# Operation acceptance matrix — upstream 58e2204
> Generated from the structured ledger. Registry is the sole source for risk, confirmation, capability, and dedicated-flow facts; orchestration is bound by acceptance policy. `registeredOperation` is not a synonym for preparation Job.
REAL_READ means captured evidence and is restricted to `captured-readonly`. REAL_READ_DEFERRED marks denied candidates without a real fixture. Fixture disposition is metadata-only: runtime status, count, safe observed status categories, and reason; it never renders fixture body/response, alias, identity, or URL.
## Control-plane acceptance (independent flows)
| flowId | route | risk / subtype | confirmation | preconditions | result | failure recovery | secret policy | evidence |
|---|---|---|---|---|---|---|---|---|
| `instance-create` | `/instances/new` | R1 / configuration | diff-confirm | canonical origin and unique stable ID | created instance revision and audit | retain draft on validation or reconcile failure | secret reference only; never return a value | WF-01 + product policy |
| `instance-update` | `/settings/instances/:id` | R1 / configuration | revision-diff | current revision | updated revision and audit | 409 refreshes diff without losing edits | preserve/set/clear explicit; never return a value | WF-01 + product policy |
| `instance-delete` | `/settings/instances/:id` | R3 / destructive | strong target restatement | fresh revision and no conflicting job | new jobId with two-phase deleting to tombstone result | before boundary restore; after boundary manual recovery | destroy reference without reading secret value | WF-13 |
| `secret-set` | `/settings/instances/:id` | R1 / secret-reference | explicit set | authorized SecretStore write | new reference metadata and audit | atomic rollback on reference write failure | never return or log secret value | WF-01 |
| `secret-preserve` | `/settings/instances/:id` | R1 / secret-reference | explicit preserve | existing reference metadata | unchanged reference metadata and audit | revision conflict refreshes metadata only | never read or return secret value | WF-01 |
| `secret-clear` | `/settings/instances/:id` | R1 / secret-reference | explicit clear | fresh revision | reference removed and audit | atomic rollback or explicit recovery state | never return destroyed secret value | WF-01 |
| `config-import-preview` | `/settings/instances` | R0 / preview | none | validated upload and canonical origins | redacted diff/conflict/count preview | fix file and regenerate preview | never include secret values in preview | IA settings import |
| `config-import-confirm` | `/settings/instances` | R2 / bulk-configuration | explicit preview token | fresh unexpired preview | new jobId with per-instance items | retry failed items in new lineage | references only; never import/export secret values | IA settings import |
| `credential-verify` | `/instances/new` | R1 / session-sensitive | actor initiated | rate limit and registered target | credential metadata-only result | no automatic replay; actor may retry after backoff | ephemeral input, never response/audit value | WF-01 |
| `saved-secret-login` | `/instances/new` | R1 / session-sensitive | actor initiated | saved reference and rate limit | session metadata-only result | no automatic replay; return to login flow | resolve server-side; never expose value | WF-12 |
| `temporary-secret-login` | `/instances/new` | R1 / session-sensitive | actor initiated | one-shot input and rate limit | session metadata-only result | no automatic replay; require new actor input | memory-only and never saved or returned | WF-12 |
| `logout` | `/settings/instances/:id` | R1 / session-sensitive | actor initiated | active session | session cleared and metadata audit | no replay; reconcile auth status | no credential value involved | WF-12 |
| `401-recovery` | `/instances/:id/overview` | R1 / session-recovery | actor chooses login | 401 evidence and retained stale data | return to owner; retry R0 only | never replay writes; preserve draft for new prepare | temporary/saved secret follows selected login policy | WF-12 |
| `auth-setup` | `/instances/new` | R3 / authentication-change | strong confirmation | fresh dedicated auth preflight | new jobId and metadata-only audit | new lineage after state verification | password never returned or audited | Registry postAuthSetup |
| `auth-password-change` | `/settings/instances/:id` | R3 / authentication-change | strong confirmation | fresh dedicated auth preflight | new jobId and metadata-only audit | new lineage after auth-status verification | old/new password never returned or audited | Registry postAuthPassword |
| `auth-settings-read` | `/settings/instances/:id` | R0 / authentication-read | none | registered instance and actor | structured auth settings | safe actor retry | no password/cookie/token fields | Registry getAuthSettings |
| `auth-settings-write` | `/settings/instances/:id` | R2 / authentication-change | explicit confirmation | fresh dedicated auth preflight | new jobId and metadata-only audit | new lineage; no replay | never return credential values | Registry postAuthSettings |
| `job-cancel` | `/jobs/:jobId` | R1 / job-control | explicit confirmation | cancelable current phase | immutable cancellation event | show non-cancelable boundary and reconcile | no secret data in event | IA jobs |
| `job-retry` | `/jobs/:jobId` | R2 / job-control | explicit failed-item selection | source terminal state and fresh preflight | new jobId with retryOf/root/source lineage | never mutate source or replay successful items | redacted parameter summary only | WF-10 |
| `audit-export` | `/audit` | R0 / data-export | explicit scope | authorized filters | redacted export artifact | regenerate from immutable audit | redaction applies; no sensitiveFields | WF-11 |
| `system-settings-update` | `/settings/system` | R1 / configuration | revision-diff | safe bounds and current revision | updated revision and audit | 409 refreshes diff; invalid bounds rejected | no secrets accepted | IA settings system |
## Upstream operation acceptance (exact 117)
| operationId | method/path | domain | route/surface | UI | availability/version evidence | scenario applicability | risk/confirmation/execution | policy IDs and resolved policies | real class | fixture disposition (metadata-only: runtime status / n / categories / reason) | evidence |
|---|---|---|---|---|---|---|---|---|---|---|---|
| `getDevice` | GET `/api/device` | device-system | `/instances/:id/overview`
`overview/device` | detail | planned: Frozen-scope read has two redacted captured responses; runtime support is still decided per registered instance.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Detail resource has no collection-empty rendering.)
partial:N (Atomic detail read has no meaningful partial rendering.)
policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)
unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)
owner-switch:Y (Owner switch discards responses with a mismatched instance key.) | R0; none
direct | query-capability/read-retain/version-probe/safe-read/route-result
Registered instance, authorized actor, and runtime capability decision are required.
Retain last success as stale and permit an explicit safe refresh.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Safe reads may retry within deadline and retain stale success.
Structured result returns to the owning route with a redacted audit link. | REAL_READ | captured-readonly; n=2; categories=success; collector-selected fully-bound GET R0; two redacted real captures | `registry:getDevice`
`upstream:backend/src/main.rs:506-506`
`upstream:backend/src/handlers.rs:1076-1090`
`upstream:bruno-api/get_device_info.bru:8`
`fixture:captured-readonly` |
| `getSim` | GET `/api/sim` | sim | `/instances/:id/overview`
`overview/sim` | detail | planned: Frozen-scope read has two redacted captured responses; runtime support is still decided per registered instance.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Detail resource has no collection-empty rendering.)
partial:N (Atomic detail read has no meaningful partial rendering.)
policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)
unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)
owner-switch:Y (Owner switch discards responses with a mismatched instance key.) | R0; none
direct | query-capability/read-retain/version-probe/safe-read/route-result
Registered instance, authorized actor, and runtime capability decision are required.
Retain last success as stale and permit an explicit safe refresh.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Safe reads may retry within deadline and retain stale success.
Structured result returns to the owning route with a redacted audit link. | REAL_READ | captured-readonly; n=2; categories=success; collector-selected fully-bound GET R0; two redacted real captures | `registry:getSim`
`upstream:backend/src/main.rs:508-508`
`upstream:backend/src/handlers.rs:1126-1145`
`upstream:bruno-api/get_sim_info.bru:8`
`fixture:captured-readonly` |
| `postSimDetailsRefresh` | POST `/api/sim/details/refresh` | sim | `/instances/:id/overview`
`overview/sim` | action | planned: Frozen-scope reversible command is contract-planned for a later controlled real-write acceptance phase.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)
partial:N (Single-target command has no meaningful partial result.)
policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)
unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)
owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R1; none
direct | command-current-state/write-revision/version-probe/verify-write/route-result
Refresh current state when available and bind the actor decision to its revision.
Refresh current state or require an explicit recorded revision-bound override.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Writes require outcome verification before actor-initiated retry.
Structured result returns to the owning route with a redacted audit link. | REAL_WRITE_LATER | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:postSimDetailsRefresh`
`upstream:backend/src/main.rs:510-511`
`upstream:backend/src/handlers.rs:1148-1164`
`fixture:not-eligible-readonly-capture` |
| `postSimCache` | POST `/api/sim/cache` | sim | `/instances/:id/overview`
`overview/sim` | form | planned: Frozen-scope reversible command is contract-planned for a later controlled real-write acceptance phase.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)
partial:N (Single-target command has no meaningful partial result.)
policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)
unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)
owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R1; none
direct | command-current-state/write-revision/version-probe/verify-write/route-result
Refresh current state when available and bind the actor decision to its revision.
Refresh current state or require an explicit recorded revision-bound override.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Writes require outcome verification before actor-initiated retry.
Structured result returns to the owning route with a redacted audit link. | REAL_WRITE_LATER | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:postSimCache`
`upstream:backend/src/main.rs:514-515`
`upstream:backend/src/handlers.rs:1167-1213`
`fixture:not-eligible-readonly-capture` |
| `getNetwork` | GET `/api/network` | cellular | `/instances/:id/cellular`
`cellular/serving-network` | detail | planned: Frozen-scope read has two redacted captured responses; runtime support is still decided per registered instance.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Detail resource has no collection-empty rendering.)
partial:N (Atomic detail read has no meaningful partial rendering.)
policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)
unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)
owner-switch:Y (Owner switch discards responses with a mismatched instance key.) | R0; none
direct | query-capability/read-retain/version-probe/safe-read/route-result
Registered instance, authorized actor, and runtime capability decision are required.
Retain last success as stale and permit an explicit safe refresh.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Safe reads may retry within deadline and retain stale success.
Structured result returns to the owning route with a redacted audit link. | REAL_READ | captured-readonly; n=2; categories=success; collector-selected fully-bound GET R0; two redacted real captures | `registry:getNetwork`
`upstream:backend/src/main.rs:519-520`
`upstream:backend/src/handlers.rs:1218-1232`
`upstream:bruno-api/get_network_info.bru:8`
`fixture:captured-readonly` |
| `getCells` | GET `/api/cells` | cellular | `/instances/:id/cellular`
`cellular/cells` | table | planned: Frozen-scope read has two redacted captured responses; runtime support is still decided per registered instance.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:Y (Successful collection may contain no rows.)
partial:Y (Independent response sections may succeed or fail.)
policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)
unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)
owner-switch:Y (Owner switch discards responses with a mismatched instance key.) | R0; none
direct | query-capability/read-retain/version-probe/safe-read/route-result
Registered instance, authorized actor, and runtime capability decision are required.
Retain last success as stale and permit an explicit safe refresh.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Safe reads may retry within deadline and retain stale success.
Structured result returns to the owning route with a redacted audit link. | REAL_READ | captured-readonly; n=2; categories=success; collector-selected fully-bound GET R0; two redacted real captures | `registry:getCells`
`upstream:backend/src/main.rs:522-522`
`upstream:backend/src/handlers.rs:1235-1249`
`upstream:bruno-api/get_cells_info.bru:8`
`fixture:captured-readonly` |
| `postCellMonitorStart` | POST `/api/cell-monitor/start` | cellular | `/instances/:id/cellular`
`cellular/cells` | action | planned: Frozen-scope reversible command is contract-planned for a later controlled real-write acceptance phase.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)
partial:N (Single-target command has no meaningful partial result.)
policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)
unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)
owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R1; none
direct | command-current-state/write-revision/version-probe/verify-write/route-result
Refresh current state when available and bind the actor decision to its revision.
Refresh current state or require an explicit recorded revision-bound override.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Writes require outcome verification before actor-initiated retry.
Structured result returns to the owning route with a redacted audit link. | REAL_WRITE_LATER | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:postCellMonitorStart`
`upstream:backend/src/main.rs:524-525`
`upstream:backend/src/handlers.rs:1252-1282`
`fixture:not-eligible-readonly-capture` |
| `postCellMonitorStop` | POST `/api/cell-monitor/stop` | cellular | `/instances/:id/cellular`
`cellular/cells` | action | planned: Frozen-scope reversible command is contract-planned for a later controlled real-write acceptance phase.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)
partial:N (Single-target command has no meaningful partial result.)
policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)
unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)
owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R1; none
direct | command-current-state/write-revision/version-probe/verify-write/route-result
Refresh current state when available and bind the actor decision to its revision.
Refresh current state or require an explicit recorded revision-bound override.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Writes require outcome verification before actor-initiated retry.
Structured result returns to the owning route with a redacted audit link. | REAL_WRITE_LATER | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:postCellMonitorStop`
`upstream:backend/src/main.rs:528-529`
`upstream:backend/src/handlers.rs:1285-1312`
`fixture:not-eligible-readonly-capture` |
| `getRadioMode` | GET `/api/radio-mode` | radio-lock | `/instances/:id/cellular`
`cellular/radio-locks` | read-panel | planned: Frozen-scope read has two redacted captured responses; runtime support is still decided per registered instance.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Detail resource has no collection-empty rendering.)
partial:N (Atomic detail read has no meaningful partial rendering.)
policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)
unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)
owner-switch:Y (Owner switch discards responses with a mismatched instance key.) | R0; none
direct | query-capability/read-retain/version-probe/safe-read/route-result
Registered instance, authorized actor, and runtime capability decision are required.
Retain last success as stale and permit an explicit safe refresh.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Safe reads may retry within deadline and retain stale success.
Structured result returns to the owning route with a redacted audit link. | REAL_READ | captured-readonly; n=2; categories=success; collector-selected fully-bound GET R0; two redacted real captures | `registry:getRadioMode`
`upstream:backend/src/main.rs:532-533`
`upstream:backend/src/handlers.rs:1315-1329`
`upstream:bruno-api/get_radio_mode.bru:8`
`fixture:captured-readonly` |
| `postRadioMode` | POST `/api/radio-mode` | radio-lock | `/instances/:id/cellular`
`cellular/radio-locks` | form | planned: Frozen-scope reversible command is contract-planned for a later controlled real-write acceptance phase.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)
partial:N (Single-target command has no meaningful partial result.)
policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)
unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)
owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R1; none
direct | command-current-state/write-revision/version-probe/verify-write/route-result
Refresh current state when available and bind the actor decision to its revision.
Refresh current state or require an explicit recorded revision-bound override.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Writes require outcome verification before actor-initiated retry.
Structured result returns to the owning route with a redacted audit link. | REAL_WRITE_LATER | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:postRadioMode`
`upstream:backend/src/main.rs:532-534`
`upstream:backend/src/handlers.rs:1332-1352`
`upstream:bruno-api/set_radio_mode_nr.bru:8`
`upstream:bruno-api/set_radio_mode_lte.bru:8`
`upstream:bruno-api/set_radio_mode_auto.bru:8`
`fixture:not-eligible-readonly-capture` |
| `getBandLock` | GET `/api/band-lock` | radio-lock | `/instances/:id/cellular`
`cellular/radio-locks` | read-panel | planned: Frozen-scope read has two redacted captured responses; runtime support is still decided per registered instance.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Detail resource has no collection-empty rendering.)
partial:N (Atomic detail read has no meaningful partial rendering.)
policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)
unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)
owner-switch:Y (Owner switch discards responses with a mismatched instance key.) | R0; none
direct | query-capability/read-retain/version-probe/safe-read/route-result
Registered instance, authorized actor, and runtime capability decision are required.
