:id/calls`<br>`calls/live` | table | planned: Frozen-scope read has two redacted captured responses; runtime support is still decided per registered instance.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:Y (Successful collection may contain no rows.)<br>partial:Y (Independent response sections may succeed or fail.)<br>policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)<br>unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)<br>owner-switch:Y (Owner switch discards responses with a mismatched instance key.) | R0; none<br>direct | query-capability/read-retain/version-probe/safe-read/route-result<br>Registered instance, authorized actor, and runtime capability decision are required.<br>Retain last success as stale and permit an explicit safe refresh.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Safe reads may retry within deadline and retain stale success.<br>Structured result returns to the owning route with a redacted audit link. | REAL_READ | captured-readonly; n=2; categories=success; collector-selected fully-bound GET R0; two redacted real captures | `registry:getCalls`<br>`upstream:backend/src/main.rs:717-718`<br>`upstream:backend/src/handlers.rs:2634-2655`<br>`upstream:bruno-api/get_calls.bru:8`<br>`fixture:captured-readonly` |
|
||||
| `postCallDial` | POST `/api/call/dial` | calls | `/instances/:id/calls`<br>`calls/live` | form | planned: Frozen-scope reversible command is contract-planned for a later controlled real-write acceptance phase.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)<br>partial:N (Single-target command has no meaningful partial result.)<br>policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)<br>unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)<br>owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R1; none<br>direct | command-current-state/write-revision/version-probe/verify-write/route-result<br>Refresh current state when available and bind the actor decision to its revision.<br>Refresh current state or require an explicit recorded revision-bound override.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Writes require outcome verification before actor-initiated retry.<br>Structured result returns to the owning route with a redacted audit link. | REAL_WRITE_LATER | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:postCallDial`<br>`upstream:backend/src/main.rs:721-722`<br>`upstream:backend/src/handlers.rs:2657-2689`<br>`upstream:bruno-api/post_call_dial.bru:8`<br>`fixture:not-eligible-readonly-capture` |
|
||||
| `postCallHangup` | POST `/api/call/hangup` | calls | `/instances/:id/calls`<br>`calls/live` | form | planned: Frozen-scope reversible command is contract-planned for a later controlled real-write acceptance phase.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)<br>partial:N (Single-target command has no meaningful partial result.)<br>policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)<br>unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)<br>owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R1; none<br>direct | command-current-state/write-revision/version-probe/verify-write/route-result<br>Refresh current state when available and bind the actor decision to its revision.<br>Refresh current state or require an explicit recorded revision-bound override.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Writes require outcome verification before actor-initiated retry.<br>Structured result returns to the owning route with a redacted audit link. | REAL_WRITE_LATER | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:postCallHangup`<br>`upstream:backend/src/main.rs:725-726`<br>`upstream:backend/src/handlers.rs:2691-2725`<br>`upstream:bruno-api/post_call_hangup.bru:8`<br>`fixture:not-eligible-readonly-capture` |
|
||||
| `postCallHangupAll` | POST `/api/call/hangup-all` | calls | `/instances/:id/calls`<br>`calls/live` | action | planned: Frozen-scope reversible command is contract-planned for a later controlled real-write acceptance phase.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)<br>partial:N (Single-target command has no meaningful partial result.)<br>policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)<br>unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)<br>owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R1; none<br>direct | command-current-state/write-revision/version-probe/verify-write/route-result<br>Refresh current state when available and bind the actor decision to its revision.<br>Refresh current state or require an explicit recorded revision-bound override.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Writes require outcome verification before actor-initiated retry.<br>Structured result returns to the owning route with a redacted audit link. | REAL_WRITE_LATER | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:postCallHangupAll`<br>`upstream:backend/src/main.rs:729-730`<br>`upstream:backend/src/handlers.rs:2727-2760`<br>`upstream:bruno-api/post_call_hangup_all.bru:8`<br>`fixture:not-eligible-readonly-capture` |
|
||||
| `postCallAnswer` | POST `/api/call/answer` | calls | `/instances/:id/calls`<br>`calls/live` | form | planned: Frozen-scope reversible command is contract-planned for a later controlled real-write acceptance phase.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)<br>partial:N (Single-target command has no meaningful partial result.)<br>policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)<br>unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)<br>owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R1; none<br>direct | command-current-state/write-revision/version-probe/verify-write/route-result<br>Refresh current state when available and bind the actor decision to its revision.<br>Refresh current state or require an explicit recorded revision-bound override.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Writes require outcome verification before actor-initiated retry.<br>Structured result returns to the owning route with a redacted audit link. | REAL_WRITE_LATER | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:postCallAnswer`<br>`upstream:backend/src/main.rs:733-734`<br>`upstream:backend/src/handlers.rs:2762-2789`<br>`upstream:bruno-api/post_call_answer.bru:8`<br>`fixture:not-eligible-readonly-capture` |
|
||||
| `getCallVolume` | GET `/api/call/volume` | calls | `/instances/:id/calls`<br>`calls/volume` | read-panel | planned: Frozen-scope read has two redacted captured responses; runtime support is still decided per registered instance.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Detail resource has no collection-empty rendering.)<br>partial:N (Atomic detail read has no meaningful partial rendering.)<br>policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)<br>unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)<br>owner-switch:Y (Owner switch discards responses with a mismatched instance key.) | R0; none<br>direct | query-capability/read-retain/version-probe/safe-read/route-result<br>Registered instance, authorized actor, and runtime capability decision are required.<br>Retain last success as stale and permit an explicit safe refresh.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Safe reads may retry within deadline and retain stale success.<br>Structured result returns to the owning route with a redacted audit link. | REAL_READ | captured-readonly; n=2; categories=success; collector-selected fully-bound GET R0; two redacted real captures | `registry:getCallVolume`<br>`upstream:backend/src/main.rs:737-738`<br>`upstream:backend/src/handlers.rs:2899-2906`<br>`upstream:bruno-api/get_call_volume.bru:8`<br>`fixture:captured-readonly` |
|
||||
| `postCallVolume` | POST `/api/call/volume` | calls | `/instances/:id/calls`<br>`calls/volume` | form | planned: Frozen-scope reversible command is contract-planned for a later controlled real-write acceptance phase.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)<br>partial:N (Single-target command has no meaningful partial result.)<br>policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)<br>unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)<br>owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R1; none<br>direct | command-current-state/write-revision/version-probe/verify-write/route-result<br>Refresh current state when available and bind the actor decision to its revision.<br>Refresh current state or require an explicit recorded revision-bound override.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Writes require outcome verification before actor-initiated retry.<br>Structured result returns to the owning route with a redacted audit link. | REAL_WRITE_LATER | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:postCallVolume`<br>`upstream:backend/src/main.rs:737-739`<br>`upstream:backend/src/handlers.rs:2908-2922`<br>`upstream:bruno-api/set_call_volume.bru:8`<br>`fixture:not-eligible-readonly-capture` |
|
||||
| `getCallForwarding` | GET `/api/call/forwarding` | calls | `/instances/:id/calls`<br>`calls/forwarding` | read-panel | planned: Frozen-scope read has two redacted captured responses; runtime support is still decided per registered instance.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Detail resource has no collection-empty rendering.)<br>partial:N (Atomic detail read has no meaningful partial rendering.)<br>policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)<br>unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)<br>owner-switch:Y (Owner switch discards responses with a mismatched instance key.) | R0; none<br>direct | query-capability/read-retain/version-probe/safe-read/route-result<br>Registered instance, authorized actor, and runtime capability decision are required.<br>Retain last success as stale and permit an explicit safe refresh.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Safe reads may retry within deadline and retain stale success.<br>Structured result returns to the owning route with a redacted audit link. | REAL_READ | captured-readonly; n=2; categories=success; collector-selected fully-bound GET R0; two redacted real captures | `registry:getCallForwarding`<br>`upstream:backend/src/main.rs:743-744`<br>`upstream:backend/src/handlers.rs:2924-2931`<br>`upstream:bruno-api/get_call_forwarding.bru:8`<br>`fixture:captured-readonly` |
|
||||
| `postCallForwarding` | POST `/api/call/forwarding` | calls | `/instances/:id/calls`<br>`calls/forwarding` | form | planned: Frozen-scope reversible command is contract-planned for a later controlled real-write acceptance phase.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)<br>partial:N (Single-target command has no meaningful partial result.)<br>policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)<br>unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)<br>owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R1; none<br>direct | command-current-state/write-revision/version-probe/verify-write/route-result<br>Refresh current state when available and bind the actor decision to its revision.<br>Refresh current state or require an explicit recorded revision-bound override.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Writes require outcome verification before actor-initiated retry.<br>Structured result returns to the owning route with a redacted audit link. | REAL_WRITE_LATER | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:postCallForwarding`<br>`upstream:backend/src/main.rs:743-745`<br>`upstream:backend/src/handlers.rs:2933-2943`<br>`upstream:bruno-api/set_call_forwarding.bru:8`<br>`fixture:not-eligible-readonly-capture` |
|
||||
| `getCallSettings` | GET `/api/call/settings` | calls | `/instances/:id/calls`<br>`calls/settings` | read-panel | planned: Frozen-scope read has two redacted captured responses; runtime support is still decided per registered instance.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Detail resource has no collection-empty rendering.)<br>partial:N (Atomic detail read has no meaningful partial rendering.)<br>policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)<br>unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)<br>owner-switch:Y (Owner switch discards responses with a mismatched instance key.) | R0; none<br>direct | query-capability/read-retain/version-probe/safe-read/route-result<br>Registered instance, authorized actor, and runtime capability decision are required.<br>Retain last success as stale and permit an explicit safe refresh.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Safe reads may retry within deadline and retain stale success.<br>Structured result returns to the owning route with a redacted audit link. | REAL_READ | captured-readonly; n=2; categories=success; collector-selected fully-bound GET R0; two redacted real captures | `registry:getCallSettings`<br>`upstream:backend/src/main.rs:749-750`<br>`upstream:backend/src/handlers.rs:2852-2866`<br>`upstream:bruno-api/get_call_settings.bru:8`<br>`fixture:captured-readonly` |
|
||||
| `postCallSettings` | POST `/api/call/settings` | calls | `/instances/:id/calls`<br>`calls/settings` | job-action | planned: Frozen-scope high-risk operation is planned with simulation-only acceptance until controlled safety authorization exists.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)<br>partial:N (Single-target command has no meaningful partial result.)<br>policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)<br>unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)<br>owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R2; explicit<br>preparation-job | job-fresh-preflight/high-risk-block/version-probe/new-job-lineage/job-result<br>Required fresh preflight; inability to refresh blocks execution.<br>Fresh preflight is mandatory; stale, expired, or unknown state blocks execution.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Retry creates a new Job lineage (retryOfJobId/rootJobId); never replay successful items.<br>/jobs/:jobId contains per-item result, attempt lineage, and redacted audit. | SIMULATED_HIGH_RISK | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:postCallSettings`<br>`upstream:backend/src/main.rs:749-751`<br>`upstream:backend/src/handlers.rs:2868-2897`<br>`upstream:bruno-api/set_call_settings.bru:8`<br>`fixture:not-eligible-readonly-capture` |
|
||||
| `getCallHistory` | GET `/api/call/history` | calls | `/instances/:id/calls`<br>`calls/history` | table | planned: Frozen-scope read is modeled but real capture was explicitly denied; runtime support is probed per instance.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:Y (Successful collection may contain no rows.)<br>partial:Y (Independent response sections may succeed or fail.)<br>policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)<br>unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)<br>owner-switch:Y (Owner switch discards responses with a mismatched instance key.) | R0; none<br>direct | query-capability/read-retain/version-probe/safe-read/route-result<br>Registered instance, authorized actor, and runtime capability decision are required.<br>Retain last success as stale and permit an explicit safe refresh.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Safe reads may retry within deadline and retain stale success.<br>Structured result returns to the owning route with a redacted audit link. | REAL_READ_DEFERRED | denied-readonly-candidate; n=0; categories=none; query limit is not encoded in Registry path contract | `registry:getCallHistory`<br>`upstream:backend/src/main.rs:755-756`<br>`upstream:backend/src/handlers.rs:2791-2813`<br>`fixture:denied-readonly-candidate` |
|
||||
| `deleteCallHistoryId` | DELETE `/api/call/history/{id}` | calls | `/instances/:id/calls`<br>`calls/history` | job-action | planned: Frozen-scope high-risk operation is planned with simulation-only acceptance until controlled safety authorization exists.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)<br>partial:N (Single-target command has no meaningful partial result.)<br>policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)<br>unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)<br>owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R3; strong<br>preparation-job | job-fresh-preflight/high-risk-block/version-probe/new-job-lineage/job-result<br>Required fresh preflight; inability to refresh blocks execution.<br>Fresh preflight is mandatory; stale, expired, or unknown state blocks execution.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Retry creates a new Job lineage (retryOfJobId/rootJobId); never replay successful items.<br>/jobs/:jobId contains per-item result, attempt lineage, and redacted audit. | SIMULATED_HIGH_RISK | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:deleteCallHistoryId`<br>`upstream:backend/src/main.rs:759-760`<br>`upstream:backend/src/handlers.rs:2815-2832`<br>`upstream:bruno-api/delete_call_history.bru:8`<br>`fixture:not-eligible-readonly-capture` |
|
||||
| `postCallHistoryClear` | POST `/api/call/history/clear` | calls | `/instances/:id/calls`<br>`calls/history` | job-action | planned: Frozen-scope high-risk operation is planned with simulation-only acceptance until controlled safety authorization exists.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)<br>partial:N (Single-target command has no meaningful partial result.)<br>policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)<br>unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)<br>owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R3; strong<br>preparation-job | job-fresh-preflight/high-risk-block/version-probe/new-job-lineage/job-result<br>Required fresh preflight; inability to refresh blocks execution.<br>Fresh preflight is mandatory; stale, expired, or unknown state blocks execution.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Retry creates a new Job lineage (retryOfJobId/rootJobId); never replay successful items.<br>/jobs/:jobId contains per-item result, attempt lineage, and redacted audit. | SIMULATED_HIGH_RISK | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:postCallHistoryClear`<br>`upstream:backend/src/main.rs:763-764`<br>`upstream:backend/src/handlers.rs:2834-2850`<br>`upstream:bruno-api/clear_call_history.bru:8`<br>`fixture:not-eligible-readonly-capture` |
|
||||
| `getImsStatus` | GET `/api/ims/status` | calls | `/instances/:id/calls`<br>`calls/ims-voicemail` | read-panel | planned: Frozen-scope read has two redacted captured responses; runtime support is still decided per registered instance.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Detail resource has no collection-empty rendering.)<br>partial:N (Atomic detail read has no meaningful partial rendering.)<br>policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)<br>unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)<br>owner-switch:Y (Owner switch discards responses with a mismatched instance key.) | R0; none<br>direct | query-capability/read-retain/version-probe/safe-read/route-result<br>Registered instance, authorized actor, and runtime capability decision are required.<br>Retain last success as stale and permit an explicit safe refresh.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Safe reads may retry within deadline and retain stale success.<br>Structured result returns to the owning route with a redacted audit link. | REAL_READ | captured-readonly; n=2; categories=success; collector-selected fully-bound GET R0; two redacted real captures | `registry:getImsStatus`<br>`upstream:backend/src/main.rs:767-768`<br>`upstream:backend/src/handlers.rs:2945-2952`<br>`upstream:bruno-api/get_ims_status.bru:8`<br>`fixture:captured-readonly` |
|
||||