Retain last success as stale and permit an explicit safe refresh.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Safe reads may retry within deadline and retain stale success.
Structured result returns to the owning route with a redacted audit link. | REAL_READ | captured-readonly; n=2; categories=success; collector-selected fully-bound GET R0; two redacted real captures | `registry:getBandLock`
`upstream:backend/src/main.rs:538-539`
`upstream:backend/src/handlers.rs:1355-1369`
`upstream:bruno-api/get_band_lock.bru:8`
`fixture:captured-readonly` |
| `postBandLock` | POST `/api/band-lock` | radio-lock | `/instances/:id/cellular`
`cellular/radio-locks` | job-action | planned: Frozen-scope high-risk operation is planned with simulation-only acceptance until controlled safety authorization exists.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)
partial:N (Single-target command has no meaningful partial result.)
policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)
unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)
owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R2; explicit
preparation-job | job-fresh-preflight/high-risk-block/version-probe/new-job-lineage/job-result
Required fresh preflight; inability to refresh blocks execution.
Fresh preflight is mandatory; stale, expired, or unknown state blocks execution.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Retry creates a new Job lineage (retryOfJobId/rootJobId); never replay successful items.
/jobs/:jobId contains per-item result, attempt lineage, and redacted audit. | SIMULATED_HIGH_RISK | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:postBandLock`
`upstream:backend/src/main.rs:538-540`
`upstream:backend/src/handlers.rs:1372-1392`
`upstream:bruno-api/set_band_lock_nr_n78.bru:8`
`upstream:bruno-api/set_band_lock_lte_b1_b3.bru:8`
`upstream:bruno-api/unlock_all_bands.bru:8`
`upstream:bruno-api/set_band_lock_lte_nr_mix.bru:8`
`fixture:not-eligible-readonly-capture` |
| `getNetworkInterfaces` | GET `/api/network/interfaces` | device-network | `/instances/:id/device-network`
`device-network/interfaces` | table | planned: Frozen-scope read has two redacted captured responses; runtime support is still decided per registered instance.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:Y (Successful collection may contain no rows.)
partial:Y (Independent response sections may succeed or fail.)
policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)
unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)
owner-switch:Y (Owner switch discards responses with a mismatched instance key.) | R0; none
direct | query-capability/read-retain/version-probe/safe-read/route-result
Registered instance, authorized actor, and runtime capability decision are required.
Retain last success as stale and permit an explicit safe refresh.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Safe reads may retry within deadline and retain stale success.
Structured result returns to the owning route with a redacted audit link. | REAL_READ | captured-readonly; n=2; categories=success; collector-selected fully-bound GET R0; two redacted real captures | `registry:getNetworkInterfaces`
`upstream:backend/src/main.rs:544-545`
`upstream:backend/src/handlers.rs:1619-1644`
`upstream:bruno-api/get_network_interfaces.bru:8`
`fixture:captured-readonly` |
| `getNetworkConnectionAddresses` | GET `/api/network/connection-addresses` | device-network | `/instances/:id/device-network`
`device-network/interfaces` | read-panel | planned: Frozen-scope read has two redacted captured responses; runtime support is still decided per registered instance.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Detail resource has no collection-empty rendering.)
partial:N (Atomic detail read has no meaningful partial rendering.)
policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)
unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)
owner-switch:Y (Owner switch discards responses with a mismatched instance key.) | R0; none
direct | query-capability/read-retain/version-probe/safe-read/route-result
Registered instance, authorized actor, and runtime capability decision are required.
Retain last success as stale and permit an explicit safe refresh.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Safe reads may retry within deadline and retain stale success.
Structured result returns to the owning route with a redacted audit link. | REAL_READ | captured-readonly; n=2; categories=success; collector-selected fully-bound GET R0; two redacted real captures | `registry:getNetworkConnectionAddresses`
`upstream:backend/src/main.rs:548-549`
`upstream:backend/src/handlers.rs:1647-1666`
`fixture:captured-readonly` |
| `getDeviceNetworkDdnsConfig` | GET `/api/device-network/ddns/config` | device-network | `/instances/:id/device-network`
`device-network/ddns` | read-panel | planned: Frozen-scope read has two redacted captured responses; runtime support is still decided per registered instance.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Detail resource has no collection-empty rendering.)
partial:N (Atomic detail read has no meaningful partial rendering.)
policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)
unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)
owner-switch:Y (Owner switch discards responses with a mismatched instance key.) | R0; none
direct | query-capability/read-retain/version-probe/safe-read/route-result
Registered instance, authorized actor, and runtime capability decision are required.
Retain last success as stale and permit an explicit safe refresh.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Safe reads may retry within deadline and retain stale success.
Structured result returns to the owning route with a redacted audit link. | REAL_READ | captured-readonly; n=2; categories=success; collector-selected fully-bound GET R0; two redacted real captures | `registry:getDeviceNetworkDdnsConfig`
`upstream:backend/src/main.rs:552-553`
`upstream:backend/src/handlers.rs:1669-1679`
`upstream:bruno-api/get_device_ddns_config.bru:8`
`fixture:captured-readonly` |
| `postDeviceNetworkDdnsConfig` | POST `/api/device-network/ddns/config` | device-network | `/instances/:id/device-network`
`device-network/ddns` | job-action | planned: Frozen-scope high-risk operation is planned with simulation-only acceptance until controlled safety authorization exists.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)
partial:N (Single-target command has no meaningful partial result.)
policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)
unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)
owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R2; explicit
preparation-job | job-fresh-preflight/high-risk-block/version-probe/new-job-lineage/job-result
Required fresh preflight; inability to refresh blocks execution.
Fresh preflight is mandatory; stale, expired, or unknown state blocks execution.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Retry creates a new Job lineage (retryOfJobId/rootJobId); never replay successful items.
/jobs/:jobId contains per-item result, attempt lineage, and redacted audit. | SIMULATED_HIGH_RISK | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:postDeviceNetworkDdnsConfig`
`upstream:backend/src/main.rs:552-554`
`upstream:backend/src/handlers.rs:1682-1721`
`upstream:bruno-api/set_device_ddns_config.bru:8`
`fixture:not-eligible-readonly-capture` |
| `getDeviceNetworkDdnsStatus` | GET `/api/device-network/ddns/status` | device-network | `/instances/:id/device-network`
`device-network/ddns` | read-panel | planned: Frozen-scope read has two redacted captured responses; runtime support is still decided per registered instance.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Detail resource has no collection-empty rendering.)
partial:N (Atomic detail read has no meaningful partial rendering.)
policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)
unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)
owner-switch:Y (Owner switch discards responses with a mismatched instance key.) | R0; none
direct | query-capability/read-retain/version-probe/safe-read/route-result
Registered instance, authorized actor, and runtime capability decision are required.
Retain last success as stale and permit an explicit safe refresh.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Safe reads may retry within deadline and retain stale success.
Structured result returns to the owning route with a redacted audit link. | REAL_READ | captured-readonly; n=2; categories=success; collector-selected fully-bound GET R0; two redacted real captures | `registry:getDeviceNetworkDdnsStatus`
`upstream:backend/src/main.rs:558-559`
`upstream:backend/src/handlers.rs:1750-1757`
`upstream:bruno-api/get_device_ddns_status.bru:8`
`fixture:captured-readonly` |
| `postDeviceNetworkDdnsSync` | POST `/api/device-network/ddns/sync` | device-network | `/instances/:id/device-network`
`device-network/ddns` | action | planned: Frozen-scope reversible command is contract-planned for a later controlled real-write acceptance phase.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)
partial:N (Single-target command has no meaningful partial result.)
policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)
unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)
owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R1; none
direct | command-current-state/write-revision/version-probe/verify-write/route-result
Refresh current state when available and bind the actor decision to its revision.
Refresh current state or require an explicit recorded revision-bound override.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Writes require outcome verification before actor-initiated retry.
Structured result returns to the owning route with a redacted audit link. | REAL_WRITE_LATER | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:postDeviceNetworkDdnsSync`
`upstream:backend/src/main.rs:562-563`
`upstream:backend/src/handlers.rs:1760-1781`
`upstream:bruno-api/post_device_ddns_sync.bru:8`
`fixture:not-eligible-readonly-capture` |
| `getDeviceNetworkDdnsLogs` | GET `/api/device-network/ddns/logs` | device-network | `/instances/:id/device-network`
`device-network/ddns` | read-panel | planned: Frozen-scope read is modeled but real capture was explicitly denied; runtime support is probed per instance.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:Y (Successful collection may contain no rows.)
partial:Y (Independent response sections may succeed or fail.)
policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)
unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)
owner-switch:Y (Owner switch discards responses with a mismatched instance key.) | R0; none
direct | query-capability/read-retain/version-probe/safe-read/route-result
Registered instance, authorized actor, and runtime capability decision are required.
Retain last success as stale and permit an explicit safe refresh.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Safe reads may retry within deadline and retain stale success.
Structured result returns to the owning route with a redacted audit link. | REAL_READ_DEFERRED | denied-readonly-candidate; n=0; categories=none; no safe limit contract | `registry:getDeviceNetworkDdnsLogs`
`upstream:backend/src/main.rs:566-567`
`upstream:backend/src/handlers.rs:1784-1790`
`upstream:bruno-api/get_device_ddns_logs.bru:8`
`fixture:denied-readonly-candidate` |
| `postDeviceNetworkDdnsLogsClear` | POST `/api/device-network/ddns/logs/clear` | device-network | `/instances/:id/device-network`
`device-network/ddns` | job-action | planned: Frozen-scope high-risk operation is planned with simulation-only acceptance until controlled safety authorization exists.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)
partial:N (Single-target command has no meaningful partial result.)
policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)
unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)
owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R2; explicit
preparation-job | job-fresh-preflight/high-risk-block/version-probe/new-job-lineage/job-result
Required fresh preflight; inability to refresh blocks execution.
Fresh preflight is mandatory; stale, expired, or unknown state blocks execution.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Retry creates a new Job lineage (retryOfJobId/rootJobId); never replay successful items.
/jobs/:jobId contains per-item result, attempt lineage, and redacted audit. | SIMULATED_HIGH_RISK | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:postDeviceNetworkDdnsLogsClear`
`upstream:backend/src/main.rs:570-571`
`upstream:backend/src/handlers.rs:1793-1802`
`upstream:bruno-api/post_device_ddns_logs_clear.bru:8`
`fixture:not-eligible-readonly-capture` |
| `getDeviceNetworkWlanStatus` | GET `/api/device-network/wlan/status` | device-network | `/instances/:id/device-network`
`device-network/wlan` | read-panel | planned: Frozen-scope read has two redacted captured responses; runtime support is still decided per registered instance.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Detail resource has no collection-empty rendering.)
partial:N (Atomic detail read has no meaningful partial rendering.)
policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)
unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)
owner-switch:Y (Owner switch discards responses with a mismatched instance key.) | R0; none
direct | query-capability/read-retain/version-probe/safe-read/route-result
Registered instance, authorized actor, and runtime capability decision are required.
Retain last success as stale and permit an explicit safe refresh.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Safe reads may retry within deadline and retain stale success.
Structured result returns to the owning route with a redacted audit link. | REAL_READ | captured-readonly; n=2; categories=success; collector-selected fully-bound GET R0; two redacted real captures | `registry:getDeviceNetworkWlanStatus`
`upstream:backend/src/main.rs:574-575`
`upstream:backend/src/handlers.rs:1805-1819`
`upstream:bruno-api/get_device_wlan_status.bru:8`
`fixture:captured-readonly` |
| `postDeviceNetworkWlanEnabled` | POST `/api/device-network/wlan/enabled` | device-network | `/instances/:id/device-network`
`device-network/wlan` | form | planned: Frozen-scope reversible command is contract-planned for a later controlled real-write acceptance phase.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)
partial:N (Single-target command has no meaningful partial result.)
policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)
unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)
owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R1; none
direct | command-current-state/write-revision/version-probe/verify-write/route-result
Refresh current state when available and bind the actor decision to its revision.
Refresh current state or require an explicit recorded revision-bound override.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Writes require outcome verification before actor-initiated retry.
Structured result returns to the owning route with a redacted audit link. | REAL_WRITE_LATER | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:postDeviceNetworkWlanEnabled`
`upstream:backend/src/main.rs:578-579`
`upstream:backend/src/handlers.rs:1822-1841`
`upstream:bruno-api/set_device_wlan_enabled.bru:8`
`fixture:not-eligible-readonly-capture` |
| `postDeviceNetworkWlanScan` | POST `/api/device-network/wlan/scan` | device-network | `/instances/:id/device-network`
`device-network/wlan` | action | planned: Frozen-scope reversible command is contract-planned for a later controlled real-write acceptance phase.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)
partial:N (Single-target command has no meaningful partial result.)
policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)
unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)
owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R1; none
direct | command-current-state/write-revision/version-probe/verify-write/route-result
Refresh current state when available and bind the actor decision to its revision.
Refresh current state or require an explicit recorded revision-bound override.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Writes require outcome verification before actor-initiated retry.
Structured result returns to the owning route with a redacted audit link. | REAL_WRITE_LATER | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:postDeviceNetworkWlanScan`
`upstream:backend/src/main.rs:582-583`
`upstream:backend/src/handlers.rs:1844-1858`
`upstream:bruno-api/post_device_wlan_scan.bru:8`
`fixture:not-eligible-readonly-capture` |
| `getDeviceNetworkWlanProfiles` | GET `/api/device-network/wlan/profiles` | device-network | `/instances/:id/device-network`
`device-network/wlan` | table | planned: Frozen-scope read has two redacted captured responses; runtime support is still decided per registered instance.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:Y (Successful collection may contain no rows.)
partial:Y (Independent response sections may succeed or fail.)
policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)
unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)
owner-switch:Y (Owner switch discards responses with a mismatched instance key.) | R0; none
direct | query-capability/read-retain/version-probe/safe-read/route-result
Registered instance, authorized actor, and runtime capability decision are required.
Retain last success as stale and permit an explicit safe refresh.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Safe reads may retry within deadline and retain stale success.
Structured result returns to the owning route with a redacted audit link. | REAL_READ | captured-readonly; n=2; categories=success; collector-selected fully-bound GET R0; two redacted real captures | `registry:getDeviceNetworkWlanProfiles`
`upstream:backend/src/main.rs:586-587`
`upstream:backend/src/handlers.rs:1861-1875`
`upstream:bruno-api/get_device_wlan_profiles.bru:8`
`fixture:captured-readonly` |
| `postDeviceNetworkWlanForget` | POST `/api/device-network/wlan/forget` | device-network | `/instances/:id/device-network`
`device-network/wlan` | job-action | planned: Frozen-scope high-risk operation is planned with simulation-only acceptance until controlled safety authorization exists.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)
partial:N (Single-target command has no meaningful partial result.)
policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)
unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)
owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R2; explicit
preparation-job | job-fresh-preflight/high-risk-block/version-probe/new-job-lineage/job-result
Required fresh preflight; inability to refresh blocks execution.
Fresh preflight is mandatory; stale, expired, or unknown state blocks execution.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Retry creates a new Job lineage (retryOfJobId/rootJobId); never replay successful items.
/jobs/:jobId contains per-item result, attempt lineage, and redacted audit. | SIMULATED_HIGH_RISK | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:postDeviceNetworkWlanForget`
`upstream:backend/src/main.rs:590-591`
`upstream:backend/src/handlers.rs:1878-1897`
`upstream:bruno-api/post_device_wlan_forget.bru:8`
`fixture:not-eligible-readonly-capture` |
| `postDeviceNetworkWlanConnect` | POST `/api/device-network/wlan/connect` | device-network | `/instances/:id/device-network`
`device-network/wlan` | form | planned: Frozen-scope reversible command is contract-planned for a later controlled real-write acceptance phase.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)
partial:N (Single-target command has no meaningful partial result.)
policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)
unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)
owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R1; none
direct | command-current-state/write-revision/version-probe/verify-write/route-result
Refresh current state when available and bind the actor decision to its revision.
Refresh current state or require an explicit recorded revision-bound override.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Writes require outcome verification before actor-initiated retry.
Structured result returns to the owning route with a redacted audit link. | REAL_WRITE_LATER | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:postDeviceNetworkWlanConnect`
`upstream:backend/src/main.rs:594-595`
`upstream:backend/src/handlers.rs:1900-1955`
`upstream:bruno-api/post_device_wlan_connect.bru:8`
`fixture:not-eligible-readonly-capture` |
| `postDeviceNetworkWlanDisconnect` | POST `/api/device-network/wlan/disconnect` | device-network | `/instances/:id/device-network`
`device-network/wlan` | action | planned: Frozen-scope reversible command is contract-planned for a later controlled real-write acceptance phase.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)
partial:N (Single-target command has no meaningful partial result.)
policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)
unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)
owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R1; none
direct | command-current-state/write-revision/version-probe/verify-write/route-result
Refresh current state when available and bind the actor decision to its revision.
Refresh current state or require an explicit recorded revision-bound override.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Writes require outcome verification before actor-initiated retry.
Structured result returns to the owning route with a redacted audit link. | REAL_WRITE_LATER | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:postDeviceNetworkWlanDisconnect`
`upstream:backend/src/main.rs:598-599`
`upstream:backend/src/handlers.rs:1958-1991`
`upstream:bruno-api/post_device_wlan_disconnect.bru:8`
`fixture:not-eligible-readonly-capture` |
| `postDeviceNetworkWlanProfile` | POST `/api/device-network/wlan/profile` | device-network | `/instances/:id/device-network`
`device-network/wlan` | form | planned: Frozen-scope reversible command is contract-planned for a later controlled real-write acceptance phase.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)
partial:N (Single-target command has no meaningful partial result.)
policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)
unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)
owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R1; none
direct | command-current-state/write-revision/version-probe/verify-write/route-result
Refresh current state when available and bind the actor decision to its revision.
Refresh current state or require an explicit recorded revision-bound override.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Writes require outcome verification before actor-initiated retry.
Structured result returns to the owning route with a redacted audit link. | REAL_WRITE_LATER | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:postDeviceNetworkWlanProfile`
`upstream:backend/src/main.rs:602-603`
`upstream:backend/src/handlers.rs:1994-2013`
`upstream:bruno-api/post_device_wlan_profile.bru:8`
`fixture:not-eligible-readonly-capture` |
| `getNetworkSignalStrength` | GET `/api/network/signal-strength` | cellular | `/instances/:id/cellular`
`cellular/signal` | read-panel | planned: Frozen-scope read has two redacted captured responses; runtime support is still decided per registered instance.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Detail resource has no collection-empty rendering.)
partial:N (Atomic detail read has no meaningful partial rendering.)
policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)
unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)
owner-switch:Y (Owner switch discards responses with a mismatched instance key.) | R0; none
direct | query-capability/read-retain/version-probe/safe-read/route-result
Registered instance, authorized actor, and runtime capability decision are required.
Retain last success as stale and permit an explicit safe refresh.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Safe reads may retry within deadline and retain stale success.
Structured result returns to the owning route with a redacted audit link. | REAL_READ | captured-readonly; n=2; categories=success; collector-selected fully-bound GET R0; two redacted real captures | `registry:getNetworkSignalStrength`
`upstream:backend/src/main.rs:606-607`
`upstream:backend/src/handlers.rs:2016-2030`
`upstream:bruno-api/get_signal_strength.bru:8`
`fixture:captured-readonly` |
| `getLocationCellInfo` | GET `/api/location/cell-info` | cellular | `/instances/:id/cellular`
`cellular/cells` | read-panel | planned: Frozen-scope read has two redacted captured responses; runtime support is still decided per registered instance.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Detail resource has no collection-empty rendering.)
partial:N (Atomic detail read has no meaningful partial rendering.)
policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)
unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)
owner-switch:Y (Owner switch discards responses with a mismatched instance key.) | R0; none
direct | query-capability/read-retain/version-probe/safe-read/route-result
Registered instance, authorized actor, and runtime capability decision are required.
Retain last success as stale and permit an explicit safe refresh.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Safe reads may retry within deadline and retain stale success.
Structured result returns to the owning route with a redacted audit link. | REAL_READ | captured-readonly; n=2; categories=success; collector-selected fully-bound GET R0; two redacted real captures | `registry:getLocationCellInfo`
`upstream:backend/src/main.rs:610-611`
`upstream:backend/src/handlers.rs:1395-1409`
`upstream:bruno-api/get_cell_location_info.bru:8`
`fixture:captured-readonly` |
| `getNetworkOperators` | GET `/api/network/operators` | cellular | `/instances/:id/cellular`
`cellular/operator-registration` | table | planned: Frozen-scope read has two redacted captured responses; runtime support is still decided per registered instance.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:Y (Successful collection may contain no rows.)
partial:Y (Independent response sections may succeed or fail.)
policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)
unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)
owner-switch:Y (Owner switch discards responses with a mismatched instance key.) | R0; none
direct | query-capability/read-retain/version-probe/safe-read/route-result
Registered instance, authorized actor, and runtime capability decision are required.
Retain last success as stale and permit an explicit safe refresh.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Safe reads may retry within deadline and retain stale success.
Structured result returns to the owning route with a redacted audit link. | REAL_READ | captured-readonly; n=2; categories=success; collector-selected fully-bound GET R0; two redacted real captures | `registry:getNetworkOperators`
`upstream:backend/src/main.rs:614-615`
`upstream:backend/src/handlers.rs:1412-1426`
`upstream:bruno-api/get_operators.bru:8`
`fixture:captured-readonly` |
| `getNetworkOperatorsScan` | GET `/api/network/operators/scan` | cellular | `/instances/:id/cellular`
`cellular/operator-registration` | read-panel | planned: Frozen-scope read is modeled but real capture was explicitly denied; runtime support is probed per instance.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:Y (A successful active operator scan may return no operators.)
partial:Y (The scan response may contain usable operators alongside per-result failures or incomplete entries.)
policy-forbidden:Y (Active scan may be blocked by capability, authorization, preflight, or active-scan policy.)
unknown-result:N (A timed-out scan result may be discarded; it is not an unknown persistent write outcome.)
owner-switch:Y (Owner switch discards scan responses with a mismatched instance key.) | R0; none
direct | command-current-state/write-revision/version-probe/verify-write/route-result
Refresh current state when available and bind the actor decision to its revision.
Refresh current state or require an explicit recorded revision-bound override.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Writes require outcome verification before actor-initiated retry.
Structured result returns to the owning route with a redacted audit link. | REAL_READ_DEFERRED | denied-readonly-candidate; n=0; categories=none; active radio/network scan | `registry:getNetworkOperatorsScan`
`upstream:backend/src/main.rs:618-619`
`upstream:backend/src/handlers.rs:1429-1443`
`upstream:bruno-api/scan_operators.bru:8`
`fixture:denied-readonly-candidate` |
| `postNetworkRegisterManual` | POST `/api/network/register-manual` | cellular | `/instances/:id/cellular`
`cellular/operator-registration` | job-action | planned: Frozen-scope high-risk operation is planned with simulation-only acceptance until controlled safety authorization exists.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)
partial:N (Single-target command has no meaningful partial result.)
policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)
unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)
owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R2; explicit
preparation-job | job-fresh-preflight/high-risk-block/version-probe/new-job-lineage/job-result
Required fresh preflight; inability to refresh blocks execution.
Fresh preflight is mandatory; stale, expired, or unknown state blocks execution.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Retry creates a new Job lineage (retryOfJobId/rootJobId); never replay successful items.
/jobs/:jobId contains per-item result, attempt lineage, and redacted audit. | SIMULATED_HIGH_RISK | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:postNetworkRegisterManual`
`upstream:backend/src/main.rs:622-623`
`upstream:backend/src/handlers.rs:1446-1466`
`upstream:bruno-api/register_operator_manual.bru:8`
`fixture:not-eligible-readonly-capture` |
| `postNetworkRegisterAuto` | POST `/api/network/register-auto` | cellular | `/instances/:id/cellular`
`cellular/operator-registration` | job-action | planned: Frozen-scope high-risk operation is planned with simulation-only acceptance until controlled safety authorization exists.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)
partial:N (Single-target command has no meaningful partial result.)
policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)
unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)
owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R2; explicit
preparation-job | job-fresh-preflight/high-risk-block/version-probe/new-job-lineage/job-result
Required fresh preflight; inability to refresh blocks execution.
Fresh preflight is mandatory; stale, expired, or unknown state blocks execution.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Retry creates a new Job lineage (retryOfJobId/rootJobId); never replay successful items.
/jobs/:jobId contains per-item result, attempt lineage, and redacted audit. | SIMULATED_HIGH_RISK | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:postNetworkRegisterAuto`
`upstream:backend/src/main.rs:626-627`
`upstream:backend/src/handlers.rs:1469-1486`
`upstream:bruno-api/register_operator_auto.bru:8`
`fixture:not-eligible-readonly-capture` |
| `getApn` | GET `/api/apn` | data-connection | `/instances/:id/cellular`
`cellular/data-apn` | read-panel | planned: Frozen-scope read has two redacted captured responses; runtime support is still decided per registered instance.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Detail resource has no collection-empty rendering.)
partial:N (Atomic detail read has no meaningful partial rendering.)
policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)
unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)
owner-switch:Y (Owner switch discards responses with a mismatched instance key.) | R0; none
direct | query-capability/read-retain/version-probe/safe-read/route-result
Registered instance, authorized actor, and runtime capability decision are required.
Retain last success as stale and permit an explicit safe refresh.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Safe reads may retry within deadline and retain stale success.
Structured result returns to the owning route with a redacted audit link. | REAL_READ | captured-readonly; n=2; categories=success; collector-selected fully-bound GET R0; two redacted real captures | `registry:getApn`
`upstream:backend/src/main.rs:630-631`
`upstream:backend/src/handlers.rs:1489-1504`
`upstream:bruno-api/get_apn_list.bru:8`
`fixture:captured-readonly` |
| `postApn` | POST `/api/apn` | data-connection | `/instances/:id/cellular`
`cellular/data-apn` | form | planned: Frozen-scope reversible command is contract-planned for a later controlled real-write acceptance phase.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)
partial:N (Single-target command has no meaningful partial result.)
policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)
unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)
owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R1; none
direct | command-current-state/write-revision/version-probe/verify-write/route-result
Refresh current state when available and bind the actor decision to its revision.
Refresh current state or require an explicit recorded revision-bound override.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Writes require outcome verification before actor-initiated retry.
Structured result returns to the owning route with a redacted audit link. | REAL_WRITE_LATER | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:postApn`
`upstream:backend/src/main.rs:630-632`
`upstream:backend/src/handlers.rs:1507-1571`
`upstream:bruno-api/set_apn.bru:8`
`fixture:not-eligible-readonly-capture` |
| `getCellLock` | GET `/api/cell-lock` | radio-lock | `/instances/:id/cellular`
`cellular/radio-locks` | read-panel | planned: Frozen-scope read has two redacted captured responses; runtime support is still decided per registered instance.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Detail resource has no collection-empty rendering.)
partial:N (Atomic detail read has no meaningful partial rendering.)
policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)
unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)
owner-switch:Y (Owner switch discards responses with a mismatched instance key.) | R0; none
direct | query-capability/read-retain/version-probe/safe-read/route-result
Registered instance, authorized actor, and runtime capability decision are required.
Retain last success as stale and permit an explicit safe refresh.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Safe reads may retry within deadline and retain stale success.
Structured result returns to the owning route with a redacted audit link. | REAL_READ | captured-readonly; n=2; categories=success; collector-selected fully-bound GET R0; two redacted real captures | `registry:getCellLock`
`upstream:backend/src/main.rs:636-637`
`upstream:backend/src/handlers.rs:1574-1582`
`upstream:bruno-api/get_cell_lock.bru:8`
`fixture:captured-readonly` |
| `postCellLock` | POST `/api/cell-lock` | radio-lock | `/instances/:id/cellular`
`cellular/radio-locks` | job-action | planned: Frozen-scope high-risk operation is planned with simulation-only acceptance until controlled safety authorization exists.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)
partial:N (Single-target command has no meaningful partial result.)
policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)
unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)
owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R2; explicit
preparation-job | job-fresh-preflight/high-risk-block/version-probe/new-job-lineage/job-result
Required fresh preflight; inability to refresh blocks execution.
Fresh preflight is mandatory; stale, expired, or unknown state blocks execution.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Retry creates a new Job lineage (retryOfJobId/rootJobId); never replay successful items.
/jobs/:jobId contains per-item result, attempt lineage, and redacted audit. | SIMULATED_HIGH_RISK | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:postCellLock`
`upstream:backend/src/main.rs:636-638`
`upstream:backend/src/handlers.rs:1585-1603`
`upstream:bruno-api/set_cell_lock_lte.bru:8`
`upstream:bruno-api/set_cell_lock_nr.bru:8`
`upstream:bruno-api/unlock_cell_nr.bru:8`
`fixture:not-eligible-readonly-capture` |
| `postCellLockUnlockAll` | POST `/api/cell-lock/unlock-all` | radio-lock | `/instances/:id/cellular`
`cellular/radio-locks` | job-action | planned: Frozen-scope high-risk operation is planned with simulation-only acceptance until controlled safety authorization exists.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)
partial:N (Single-target command has no meaningful partial result.)
policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)
unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)
owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R2; explicit
preparation-job | job-fresh-preflight/high-risk-block/version-probe/new-job-lineage/job-result
Required fresh preflight; inability to refresh blocks execution.
Fresh preflight is mandatory; stale, expired, or unknown state blocks execution.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Retry creates a new Job lineage (retryOfJobId/rootJobId); never replay successful items.
/jobs/:jobId contains per-item result, attempt lineage, and redacted audit. | SIMULATED_HIGH_RISK | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:postCellLockUnlockAll`
`upstream:backend/src/main.rs:642-643`
`upstream:backend/src/handlers.rs:1606-1616`
`upstream:bruno-api/unlock_all_cells.bru:8`
`fixture:not-eligible-readonly-capture` |
| `getData` | GET `/api/data` | data-connection | `/instances/:id/cellular`
`cellular/data-apn` | read-panel | planned: Frozen-scope read has two redacted captured responses; runtime support is still decided per registered instance.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Detail resource has no collection-empty rendering.)
partial:N (Atomic detail read has no meaningful partial rendering.)
policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)
unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)
owner-switch:Y (Owner switch discards responses with a mismatched instance key.) | R0; none
direct | query-capability/read-retain/version-probe/safe-read/route-result
Registered instance, authorized actor, and runtime capability decision are required.
Retain last success as stale and permit an explicit safe refresh.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Safe reads may retry within deadline and retain stale success.