| `getVoicemailStatus` | GET `/api/voicemail/status` | calls | `/instances/:id/calls`<br>`calls/ims-voicemail` | read-panel | planned: Frozen-scope read has two redacted captured responses; runtime support is still decided per registered instance.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Detail resource has no collection-empty rendering.)<br>partial:N (Atomic detail read has no meaningful partial rendering.)<br>policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)<br>unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)<br>owner-switch:Y (Owner switch discards responses with a mismatched instance key.) | R0; none<br>direct | query-capability/read-retain/version-probe/safe-read/route-result<br>Registered instance, authorized actor, and runtime capability decision are required.<br>Retain last success as stale and permit an explicit safe refresh.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Safe reads may retry within deadline and retain stale success.<br>Structured result returns to the owning route with a redacted audit link. | REAL_READ | captured-readonly; n=2; categories=success; collector-selected fully-bound GET R0; two redacted real captures | `registry:getVoicemailStatus`<br>`upstream:backend/src/main.rs:771-772`<br>`upstream:backend/src/handlers.rs:2954-2961`<br>`upstream:bruno-api/get_voicemail_status.bru:8`<br>`fixture:captured-readonly` |
|
||||
| `postSmsSend` | POST `/api/sms/send` | messages | `/instances/:id/messages`<br>`messages/compose` | job-action | planned: Frozen-scope high-risk operation is planned with simulation-only acceptance until controlled safety authorization exists.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)<br>partial:N (Single-target command has no meaningful partial result.)<br>policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)<br>unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)<br>owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R2; explicit<br>preparation-job | job-fresh-preflight/high-risk-block/version-probe/new-job-lineage/job-result<br>Required fresh preflight; inability to refresh blocks execution.<br>Fresh preflight is mandatory; stale, expired, or unknown state blocks execution.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Retry creates a new Job lineage (retryOfJobId/rootJobId); never replay successful items.<br>/jobs/:jobId contains per-item result, attempt lineage, and redacted audit. | SIMULATED_HIGH_RISK | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:postSmsSend`<br>`upstream:backend/src/main.rs:776-777`<br>`upstream:backend/src/handlers.rs:2373-2404`<br>`upstream:bruno-api/post_sms_send.bru:8`<br>`fixture:not-eligible-readonly-capture` |
|
||||
| `getSmsList` | GET `/api/sms/list` | messages | `/instances/:id/messages`<br>`messages/list` | table | planned: Frozen-scope read is modeled but real capture was explicitly denied; runtime support is probed per instance.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:Y (Successful collection may contain no rows.)<br>partial:Y (Independent response sections may succeed or fail.)<br>policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)<br>unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)<br>owner-switch:Y (Owner switch discards responses with a mismatched instance key.) | R0; none<br>direct | query-capability/read-retain/version-probe/safe-read/route-result<br>Registered instance, authorized actor, and runtime capability decision are required.<br>Retain last success as stale and permit an explicit safe refresh.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Safe reads may retry within deadline and retain stale success.<br>Structured result returns to the owning route with a redacted audit link. | REAL_READ_DEFERRED | denied-readonly-candidate; n=0; categories=none; message list can expose body; intentionally not collected | `registry:getSmsList`<br>`upstream:backend/src/main.rs:780-781`<br>`upstream:backend/src/handlers.rs:2407-2434`<br>`fixture:denied-readonly-candidate` |
|
||||
| `getSmsConversation` | GET `/api/sms/conversation` | messages | `/instances/:id/messages`<br>`messages/conversation` | table | planned: Frozen-scope read is modeled but real capture was explicitly denied; runtime support is probed per instance.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:Y (Successful collection may contain no rows.)<br>partial:Y (Independent response sections may succeed or fail.)<br>policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)<br>unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)<br>owner-switch:Y (Owner switch discards responses with a mismatched instance key.) | R0; none<br>direct | query-capability/read-retain/version-probe/safe-read/route-result<br>Registered instance, authorized actor, and runtime capability decision are required.<br>Retain last success as stale and permit an explicit safe refresh.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Safe reads may retry within deadline and retain stale success.<br>Structured result returns to the owning route with a redacted audit link. | REAL_READ_DEFERRED | denied-readonly-candidate; n=0; categories=none; requires correspondent query and exposes message bodies | `registry:getSmsConversation`<br>`upstream:backend/src/main.rs:784-785`<br>`upstream:backend/src/handlers.rs:2437-2458`<br>`fixture:denied-readonly-candidate` |
|
||||
| `getSmsStats` | GET `/api/sms/stats` | messages | `/instances/:id/messages`<br>`messages/stats` | read-panel | planned: Frozen-scope read has two redacted captured responses; runtime support is still decided per registered instance.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Detail resource has no collection-empty rendering.)<br>partial:N (Atomic detail read has no meaningful partial rendering.)<br>policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)<br>unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)<br>owner-switch:Y (Owner switch discards responses with a mismatched instance key.) | R0; none<br>direct | query-capability/read-retain/version-probe/safe-read/route-result<br>Registered instance, authorized actor, and runtime capability decision are required.<br>Retain last success as stale and permit an explicit safe refresh.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Safe reads may retry within deadline and retain stale success.<br>Structured result returns to the owning route with a redacted audit link. | REAL_READ | captured-readonly; n=2; categories=success; collector-selected fully-bound GET R0; two redacted real captures | `registry:getSmsStats`<br>`upstream:backend/src/main.rs:788-789`<br>`upstream:backend/src/handlers.rs:2461-2477`<br>`upstream:bruno-api/get_sms_stats.bru:8`<br>`fixture:captured-readonly` |
|
||||
| `postSmsBatchDelete` | POST `/api/sms/batch-delete` | messages | `/instances/:id/messages`<br>`messages/destructive` | job-action | planned: Frozen-scope high-risk operation is planned with simulation-only acceptance until controlled safety authorization exists.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)<br>partial:Y (Job items may independently succeed, fail, or be skipped.)<br>policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)<br>unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)<br>owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R3; strong<br>preparation-job | job-fresh-preflight/high-risk-block/version-probe/new-job-lineage/job-result<br>Required fresh preflight; inability to refresh blocks execution.<br>Fresh preflight is mandatory; stale, expired, or unknown state blocks execution.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Retry creates a new Job lineage (retryOfJobId/rootJobId); never replay successful items.<br>/jobs/:jobId contains per-item result, attempt lineage, and redacted audit. | SIMULATED_HIGH_RISK | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:postSmsBatchDelete`<br>`upstream:backend/src/main.rs:792-793`<br>`upstream:backend/src/handlers.rs:2551-2578`<br>`fixture:not-eligible-readonly-capture` |
|
||||
| `deleteSmsConversationPhoneNumber` | DELETE `/api/sms/conversation/{phone_number}` | messages | `/instances/:id/messages`<br>`messages/destructive` | job-action | planned: Frozen-scope high-risk operation is planned with simulation-only acceptance until controlled safety authorization exists.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)<br>partial:N (Single-target command has no meaningful partial result.)<br>policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)<br>unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)<br>owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R3; strong<br>preparation-job | job-fresh-preflight/high-risk-block/version-probe/new-job-lineage/job-result<br>Required fresh preflight; inability to refresh blocks execution.<br>Fresh preflight is mandatory; stale, expired, or unknown state blocks execution.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Retry creates a new Job lineage (retryOfJobId/rootJobId); never replay successful items.<br>/jobs/:jobId contains per-item result, attempt lineage, and redacted audit. | SIMULATED_HIGH_RISK | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:deleteSmsConversationPhoneNumber`<br>`upstream:backend/src/main.rs:796-797`<br>`upstream:backend/src/handlers.rs:2528-2548`<br>`fixture:not-eligible-readonly-capture` |
|
||||
| `deleteSmsMessageId` | DELETE `/api/sms/message/{id}` | messages | `/instances/:id/messages`<br>`messages/destructive` | job-action | planned: Frozen-scope high-risk operation is planned with simulation-only acceptance until controlled safety authorization exists.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)<br>partial:N (Single-target command has no meaningful partial result.)<br>policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)<br>unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)<br>owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R3; strong<br>preparation-job | job-fresh-preflight/high-risk-block/version-probe/new-job-lineage/job-result<br>Required fresh preflight; inability to refresh blocks execution.<br>Fresh preflight is mandatory; stale, expired, or unknown state blocks execution.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Retry creates a new Job lineage (retryOfJobId/rootJobId); never replay successful items.<br>/jobs/:jobId contains per-item result, attempt lineage, and redacted audit. | SIMULATED_HIGH_RISK | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:deleteSmsMessageId`<br>`upstream:backend/src/main.rs:800-801`<br>`upstream:backend/src/handlers.rs:2508-2525`<br>`fixture:not-eligible-readonly-capture` |
|
||||
| `postSmsClear` | POST `/api/sms/clear` | messages | `/instances/:id/messages`<br>`messages/destructive` | job-action | planned: Frozen-scope high-risk operation is planned with simulation-only acceptance until controlled safety authorization exists.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)<br>partial:N (Single-target command has no meaningful partial result.)<br>policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)<br>unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)<br>owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R3; strong<br>preparation-job | job-fresh-preflight/high-risk-block/version-probe/new-job-lineage/job-result<br>Required fresh preflight; inability to refresh blocks execution.<br>Fresh preflight is mandatory; stale, expired, or unknown state blocks execution.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Retry creates a new Job lineage (retryOfJobId/rootJobId); never replay successful items.<br>/jobs/:jobId contains per-item result, attempt lineage, and redacted audit. | SIMULATED_HIGH_RISK | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:postSmsClear`<br>`upstream:backend/src/main.rs:804-805`<br>`upstream:backend/src/handlers.rs:2480-2505`<br>`upstream:bruno-api/post_sms_clear.bru:8`<br>`fixture:not-eligible-readonly-capture` |
|
||||
| `getStats` | GET `/api/stats` | device-system | `/instances/:id/overview`<br>`overview/stats` | read-panel | planned: Frozen-scope read has two redacted captured responses; runtime support is still decided per registered instance.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Detail resource has no collection-empty rendering.)<br>partial:Y (Independent response sections may succeed or fail.)<br>policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)<br>unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)<br>owner-switch:Y (Owner switch discards responses with a mismatched instance key.) | R0; none<br>direct | command-current-state/read-retain/version-probe/safe-read/route-result<br>Refresh current state when available and bind the actor decision to its revision.<br>Retain last success as stale and permit an explicit safe refresh.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Safe reads may retry within deadline and retain stale success.<br>Structured result returns to the owning route with a redacted audit link. | REAL_READ | captured-readonly; n=2; categories=success; collector-selected fully-bound GET R0; two redacted real captures | `registry:getStats`<br>`upstream:backend/src/main.rs:808-808`<br>`upstream:backend/src/handlers.rs:3272-3288`<br>`upstream:bruno-api/get_stats.bru:8`<br>`fixture:captured-readonly` |
|
||||
| `getStatsCpu` | GET `/api/stats/cpu` | device-system | `/instances/:id/overview`<br>`overview/stats` | read-panel | planned: Frozen-scope read has two redacted captured responses; runtime support is still decided per registered instance.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Detail resource has no collection-empty rendering.)<br>partial:Y (Independent response sections may succeed or fail.)<br>policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)<br>unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)<br>owner-switch:Y (Owner switch discards responses with a mismatched instance key.) | R0; none<br>direct | command-current-state/read-retain/version-probe/safe-read/route-result<br>Refresh current state when available and bind the actor decision to its revision.<br>Retain last success as stale and permit an explicit safe refresh.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Safe reads may retry within deadline and retain stale success.<br>Structured result returns to the owning route with a redacted audit link. | REAL_READ | captured-readonly; n=2; categories=success; collector-selected fully-bound GET R0; two redacted real captures | `registry:getStatsCpu`<br>`upstream:backend/src/main.rs:809-809`<br>`upstream:backend/src/handlers.rs:3291-3302`<br>`upstream:bruno-api/get_cpu_info.bru:8`<br>`fixture:captured-readonly` |
|
||||
| `getConnectivity` | GET `/api/connectivity` | device-system | `/instances/:id/overview`<br>`overview/auth-health` | read-panel | planned: Frozen-scope read is modeled but real capture was explicitly denied; runtime support is probed per instance.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Detail resource has no collection-empty rendering.)<br>partial:Y (Independent response sections may succeed or fail.)<br>policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)<br>unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)<br>owner-switch:Y (Owner switch discards responses with a mismatched instance key.) | R0; none<br>direct | command-current-state/read-retain/version-probe/safe-read/route-result<br>Refresh current state when available and bind the actor decision to its revision.<br>Retain last success as stale and permit an explicit safe refresh.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Safe reads may retry within deadline and retain stale success.<br>Structured result returns to the owning route with a redacted audit link. | REAL_READ_DEFERRED | denied-readonly-candidate; n=0; categories=none; handler performs active connectivity ping | `registry:getConnectivity`<br>`upstream:backend/src/main.rs:811-812`<br>`upstream:backend/src/handlers.rs:3305-3322`<br>`fixture:denied-readonly-candidate` |
|
||||
| `postSystemReboot` | POST `/api/system/reboot` | device-system | `/instances/:id/overview`<br>`overview/system-actions` | job-action | planned: Frozen-scope high-risk operation is planned with simulation-only acceptance until controlled safety authorization exists.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)<br>partial:N (Single-target command has no meaningful partial result.)<br>policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)<br>unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)<br>owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R3; strong<br>preparation-job | job-fresh-preflight/high-risk-block/version-probe/new-job-lineage/job-result<br>Required fresh preflight; inability to refresh blocks execution.<br>Fresh preflight is mandatory; stale, expired, or unknown state blocks execution.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Retry creates a new Job lineage (retryOfJobId/rootJobId); never replay successful items.<br>/jobs/:jobId contains per-item result, attempt lineage, and redacted audit. | SIMULATED_HIGH_RISK | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:postSystemReboot`<br>`upstream:backend/src/main.rs:815-816`<br>`upstream:backend/src/handlers.rs:3381-3406`<br>`upstream:bruno-api/post_system_reboot.bru:8`<br>`fixture:not-eligible-readonly-capture` |
|
||||
| `postServiceRestart` | POST `/api/service/restart` | device-system | `/instances/:id/overview`<br>`overview/system-actions` | job-action | planned: Frozen-scope high-risk operation is planned with simulation-only acceptance until controlled safety authorization exists.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)<br>partial:N (Single-target command has no meaningful partial result.)<br>policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)<br>unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)<br>owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R3; strong<br>preparation-job | job-fresh-preflight/high-risk-block/version-probe/new-job-lineage/job-result<br>Required fresh preflight; inability to refresh blocks execution.<br>Fresh preflight is mandatory; stale, expired, or unknown state blocks execution.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Retry creates a new Job lineage (retryOfJobId/rootJobId); never replay successful items.<br>/jobs/:jobId contains per-item result, attempt lineage, and redacted audit. | SIMULATED_HIGH_RISK | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:postServiceRestart`<br>`upstream:backend/src/main.rs:819-820`<br>`upstream:backend/src/handlers.rs:3578-3601`<br>`fixture:not-eligible-readonly-capture` |
|
||||
| `getNotificationsConfig` | GET `/api/notifications/config` | notifications | `/instances/:id/notifications`<br>`notifications/config` | read-panel | planned: Frozen-scope read has two redacted captured responses; runtime support is still decided per registered instance.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Detail resource has no collection-empty rendering.)<br>partial:N (Atomic detail read has no meaningful partial rendering.)<br>policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)<br>unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)<br>owner-switch:Y (Owner switch discards responses with a mismatched instance key.) | R0; none<br>direct | query-capability/read-retain/version-probe/safe-read/route-result<br>Registered instance, authorized actor, and runtime capability decision are required.<br>Retain last success as stale and permit an explicit safe refresh.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Safe reads may retry within deadline and retain stale success.<br>Structured result returns to the owning route with a redacted audit link. | REAL_READ | captured-readonly; n=2; categories=success; collector-selected fully-bound GET R0; two redacted real captures | `registry:getNotificationsConfig`<br>`upstream:backend/src/main.rs:824-825`<br>`upstream:backend/src/handlers.rs:3641-3652`<br>`upstream:bruno-api/get_notification_config.bru:8`<br>`fixture:captured-readonly` |
|
||||
| `postNotificationsConfig` | POST `/api/notifications/config` | notifications | `/instances/:id/notifications`<br>`notifications/config` | job-action | planned: Frozen-scope high-risk operation is planned with simulation-only acceptance until controlled safety authorization exists.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)<br>partial:N (Single-target command has no meaningful partial result.)<br>policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)<br>unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)<br>owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R2; explicit<br>preparation-job | job-fresh-preflight/high-risk-block/version-probe/new-job-lineage/job-result<br>Required fresh preflight; inability to refresh blocks execution.<br>Fresh preflight is mandatory; stale, expired, or unknown state blocks execution.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Retry creates a new Job lineage (retryOfJobId/rootJobId); never replay successful items.<br>/jobs/:jobId contains per-item result, attempt lineage, and redacted audit. | SIMULATED_HIGH_RISK | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:postNotificationsConfig`<br>`upstream:backend/src/main.rs:824-826`<br>`upstream:backend/src/handlers.rs:3655-3672`<br>`upstream:bruno-api/set_notification_config.bru:8`<br>`fixture:not-eligible-readonly-capture` |
|
||||
| `postNotificationsTestChannel` | POST `/api/notifications/test/{channel}` | notifications | `/instances/:id/notifications`<br>`notifications/config` | job-action | planned: Frozen-scope high-risk operation is planned with simulation-only acceptance until controlled safety authorization exists.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)<br>partial:N (Single-target command has no meaningful partial result.)<br>policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)<br>unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)<br>owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R2; explicit<br>preparation-job | job-fresh-preflight/high-risk-block/version-probe/new-job-lineage/job-result<br>Required fresh preflight; inability to refresh blocks execution.<br>Fresh preflight is mandatory; stale, expired, or unknown state blocks execution.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Retry creates a new Job lineage (retryOfJobId/rootJobId); never replay successful items.<br>/jobs/:jobId contains per-item result, attempt lineage, and redacted audit. | SIMULATED_HIGH_RISK | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:postNotificationsTestChannel`<br>`upstream:backend/src/main.rs:830-831`<br>`upstream:backend/src/handlers.rs:3675-3704`<br>`fixture:not-eligible-readonly-capture` |
|
||||
| `getNotificationsLogs` | GET `/api/notifications/logs` | notifications | `/instances/:id/notifications`<br>`notifications/logs` | table | planned: Frozen-scope read is modeled but real capture was explicitly denied; runtime support is probed per instance.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:Y (Successful collection may contain no rows.)<br>partial:Y (Independent response sections may succeed or fail.)<br>policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)<br>unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)<br>owner-switch:Y (Owner switch discards responses with a mismatched instance key.) | R0; none<br>direct | query-capability/read-retain/version-probe/safe-read/route-result<br>Registered instance, authorized actor, and runtime capability decision are required.<br>Retain last success as stale and permit an explicit safe refresh.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Safe reads may retry within deadline and retain stale success.<br>Structured result returns to the owning route with a redacted audit link. | REAL_READ_DEFERRED | denied-readonly-candidate; n=0; categories=none; query limit is not encoded in Registry path contract | `registry:getNotificationsLogs`<br>`upstream:backend/src/main.rs:835-836`<br>`upstream:backend/src/handlers.rs:3709-3734`<br>`fixture:denied-readonly-candidate` |
|
||||
| `postNotificationsLogsClear` | POST `/api/notifications/logs/clear` | notifications | `/instances/:id/notifications`<br>`notifications/logs` | job-action | planned: Frozen-scope high-risk operation is planned with simulation-only acceptance until controlled safety authorization exists.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)<br>partial:N (Single-target command has no meaningful partial result.)<br>policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)<br>unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)<br>owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R3; strong<br>preparation-job | job-fresh-preflight/high-risk-block/version-probe/new-job-lineage/job-result<br>Required fresh preflight; inability to refresh blocks execution.<br>Fresh preflight is mandatory; stale, expired, or unknown state blocks execution.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Retry creates a new Job lineage (retryOfJobId/rootJobId); never replay successful items.<br>/jobs/:jobId contains per-item result, attempt lineage, and redacted audit. | SIMULATED_HIGH_RISK | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:postNotificationsLogsClear`<br>`upstream:backend/src/main.rs:839-840`<br>`upstream:backend/src/handlers.rs:3737-3760`<br>`fixture:not-eligible-readonly-capture` |
|
||||
| `getNotificationsQueue` | GET `/api/notifications/queue` | notifications | `/instances/:id/notifications`<br>`notifications/queue` | table | planned: Frozen-scope read is modeled but real capture was explicitly denied; runtime support is probed per instance.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:Y (Successful collection may contain no rows.)<br>partial:Y (Independent response sections may succeed or fail.)<br>policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)<br>unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)<br>owner-switch:Y (Owner switch discards responses with a mismatched instance key.) | R0; none<br>direct | query-capability/read-retain/version-probe/safe-read/route-result<br>Registered instance, authorized actor, and runtime capability decision are required.<br>Retain last success as stale and permit an explicit safe refresh.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Safe reads may retry within deadline and retain stale success.<br>Structured result returns to the owning route with a redacted audit link. | REAL_READ_DEFERRED | denied-readonly-candidate; n=0; categories=none; query limit is not encoded in Registry path contract | `registry:getNotificationsQueue`<br>`upstream:backend/src/main.rs:843-844`<br>`upstream:backend/src/notification_queue.rs:24-41`<br>`fixture:denied-readonly-candidate` |
|
||||
| `postNotificationsQueueRetryAll` | POST `/api/notifications/queue/retry-all` | notifications | `/instances/:id/notifications`<br>`notifications/queue` | job-action | planned: Frozen-scope high-risk operation is planned with simulation-only acceptance until controlled safety authorization exists.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)<br>partial:Y (Job items may independently succeed, fail, or be skipped.)<br>policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)<br>unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)<br>owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R2; explicit<br>preparation-job | job-fresh-preflight/high-risk-block/version-probe/new-job-lineage/job-result<br>Required fresh preflight; inability to refresh blocks execution.<br>Fresh preflight is mandatory; stale, expired, or unknown state blocks execution.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Retry creates a new Job lineage (retryOfJobId/rootJobId); never replay successful items.<br>/jobs/:jobId contains per-item result, attempt lineage, and redacted audit. | SIMULATED_HIGH_RISK | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:postNotificationsQueueRetryAll`<br>`upstream:backend/src/main.rs:847-848`<br>`upstream:backend/src/notification_queue.rs:84-100`<br>`fixture:not-eligible-readonly-capture` |
|
||||
| `postNotificationsQueueClear` | POST `/api/notifications/queue/clear` | notifications | `/instances/:id/notifications`<br>`notifications/queue` | job-action | planned: Frozen-scope high-risk operation is planned with simulation-only acceptance until controlled safety authorization exists.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)<br>partial:Y (Job items may independently succeed, fail, or be skipped.)<br>policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)<br>unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)<br>owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R3; strong<br>preparation-job | job-fresh-preflight/high-risk-block/version-probe/new-job-lineage/job-result<br>Required fresh preflight; inability to refresh blocks execution.<br>Fresh preflight is mandatory; stale, expired, or unknown state blocks execution.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Retry creates a new Job lineage (retryOfJobId/rootJobId); never replay successful items.<br>/jobs/:jobId contains per-item result, attempt lineage, and redacted audit. | SIMULATED_HIGH_RISK | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:postNotificationsQueueClear`<br>`upstream:backend/src/main.rs:851-852`<br>`upstream:backend/src/notification_queue.rs:103-119`<br>`fixture:not-eligible-readonly-capture` |
|
||||
| `deleteNotificationsQueueId` | DELETE `/api/notifications/queue/{id}` | notifications | `/instances/:id/notifications`<br>`notifications/queue` | job-action | planned: Frozen-scope high-risk operation is planned with simulation-only acceptance until controlled safety authorization exists.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)<br>partial:N (Single-target command has no meaningful partial result.)<br>policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)<br>unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)<br>owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R3; strong<br>preparation-job | job-fresh-preflight/high-risk-block/version-probe/new-job-lineage/job-result<br>Required fresh preflight; inability to refresh blocks execution.<br>Fresh preflight is mandatory; stale, expired, or unknown state blocks execution.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Retry creates a new Job lineage (retryOfJobId/rootJobId); never replay successful items.<br>/jobs/:jobId contains per-item result, attempt lineage, and redacted audit. | SIMULATED_HIGH_RISK | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:deleteNotificationsQueueId`<br>`upstream:backend/src/main.rs:855-856`<br>`upstream:backend/src/notification_queue.rs:64-81`<br>`fixture:not-eligible-readonly-capture` |
|
||||
| `postNotificationsQueueIdRetry` | POST `/api/notifications/queue/{id}/retry` | notifications | `/instances/:id/notifications`<br>`notifications/queue` | job-action | planned: Frozen-scope high-risk operation is planned with simulation-only acceptance until controlled safety authorization exists.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)<br>partial:N (Single-target command has no meaningful partial result.)<br>policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)<br>unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)<br>owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R2; explicit<br>preparation-job | job-fresh-preflight/high-risk-block/version-probe/new-job-lineage/job-result<br>Required fresh preflight; inability to refresh blocks execution.<br>Fresh preflight is mandatory; stale, expired, or unknown state blocks execution.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Retry creates a new Job lineage (retryOfJobId/rootJobId); never replay successful items.<br>/jobs/:jobId contains per-item result, attempt lineage, and redacted audit. | SIMULATED_HIGH_RISK | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:postNotificationsQueueIdRetry`<br>`upstream:backend/src/main.rs:859-860`<br>`upstream:backend/src/notification_queue.rs:44-61`<br>`fixture:not-eligible-readonly-capture` |
|
||||
| `getAutomationConfig` | GET `/api/automation/config` | automation | `/instances/:id/automation`<br>`automation/config` | read-panel | planned: Frozen-scope read has two redacted captured responses; runtime support is still decided per registered instance.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Detail resource has no collection-empty rendering.)<br>partial:N (Atomic detail read has no meaningful partial rendering.)<br>policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)<br>unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)<br>owner-switch:Y (Owner switch discards responses with a mismatched instance key.) | R0; none<br>direct | query-capability/read-retain/version-probe/safe-read/route-result<br>Registered instance, authorized actor, and runtime capability decision are required.<br>Retain last success as stale and permit an explicit safe refresh.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Safe reads may retry within deadline and retain stale success.<br>Structured result returns to the owning route with a redacted audit link. | REAL_READ | captured-readonly; n=2; categories=unsupported; collector-selected fully-bound GET R0; two redacted real captures | `registry:getAutomationConfig`<br>`upstream:backend/src/main.rs:864-865`<br>`upstream:backend/src/handlers.rs:3968-3979`<br>`fixture:captured-readonly` |
|
||||
| `postAutomationConfig` | POST `/api/automation/config` | automation | `/instances/:id/automation`<br>`automation/config` | job-action | planned: Frozen-scope high-risk operation is planned with simulation-only acceptance until controlled safety authorization exists.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)<br>partial:N (Single-target command has no meaningful partial result.)<br>policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)<br>unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)<br>owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R2; explicit<br>preparation-job | job-fresh-preflight/high-risk-block/version-probe/new-job-lineage/job-result<br>Required fresh preflight; inability to refresh blocks execution.<br>Fresh preflight is mandatory; stale, expired, or unknown state blocks execution.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Retry creates a new Job lineage (retryOfJobId/rootJobId); never replay successful items.<br>/jobs/:jobId contains per-item result, attempt lineage, and redacted audit. | SIMULATED_HIGH_RISK | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:postAutomationConfig`<br>`upstream:backend/src/main.rs:864-866`<br>`upstream:backend/src/handlers.rs:3982-3999`<br>`fixture:not-eligible-readonly-capture` |
|
||||
| `getAutomationLogs` | GET `/api/automation/logs` | automation | `/instances/:id/automation`<br>`automation/logs` | table | planned: Frozen-scope read is modeled but real capture was explicitly denied; runtime support is probed per instance.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:Y (Successful collection may contain no rows.)<br>partial:Y (Independent response sections may succeed or fail.)<br>policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)<br>unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)<br>owner-switch:Y (Owner switch discards responses with a mismatched instance key.) | R0; none<br>direct | query-capability/read-retain/version-probe/safe-read/route-result<br>Registered instance, authorized actor, and runtime capability decision are required.<br>Retain last success as stale and permit an explicit safe refresh.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Safe reads may retry within deadline and retain stale success.<br>Structured result returns to the owning route with a redacted audit link. | REAL_READ_DEFERRED | denied-readonly-candidate; n=0; categories=none; query limit is not encoded in Registry path contract | `registry:getAutomationLogs`<br>`upstream:backend/src/main.rs:870-871`<br>`upstream:backend/src/handlers.rs:4002-4027`<br>`fixture:denied-readonly-candidate` |
|
||||
| `postAutomationLogsClear` | POST `/api/automation/logs/clear` | automation | `/instances/:id/automation`<br>`automation/logs` | job-action | planned: Frozen-scope high-risk operation is planned with simulation-only acceptance until controlled safety authorization exists.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)<br>partial:N (Single-target command has no meaningful partial result.)<br>policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)<br>unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)<br>owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R3; strong<br>preparation-job | job-fresh-preflight/high-risk-block/version-probe/new-job-lineage/job-result<br>Required fresh preflight; inability to refresh blocks execution.<br>Fresh preflight is mandatory; stale, expired, or unknown state blocks execution.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Retry creates a new Job lineage (retryOfJobId/rootJobId); never replay successful items.<br>/jobs/:jobId contains per-item result, attempt lineage, and redacted audit. | SIMULATED_HIGH_RISK | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:postAutomationLogsClear`<br>`upstream:backend/src/main.rs:874-875`<br>`upstream:backend/src/handlers.rs:4030-4053`<br>`fixture:not-eligible-readonly-capture` |
|
||||
| `postAutomationTestTaskId` | POST `/api/automation/test/{task_id}` | automation | `/instances/:id/automation`<br>`automation/task-test` | job-action | planned: Frozen-scope high-risk operation is planned with simulation-only acceptance until controlled safety authorization exists.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)<br>partial:N (Single-target command has no meaningful partial result.)<br>policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)<br>unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)<br>owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R2; explicit<br>preparation-job | job-fresh-preflight/high-risk-block/version-probe/new-job-lineage/job-result<br>Required fresh preflight; inability to refresh blocks execution.<br>Fresh preflight is mandatory; stale, expired, or unknown state blocks execution.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Retry creates a new Job lineage (retryOfJobId/rootJobId); never replay successful items.<br>/jobs/:jobId contains per-item result, attempt lineage, and redacted audit. | SIMULATED_HIGH_RISK | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:postAutomationTestTaskId`<br>`upstream:backend/src/main.rs:878-879`<br>`upstream:backend/src/handlers.rs:4056-4146`<br>`fixture:not-eligible-readonly-capture` |
|
||||
| `getOtaStatus` | GET `/api/ota/status` | ota | `/instances/:id/ota`<br>`ota/status` | read-panel | planned: Frozen-scope read has two redacted captured responses; runtime support is still decided per registered instance.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Detail resource has no collection-empty rendering.)<br>partial:N (Atomic detail read has no meaningful partial rendering.)<br>policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)<br>unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)<br>owner-switch:Y (Owner switch discards responses with a mismatched instance key.) | R0; none<br>direct | query-capability/read-retain/version-probe/safe-read/route-result<br>Registered instance, authorized actor, and runtime capability decision are required.<br>Retain last success as stale and permit an explicit safe refresh.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Safe reads may retry within deadline and retain stale success.<br>Structured result returns to the owning route with a redacted audit link. | REAL_READ | captured-readonly; n=2; categories=success; collector-selected fully-bound GET R0; two redacted real captures | `registry:getOtaStatus`<br>`upstream:backend/src/main.rs:882-883`<br>`upstream:backend/src/handlers.rs:3763-3769`<br>`upstream:bruno-api/get_ota_status.bru:8`<br>`fixture:captured-readonly` |
|
||||
| `postOtaUpload` | POST `/api/ota/upload` | ota | `/instances/:id/ota`<br>`ota/upload` | dedicated-upload-flow | planned: Frozen-scope high-risk operation is planned with simulation-only acceptance until controlled safety authorization exists.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)<br>partial:N (Single-target command has no meaningful partial result.)<br>policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)<br>unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)<br>owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R3; strong<br>preparation-job | job-fresh-preflight/high-risk-block/ota-version-probe/new-job-lineage/job-result<br>Required fresh preflight; inability to refresh blocks execution.<br>Fresh preflight is mandatory; stale, expired, or unknown state blocks execution.<br>OTA 404/405/501 is frozen-version evidence; preserve release/status probe context and never infer global support.<br>Retry creates a new Job lineage (retryOfJobId/rootJobId); never replay successful items.<br>/jobs/:jobId contains per-item result, attempt lineage, and redacted audit. | SIMULATED_HIGH_RISK | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:postOtaUpload`<br>`upstream:backend/src/main.rs:886-887`<br>`upstream:backend/src/handlers.rs:3772-3792`<br>`fixture:not-eligible-readonly-capture` |