Structured result returns to the owning route with a redacted audit link. | REAL_READ | captured-readonly; n=2; categories=success; collector-selected fully-bound GET R0; two redacted real captures | `registry:getData`
`upstream:backend/src/main.rs:647-648`
`upstream:backend/src/handlers.rs:2035-2062`
`upstream:bruno-api/get_data_status.bru:8`
`fixture:captured-readonly` |
| `postData` | POST `/api/data` | data-connection | `/instances/:id/cellular`
`cellular/data-apn` | form | planned: Frozen-scope reversible command is contract-planned for a later controlled real-write acceptance phase.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)
partial:N (Single-target command has no meaningful partial result.)
policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)
unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)
owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R1; none
direct | command-current-state/write-revision/version-probe/verify-write/route-result
Refresh current state when available and bind the actor decision to its revision.
Refresh current state or require an explicit recorded revision-bound override.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Writes require outcome verification before actor-initiated retry.
Structured result returns to the owning route with a redacted audit link. | REAL_WRITE_LATER | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:postData`
`upstream:backend/src/main.rs:647-649`
`upstream:backend/src/handlers.rs:2065-2131`
`upstream:bruno-api/set_data_status_disable.bru:8`
`upstream:bruno-api/set_data_status_enable.bru:8`
`fixture:not-eligible-readonly-capture` |
| `getRoaming` | GET `/api/roaming` | data-connection | `/instances/:id/cellular`
`cellular/data-apn` | read-panel | planned: Frozen-scope read has two redacted captured responses; runtime support is still decided per registered instance.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Detail resource has no collection-empty rendering.)
partial:N (Atomic detail read has no meaningful partial rendering.)
policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)
unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)
owner-switch:Y (Owner switch discards responses with a mismatched instance key.) | R0; none
direct | query-capability/read-retain/version-probe/safe-read/route-result
Registered instance, authorized actor, and runtime capability decision are required.
Retain last success as stale and permit an explicit safe refresh.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Safe reads may retry within deadline and retain stale success.
Structured result returns to the owning route with a redacted audit link. | REAL_READ | captured-readonly; n=2; categories=success; collector-selected fully-bound GET R0; two redacted real captures | `registry:getRoaming`
`upstream:backend/src/main.rs:653-654`
`upstream:backend/src/handlers.rs:2172-2193`
`upstream:bruno-api/get_roaming_status.bru:8`
`fixture:captured-readonly` |
| `postRoaming` | POST `/api/roaming` | data-connection | `/instances/:id/cellular`
`cellular/data-apn` | form | planned: Frozen-scope reversible command is contract-planned for a later controlled real-write acceptance phase.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)
partial:N (Single-target command has no meaningful partial result.)
policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)
unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)
owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R1; none
direct | command-current-state/write-revision/version-probe/verify-write/route-result
Refresh current state when available and bind the actor decision to its revision.
Refresh current state or require an explicit recorded revision-bound override.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Writes require outcome verification before actor-initiated retry.
Structured result returns to the owning route with a redacted audit link. | REAL_WRITE_LATER | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:postRoaming`
`upstream:backend/src/main.rs:653-655`
`upstream:backend/src/handlers.rs:2196-2247`
`upstream:bruno-api/set_roaming_enable.bru:8`
`upstream:bruno-api/set_roaming_disable.bru:8`
`fixture:not-eligible-readonly-capture` |
| `getAirplaneMode` | GET `/api/airplane-mode` | data-connection | `/instances/:id/cellular`
`cellular/data-apn` | read-panel | planned: Frozen-scope read has two redacted captured responses; runtime support is still decided per registered instance.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Detail resource has no collection-empty rendering.)
partial:N (Atomic detail read has no meaningful partial rendering.)
policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)
unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)
owner-switch:Y (Owner switch discards responses with a mismatched instance key.) | R0; none
direct | query-capability/read-retain/version-probe/safe-read/route-result
Registered instance, authorized actor, and runtime capability decision are required.
Retain last success as stale and permit an explicit safe refresh.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Safe reads may retry within deadline and retain stale success.
Structured result returns to the owning route with a redacted audit link. | REAL_READ | captured-readonly; n=2; categories=success; collector-selected fully-bound GET R0; two redacted real captures | `registry:getAirplaneMode`
`upstream:backend/src/main.rs:659-660`
`upstream:backend/src/handlers.rs:2315-2329`
`upstream:bruno-api/get_airplane_mode.bru:8`
`fixture:captured-readonly` |
| `postAirplaneMode` | POST `/api/airplane-mode` | data-connection | `/instances/:id/cellular`
`cellular/data-apn` | form | planned: Frozen-scope reversible command is contract-planned for a later controlled real-write acceptance phase.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)
partial:N (Single-target command has no meaningful partial result.)
policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)
unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)
owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R1; none
direct | command-current-state/write-revision/version-probe/verify-write/route-result
Refresh current state when available and bind the actor decision to its revision.
Refresh current state or require an explicit recorded revision-bound override.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Writes require outcome verification before actor-initiated retry.
Structured result returns to the owning route with a redacted audit link. | REAL_WRITE_LATER | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:postAirplaneMode`
`upstream:backend/src/main.rs:659-661`
`upstream:backend/src/handlers.rs:2250-2312`
`upstream:bruno-api/set_airplane_mode_disable.bru:8`
`upstream:bruno-api/set_airplane_mode_enable.bru:8`
`fixture:not-eligible-readonly-capture` |
| `postBasebandRestart` | POST `/api/baseband/restart` | data-connection | `/instances/:id/cellular`
`cellular/data-apn` | job-action | planned: Frozen-scope high-risk operation is planned with simulation-only acceptance until controlled safety authorization exists.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)
partial:N (Single-target command has no meaningful partial result.)
policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)
unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)
owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R3; strong
preparation-job | job-fresh-preflight/high-risk-block/version-probe/new-job-lineage/job-result
Required fresh preflight; inability to refresh blocks execution.
Fresh preflight is mandatory; stale, expired, or unknown state blocks execution.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Retry creates a new Job lineage (retryOfJobId/rootJobId); never replay successful items.
/jobs/:jobId contains per-item result, attempt lineage, and redacted audit. | SIMULATED_HIGH_RISK | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:postBasebandRestart`
`upstream:backend/src/main.rs:665-666`
`upstream:backend/src/handlers.rs:2133-2159`
`fixture:not-eligible-readonly-capture` |
| `getBasebandRestartStatus` | GET `/api/baseband/restart/status` | data-connection | `/instances/:id/cellular`
`cellular/data-apn` | read-panel | planned: Frozen-scope read has two redacted captured responses; runtime support is still decided per registered instance.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Detail resource has no collection-empty rendering.)
partial:N (Atomic detail read has no meaningful partial rendering.)
policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)
unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)
owner-switch:Y (Owner switch discards responses with a mismatched instance key.) | R0; none
direct | query-capability/read-retain/version-probe/safe-read/route-result
Registered instance, authorized actor, and runtime capability decision are required.
Retain last success as stale and permit an explicit safe refresh.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Safe reads may retry within deadline and retain stale success.
Structured result returns to the owning route with a redacted audit link. | REAL_READ | captured-readonly; n=2; categories=success; collector-selected fully-bound GET R0; two redacted real captures | `registry:getBasebandRestartStatus`
`upstream:backend/src/main.rs:669-670`
`upstream:backend/src/handlers.rs:2161-2169`
`fixture:captured-readonly` |
| `getWorkMode` | GET `/api/work-mode` | workmode-esim | `/instances/:id/esim`
`esim/mode` | read-panel | planned: Frozen-scope read has two redacted captured responses; runtime support is still decided per registered instance.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Detail resource has no collection-empty rendering.)
partial:N (Atomic detail read has no meaningful partial rendering.)
policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)
unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)
owner-switch:Y (Owner switch discards responses with a mismatched instance key.) | R0; none
direct | query-capability/read-retain/version-probe/safe-read/route-result
Registered instance, authorized actor, and runtime capability decision are required.
Retain last success as stale and permit an explicit safe refresh.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Safe reads may retry within deadline and retain stale success.
Structured result returns to the owning route with a redacted audit link. | REAL_READ | captured-readonly; n=2; categories=success; collector-selected fully-bound GET R0; two redacted real captures | `registry:getWorkMode`
`upstream:backend/src/main.rs:674-675`
`upstream:backend/src/handlers.rs:352-365`
`fixture:captured-readonly` |
| `postWorkMode` | POST `/api/work-mode` | workmode-esim | `/instances/:id/esim`
`esim/mode` | job-action | planned: Frozen-scope high-risk operation is planned with simulation-only acceptance until controlled safety authorization exists.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)
partial:N (Single-target command has no meaningful partial result.)
policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)
unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)
owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R2; explicit
preparation-job | job-fresh-preflight/high-risk-block/version-probe/new-job-lineage/job-result
Required fresh preflight; inability to refresh blocks execution.
Fresh preflight is mandatory; stale, expired, or unknown state blocks execution.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Retry creates a new Job lineage (retryOfJobId/rootJobId); never replay successful items.
/jobs/:jobId contains per-item result, attempt lineage, and redacted audit. | SIMULATED_HIGH_RISK | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:postWorkMode`
`upstream:backend/src/main.rs:674-676`
`upstream:backend/src/handlers.rs:368-405`
`fixture:not-eligible-readonly-capture` |
| `getEsimConfig` | GET `/api/esim/config` | workmode-esim | `/instances/:id/esim`
`esim/config` | read-panel | planned: Frozen-scope read has two redacted captured responses; runtime support is still decided per registered instance.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Detail resource has no collection-empty rendering.)
partial:N (Atomic detail read has no meaningful partial rendering.)
policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)
unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)
owner-switch:Y (Owner switch discards responses with a mismatched instance key.) | R0; none
direct | query-capability/read-retain/version-probe/safe-read/route-result
Registered instance, authorized actor, and runtime capability decision are required.
Retain last success as stale and permit an explicit safe refresh.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Safe reads may retry within deadline and retain stale success.
Structured result returns to the owning route with a redacted audit link. | REAL_READ | captured-readonly; n=2; categories=unsupported; collector-selected fully-bound GET R0; two redacted real captures | `registry:getEsimConfig`
`upstream:backend/src/main.rs:680-681`
`upstream:backend/src/handlers.rs:456-462`
`fixture:captured-readonly` |
| `postEsimConfig` | POST `/api/esim/config` | workmode-esim | `/instances/:id/esim`
`esim/config` | job-action | planned: Frozen-scope high-risk operation is planned with simulation-only acceptance until controlled safety authorization exists.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)
partial:N (Single-target command has no meaningful partial result.)
policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)
unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)
owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R2; explicit
preparation-job | job-fresh-preflight/high-risk-block/version-probe/new-job-lineage/job-result
Required fresh preflight; inability to refresh blocks execution.
Fresh preflight is mandatory; stale, expired, or unknown state blocks execution.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Retry creates a new Job lineage (retryOfJobId/rootJobId); never replay successful items.
/jobs/:jobId contains per-item result, attempt lineage, and redacted audit. | SIMULATED_HIGH_RISK | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:postEsimConfig`
`upstream:backend/src/main.rs:680-682`
`upstream:backend/src/handlers.rs:465-482`
`fixture:not-eligible-readonly-capture` |
| `getEsimLpacStatus` | GET `/api/esim/lpac/status` | workmode-esim | `/instances/:id/esim`
`esim/lpac` | read-panel | planned: Frozen-scope read has two redacted captured responses; runtime support is still decided per registered instance.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Detail resource has no collection-empty rendering.)
partial:N (Atomic detail read has no meaningful partial rendering.)
policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)
unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)
owner-switch:Y (Owner switch discards responses with a mismatched instance key.) | R0; none
direct | query-capability/read-retain/version-probe/safe-read/route-result
Registered instance, authorized actor, and runtime capability decision are required.
Retain last success as stale and permit an explicit safe refresh.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Safe reads may retry within deadline and retain stale success.
Structured result returns to the owning route with a redacted audit link. | REAL_READ | captured-readonly; n=2; categories=auth-required; collector-selected fully-bound GET R0; two redacted real captures | `registry:getEsimLpacStatus`
`upstream:backend/src/main.rs:686-687`
`upstream:backend/src/handlers.rs:408-416`
`fixture:captured-readonly` |
| `postEsimLpacRepair` | POST `/api/esim/lpac/repair` | workmode-esim | `/instances/:id/esim`
`esim/lpac` | job-action | planned: Frozen-scope high-risk operation is planned with simulation-only acceptance until controlled safety authorization exists.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)
partial:N (Single-target command has no meaningful partial result.)
policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)
unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)
owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R2; explicit
preparation-job | job-fresh-preflight/high-risk-block/version-probe/new-job-lineage/job-result
Required fresh preflight; inability to refresh blocks execution.
Fresh preflight is mandatory; stale, expired, or unknown state blocks execution.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Retry creates a new Job lineage (retryOfJobId/rootJobId); never replay successful items.
/jobs/:jobId contains per-item result, attempt lineage, and redacted audit. | SIMULATED_HIGH_RISK | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:postEsimLpacRepair`
`upstream:backend/src/main.rs:690-691`
`upstream:backend/src/handlers.rs:419-453`
`fixture:not-eligible-readonly-capture` |
| `getEsimEuicc` | GET `/api/esim/euicc` | workmode-esim | `/instances/:id/esim`
`esim/euicc` | read-panel | planned: Frozen-scope read is modeled but real capture was explicitly denied; runtime support is probed per instance.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Detail resource has no collection-empty rendering.)
partial:N (Atomic detail read has no meaningful partial rendering.)
policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)
unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)
owner-switch:Y (Owner switch discards responses with a mismatched instance key.) | R0; none
direct | query-capability/read-retain/version-probe/safe-read/route-result
Registered instance, authorized actor, and runtime capability decision are required.
Retain last success as stale and permit an explicit safe refresh.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Safe reads may retry within deadline and retain stale success.
Structured result returns to the owning route with a redacted audit link. | REAL_READ_DEFERRED | denied-readonly-candidate; n=0; categories=none; query-bearing endpoint omitted | `registry:getEsimEuicc`
`upstream:backend/src/main.rs:694-695`
`upstream:backend/src/handlers.rs:485-521`
`fixture:denied-readonly-candidate` |
| `getEsimProfiles` | GET `/api/esim/profiles` | workmode-esim | `/instances/:id/esim`
`esim/profiles` | table | planned: Frozen-scope read is modeled but real capture was explicitly denied; runtime support is probed per instance.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:Y (Successful collection may contain no rows.)
partial:Y (Independent response sections may succeed or fail.)
policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)
unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)
owner-switch:Y (Owner switch discards responses with a mismatched instance key.) | R0; none
direct | query-capability/read-retain/version-probe/safe-read/route-result
Registered instance, authorized actor, and runtime capability decision are required.
Retain last success as stale and permit an explicit safe refresh.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Safe reads may retry within deadline and retain stale success.
Structured result returns to the owning route with a redacted audit link. | REAL_READ_DEFERRED | denied-readonly-candidate; n=0; categories=none; query-bearing endpoint omitted | `registry:getEsimProfiles`
`upstream:backend/src/main.rs:698-699`
`upstream:backend/src/handlers.rs:524-598`
`fixture:denied-readonly-candidate` |
| `postEsimProfiles` | POST `/api/esim/profiles` | workmode-esim | `/instances/:id/esim`
`esim/profiles` | form | planned: Frozen-scope reversible command is contract-planned for a later controlled real-write acceptance phase.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)
partial:N (Single-target command has no meaningful partial result.)
policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)
unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)
owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R1; none
direct | command-current-state/write-revision/version-probe/verify-write/route-result
Refresh current state when available and bind the actor decision to its revision.
Refresh current state or require an explicit recorded revision-bound override.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Writes require outcome verification before actor-initiated retry.
Structured result returns to the owning route with a redacted audit link. | REAL_WRITE_LATER | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:postEsimProfiles`
`upstream:backend/src/main.rs:698-700`
`upstream:backend/src/handlers.rs:803-1071`
`fixture:not-eligible-readonly-capture` |
| `postEsimProfilesIccidEnable` | POST `/api/esim/profiles/{iccid}/enable` | workmode-esim | `/instances/:id/esim`
`esim/profiles` | action | planned: Frozen-scope reversible command is contract-planned for a later controlled real-write acceptance phase.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)
partial:N (Single-target command has no meaningful partial result.)
policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)
unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)
owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R1; none
direct | command-current-state/write-revision/version-probe/verify-write/route-result
Refresh current state when available and bind the actor decision to its revision.
Refresh current state or require an explicit recorded revision-bound override.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Writes require outcome verification before actor-initiated retry.
Structured result returns to the owning route with a redacted audit link. | REAL_WRITE_LATER | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:postEsimProfilesIccidEnable`
`upstream:backend/src/main.rs:704-705`
`upstream:backend/src/handlers.rs:601-726`
`fixture:not-eligible-readonly-capture` |
| `postEsimProfilesIccidRename` | POST `/api/esim/profiles/{iccid}/rename` | workmode-esim | `/instances/:id/esim`
`esim/profiles` | form | planned: Frozen-scope reversible command is contract-planned for a later controlled real-write acceptance phase.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)
partial:N (Single-target command has no meaningful partial result.)
policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)
unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)
owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R1; none
direct | command-current-state/write-revision/version-probe/verify-write/route-result
Refresh current state when available and bind the actor decision to its revision.
Refresh current state or require an explicit recorded revision-bound override.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Writes require outcome verification before actor-initiated retry.
Structured result returns to the owning route with a redacted audit link. | REAL_WRITE_LATER | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:postEsimProfilesIccidRename`
`upstream:backend/src/main.rs:708-709`
`upstream:backend/src/handlers.rs:729-750`
`fixture:not-eligible-readonly-capture` |
| `deleteEsimProfilesIccid` | DELETE `/api/esim/profiles/{iccid}` | workmode-esim | `/instances/:id/esim`
`esim/profiles` | job-action | planned: Frozen-scope high-risk operation is planned with simulation-only acceptance until controlled safety authorization exists.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)
partial:N (Single-target command has no meaningful partial result.)
policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)
unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)
owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R3; strong
preparation-job | job-fresh-preflight/high-risk-block/version-probe/new-job-lineage/job-result
Required fresh preflight; inability to refresh blocks execution.
Fresh preflight is mandatory; stale, expired, or unknown state blocks execution.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Retry creates a new Job lineage (retryOfJobId/rootJobId); never replay successful items.
/jobs/:jobId contains per-item result, attempt lineage, and redacted audit. | SIMULATED_HIGH_RISK | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:deleteEsimProfilesIccid`
`upstream:backend/src/main.rs:712-713`
`upstream:backend/src/handlers.rs:753-780`
`fixture:not-eligible-readonly-capture` |
| `getCalls` | GET `/api/calls` | calls | `/instances/:id/calls`
`calls/live` | table | planned: Frozen-scope read has two redacted captured responses; runtime support is still decided per registered instance.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:Y (Successful collection may contain no rows.)
partial:Y (Independent response sections may succeed or fail.)
policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)
unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)
owner-switch:Y (Owner switch discards responses with a mismatched instance key.) | R0; none
direct | query-capability/read-retain/version-probe/safe-read/route-result
Registered instance, authorized actor, and runtime capability decision are required.
Retain last success as stale and permit an explicit safe refresh.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Safe reads may retry within deadline and retain stale success.
Structured result returns to the owning route with a redacted audit link. | REAL_READ | captured-readonly; n=2; categories=success; collector-selected fully-bound GET R0; two redacted real captures | `registry:getCalls`
`upstream:backend/src/main.rs:717-718`
`upstream:backend/src/handlers.rs:2634-2655`
`upstream:bruno-api/get_calls.bru:8`
`fixture:captured-readonly` |
| `postCallDial` | POST `/api/call/dial` | calls | `/instances/:id/calls`
`calls/live` | form | planned: Frozen-scope reversible command is contract-planned for a later controlled real-write acceptance phase.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)
partial:N (Single-target command has no meaningful partial result.)
policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)
unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)
owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R1; none
direct | command-current-state/write-revision/version-probe/verify-write/route-result
Refresh current state when available and bind the actor decision to its revision.
Refresh current state or require an explicit recorded revision-bound override.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Writes require outcome verification before actor-initiated retry.
Structured result returns to the owning route with a redacted audit link. | REAL_WRITE_LATER | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:postCallDial`
`upstream:backend/src/main.rs:721-722`
`upstream:backend/src/handlers.rs:2657-2689`
`upstream:bruno-api/post_call_dial.bru:8`
`fixture:not-eligible-readonly-capture` |
| `postCallHangup` | POST `/api/call/hangup` | calls | `/instances/:id/calls`
`calls/live` | form | planned: Frozen-scope reversible command is contract-planned for a later controlled real-write acceptance phase.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)
partial:N (Single-target command has no meaningful partial result.)
policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)
unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)
owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R1; none
direct | command-current-state/write-revision/version-probe/verify-write/route-result
Refresh current state when available and bind the actor decision to its revision.
Refresh current state or require an explicit recorded revision-bound override.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Writes require outcome verification before actor-initiated retry.
Structured result returns to the owning route with a redacted audit link. | REAL_WRITE_LATER | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:postCallHangup`
`upstream:backend/src/main.rs:725-726`
`upstream:backend/src/handlers.rs:2691-2725`
`upstream:bruno-api/post_call_hangup.bru:8`
`fixture:not-eligible-readonly-capture` |
| `postCallHangupAll` | POST `/api/call/hangup-all` | calls | `/instances/:id/calls`
`calls/live` | action | planned: Frozen-scope reversible command is contract-planned for a later controlled real-write acceptance phase.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)
partial:N (Single-target command has no meaningful partial result.)
policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)
unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)
owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R1; none
direct | command-current-state/write-revision/version-probe/verify-write/route-result
Refresh current state when available and bind the actor decision to its revision.
Refresh current state or require an explicit recorded revision-bound override.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Writes require outcome verification before actor-initiated retry.
Structured result returns to the owning route with a redacted audit link. | REAL_WRITE_LATER | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:postCallHangupAll`
`upstream:backend/src/main.rs:729-730`
`upstream:backend/src/handlers.rs:2727-2760`
`upstream:bruno-api/post_call_hangup_all.bru:8`
`fixture:not-eligible-readonly-capture` |
| `postCallAnswer` | POST `/api/call/answer` | calls | `/instances/:id/calls`
`calls/live` | form | planned: Frozen-scope reversible command is contract-planned for a later controlled real-write acceptance phase.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)
partial:N (Single-target command has no meaningful partial result.)
policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)
unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)
owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R1; none
direct | command-current-state/write-revision/version-probe/verify-write/route-result
Refresh current state when available and bind the actor decision to its revision.
Refresh current state or require an explicit recorded revision-bound override.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Writes require outcome verification before actor-initiated retry.
Structured result returns to the owning route with a redacted audit link. | REAL_WRITE_LATER | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:postCallAnswer`
`upstream:backend/src/main.rs:733-734`
`upstream:backend/src/handlers.rs:2762-2789`
`upstream:bruno-api/post_call_answer.bru:8`
`fixture:not-eligible-readonly-capture` |
| `getCallVolume` | GET `/api/call/volume` | calls | `/instances/:id/calls`
`calls/volume` | read-panel | planned: Frozen-scope read has two redacted captured responses; runtime support is still decided per registered instance.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Detail resource has no collection-empty rendering.)
partial:N (Atomic detail read has no meaningful partial rendering.)
policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)
unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)
owner-switch:Y (Owner switch discards responses with a mismatched instance key.) | R0; none
direct | query-capability/read-retain/version-probe/safe-read/route-result
Registered instance, authorized actor, and runtime capability decision are required.
Retain last success as stale and permit an explicit safe refresh.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Safe reads may retry within deadline and retain stale success.
Structured result returns to the owning route with a redacted audit link. | REAL_READ | captured-readonly; n=2; categories=success; collector-selected fully-bound GET R0; two redacted real captures | `registry:getCallVolume`
`upstream:backend/src/main.rs:737-738`
`upstream:backend/src/handlers.rs:2899-2906`
`upstream:bruno-api/get_call_volume.bru:8`
`fixture:captured-readonly` |
| `postCallVolume` | POST `/api/call/volume` | calls | `/instances/:id/calls`
`calls/volume` | form | planned: Frozen-scope reversible command is contract-planned for a later controlled real-write acceptance phase.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)
partial:N (Single-target command has no meaningful partial result.)
policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)
unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)
owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R1; none
direct | command-current-state/write-revision/version-probe/verify-write/route-result
Refresh current state when available and bind the actor decision to its revision.
Refresh current state or require an explicit recorded revision-bound override.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Writes require outcome verification before actor-initiated retry.
Structured result returns to the owning route with a redacted audit link. | REAL_WRITE_LATER | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:postCallVolume`
`upstream:backend/src/main.rs:737-739`
`upstream:backend/src/handlers.rs:2908-2922`
`upstream:bruno-api/set_call_volume.bru:8`
`fixture:not-eligible-readonly-capture` |
| `getCallForwarding` | GET `/api/call/forwarding` | calls | `/instances/:id/calls`
`calls/forwarding` | read-panel | planned: Frozen-scope read has two redacted captured responses; runtime support is still decided per registered instance.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Detail resource has no collection-empty rendering.)
partial:N (Atomic detail read has no meaningful partial rendering.)
policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)
unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)
owner-switch:Y (Owner switch discards responses with a mismatched instance key.) | R0; none
direct | query-capability/read-retain/version-probe/safe-read/route-result
Registered instance, authorized actor, and runtime capability decision are required.
Retain last success as stale and permit an explicit safe refresh.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Safe reads may retry within deadline and retain stale success.
Structured result returns to the owning route with a redacted audit link. | REAL_READ | captured-readonly; n=2; categories=success; collector-selected fully-bound GET R0; two redacted real captures | `registry:getCallForwarding`
`upstream:backend/src/main.rs:743-744`
`upstream:backend/src/handlers.rs:2924-2931`
`upstream:bruno-api/get_call_forwarding.bru:8`
`fixture:captured-readonly` |
| `postCallForwarding` | POST `/api/call/forwarding` | calls | `/instances/:id/calls`
`calls/forwarding` | form | planned: Frozen-scope reversible command is contract-planned for a later controlled real-write acceptance phase.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)
partial:N (Single-target command has no meaningful partial result.)
policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)
unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)
owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R1; none
direct | command-current-state/write-revision/version-probe/verify-write/route-result
Refresh current state when available and bind the actor decision to its revision.
Refresh current state or require an explicit recorded revision-bound override.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Writes require outcome verification before actor-initiated retry.
Structured result returns to the owning route with a redacted audit link. | REAL_WRITE_LATER | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:postCallForwarding`
`upstream:backend/src/main.rs:743-745`
`upstream:backend/src/handlers.rs:2933-2943`
`upstream:bruno-api/set_call_forwarding.bru:8`
`fixture:not-eligible-readonly-capture` |
| `getCallSettings` | GET `/api/call/settings` | calls | `/instances/:id/calls`
`calls/settings` | read-panel | planned: Frozen-scope read has two redacted captured responses; runtime support is still decided per registered instance.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Detail resource has no collection-empty rendering.)
partial:N (Atomic detail read has no meaningful partial rendering.)
policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)
unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)
owner-switch:Y (Owner switch discards responses with a mismatched instance key.) | R0; none
direct | query-capability/read-retain/version-probe/safe-read/route-result
Registered instance, authorized actor, and runtime capability decision are required.
Retain last success as stale and permit an explicit safe refresh.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Safe reads may retry within deadline and retain stale success.
Structured result returns to the owning route with a redacted audit link. | REAL_READ | captured-readonly; n=2; categories=success; collector-selected fully-bound GET R0; two redacted real captures | `registry:getCallSettings`
`upstream:backend/src/main.rs:749-750`
`upstream:backend/src/handlers.rs:2852-2866`
`upstream:bruno-api/get_call_settings.bru:8`
`fixture:captured-readonly` |
| `postCallSettings` | POST `/api/call/settings` | calls | `/instances/:id/calls`
`calls/settings` | job-action | planned: Frozen-scope high-risk operation is planned with simulation-only acceptance until controlled safety authorization exists.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)
partial:N (Single-target command has no meaningful partial result.)
policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)
unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)
owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R2; explicit
preparation-job | job-fresh-preflight/high-risk-block/version-probe/new-job-lineage/job-result
Required fresh preflight; inability to refresh blocks execution.
Fresh preflight is mandatory; stale, expired, or unknown state blocks execution.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Retry creates a new Job lineage (retryOfJobId/rootJobId); never replay successful items.
/jobs/:jobId contains per-item result, attempt lineage, and redacted audit. | SIMULATED_HIGH_RISK | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:postCallSettings`
`upstream:backend/src/main.rs:749-751`
`upstream:backend/src/handlers.rs:2868-2897`
`upstream:bruno-api/set_call_settings.bru:8`
`fixture:not-eligible-readonly-capture` |
| `getCallHistory` | GET `/api/call/history` | calls | `/instances/:id/calls`
`calls/history` | table | planned: Frozen-scope read is modeled but real capture was explicitly denied; runtime support is probed per instance.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:Y (Successful collection may contain no rows.)
partial:Y (Independent response sections may succeed or fail.)
policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)
unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)
owner-switch:Y (Owner switch discards responses with a mismatched instance key.) | R0; none
direct | query-capability/read-retain/version-probe/safe-read/route-result
Registered instance, authorized actor, and runtime capability decision are required.
Retain last success as stale and permit an explicit safe refresh.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Safe reads may retry within deadline and retain stale success.
Structured result returns to the owning route with a redacted audit link. | REAL_READ_DEFERRED | denied-readonly-candidate; n=0; categories=none; query limit is not encoded in Registry path contract | `registry:getCallHistory`
`upstream:backend/src/main.rs:755-756`
`upstream:backend/src/handlers.rs:2791-2813`
`fixture:denied-readonly-candidate` |
| `deleteCallHistoryId` | DELETE `/api/call/history/{id}` | calls | `/instances/:id/calls`
`calls/history` | job-action | planned: Frozen-scope high-risk operation is planned with simulation-only acceptance until controlled safety authorization exists.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)
partial:N (Single-target command has no meaningful partial result.)
policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)
unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)
owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R3; strong
preparation-job | job-fresh-preflight/high-risk-block/version-probe/new-job-lineage/job-result
Required fresh preflight; inability to refresh blocks execution.
Fresh preflight is mandatory; stale, expired, or unknown state blocks execution.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Retry creates a new Job lineage (retryOfJobId/rootJobId); never replay successful items.
/jobs/:jobId contains per-item result, attempt lineage, and redacted audit. | SIMULATED_HIGH_RISK | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:deleteCallHistoryId`
`upstream:backend/src/main.rs:759-760`
`upstream:backend/src/handlers.rs:2815-2832`
`upstream:bruno-api/delete_call_history.bru:8`
`fixture:not-eligible-readonly-capture` |
| `postCallHistoryClear` | POST `/api/call/history/clear` | calls | `/instances/:id/calls`
`calls/history` | job-action | planned: Frozen-scope high-risk operation is planned with simulation-only acceptance until controlled safety authorization exists.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)
partial:N (Single-target command has no meaningful partial result.)
policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)
unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)
owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R3; strong
preparation-job | job-fresh-preflight/high-risk-block/version-probe/new-job-lineage/job-result
Required fresh preflight; inability to refresh blocks execution.