|
||||
| `postOtaLatestRelease` | POST `/api/ota/latest-release` | ota | `/instances/:id/ota`<br>`ota/release` | form | planned: Frozen-scope reversible command is contract-planned for a later controlled real-write acceptance phase.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)<br>partial:N (Single-target command has no meaningful partial result.)<br>policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)<br>unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)<br>owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R1; none<br>direct | command-current-state/write-revision/version-probe/verify-write/route-result<br>Refresh current state when available and bind the actor decision to its revision.<br>Refresh current state or require an explicit recorded revision-bound override.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Writes require outcome verification before actor-initiated retry.<br>Structured result returns to the owning route with a redacted audit link. | REAL_WRITE_LATER | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:postOtaLatestRelease`<br>`upstream:backend/src/main.rs:892-893`<br>`upstream:backend/src/handlers.rs:3795-3825`<br>`fixture:not-eligible-readonly-capture` |
|
||||
| `postOtaOnlinePrepare` | POST `/api/ota/online-prepare` | ota | `/instances/:id/ota`<br>`ota/release` | job-action | planned: Frozen-scope high-risk operation is planned with simulation-only acceptance until controlled safety authorization exists.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)<br>partial:N (Single-target command has no meaningful partial result.)<br>policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)<br>unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)<br>owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R2; explicit<br>preparation-job | job-fresh-preflight/high-risk-block/ota-version-probe/new-job-lineage/job-result<br>Required fresh preflight; inability to refresh blocks execution.<br>Fresh preflight is mandatory; stale, expired, or unknown state blocks execution.<br>OTA 404/405/501 is frozen-version evidence; preserve release/status probe context and never infer global support.<br>Retry creates a new Job lineage (retryOfJobId/rootJobId); never replay successful items.<br>/jobs/:jobId contains per-item result, attempt lineage, and redacted audit. | SIMULATED_HIGH_RISK | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:postOtaOnlinePrepare`<br>`upstream:backend/src/main.rs:896-897`<br>`upstream:backend/src/handlers.rs:3828-3889`<br>`fixture:not-eligible-readonly-capture` |
|
||||
| `postOtaApply` | POST `/api/ota/apply` | ota | `/instances/:id/ota`<br>`ota/apply` | job-action | planned: Frozen-scope high-risk operation is planned with simulation-only acceptance until controlled safety authorization exists.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)<br>partial:N (Single-target command has no meaningful partial result.)<br>policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)<br>unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)<br>owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R3; strong<br>preparation-job | job-fresh-preflight/high-risk-block/ota-version-probe/new-job-lineage/job-result<br>Required fresh preflight; inability to refresh blocks execution.<br>Fresh preflight is mandatory; stale, expired, or unknown state blocks execution.<br>OTA 404/405/501 is frozen-version evidence; preserve release/status probe context and never infer global support.<br>Retry creates a new Job lineage (retryOfJobId/rootJobId); never replay successful items.<br>/jobs/:jobId contains per-item result, attempt lineage, and redacted audit. | SIMULATED_HIGH_RISK | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:postOtaApply`<br>`upstream:backend/src/main.rs:900-901`<br>`upstream:backend/src/handlers.rs:3892-3911`<br>`upstream:bruno-api/post_ota_apply_restart.bru:8`<br>`upstream:bruno-api/post_ota_apply.bru:8`<br>`fixture:not-eligible-readonly-capture` |
|
||||
| `postOtaCancel` | POST `/api/ota/cancel` | ota | `/instances/:id/ota`<br>`ota/status` | action | planned: Frozen-scope reversible command is contract-planned for a later controlled real-write acceptance phase.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)<br>partial:N (Single-target command has no meaningful partial result.)<br>policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)<br>unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)<br>owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R1; none<br>direct | command-current-state/write-revision/version-probe/verify-write/route-result<br>Refresh current state when available and bind the actor decision to its revision.<br>Refresh current state or require an explicit recorded revision-bound override.<br>404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.<br>Writes require outcome verification before actor-initiated retry.<br>Structured result returns to the owning route with a redacted audit link. | REAL_WRITE_LATER | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:postOtaCancel`<br>`upstream:backend/src/main.rs:904-905`<br>`upstream:backend/src/handlers.rs:3914-3931`<br>`upstream:bruno-api/post_ota_cancel.bru:8`<br>`fixture:not-eligible-readonly-capture` |
|
||||
| `postAuthPassword` | POST `/api/auth/password` | instances-auth | `/settings/instances/:id`<br>`settings/auth-settings` | dedicated-auth-flow | planned: Frozen-scope high-risk operation is planned with simulation-only acceptance until controlled safety authorization exists.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)<br>partial:N (Single-target command has no meaningful partial result.)<br>policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)<br>unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)<br>owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R3; strong<br>dedicated-flow | auth-dedicated/auth-no-replay/auth-version-probe/new-job-lineage/auth-result<br>Dedicated auth endpoint, actor/session/instance rate limits, and fresh preflight of authentication state are required.<br>Credential state is never inferred from stale data; require actor-initiated auth flow and no replay.<br>Auth 404/405/501 is version evidence; do not downgrade to a generic proxy or expose credentials.<br>Retry creates a new Job lineage (retryOfJobId/rootJobId); never replay successful items.<br>Dedicated auth jobs return through /jobs/:jobId; session flows return a credential metadata-only audit result and link. | SIMULATED_HIGH_RISK | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:postAuthPassword`<br>`upstream:backend/src/main.rs:908-909`<br>`upstream:backend/src/auth.rs:491-553`<br>`upstream:backend/src/auth.rs:43-43`<br>`fixture:not-eligible-readonly-capture` |
|
||||
| `getAuthSettings` | GET `/api/auth/settings` | instances-auth | `/settings/instances/:id`<br>`settings/auth-settings` | detail | planned: Frozen-scope read has two redacted captured responses; runtime support is still decided per registered instance.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Detail resource has no collection-empty rendering.)<br>partial:N (Atomic detail read has no meaningful partial rendering.)<br>policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)<br>unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)<br>owner-switch:Y (Owner switch discards responses with a mismatched instance key.) | R0; none<br>direct | query-capability/auth-no-replay/auth-version-probe/auth-actor-only/auth-result<br>Registered instance, authorized actor, and runtime capability decision are required.<br>Credential state is never inferred from stale data; require actor-initiated auth flow and no replay.<br>Auth 404/405/501 is version evidence; do not downgrade to a generic proxy or expose credentials.<br>No automatic replay; require an actor-initiated dedicated flow.<br>Dedicated auth jobs return through /jobs/:jobId; session flows return a credential metadata-only audit result and link. | REAL_READ | captured-readonly; n=2; categories=success,unsupported; collector-selected fully-bound GET R0; two redacted real captures | `registry:getAuthSettings`<br>`upstream:backend/src/main.rs:912-913`<br>`upstream:backend/src/auth.rs:555-570`<br>`upstream:backend/src/auth.rs:43-43`<br>`fixture:captured-readonly` |
|
||||
| `postAuthSettings` | POST `/api/auth/settings` | instances-auth | `/settings/instances/:id`<br>`settings/auth-settings` | dedicated-auth-flow | planned: Frozen-scope high-risk operation is planned with simulation-only acceptance until controlled safety authorization exists.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)<br>partial:N (Single-target command has no meaningful partial result.)<br>policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)<br>unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)<br>owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R2; explicit<br>dedicated-flow | auth-dedicated/auth-no-replay/auth-version-probe/new-job-lineage/auth-result<br>Dedicated auth endpoint, actor/session/instance rate limits, and fresh preflight of authentication state are required.<br>Credential state is never inferred from stale data; require actor-initiated auth flow and no replay.<br>Auth 404/405/501 is version evidence; do not downgrade to a generic proxy or expose credentials.<br>Retry creates a new Job lineage (retryOfJobId/rootJobId); never replay successful items.<br>Dedicated auth jobs return through /jobs/:jobId; session flows return a credential metadata-only audit result and link. | SIMULATED_HIGH_RISK | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:postAuthSettings`<br>`upstream:backend/src/main.rs:912-914`<br>`upstream:backend/src/auth.rs:572-640`<br>`upstream:backend/src/auth.rs:43-43`<br>`fixture:not-eligible-readonly-capture` |
|
||||
| `getHealth` | GET `/api/health` | instances-auth | `/instances/new`<br>`settings/auth-entry` | detail | planned: Frozen-scope read has two redacted captured responses; runtime support is still decided per registered instance.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Detail resource has no collection-empty rendering.)<br>partial:N (Atomic detail read has no meaningful partial rendering.)<br>policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)<br>unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)<br>owner-switch:Y (Owner switch discards responses with a mismatched instance key.) | R0; none<br>direct | query-capability/auth-no-replay/auth-version-probe/auth-actor-only/auth-result<br>Registered instance, authorized actor, and runtime capability decision are required.<br>Credential state is never inferred from stale data; require actor-initiated auth flow and no replay.<br>Auth 404/405/501 is version evidence; do not downgrade to a generic proxy or expose credentials.<br>No automatic replay; require an actor-initiated dedicated flow.<br>Dedicated auth jobs return through /jobs/:jobId; session flows return a credential metadata-only audit result and link. | REAL_READ | captured-readonly; n=2; categories=success; collector-selected fully-bound GET R0; two redacted real captures | `registry:getHealth`<br>`upstream:backend/src/main.rs:923-923`<br>`upstream:backend/src/handlers.rs:65-75`<br>`upstream:bruno-api/get_health.bru:8`<br>`upstream:backend/src/auth.rs:43-43`<br>`fixture:captured-readonly` |
|
||||
| `getAuthStatus` | GET `/api/auth/status` | instances-auth | `/instances/new`<br>`settings/auth-entry` | detail | planned: Frozen-scope read has two redacted captured responses; runtime support is still decided per registered instance.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Detail resource has no collection-empty rendering.)<br>partial:N (Atomic detail read has no meaningful partial rendering.)<br>policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)<br>unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)<br>owner-switch:Y (Owner switch discards responses with a mismatched instance key.) | R0; none<br>direct | query-capability/auth-no-replay/auth-version-probe/auth-actor-only/auth-result<br>Registered instance, authorized actor, and runtime capability decision are required.<br>Credential state is never inferred from stale data; require actor-initiated auth flow and no replay.<br>Auth 404/405/501 is version evidence; do not downgrade to a generic proxy or expose credentials.<br>No automatic replay; require an actor-initiated dedicated flow.<br>Dedicated auth jobs return through /jobs/:jobId; session flows return a credential metadata-only audit result and link. | REAL_READ | captured-readonly; n=2; categories=success,unsupported; collector-selected fully-bound GET R0; two redacted real captures | `registry:getAuthStatus`<br>`upstream:backend/src/main.rs:925-926`<br>`upstream:backend/src/auth.rs:345-364`<br>`upstream:backend/src/auth.rs:43-43`<br>`fixture:captured-readonly` |
|
||||
| `postAuthSetup` | POST `/api/auth/setup` | instances-auth | `/instances/new`<br>`settings/auth-entry` | dedicated-auth-flow | planned: Frozen-scope high-risk operation is planned with simulation-only acceptance until controlled safety authorization exists.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)<br>partial:N (Single-target command has no meaningful partial result.)<br>policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)<br>unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)<br>owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R3; strong<br>dedicated-flow | auth-dedicated/auth-no-replay/auth-version-probe/new-job-lineage/auth-result<br>Dedicated auth endpoint, actor/session/instance rate limits, and fresh preflight of authentication state are required.<br>Credential state is never inferred from stale data; require actor-initiated auth flow and no replay.<br>Auth 404/405/501 is version evidence; do not downgrade to a generic proxy or expose credentials.<br>Retry creates a new Job lineage (retryOfJobId/rootJobId); never replay successful items.<br>Dedicated auth jobs return through /jobs/:jobId; session flows return a credential metadata-only audit result and link. | SIMULATED_HIGH_RISK | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:postAuthSetup`<br>`upstream:backend/src/main.rs:929-930`<br>`upstream:backend/src/auth.rs:366-427`<br>`upstream:backend/src/auth.rs:43-43`<br>`fixture:not-eligible-readonly-capture` |
|
||||
| `postAuthLogin` | POST `/api/auth/login` | instances-auth | `/instances/new`<br>`settings/auth-entry` | dedicated-auth-flow | planned: Frozen-scope reversible command is contract-planned for a later controlled real-write acceptance phase.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)<br>partial:N (Single-target command has no meaningful partial result.)<br>policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)<br>unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)<br>owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R1; none<br>dedicated-flow | auth-dedicated/auth-no-replay/auth-version-probe/auth-actor-only/auth-result<br>Dedicated auth endpoint, actor/session/instance rate limits, and fresh preflight of authentication state are required.<br>Credential state is never inferred from stale data; require actor-initiated auth flow and no replay.<br>Auth 404/405/501 is version evidence; do not downgrade to a generic proxy or expose credentials.<br>No automatic replay; require an actor-initiated dedicated flow.<br>Dedicated auth jobs return through /jobs/:jobId; session flows return a credential metadata-only audit result and link. | REAL_WRITE_LATER | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:postAuthLogin`<br>`upstream:backend/src/main.rs:933-934`<br>`upstream:backend/src/auth.rs:429-489`<br>`upstream:backend/src/auth.rs:43-43`<br>`fixture:not-eligible-readonly-capture` |
|
||||
| `postAuthLogout` | POST `/api/auth/logout` | instances-auth | `/settings/instances/:id`<br>`settings/auth-settings` | dedicated-auth-flow | planned: Frozen-scope reversible command is contract-planned for a later controlled real-write acceptance phase.<br>Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)<br>partial:N (Single-target command has no meaningful partial result.)<br>policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)<br>unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)<br>owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R1; none<br>dedicated-flow | auth-dedicated/auth-no-replay/auth-version-probe/auth-actor-only/auth-result<br>Dedicated auth endpoint, actor/session/instance rate limits, and fresh preflight of authentication state are required.<br>Credential state is never inferred from stale data; require actor-initiated auth flow and no replay.<br>Auth 404/405/501 is version evidence; do not downgrade to a generic proxy or expose credentials.<br>No automatic replay; require an actor-initiated dedicated flow.<br>Dedicated auth jobs return through /jobs/:jobId; session flows return a credential metadata-only audit result and link. | REAL_WRITE_LATER | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:postAuthLogout`<br>`upstream:backend/src/main.rs:937-938`<br>`upstream:backend/src/auth.rs:642-655`<br>`upstream:backend/src/auth.rs:43-43`<br>`fixture:not-eligible-readonly-capture` |
|
||||
@@ -128,7 +128,7 @@ R2/R3 还必须显示预检结果和失败阻断项；确认 token 的完整绑
|
||||
|
||||
### WF-04 执行 R1 可逆设置
|
||||
|
||||
**例：** 开关 data、roaming、WLAN 或修改通知配置。<br>
|
||||
**例：** 开关 data、roaming、WLAN 等可逆设置。具体 operation 风险、确认和执行方式以 [117 项验收账本](./operation-acceptance-matrix.md) 引用的 OperationRegistry 为唯一事实源；例如 WLAN connect 为 R1，而 notifications config 为 R2 Job，不因出现在同一产品模块而套用统一风险。<br>
|
||||
**角色：** P1/P2
|
||||
|
||||
1. 在业务页读取当前值和 `fetchedAt`。
|
||||
@@ -161,7 +161,7 @@ R2/R3 还必须显示预检结果和失败阻断项；确认 token 的完整绑
|
||||
### WF-06 批量操作
|
||||
|
||||
**角色：** P1/P3<br>
|
||||
**入口：** `/fleet` 多选；只显示 registry 标记 `batchable` 的动作。
|
||||
**入口：** `/fleet` 多选；只显示验收账本明确标记 `fleetBatchable=true` 的动作。上游 Registry 旧字段 `batchable` 仅表示单实例内的资源批量，不表示跨实例 Fleet 批量。
|
||||
|
||||
1. 用户多选实例并选择业务动作。
|
||||
2. 系统逐实例预检 capability、认证、当前值和冲突 Job。
|
||||
@@ -190,8 +190,8 @@ R2/R3 还必须显示预检结果和失败阻断项；确认 token 的完整绑
|
||||
**页面：** `/instances/:id/esim`
|
||||
|
||||
1. 查看 work mode、eSIM config、lpac、eUICC 和 profiles capability。
|
||||
2. 下载 profile 时校验激活信息并进入 R2 Job。
|
||||
3. enable/rename 使用专用表单；切换工作模式说明连接影响。
|
||||
2. 下载 profile 时校验激活信息；其风险与执行方式按 Registry 当前值 R1/direct 验收，不在产品文档中另行升级。
|
||||
3. enable/rename 使用专用表单；enable 的 Registry 当前值为 R1/direct；切换工作模式按其 Registry R2/Job 政策说明连接影响。
|
||||
4. delete 为 R3：展示 ICCID/名称/状态，要求复述 profile，确认不可恢复。
|
||||
5. 完成后重新获取 profile 和 connectivity；失败保留上次 profile 数据并标 stale。
|
||||
|
||||
|
||||
@@ -5,7 +5,7 @@
|
||||
> 上游证据基线：[`3899/SimAdmin@58e220411d6599609f0eeda01eb7016e9212f970`](https://github.com/3899/SimAdmin/commit/58e220411d6599609f0eeda01eb7016e9212f970)<br>
|
||||
> 适用范围：Multi SimAdmin V1 的产品、API/BFF、Web 控制台、测试与迁移决策
|
||||
|
||||
> Phase 0.1 文档导航：**项目章程**（本文）｜[现状审计](./current-system-audit.md)｜[角色与流程](./personas-and-workflows.md)｜[信息架构](./information-architecture.md)
|
||||
> Phase 0.1 文档导航：**项目章程**（本文）｜[现状审计](./current-system-audit.md)｜[角色与流程](./personas-and-workflows.md)｜[信息架构](./information-architecture.md)｜[117 项验收账本](./operation-acceptance-matrix.md)
|
||||
|
||||
## 1. 立项结论
|
||||
|
||||
@@ -43,7 +43,7 @@
|
||||
- **能力驱动：** 不支持的能力不显示为可点击动作；必要时保留解释性占位，不用 `-` 假装正常。
|
||||
- **目标明确：** 每个写操作都显示实例、当前值、目标值、字段 diff、影响和风险。
|
||||
- **默认拒绝：** 未注册 operation、未知方法/路径、认证端点通用代理均拒绝。
|
||||
- **部分结果真实：** 批量动作逐实例给出成功、失败、跳过及原因，不制造“全部成功”。
|
||||
- **部分结果真实：** Fleet 批量与单实例资源批量分开建模；Fleet 逐实例给出成功、失败、跳过及原因，不制造“全部成功”。具体 `resourceBulk`、`fleetBatchable` 与逐项聚合以验收账本为准。
|
||||
- **凭据服务端化：** 密码、Cookie、token 不进入浏览器响应、日志、审计或 fixture。
|
||||
- **高密度但可访问：** 主要工作流兼容键盘和窄屏；视觉不能牺牲错误、焦点和操作可达性。
|
||||
|
||||
|
||||
@@ -0,0 +1,40 @@
|
||||
# Phase 0 release gate
|
||||
|
||||
Scope: Phase 0.4 evidence only. No commit, no production server/public/root-package modification, no network refetch, and no local instance URL/name/secret is recorded here.