Fresh preflight is mandatory; stale, expired, or unknown state blocks execution.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Retry creates a new Job lineage (retryOfJobId/rootJobId); never replay successful items.
/jobs/:jobId contains per-item result, attempt lineage, and redacted audit. | SIMULATED_HIGH_RISK | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:postCallHistoryClear`
`upstream:backend/src/main.rs:763-764`
`upstream:backend/src/handlers.rs:2834-2850`
`upstream:bruno-api/clear_call_history.bru:8`
`fixture:not-eligible-readonly-capture` |
| `getImsStatus` | GET `/api/ims/status` | calls | `/instances/:id/calls`
`calls/ims-voicemail` | read-panel | planned: Frozen-scope read has two redacted captured responses; runtime support is still decided per registered instance.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Detail resource has no collection-empty rendering.)
partial:N (Atomic detail read has no meaningful partial rendering.)
policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)
unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)
owner-switch:Y (Owner switch discards responses with a mismatched instance key.) | R0; none
direct | query-capability/read-retain/version-probe/safe-read/route-result
Registered instance, authorized actor, and runtime capability decision are required.
Retain last success as stale and permit an explicit safe refresh.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Safe reads may retry within deadline and retain stale success.
Structured result returns to the owning route with a redacted audit link. | REAL_READ | captured-readonly; n=2; categories=success; collector-selected fully-bound GET R0; two redacted real captures | `registry:getImsStatus`
`upstream:backend/src/main.rs:767-768`
`upstream:backend/src/handlers.rs:2945-2952`
`upstream:bruno-api/get_ims_status.bru:8`
`fixture:captured-readonly` |
| `getVoicemailStatus` | GET `/api/voicemail/status` | calls | `/instances/:id/calls`
`calls/ims-voicemail` | read-panel | planned: Frozen-scope read has two redacted captured responses; runtime support is still decided per registered instance.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Detail resource has no collection-empty rendering.)
partial:N (Atomic detail read has no meaningful partial rendering.)
policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)
unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)
owner-switch:Y (Owner switch discards responses with a mismatched instance key.) | R0; none
direct | query-capability/read-retain/version-probe/safe-read/route-result
Registered instance, authorized actor, and runtime capability decision are required.
Retain last success as stale and permit an explicit safe refresh.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Safe reads may retry within deadline and retain stale success.
Structured result returns to the owning route with a redacted audit link. | REAL_READ | captured-readonly; n=2; categories=success; collector-selected fully-bound GET R0; two redacted real captures | `registry:getVoicemailStatus`
`upstream:backend/src/main.rs:771-772`
`upstream:backend/src/handlers.rs:2954-2961`
`upstream:bruno-api/get_voicemail_status.bru:8`
`fixture:captured-readonly` |
| `postSmsSend` | POST `/api/sms/send` | messages | `/instances/:id/messages`
`messages/compose` | job-action | planned: Frozen-scope high-risk operation is planned with simulation-only acceptance until controlled safety authorization exists.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)
partial:N (Single-target command has no meaningful partial result.)
policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)
unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)
owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R2; explicit
preparation-job | job-fresh-preflight/high-risk-block/version-probe/new-job-lineage/job-result
Required fresh preflight; inability to refresh blocks execution.
Fresh preflight is mandatory; stale, expired, or unknown state blocks execution.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Retry creates a new Job lineage (retryOfJobId/rootJobId); never replay successful items.
/jobs/:jobId contains per-item result, attempt lineage, and redacted audit. | SIMULATED_HIGH_RISK | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:postSmsSend`
`upstream:backend/src/main.rs:776-777`
`upstream:backend/src/handlers.rs:2373-2404`
`upstream:bruno-api/post_sms_send.bru:8`
`fixture:not-eligible-readonly-capture` |
| `getSmsList` | GET `/api/sms/list` | messages | `/instances/:id/messages`
`messages/list` | table | planned: Frozen-scope read is modeled but real capture was explicitly denied; runtime support is probed per instance.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:Y (Successful collection may contain no rows.)
partial:Y (Independent response sections may succeed or fail.)
policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)
unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)
owner-switch:Y (Owner switch discards responses with a mismatched instance key.) | R0; none
direct | query-capability/read-retain/version-probe/safe-read/route-result
Registered instance, authorized actor, and runtime capability decision are required.
Retain last success as stale and permit an explicit safe refresh.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Safe reads may retry within deadline and retain stale success.
Structured result returns to the owning route with a redacted audit link. | REAL_READ_DEFERRED | denied-readonly-candidate; n=0; categories=none; message list can expose body; intentionally not collected | `registry:getSmsList`
`upstream:backend/src/main.rs:780-781`
`upstream:backend/src/handlers.rs:2407-2434`
`fixture:denied-readonly-candidate` |
| `getSmsConversation` | GET `/api/sms/conversation` | messages | `/instances/:id/messages`
`messages/conversation` | table | planned: Frozen-scope read is modeled but real capture was explicitly denied; runtime support is probed per instance.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:Y (Successful collection may contain no rows.)
partial:Y (Independent response sections may succeed or fail.)
policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)
unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)
owner-switch:Y (Owner switch discards responses with a mismatched instance key.) | R0; none
direct | query-capability/read-retain/version-probe/safe-read/route-result
Registered instance, authorized actor, and runtime capability decision are required.
Retain last success as stale and permit an explicit safe refresh.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Safe reads may retry within deadline and retain stale success.
Structured result returns to the owning route with a redacted audit link. | REAL_READ_DEFERRED | denied-readonly-candidate; n=0; categories=none; requires correspondent query and exposes message bodies | `registry:getSmsConversation`
`upstream:backend/src/main.rs:784-785`
`upstream:backend/src/handlers.rs:2437-2458`
`fixture:denied-readonly-candidate` |
| `getSmsStats` | GET `/api/sms/stats` | messages | `/instances/:id/messages`
`messages/stats` | read-panel | planned: Frozen-scope read has two redacted captured responses; runtime support is still decided per registered instance.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Detail resource has no collection-empty rendering.)
partial:N (Atomic detail read has no meaningful partial rendering.)
policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)
unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)
owner-switch:Y (Owner switch discards responses with a mismatched instance key.) | R0; none
direct | query-capability/read-retain/version-probe/safe-read/route-result
Registered instance, authorized actor, and runtime capability decision are required.
Retain last success as stale and permit an explicit safe refresh.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Safe reads may retry within deadline and retain stale success.
Structured result returns to the owning route with a redacted audit link. | REAL_READ | captured-readonly; n=2; categories=success; collector-selected fully-bound GET R0; two redacted real captures | `registry:getSmsStats`
`upstream:backend/src/main.rs:788-789`
`upstream:backend/src/handlers.rs:2461-2477`
`upstream:bruno-api/get_sms_stats.bru:8`
`fixture:captured-readonly` |
| `postSmsBatchDelete` | POST `/api/sms/batch-delete` | messages | `/instances/:id/messages`
`messages/destructive` | job-action | planned: Frozen-scope high-risk operation is planned with simulation-only acceptance until controlled safety authorization exists.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)
partial:Y (Job items may independently succeed, fail, or be skipped.)
policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)
unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)
owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R3; strong
preparation-job | job-fresh-preflight/high-risk-block/version-probe/new-job-lineage/job-result
Required fresh preflight; inability to refresh blocks execution.
Fresh preflight is mandatory; stale, expired, or unknown state blocks execution.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Retry creates a new Job lineage (retryOfJobId/rootJobId); never replay successful items.
/jobs/:jobId contains per-item result, attempt lineage, and redacted audit. | SIMULATED_HIGH_RISK | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:postSmsBatchDelete`
`upstream:backend/src/main.rs:792-793`
`upstream:backend/src/handlers.rs:2551-2578`
`fixture:not-eligible-readonly-capture` |
| `deleteSmsConversationPhoneNumber` | DELETE `/api/sms/conversation/{phone_number}` | messages | `/instances/:id/messages`
`messages/destructive` | job-action | planned: Frozen-scope high-risk operation is planned with simulation-only acceptance until controlled safety authorization exists.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)
partial:N (Single-target command has no meaningful partial result.)
policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)
unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)
owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R3; strong
preparation-job | job-fresh-preflight/high-risk-block/version-probe/new-job-lineage/job-result
Required fresh preflight; inability to refresh blocks execution.
Fresh preflight is mandatory; stale, expired, or unknown state blocks execution.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Retry creates a new Job lineage (retryOfJobId/rootJobId); never replay successful items.
/jobs/:jobId contains per-item result, attempt lineage, and redacted audit. | SIMULATED_HIGH_RISK | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:deleteSmsConversationPhoneNumber`
`upstream:backend/src/main.rs:796-797`
`upstream:backend/src/handlers.rs:2528-2548`
`fixture:not-eligible-readonly-capture` |
| `deleteSmsMessageId` | DELETE `/api/sms/message/{id}` | messages | `/instances/:id/messages`
`messages/destructive` | job-action | planned: Frozen-scope high-risk operation is planned with simulation-only acceptance until controlled safety authorization exists.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)
partial:N (Single-target command has no meaningful partial result.)
policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)
unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)
owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R3; strong
preparation-job | job-fresh-preflight/high-risk-block/version-probe/new-job-lineage/job-result
Required fresh preflight; inability to refresh blocks execution.
Fresh preflight is mandatory; stale, expired, or unknown state blocks execution.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Retry creates a new Job lineage (retryOfJobId/rootJobId); never replay successful items.
/jobs/:jobId contains per-item result, attempt lineage, and redacted audit. | SIMULATED_HIGH_RISK | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:deleteSmsMessageId`
`upstream:backend/src/main.rs:800-801`
`upstream:backend/src/handlers.rs:2508-2525`
`fixture:not-eligible-readonly-capture` |
| `postSmsClear` | POST `/api/sms/clear` | messages | `/instances/:id/messages`
`messages/destructive` | job-action | planned: Frozen-scope high-risk operation is planned with simulation-only acceptance until controlled safety authorization exists.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)
partial:N (Single-target command has no meaningful partial result.)
policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)
unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)
owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R3; strong
preparation-job | job-fresh-preflight/high-risk-block/version-probe/new-job-lineage/job-result
Required fresh preflight; inability to refresh blocks execution.
Fresh preflight is mandatory; stale, expired, or unknown state blocks execution.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Retry creates a new Job lineage (retryOfJobId/rootJobId); never replay successful items.
/jobs/:jobId contains per-item result, attempt lineage, and redacted audit. | SIMULATED_HIGH_RISK | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:postSmsClear`
`upstream:backend/src/main.rs:804-805`
`upstream:backend/src/handlers.rs:2480-2505`
`upstream:bruno-api/post_sms_clear.bru:8`
`fixture:not-eligible-readonly-capture` |
| `getStats` | GET `/api/stats` | device-system | `/instances/:id/overview`
`overview/stats` | read-panel | planned: Frozen-scope read has two redacted captured responses; runtime support is still decided per registered instance.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Detail resource has no collection-empty rendering.)
partial:Y (Independent response sections may succeed or fail.)
policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)
unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)
owner-switch:Y (Owner switch discards responses with a mismatched instance key.) | R0; none
direct | command-current-state/read-retain/version-probe/safe-read/route-result
Refresh current state when available and bind the actor decision to its revision.
Retain last success as stale and permit an explicit safe refresh.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Safe reads may retry within deadline and retain stale success.
Structured result returns to the owning route with a redacted audit link. | REAL_READ | captured-readonly; n=2; categories=success; collector-selected fully-bound GET R0; two redacted real captures | `registry:getStats`
`upstream:backend/src/main.rs:808-808`
`upstream:backend/src/handlers.rs:3272-3288`
`upstream:bruno-api/get_stats.bru:8`
`fixture:captured-readonly` |
| `getStatsCpu` | GET `/api/stats/cpu` | device-system | `/instances/:id/overview`
`overview/stats` | read-panel | planned: Frozen-scope read has two redacted captured responses; runtime support is still decided per registered instance.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Detail resource has no collection-empty rendering.)
partial:Y (Independent response sections may succeed or fail.)
policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)
unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)
owner-switch:Y (Owner switch discards responses with a mismatched instance key.) | R0; none
direct | command-current-state/read-retain/version-probe/safe-read/route-result
Refresh current state when available and bind the actor decision to its revision.
Retain last success as stale and permit an explicit safe refresh.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Safe reads may retry within deadline and retain stale success.
Structured result returns to the owning route with a redacted audit link. | REAL_READ | captured-readonly; n=2; categories=success; collector-selected fully-bound GET R0; two redacted real captures | `registry:getStatsCpu`
`upstream:backend/src/main.rs:809-809`
`upstream:backend/src/handlers.rs:3291-3302`
`upstream:bruno-api/get_cpu_info.bru:8`
`fixture:captured-readonly` |
| `getConnectivity` | GET `/api/connectivity` | device-system | `/instances/:id/overview`
`overview/auth-health` | read-panel | planned: Frozen-scope read is modeled but real capture was explicitly denied; runtime support is probed per instance.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Detail resource has no collection-empty rendering.)
partial:Y (Independent response sections may succeed or fail.)
policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)
unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)
owner-switch:Y (Owner switch discards responses with a mismatched instance key.) | R0; none
direct | command-current-state/read-retain/version-probe/safe-read/route-result
Refresh current state when available and bind the actor decision to its revision.
Retain last success as stale and permit an explicit safe refresh.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Safe reads may retry within deadline and retain stale success.
Structured result returns to the owning route with a redacted audit link. | REAL_READ_DEFERRED | denied-readonly-candidate; n=0; categories=none; handler performs active connectivity ping | `registry:getConnectivity`
`upstream:backend/src/main.rs:811-812`
`upstream:backend/src/handlers.rs:3305-3322`
`fixture:denied-readonly-candidate` |
| `postSystemReboot` | POST `/api/system/reboot` | device-system | `/instances/:id/overview`
`overview/system-actions` | job-action | planned: Frozen-scope high-risk operation is planned with simulation-only acceptance until controlled safety authorization exists.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)
partial:N (Single-target command has no meaningful partial result.)
policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)
unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)
owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R3; strong
preparation-job | job-fresh-preflight/high-risk-block/version-probe/new-job-lineage/job-result
Required fresh preflight; inability to refresh blocks execution.
Fresh preflight is mandatory; stale, expired, or unknown state blocks execution.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Retry creates a new Job lineage (retryOfJobId/rootJobId); never replay successful items.
/jobs/:jobId contains per-item result, attempt lineage, and redacted audit. | SIMULATED_HIGH_RISK | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:postSystemReboot`
`upstream:backend/src/main.rs:815-816`
`upstream:backend/src/handlers.rs:3381-3406`
`upstream:bruno-api/post_system_reboot.bru:8`
`fixture:not-eligible-readonly-capture` |
| `postServiceRestart` | POST `/api/service/restart` | device-system | `/instances/:id/overview`
`overview/system-actions` | job-action | planned: Frozen-scope high-risk operation is planned with simulation-only acceptance until controlled safety authorization exists.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)
partial:N (Single-target command has no meaningful partial result.)
policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)
unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)
owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R3; strong
preparation-job | job-fresh-preflight/high-risk-block/version-probe/new-job-lineage/job-result
Required fresh preflight; inability to refresh blocks execution.