|
||||
|
||||
## Gate result
|
||||
|
||||
| Check | Status | Evidence / rationale |
|
||||
|---|---|---|
|
||||
| RED first | RECORDED | Process evidence: expanded acceptance tests first failed because structured exports were absent; this historical step is not machine-recomputable from the final tree. |
|
||||
| Repository `npm test` | PASS | Final recomputation: 84 tests passed, 0 failed. |
|
||||
| Phase 0 acceptance tests | PASS | `packages/operation-registry/test/acceptance-gate.test.ts`: 12/12 pass, including exact partitions, fixture-bound real classes and metadata-only categories, product prose, policies, and control-plane rows. |
|
||||
| Independent safety baseline | PASS | Phase 0.2 commit `9dffadbec271227da7ffb192f31dc78c6ee3c2be` independently freezes exact 117 unique `operationId` + risk + confirmation + capability + execution-policy tuples. Tests read that committed Git object with `git show`, never current docs/current Registry for expected values; a missing/wrong object fails, and synchronized working-tree matrix/fixture edits cannot bypass it. Risk, confirmation, capability, and execution-policy mutation tests all fail closed. Baseline changes require explicit safety review. |
|
||||
| Registry parity | PASS | exact 117 operations, 100 paths, GET 50 / POST 62 / DELETE 5; operation IDs unique and frozen route parity tests pass. |
|
||||
| Acceptance ledger | PASS | exact 117 operation-to-section mapping plus independent exact policy/scenario/availability operation-ID partitions; each partition rejects overlap, omission, and unknown IDs; route ownership, Registry risk/confirmation, scenario applicability, and high-risk/auth/write policies are enforced without method/risk fallback. |
|
||||
| Registry risk distribution | PASS | R0 50, R1 28, R2 21, R3 18. Product prose now defers to the Registry-backed ledger; eSIM download/enable and notifications config conflicts are corrected. |
|
||||
| Fixture disposition | PASS | authoritative map exact 117: 39 `captured-readonly`, 11 `denied-readonly-candidate`, 67 `not-eligible-readonly-capture`; selection and deny reasons are recomputed from the collector. No operation remains currently `pending`. |
|
||||
| Real fixture manifest | PASS | 78 real fixtures, 0 synthetic, exactly two aliases per 39 eligible operation; manifest SHA-256 `4f2475bdd6ee2c4ca6057d951161eb97d2e842cdf9d378e44195d7d6c87af459`. Every matrix row renders metadata-only `categories=` sorted from fixture disposition (`success`, `unsupported`, `auth-required` only), or `none` when uncaptured; no fixture body/response, alias, identity, or URL is rendered. |
|
||||
| Explicit readonly denials | PASS | exact 11 and equal to collector `DENY_REASONS`; active connectivity/operator scan and privacy-sensitive/query endpoints are not misrepresented as captures. |
|
||||
| Batch semantics | PASS | Registry `batchable` is treated as resource bulk, never Fleet authorization. `postSmsBatchDelete`: resource bulk true / Fleet false. `getHealth`: Fleet true read refresh / per-item aggregation. All writes Fleet false. |
|
||||
| Dedicated auth | PASS | setup/password/settings/login/logout use dedicated auth strategy/flow; login/logout session-sensitive, no automatic replay, credential metadata-only audit. Control-plane acceptance is listed in the matrix. |
|
||||
| R2/R3 and Job lineage | PASS | fresh preflight blocks when unavailable; one-use Registry confirmation; R3 Registry capability is Job; retry creates new Job lineage and never mutates/replays successful source items. |
|
||||
| Capability/404, stale, orthogonal state, partial policies | PASS | machine ledger plus generated matrix bind these policies per operation; a fixture 404 is evidence, not a permanent unsupported declaration. |
|
||||
| Real vs simulated acceptance | PASS | exact fixture-bound classification: 39 captured reads are `REAL_READ`; 11 denied candidates are `REAL_READ_DEFERRED`; no uncaptured GET claims real evidence; remaining writes/noneligible operations use deferred, simulated, or contract-only classes. |
|
||||
| Timeout / non-JSON real coverage | DEFERRED | neither category occurred in the 78 real captures. Unit categorization tests pass, but real timeout/non-JSON acceptance is deferred to controlled fault injection; no coverage is claimed. |
|
||||
| Listener introduced by Phase 0 commands | RECORDED | Process evidence: validation used Node test/inject and did not intentionally start a listener; this is not labeled machine-recomputable. |
|
||||
| Old production tree unchanged | PASS | `git diff -- server public package.json` is empty. Root `package.json` was not changed. |
|
||||
| Frozen upstream provenance | PASS with accepted gap | Upstream URL: `https://github.com/3899/SimAdmin`; full commit `58e220411d6599609f0eeda01eb7016e9212f970`; snapshot paths: `packages/operation-registry/test/fixtures/upstream-58e2204/`; mechanism: snapshot `manifest.json` pins SHA-256 per whole file and tests re-hash exact files/handler slices. Fetch/capture time is not recorded and is an accepted provenance gap; no value was invented and no network was used. |
|
||||
| Frozen whitespace exception | N/A | Frozen upstream files were not edited. Existing snapshot bytes and hashes are authoritative, including upstream whitespace; no formatter is run over the snapshot. |
|
||||
| Secret scan scope | PASS | Existing fixture test recursively scans configured credential strings and every fixture string leaf (including tags/capabilities/auth/password) without printing values; all 78 real fixture envelopes, hashes, response-shape baseline, and redaction contracts pass. This is fixture-scope evidence, not a claim of a future workspace-wide scanner. |
|
||||
| `git diff --check` | PASS | No whitespace errors. |
|
||||
| pnpm workspace | N/A | Phase 1 workspace does not exist; not run and not marked PASS. |
|
||||
| lint | N/A | No Phase 1 workspace lint command exists; not run and not marked PASS. |
|
||||
| strict typecheck | N/A | No Phase 1 workspace typecheck command exists; not run and not marked PASS. |
|
||||
| E2E | N/A | Phase 1+ application/E2E harness does not exist; not run and not marked PASS. |
|
||||
| Independent Phase 0.4 specification/security review | PASS | Final specification review passed after exact-partition, scenario, availability and gate corrections. Independent quality/security reviews also approved the committed-Git-object safety baseline and metadata-only fixture matrix; the original synchronized-risk mutation was reproduced in `/tmp` and now fails closed. |
|
||||
| full product/security audit | DEFERRED | The independent Phase 8/9 audit is not performed or claimed here. |
|
||||
|
||||
## Release decision
|
||||
|
||||
**PASS.** Phase 0 is complete and may enter the Phase 1 workspace/contract bootstrap. Deferred timeout/non-JSON real coverage, Phase 1 lint/typecheck, and Phase 5 E2E remain outside Phase 0 and must not be relabeled as completed evidence.
|
||||
@@ -0,0 +1,116 @@
|
||||
import { readFileSync } from 'node:fs';
|
||||
import { fileURLToPath } from 'node:url';
|
||||
import { upstream58e2204Operations } from './upstream-58e2204.ts';
|
||||
import { DENY_REASONS, selectReadonlyOperations } from '../../test-fixtures/scripts/collector.ts';
|
||||
|
||||
type Risk='R0'|'R1'|'R2'|'R3';
|
||||
export type RuntimeFixtureStatus='captured-readonly'|'denied-readonly-candidate'|'not-eligible-readonly-capture'|'not-eligible-readonly-capture-parameterized-r0';
|
||||
const routeByOwner:Record<string,string>={fleet:'/fleet','instances-new':'/instances/new','settings-instance':'/settings/instances/:id',overview:'/instances/:id/overview',cellular:'/instances/:id/cellular','device-network':'/instances/:id/device-network',messages:'/instances/:id/messages',calls:'/instances/:id/calls',esim:'/instances/:id/esim',notifications:'/instances/:id/notifications',automation:'/instances/:id/automation',ota:'/instances/:id/ota'};
|
||||
const dedicatedAuth=new Set(['postAuthSetup','postAuthPassword','postAuthSettings','postAuthLogin','postAuthLogout']);
|
||||
const resourceBulk=new Set(['postSmsBatchDelete','postNotificationsQueueRetryAll','postNotificationsQueueClear']);
|
||||
|
||||
const fixtureManifest=JSON.parse(readFileSync(fileURLToPath(new URL('../../test-fixtures/src/manifest.json',import.meta.url)),'utf8'));
|
||||
const fixtureRoot=fileURLToPath(new URL('../../test-fixtures/',import.meta.url));
|
||||
const selected=selectReadonlyOperations(upstream58e2204Operations as any[]);
|
||||
const selectedIds=new Set(selected.selected.map((x:any)=>x.operationId));
|
||||
const deniedById=new Map(selected.denied.map((x:any)=>[x.operationId,x.denyReason]));
|
||||
const observations=new Map<string,{aliases:Set<string>,categories:Set<string>,count:number}>();
|
||||
for(const file of fixtureManifest.files){const envelope=JSON.parse(readFileSync(`${fixtureRoot}${file.path}`,'utf8'));const current=observations.get(envelope.operationId)??{aliases:new Set(),categories:new Set(),count:0};current.aliases.add(envelope.sourceInstanceAlias);current.categories.add(envelope.statusCategory);current.count++;observations.set(envelope.operationId,current);}
|
||||
export const fixtureDisposition58e2204=upstream58e2204Operations.map((op:any)=>{const observed=observations.get(op.operationId);if(selectedIds.has(op.operationId))return {operationId:op.operationId,runtimeFixtureStatus:'captured-readonly' as RuntimeFixtureStatus,fixtureCount:observed?.count??0,aliases:[...(observed?.aliases??[])].sort(),observedCategories:[...(observed?.categories??[])].sort(),reason:'collector-selected fully-bound GET R0; two redacted real captures'};const deny=deniedById.get(op.operationId);if(deny)return {operationId:op.operationId,runtimeFixtureStatus:'denied-readonly-candidate' as RuntimeFixtureStatus,fixtureCount:0,aliases:[],observedCategories:[],reason:deny};const parameterized=op.method==='GET'&&op.riskLevel==='R0'&&/[{}]/.test(op.pathTemplate);return {operationId:op.operationId,runtimeFixtureStatus:(parameterized?'not-eligible-readonly-capture-parameterized-r0':'not-eligible-readonly-capture') as RuntimeFixtureStatus,fixtureCount:0,aliases:[],observedCategories:[],reason:parameterized?'R0 read requires bound path parameters; collector accepts only fully-bound Registry paths':'not a collector-eligible fully-bound GET R0 operation'};});
|
||||
const fixtureById=new Map(fixtureDisposition58e2204.map(x=>[x.operationId,x]));
|
||||
|
||||
export const acceptancePolicyCatalog={
|
||||
preconditionPolicyId:{'query-capability':'Registered instance, authorized actor, and runtime capability decision are required.','command-current-state':'Refresh current state when available and bind the actor decision to its revision.','job-fresh-preflight':'Required fresh preflight; inability to refresh blocks execution.','auth-dedicated':'Dedicated auth endpoint, actor/session/instance rate limits, and fresh preflight of authentication state are required.'},
|
||||
stalePolicyId:{'read-retain':'Retain last success as stale and permit an explicit safe refresh.','write-revision':'Refresh current state or require an explicit recorded revision-bound override.','high-risk-block':'Fresh preflight is mandatory; stale, expired, or unknown state blocks execution.','auth-no-replay':'Credential state is never inferred from stale data; require actor-initiated auth flow and no replay.'},
|
||||
unsupportedPolicyId:{'version-probe':'404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.','auth-version-probe':'Auth 404/405/501 is version evidence; do not downgrade to a generic proxy or expose credentials.','ota-version-probe':'OTA 404/405/501 is frozen-version evidence; preserve release/status probe context and never infer global support.'},
|
||||
retryPolicyId:{'safe-read':'Safe reads may retry within deadline and retain stale success.','verify-write':'Writes require outcome verification before actor-initiated retry.','new-job-lineage':'Retry creates a new Job lineage (retryOfJobId/rootJobId); never replay successful items.','auth-actor-only':'No automatic replay; require an actor-initiated dedicated flow.'},
|
||||
resultPolicyId:{'route-result':'Structured result returns to the owning route with a redacted audit link.','job-result':'/jobs/:jobId contains per-item result, attempt lineage, and redacted audit.','auth-result':'Dedicated auth jobs return through /jobs/:jobId; session flows return a credential metadata-only audit result and link.'}
|
||||
} as const;
|
||||
|
||||
/* Exact declarative UI partition. Every operation ID occurs in exactly one group; construction below throws on overlap/omission. */
|
||||
const uiGroups:Record<string,string[]>= {
|
||||
detail:['getDevice','getSim','getNetwork','getHealth','getAuthStatus','getAuthSettings'],
|
||||
table:['getCells','getNetworkInterfaces','getNetworkOperators','getDeviceNetworkWlanProfiles','getEsimProfiles','getCalls','getCallHistory','getSmsList','getSmsConversation','getNotificationsLogs','getNotificationsQueue','getAutomationLogs'],
|
||||
'dedicated-auth-flow':['postAuthSetup','postAuthPassword','postAuthSettings','postAuthLogin','postAuthLogout'],
|
||||
'dedicated-upload-flow':['postOtaUpload'],
|
||||
'job-action':['postBandLock','postDeviceNetworkDdnsConfig','postDeviceNetworkDdnsLogsClear','postDeviceNetworkWlanForget','postNetworkRegisterManual','postNetworkRegisterAuto','postCellLock','postCellLockUnlockAll','postBasebandRestart','postWorkMode','postEsimConfig','postEsimLpacRepair','deleteEsimProfilesIccid','postCallSettings','deleteCallHistoryId','postCallHistoryClear','postSmsSend','postSmsBatchDelete','deleteSmsConversationPhoneNumber','deleteSmsMessageId','postSmsClear','postSystemReboot','postServiceRestart','postNotificationsConfig','postNotificationsTestChannel','postNotificationsLogsClear','postNotificationsQueueRetryAll','postNotificationsQueueClear','deleteNotificationsQueueId','postNotificationsQueueIdRetry','postAutomationConfig','postAutomationLogsClear','postAutomationTestTaskId','postOtaApply','postOtaOnlinePrepare'],
|
||||
form:['postSimCache','postRadioMode','postDeviceNetworkWlanEnabled','postDeviceNetworkWlanConnect','postDeviceNetworkWlanProfile','postApn','postData','postRoaming','postAirplaneMode','postEsimProfiles','postEsimProfilesIccidRename','postCallDial','postCallHangup','postCallAnswer','postCallVolume','postCallForwarding','postOtaLatestRelease'],
|
||||
action:['postSimDetailsRefresh','postCellMonitorStart','postCellMonitorStop','postDeviceNetworkDdnsSync','postDeviceNetworkWlanScan','postDeviceNetworkWlanDisconnect','postEsimProfilesIccidEnable','postCallHangupAll','postOtaCancel'],
|
||||
'read-panel':['getRadioMode','getBandLock','getNetworkConnectionAddresses','getDeviceNetworkDdnsConfig','getDeviceNetworkDdnsStatus','getDeviceNetworkDdnsLogs','getDeviceNetworkWlanStatus','getNetworkSignalStrength','getLocationCellInfo','getNetworkOperatorsScan','getApn','getCellLock','getData','getRoaming','getAirplaneMode','getBasebandRestartStatus','getWorkMode','getEsimConfig','getEsimLpacStatus','getEsimEuicc','getCallVolume','getCallForwarding','getCallSettings','getImsStatus','getVoicemailStatus','getSmsStats','getStats','getStatsCpu','getConnectivity','getNotificationsConfig','getAutomationConfig','getOtaStatus']
|
||||
};
|
||||
const strategyById=new Map<string,string>();for(const [strategy,ids] of Object.entries(uiGroups))for(const id of ids){if(strategyById.has(id))throw new Error(`duplicate acceptance override ${id}`);strategyById.set(id,strategy);}
|
||||
const operationIds=new Set(upstream58e2204Operations.map((x:any)=>x.operationId));if(strategyById.size!==operationIds.size||[...operationIds].some(id=>!strategyById.has(id)))throw new Error('acceptance override partition must exactly cover frozen 117 operations');
|
||||
const route=(owner:string)=>routeByOwner[owner];
|
||||
export const surfaceGroups58e2204=[
|
||||
{surfaceId:'overview/device',primaryRoute:route('overview'),ids:['getDevice']},{surfaceId:'overview/sim',primaryRoute:route('overview'),ids:['getSim','postSimDetailsRefresh','postSimCache']},{surfaceId:'overview/stats',primaryRoute:route('overview'),ids:['getStats','getStatsCpu']},{surfaceId:'overview/auth-health',primaryRoute:route('overview'),ids:['getConnectivity']},{surfaceId:'overview/system-actions',primaryRoute:route('overview'),ids:['postSystemReboot','postServiceRestart']},
|
||||
{surfaceId:'cellular/serving-network',primaryRoute:route('cellular'),ids:['getNetwork']},{surfaceId:'cellular/cells',primaryRoute:route('cellular'),ids:['getCells','postCellMonitorStart','postCellMonitorStop','getLocationCellInfo']},{surfaceId:'cellular/signal',primaryRoute:route('cellular'),ids:['getNetworkSignalStrength']},{surfaceId:'cellular/operator-registration',primaryRoute:route('cellular'),ids:['getNetworkOperators','getNetworkOperatorsScan','postNetworkRegisterManual','postNetworkRegisterAuto']},{surfaceId:'cellular/radio-locks',primaryRoute:route('cellular'),ids:['getRadioMode','postRadioMode','getBandLock','postBandLock','getCellLock','postCellLock','postCellLockUnlockAll']},{surfaceId:'cellular/data-apn',primaryRoute:route('cellular'),ids:['getApn','postApn','getData','postData','getRoaming','postRoaming','getAirplaneMode','postAirplaneMode','postBasebandRestart','getBasebandRestartStatus']},
|
||||
{surfaceId:'device-network/interfaces',primaryRoute:route('device-network'),ids:['getNetworkInterfaces','getNetworkConnectionAddresses']},{surfaceId:'device-network/ddns',primaryRoute:route('device-network'),ids:['getDeviceNetworkDdnsConfig','postDeviceNetworkDdnsConfig','getDeviceNetworkDdnsStatus','postDeviceNetworkDdnsSync','getDeviceNetworkDdnsLogs','postDeviceNetworkDdnsLogsClear']},{surfaceId:'device-network/wlan',primaryRoute:route('device-network'),ids:['getDeviceNetworkWlanStatus','postDeviceNetworkWlanEnabled','postDeviceNetworkWlanScan','getDeviceNetworkWlanProfiles','postDeviceNetworkWlanForget','postDeviceNetworkWlanConnect','postDeviceNetworkWlanDisconnect','postDeviceNetworkWlanProfile']},
|
||||
{surfaceId:'calls/live',primaryRoute:route('calls'),ids:['getCalls','postCallDial','postCallHangup','postCallHangupAll','postCallAnswer']},{surfaceId:'calls/volume',primaryRoute:route('calls'),ids:['getCallVolume','postCallVolume']},{surfaceId:'calls/forwarding',primaryRoute:route('calls'),ids:['getCallForwarding','postCallForwarding']},{surfaceId:'calls/settings',primaryRoute:route('calls'),ids:['getCallSettings','postCallSettings']},{surfaceId:'calls/history',primaryRoute:route('calls'),ids:['getCallHistory','deleteCallHistoryId','postCallHistoryClear']},{surfaceId:'calls/ims-voicemail',primaryRoute:route('calls'),ids:['getImsStatus','getVoicemailStatus']},
|
||||
{surfaceId:'messages/stats',primaryRoute:route('messages'),ids:['getSmsStats']},{surfaceId:'messages/list',primaryRoute:route('messages'),ids:['getSmsList']},{surfaceId:'messages/conversation',primaryRoute:route('messages'),ids:['getSmsConversation']},{surfaceId:'messages/compose',primaryRoute:route('messages'),ids:['postSmsSend']},{surfaceId:'messages/destructive',primaryRoute:route('messages'),ids:['postSmsBatchDelete','deleteSmsConversationPhoneNumber','deleteSmsMessageId','postSmsClear']},
|
||||
{surfaceId:'esim/mode',primaryRoute:route('esim'),ids:['getWorkMode','postWorkMode']},{surfaceId:'esim/config',primaryRoute:route('esim'),ids:['getEsimConfig','postEsimConfig']},{surfaceId:'esim/lpac',primaryRoute:route('esim'),ids:['getEsimLpacStatus','postEsimLpacRepair']},{surfaceId:'esim/euicc',primaryRoute:route('esim'),ids:['getEsimEuicc']},{surfaceId:'esim/profiles',primaryRoute:route('esim'),ids:['getEsimProfiles','postEsimProfiles','postEsimProfilesIccidEnable','postEsimProfilesIccidRename','deleteEsimProfilesIccid']},
|
||||
{surfaceId:'notifications/config',primaryRoute:route('notifications'),ids:['getNotificationsConfig','postNotificationsConfig','postNotificationsTestChannel']},{surfaceId:'notifications/logs',primaryRoute:route('notifications'),ids:['getNotificationsLogs','postNotificationsLogsClear']},{surfaceId:'notifications/queue',primaryRoute:route('notifications'),ids:['getNotificationsQueue','postNotificationsQueueRetryAll','postNotificationsQueueClear','deleteNotificationsQueueId','postNotificationsQueueIdRetry']},
|
||||
{surfaceId:'automation/config',primaryRoute:route('automation'),ids:['getAutomationConfig','postAutomationConfig']},{surfaceId:'automation/logs',primaryRoute:route('automation'),ids:['getAutomationLogs','postAutomationLogsClear']},{surfaceId:'automation/task-test',primaryRoute:route('automation'),ids:['postAutomationTestTaskId']},
|
||||
{surfaceId:'ota/status',primaryRoute:route('ota'),ids:['getOtaStatus','postOtaCancel']},{surfaceId:'ota/release',primaryRoute:route('ota'),ids:['postOtaLatestRelease','postOtaOnlinePrepare']},{surfaceId:'ota/upload',primaryRoute:route('ota'),ids:['postOtaUpload']},{surfaceId:'ota/apply',primaryRoute:route('ota'),ids:['postOtaApply']},
|
||||
{surfaceId:'settings/auth-settings',primaryRoute:route('settings-instance'),ids:['postAuthPassword','getAuthSettings','postAuthSettings','postAuthLogout']},{surfaceId:'settings/auth-entry',primaryRoute:route('instances-new'),ids:['getHealth','getAuthStatus','postAuthSetup','postAuthLogin']}
|
||||
] as const;
|
||||
|
||||
const policies=(preconditionPolicyId:string,stalePolicyId:string,retryPolicyId:string,resultPolicyId:string,unsupportedPolicyId='version-probe')=>({preconditionPolicyId,stalePolicyId,unsupportedPolicyId,retryPolicyId,resultPolicyId});
|
||||
export const policyGroups58e2204=[
|
||||
{groupId:'query-list',ids:['getCells','getNetworkInterfaces','getDeviceNetworkDdnsLogs','getDeviceNetworkWlanProfiles','getNetworkOperators','getEsimProfiles','getCalls','getCallHistory','getSmsList','getSmsConversation','getNotificationsLogs','getNotificationsQueue','getAutomationLogs'],policies:policies('query-capability','read-retain','safe-read','route-result')},
|
||||
{groupId:'query-detail',ids:['getDevice','getSim','getNetwork','getRadioMode','getBandLock','getNetworkConnectionAddresses','getDeviceNetworkDdnsConfig','getDeviceNetworkDdnsStatus','getDeviceNetworkWlanStatus','getNetworkSignalStrength','getLocationCellInfo','getApn','getCellLock','getData','getRoaming','getAirplaneMode','getBasebandRestartStatus','getWorkMode','getEsimConfig','getEsimLpacStatus','getEsimEuicc','getCallVolume','getCallForwarding','getCallSettings','getImsStatus','getVoicemailStatus','getSmsStats','getNotificationsConfig','getAutomationConfig','getOtaStatus'],policies:policies('query-capability','read-retain','safe-read','route-result')},
|
||||
{groupId:'query-composite',ids:['getStats','getStatsCpu','getConnectivity'],policies:policies('command-current-state','read-retain','safe-read','route-result')},
|
||||
{groupId:'query-active-scan',ids:['getNetworkOperatorsScan'],policies:policies('command-current-state','write-revision','verify-write','route-result')},
|
||||
{groupId:'query-auth-detail',ids:['getAuthSettings','getHealth','getAuthStatus'],policies:policies('query-capability','auth-no-replay','auth-actor-only','auth-result','auth-version-probe')},
|
||||
{groupId:'direct-reversible-setting',ids:['postSimDetailsRefresh','postSimCache','postCellMonitorStart','postCellMonitorStop','postRadioMode','postDeviceNetworkDdnsSync','postDeviceNetworkWlanEnabled','postDeviceNetworkWlanScan','postDeviceNetworkWlanConnect','postDeviceNetworkWlanDisconnect','postDeviceNetworkWlanProfile','postApn','postData','postRoaming','postAirplaneMode','postEsimProfiles','postEsimProfilesIccidEnable','postEsimProfilesIccidRename','postCallDial','postCallHangup','postCallHangupAll','postCallAnswer','postCallVolume','postCallForwarding'],policies:policies('command-current-state','write-revision','verify-write','route-result')},
|
||||
{groupId:'session-auth-flow',ids:['postAuthLogin','postAuthLogout'],policies:policies('auth-dedicated','auth-no-replay','auth-actor-only','auth-result','auth-version-probe')},
|
||||
{groupId:'high-risk-network-job',ids:['postBandLock','postDeviceNetworkDdnsConfig','postDeviceNetworkDdnsLogsClear','postDeviceNetworkWlanForget','postNetworkRegisterManual','postNetworkRegisterAuto','postCellLock','postCellLockUnlockAll','postBasebandRestart','postWorkMode','postEsimConfig','postEsimLpacRepair','postCallSettings','postSmsSend','postNotificationsConfig','postNotificationsTestChannel','postNotificationsQueueRetryAll','postNotificationsQueueIdRetry','postAutomationConfig','postAutomationTestTaskId'],policies:policies('job-fresh-preflight','high-risk-block','new-job-lineage','job-result')},
|
||||
{groupId:'destructive-cleanup-job',ids:['deleteEsimProfilesIccid','deleteCallHistoryId','postCallHistoryClear','postSmsBatchDelete','deleteSmsConversationPhoneNumber','deleteSmsMessageId','postSmsClear','postSystemReboot','postServiceRestart','postNotificationsLogsClear','postNotificationsQueueClear','deleteNotificationsQueueId','postAutomationLogsClear'],policies:policies('job-fresh-preflight','high-risk-block','new-job-lineage','job-result')},
|
||||
{groupId:'ota-direct-control',ids:['postOtaLatestRelease','postOtaCancel'],policies:policies('command-current-state','write-revision','verify-write','route-result')},
|
||||
{groupId:'ota-job',ids:['postOtaUpload','postOtaOnlinePrepare','postOtaApply'],policies:policies('job-fresh-preflight','high-risk-block','new-job-lineage','job-result','ota-version-probe')},
|
||||
{groupId:'high-risk-auth-flow',ids:['postAuthPassword','postAuthSettings','postAuthSetup'],policies:policies('auth-dedicated','auth-no-replay','new-job-lineage','auth-result','auth-version-probe')}
|
||||
] as const;
|
||||
|
||||
const readScenario=(empty:boolean,partial:boolean)=>({empty:{applicable:empty,rationale:empty?'Successful collection may contain no rows.':'Detail resource has no collection-empty rendering.'},partial:{applicable:partial,rationale:partial?'Independent response sections may succeed or fail.':'Atomic detail read has no meaningful partial rendering.'},'policy-forbidden':{applicable:false,rationale:'Safe read has no write-confirmation policy; support remains orthogonal.'},'unknown-result':{applicable:false,rationale:'Read failure is an error/freshness state, not unknown write outcome.'},'owner-switch':{applicable:true,rationale:'Owner switch discards responses with a mismatched instance key.'}});
|
||||
const writeScenario=(partial:boolean)=>({empty:{applicable:false,rationale:'Command result is not a collection-empty state.'},partial:{applicable:partial,rationale:partial?'Job items may independently succeed, fail, or be skipped.':'Single-target command has no meaningful partial result.'},'policy-forbidden':{applicable:true,rationale:'Write can be blocked by capability, authorization, risk, or preflight policy.'},'unknown-result':{applicable:true,rationale:'Disconnect or timeout requires outcome verification before retry.'},'owner-switch':{applicable:true,rationale:'Owner switch preserves execution lineage but discards mismatched route responses.'}});
|
||||
const activeScanScenario={empty:{applicable:true,rationale:'A successful active operator scan may return no operators.'},partial:{applicable:true,rationale:'The scan response may contain usable operators alongside per-result failures or incomplete entries.'},'policy-forbidden':{applicable:true,rationale:'Active scan may be blocked by capability, authorization, preflight, or active-scan policy.'},'unknown-result':{applicable:false,rationale:'A timed-out scan result may be discarded; it is not an unknown persistent write outcome.'},'owner-switch':{applicable:true,rationale:'Owner switch discards scan responses with a mismatched instance key.'}};
|
||||
export const scenarioGroups58e2204=[
|
||||
{profileId:'list-read',ids:['getCells','getNetworkInterfaces','getDeviceNetworkDdnsLogs','getDeviceNetworkWlanProfiles','getNetworkOperators','getEsimProfiles','getCalls','getCallHistory','getSmsList','getSmsConversation','getNotificationsLogs','getNotificationsQueue','getAutomationLogs'],scenarios:readScenario(true,true)},
|
||||
{profileId:'detail-read',ids:['getDevice','getSim','getNetwork','getRadioMode','getBandLock','getNetworkConnectionAddresses','getDeviceNetworkDdnsConfig','getDeviceNetworkDdnsStatus','getDeviceNetworkWlanStatus','getNetworkSignalStrength','getLocationCellInfo','getApn','getCellLock','getData','getRoaming','getAirplaneMode','getBasebandRestartStatus','getWorkMode','getEsimConfig','getEsimLpacStatus','getEsimEuicc','getCallVolume','getCallForwarding','getCallSettings','getImsStatus','getVoicemailStatus','getSmsStats','getNotificationsConfig','getAutomationConfig','getOtaStatus','getAuthSettings','getHealth','getAuthStatus'],scenarios:readScenario(false,false)},
|
||||
{profileId:'composite-read',ids:['getStats','getStatsCpu','getConnectivity'],scenarios:readScenario(false,true)},
|
||||
{profileId:'active-scan',ids:['getNetworkOperatorsScan'],scenarios:activeScanScenario},
|
||||
{profileId:'direct-write',ids:['postSimDetailsRefresh','postSimCache','postCellMonitorStart','postCellMonitorStop','postRadioMode','postDeviceNetworkDdnsSync','postDeviceNetworkWlanEnabled','postDeviceNetworkWlanScan','postDeviceNetworkWlanConnect','postDeviceNetworkWlanDisconnect','postDeviceNetworkWlanProfile','postApn','postData','postRoaming','postAirplaneMode','postEsimProfiles','postEsimProfilesIccidEnable','postEsimProfilesIccidRename','postCallDial','postCallHangup','postCallHangupAll','postCallAnswer','postCallVolume','postCallForwarding'],scenarios:writeScenario(false)},
|
||||
{profileId:'job-single',ids:['postBandLock','postDeviceNetworkDdnsConfig','postDeviceNetworkDdnsLogsClear','postDeviceNetworkWlanForget','postNetworkRegisterManual','postNetworkRegisterAuto','postCellLock','postCellLockUnlockAll','postWorkMode','postEsimConfig','postEsimLpacRepair','postCallSettings','postSmsSend','postNotificationsConfig','postNotificationsTestChannel','postNotificationsQueueIdRetry','postAutomationConfig','postAutomationTestTaskId','deleteEsimProfilesIccid','deleteCallHistoryId','postCallHistoryClear','deleteSmsConversationPhoneNumber','deleteSmsMessageId','postSmsClear','postBasebandRestart','postSystemReboot','postServiceRestart','postNotificationsLogsClear','deleteNotificationsQueueId','postAutomationLogsClear'],scenarios:writeScenario(false)},
|
||||
{profileId:'job-resource-bulk',ids:['postSmsBatchDelete','postNotificationsQueueRetryAll','postNotificationsQueueClear'],scenarios:writeScenario(true)},
|
||||
{profileId:'ota-direct',ids:['postOtaLatestRelease','postOtaCancel'],scenarios:writeScenario(false)},
|
||||
{profileId:'ota-job-single',ids:['postOtaUpload','postOtaOnlinePrepare','postOtaApply'],scenarios:writeScenario(false)},
|
||||
{profileId:'auth-flow',ids:['postAuthPassword','postAuthSettings','postAuthSetup','postAuthLogin','postAuthLogout'],scenarios:writeScenario(false)}
|
||||
] as const;
|
||||
|
||||
const versionEvidencePolicy='Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict.';
|
||||
export const availabilityGroups58e2204=[
|
||||
{groupId:'captured-real-read',realAcceptance:'REAL_READ',availability:'planned',reason:'Frozen-scope read has two redacted captured responses; runtime support is still decided per registered instance.',versionEvidencePolicy,ids:['getDevice','getSim','getNetwork','getCells','getRadioMode','getBandLock','getNetworkInterfaces','getNetworkConnectionAddresses','getDeviceNetworkDdnsConfig','getDeviceNetworkDdnsStatus','getDeviceNetworkWlanStatus','getDeviceNetworkWlanProfiles','getNetworkSignalStrength','getLocationCellInfo','getNetworkOperators','getApn','getCellLock','getData','getRoaming','getAirplaneMode','getBasebandRestartStatus','getWorkMode','getEsimConfig','getEsimLpacStatus','getCalls','getCallVolume','getCallForwarding','getCallSettings','getImsStatus','getVoicemailStatus','getSmsStats','getStats','getStatsCpu','getNotificationsConfig','getAutomationConfig','getOtaStatus','getAuthSettings','getHealth','getAuthStatus']},
|
||||
{groupId:'denied-read-candidate',realAcceptance:'REAL_READ_DEFERRED',availability:'planned',reason:'Frozen-scope read is modeled but real capture was explicitly denied; runtime support is probed per instance.',versionEvidencePolicy,ids:['getDeviceNetworkDdnsLogs','getNetworkOperatorsScan','getEsimEuicc','getEsimProfiles','getCallHistory','getSmsList','getSmsConversation','getConnectivity','getNotificationsLogs','getNotificationsQueue','getAutomationLogs']},
|
||||
{groupId:'write-later',realAcceptance:'REAL_WRITE_LATER',availability:'planned',reason:'Frozen-scope reversible command is contract-planned for a later controlled real-write acceptance phase.',versionEvidencePolicy,ids:['postSimDetailsRefresh','postSimCache','postCellMonitorStart','postCellMonitorStop','postRadioMode','postDeviceNetworkDdnsSync','postDeviceNetworkWlanEnabled','postDeviceNetworkWlanScan','postDeviceNetworkWlanConnect','postDeviceNetworkWlanDisconnect','postDeviceNetworkWlanProfile','postApn','postData','postRoaming','postAirplaneMode','postEsimProfiles','postEsimProfilesIccidEnable','postEsimProfilesIccidRename','postCallDial','postCallHangup','postCallHangupAll','postCallAnswer','postCallVolume','postCallForwarding','postOtaLatestRelease','postOtaCancel','postAuthLogin','postAuthLogout']},
|
||||
{groupId:'high-risk-simulated',realAcceptance:'SIMULATED_HIGH_RISK',availability:'planned',reason:'Frozen-scope high-risk operation is planned with simulation-only acceptance until controlled safety authorization exists.',versionEvidencePolicy,ids:['postBandLock','postDeviceNetworkDdnsConfig','postDeviceNetworkDdnsLogsClear','postDeviceNetworkWlanForget','postNetworkRegisterManual','postNetworkRegisterAuto','postCellLock','postCellLockUnlockAll','postBasebandRestart','postWorkMode','postEsimConfig','postEsimLpacRepair','deleteEsimProfilesIccid','postCallSettings','deleteCallHistoryId','postCallHistoryClear','postSmsSend','postSmsBatchDelete','deleteSmsConversationPhoneNumber','deleteSmsMessageId','postSmsClear','postSystemReboot','postServiceRestart','postNotificationsConfig','postNotificationsTestChannel','postNotificationsLogsClear','postNotificationsQueueRetryAll','postNotificationsQueueClear','deleteNotificationsQueueId','postNotificationsQueueIdRetry','postAutomationConfig','postAutomationLogsClear','postAutomationTestTaskId','postOtaUpload','postOtaOnlinePrepare','postOtaApply','postAuthPassword','postAuthSettings','postAuthSetup']}