Fresh preflight is mandatory; stale, expired, or unknown state blocks execution.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Retry creates a new Job lineage (retryOfJobId/rootJobId); never replay successful items.
/jobs/:jobId contains per-item result, attempt lineage, and redacted audit. | SIMULATED_HIGH_RISK | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:postServiceRestart`
`upstream:backend/src/main.rs:819-820`
`upstream:backend/src/handlers.rs:3578-3601`
`fixture:not-eligible-readonly-capture` |
| `getNotificationsConfig` | GET `/api/notifications/config` | notifications | `/instances/:id/notifications`
`notifications/config` | read-panel | planned: Frozen-scope read has two redacted captured responses; runtime support is still decided per registered instance.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Detail resource has no collection-empty rendering.)
partial:N (Atomic detail read has no meaningful partial rendering.)
policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)
unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)
owner-switch:Y (Owner switch discards responses with a mismatched instance key.) | R0; none
direct | query-capability/read-retain/version-probe/safe-read/route-result
Registered instance, authorized actor, and runtime capability decision are required.
Retain last success as stale and permit an explicit safe refresh.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Safe reads may retry within deadline and retain stale success.
Structured result returns to the owning route with a redacted audit link. | REAL_READ | captured-readonly; n=2; categories=success; collector-selected fully-bound GET R0; two redacted real captures | `registry:getNotificationsConfig`
`upstream:backend/src/main.rs:824-825`
`upstream:backend/src/handlers.rs:3641-3652`
`upstream:bruno-api/get_notification_config.bru:8`
`fixture:captured-readonly` |
| `postNotificationsConfig` | POST `/api/notifications/config` | notifications | `/instances/:id/notifications`
`notifications/config` | job-action | planned: Frozen-scope high-risk operation is planned with simulation-only acceptance until controlled safety authorization exists.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)
partial:N (Single-target command has no meaningful partial result.)
policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)
unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)
owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R2; explicit
preparation-job | job-fresh-preflight/high-risk-block/version-probe/new-job-lineage/job-result
Required fresh preflight; inability to refresh blocks execution.
Fresh preflight is mandatory; stale, expired, or unknown state blocks execution.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Retry creates a new Job lineage (retryOfJobId/rootJobId); never replay successful items.
/jobs/:jobId contains per-item result, attempt lineage, and redacted audit. | SIMULATED_HIGH_RISK | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:postNotificationsConfig`
`upstream:backend/src/main.rs:824-826`
`upstream:backend/src/handlers.rs:3655-3672`
`upstream:bruno-api/set_notification_config.bru:8`
`fixture:not-eligible-readonly-capture` |
| `postNotificationsTestChannel` | POST `/api/notifications/test/{channel}` | notifications | `/instances/:id/notifications`
`notifications/config` | job-action | planned: Frozen-scope high-risk operation is planned with simulation-only acceptance until controlled safety authorization exists.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)
partial:N (Single-target command has no meaningful partial result.)
policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)
unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)
owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R2; explicit
preparation-job | job-fresh-preflight/high-risk-block/version-probe/new-job-lineage/job-result
Required fresh preflight; inability to refresh blocks execution.
Fresh preflight is mandatory; stale, expired, or unknown state blocks execution.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Retry creates a new Job lineage (retryOfJobId/rootJobId); never replay successful items.
/jobs/:jobId contains per-item result, attempt lineage, and redacted audit. | SIMULATED_HIGH_RISK | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:postNotificationsTestChannel`
`upstream:backend/src/main.rs:830-831`
`upstream:backend/src/handlers.rs:3675-3704`
`fixture:not-eligible-readonly-capture` |
| `getNotificationsLogs` | GET `/api/notifications/logs` | notifications | `/instances/:id/notifications`
`notifications/logs` | table | planned: Frozen-scope read is modeled but real capture was explicitly denied; runtime support is probed per instance.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:Y (Successful collection may contain no rows.)
partial:Y (Independent response sections may succeed or fail.)
policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)
unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)
owner-switch:Y (Owner switch discards responses with a mismatched instance key.) | R0; none
direct | query-capability/read-retain/version-probe/safe-read/route-result
Registered instance, authorized actor, and runtime capability decision are required.
Retain last success as stale and permit an explicit safe refresh.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Safe reads may retry within deadline and retain stale success.
Structured result returns to the owning route with a redacted audit link. | REAL_READ_DEFERRED | denied-readonly-candidate; n=0; categories=none; query limit is not encoded in Registry path contract | `registry:getNotificationsLogs`
`upstream:backend/src/main.rs:835-836`
`upstream:backend/src/handlers.rs:3709-3734`
`fixture:denied-readonly-candidate` |
| `postNotificationsLogsClear` | POST `/api/notifications/logs/clear` | notifications | `/instances/:id/notifications`
`notifications/logs` | job-action | planned: Frozen-scope high-risk operation is planned with simulation-only acceptance until controlled safety authorization exists.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)
partial:N (Single-target command has no meaningful partial result.)
policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)
unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)
owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R3; strong
preparation-job | job-fresh-preflight/high-risk-block/version-probe/new-job-lineage/job-result
Required fresh preflight; inability to refresh blocks execution.
Fresh preflight is mandatory; stale, expired, or unknown state blocks execution.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Retry creates a new Job lineage (retryOfJobId/rootJobId); never replay successful items.
/jobs/:jobId contains per-item result, attempt lineage, and redacted audit. | SIMULATED_HIGH_RISK | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:postNotificationsLogsClear`
`upstream:backend/src/main.rs:839-840`
`upstream:backend/src/handlers.rs:3737-3760`
`fixture:not-eligible-readonly-capture` |
| `getNotificationsQueue` | GET `/api/notifications/queue` | notifications | `/instances/:id/notifications`
`notifications/queue` | table | planned: Frozen-scope read is modeled but real capture was explicitly denied; runtime support is probed per instance.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:Y (Successful collection may contain no rows.)
partial:Y (Independent response sections may succeed or fail.)
policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)
unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)
owner-switch:Y (Owner switch discards responses with a mismatched instance key.) | R0; none
direct | query-capability/read-retain/version-probe/safe-read/route-result
Registered instance, authorized actor, and runtime capability decision are required.
Retain last success as stale and permit an explicit safe refresh.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Safe reads may retry within deadline and retain stale success.
Structured result returns to the owning route with a redacted audit link. | REAL_READ_DEFERRED | denied-readonly-candidate; n=0; categories=none; query limit is not encoded in Registry path contract | `registry:getNotificationsQueue`
`upstream:backend/src/main.rs:843-844`
`upstream:backend/src/notification_queue.rs:24-41`
`fixture:denied-readonly-candidate` |
| `postNotificationsQueueRetryAll` | POST `/api/notifications/queue/retry-all` | notifications | `/instances/:id/notifications`
`notifications/queue` | job-action | planned: Frozen-scope high-risk operation is planned with simulation-only acceptance until controlled safety authorization exists.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)
partial:Y (Job items may independently succeed, fail, or be skipped.)
policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)
unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)
owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R2; explicit
preparation-job | job-fresh-preflight/high-risk-block/version-probe/new-job-lineage/job-result
Required fresh preflight; inability to refresh blocks execution.
Fresh preflight is mandatory; stale, expired, or unknown state blocks execution.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Retry creates a new Job lineage (retryOfJobId/rootJobId); never replay successful items.
/jobs/:jobId contains per-item result, attempt lineage, and redacted audit. | SIMULATED_HIGH_RISK | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:postNotificationsQueueRetryAll`
`upstream:backend/src/main.rs:847-848`
`upstream:backend/src/notification_queue.rs:84-100`
`fixture:not-eligible-readonly-capture` |
| `postNotificationsQueueClear` | POST `/api/notifications/queue/clear` | notifications | `/instances/:id/notifications`
`notifications/queue` | job-action | planned: Frozen-scope high-risk operation is planned with simulation-only acceptance until controlled safety authorization exists.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)
partial:Y (Job items may independently succeed, fail, or be skipped.)
policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)
unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)
owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R3; strong
preparation-job | job-fresh-preflight/high-risk-block/version-probe/new-job-lineage/job-result
Required fresh preflight; inability to refresh blocks execution.
Fresh preflight is mandatory; stale, expired, or unknown state blocks execution.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Retry creates a new Job lineage (retryOfJobId/rootJobId); never replay successful items.
/jobs/:jobId contains per-item result, attempt lineage, and redacted audit. | SIMULATED_HIGH_RISK | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:postNotificationsQueueClear`
`upstream:backend/src/main.rs:851-852`
`upstream:backend/src/notification_queue.rs:103-119`
`fixture:not-eligible-readonly-capture` |
| `deleteNotificationsQueueId` | DELETE `/api/notifications/queue/{id}` | notifications | `/instances/:id/notifications`
`notifications/queue` | job-action | planned: Frozen-scope high-risk operation is planned with simulation-only acceptance until controlled safety authorization exists.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)
partial:N (Single-target command has no meaningful partial result.)
policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)
unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)
owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R3; strong
preparation-job | job-fresh-preflight/high-risk-block/version-probe/new-job-lineage/job-result
Required fresh preflight; inability to refresh blocks execution.
Fresh preflight is mandatory; stale, expired, or unknown state blocks execution.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Retry creates a new Job lineage (retryOfJobId/rootJobId); never replay successful items.
/jobs/:jobId contains per-item result, attempt lineage, and redacted audit. | SIMULATED_HIGH_RISK | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:deleteNotificationsQueueId`
`upstream:backend/src/main.rs:855-856`
`upstream:backend/src/notification_queue.rs:64-81`
`fixture:not-eligible-readonly-capture` |
| `postNotificationsQueueIdRetry` | POST `/api/notifications/queue/{id}/retry` | notifications | `/instances/:id/notifications`
`notifications/queue` | job-action | planned: Frozen-scope high-risk operation is planned with simulation-only acceptance until controlled safety authorization exists.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)
partial:N (Single-target command has no meaningful partial result.)
policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)
unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)
owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R2; explicit
preparation-job | job-fresh-preflight/high-risk-block/version-probe/new-job-lineage/job-result
Required fresh preflight; inability to refresh blocks execution.
Fresh preflight is mandatory; stale, expired, or unknown state blocks execution.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Retry creates a new Job lineage (retryOfJobId/rootJobId); never replay successful items.
/jobs/:jobId contains per-item result, attempt lineage, and redacted audit. | SIMULATED_HIGH_RISK | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:postNotificationsQueueIdRetry`
`upstream:backend/src/main.rs:859-860`
`upstream:backend/src/notification_queue.rs:44-61`
`fixture:not-eligible-readonly-capture` |
| `getAutomationConfig` | GET `/api/automation/config` | automation | `/instances/:id/automation`
`automation/config` | read-panel | planned: Frozen-scope read has two redacted captured responses; runtime support is still decided per registered instance.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Detail resource has no collection-empty rendering.)
partial:N (Atomic detail read has no meaningful partial rendering.)
policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)
unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)
owner-switch:Y (Owner switch discards responses with a mismatched instance key.) | R0; none
direct | query-capability/read-retain/version-probe/safe-read/route-result
Registered instance, authorized actor, and runtime capability decision are required.
Retain last success as stale and permit an explicit safe refresh.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Safe reads may retry within deadline and retain stale success.
Structured result returns to the owning route with a redacted audit link. | REAL_READ | captured-readonly; n=2; categories=unsupported; collector-selected fully-bound GET R0; two redacted real captures | `registry:getAutomationConfig`
`upstream:backend/src/main.rs:864-865`
`upstream:backend/src/handlers.rs:3968-3979`
`fixture:captured-readonly` |
| `postAutomationConfig` | POST `/api/automation/config` | automation | `/instances/:id/automation`
`automation/config` | job-action | planned: Frozen-scope high-risk operation is planned with simulation-only acceptance until controlled safety authorization exists.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)
partial:N (Single-target command has no meaningful partial result.)
policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)
unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)
owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R2; explicit
preparation-job | job-fresh-preflight/high-risk-block/version-probe/new-job-lineage/job-result
Required fresh preflight; inability to refresh blocks execution.
Fresh preflight is mandatory; stale, expired, or unknown state blocks execution.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Retry creates a new Job lineage (retryOfJobId/rootJobId); never replay successful items.
/jobs/:jobId contains per-item result, attempt lineage, and redacted audit. | SIMULATED_HIGH_RISK | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:postAutomationConfig`
`upstream:backend/src/main.rs:864-866`
`upstream:backend/src/handlers.rs:3982-3999`
`fixture:not-eligible-readonly-capture` |
| `getAutomationLogs` | GET `/api/automation/logs` | automation | `/instances/:id/automation`
`automation/logs` | table | planned: Frozen-scope read is modeled but real capture was explicitly denied; runtime support is probed per instance.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:Y (Successful collection may contain no rows.)
partial:Y (Independent response sections may succeed or fail.)
policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)
unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)
owner-switch:Y (Owner switch discards responses with a mismatched instance key.) | R0; none
direct | query-capability/read-retain/version-probe/safe-read/route-result
Registered instance, authorized actor, and runtime capability decision are required.
Retain last success as stale and permit an explicit safe refresh.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Safe reads may retry within deadline and retain stale success.
Structured result returns to the owning route with a redacted audit link. | REAL_READ_DEFERRED | denied-readonly-candidate; n=0; categories=none; query limit is not encoded in Registry path contract | `registry:getAutomationLogs`
`upstream:backend/src/main.rs:870-871`
`upstream:backend/src/handlers.rs:4002-4027`
`fixture:denied-readonly-candidate` |
| `postAutomationLogsClear` | POST `/api/automation/logs/clear` | automation | `/instances/:id/automation`
`automation/logs` | job-action | planned: Frozen-scope high-risk operation is planned with simulation-only acceptance until controlled safety authorization exists.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)
partial:N (Single-target command has no meaningful partial result.)
policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)
unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)
owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R3; strong
preparation-job | job-fresh-preflight/high-risk-block/version-probe/new-job-lineage/job-result
Required fresh preflight; inability to refresh blocks execution.
Fresh preflight is mandatory; stale, expired, or unknown state blocks execution.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Retry creates a new Job lineage (retryOfJobId/rootJobId); never replay successful items.
/jobs/:jobId contains per-item result, attempt lineage, and redacted audit. | SIMULATED_HIGH_RISK | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:postAutomationLogsClear`
`upstream:backend/src/main.rs:874-875`
`upstream:backend/src/handlers.rs:4030-4053`
`fixture:not-eligible-readonly-capture` |
| `postAutomationTestTaskId` | POST `/api/automation/test/{task_id}` | automation | `/instances/:id/automation`
`automation/task-test` | job-action | planned: Frozen-scope high-risk operation is planned with simulation-only acceptance until controlled safety authorization exists.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)
partial:N (Single-target command has no meaningful partial result.)
policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)
unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)
owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R2; explicit
preparation-job | job-fresh-preflight/high-risk-block/version-probe/new-job-lineage/job-result
Required fresh preflight; inability to refresh blocks execution.
Fresh preflight is mandatory; stale, expired, or unknown state blocks execution.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Retry creates a new Job lineage (retryOfJobId/rootJobId); never replay successful items.
/jobs/:jobId contains per-item result, attempt lineage, and redacted audit. | SIMULATED_HIGH_RISK | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:postAutomationTestTaskId`
`upstream:backend/src/main.rs:878-879`
`upstream:backend/src/handlers.rs:4056-4146`
`fixture:not-eligible-readonly-capture` |
| `getOtaStatus` | GET `/api/ota/status` | ota | `/instances/:id/ota`
`ota/status` | read-panel | planned: Frozen-scope read has two redacted captured responses; runtime support is still decided per registered instance.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Detail resource has no collection-empty rendering.)
partial:N (Atomic detail read has no meaningful partial rendering.)
policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)
unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)
owner-switch:Y (Owner switch discards responses with a mismatched instance key.) | R0; none
direct | query-capability/read-retain/version-probe/safe-read/route-result
Registered instance, authorized actor, and runtime capability decision are required.