|
||||
] as const;
|
||||
|
||||
function exactLookup(groups:readonly any[],label:string){const map=new Map<string,any>();for(const group of groups)for(const id of group.ids){if(map.has(id))throw new Error(`${label} overlap: ${id}`);map.set(id,group);}for(const id of map.keys())if(!operationIds.has(id))throw new Error(`${label} unknown operation: ${id}`);if(map.size!==operationIds.size||[...operationIds].some(id=>!map.has(id)))throw new Error(`${label} must exactly cover frozen 117 operations`);return map;}
|
||||
const surfaceById=exactLookup(surfaceGroups58e2204,'surface');const policyById=exactLookup(policyGroups58e2204,'policy');const scenarioById=exactLookup(scenarioGroups58e2204,'scenario');const availabilityById=exactLookup(availabilityGroups58e2204,'availability');
|
||||
export const operationAcceptanceOverrides58e2204=Object.fromEntries(upstream58e2204Operations.map((op:any)=>{const surface=surfaceById.get(op.operationId);const policy=policyById.get(op.operationId);const scenario=scenarioById.get(op.operationId);const availability=availabilityById.get(op.operationId);if(!surface||!policy||!scenario||!availability)throw new Error(`missing exact acceptance decision: ${op.operationId}`);return [op.operationId,{surfaceId:surface.surfaceId,primaryRoute:surface.primaryRoute,uiStrategy:strategyById.get(op.operationId),...policy.policies,scenarioAcceptance:scenario.scenarios,availability:availability.availability,availabilityReason:availability.reason,versionEvidencePolicy:availability.versionEvidencePolicy,realAcceptance:availability.realAcceptance}];}));
|
||||
export const operationAcceptance58e2204=upstream58e2204Operations.map((op:any)=>{const override:any=operationAcceptanceOverrides58e2204[op.operationId];const policies:any=acceptancePolicyCatalog;const high=['R2','R3'].includes(op.riskLevel);const auth=dedicatedAuth.has(op.operationId);const scenarios=override.scenarioAcceptance;return {operationId:op.operationId,method:op.method,pathTemplate:op.pathTemplate,upstreamDomain:op.upstreamDomain,primaryRoute:override.primaryRoute,surfaceId:override.surfaceId,uiStrategy:override.uiStrategy,availability:override.availability,availabilityReason:override.availabilityReason,versionEvidencePolicy:override.versionEvidencePolicy,requiredStates:{request:['idle','loading','success','error'],freshness:['fresh','stale','expired','unknown'],support:['supported','unsupported','auth-required','degraded','unknown'],scenarios:Object.entries(scenarios).filter(([,v]:any)=>v.applicable).map(([k])=>k),naRationale:'Non-applicable scenarios retain an explicit rationale in scenarioAcceptance.'},scenarioAcceptance:scenarios,riskLevel:op.riskLevel as Risk,confirmationUX:op.confirmationPolicy,executionMode:auth?'dedicated-flow':high?'preparation-job':'direct',executionDerivation:auth?'Registry executionPolicy=dedicatedFlow binds the dedicated authentication orchestration.':high?'Registry capability=job plus product prepare-confirm-execute policy derives preparation-job orchestration.':'Registry capability plus acceptance policy derives direct structured execution.',executionPolicySource:'Registry supplies risk, confirmation, capability and dedicatedFlow; acceptance policy supplies orchestration.',...Object.fromEntries(['preconditionPolicyId','stalePolicyId','unsupportedPolicyId','retryPolicyId','resultPolicyId'].map(k=>[k,override[k]])),preconditions:policies.preconditionPolicyId[override.preconditionPolicyId],stalePolicy:policies.stalePolicyId[override.stalePolicyId],unsupportedPolicy:policies.unsupportedPolicyId[override.unsupportedPolicyId],retryRecovery:policies.retryPolicyId[override.retryPolicyId],resultDestination:policies.resultPolicyId[override.resultPolicyId],resourceBulk:resourceBulk.has(op.operationId),fleetBatchable:op.operationId==='getHealth',partialAggregationPolicy:op.operationId==='getHealth'?'per-item':resourceBulk.has(op.operationId)?'resource-item':'not-applicable',realAcceptance:override.realAcceptance,evidenceIds:[`registry:${op.operationId}`,...op.sourceEvidence.map((x:string)=>`upstream:${x}`),`fixture:${fixtureById.get(op.operationId)?.runtimeFixtureStatus}`],...(op.sessionSensitive?{sessionSubtype:'session-sensitive'}:{})};});
|
||||
|
||||
const flow=(flowId:string,route:string,risk:string,riskSubtype:string,confirmation:string,preconditions:string,result:string,failureRecovery:string,secretPolicy:string,evidence:string)=>({flowId,route,risk,riskSubtype,confirmation,preconditions,result,failureRecovery,secretPolicy,evidence});
|
||||
export const controlPlaneAcceptance=[
|
||||
flow('instance-create','/instances/new','R1','configuration','diff-confirm','canonical origin and unique stable ID','created instance revision and audit','retain draft on validation or reconcile failure','secret reference only; never return a value','WF-01 + product policy'),
|
||||
flow('instance-update','/settings/instances/:id','R1','configuration','revision-diff','current revision','updated revision and audit','409 refreshes diff without losing edits','preserve/set/clear explicit; never return a value','WF-01 + product policy'),
|
||||
flow('instance-delete','/settings/instances/:id','R3','destructive','strong target restatement','fresh revision and no conflicting job','new jobId with two-phase deleting to tombstone result','before boundary restore; after boundary manual recovery','destroy reference without reading secret value','WF-13'),
|
||||
flow('secret-set','/settings/instances/:id','R1','secret-reference','explicit set','authorized SecretStore write','new reference metadata and audit','atomic rollback on reference write failure','never return or log secret value','WF-01'),flow('secret-preserve','/settings/instances/:id','R1','secret-reference','explicit preserve','existing reference metadata','unchanged reference metadata and audit','revision conflict refreshes metadata only','never read or return secret value','WF-01'),flow('secret-clear','/settings/instances/:id','R1','secret-reference','explicit clear','fresh revision','reference removed and audit','atomic rollback or explicit recovery state','never return destroyed secret value','WF-01'),
|
||||
flow('config-import-preview','/settings/instances','R0','preview','none','validated upload and canonical origins','redacted diff/conflict/count preview','fix file and regenerate preview','never include secret values in preview','IA settings import'),flow('config-import-confirm','/settings/instances','R2','bulk-configuration','explicit preview token','fresh unexpired preview','new jobId with per-instance items','retry failed items in new lineage','references only; never import/export secret values','IA settings import'),
|
||||
flow('credential-verify','/instances/new','R1','session-sensitive','actor initiated','rate limit and registered target','credential metadata-only result','no automatic replay; actor may retry after backoff','ephemeral input, never response/audit value','WF-01'),flow('saved-secret-login','/instances/new','R1','session-sensitive','actor initiated','saved reference and rate limit','session metadata-only result','no automatic replay; return to login flow','resolve server-side; never expose value','WF-12'),flow('temporary-secret-login','/instances/new','R1','session-sensitive','actor initiated','one-shot input and rate limit','session metadata-only result','no automatic replay; require new actor input','memory-only and never saved or returned','WF-12'),flow('logout','/settings/instances/:id','R1','session-sensitive','actor initiated','active session','session cleared and metadata audit','no replay; reconcile auth status','no credential value involved','WF-12'),flow('401-recovery','/instances/:id/overview','R1','session-recovery','actor chooses login','401 evidence and retained stale data','return to owner; retry R0 only','never replay writes; preserve draft for new prepare','temporary/saved secret follows selected login policy','WF-12'),
|
||||
flow('auth-setup','/instances/new','R3','authentication-change','strong confirmation','fresh dedicated auth preflight','new jobId and metadata-only audit','new lineage after state verification','password never returned or audited','Registry postAuthSetup'),flow('auth-password-change','/settings/instances/:id','R3','authentication-change','strong confirmation','fresh dedicated auth preflight','new jobId and metadata-only audit','new lineage after auth-status verification','old/new password never returned or audited','Registry postAuthPassword'),flow('auth-settings-read','/settings/instances/:id','R0','authentication-read','none','registered instance and actor','structured auth settings','safe actor retry','no password/cookie/token fields','Registry getAuthSettings'),flow('auth-settings-write','/settings/instances/:id','R2','authentication-change','explicit confirmation','fresh dedicated auth preflight','new jobId and metadata-only audit','new lineage; no replay','never return credential values','Registry postAuthSettings'),
|
||||
flow('job-cancel','/jobs/:jobId','R1','job-control','explicit confirmation','cancelable current phase','immutable cancellation event','show non-cancelable boundary and reconcile','no secret data in event','IA jobs'),flow('job-retry','/jobs/:jobId','R2','job-control','explicit failed-item selection','source terminal state and fresh preflight','new jobId with retryOf/root/source lineage','never mutate source or replay successful items','redacted parameter summary only','WF-10'),flow('audit-export','/audit','R0','data-export','explicit scope','authorized filters','redacted export artifact','regenerate from immutable audit','redaction applies; no sensitiveFields','WF-11'),flow('system-settings-update','/settings/system','R1','configuration','revision-diff','safe bounds and current revision','updated revision and audit','409 refreshes diff; invalid bounds rejected','no secrets accepted','IA settings system')
|
||||
];
|
||||
|
||||
const esc=(v:any)=>String(v).replace(/\|/g,'\\|').replace(/\n/g,' ');
|
||||
export function renderOperationAcceptanceMatrix(){const controlRows=controlPlaneAcceptance.map(x=>`| \`${x.flowId}\` | \`${x.route}\` | ${x.risk} / ${x.riskSubtype} | ${x.confirmation} | ${esc(x.preconditions)} | ${esc(x.result)} | ${esc(x.failureRecovery)} | ${esc(x.secretPolicy)} | ${esc(x.evidence)} |`).join('\n');const rows=operationAcceptance58e2204.map((x:any)=>{const f:any=fixtureById.get(x.operationId);const scenarios=Object.entries(x.scenarioAcceptance).map(([k,v]:any)=>`${k}:${v.applicable?'Y':'N'} (${v.rationale})`).join('<br>');const policies=`${x.preconditionPolicyId}/${x.stalePolicyId}/${x.unsupportedPolicyId}/${x.retryPolicyId}/${x.resultPolicyId}`;const categories=f.observedCategories.length?[...f.observedCategories].sort().join(','):'none';return `| \`${x.operationId}\` | ${x.method} \`${x.pathTemplate}\` | ${x.upstreamDomain} | \`${x.primaryRoute}\`<br>\`${x.surfaceId}\` | ${x.uiStrategy} | ${x.availability}: ${esc(x.availabilityReason)}<br>${esc(x.versionEvidencePolicy)} | ${scenarios} | ${x.riskLevel}; ${x.confirmationUX}<br>${x.executionMode} | ${policies}<br>${esc(x.preconditions)}<br>${esc(x.stalePolicy)}<br>${esc(x.unsupportedPolicy)}<br>${esc(x.retryRecovery)}<br>${esc(x.resultDestination)} | ${x.realAcceptance} | ${f.runtimeFixtureStatus}; n=${f.fixtureCount}; categories=${categories}; ${esc(f.reason)} | ${x.evidenceIds.map((e:string)=>`\`${e}\``).join('<br>')} |`;}).join('\n');return `# Operation acceptance matrix — upstream 58e2204\n\n> Generated from the structured ledger. Registry is the sole source for risk, confirmation, capability, and dedicated-flow facts; orchestration is bound by acceptance policy. \`registeredOperation\` is not a synonym for preparation Job.\n\nREAL_READ means captured evidence and is restricted to \`captured-readonly\`. REAL_READ_DEFERRED marks denied candidates without a real fixture. Fixture disposition is metadata-only: runtime status, count, safe observed status categories, and reason; it never renders fixture body/response, alias, identity, or URL.\n\n## Control-plane acceptance (independent flows)\n\n| flowId | route | risk / subtype | confirmation | preconditions | result | failure recovery | secret policy | evidence |\n|---|---|---|---|---|---|---|---|---|\n${controlRows}\n\n## Upstream operation acceptance (exact 117)\n\n| operationId | method/path | domain | route/surface | UI | availability/version evidence | scenario applicability | risk/confirmation/execution | policy IDs and resolved policies | real class | fixture disposition (metadata-only: runtime status / n / categories / reason) | evidence |\n|---|---|---|---|---|---|---|---|---|---|---|---|\n${rows}\n`;}
|
||||
export const fixtureDenyReasons58e2204=DENY_REASONS;
|
||||
@@ -0,0 +1,69 @@
|
||||
import test from 'node:test';
|
||||
import assert from 'node:assert/strict';
|
||||
import { readFile } from 'node:fs/promises';
|
||||
import { fileURLToPath } from 'node:url';
|
||||
import { upstream58e2204Operations } from '../src/upstream-58e2204.ts';
|
||||
import { operationAcceptance58e2204, operationAcceptanceOverrides58e2204, acceptancePolicyCatalog, controlPlaneAcceptance, fixtureDisposition58e2204, renderOperationAcceptanceMatrix, surfaceGroups58e2204, policyGroups58e2204, scenarioGroups58e2204, availabilityGroups58e2204 } from '../src/acceptance-58e2204.ts';
|
||||
import { DENY_REASONS, selectReadonlyOperations } from '../../test-fixtures/scripts/collector.ts';
|
||||
|
||||
const fixtureManifestPath=fileURLToPath(new URL('../../test-fixtures/src/manifest.json',import.meta.url));
|
||||
const matrixPath=fileURLToPath(new URL('../../../docs/product/operation-acceptance-matrix.md',import.meta.url));
|
||||
const acceptanceSourcePath=fileURLToPath(new URL('../src/acceptance-58e2204.ts',import.meta.url));
|
||||
const iaPath=fileURLToPath(new URL('../../../docs/product/information-architecture.md',import.meta.url));
|
||||
const manifest=JSON.parse(await readFile(fixtureManifestPath,'utf8'));
|
||||
const byId=new Map(upstream58e2204Operations.map((o:any)=>[o.operationId,o]));
|
||||
const canonicalRoutes=new Set(['/fleet','/instances/new','/instances/:id/overview','/instances/:id/cellular','/instances/:id/device-network','/instances/:id/messages','/instances/:id/calls','/instances/:id/esim','/instances/:id/notifications','/instances/:id/automation','/instances/:id/ota','/settings/instances/:id']);
|
||||
const assertExactPartition=(groups:readonly {ids:readonly string[]}[])=>{const ids=groups.flatMap(g=>[...g.ids]);assert.equal(ids.length,117);assert.equal(new Set(ids).size,117);assert.deepEqual([...ids].sort(),[...byId.keys()].sort());};
|
||||
|
||||
test('RED→GREEN: surface/policy/scenario/availability are literal exact operation partitions',()=>{
|
||||
for(const groups of [surfaceGroups58e2204,policyGroups58e2204,scenarioGroups58e2204,availabilityGroups58e2204])assertExactPartition(groups);
|
||||
assert.ok(surfaceGroups58e2204.filter(g=>g.surfaceId.startsWith('calls/')).length>=5);
|
||||
assert.ok(surfaceGroups58e2204.filter(g=>g.surfaceId.startsWith('cellular/')).length>=5);
|
||||
for(const group of surfaceGroups58e2204)for(const id of group.ids){const row=operationAcceptance58e2204.find(x=>x.operationId===id)!;assert.equal(row.surfaceId,group.surfaceId);assert.equal(row.primaryRoute,group.primaryRoute);}
|
||||
const tuples=new Set(policyGroups58e2204.map(g=>Object.values(g.policies).join('/')));assert.ok(policyGroups58e2204.length>=8);assert.ok(tuples.size>=8);
|
||||
const policy=(id:string)=>policyGroups58e2204.find(g=>g.ids.includes(id))!;assert.match(policy('getSmsList').groupId,/list/);assert.match(policy('getHealth').groupId,/detail/);assert.match(policy('getNetworkOperatorsScan').groupId,/scan/);assert.match(policy('postData').groupId,/direct/);assert.match(policy('postAuthLogin').groupId,/auth/);assert.match(policy('postSmsBatchDelete').groupId,/destructive/);assert.match(policy('postOtaApply').groupId,/ota/);
|
||||
assert.ok(scenarioGroups58e2204.length>=8);const scenario=(id:string)=>scenarioGroups58e2204.find(g=>g.ids.includes(id))!.scenarios;assert.equal(scenario('getHealth').empty.applicable,false);assert.equal(scenario('getSmsList').empty.applicable,true);assert.equal(scenario('getStats').partial.applicable,true);assert.equal(scenario('getAuthStatus').partial.applicable,false);assert.equal(scenario('getNetworkOperatorsScan').empty.applicable,true);assert.equal(scenario('getNetworkOperatorsScan').partial.applicable,true);assert.equal(scenario('getNetworkOperatorsScan')['policy-forbidden'].applicable,true);assert.equal(scenario('getNetworkOperatorsScan')['unknown-result'].applicable,false);for(const id of ['postSmsBatchDelete','postNotificationsQueueRetryAll','postNotificationsQueueClear'])assert.equal(scenario(id).partial.applicable,true,id);for(const id of ['postSystemReboot','postServiceRestart','deleteCallHistoryId','postBandLock','postOtaApply','postOtaUpload','postOtaOnlinePrepare','postOtaLatestRelease','postOtaCancel','postData'])assert.equal(scenario(id).partial.applicable,false,id);for(const id of ['postData','postSmsBatchDelete']){assert.equal(scenario(id)['policy-forbidden'].applicable,true);assert.equal(scenario(id)['unknown-result'].applicable,true);}for(const id of ['getHealth','getSmsList']){assert.equal(scenario(id)['policy-forbidden'].applicable,false);assert.equal(scenario(id)['unknown-result'].applicable,false);}for(const group of scenarioGroups58e2204)assert.equal(group.scenarios['owner-switch'].applicable,true);
|
||||
assert.ok(availabilityGroups58e2204.length>=4);for(const group of availabilityGroups58e2204)assert.ok(group.reason.length>20);
|
||||
});
|
||||
|
||||
test('RED→GREEN: acceptance ledger is exact, Registry-bound and IA-owned',()=>{
|
||||
assert.equal(operationAcceptance58e2204.length,117);
|
||||
assert.equal(new Set(operationAcceptance58e2204.map(x=>x.operationId)).size,117);
|
||||
assert.deepEqual([...operationAcceptance58e2204.map(x=>x.operationId)].sort(),[...byId.keys()].sort());
|
||||
for(const row of operationAcceptance58e2204){const op:any=byId.get(row.operationId);assert.ok(op);assert.equal(row.method,op.method);assert.equal(row.pathTemplate,op.pathTemplate);assert.equal(row.upstreamDomain,op.upstreamDomain);assert.equal(row.riskLevel,op.riskLevel);assert.equal(row.confirmationUX,op.confirmationPolicy);assert.ok(canonicalRoutes.has(row.primaryRoute),row.operationId);assert.ok(row.surfaceId);assert.ok(row.uiStrategy);assert.match(row.availability,/^(planned|unsupported-version|deferred-with-reason)$/);if(row.availability==='deferred-with-reason')assert.ok(row.availabilityReason);assert.ok(row.requiredStates.request.length&&row.requiredStates.freshness.length&&row.requiredStates.support.length);assert.ok(row.requiredStates.scenarios.length||row.requiredStates.naRationale);assert.ok(row.evidenceIds.length);}
|
||||
});
|
||||
|
||||
test('RED→GREEN: exact overrides and policy-bound acceptance are auditable',()=>{
|
||||
assert.deepEqual(Object.keys(operationAcceptanceOverrides58e2204).sort(),[...byId.keys()].sort());
|
||||
const policyFields=['preconditionPolicyId','stalePolicyId','unsupportedPolicyId','retryPolicyId','resultPolicyId'];
|
||||
for(const row of operationAcceptance58e2204){const override:any=(operationAcceptanceOverrides58e2204 as any)[row.operationId];assert.ok(override);assert.ok(row.availabilityReason?.length>20,row.operationId);assert.ok(row.versionEvidencePolicy?.length>20,row.operationId);assert.equal(row.surfaceId,override.surfaceId);assert.equal(row.uiStrategy,override.uiStrategy);for(const scenario of ['empty','partial','policy-forbidden','unknown-result','owner-switch']){assert.equal(typeof row.scenarioAcceptance[scenario].applicable,'boolean');assert.ok(row.scenarioAcceptance[scenario].rationale.length>8);}for(const field of policyFields){assert.equal((row as any)[field],override[field]);assert.ok((acceptancePolicyCatalog as any)[field][(row as any)[field]],`${row.operationId}:${field}`);}}
|
||||
});
|
||||
|
||||
test('real acceptance is an explicit availability decision coherent with fixture disposition',async()=>{const fixture=new Map(fixtureDisposition58e2204.map(x=>[x.operationId,x]));const valid=new Set(['REAL_READ','REAL_READ_DEFERRED','REAL_WRITE_LATER','SIMULATED_HIGH_RISK','CONTRACT_ONLY']);for(const group of availabilityGroups58e2204){assert.ok(valid.has(group.realAcceptance),group.groupId);for(const id of group.ids){const row=operationAcceptance58e2204.find(x=>x.operationId===id)!;assert.equal(row.realAcceptance,group.realAcceptance,id);const status=fixture.get(id)!.runtimeFixtureStatus;if(status==='captured-readonly')assert.equal(group.realAcceptance,'REAL_READ',id);if(status==='denied-readonly-candidate')assert.equal(group.realAcceptance,'REAL_READ_DEFERRED',id);if(group.realAcceptance==='REAL_READ')assert.equal(status,'captured-readonly',id);if(group.realAcceptance==='REAL_READ_DEFERRED')assert.equal(status,'denied-readonly-candidate',id);}}const source=await readFile(acceptanceSourcePath,'utf8');assert.doesNotMatch(source,/function\s+realAcceptance\s*\(/);assert.doesNotMatch(source,/realAcceptanceIntent/);assert.equal(operationAcceptance58e2204.filter(x=>x.realAcceptance==='REAL_READ').length,39);assert.equal(operationAcceptance58e2204.filter(x=>x.realAcceptance==='REAL_READ_DEFERRED').length,11);});
|
||||
|
||||
test('Phase 1 bootstrap gate defers Fleet component/E2E evidence to the Phase 5 implementation gate',async()=>{const ia=await readFile(iaPath,'utf8');const bootstrap=ia.match(/### Phase 0 → Phase 1 workspace\/contract bootstrap gate([\s\S]*?)(?=### Phase 5 implementation gate)/)?.[1];const phase5=ia.match(/### Phase 5 implementation gate([\s\S]*)/)?.[1];assert.ok(bootstrap);assert.ok(phase5);assert.doesNotMatch(bootstrap!,/Fleet[^\n]*组件\/E2E/);assert.match(phase5!,/Fleet[^\n]*组件\/E2E/);assert.match(phase5!,/\[ \][^\n]*Fleet/);assert.match(bootstrap!,/\[x\][^\n]*最终独立规格与质量\/安全复审均已通过/);assert.doesNotMatch(bootstrap!,/PENDING final independent review/);assert.match(ia,/E2E[^\n]*N\/A[^\n]*Phase 5/);});
|
||||
|
||||
test('control-plane flows are independent, structured, and preserve safety invariants',()=>{const ids=['instance-create','instance-update','instance-delete','secret-set','secret-preserve','secret-clear','config-import-preview','config-import-confirm','credential-verify','saved-secret-login','temporary-secret-login','logout','401-recovery','auth-setup','auth-password-change','auth-settings-read','auth-settings-write','job-cancel','job-retry','audit-export','system-settings-update'];assert.deepEqual(controlPlaneAcceptance.map(x=>x.flowId).sort(),ids.sort());for(const flow of controlPlaneAcceptance)for(const field of ['route','risk','riskSubtype','confirmation','preconditions','result','failureRecovery','secretPolicy','evidence'])assert.ok(String((flow as any)[field]).length>1,`${flow.flowId}:${field}`);assert.match(controlPlaneAcceptance.find(x=>x.flowId==='instance-delete')!.result,/new jobId.*two-phase/i);for(const id of ['secret-set','secret-preserve','secret-clear'])assert.match(controlPlaneAcceptance.find(x=>x.flowId===id)!.secretPolicy,/never.*value/i);for(const id of ['saved-secret-login','temporary-secret-login'])assert.match(controlPlaneAcceptance.find(x=>x.flowId===id)!.failureRecovery,/no automatic replay/i);assert.match(controlPlaneAcceptance.find(x=>x.flowId==='job-retry')!.result,/new jobId.*lineage/i);});
|
||||
|
||||
test('product risk prose has no conflicting action summaries',async()=>{const root=fileURLToPath(new URL('../../../docs/product/',import.meta.url));const names=['project-charter.md','personas-and-workflows.md','information-architecture.md','current-system-audit.md'];const docs=(await Promise.all(names.map(n=>readFile(`${root}${n}`,'utf8')))).join('\n');for(const expected of [/notifications config[^\n]*R2[^\n]*Job/i,/automation config[^\n]*R2[^\n]*Job/i,/eSIM[^\n]*download[^\n]*R1[^\n]*direct/i,/WLAN connect[^\n]*R1[^\n]*forget[^\n]*R2/i,/DDNS config[^\n]*R2[^\n]*Job/i,/baseband restart[^\n]*R3[^\n]*status[^\n]*R0/i])assert.match(docs,expected);assert.doesNotMatch(docs,/Notifications[^\n]*config R1/i);assert.doesNotMatch(docs,/Automation[^\n]*config R1/i);});
|
||||
test('R2/R3, dedicated auth, write strategy, and split bulk/fleet policy are gated',()=>{
|
||||
for(const row of operationAcceptance58e2204){const op:any=byId.get(row.operationId);if(['R2','R3'].includes(row.riskLevel)){assert.equal(row.executionMode,op.executionPolicy==='dedicatedFlow'?'dedicated-flow':'preparation-job');assert.match(row.preconditions,/fresh preflight/i);assert.match(row.confirmationUX,/explicit|strong/);assert.match(row.resultDestination,/jobs\/:jobId/);assert.match(row.retryRecovery,/new Job lineage/i);}if(row.riskLevel==='R3')assert.equal(op.capability,'job');if(row.method!=='GET'){assert.notEqual(row.uiStrategy,'read-panel');assert.notEqual(row.realAcceptance,'REAL_READ');assert.equal(row.fleetBatchable,false);}}
|
||||
const auth=operationAcceptance58e2204.filter(x=>['postAuthSetup','postAuthPassword','postAuthSettings','postAuthLogin','postAuthLogout'].includes(x.operationId));assert.equal(auth.length,5);assert.ok(auth.every(x=>x.uiStrategy==='dedicated-auth-flow'&&x.executionMode==='dedicated-flow'));for(const id of ['postAuthLogin','postAuthLogout']){const row=auth.find(x=>x.operationId===id)!;assert.equal(row.sessionSubtype,'session-sensitive');assert.match(row.retryRecovery,/no automatic replay/i);assert.match(row.resultDestination,/metadata-only audit/i);}
|
||||
const sms=operationAcceptance58e2204.find(x=>x.operationId==='postSmsBatchDelete')!;assert.equal(sms.resourceBulk,true);assert.equal(sms.fleetBatchable,false);for(const id of ['postNotificationsQueueRetryAll','postNotificationsQueueClear'])assert.equal(operationAcceptance58e2204.find(x=>x.operationId===id)!.resourceBulk,true,id);for(const id of ['postSmsClear','postCallHistoryClear','postNotificationsLogsClear','postAutomationLogsClear'])assert.equal(operationAcceptance58e2204.find(x=>x.operationId===id)!.resourceBulk,false,id);
|
||||
const health=operationAcceptance58e2204.find(x=>x.operationId==='getHealth')!;assert.equal(health.fleetBatchable,true);assert.equal(health.partialAggregationPolicy,'per-item');
|
||||
});
|
||||
|
||||
test('fixture disposition is authoritative and exactly follows collector plus 78-file manifest',()=>{
|
||||
assert.equal(fixtureDisposition58e2204.length,117);assert.equal(new Set(fixtureDisposition58e2204.map(x=>x.operationId)).size,117);
|
||||
const selected=selectReadonlyOperations(upstream58e2204Operations as any[]);assert.equal(selected.selected.length,39);assert.equal(selected.denied.length,11);assert.equal(Object.keys(DENY_REASONS).length,11);
|
||||
const selectedIds=new Set(selected.selected.map((x:any)=>x.operationId));const denied=new Map(selected.denied.map((x:any)=>[x.operationId,x.denyReason]));
|
||||
const filesById=new Map<string,any[]>();for(const file of manifest.files){const match=/instance-[12]--([^.]+)\.json$/.exec(file.path);assert.ok(match);const list=filesById.get(match[1])??[];list.push(file);filesById.set(match[1],list);}
|
||||
for(const d of fixtureDisposition58e2204){if(selectedIds.has(d.operationId)){assert.equal(d.runtimeFixtureStatus,'captured-readonly');assert.equal(d.fixtureCount,2);assert.equal(filesById.get(d.operationId)?.length,2);assert.deepEqual(d.aliases,['instance-1','instance-2']);assert.ok(d.observedCategories.length);}else if(denied.has(d.operationId)){assert.equal(d.runtimeFixtureStatus,'denied-readonly-candidate');assert.equal(d.reason,denied.get(d.operationId));assert.equal(d.fixtureCount,0);}else {assert.match(d.runtimeFixtureStatus,/^not-eligible-readonly-capture/);assert.equal(d.fixtureCount,0);}}
|
||||
assert.equal(manifest.realFixtureCount,78);
|
||||
});
|
||||
|
||||
test('product risk prose defers to Registry and known conflicts stay corrected',async()=>{const productRoot=fileURLToPath(new URL('../../../docs/product/',import.meta.url));const workflows=await readFile(`${productRoot}personas-and-workflows.md`,'utf8');const charter=await readFile(`${productRoot}project-charter.md`,'utf8');assert.doesNotMatch(workflows,/下载 profile[^\n]*R2 Job/);assert.match(workflows,/WLAN connect 为 R1/);assert.match(workflows,/notifications config 为 R2 Job/);assert.match(workflows,/fleetBatchable=true/);assert.match(charter,/resourceBulk.*fleetBatchable/);for(const id of ['postEsimProfiles','postEsimProfilesIccidEnable','postDeviceNetworkWlanConnect','postNotificationsConfig','postAutomationConfig','postDeviceNetworkDdnsConfig','postBasebandRestart']){assert.ok(operationAcceptance58e2204.find(x=>x.operationId===id),id);}});
|
||||
|
||||
test('generated matrix is synchronized and contains each operation exactly once',async()=>{const doc=await readFile(matrixPath,'utf8');assert.equal(doc,renderOperationAcceptanceMatrix());const ids=[...doc.matchAll(/^\| `([^`]+)` \|/gm)].map(x=>x[1]).filter(id=>byId.has(id));assert.equal(ids.length,117);assert.deepEqual(ids.sort(),[...byId.keys()].sort());});
|
||||
|
||||
test('matrix renders metadata-only safe fixture categories for every operation',()=>{const doc=renderOperationAcceptanceMatrix();const safeCategories=new Set(['success','unsupported','auth-required']);const fixture=new Map(fixtureDisposition58e2204.map(x=>[x.operationId,x]));const rows=[...doc.matchAll(/^\| `([^`]+)` \|.*?\| ([^|]*categories=([^;|]+);[^|]*) \|/gm)].filter(match=>byId.has(match[1]));assert.equal(rows.length,117);for(const [,id,metadata,rendered] of rows){const disposition=fixture.get(id)!;const expected=disposition.observedCategories.length?[...disposition.observedCategories].sort().join(','):'none';assert.equal(rendered.trim(),expected,id);for(const category of disposition.observedCategories)assert.ok(safeCategories.has(category),`${id}:${category}`);assert.doesNotMatch(metadata,/"(?:response|body|sourceInstanceAlias)"\s*:|https?:\/\//i,id);}assert.match(doc,/metadata-only/i);});
|
||||
@@ -0,0 +1,59 @@
|
||||
import test from 'node:test';
|
||||
import assert from 'node:assert/strict';
|
||||
import { execFileSync } from 'node:child_process';
|
||||
import { fileURLToPath } from 'node:url';
|
||||
import { upstream58e2204Operations } from '../src/upstream-58e2204.ts';
|
||||
|
||||
const PHASE_0_2_COMMIT='9dffadbec271227da7ffb192f31dc78c6ee3c2be';
|
||||
const BASELINE_PATH='packages/operation-registry/src/upstream-58e2204.ts';
|
||||
const repoRoot=fileURLToPath(new URL('../../../',import.meta.url));
|
||||
const safetyFields=['operationId','riskLevel','confirmationPolicy','capability','executionPolicy'] as const;
|
||||
type SafetyRow=Record<(typeof safetyFields)[number],string>;
|
||||
|
||||
function git(...args:string[]){return execFileSync('git',args,{cwd:repoRoot,encoding:'utf8',stdio:['ignore','pipe','pipe']}).trim();}
|
||||
|
||||
/** Parse only the JSON array literal assigned to the frozen raw operations constant; never evaluate TypeScript. */
|
||||
export function parseFrozenSafetyBaseline(source:string):SafetyRow[]{
|
||||
const marker='const rawUpstream58e2204Operations = ';
|
||||
const start=source.indexOf('[',source.indexOf(marker)+marker.length);
|
||||
assert.ok(source.includes(marker)&&start>=0,'frozen operation array marker missing');
|
||||
let quoted=false,escaped=false,depth=0,end=-1;
|
||||
for(let i=start;i<source.length;i++){
|
||||
const ch=source[i];
|
||||
if(quoted){if(escaped)escaped=false;else if(ch==='\\')escaped=true;else if(ch==='"')quoted=false;continue;}
|
||||
if(ch==='"'){quoted=true;continue;}if(ch==='[')depth++;else if(ch===']'&&--depth===0){end=i+1;break;}
|
||||
}
|
||||
assert.ok(end>start,'unterminated frozen operation array');
|
||||
const parsed=JSON.parse(source.slice(start,end));
|
||||
assert.ok(Array.isArray(parsed),'frozen operation baseline is not an array');
|
||||
return parsed.map((row:any,index:number)=>Object.fromEntries(safetyFields.map(field=>{assert.equal(typeof row?.[field],'string',`baseline row ${index} missing ${field}`);return [field,row[field]];})) as SafetyRow);
|
||||
}
|
||||
|
||||
export function assertExactSafetyBaseline(actual:readonly SafetyRow[],expected:readonly SafetyRow[]){
|
||||
assert.equal(expected.length,117,'independent baseline must contain exactly 117 operations');
|
||||
assert.equal(new Set(expected.map(x=>x.operationId)).size,117,'independent baseline operationIds must be unique');
|
||||
assert.equal(actual.length,117,'current Registry must contain exactly 117 operations');
|
||||
assert.equal(new Set(actual.map(x=>x.operationId)).size,117,'current Registry operationIds must be unique');
|
||||
const sort=(rows:readonly SafetyRow[])=>[...rows].sort((a,b)=>a.operationId.localeCompare(b.operationId));
|
||||
assert.deepEqual(sort(actual),sort(expected),'current Registry safety fields differ from frozen Phase 0.2 Git object; update requires explicit safety review');
|
||||
}
|
||||
|
||||
const project=(rows:readonly any[]):SafetyRow[]=>rows.map(row=>Object.fromEntries(safetyFields.map(field=>[field,row[field]])) as SafetyRow);
|
||||
|
||||
test('independent Phase 0.2 Git object freezes all 117 Registry safety decisions',()=>{
|
||||
assert.equal(git('rev-parse','9dffadb'),PHASE_0_2_COMMIT);
|
||||
assert.equal(git('cat-file','-t',PHASE_0_2_COMMIT),'commit');
|
||||
const baseline=parseFrozenSafetyBaseline(git('show',`${PHASE_0_2_COMMIT}:${BASELINE_PATH}`));
|
||||
assertExactSafetyBaseline(project(upstream58e2204Operations),baseline);
|
||||
});
|
||||
|
||||
test('independent safety comparison rejects risk, confirmation, capability and execution-policy mutations',()=>{
|
||||
const baseline=parseFrozenSafetyBaseline(git('show',`${PHASE_0_2_COMMIT}:${BASELINE_PATH}`));
|
||||
const mutations:[string,string,string][]=[
|
||||
['postData','riskLevel','R0'],
|
||||
['postSmsSend','confirmationPolicy','none'],
|
||||
['postSmsSend','capability','query'],
|
||||
['postSmsSend','executionPolicy','dedicatedFlow']
|
||||
];
|
||||
for(const [operationId,field,value] of mutations){const current=structuredClone(project(upstream58e2204Operations));(current.find(x=>x.operationId===operationId)! as any)[field]=value;assert.throws(()=>assertExactSafetyBaseline(current,baseline),/safety fields differ/,`${operationId}:${field}`);}
|
||||
});
|
||||
Reference in New Issue
Block a user