Retain last success as stale and permit an explicit safe refresh.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Safe reads may retry within deadline and retain stale success.
Structured result returns to the owning route with a redacted audit link. | REAL_READ | captured-readonly; n=2; categories=success; collector-selected fully-bound GET R0; two redacted real captures | `registry:getOtaStatus`
`upstream:backend/src/main.rs:882-883`
`upstream:backend/src/handlers.rs:3763-3769`
`upstream:bruno-api/get_ota_status.bru:8`
`fixture:captured-readonly` |
| `postOtaUpload` | POST `/api/ota/upload` | ota | `/instances/:id/ota`
`ota/upload` | dedicated-upload-flow | planned: Frozen-scope high-risk operation is planned with simulation-only acceptance until controlled safety authorization exists.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)
partial:N (Single-target command has no meaningful partial result.)
policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)
unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)
owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R3; strong
preparation-job | job-fresh-preflight/high-risk-block/ota-version-probe/new-job-lineage/job-result
Required fresh preflight; inability to refresh blocks execution.
Fresh preflight is mandatory; stale, expired, or unknown state blocks execution.
OTA 404/405/501 is frozen-version evidence; preserve release/status probe context and never infer global support.
Retry creates a new Job lineage (retryOfJobId/rootJobId); never replay successful items.
/jobs/:jobId contains per-item result, attempt lineage, and redacted audit. | SIMULATED_HIGH_RISK | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:postOtaUpload`
`upstream:backend/src/main.rs:886-887`
`upstream:backend/src/handlers.rs:3772-3792`
`fixture:not-eligible-readonly-capture` |
| `postOtaLatestRelease` | POST `/api/ota/latest-release` | ota | `/instances/:id/ota`
`ota/release` | form | planned: Frozen-scope reversible command is contract-planned for a later controlled real-write acceptance phase.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)
partial:N (Single-target command has no meaningful partial result.)
policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)
unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)
owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R1; none
direct | command-current-state/write-revision/version-probe/verify-write/route-result
Refresh current state when available and bind the actor decision to its revision.
Refresh current state or require an explicit recorded revision-bound override.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Writes require outcome verification before actor-initiated retry.
Structured result returns to the owning route with a redacted audit link. | REAL_WRITE_LATER | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:postOtaLatestRelease`
`upstream:backend/src/main.rs:892-893`
`upstream:backend/src/handlers.rs:3795-3825`
`fixture:not-eligible-readonly-capture` |
| `postOtaOnlinePrepare` | POST `/api/ota/online-prepare` | ota | `/instances/:id/ota`
`ota/release` | job-action | planned: Frozen-scope high-risk operation is planned with simulation-only acceptance until controlled safety authorization exists.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)
partial:N (Single-target command has no meaningful partial result.)
policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)
unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)
owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R2; explicit
preparation-job | job-fresh-preflight/high-risk-block/ota-version-probe/new-job-lineage/job-result
Required fresh preflight; inability to refresh blocks execution.
Fresh preflight is mandatory; stale, expired, or unknown state blocks execution.
OTA 404/405/501 is frozen-version evidence; preserve release/status probe context and never infer global support.
Retry creates a new Job lineage (retryOfJobId/rootJobId); never replay successful items.
/jobs/:jobId contains per-item result, attempt lineage, and redacted audit. | SIMULATED_HIGH_RISK | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:postOtaOnlinePrepare`
`upstream:backend/src/main.rs:896-897`
`upstream:backend/src/handlers.rs:3828-3889`
`fixture:not-eligible-readonly-capture` |
| `postOtaApply` | POST `/api/ota/apply` | ota | `/instances/:id/ota`
`ota/apply` | job-action | planned: Frozen-scope high-risk operation is planned with simulation-only acceptance until controlled safety authorization exists.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)
partial:N (Single-target command has no meaningful partial result.)
policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)
unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)
owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R3; strong
preparation-job | job-fresh-preflight/high-risk-block/ota-version-probe/new-job-lineage/job-result
Required fresh preflight; inability to refresh blocks execution.
Fresh preflight is mandatory; stale, expired, or unknown state blocks execution.
OTA 404/405/501 is frozen-version evidence; preserve release/status probe context and never infer global support.
Retry creates a new Job lineage (retryOfJobId/rootJobId); never replay successful items.
/jobs/:jobId contains per-item result, attempt lineage, and redacted audit. | SIMULATED_HIGH_RISK | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:postOtaApply`
`upstream:backend/src/main.rs:900-901`
`upstream:backend/src/handlers.rs:3892-3911`
`upstream:bruno-api/post_ota_apply_restart.bru:8`
`upstream:bruno-api/post_ota_apply.bru:8`
`fixture:not-eligible-readonly-capture` |
| `postOtaCancel` | POST `/api/ota/cancel` | ota | `/instances/:id/ota`
`ota/status` | action | planned: Frozen-scope reversible command is contract-planned for a later controlled real-write acceptance phase.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)
partial:N (Single-target command has no meaningful partial result.)
policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)
unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)
owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R1; none
direct | command-current-state/write-revision/version-probe/verify-write/route-result
Refresh current state when available and bind the actor decision to its revision.
Refresh current state or require an explicit recorded revision-bound override.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Writes require outcome verification before actor-initiated retry.
Structured result returns to the owning route with a redacted audit link. | REAL_WRITE_LATER | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:postOtaCancel`
`upstream:backend/src/main.rs:904-905`
`upstream:backend/src/handlers.rs:3914-3931`
`upstream:bruno-api/post_ota_cancel.bru:8`
`fixture:not-eligible-readonly-capture` |
| `postAuthPassword` | POST `/api/auth/password` | instances-auth | `/settings/instances/:id`
`settings/auth-settings` | dedicated-auth-flow | planned: Frozen-scope high-risk operation is planned with simulation-only acceptance until controlled safety authorization exists.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)
partial:N (Single-target command has no meaningful partial result.)
policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)
unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)
owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R3; strong
dedicated-flow | auth-dedicated/auth-no-replay/auth-version-probe/new-job-lineage/auth-result
Dedicated auth endpoint, actor/session/instance rate limits, and fresh preflight of authentication state are required.
Credential state is never inferred from stale data; require actor-initiated auth flow and no replay.
Auth 404/405/501 is version evidence; do not downgrade to a generic proxy or expose credentials.
Retry creates a new Job lineage (retryOfJobId/rootJobId); never replay successful items.
Dedicated auth jobs return through /jobs/:jobId; session flows return a credential metadata-only audit result and link. | SIMULATED_HIGH_RISK | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:postAuthPassword`
`upstream:backend/src/main.rs:908-909`
`upstream:backend/src/auth.rs:491-553`
`upstream:backend/src/auth.rs:43-43`
`fixture:not-eligible-readonly-capture` |
| `getAuthSettings` | GET `/api/auth/settings` | instances-auth | `/settings/instances/:id`
`settings/auth-settings` | detail | planned: Frozen-scope read has two redacted captured responses; runtime support is still decided per registered instance.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Detail resource has no collection-empty rendering.)
partial:N (Atomic detail read has no meaningful partial rendering.)
policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)
unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)
owner-switch:Y (Owner switch discards responses with a mismatched instance key.) | R0; none
direct | query-capability/auth-no-replay/auth-version-probe/auth-actor-only/auth-result
Registered instance, authorized actor, and runtime capability decision are required.
Credential state is never inferred from stale data; require actor-initiated auth flow and no replay.
Auth 404/405/501 is version evidence; do not downgrade to a generic proxy or expose credentials.
No automatic replay; require an actor-initiated dedicated flow.
Dedicated auth jobs return through /jobs/:jobId; session flows return a credential metadata-only audit result and link. | REAL_READ | captured-readonly; n=2; categories=success,unsupported; collector-selected fully-bound GET R0; two redacted real captures | `registry:getAuthSettings`
`upstream:backend/src/main.rs:912-913`
`upstream:backend/src/auth.rs:555-570`
`upstream:backend/src/auth.rs:43-43`
`fixture:captured-readonly` |
| `postAuthSettings` | POST `/api/auth/settings` | instances-auth | `/settings/instances/:id`
`settings/auth-settings` | dedicated-auth-flow | planned: Frozen-scope high-risk operation is planned with simulation-only acceptance until controlled safety authorization exists.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)
partial:N (Single-target command has no meaningful partial result.)
policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)
unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)
owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R2; explicit
dedicated-flow | auth-dedicated/auth-no-replay/auth-version-probe/new-job-lineage/auth-result
Dedicated auth endpoint, actor/session/instance rate limits, and fresh preflight of authentication state are required.
Credential state is never inferred from stale data; require actor-initiated auth flow and no replay.
Auth 404/405/501 is version evidence; do not downgrade to a generic proxy or expose credentials.
Retry creates a new Job lineage (retryOfJobId/rootJobId); never replay successful items.
Dedicated auth jobs return through /jobs/:jobId; session flows return a credential metadata-only audit result and link. | SIMULATED_HIGH_RISK | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:postAuthSettings`
`upstream:backend/src/main.rs:912-914`
`upstream:backend/src/auth.rs:572-640`
`upstream:backend/src/auth.rs:43-43`
`fixture:not-eligible-readonly-capture` |
| `getHealth` | GET `/api/health` | instances-auth | `/instances/new`
`settings/auth-entry` | detail | planned: Frozen-scope read has two redacted captured responses; runtime support is still decided per registered instance.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Detail resource has no collection-empty rendering.)
partial:N (Atomic detail read has no meaningful partial rendering.)
policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)
unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)
owner-switch:Y (Owner switch discards responses with a mismatched instance key.) | R0; none
direct | query-capability/auth-no-replay/auth-version-probe/auth-actor-only/auth-result
Registered instance, authorized actor, and runtime capability decision are required.
Credential state is never inferred from stale data; require actor-initiated auth flow and no replay.
Auth 404/405/501 is version evidence; do not downgrade to a generic proxy or expose credentials.
No automatic replay; require an actor-initiated dedicated flow.
Dedicated auth jobs return through /jobs/:jobId; session flows return a credential metadata-only audit result and link. | REAL_READ | captured-readonly; n=2; categories=success; collector-selected fully-bound GET R0; two redacted real captures | `registry:getHealth`
`upstream:backend/src/main.rs:923-923`
`upstream:backend/src/handlers.rs:65-75`
`upstream:bruno-api/get_health.bru:8`
`upstream:backend/src/auth.rs:43-43`
`fixture:captured-readonly` |
| `getAuthStatus` | GET `/api/auth/status` | instances-auth | `/instances/new`
`settings/auth-entry` | detail | planned: Frozen-scope read has two redacted captured responses; runtime support is still decided per registered instance.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Detail resource has no collection-empty rendering.)
partial:N (Atomic detail read has no meaningful partial rendering.)
policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)
unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)
owner-switch:Y (Owner switch discards responses with a mismatched instance key.) | R0; none
direct | query-capability/auth-no-replay/auth-version-probe/auth-actor-only/auth-result
Registered instance, authorized actor, and runtime capability decision are required.
Credential state is never inferred from stale data; require actor-initiated auth flow and no replay.
Auth 404/405/501 is version evidence; do not downgrade to a generic proxy or expose credentials.
No automatic replay; require an actor-initiated dedicated flow.
Dedicated auth jobs return through /jobs/:jobId; session flows return a credential metadata-only audit result and link. | REAL_READ | captured-readonly; n=2; categories=success,unsupported; collector-selected fully-bound GET R0; two redacted real captures | `registry:getAuthStatus`
`upstream:backend/src/main.rs:925-926`
`upstream:backend/src/auth.rs:345-364`
`upstream:backend/src/auth.rs:43-43`
`fixture:captured-readonly` |
| `postAuthSetup` | POST `/api/auth/setup` | instances-auth | `/instances/new`
`settings/auth-entry` | dedicated-auth-flow | planned: Frozen-scope high-risk operation is planned with simulation-only acceptance until controlled safety authorization exists.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)
partial:N (Single-target command has no meaningful partial result.)
policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)
unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)
owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R3; strong
dedicated-flow | auth-dedicated/auth-no-replay/auth-version-probe/new-job-lineage/auth-result
Dedicated auth endpoint, actor/session/instance rate limits, and fresh preflight of authentication state are required.
Credential state is never inferred from stale data; require actor-initiated auth flow and no replay.
Auth 404/405/501 is version evidence; do not downgrade to a generic proxy or expose credentials.
Retry creates a new Job lineage (retryOfJobId/rootJobId); never replay successful items.
Dedicated auth jobs return through /jobs/:jobId; session flows return a credential metadata-only audit result and link. | SIMULATED_HIGH_RISK | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:postAuthSetup`
`upstream:backend/src/main.rs:929-930`
`upstream:backend/src/auth.rs:366-427`
`upstream:backend/src/auth.rs:43-43`
`fixture:not-eligible-readonly-capture` |
| `postAuthLogin` | POST `/api/auth/login` | instances-auth | `/instances/new`
`settings/auth-entry` | dedicated-auth-flow | planned: Frozen-scope reversible command is contract-planned for a later controlled real-write acceptance phase.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)
partial:N (Single-target command has no meaningful partial result.)
policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)
unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)
owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R1; none
dedicated-flow | auth-dedicated/auth-no-replay/auth-version-probe/auth-actor-only/auth-result
Dedicated auth endpoint, actor/session/instance rate limits, and fresh preflight of authentication state are required.
Credential state is never inferred from stale data; require actor-initiated auth flow and no replay.
Auth 404/405/501 is version evidence; do not downgrade to a generic proxy or expose credentials.
No automatic replay; require an actor-initiated dedicated flow.
Dedicated auth jobs return through /jobs/:jobId; session flows return a credential metadata-only audit result and link. | REAL_WRITE_LATER | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:postAuthLogin`
`upstream:backend/src/main.rs:933-934`
`upstream:backend/src/auth.rs:429-489`
`upstream:backend/src/auth.rs:43-43`
`fixture:not-eligible-readonly-capture` |
| `postAuthLogout` | POST `/api/auth/logout` | instances-auth | `/settings/instances/:id`
`settings/auth-settings` | dedicated-auth-flow | planned: Frozen-scope reversible command is contract-planned for a later controlled real-write acceptance phase.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict. | empty:N (Command result is not a collection-empty state.)
partial:N (Single-target command has no meaningful partial result.)
policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)
unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)
owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.) | R1; none
dedicated-flow | auth-dedicated/auth-no-replay/auth-version-probe/auth-actor-only/auth-result
Dedicated auth endpoint, actor/session/instance rate limits, and fresh preflight of authentication state are required.
Credential state is never inferred from stale data; require actor-initiated auth flow and no replay.
Auth 404/405/501 is version evidence; do not downgrade to a generic proxy or expose credentials.
No automatic replay; require an actor-initiated dedicated flow.
Dedicated auth jobs return through /jobs/:jobId; session flows return a credential metadata-only audit result and link. | REAL_WRITE_LATER | not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation | `registry:postAuthLogout`
`upstream:backend/src/main.rs:937-938`
`upstream:backend/src/auth.rs:642-655`
`upstream:backend/src/auth.rs:43-43`
`fixture:not-eligible-readonly-capture` |